Network Security Assessment Runbook

A professional network security assessment is not just a review of firewall rules. It is a structured evaluation of architecture, exposure, trust, access paths, monitoring, and operational risk across the entire network.

Welcome to the Network Security Assessment Runbook.

This runbook brings together the practical skills from:

• Network Security Fundamentals Lab
• ACL Security Lab
• Firewall Security Lab
• VPN Security Lab
• Network Threat Investigation Lab

The objective is to move from:

I can configure network-security controls.

to:

I can assess an unfamiliar network, identify meaningful security weaknesses, prioritize risk, and present clear remediation to both technical teams and management.

This runbook is especially relevant for:

• Network Security Engineers
• Security Consultants
• Firewall Engineers
• SOC Analysts
• Infrastructure Security Engineers
• Security Architects

🎯 Runbook Information

Item	Details
Runbook	Network Security Assessment
Difficulty	Intermediate → Advanced
Estimated Time	3–8 Hours depending on scope
Primary Focus	Network Architecture, Exposure, Segmentation & Control Review
Target Roles	Network Security Engineer, Security Consultant, Security Architect
Certification Alignment	CCNA, CCNP Security
Output	Assessment Report, Findings Register, Risk Ratings, Remediation Roadmap

🏢 Assessment Scenario

You have been given approved review access to an enterprise network.

The environment contains:

• user VLANs
• server VLANs
• database networks
• management networks
• internet-facing services
• firewalls
• routers
• switches
• VPN connectivity
• remote users
• DNS infrastructure
• logging and monitoring

Management asks:

How secure is our network, where are the biggest risks, and what should we fix first?

Your job is not to simply collect configurations.

You need to answer:

What Exists?
   ↓
How Is It Connected?
   ↓
Which Trust Relationships Exist?
   ↓
Which Traffic Is Allowed?
   ↓
Which Systems Are Exposed?
   ↓
Which Controls Protect Them?
   ↓
Can Suspicious Activity Be Detected?
   ↓
Which Weaknesses Matter Most?

🎯 Assessment Objectives

By the end of this runbook, you should be able to:

• define assessment scope

• understand network architecture

• inventory network assets

• review IP addressing and subnets

• identify trust boundaries

• evaluate segmentation

• review ACLs

• assess firewall policy

• identify public exposure

• review management-plane security

• assess VPN architecture

• review remote-access security

• inspect routing and NAT

• review DNS and network services

• assess logging and monitoring

• identify security findings

• rate findings consistently

• create a remediation roadmap

• produce technical and executive reports

⚠️ Authorization First

Before beginning, confirm:

• sites in scope

• networks in scope

• devices in scope

• production vs non-production

• VPNs in scope

• internet edge in scope

• wireless in scope if applicable

• whether configuration changes are permitted

• whether testing is passive or active

• evidence-handling requirements

Do not:

• alter firewall policies

• shut interfaces

• change routes

• modify VPNs

• run disruptive scans

unless explicitly authorized.

🧭 Assessment Workflow

Use:

Scope
  ↓
Discover
  ↓
Map Architecture
  ↓
Inventory Assets
  ↓
Identify Trust Boundaries
  ↓
Review Exposure
  ↓
Review Segmentation
  ↓
Review ACLs
  ↓
Review Firewalls
  ↓
Review VPNs
  ↓
Review Routing / NAT
  ↓
Review Network Services
  ↓
Review Monitoring
  ↓
Create Findings
  ↓
Prioritize Risk
  ↓
Build Remediation Roadmap
  ↓
Report

01 — Define Assessment Scope

Document:

• sites

• offices

• data centers

• cloud-connected networks

• firewalls

• routers

• core switches

• access switches

• VPN gateways

• critical applications

• internet-facing systems

📋 Scope Worksheet

Item	Details
Organization
Primary Site
Branch Sites
Internet Edge
VPN Infrastructure
Critical Networks
Critical Applications
Assessment Owner
Technical Contact
Assessment Date

🧠 Why Scope Matters

Without clear scope, you may:

• miss a branch connection

• overlook a management network

• misinterpret risk

• review incomplete firewall policy

02 — Collect Existing Documentation

Request available:

• network diagrams

• IP address plans

• VLAN lists

• firewall rule exports

• router configurations

• VPN documentation

• asset inventories

• change records

• security standards

🧠 Do Not Trust Diagrams Blindly

Documentation may be:

• incomplete

• outdated

• inconsistent with actual configuration

Treat it as a starting point.

