Find each network architecture concept hidden in the grid.
12 terms · Choose how you want to study
New to the CompTIA Security+ exam? Read our how-to-pass guide →
A perimeter network segment that exposes external-facing services while shielding the internal network.
A DMZ (screened subnet) holds internet-facing services — web, mail, DNS — between firewall boundaries so a compromise there can’t directly reach internal data. DMZ hosts should be hardened and minimally privileged; modern designs increasingly replace the single perimeter DMZ with micro-segmentation and zero-trust controls.
Virtual Private Network — an encrypted tunnel over an untrusted network.
A VPN tunnels traffic through encryption over an untrusted network — IPsec for site-to-site, TLS for remote access. Full-tunnel routes all traffic through the corporate gateway (more visibility and control); split-tunnel sends only corporate traffic through it (better performance, less visibility). ZTNA is increasingly replacing traditional VPNs, granting per-application rather than whole-network access.
An intermediary that forwards requests between client and server, enforcing policy and visibility.
A proxy mediates traffic, adding policy enforcement, caching, and visibility. Forward proxies sit between internal users and the internet (filtering and logging outbound requests); reverse proxies sit in front of servers (load balancing, TLS termination, hiding the origin). TLS-inspecting proxies enable DLP and threat scanning but require careful certificate and key management.
A layer-3 device that forwards packets between networks based on IP routing tables.
A router forwards packets between networks at layer 3 using IP routing tables. ACLs on a router give coarse, stateless filtering, while stateful, application-aware policy belongs on a firewall. Misconfigured or unauthenticated routing protocols (BGP, OSPF) cause both major outages and route hijacks that redirect or intercept traffic.
A layer-2 device that forwards frames within a local network based on MAC addresses.
A switch forwards frames within a LAN at layer 2 using a MAC address table. Classic layer-2 attacks include MAC flooding (overflowing the table to force hub-like broadcasting) and ARP poisoning (to set up man-in-the-middle). Defenses include 802.1X port authentication, port security, DHCP snooping, dynamic ARP inspection, and VLANs.
A network security device that filters traffic based on rules; modern variants inspect application-layer content.
Packet-filter firewalls judge each packet in isolation; stateful firewalls track connection state and permit return traffic for established sessions; next-gen firewalls (NGFW) add application awareness, integrated IDS/IPS, and TLS inspection. A default-deny posture — explicitly allowing only required traffic, increasingly including outbound — is the zero-trust baseline.
Intrusion Detection System — monitors and alerts on suspicious activity but does not block.
An IDS sits out-of-band (on a SPAN port or tap) and only alerts, so it can’t drop traffic but also can’t cause an outage; an IPS sits in-line and can block. Signature-based detection catches known patterns but misses novel attacks; anomaly/behavior-based detection catches unknowns at the cost of more false positives.
Intrusion Prevention System — like IDS but in-line and able to drop malicious traffic.
An IPS extends IDS by sitting in-line and dropping malicious traffic in real time. Because it’s in the data path, false positives cause outages — so tune signatures carefully (often starting in detect/alert mode) before enabling block mode. Modern NGFWs commonly bundle IPS as one feature set.
Transport Layer Security — encrypts and authenticates data in transit (HTTPS and beyond).
TLS encrypts and authenticates data in transit (HTTPS, SMTPS, and more), using a certificate to authenticate the server and negotiate a session key. Require TLS 1.2 at minimum and prefer 1.3, disabling legacy versions and weak ciphers. Mutual TLS (mTLS) authenticates both ends and underpins zero-trust service meshes.
A suite of protocols that secure IP traffic at the network layer — common in site-to-site VPNs.
IPsec secures traffic at the network layer and underpins most site-to-site VPNs. Tunnel mode encrypts the entire original packet (gateway-to-gateway); transport mode encrypts only the payload (host-to-host). Within IPsec, AH provides authentication and integrity only, while ESP provides confidentiality plus integrity — ESP is the one normally used.
Web Application Firewall — filters HTTP/HTTPS traffic to protect web apps from OWASP-class attacks.
A WAF inspects HTTP/HTTPS to block OWASP-class attacks like SQL injection and XSS that network firewalls can’t see. It complements — never replaces — secure coding and input validation. WAFs can run per-rule in detect, block, or log-only mode, letting teams tune rules before enforcing them.
Network Address Translation — maps private addresses to public ones at a network boundary.
NAT maps private (RFC 1918) addresses to public ones at the boundary, conserving public IPv4 and incidentally hiding internal addressing. It is not a security control on its own — inbound connections are merely unmapped, not filtered — so it must be paired with a firewall. PAT (port address translation) multiplexes many internal hosts onto one public IP and is what home routers do by default.
All Security Architecture sets and terms → · All CompTIA Security+ study games → · Not sure where to start? Take the CompTIA Security+ diagnostic →