A good security control directly changes the risk described in the requirement
Network security controls are not interchangeable. Firewalls, encryption, authentication, segmentation, logging, patching, backups, policy, and physical protection all reduce risk in different ways. The strongest AP Networking answer does not stop at naming a technology. It explains which risk is being changed, how the control changes it, what the control does not prove, and how the result should be verified.
Security controls can be classified by what they do and by how they are implemented
By function
Preventive, detective, deterrent, corrective.
By implementation
Technical, administrative, physical.
By scope
Endpoint, network segment, identity, facility, application, or organization.
A firewall deny rule is technical and preventive. A security policy is administrative and may support prevention or deterrence. A locked network closet is physical and preventive. These classifications answer different questions, so do not treat them as mutually exclusive.
Preventive controls attempt to stop the unwanted event before it succeeds
Examples include firewall and ACL rules, network access control, strong authentication, MFA, segmentation, secure configuration, patching, disabling unnecessary services, and restricting management access.
| Requirement | Preventive control | Mechanism |
|---|---|---|
| Stop guests reaching payroll | Firewall + segmentation | Blocks cross-zone traffic |
| Stop password-only login | MFA | Requires another authentication factor |
| Stop unknown devices joining production | NAC/802.1X | Restricts network admission |
| Reduce exploitability | Patching | Removes known vulnerabilities |
Swipe horizontally to see the preventive-control table.
Detective controls make security events visible
Logs, IDS alerts, SIEM correlation, authentication-failure monitoring, change auditing, traffic monitoring, and configuration drift detection are detective because they create evidence.
If the account is automatically locked after the threshold, the lockout is an additional preventive control.
Corrective controls restore the system after the event
Restoring a known-good configuration, recovering from backup, rebuilding a compromised host, rotating exposed credentials, and applying a fix after an incident are corrective actions.
Deterrent controls influence behavior rather than enforce packet-level access
Warning banners, visible monitoring, posted policy notices, and visible security cameras can discourage misuse by increasing perceived consequences and accountability.
Technical controls enforce policy through systems and protocols
Firewalls, NAC, MFA, encryption, endpoint security, access-control lists, VPNs, IDS/IPS, and security configuration are technical controls because software or hardware implements the control.
Technical does not tell you whether the control is preventive or detective. A firewall deny is preventive; firewall logging is detective. One platform can support both.
Policies and processes shape how technology is configured and used
Acceptable-use policy, change-control procedures, incident-response plans, account-review procedures, onboarding/offboarding, training, and approval workflows are administrative controls.
A strong design connects administrative policy to technical enforcement. A written rule that “only network administrators may access the management VLAN” is much stronger when firewall and identity controls enforce it.
Physical security protects the infrastructure the network depends on
Locked equipment rooms, protected wiring closets, rack locks, controlled building access, surveillance, and environmental protections reduce physical tampering or theft.
Logical security cannot compensate for every physical risk. If anyone can unplug the core switch, replace the router, or attach rogue hardware to an exposed patch panel, technical policy can be bypassed or disrupted.
Grant only the access required for the specific task
Least privilege is a design principle applied to users, devices, services, ports, and network paths. If a printer needs to receive print jobs, it does not automatically need access to the management network. If a student needs web access, that does not justify SSH access to servers.
Good controls enforce the narrow requirement without opening unrelated access.
Segmentation creates security boundaries before traffic reaches the target
Separate guest, student, IoT, management, and server populations can reduce unnecessary lateral movement. Segmentation alone creates structure; firewall or ACL policy determines what is allowed between segments.
| Source zone | Destination | Policy |
|---|---|---|
| Guest | Internet | Allow web/DNS as required |
| Guest | Payroll subnet | Deny |
| Management | Switches/APs | Allow approved admin protocols |
| IoT | Management | Deny |
Swipe horizontally to see the segmentation table.
Firewall and ACL controls should match the exact required flow
Source, destination, protocol, port, direction, zone, and connection state can all define policy. Broad “allow any” rules may make troubleshooting seem successful while increasing risk.
Verification should include one allowed-path test and one blocked-path test.
Authentication proves identity before access is granted
Passwords, certificates, MFA, 802.1X, and other methods establish identity or device trust. Strong authentication addresses the risk of unauthorized login, but it does not automatically restrict what an authenticated user can do afterward.
