Network And Industrial Architecture Models for Security+
Short answer
Network infrastructure is the foundation for where trust boundaries can exist. Architecture decisions such as routing, switching, wireless coverage, virtual networks, and management paths determine how easily systems can reach one another. In this topic, the focus is the model implication: a flat network increases broad reachability, while a segmented architecture can reduce blast radius. The exact placement of WAFs, jump servers, intrusion detection system (IDS), intrusion prevention system (IPS), or virtual private network (VPN) concentrators belongs to secure enterprise infrastructure.
Why it appears on the exam
SY0-701 3.1: Differentiate physical isolation, air gaps, logical segmentation, SDN, IoT, ICS/SCADA, RTOS, embedded systems, and high-availability architecture implications.
Key concepts
Concept 1
Required terms
Network infrastructure: the routers, switches, links, wireless systems, addressing, routing, and supporting services that connect systems and enforce network boundaries. Physical isolation: separating systems with physical separation so they do not share direct network connectivity or hardware paths. Air-gapped: a strong form of physical isolation where a system or network is intentionally not connected to other networks, especially the Internet. Logical segmentation: separating traffic or access with logical controls such as VLANs, subnets, virtual networks, access rules, or software-defined policy.
Example
A payment processing network is separated with dedicated switches and cabling. That is physical isolation because separation is enforced through physical infrastructure.
Concept 2
How Network And Industrial Architecture Models works
Network infrastructure is the foundation for where trust boundaries can exist. Architecture decisions such as routing, switching, wireless coverage, virtual networks, and management paths determine how easily systems can reach one another. In this topic, the focus is the model implication: a flat network increases broad reachability, while a segmented architecture can reduce blast radius. The exact placement of WAFs, jump servers, IDS, IPS, or VPN concentrators belongs to secure enterprise infrastructure.
Example
A manufacturing controller has no Internet connection and receives updates through a controlled maintenance process. That is an air-gapped implication, but removable media still requires control.
Concept 3
Common confusion
Learners often treat air-gapped as impossible to compromise. The correction is that air-gapped reduces network exposure but does not remove removable media, vendor maintenance, supply chain, or insider paths. Another common confusion is treating logical segmentation as physical isolation. Logical segmentation depends on policy and configuration; physical isolation depends on separate physical paths.
Example
A hospital places medical IoT devices on their own VLAN with restricted routes to clinical systems. That is logical segmentation used to limit reachability.
Concept 4
What to recognize
Distinguish physical isolation from logical segmentation based on the enforcement mechanism; Recognize air-gapped architecture from intentional lack of external network connectivity; Identify SDN when software controllers define or push network policy; Recognize IoT, embedded, RTOS, ICS, and SCADA constraints such as limited patching, safety, uptime, and vendor dependency.
Example
A data center uses a controller to push network policy to virtual switches. That is SDN; the controller becomes a critical security dependency.
Sample questions
Select an answer to reveal the explanation. For tracked practice and weak-area review, use the Cultiv8 app.
Q1.A Security+ scenario describes this situation: A payment processing network is separated with dedicated switches and cabling. That is physical isolation because separation is enforced through physical infrastructure. Which answer fits best?
Q2.A Security+ scenario describes this situation: A payment processing network is separated with dedicated switches and cabling. That is physical isolation because separation is enforced through physical infrastructure. Which answer fits best?
Q3.A security team needs to decide what this situation represents: A manufacturing controller has no Internet connection and receives updates through a controlled maintenance process. That is an air-gapped implication, but removable media still requires control. Which option fits?
Practice this lesson in Cultiv8
The app adds tracked practice, targeted remediation, saved session history, and future readiness scoring.
Continue in Cultiv8