Objective 3.1Medium10 min

Network Infrastructure Models

Security implications of different network infrastructure approaches including physical isolation (air-gapped networks), logical segmentation (VLANs, subnets), and software-defined networking (SDN) with programmatic network control.

Understanding Network Infrastructure Models

Network infrastructure models determine how systems connect and communicate. The choice of model has significant security implications for isolation, attack surface, and operational capabilities.

Key network models:Physical isolation (Air gap) — Complete network separation • Logical segmentation — Virtual separation on shared infrastructure • Software-defined networking — Programmatic network control

The 2010 Stuxnet attack proved that even air-gapped networks aren't impenetrable—the malware spread via infected USB drives to Iran's nuclear facility, demonstrating that physical isolation alone isn't sufficient.

Each model offers different security trade-offs between isolation, usability, cost, and management complexity.

Why This Matters for the Exam

Network infrastructure models are tested on SY0-701 as they're fundamental to security architecture. Questions cover when to use each model and their security implications.

Understanding these models helps with network security design, compliance requirements, and risk management. The right model depends on security requirements, operational needs, and resources.

The exam tests comparison of models and appropriate use cases for each.

Deep Dive

What Is an Air-Gapped Network and When Should You Use One?

Complete physical separation between networks with no connectivity.

True Air Gap Characteristics:

  • No network connectivity (wired or wireless)
  • No shared infrastructure
  • Physical separation of equipment
  • Data transfer only via sneakernet (removable media)

Air Gap Use Cases:

  • Military/classified systems
  • Critical infrastructure (nuclear, utilities)
  • Industrial control systems
  • Sensitive research
  • High-security financial systems

Air Gap Security Benefits:

BenefitDescription
No remote attacksNetwork-based attacks impossible
Malware containmentCan't spread via network
Data exfiltration harderNo network path out
Highest isolationComplete separation

Air Gap Challenges:

ChallengeSecurity Implication
UpdatesDifficult to patch, may remain vulnerable
UsabilityManual data transfer is slow
Human factorUSB drives can bridge gap
CostDuplicate infrastructure expensive

How Can Air-Gapped Networks Be Compromised?

Despite physical isolation, air gaps can be bridged: • USB/removable media (Stuxnet example) • Supply chain compromise • Social engineering • Side-channel attacks (acoustic, electromagnetic)

What Is Logical Network Segmentation?

Virtual separation using VLANs, subnets, and access controls on shared infrastructure.

Logical Segmentation Methods:

MethodLayerDescription
VLANs2Switch-based isolation
Subnets3IP-based separation
Firewalls3-7Traffic filtering
ACLs3-4Router-based filtering

Logical Segmentation Benefits:

  • Cost-effective (shared infrastructure)
  • Flexible (easy to reconfigure)
  • Scalable
  • Manageable

Logical Segmentation Limitations:

  • Configuration errors can break isolation
  • Shared hardware = potential side channels
  • Software vulnerabilities can bypass
  • Less secure than physical separation

How Do Air Gap and Logical Segmentation Compare?

Air Gap vs Logical Segmentation
Air Gap:
Network A
Network B
No physical connection • Highest isolation
Logical:
Network A
Firewall
Network B
Controlled connection • Filtered traffic
Air gap = complete isolation (USB bridge possible) • Logical = controlled connectivity

What Is Software-Defined Networking (SDN) and Its Security Implications?

Programmatic control of network behavior separating control from data plane.

SDN Architecture:

ComponentFunction
Application layerNetwork applications, security tools
Control planeSDN controller, centralized decisions
Data planePhysical switches, packet forwarding

SDN Security Benefits:

  • Centralized visibility and control
  • Programmatic security policy
  • Rapid response to threats
  • Microsegmentation capabilities
  • Automated provisioning

SDN Security Risks:

RiskDescription
Controller compromiseSingle point of failure
API vulnerabilitiesProgrammatic access = new attack surface
MisconfigurationErrors affect entire network
ComplexityNew skills required

SDN Security Controls:

  • Controller hardening
  • Secure API authentication
  • Encryption between components
  • Redundant controllers
  • Change management for policies

How Do You Choose Between Network Models?