Authentication and authorization are separate controls: one answers “Who are you?” and the other answers “What are you allowed to access?”
MFA reduces the value of a stolen password
If a password is compromised but the attacker cannot satisfy the second factor, the authentication attempt can still fail. MFA therefore reduces single-credential risk.
Encryption protects confidentiality but does not replace access control
TLS, VPN encryption, encrypted storage, and secure management protocols reduce exposure of readable data. Encryption is the direct answer when the risk is plaintext credentials or readable traffic being observed.
But an authorized user can still read data they are permitted to access. Encryption does not replace authentication, authorization, segmentation, or patching.
Patching removes known vulnerabilities before they can be exploited
Patching is preventive when it closes a known exploitable flaw. Good patch management also includes inventory, version tracking, testing, maintenance windows, verification, and rollback planning.
“Fully patched” is not the same as “invulnerable.” It supports only that known addressed vulnerabilities have been remediated according to the current patch state.
Detection and prevention separate when you ask what happens to the traffic
IDS
Detects suspicious patterns and generates alerts or evidence.
IPS
Can actively block, drop, or disrupt traffic that matches policy.
Key question
Did the control only observe, or did it actually stop the flow?
Detection quality depends on context, thresholds, and response
A security log should identify time, source, destination or account, action, and outcome. A SIEM can correlate events across systems and generate alerts.
An alert that is never reviewed has limited operational value. Detective controls need a response process.
Monitoring can detect both security and operational anomalies
Availability monitoring can reveal outages. Bandwidth monitoring can identify unusual usage. Configuration monitoring can detect unauthorized changes. Authentication monitoring can reveal brute-force behavior.
These controls do not stop the event by themselves, but they provide evidence that can trigger response.
Backups support correction only when they are current, protected, and restorable
A backup that cannot be restored is not an effective recovery control. Configuration backups, server backups, and protected recovery copies should be verified periodically.
Multiple controls cover different failure modes
Consider one internal application. Segmentation limits reachability. Firewall rules narrow allowed ports. MFA protects login. TLS protects traffic confidentiality. Patching reduces exploitable flaws. Logging provides evidence. Backups support recovery.
Defense in depth is useful because no one layer solves every risk.
When the ideal control is unavailable, reduce the same risk through other layers
A legacy system may not support MFA. Instead of leaving it broadly reachable, require VPN first, restrict access to a management subnet, limit source addresses with firewall policy, and log every login.
These controls do not make the legacy system modern, but they reduce exposure while preserving required functionality.
Guests must browse the Internet but never reach payroll
Use segmentation and firewall policy to separate guest traffic from internal services.
Primary function: preventive. Verification: guest web/DNS works, guest-to-payroll fails.
Security team must know when one account fails login 50 times
Use authentication logging plus an alert threshold.
Primary function: detective. If an automatic lockout is added, that additional action is preventive.
Prevent plaintext credential capture on management traffic
Use encrypted management protocols such as HTTPS or SSH rather than plaintext alternatives.
Primary control: technical protection of confidentiality. Logging would tell you a connection occurred, but it would not prevent credential exposure.
Restore a switch after configuration corruption
Use a verified configuration backup and documented recovery procedure.
Primary function: corrective. Prevention would require different controls such as change management, authentication, and configuration protections.
Stop unmanaged laptops from receiving production LAN access
Use 802.1X or NAC to authenticate and assess the endpoint before placing it into the normal production network.
Primary function: preventive. Quarantine logging can also provide detective evidence.
Choose the control that directly changes the stated risk
| Risk | Direct control | Why |
|---|---|---|
| Guests can reach internal servers | Segmentation + filtering | Changes reachability |
| Passwords visible on network | Encryption | Protects confidentiality in transit |
| Repeated failed logins go unnoticed | Logging/monitoring | Creates detection evidence |
| Known vulnerability remains exploitable | Patching | Removes flaw |
| Compromised config must be recovered | Backup/restore | Restores known-good state |
Swipe horizontally to see the control-selection table.
Where a control is placed determines what it can influence
A host firewall protects one endpoint. A network firewall can mediate traffic between many segments. NAC acts during network admission. IDS sees only the traffic available at its monitoring point. A locked closet protects the equipment inside that physical boundary.
When a question includes topology, connect the control to the place where it can actually enforce or observe the requirement.