03 — Build the Network Architecture Map

Create a high-level diagram.

Example:

Internet
   ↓
Edge Router
   ↓
Firewall
   ↓
DMZ
   ↓
Core Network
   ├── User VLANs
   ├── Application VLANs
   ├── Database VLANs
   └── Management VLAN

Add:

• branch offices

• VPN tunnels

• cloud connections

• security services

🧠 First Architecture Question

Ask:

Where are the trust boundaries?

04 — Inventory Network Devices

Create:

Device	Type	Location	Management IP	Criticality

Include:

• routers

• switches

• firewalls

• VPN gateways

• wireless controllers

• load balancers where relevant

05 — Review Device Ownership

Every important device should have:

• technical owner

• business/service owner where relevant

• support team

🚨 Risk Pattern

Critical Firewall
      ↓
No Clear Owner

creates operational and security risk.

06 — Inventory VLANs and Subnets

Create:

VLAN	Network	Purpose	Trust Level	Owner

Classify:

• user

• application

• database

• management

• guest

• DMZ

• security

• voice

• infrastructure

🧠 Security Question

Ask:

Why does this network exist, and which other networks should it communicate with?

07 — Review IP Addressing Design

Assess:

• network ranges

• overlapping networks

• inconsistent subnet design

• undocumented ranges

🧠 Security Relevance

Poor IP planning can make:

• segmentation

• firewall policy

• incident response

• routing

more difficult.

08 — Identify Critical Assets

List:

• authentication services

• database systems

• finance systems

• security tools

• backup infrastructure

• network management systems

Create:

Asset	Network	Criticality	Exposure

09 — Define Trust Zones

Classify zones such as:

Internet
DMZ
User
Application
Database
Management
Guest
Partner
Remote Access

🧠 Trust Principle

Internal does not automatically mean:

trusted.

10 — Build a Trust Matrix

Create:

Source Zone	Destination Zone	Expected Trust
Internet	DMZ	Low
User	Application	Controlled
User	Database	Normally Restricted
Management	Infrastructure	Privileged
Guest	Internal	Restricted

11 — Build the Traffic Requirement Matrix

For important applications:

Source	Destination	Protocol/Service	Required?	Owner
Users	Web App	HTTPS	Yes	App Team
Users	DB	SQL	No
App	DB	DB Service	Yes	App Team

🧠 Assessment Principle

Security policy should match business requirements.

12 — Identify Unnecessary Connectivity

Look for paths such as:

Users
  ↓
Database

or:

Development
  ↓
Production Management

without clear business need.

🚨 Example Finding

Finding ID:
NET-001

Title:
User Network Has Direct Access to Sensitive Database Network

Severity:
High

Observation:
General user systems can directly communicate with sensitive database services.

Risk:
Compromise of an employee endpoint could provide a direct attack path toward critical data systems.

Recommendation:
Restrict user-to-database communication and require access through approved application tiers.

13 — Review Network Segmentation

Assess whether the architecture separates:

• users

• servers

• databases

• management

• guest access

• internet-facing workloads

🧠 Segmentation Question

Ask:

If this network is compromised, what can the attacker reach next?

14 — Review East-West Traffic

East-west traffic means internal-to-internal communication.

Look for:

• broad server-to-server access

• unnecessary admin protocols

• unrestricted user-to-server paths

🧠 Security Goal

Segmentation should reduce lateral movement.

15 — Review North-South Traffic

North-south traffic generally involves:

• internet ↔ internal

• remote access ↔ internal

• partner ↔ internal

Review:

• exposed services

• firewall control

• logging

• authentication

16 — Inventory Internet-Facing Services

Create:

Public IP/Service	Internal Resource	Port	Required?	Owner

🚨 High-Risk Services

Review carefully:

• SSH

• RDP

• databases

• management consoles

• VPN portals

17 — Review Public Administrative Access

Ask:

Can internet hosts directly reach administrative interfaces?

