Network & Endpoint Security Masterclass: Architecture, Segmentation, Firewalls, Zero Trust & EDR/XDR

This kit is a structured exam-preparation and audit-awareness summary of network and endpoint security. It follows the loop Map → Inventory → Harden → Segment → Monitor → Respond, and applies Prevent, Detect, Respond and recover thinking throughout. It aligns with ISO/IEC 27001 network and endpoint controls and ISO/IEC 27033, and always asks what an auditor would test.

What is inside:

The big picture: control every link and device, with the auditor’s rule that gaps in mapping or inventory make later tests unreliable. Infrastructure and architectures: LAN, WAN, WLAN, SAN and IoT, with main risks and control emphasis, plus how the device layer (switch, router, proxy) decides the control. Services and protocols: swapping cleartext for encrypted (HTTP to HTTPS, Telnet to SSH, FTP to SFTP, SNMPv1/v2c to SNMPv3, plain LDAP to LDAPS, internet-exposed RDP to a gateway or VPN with MFA), and shared services such as DNS, DHCP, directory and PKI. Remote and wireless access: VPN risks and controls (stolen credentials, unmanaged devices, split tunnelling, dormant accounts) and wireless security with WPA3 or WPA2-Enterprise and 802.1X. Firewalls, DMZ and IDS/IPS: the zone model (Internet, DMZ, application, data), firewall types (network, web app, next-generation, cloud security group), and IDS versus IPS tuning. Segmentation and zero trust: request → identity → context → decision → resource, default-deny zones, why VLANs alone enforce nothing, and microsegmentation against lateral movement. Endpoint defence: application control, anti-malware, disk encryption, device control, MDM and browser and email hardening, plus EDR (isolate, kill, quarantine) and XDR (linked signals into one incident). Defence in depth and audit: a layered control table, design versus operating effectiveness, and a case study where phished VPN credentials, an unmanaged laptop and a flat network exposed customer data. Key takeaways: know what you have, limit trust, and prove it with evidence.

Who it is for: CISA candidates, IS auditors, network and security engineers, IT risk and compliance professionals, and security managers.

How to use it: use it as an exam-prep revision guide, an audit checklist for network and endpoint reviews, a control-selection reference and a team training resource. It helps you find the control gap and choose the BEST answer: the one that swaps in an encrypted protocol, segments the network or proves operating effectiveness, not just adds monitoring.