14.2 Operate and Configure Network-Based Security Appliances and Services

Operate and configure the Domain 6 appliance set

Knowledge Area 6.5 — Operate and configure network-based security appliances and services — is the SSCP outline's inventory of what you turn on after 6.4 told you where to put it. The bullets are firewalls and proxies (filtering methods, web application firewall (WAF), cloud access security broker (CASB)), network intrusion detection/prevention systems, routers and switches, traffic-shaping devices (wide area network (WAN) optimization, load balancing), Network Access Control (NAC), Data Loss Prevention (DLP), and Unified Threat Management (UTM).

You will not be asked to recite a SKU. You will be asked which function stops SQL injection when port 443 is already open, why a network intrusion detection system (NIDS) on a TAP did not contain ransomware command-and-control (C2), and whether a branch UTM is the same as a layered data-center design.

Firewalls and proxies: filtering methods, WAF, and CASB

A firewall is a policy enforcement point that permits or denies traffic between trust boundaries. How it decides is the filtering method.

Stateful versus next-generation is a frequent CAT contrast. Stateful is the minimum for a perimeter in 2026: track Transmission Control Protocol (TCP) (and often User Datagram Protocol (UDP)/ICMP) so that only return traffic for an allowed flow passes. Next-generation is what you need when the stem says the attacker used port 443 for a disallowed application, or when policy is tied to a user in Active Directory rather than a subnet. Do not say NGFW "replaces" WAF. A NGFW may have HTTP signatures; a WAF is built to understand cookies, sessions, and injection in the application you published.

Proxies sit in the middle on purpose. A forward proxy is for clients: users (or IoT) must use it to reach the Internet, which gives you URL filtering, authentication, and a place to hang DLP. A reverse proxy is for servers: the Internet hits the proxy, which terminates Transport Layer Security (TLS) and forwards to the application — often the same box as a WAF or load balancer. TLS intercept (a corporate root in the trust store) lets the proxy see inside HTTPS; it also means you no longer have end-to-end TLS to the real server. That is an explicit trade, not a default.

WAF. If the public patient portal is already allowed on TCP/443 through a stateful firewall, SQL injection in the login form never hits a port rule. The WAF (or equivalent application-layer inspection) is the control that parses the request and drops ' OR 1=1 --. Pair it with patched code; a WAF is a compensating and detective/preventive layer, not a license to ignore Open Web Application Security Project (OWASP) findings.

CASB. Shadow IT is a 6.5 problem when users upload a clinic schedule to a personal SaaS drive. CASB in proxy/forward mode can block the upload in line. CASB in API mode inventories files already in the sanctioned tenant and can revoke links, but it will not stop an unsanctioned app it never sees. If the stem is "stop tomorrow's upload to an unsanctioned cloud," you need traffic steering to a proxy-mode CASB or an equivalent secure web gateway, not only an API connector.

Scenario — port 443 is not a WAF. The stateful firewall allow-list for the DMZ is tcp any public-ip eq 443. Penetration testers SQLi the login and dump a table. Leadership asks why the firewall failed. It did not fail: it allowed HTTPS, which is what you asked. The missing appliance is a WAF (and the missing process is application testing). Do not open more ports "so the app can fail over."

Network IDS and IPS: alert versus block

Network intrusion detection systems (NIDS) and network intrusion prevention systems (NIPS) inspect traffic for exploits, malware callbacks, policy violations, and sometimes anomalies. The outline groups them; the operations difference is placement and action.

Signature detection matches known patterns. Anomaly / behavioral detection flags deviation from a baseline (useful for low-and-slow; noisy if the baseline is wrong). Heuristic engines score suspicious traits. Encrypted traffic is the shared blind spot unless you decrypt at a proxy/firewall or use telemetry (JA3, Server Name Indication, destination reputation) that does not need payload. Fail-open versus fail-closed on an inline IPS is the same availability conversation as 6.4: pharmacy cabinets versus PCI.