Examples:

Internet
   ↓
SSH
   ↓
Server

or:

Internet
   ↓
Firewall Management

🚨 Finding Pattern

Finding ID:
NET-002

Title:
Administrative Service Exposed to the Internet

Severity:
High

Risk:
Attackers can directly target administrative authentication and exposed management services.

Recommendation:
Restrict administrative access to approved private or controlled management paths.

18 — Review ACLs

Assess:

• standard ACLs

• extended ACLs

• source ranges

• destination ranges

• protocol

• port

• placement

• direction

• rule order

🧠 ACL Review Question

For every permit ask:

Can this access be made narrower?

19 — Identify Broad ACL Rules

Look for:

permit ip any any

or broad subnet-to-subnet access.

🚨 Example Finding

Finding ID:
ACL-001

Title:
Overly Broad ACL Permits Unrestricted Inter-Network Traffic

Severity:
High

Risk:
The rule weakens segmentation and may enable lateral movement.

Recommendation:
Replace broad access with application-specific source, destination, and service rules.

20 — Review ACL Placement

Determine:

• interface

• inbound/outbound

• whether intended traffic actually crosses the ACL

21 — Review ACL Rule Order

Identify cases where:

Broad Permit
     ↓
Specific Deny

makes the deny ineffective.

22 — Review Temporary ACLs

Look for:

• migration rules

• vendor rules

• troubleshooting rules

Ask:

Is this still required?

23 — Review Firewall Architecture

Identify:

• perimeter firewalls

• internal segmentation firewalls

• cloud firewalls if relevant

• branch firewalls

🧠 Firewall Architecture Question

Ask:

Is firewall placement aligned with the organization’s trust boundaries?

24 — Review Firewall Zones

Document:

Firewall	Zone	Purpose

Typical zones:

• outside

• DMZ

• inside

• management

• partner

25 — Review Firewall Rules

For every important rule inspect:

• source

• destination

• service

• action

• logging

• owner

• last review

📋 Firewall Rule Review

Rule	Source	Destination	Service	Owner	Required?

26 — Identify Any/Any Firewall Rules

Review:

ANY
 ↓
ANY
 ↓
ANY
 ↓
ALLOW

These should receive high scrutiny.

27 — Review DMZ Access

A DMZ workload should generally have limited internal access.

Review:

Internet
  ↓
DMZ Web
  ↓
Required App Service

and not:

DMZ
 ↓
Entire Internal Network

28 — Review Database Protection

Determine:

• which networks can reach databases

• which ports

• whether admin access is isolated

🧠 Database Security Principle

Databases should normally be reachable only from:

• approved applications

• approved administration paths

29 — Review Outbound Firewall Rules

Do not ignore egress.

Check whether sensitive systems have:

ANY → Internet

🧠 Egress Question

Ask:

Why does this server require unrestricted internet access?

30 — Review Firewall NAT

Document:

Original	Translated	Direction	Business Purpose

Review:

• inbound publishing

• source NAT

• destination NAT

• PAT

🧠 Important

NAT does not replace firewall policy.

31 — Review Firewall Logging

Important rules should provide usable logs.

Review whether logs contain:

• source

• destination

• service

• action

• timestamp

• policy name

32 — Review Firewall Rule Ownership

Every important rule should ideally have:

• owner

• business justification

• review date

33 — Review Rule Recertification

Ask:

When were firewall rules last reviewed?

Identify:

• stale rules

• expired projects

• old vendors

• decommissioned systems

34 — Review Shadowed Rules

Look for rules that never match because broader rules exist above them.

🧠 Why This Matters

Shadowed rules indicate poor policy quality and may hide security intent.

35 — Review Management-Plane Architecture

Identify how administrators access:

• routers

• switches

• firewalls

• VPN gateways

• network controllers

🧠 Preferred Model

Administrator
      ↓
Management Network
      ↓
Network Device

36 — Review Management Protocols

Prefer secure protocols.

Review for:

• SSH

• HTTPS

• secure APIs

and identify insecure legacy management where applicable.

37 — Review AAA

Assess:

Authentication
Authorization
Accounting

Ask:

• are individual administrator accounts used?

• is access centrally managed?

• are actions logged?

38 — Review Shared Administrator Accounts

Shared admin accounts reduce accountability.