One successful control does not prove the whole network is secure
| Evidence | Supports | Does not prove |
|---|---|---|
| MFA blocks password-only login | Single-password risk reduced | No account misuse is possible |
| Firewall denies guest-to-payroll | That path is blocked | All lateral movement is impossible |
| TLS encrypts traffic | Confidentiality in transit | Endpoint is uncompromised |
| IDS alert fires | Suspicious activity was detected | Traffic was blocked |
| Backup restores successfully | Recovery works | Original event was prevented |
Swipe horizontally to see the evidence-boundary table.
Security controls should preserve authorized behavior while blocking prohibited behavior
Positive test: management users can still reach the required admin service.
Negative test: student and guest networks cannot reach that same service.
Detection test: generate a known failed login and confirm the expected log/alert appears.
Recovery test: restore a known backup in a controlled process and verify service state.
Most mistakes come from choosing a related control instead of the direct one
- Logging does not prevent plaintext credential capture.
- Encryption does not replace authorization.
- Backups do not prevent the original compromise.
- A firewall does not replace patching.
- An IDS alert does not mean the attack was blocked.
- Least privilege is a design principle, not one product.
- Administrative policy is stronger when technical controls enforce it.
Build the answer from requirement, control, mechanism, and verification
Requirement: what exact risk must change?
Control: which control directly addresses it?
Function: preventive, detective, deterrent, or corrective.
Type: technical, administrative, or physical where relevant.
Mechanism: explain exactly how the control changes the risk.
Boundary: state what the control does not prove.
Verification: test the required outcome directly.
One security requirement can depend on several controls operating together
Suppose the requirement is to let administrators manage switches remotely without exposing management interfaces to students or the public Internet. No single control satisfies the whole requirement. Segmentation defines a management zone. Firewall rules restrict who can reach it. VPN or secure remote access protects the path. MFA strengthens administrator authentication. Logging records access attempts. Configuration backups support recovery if the device is misconfigured.
This dependency view prevents the common mistake of selecting one familiar technology and assuming the entire risk is solved.
Controls can fail because of scope, configuration, placement, or maintenance
A firewall rule can be technically correct but applied to the wrong interface. An IDS can be perfectly configured but unable to see encrypted or off-path traffic. MFA can protect administrator login while a shared service account still uses a password only. A backup can exist but be too old to restore the current configuration.
| Control | Failure mode | Verification evidence |
|---|---|---|
| Firewall | Rule on wrong zone/interface | Test exact source/destination flow and inspect logs |
| IDS | Sensor cannot see traffic | Generate known event and confirm alert |
| MFA | Only some accounts protected | Audit authentication policy by account class |
| Backup | Stale or un-restorable copy | Controlled restore test |
| NAC | Fallback path bypasses admission | Test unauthorized endpoint on each access path |
Swipe horizontally to see the control-failure table.
A stronger security control can create availability or usability costs that must be managed
Security controls are not free of operational impact. Aggressive lockout rules can block legitimate users. Strict segmentation can break required application dependencies. Deep packet inspection can reduce throughput. Very short session timeouts can frustrate administrators. The right design still prioritizes security requirements, but it should make the tradeoff explicit.
On an AP Networking scenario, a strong answer states both sides: what risk the control reduces and which required behavior must remain functional. That naturally leads to positive and negative verification rather than one-sided testing.
A shared infrastructure control can protect many endpoints—or expose many endpoints if misconfigured
A gateway firewall, central authentication service, NAC platform, or DNS security control can affect many clients simultaneously. That makes shared controls efficient, but it also raises the impact of mistakes. A broad firewall allow rule can expose an entire subnet. A broken NAC policy can deny many users. A compromised central identity provider can affect multiple services.
When the control is shared, the troubleshooting scope matters. If one client fails, inspect endpoint-specific state first. If an entire trust zone changes behavior at once, shared policy becomes a stronger suspect.
Compare intended policy, actual configuration, and observed behavior
A useful audit does not stop at reading the written policy. It compares three things: what should happen, what the device is configured to do, and what a controlled test proves actually happens.
The contradiction is valuable evidence. Either the control is not being enforced as intended or the documentation/configuration view is incomplete.
24 Network Security Controls digital flashcards
Practice preventive, detective, corrective, deterrent, technical, administrative, and physical controls; least privilege; segmentation; firewalls; NAC; MFA; encryption; patching; IDS/IPS; logs; backups; defense in depth; and verification.