Key Idea: Network security works in layers: a firewall controls what crosses the boundary, encryption protects what travels, and certificates prove who is at the far end. None of the three is sufficient alone.
Paper 1
- Naming devices, protocols and topologies.
- Distinguish questions — router vs switch, LAN vs WAN.
Paper 2
- Scenario design: choose a topology or a medium.
- Transfer-time and subnet calculations.
Both
- Selection questions want a justification against the alternative.
- Say what would go wrong with the option you rejected.
🧱 Firewalls
How one decides
- It reads the packet's header — source and destination address, port, protocol
- It compares those against its rule list, IN ORDER
- The first rule that matches decides: forward, or drop
- A final catch-all rule handles anything that matched nothing
Important: A broad rule placed early overrides every more specific rule below it. 'Permit all outbound' above 'block social media' means social media is never blocked — and nothing in the configuration looks wrong, because the later rule is simply never reached.
| Packet filter | Stateful firewall | |
|---|---|---|
| Judges | Each packet alone | Packets in the context of a connection |
| Can tell a reply from an unsolicited packet? | No | Yes |
| Consequence | Must leave wide ranges open | Can default to blocking everything inbound |
Block unless a rule permits, rather than permit unless a rule forbids. Nobody can list every threat in advance, so default-deny fails the safe way: a mistake blocks something legitimate, which is noticed and fixed — rather than silently admitting something harmful.
🔐 Encryption
| Symmetric | Asymmetric | |
|---|---|---|
| Keys | One, shared by both | A public and a private key |
| Speed | Fast | Far slower |
| The problem | How is the key shared safely? | Solves exactly that |
| Used for | The bulk of the session data | Agreeing the session key |
Asymmetric encryption solves the problem of two strangers agreeing a secret, but it is far too slow for every byte. So it is used only at the start, to agree a symmetric key, and the rest of the session is encrypted symmetrically at speed.
📜 Certificates and signatures
What a certificate is for
- A public key alone proves nothing — anyone can publish one and claim to be a bank
- A certificate binds a public key to a verified identity
- It is signed by an authority the browser already trusts
- The browser checks the name, the dates, the revocation status and the signature chain
To encrypt for someone, use their public key. To sign, use your private key — because only you hold it, so only you could have produced something your public key verifies. Getting these the wrong way round is the classic error.
Important: A certificate warning usually means the connection is still encrypted — what has failed is the proof of who is at the other end. The risk is not eavesdropping but talking to the wrong party entirely.
📝 Exam-style questions
A firewall's rules are, in order: (1) permit all traffic to port 443, (2) block traffic to the address 203.0.113.9, (3) deny all. Determine what happens to a request to 203.0.113.9 on port 443, and state the fix.
🔒 Model answer plan
See the mark-by-mark plan — for / against / judgement, with marking guidance — in study mode.
A school's public website is compromised by an attacker. Explain how placing it in a DMZ limits the damage, and why the school still needs the site to be reachable.
🔒 Model answer plan
See the mark-by-mark plan — for / against / judgement, with marking guidance — in study mode.
Explain why a browser shows a warning when a certificate's name does not match the address typed, even though the connection may still be encrypted.
🔒 Model answer plan
See the mark-by-mark plan — for / against / judgement, with marking guidance — in study mode.
✅ Quick check
Cover the answers.
A firewall's rules are tested in what order? In order, first match wins. A broad rule early hides everything below it.
What does default-deny mean, and why is it safer? Block unless explicitly permitted. It fails safe: an oversight blocks something legitimate (noticed) rather than admitting something harmful (not noticed).
Which key do you use to encrypt a message FOR someone? Their public key — only their private key can undo it.
Which key do you sign with? Your private key — only you hold it, so only you could have produced it.
Name one thing a firewall cannot protect against. An infected laptop already inside, a malicious attachment over permitted web traffic, or encrypted traffic it cannot inspect.
Exam tips
- Rules are read IN ORDER and the first match wins — put specific rules above general ones.
- Default deny fails safe; default allow admits every threat nobody thought of.
- Encrypt with the recipient's PUBLIC key; sign with your own PRIVATE key.
- A secure connection uses asymmetric to agree a key, then symmetric for speed.
- A certificate warning means identity is unproven, not that the traffic is in the clear.
- A firewall only sees traffic crossing the boundary — say so when asked for its limits.