Comparison Matrix:

AspectAir GapLogicalSDN
SecurityHighestMediumMedium-High
CostHighLowMedium
FlexibilityLowMediumHigh
ManagementComplexModerateCentralized
ScalabilityPoorGoodExcellent
Remote accessNonePossiblePossible

Use Air Gap When:

  • Highest security required
  • Compliance mandates isolation
  • Remote access not needed
  • Cost is secondary to security

Use Logical Segmentation When:

  • Balance of security and usability
  • Resources need controlled interconnection
  • Cost-effective isolation needed
  • Standard compliance requirements

Use SDN When:

  • Dynamic environment
  • Centralized control needed
  • Automation is priority
  • Cloud or hybrid deployment

How CompTIA Tests This

Example Analysis

Scenario: A utility company needs to secure their SCADA/ICS network controlling power distribution. They're debating between air-gapping the OT network, using logical segmentation with firewalls, or implementing SDN for flexibility.

Analysis - Network Model Selection:

Requirements Analysis:

RequirementWeight
Security (critical infrastructure)Highest
Reliability (power distribution)Highest
Remote monitoringMedium
Update capabilityMedium

Option Evaluation:

Air Gap:

  • ✅ Highest security
  • ✅ No remote attack vector
  • ❌ No remote monitoring without bridging
  • ❌ Difficult to update/patch
  • Risk: Unpatched systems become vulnerable

Logical Segmentation with Industrial Firewalls:

  • ✅ Controlled remote access possible
  • ✅ Can still isolate effectively
  • ✅ Allows secure updates
  • ❌ Configuration errors possible
  • ❌ Firewall vulnerabilities

SDN:

  • ✅ Centralized control
  • ✅ Rapid response capability
  • ❌ Controller = single point of failure
  • ❌ Added complexity for OT environment
  • ❌ Staff may lack SDN expertise

Recommendation:

  • Layered approach:
  • 1.Physical separation of IT and OT networks
  • 2.Industrial DMZ between zones
  • 3.Unidirectional gateways (data diodes) for monitoring
  • 4.Strict logical segmentation within OT
  • 5.Air gap for most critical systems

Key insight: Critical infrastructure often uses hybrid approaches—air gap for the most sensitive components with controlled connectivity for less critical systems.

Key Terms

network infrastructure modelsair gapSDNsoftware-defined networkingnetwork segmentationlogical isolationphysical isolation

Common Mistakes

Thinking air gaps are impenetrable—Stuxnet showed air gaps can be bridged via USB and supply chain attacks.
Assuming VLANs provide security without firewalls—VLANs separate broadcast domains but need ACLs/firewalls to filter traffic.
SDN controller as single point of failure—SDN controllers should be redundant. Controller compromise affects entire network.
One model fits all—different systems may need different isolation levels within the same organization.

Exam Tips

If a question mentions "complete physical separation" or "no network connection," think air gap. If it mentions Stuxnet, remember: air gaps can be bridged via USB.
VLAN questions: VLANs separate at Layer 2 only. Without firewalls/ACLs, devices can still communicate via routing.
SDN controller compromise = potential control over entire network. Look for "single point of failure" in answer choices.
Critical infrastructure (power/water/nuclear) scenarios often need air gap + limited controlled connections via data diodes.
When asked about highest security but lowest flexibility, air gap is the answer. Highest flexibility but controller risk = SDN.
Data diodes provide one-way data flow—perfect for monitoring air-gapped systems without allowing inbound traffic.

Memory Trick

Think of network models like building security:

Air Gap = A building on a private island. No bridges, no ferries, no connections. Maximum security, but getting supplies there is a nightmare. (Stuxnet showed someone can still swim over with a USB-shaped message in a bottle.)

Logical Segmentation = A building with multiple secure floors. Everyone shares the elevator, but you need different keycards for different floors. Cheaper than separate buildings, but a determined attacker in the elevator shaft could reach any floor.

SDN = A smart building where one security center controls all doors remotely. Flexible and efficient, but if someone hacks the security center, they control everything.

  • The exam pattern:
  • "Highest isolation" = Air gap
  • "Cost-effective separation" = Logical/VLANs
  • "Centralized control, programmatic" = SDN
  • "Single point of failure" = SDN controller risk

Test Your Knowledge

Q1.A military facility requires the highest level of network isolation for classified systems. What network model should be used?

Q2.What is the PRIMARY security risk of Software-Defined Networking (SDN)?

Q3.The Stuxnet malware demonstrated that air-gapped networks can be compromised through:

Want more practice with instant AI feedback?

Continue Learning

Ready for the Exam?

See exactly where you stand on this concept and 182 others.

99% pass rate · Pass guarantee