Document:

• where used

• why

• alternatives

39 — Review Privileged Source Networks

Determine which networks can reach device-management interfaces.

General user networks should not normally provide unrestricted administrative reachability.

40 — Review VPN Architecture

Inventory:

• site-to-site VPNs

• remote-access VPNs

• partner VPNs

• vendor VPNs

41 — Review Site-to-Site VPNs

Create:

Local Site	Remote Site	Networks	Business Purpose

🧠 Site-to-Site Question

Ask:

Does the tunnel include more networks than the business requires?

42 — Review Remote-Access VPN

Assess:

• user authentication

• MFA

• user groups

• assigned networks

• allowed resources

• session logging

43 — Review VPN Least Privilege

Avoid:

Remote User
   ↓
Entire Enterprise

Prefer:

Remote User
   ↓
Required Business Applications

44 — Review Vendor VPN Access

For each vendor:

Vendor	Owner	Resource	Expiry	MFA

🚨 Vendor Risk

Third-party access without:

• expiry

• ownership

• monitoring

should be prioritized.

45 — Review Split Tunneling

Determine:

• split or full tunnel

• business justification

• security controls

• endpoint posture

• monitoring implications

46 — Review VPN Logs

Confirm the ability to answer:

• who connected?

• from where?

• when?

• how long?

• successful/failed?

• which group?

47 — Review VPN Failed Authentication

Look for patterns such as:

Same Source
   ↓
Many Users
   ↓
Repeated Failures

which may indicate password spraying.

48 — Review Routing Architecture

Document:

• static routes

• dynamic routing

• default routes

• branch routes

• internet routes

🧠 Routing Security Question

Ask:

Could a route provide an unexpected path around a security control?

49 — Review Default Routes

Identify which systems use:

0.0.0.0/0

and where that traffic goes.

50 — Review Asymmetric Routing Risks

Traffic may fail or bypass expected controls if:

• outbound and return paths differ

depending on architecture.

51 — Review Routing Between Security Zones

Confirm that sensitive paths cannot bypass:

• firewall

• ACL

• inspection

52 — Review NAT Architecture

Map:

Internal Address
      ↓
Translation
      ↓
External Address

and public service publishing.

53 — Review DNS Architecture

Inventory:

• internal DNS

• external DNS

• forwarders

• resolvers

🧠 DNS Security Question

Ask:

Which systems are allowed to resolve external domains, and where is DNS activity logged?

54 — Review Unauthorized DNS

Look for endpoints using external DNS directly instead of approved resolvers.

🧠 Why This Matters

Central DNS improves:

• policy

• monitoring

• threat investigation

55 — Review DHCP

Assess:

• authorized DHCP

• scope design

• network ownership

56 — Review NTP

Network devices should have consistent time.

🧠 Security Importance

Without accurate time:

event correlation becomes unreliable.

57 — Review Syslog

Determine whether network devices send logs to centralized monitoring.

58 — Review Network Monitoring Architecture

Identify tools receiving:

• firewall

• router

• switch

• VPN

• DNS

• IDS/IPS logs

🧠 Visibility Question

Ask:

If a network incident occurred yesterday, could the team reconstruct it today?

59 — Review Log Retention

Assess whether retention supports:

• incident investigation

• compliance

• threat hunting

60 — Review IDS/IPS Coverage

Where present, document:

• placement

• inspection scope

• alert ownership

• tuning

🧠 Detection Question

Ask:

Which high-risk network activity currently has no detection?

61 — Review Network Threat Detection

Look for detections covering:

• port scanning

• brute force

• password spray

• suspicious VPN activity

• lateral movement

• unusual outbound connections

62 — Review Alert Quality

Determine whether security teams experience:

• excessive false positives

• noisy firewall alerts

• ignored network detections

🧠 Security Operations Principle

More alerts do not automatically mean better security.

63 — Review Change Management

Assess whether network changes follow:

Request
 ↓
Review
 ↓
Approval
 ↓
Implementation
 ↓
Validation
 ↓
Rollback Capability

64 — Review Emergency Changes

Ask how emergency network changes are:

• approved

• documented

• reviewed afterward

65 — Review Configuration Backups

Critical network-device configurations should have:

• backups

• controlled storage

• recovery process

66 — Review Device Software Lifecycle

Assess:

• software versions

• patching

• unsupported devices

• security advisories

67 — Review Unused Services

Identify unnecessary network-device services.