Scenario — IDS in tap mode missed a block. The SOC NIDS, on a TAP in front of the Internet edge, signatures C2 to a known botnet. Analysts see the alert ninety seconds in. The workstation keeps the session up for twenty minutes because the TAP cannot drop. A junior analyst "raises severity" on the rule; the TAP still cannot drop. The SSCP fix is not a louder syslog. Place NIPS (or enable prevent on the firewall that is already inline) so the matching flow dies. Keep the TAP NIDS if you want a detection copy that cannot take the clinic offline. Write the runbook so "we detected it" is not recorded as "we blocked it."

False positives on inline IPS are an availability incident. Tune in detect mode, then promote prevent for rules you trust. That is operations, not cowardice.

Routers and switches as security devices

Routers and switches are in 6.5 because they enforce a surprising amount of policy if you configure them, and they become attacker platforms if you do not.

Routers (Layer 3): extended ACLs, unicast Reverse Path Forwarding (uRPF) to drop spoofed sources, routing-protocol authentication (OSPF/BGP MD5 or better), CoPP, disable unused services, SSH only. A router is not a NGFW, but a WAN edge with no uRPF is how spoofed DDoS leaves your network.

Switches (Layer 2): port security (MAC limits), DHCP snooping, Dynamic ARP Inspection (DAI), IP Source Guard, storm control, BPDU guard, disable unused ports, native-VLAN hygiene from 6.4. 802.1X at the port is the 6.3 protocol; the switch is the authenticator appliance in 6.5. A switch with all ports trunked and default native VLAN 1 is how VLAN hopping works.

Traffic-shaping: WAN optimization and load balancing

Traffic-shaping devices in the outline include WAN optimization and load balancing. They are availability and performance tools that become security tools — or security holes — depending on configuration.

Load balancers also absorb some volumetric distributed denial of service (DDoS) by spreading and by sitting behind a content delivery network (a 6.2 countermeasure). They are not IPS. A health-check path that bypasses the WAF is a finding.

NAC, DLP, and UTM

Network Access Control (NAC) decides whether a device may use the LAN/WLAN after 6.3 authentication. Pre-admission: 802.1X or captive portal before a production VLAN. Post-admission: posture (patch, disk encryption, agent) and quarantine VLAN if the laptop fails. Agent-based posture is richer; agentless (scan, DHCP fingerprint) is what you use for the badge printer that cannot run an agent — which is how IoT sneaks on unless you have a separate policy. NAC is not a firewall for east-west once the device is on the production VLAN; pair it with segmentation.

Data Loss Prevention (DLP) on the network watches egress channels: SMTP, HTTP/HTTPS (with intercept), FTP/SFTP, sometimes cloud API. It looks for personally identifiable information (PII), protected health information (PHI), primary account numbers (PAN), source code. Endpoint DLP is Domain 7. Network DLP misses what never hits the sensor (USB, already-encrypted personal tunnel). False positives (a training file of fake PANs) will train analysts to click ignore; tune dictionaries and stage in monitor before block.

Unified Threat Management (UTM) combines firewall, IPS, URL filter, anti-malware, and often VPN on one appliance — the branch-office default. Strength: one policy, one vendor, one rack unit. Weakness: one blast radius, one inspection engine that is rarely best-of-breed at WAF and IPS and DLP, and a failover story you must actually test. A hospital data center that replaced a layered firewall/WAF/IPS design with a single UTM "to simplify" has concentrated risk. UTM is a valid 6.5 answer for a small site; it is a weak answer when the stem describes a high-assurance app tier.

Putting the rack together

A typical edge: NGFW (stateful + app-ID) inline, WAF in front of published HTTP, CASB or secure web gateway for user-to-cloud, NIDS on a TAP for a detection copy, NAC at the access switch, network DLP on mail and web egress, load balancer for the portal, WAN optimizer on the clinic circuit after you know what it encrypts. The CAT item will remove one of those and ask what failed.

Scenario — UTM as the only box. A 40-person branch uses a UTM for firewall, IPS, URL filter, and VPN. That can be correct. The same design at the health-system core, with SQL injection on the patient portal, is not: you still need application-layer HTTP inspection (WAF), not a louder UTM "unified" profile on port 443.

When you sit 6.5, name the filtering method and the placement. Stateful versus next-gen is about what the firewall can see. IDS versus IPS is about whether the session died. WAF versus "allow 443" is about whether the application was inspected. TAP versus inline is the diagram you should be able to draw from memory.