Security+ exam prep: security architecture
You design secure network zones, build firewall rules and encrypted tunnels, classify and protect data and test recovery from backup.
Level 201 · 16 lessons · 12 practice labs
Lessons
Architecture models
- Security of architecture models: on-premises, virtualisation, containers, embedded systems
- The special risks of industrial control and embedded systems
- Examining container isolation: namespaces and capabilities
- Design trade-offs: cost, availability, patchability
- Short task: sketch a factory’s network segmentation
Secure infrastructure
- Security zones: DMZ, internal network, management network
- Writing firewall rules between zones
- Proxies, IDS and IPS: where they go and what they catch
- Remote access: building an encrypted tunnel with WireGuard
- Port security, 802.1X and network access control
- Short task: design the network for a three-tier web application and write its rules
Protecting data and resilience
- Data types and classification: confidential, personal, trade secret
- Protecting data: encryption, masking, hashing and tokenisation
- Resilience: redundancy, load balancing and backup sites
- Testing the backup plan: restore time and lost data
- Capstone: design and build a small clinic’s secure architecture
Practice labs
- Open only web traffic to the DMZ: You write an nftables rule on the gateway allowing only 443 from outside to the DMZ web server and test it.
- Only the app server may reach the database: You adjust inter-zone rules so that only the app server reaches the internal database on its specific port.
- Lock down the management network and log it: You leave access to the management zone only from the jump host, log denied attempts and test from three sources.
- Bring up a WireGuard tunnel between two peers: You generate keys, bring up a WireGuard tunnel between two lab machines and ping across it.
- Tunnel only internal traffic for a remote worker: You route only the remote worker's company-subnet traffic through the tunnel and verify internet traffic goes out directly.
- Revoke a lost laptop's VPN access: You remove the stolen laptop's peer, rotate keys without cutting other users and prove the old key can no longer connect.
- Inspect a container's capabilities: You list which Linux capabilities and namespaces a running container has and mark the needless ones.
- Restart a container with least privilege: You run a service that ran as root with all capabilities as an unprivileged user with a read-only file system and reduced capabilities.
- Prove and close a privileged container risk: You show in the lab that a privileged container can reach the host disk, fix the configuration and verify access is closed.
- Sort files into classification levels: You label the files in Lalezar Tekstil's share as public, internal, confidential or personal data by their content.
- Mask personal data in a test dataset: You write a script that masks ID numbers, phones and emails in a customer table dump while keeping their format.
- Measure recovery time from an encrypted backup: You encrypt a database backup, move it to a remote directory, restore it in a disaster scenario and calculate recovery time and data loss.
About this course
You design secure network zones, build firewall rules and encrypted tunnels, classify and protect data and test recovery from backup.
What you will learn
- Architecture models
- Secure infrastructure
- Protecting data and resilience
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.