🧠 Hardening Principle

Disable:

what the device does not need.

68 — Review Physical/Console Access

Where relevant, consider:

• data center access

• console access

• device tampering risk

69 — Build the Attack Surface Map

Example:

Internet
│
├── Public Web :443
├── VPN Gateway
├── SSH :22     ← Review
└── Firewall Admin ← High Risk

70 — Build the Internal Attack-Path Map

Example:

User Endpoint
      ↓
Application
      ↓
Database

User ─X→ Management

🧠 Attack-Path Question

Ask:

If this user workstation is compromised, what is the highest-value system an attacker could reach?

71 — Build an Exposure Matrix

Create:

Asset	Exposure	Service	Required?	Risk

72 — Build a Management Access Matrix

Source	Device	Protocol	Allowed?	Required?

73 — Build a VPN Access Matrix

User/Group	Destination	Service	Required?

74 — Build an Inter-Segment Traffic Matrix

Source	Destination	Service	Required?	Control

75 — Create Findings

Use:

Condition
+
Evidence
+
Network Path
+
Risk
+
Business Impact
+
Recommendation

📄 Standard Finding Format

Finding ID:

Title:

Severity:

Affected Device / Network:

Observation:

Evidence:

Attack Path:

Risk:

Business Impact:

Recommendation:

Validation:

76 — Example Finding — Weak Segmentation

Finding ID:
NSA-001

Title:
User Network Has Broad Access to Server Networks

Severity:
High

Observation:
General user endpoints can directly access multiple internal server networks and services.

Risk:
Compromise of a workstation could enable extensive lateral movement.

Recommendation:
Define required business traffic and implement least-privilege segmentation between user and server networks.

77 — Example Finding — Public Management

Finding ID:
NSA-002

Title:
Network Device Management Exposed to Untrusted Network

Severity:
High

Risk:
External or lower-trust systems may directly target privileged network-device administration.

Recommendation:
Restrict device management to approved management networks and secure administrative protocols.

78 — Example Finding — Weak VPN Access

Finding ID:
NSA-003

Title:
Remote VPN Users Have Excessive Internal Access

Severity:
High

Risk:
Compromise of a remote credential or endpoint may provide broad access to sensitive internal networks.

Recommendation:
Implement group-based VPN authorization and restrict remote access to approved applications and services.

79 — Example Finding — Logging Gap

Finding ID:
NSA-004

Title:
Critical Network Devices Do Not Send Logs to Central Monitoring

Severity:
High

Risk:
Security teams may be unable to detect or reconstruct malicious network activity.

Recommendation:
Centralize required network-device logging and validate retention and alerting.

80 — Example Finding — Temporary Firewall Rule

Finding ID:
NSA-005

Title:
Temporary Firewall Rule Remains Active Beyond Approved Period

Severity:
Medium

Risk:
Unnecessary connectivity increases attack surface and may provide an undocumented access path.

Recommendation:
Validate continued need, remove obsolete access, and enforce expiry for temporary firewall rules.

📊 Risk Rating Model

Use:

Exposure
+
Reachability
+
Privilege
+
Destination Sensitivity
+
Likelihood
+
Business Impact
=
Risk

🔴 Critical

Examples:

• internet-facing critical management

• unrestricted access to highly sensitive systems

• confirmed high-impact security-control bypass

🟠 High

Examples:

• broad user-to-server access

• excessive VPN access

• major monitoring gap

• public administrative services

🟡 Medium

Examples:

• stale firewall rules

• weak recertification

• unnecessary egress

• isolated logging gaps

🔵 Low

Examples:

• naming

• documentation

• minor configuration cleanup

81 — Prioritize Findings

Use:

Immediate Attack Paths
        ↓
Privileged Exposure
        ↓
Critical Asset Exposure
        ↓
Segmentation Weaknesses
        ↓
Remote Access Risks
        ↓
Monitoring Gaps
        ↓
Governance / Cleanup

82 — Identify Quick Wins

Examples:

