CYB-220 at Southern New Hampshire University moves from how networks work to how they are attacked and defended.
SNHU's catalog says students learn about common network-based attacks and how to defeat them. They explore intrusion detection and prevention technologies and information flow controls to protect networked systems, and analyze security concerns related to virtual systems and networks.
The listed prerequisites are CYB-200 Cybersecurity Foundations and CYB-210 Computer Networking. CYB-220 is in turn required for CYB-400 Security Assessment and Auditing.
Students often know individual attacks but struggle to explain which control stops which attack, and where on the network that control should sit.
Course at a Glance
| Item | Details |
|---|---|
| University | Southern New Hampshire University (SNHU) |
| Course code | CYB-220 |
| Level | Undergraduate, 3 credits |
| Prerequisites | CYB-200 and CYB-210 |
| Leads to | CYB-400 Security Assessment and Auditing |
| Typical work | Attack analyses, rule or architecture design, lab write-ups |
What CYB-220 Covers
| Topic | In plain language |
|---|---|
| Network-based attacks | Scanning, spoofing, sniffing, man-in-the-middle and denial of service |
| Intrusion detection | Watching traffic for signs of attack |
| Intrusion prevention | Blocking attack traffic automatically |
| Information flow controls | Firewalls, access control lists and segmentation that decide what traffic may pass |
| Virtual systems and networks | Security issues in virtual machines and software-defined networks |
Key Concepts Explained
Matching Attacks to Defenses
A clear way to show understanding is a mapping from attack to control:
| Attack | Main defenses |
|---|---|
| ARP spoofing | Dynamic ARP inspection, segmentation |
| Sniffing | Encryption such as TLS, switched networks |
| Denial of service | Rate limiting, upstream filtering |
| Port scanning | Firewall rules, IDS alerts |
Firewall Rules and Default Deny
Information flow controls work best with a default deny stance: block everything, then allow only what is needed.
Example: A web server in a DMZ needs to receive web traffic from the internet and query one database server inside. Rules: allow inbound TCP 443 from any address to the web server; allow TCP from the web server to the database server on its database port only; deny all else. If the web server is compromised, the attacker still cannot reach the rest of the internal network directly.
Virtualisation Risks
Virtual machines on one host share hardware. Risks include VM escape, misconfigured virtual switches and traffic between VMs that never passes a physical firewall. Defenses include hypervisor patching, micro-segmentation and monitoring of virtual traffic.
Typical Assignments and How to Approach Them
| Assignment type | What it tests | How to approach it |
|---|---|---|
| Attack analysis | How an attack works and is stopped | Mechanism, impact, layered defenses |
| Firewall or ACL design | Controlling information flow | Default deny, justify each allow rule |
| IDS or IPS evaluation | Choosing and placing sensors | Explain placement and tuning trade-offs |
| Virtual network review | Virtualisation security | Identify shared-resource risks and controls |
Where to Put IDS and IPS Sensors
Placement questions are a favorite in network security work because they test whether you understand traffic flow. A sensor only sees the traffic that passes it.
- At the internet edge: sees inbound attacks early, but also a lot of noise.
- In front of the DMZ: focuses on traffic to public-facing servers.
- On internal segments: catches lateral movement that never crosses the perimeter.
- Host-based agents: see activity on the machine itself, including traffic after it is decrypted.
An IPS sits inline, so a false positive can block legitimate traffic. Explain how you would tune rules in detection-only mode first, then switch on blocking for well-tested signatures.
Where Students Get Stuck
- Listing tools without placement. Say where on the network each control sits and why.
- Overly open rules. "Allow any" rules undermine flow control; justify every exception.
- IDS versus IPS confusion. Detection alerts; prevention blocks inline.
- Forgetting virtual networks. The course explicitly covers them.
Study Tips for CYB-220
- Keep an attack-to-defense table and add to it every module.
- Draw network diagrams with trust zones before writing any rules.
- Read IDS alerts in labs and practice explaining each in one sentence.
- Revise CYB-210 addressing and ports; they underpin every rule you write.
How We Help with CYB-220
Send the assignment prompt, any diagrams or lab output, the rubric and feedback. A writer with network security background can tutor you, prepare a custom analysis or rule set for reference, or review your own work.
GradeEssays is independent of Southern New Hampshire University. Use our work as a learning aid and submit your own under SNHU's academic integrity policy. Every order includes free revisions within the scope of your original request.
Strengthen Your CYB-220 Analysis
Share the assignment, diagrams and feedback. A security writer prepares a custom analysis you can learn from.
Start My CYB-220 HelpFree revisions · Full refund if late · Written from scratch for your order
Frequently Asked Questions
SNHU lists CYB-200 Cybersecurity Foundations and CYB-210 Computer Networking.
Yes. SNHU's description includes analyzing security concerns related to virtual systems and networks.
Mechanisms such as firewalls, access control lists and segmentation that decide which traffic may move between systems.
A rule approach that blocks all traffic unless it is explicitly allowed.
SNHU lists CYB-220 as one of the prerequisites for CYB-400 Security Assessment and Auditing.
No. We offer tutoring, custom answers for reference and editing of your own work.