5.4 Describe the components of network security design

What this section tests

Section 5.4 is a describe section. The exam wants you to recognize five design components and explain where each one fits. No single component solves the whole problem. A good design layers them.

Articles

• 5.4.a Threat defense
• 5.4.b Endpoint security
• 5.4.c Next-generation firewall
• 5.4.d TrustSec and MACsec

The five components

Campus users    802.1X or MAB -> SGT assignment -> SGACL enforcement
Switch uplinks  MACsec -> protected Layer 2 transport
Edge traffic    NGFW -> stateful and application-aware policy
Endpoints       EDR and posture -> identity context -> policy decision
Telemetry       threat defense -> detection and response

Each layer covers a different risk. If one layer fails, the others limit the damage.

Study plan

For each component, write five answers:

1. What problem does it solve?
2. Where is it deployed?
3. What information does it need?
4. What does it enforce?
5. What does it not do?

Exam traps

• TrustSec segments by group identity. It does not encrypt.
• MACsec encrypts a link. It does not assign identity.
• An NGFW uses application and user context. An ACL uses headers only.
• Endpoint security includes posture and detection, not only antivirus.
• Threat defense is a design and operations function, not one product.

Pass check

You are ready for Section 5.4 when you can do these things:

• Choose the correct component for a scenario in one sentence.
• Explain why TrustSec and MACsec solve different problems.
• Name what an NGFW adds over a stateful firewall.
• Explain how endpoint posture can change network access after login.