• remove public SSH

• remove obsolete firewall rule

• disable stale VPN account

• restrict user-to-management access

• enable missing syslog

83 — Identify Strategic Improvements

Examples:

• redesign segmentation

• implement centralized AAA

• redesign remote access

• implement internal firewalling

• improve network monitoring architecture

84 — Build the Remediation Roadmap

Use:

Immediate
0–7 Days

Short Term
7–30 Days

Medium Term
30–90 Days

Strategic
90+ Days

📋 Example

Finding	Timeframe
Public Admin Access	Immediate
Excessive VPN Access	Immediate
Flat User/Server Network	Short Term
Logging Gaps	Medium Term
Enterprise Segmentation Redesign	Strategic

85 — Validate Remediation

Never close findings because:

someone says the firewall was updated.

Validate:

Required Traffic
→ Works

Unauthorized Traffic
→ Fails

86 — Validate Network Segmentation

Test:

Source	Destination	Expected	Actual
User	App HTTPS	Allow
User	Database	Deny
User	Management	Deny
App	Database	Allow

87 — Validate Administrative Access

Confirm:

Management Network
      ↓
Secure Admin
      ↓
Network Device

works.

Confirm user networks cannot perform the same administrative access.

88 — Validate VPN Remediation

Confirm:

• authorized apps reachable

• unnecessary subnets blocked

• user group policy works

• logs capture sessions

89 — Validate Logging

Generate a controlled event and confirm it appears in:

• central logging

• SIEM where applicable

90 — Prepare an Executive Risk Summary

Executives usually need:

• overall posture

• top risks

• likely business impact

• remediation priorities

Example:

The network security assessment identified material risk across internal segmentation, administrative access, remote connectivity, and centralized monitoring.

The highest-priority issues include broad user-to-server communication, excessive remote-access VPN permissions, and privileged management paths available from lower-trust networks.

Immediate remediation should reduce exposed administrative access and excessive remote connectivity.

Longer-term improvements should strengthen enterprise segmentation, firewall-governance processes, centralized AAA, and network-security monitoring.

91 — Prepare the Technical Report

Recommended structure:

1. Executive Summary
2. Assessment Scope
3. Methodology
4. Network Architecture
5. Asset Inventory
6. Trust Boundaries
7. Segmentation Review
8. ACL Review
9. Firewall Review
10. Public Exposure
11. Management Security
12. VPN Security
13. Routing & NAT
14. DNS / Network Services
15. Monitoring & Logging
16. Findings
17. Risk Summary
18. Remediation Roadmap
19. Positive Observations
20. Conclusion

🌟 Positive Observations

Include controls that are working well.

Examples:

• dedicated management network

• strong VLAN segmentation

• VPN MFA

• centralized AAA

• narrow firewall rules

• good syslog coverage

• regular rule recertification

Balanced assessments are more credible than reports containing only weaknesses.

92 — Prepare the Findings Summary

Create:

Severity	Count
Critical
High
Medium
Low

Then identify:

Top 5 Network Security Risks.

93 — Prepare for Stakeholder Review

Be ready to explain:

Why is this rule risky?

Which attack path does it create?

Which system is exposed?

What happens if the source is compromised?

What is the safest remediation?

Could remediation affect production?

🧠 Consultant Mindset

Avoid:

This configuration is bad.

Prefer:

This configuration allows a lower-trust source to reach a higher-value system over services that are not required by the documented business flow, increasing lateral-movement risk.

🎤 Network Security Assessment Interview Questions

Practise without notes.

1. How would you assess an unfamiliar network?

2. What would you review first?

3. How do you identify trust boundaries?

4. How do you assess segmentation?

5. How do you identify internet-facing services?

6. How would you review ACLs?

7. What makes a firewall rule risky?

8. Why are Any/Any rules dangerous?

9. How would you assess management-plane security?

10. Why is a dedicated management network useful?

11. How would you assess remote VPN access?

12. What would you review for a site-to-site VPN?

13. Why does routing matter in a security assessment?

14. How can NAT affect investigations?

15. Why are DNS logs useful?

16. Why is NTP important?

17. Which network logs would you centralize?

18. How would you identify lateral-movement risk?

19. How do you prioritize network findings?

20. How do you validate remediation?

🚨 Scenario Interview Question 1

You discover users can directly access production database servers.

