A performance-based question might show a network diagram with empty boxes and a bank of device icons: firewall, IPS, IDS, WAF, load balancer, VPN concentrator, jump server. Each device works in one or two of those boxes and is useless or dangerous in the rest. An IPS on a mirror port can't block anything, and a database in the screened subnet is one exploit away from the internet.
On the CompTIA Security+ SY0-801 exam, device placement falls under objective 3.2, which expects you to apply architecture decisions to a scenario, and a performance-based question may ask you to drag devices onto a diagram. This lesson gives you a method for placing any device, then walks through a reference network slot by slot, explaining why each device belongs where it does and not elsewhere.
Placement follows the traffic a device must see, block or receive
Every placement decision comes down to three questions.
What traffic must the device see? A device can act only on packets that pass through it or are copied to it. A sensor meant to spot attackers moving between internal servers has to see traffic between internal servers, which a sensor at the internet edge never does.
Must it block, or only watch? Blocking requires an inline position, in the path, so the device can drop a packet before it is delivered. Watching can be done from the side with a copy of the traffic, which adds no delay and can't interrupt the network if the device fails.
Who must reach it? Devices that internet users connect to, such as a VPN concentrator or the public address of a load balancer, belong at the edge or in the screened subnet. Devices that only staff or administrators use stay inside.
Two habits follow. Put devices at choke points, where all the relevant traffic has to cross, so one device covers many systems. And put sensitive systems behind more boundaries than less sensitive ones.
The objective names device placement as a skill rather than listing devices, so questions draw on the whole toolkit: firewalls, IPS and IDS, WAFs, proxies, load balancers, remote access gateways, jump servers, SIEM collectors and NAC. How each one works is covered in the network defenses section.
A reference network gives every device a known home
The diagram shows a typical mid-size network: a screened subnet between two firewalls, and four internal zones behind them. The lettered slots are where the security devices go. Before reading on, try to place each device from the bank in a slot.
Device bank: perimeter firewall, VPN concentrator, inline IPS, load balancer,
WAF, internal firewall, IDS sensor, NAC-enforcing switches, database server,
jump server
INTERNET
|
[ Edge router ]
|
( A )-------------( B )
|
( C )
|
SCREENED SUBNET +-------------+--------------+
| | |
( D ) | Mail relay,
| | forward proxy,
( E ) | log collector
| |
Web servers |
( F )
|
[ Core switch ]------mirror------( G )
|
+--------------+-----------+-----------+----------------+
| | | |
USER ZONE SERVER ZONE RESTRICTED ZONE MANAGEMENT ZONE
( H ) access App servers, ( I ) ( J )
switches and log collector SIEM
Wi-Fi APs
The sections that follow fill the slots in the order a packet from the internet meets them.