Missiora
Network+ Domain 4: Network Security

IT & Cyber Certifications

Network+ Domain 4: Network Security

1 min readPublished 22 Jul 2026

Track your progress. Sign in to mark this guide complete and build your Job Readiness Score.

Domain 4 covers defending the network. It overlaps heavily with CompTIA Security+, so mastering it here gives you a strong head start on your next certification.

Firewalls

Firewalls enforce what traffic is allowed using ordered rules and a default-deny stance.

Interactive explainer

How a Firewall Evaluates Traffic

Ordered rules, first match wins, everything else denied.

Incoming packetALLOW tcp/443 webALLOW tcp/22 adminDENY tcp/23 telnetDENY any → any (default)

Tap or hover a part to learn more.

Incoming packet

Src/dst IP, port, protocol.

Every packet arriving at the firewall carries a source and destination IP, a port and a protocol. The firewall checks it against an ordered rule list to decide allow or deny.

Check your understanding

1. How are firewall rules evaluated?

2. What does a default-deny policy do?

Keep learning

FirewallsNetworking Fundamentals CompTIA Network+
Practise this in AI Interview™

Access control lists

Routers and switches filter traffic with ACLs — ordered permit/deny rules ending in an implicit deny.

Interactive explainer

How an Access Control List Filters

Ordered permit/deny rules on an interface, ending in implicit deny.

11. Applied to an interface22. Evaluated top-down33. Permit or deny44. Implicit deny at the end

Tap or hover a part to learn more.

1. Applied to an interface

Inbound or outbound.

An Access Control List is applied to a router or switch interface in one direction. It filters packets as they enter (inbound) or leave (outbound) that interface.

Check your understanding

1. How are ACL entries evaluated?

2. What happens if no ACL entry matches?

Keep learning

FirewallsRouting CompTIA Network+
Practise this in AI Interview™

VPNs

VPNs protect data crossing untrusted networks with an encrypted tunnel.

Interactive explainer

How a VPN Tunnel Works

An encrypted tunnel across the untrusted internet.

Untrusted internetencryptedRemote userVPNgateway

Tap or hover a part to learn more.

Remote user / site

The endpoint.

A remote worker (remote-access VPN) or a whole branch office (site-to-site VPN) starts the connection. Without a VPN their traffic would cross the internet in the clear.

Check your understanding

1. What two things does a VPN primarily provide?

2. Which VPN type connects two whole networks?

Keep learning

VPNsFirewalls CompTIA Network+
Practise this in AI Interview™

Segmentation and zero trust

Segmenting the network limits how far an attacker can move.

Interactive explainer

Why Networks Are Segmented

From one flat network to isolated zones with controlled crossings.

Flat — one breach spreadsUser zoneServer zoneGuest zoneFirewall between zones

Tap or hover a part to learn more.

Flat network

One big zone.

In a flat network every device sits in one broadcast domain. It's simple, but a single compromised device can reach everything — one breach spreads freely.

Check your understanding

1. What is the main security benefit of segmentation?

2. How is traffic between segments controlled?

Keep learning

Switching & VLANsFirewalls CompTIA Network+
Practise this in AI Interview™

Modern designs push this further with zero trust ("never trust, always verify") and Network Access Control (NAC), which checks a device's identity and health before it's allowed on the network.

Why this domain matters

Security is now everyone's job, not just the security team's. Employers expect network professionals to build defence in from the start — least privilege, default-deny and segmentation — rather than bolting it on later.

Interview Intelligence

How this topic actually shows up in interviews — and how to demonstrate you understand it.

Why employers ask about this

Security incidents are expensive and public. Interviewers check that you build defences in by default — because a network professional who ignores security is a liability.

Junior questions
What does a firewall do?+

It controls traffic between networks using rules, allowing or denying based on source/destination IP, port and protocol, with a default-deny for anything not explicitly permitted.

Mid-level questions
How does a stateful firewall differ from a simple ACL?+

A stateful firewall tracks connection state, so return traffic for an allowed session is permitted automatically; a basic ACL is stateless and evaluates each packet independently.

Senior questions
How would you apply zero trust to a flat network?+

Segment it into zones, require authentication and device posture checks (NAC) before access, enforce least-privilege rules between segments, and monitor east-west traffic — removing the assumption that 'inside' is safe.

Real-world scenarios
“Malware on one PC has spread across the entire office network.”+

Expected answer: Root cause is a flat, unsegmented network. Explain you'd segment with VLANs/firewalls, enforce least privilege between zones, and add NAC so a single infection can't reach everything.

Common candidate mistakes
  • •Writing overly permissive 'any-any' allow rules that defeat the firewall.
  • •Forgetting egress (outbound) filtering — it matters as much as inbound.
Common misconceptions

What candidates get wrong in interviews and on the job — and what strong professionals actually do.

Myth

A firewall makes the network secure.

Reality

A firewall is one control; segmentation, access control, monitoring and patching all matter.

In interviews: 'We have a firewall' is a red flag; layered answers impress.

On the job: Flat internal networks let one compromised host reach everything.

Best practice: Combine default-deny firewalls with segmentation, least privilege and monitoring.

Why it matters: Modern threats move laterally — defence in depth is the expectation.

Practise in AI Interview™Rehearse these questions, scored.Plan with Career Coach™A personalised path to your goal.Evidence it in Career Passport™Prove this skill to employers.

Employability Intelligence

Where this knowledge takes you — the jobs, skills and certifications it feeds into.

Relevant roles
Network Security EngineerSOC AnalystNetwork Administrator
Skills you're proving
FirewallsACLsVPNsSegmentationZero trust / NAC
Recommended certifications
CompTIA Security+CompTIA Network+
Career progression

This domain is the bridge into Security+, SOC Analyst and Security Engineer roles.

What employers expect

That you design with least privilege and default-deny, and can explain how your controls limit an attacker.

Frequently asked questions

What is a default-deny policy?

A firewall stance where all traffic is blocked except what you explicitly allow — the core principle of firewall configuration.

What is zero trust?

A security model that trusts nothing by default and verifies every user, device and request, regardless of whether it's inside or outside the network perimeter.

How does network segmentation improve security?

It isolates parts of the network so a compromise in one zone can't spread freely, limiting an attacker's lateral movement.

Related guides

CompTIA Network+ (N10-009): The Complete GuideNetwork+ Domain 1: Networking ConceptsNetwork+ Domain 2: Network ImplementationNetwork+ Domain 3: Network Operations

Practise what you've learned

Turn this guide into real, evidenced progress

Missiora helps you measure, improve and evidence the capabilities employers actually value — start with the tools best suited to this topic.

M
Published by
Missiora

Missiora is an AI Employability Intelligence platform. Our resources are researched and reviewed by the Missiora team to help you measure, improve and prove your career readiness.

All resources