A strong response should discuss:

• business requirement

• traffic path

• current security control

• attack path

• segmentation

• required application flow

• validation

🚨 Scenario Interview Question 2

A firewall contains a large Any/Any rule used by several applications.

Do not immediately delete it.

Use:

Identify Dependencies
      ↓
Collect Rule Usage
      ↓
Map Business Flows
      ↓
Create Specific Rules
      ↓
Test
      ↓
Remove Broad Rule
      ↓
Monitor

🚨 Scenario Interview Question 3

Remote VPN users can access every internal subnet.

Discuss:

• VPN groups

• authorization

• segmentation

• MFA

• business roles

• logging

🚨 Scenario Interview Question 4

Network administrators use Telnet from the general user network.

Discuss:

• secure management protocol

• dedicated management network

• AAA

• least privilege

• logging

🚨 Scenario Interview Question 5

Firewall and VPN logs are retained for only one day.

Discuss:

• detection

• forensic investigation

• business requirements

• compliance

• retention strategy

🧠 Assessment Interview Framework

Use:

Scope
 ↓
Architecture
 ↓
Assets
 ↓
Trust Boundaries
 ↓
Traffic Paths
 ↓
Controls
 ↓
Monitoring
 ↓
Risk
 ↓
Remediation
 ↓
Validation

💬 Interview Tip

Avoid:

“I would scan the network and check the firewall.”

A stronger answer is:

“I would first confirm the assessment scope and critical assets, understand the network topology and trust boundaries, map required traffic flows, review public exposure, segmentation, ACL and firewall policies, management access, VPNs, routing and network services, then evaluate logging and monitoring before prioritizing findings according to actual business impact.”

That sounds like a Network Security Consultant.

📁 Portfolio Deliverables

Create sanitized examples of:

• network architecture diagram

• VLAN/subnet inventory

• trust-boundary map

• traffic matrix

• public-exposure matrix

• ACL review

• firewall review

• VPN access review

• management access matrix

• findings register

• remediation roadmap

• executive summary

📝 Resume Examples

Instead of:

Network security assessment experience.

Use:

Performed a structured enterprise network-security assessment in a lab environment covering network architecture, segmentation, ACLs, firewalls, VPNs, management access, routing, NAT, DNS, and centralized logging.

Or:

Identified excessive inter-segment connectivity, broad firewall policies, weak remote-access controls, and network-monitoring gaps and produced risk-rated remediation recommendations.

⭐ Runbook Readiness Check

You should now be able to:

• define network assessment scope

• map network architecture

• inventory important assets

• identify trust boundaries

• assess segmentation

• review ACLs

• review firewall policies

• identify public exposure

• assess management security

• review VPN architecture

• evaluate remote-access security

• review routing and NAT

• understand DNS/security monitoring implications

• identify logging gaps

• create defensible findings

• rate risk

• prioritize remediation

• validate changes

• explain findings to stakeholders

The objective is not:

I checked all network devices.

The objective is:

I understand which network paths exist, which trust relationships are unnecessary, where critical systems are exposed, which controls are weak, and what should be remediated first to reduce real attack paths.

🏆 Runbook Complete

You now have a repeatable methodology for:

Architecture Discovery
      ↓
Asset Inventory
      ↓
Trust Analysis
      ↓
Segmentation Review
      ↓
ACL Assessment
      ↓
Firewall Assessment
      ↓
VPN Assessment
      ↓
Management Security
      ↓
Network Monitoring
      ↓
Risk Analysis
      ↓
Remediation
      ↓
Reporting

This directly supports roles such as:

• Network Security Engineer

• Security Consultant

• Firewall Engineer

• Infrastructure Security Engineer

• Security Architect

🚀 What’s Next?

You now understand how to assess an enterprise network as a whole.

The next runbook goes deeper into one of the most important operational security controls in that network:

➡️ Next: Firewall Review Runbook

In the next runbook, you will systematically assess:

• firewall architecture

• zones and interfaces

• policy rules

• Any/Any access

• public exposure

• inbound publishing

• outbound access

• NAT

• management-plane security

• logging

• unused rules

• shadowed rules

• temporary access

• rule ownership

• recertification

• risk rating

• remediation

• firewall interview scenarios