Lesson 05 - Group 1: Enterprise Network Architecture

What network components operate primarily at OSI Layer 2?

Switches, wireless access points, MAC addresses, and VLANs.

What network components operate primarily at OSI Layer 3?

Routers, IP addresses, networks, and subnets.

Which protocols operate primarily at OSI Layer 4?

TCP and UDP.

What are examples of application-layer protocols?

HTTP, SMTP, SMB, FTP, and DNS.

Physical topology versus logical topology

Physical topology describes the actual nodes, links, switches, and cabling; logical topology describes how traffic, VLANs, subnets, and security zones are organized.

Hierarchical network design

Organizes switching and routing infrastructure into layers to improve scalability, limit broadcast domains, and enforce segmentation.

Broadcast domain

A group of devices that receive the same Layer 2 broadcast traffic.

Subnet

A logical Layer 3 division of an IP network identified by a network prefix or subnet mask.

VLAN

Virtual LAN; maps Layer 2 switch ports to a logical Layer 3 subnet independently of their physical switch location.

What is the primary security benefit of VLANs and subnets?

They segment systems and allow traffic between segments to be controlled.

Security zone

A network segment containing hosts with similar access-control and security requirements.

Why should database, client, public-facing, and infrastructure systems be placed in separate security zones?

To compartmentalize assets and restrict unnecessary communication between systems with different security requirements.

Attack surface

The points where a threat actor may gain access to a network or system.

Defense in depth

Using layered security controls across network boundaries, internal zones, and endpoints rather than relying on a single control.

What architectural weaknesses can increase network risk?

Single points of failure, complex dependencies, weak documentation or change control, and overdependence on perimeter security.

Air gap

Physical isolation in which a host or network is not connected to any other network.

What is a major disadvantage of an air-gapped network?

It is difficult to manage and may require updates to be transferred through removable media.

What major factors should be considered when selecting a network architecture?

Cost, responsiveness, scalability, availability, resilience, power, patch availability, and risk transference.

Availability versus resilience

Availability minimizes downtime; resilience reduces the time and difficulty required to recover from a failure.

Risk transference

Shifting some infrastructure risk to a third party through contracting or outsourcin