Designing a Network with Defense-in-Depth

🔑This page doesn't reteach CIA, network attacks, or subnetting — you already have those from 2.1.1, 2.1.2, and 4.2.4. What's new here is turning that knowledge into an actual network design, labeled the way a professional (and the AP exam) expects.
Concept

Network Topology Building Blocks

Every network topology diagram in this project is built from the same three pieces, combined in different arrangements depending on what needs to be connected and what needs to stay isolated.

🧩 Topology Building Blocks — click each one
Forwards data between different networks — connecting a LAN to the internet, or connecting multiple branch locations to each other.
2.1.G, 3.3.AAP Skill

Worked Example: Diagramming a Real Network

ExampleGuided Example — From Passive Analysis to Topology

Your passive analysis of a large e-commerce site revealed: a public-facing web server (with a redundant backup), a separate media server for video content, and a separate image server for product photos. You know customer and employee data must exist somewhere, but your analysis never surfaced it directly.

Place the public-facing servers
The web, media, and image servers all connect through a router to the internet — they're meant to be reached by the public, so they sit in a lower-security zone.
✍️Notice the underlying pattern: what a passive analysis doesn't reveal is often as informative as what it does. A well-designed network deliberately keeps its most sensitive resources invisible from the outside.
2.1.GAP Skill

Labeling Every Layer

This is the actual graded skill in this project: for every piece of your diagram, name which defense-in-depth layer it belongs to and which specific control it represents.

Diagram elementLayer + control
Router at the internet boundaryNetwork — traffic routing between networks
Firewall between segmentsNetwork — rule-based traffic filtering
Encrypted customer databaseData — confidentiality at rest
Internal-only employee segmentNetwork — segmentation limiting exposure
💡An unlabeled diagram just shows shapes and lines. A labeled diagram shows reasoning — and reasoning is what AP free-response questions actually score.
Career

Career Spotlight: Network Security R&D Specialist

Every field needs people who aren't just applying existing tools, but actively improving them. A Network Security Research and Development Specialist studies emerging threats and designs new tools, protocols, or techniques to defend against them — the professional layer above the network design work you just practiced.

✍️If today's design work felt more interesting as a puzzle to optimize than a box to check, that's worth paying attention to — R&D-flavored roles reward exactly that instinct.
← Back to Project 2.1.3Next: Activity 2.2.1 →More on Malware.