Network Security: Firewalls, VPNs, and Common Attacks
AP Cybersecurity — how firewalls and VPNs protect network traffic, defense-in-depth, and the network attacks tested most: DoS/DDoS, man-in-the-middle, and packet sniffing.
Networks are the attack surface most AP Cybersecurity scenario questions live on. You need to know what the standard defenses do — and exactly how the standard attacks get around them.
Firewalls
A firewall controls traffic in and out of a network based on rules.
- Packet-filtering firewall — inspects each packet's header (source/destination IP, port) in isolation. Fast, but has no memory of previous packets.
- Stateful firewall — tracks the state of a connection (e.g., "this reply matches a request I already allowed"). Can catch more, because it understands context, not just individual packets.
VPNs (Virtual Private Networks)
A VPN creates an encrypted tunnel between a device and a network over an untrusted network (like public Wi-Fi). Traffic inside the tunnel is unreadable to anyone intercepting it on the way — this protects confidentiality in transit, but a VPN does not make the endpoint devices themselves secure.
Defense-in-depth
No single defense is perfect, so security is layered: firewall + VPN + strong authentication + monitoring + employee training. If one layer fails, another is still standing. This concept is tested constantly — a scenario that shows "just a firewall and nothing else" is usually the setup for a question about a missing layer.
Common network attacks
| Attack | What happens |
|---|---|
| Denial-of-Service (DoS) | One source floods a system with traffic/requests until it can't respond to real users |
| Distributed DoS (DDoS) | Same idea, but from many sources at once (often a botnet) — much harder to block by IP |
| Man-in-the-Middle (MITM) | Attacker secretly intercepts (and possibly alters) traffic between two parties who believe they're talking directly |
| Packet sniffing | Attacker passively captures unencrypted traffic on a network to read its contents |
Worked example
A user connects to a coffee shop's public Wi-Fi and logs into their email without a VPN. An attacker on the same network captures the login credentials as they're sent. Which attack is this, and what single control would have prevented it?
This is packet sniffing — the attacker passively captured unencrypted traffic. A VPN (or the site using HTTPS encryption) would have prevented it, since the credentials would have been encrypted in transit.
Exam tip
When a question describes an attack, look for the verb: is the attacker flooding (→ DoS/DDoS), intercepting and possibly altering (→ MITM), or passively listening (→ sniffing)? Matching the verb to the attack category is the fastest way to answer correctly under time pressure.
Kısa Ders Videosu
Deneme Sınavı
Alıştırma Testi
Kendini dene: anında sonuç ve açıklama.
1. What is the main difference between a packet-filtering firewall and a stateful firewall?
2. What does a VPN primarily protect?
3. An attacker floods a server with traffic from thousands of compromised devices at once, making it unavailable. This is:
4. Why is 'defense-in-depth' an important security principle?
Bu konuda desteğe mi ihtiyacın var?
30 dakikalık ücretsiz tanışma görüşmesinde seviye belirlenir, kişiye özel bir çalışma planı kurulur.
Ücretsiz tanışma görüşmesi