What Does the Defense Do?

About this interactive

What each defense in the lesson does: - **IDS:** detects a suspected intrusion and flags it; the traffic still gets through. - **IPS:** detects it and blocks it. It can also block legitimate traffic it misjudges, which is why some teams start with an IDS. - **Network access control:** checks a device (who it is, its patches and antivirus) before it joins; **zero trust** keeps checking it while it is connected. - **Port security:** a switch port allows or refuses devices, for example by MAC address. - **Screened subnet (DMZ):** public servers sit in their own network, so the internal network never opens to the outside. - **Honeypot:** a decoy that lures attackers and lets you study them, away from real data. - **Management network:** device management on its own segment, out of reach of user networks. **Defense in depth:** several layers, so when one fails, another still stands.

What you'll learn

Predict what a network defense does when it meets traffic or a device: an IDS, an IPS, network access control, port security, a screened subnet, a honeypot or a segmented management network
Predict how zero trust and defense in depth behave: a device is checked again while connected, and one failed layer leaves others standing

Aligned to

CompTIA Network+

4.1 Explain the importance of basic network security concepts.

4.3 Given a scenario, apply network security features, defense techniques, and solutions

Cisco CCST Cybersecurity

2.3 Describe network infrastructure and technologies

Key terms

Intrusion Detection System: A system that monitors network or system activities for malicious behavior and generates alerts.
Intrusion Prevention System: A system that monitors network traffic and actively blocks detected threats in real time.
Network Access Control: Network Access Control enforces security policy on devices attempting to connect to a network, verifying compliance with posture requirements such as patch level, antivirus status, and certificate validity before granting access.
Zero Trust: A security model that assumes no user or device is trusted by default and requires continuous verification.
Screened Subnet: A dedicated network segment that hosts publicly accessible services, isolating them from the internal network so that a compromised host cannot directly access internal resources.
Honeypot: A decoy system or network designed to attract and detect attackers while logging their activity.
Port Security: A Cisco switch feature that restricts which devices can connect to a port by limiting the number of allowed MAC addresses or requiring specific MAC addresses to be present. When a violation occurs, the port can be configured to shut down, restrict traffic, or send an alert.
Defense-in-Depth: Defense-in-Depth is a security architecture strategy that layers multiple independent controls across technical, physical, and administrative domains so that the failure of any single control does not result in a complete security breach.

Topics

Network Security Ids Ips Nac Zero Trust Screened Subnet Honeypot Interactive Predict

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →