Class notes · Professor Messer, CompTIA A+ 220-1201 Core 1 · Objective 2.3

Quick reference: the short version of this lesson is the Network Services cheat sheet, part of Section 2.

Learning objectives

By the end of these notes you should be able to:

List the services commonly found in a data centre and explain what each does.
Explain DNS, its distributed and cached design, and DHCP’s role and redundancy.
Compare file-sharing protocols (SMB, AFP) and describe print services and their protocols.
Explain why email needs high uptime, and how syslog and a SIEM centralise log data.
Describe a web server’s role, and an AAA/authentication server’s role and redundancy.
Explain database servers, relational tables and SQL.
Explain NTP, and why accurate time matters for logs and encryption.
Describe a spam gateway, an all-in-one security appliance (UTM), a load balancer and a proxy server.
Explain SCADA/ICS, legacy systems, embedded systems and IoT devices, and their common security theme.

1. The data centre

A typical data centre holds rack after rack of equipment, with many different services running across those racks. This lesson works through the services you’d expect to find there — and several you’ll meet everywhere else too.

2. DNS

DNS (Domain Name System) converts a fully qualified domain name (like professormesser.com) into an IP address — and can work in reverse too, plus provide other services.

Feature

Detail

Scale

A distributed platform — thousands of DNS servers running on the internet at any time

Load distribution

Primarily by domain name — a group of servers supports one domain, another group supports a different domain

Caching

Lookups are often served from a cached copy rather than querying the authoritative servers every time

Who manages it

Often your service provider, or internal DNS servers run by your own organisation

3. DHCP

DHCP (Dynamic Host Configuration Protocol) automatically assigns an IP address and other configuration settings whenever a computer starts up — no addresses to remember or type in.

Used everywhere: home networks and enterprise networks alike.
Redundancy in the enterprise: organisations typically run multiple DHCP servers, so if one becomes unavailable, others can still hand out addresses.

File sharing centrally stores information so people across (or outside) the organisation can access it — spreadsheets, documents, anything that needs sharing.

Platform

Common protocol

Windows

SMB — Server Message Block

macOS

AFP — Apple Filing Protocol

You usually don’t notice which protocol is in use. The operating system hides it behind an ordinary file-management interface — drag, drop, rename, edit — regardless of whether SMB, AFP or something else is doing the work underneath.

5. Print services

Even in a mostly digital workplace, some things still need to be printed. A print service manages that process: receiving print jobs, queuing them, and making sure they print successfully.

Where the print service runs:

A separate computer connected to the printer, running the print service software.
Built into the printer itself — sometimes on a network card that slots into the printer, providing both the network interface and the print service.

Common network printing protocols:

Protocol

Full name

SMB

Server Message Block

IPP

Internet Printing Protocol

LPD

Line Printer Daemon

6. Email

Email servers send and receive messages — either in the cloud (run by your internet or cloud service provider) or on-premises, in your own data centre.

Email demands very high uptime. Users expect it to always be flowing and always accessible, so administrators must plan, design and implement email services for maximum availability.

7. Syslog and the SIEM

If you manage switches, routers, servers and firewalls, you’re generating log files on all of them. Syslog is the protocol that lets you consolidate those logs into one central place.

Term

Role

Syslog

The protocol used to send log data to a central collector

SIEM (Security Information and Event Manager)

The central server that consolidates logs and lets you correlate information across very different systems

Storage needs: because a SIEM pulls in log data from many systems and typically keeps it for a long time, it needs a lot of available log space.

8. Web server

A web server answers browser requests, generally over HTTP or HTTPS.

Developers build pages in HTML (Hypertext Markup Language).
The browser fetches those HTML files from the web server, interprets them, and presents the graphical page you see.

9. Authentication (AAA) server

An authentication server — often called a AAA server (

Authentication, Authorization and Accounting) — checks your username and password, then grants access to the services you need.

Feature

Detail

Central database

Makes it easy to administer every user from one place

Home networks

Rarely have one — fewer services to reach, and families often share simple credentials

Enterprise networks

Need it for security: everyone gets their own credentials

Redundancy

Authentication is a gateway to everything else, so organisations run redundant authentication servers

10. Database server

Database servers store information in database tables — think of a table as a very large spreadsheet.

Relational databases link tables together, so different types of data can have relationships to each other, making it easy to connect and find related information.
SQL (Structured Query Language) is the standard language used to store and retrieve that data.
Common database products: Microsoft SQL Server, MySQL, and others.

11. NTP

NTP (Network Time Protocol) is why your computer’s clock is reliably accurate. Your device runs an NTP client, which periodically checks in with an NTP server referencing a central, accurate clock.

Why time accuracy matters:

Use

Why it needs the right time

Comparing log files

Events from multiple systems only line up correctly if their clocks agree

Encryption technologies

Many rely on all systems running the correct date and time to work properly

Design: organisations run one or more NTP servers, referencing a central clock, and every OS (Windows, macOS, Linux, and more) has an NTP client to stay in sync.

12. Spam gateway

Everyone gets spam — unsolicited email. A spam gateway evaluates every incoming message, decides whether it looks legitimate or like spam, and files it accordingly (inbox, or a spam/junk folder).

Often a separate service, in the cloud or on its own server.
Not 100% accurate — you’ll sometimes need to check the spam folder for a legitimate message that was miscategorised.

13. All-in-one security appliance (UTM)

Many organisations put an all-in-one security appliance at the edge of their network, between them and the internet. It goes by several names:

Next-generation firewall
UTM — Unified Threat Management
Web security gateway

Functions bundled into one device can include:

Function

Purpose

URL filtering / content inspection

Controls which sites and content users can reach

Malware scanning

On email and/or real-time network traffic

Spam filtering

Built in, rather than a separate gateway

CSU/DSU

Connecting to older WAN links

Router / switch interfaces

Basic network connectivity

Firewall / IPS

Blocking and intrusion prevention

Bandwidth shaping

Limiting the network impact of certain applications

VPN

Secure site-to-site links, or direct user connections

14. Load balancer

A load balancer keeps services up and available by spreading incoming requests across multiple devices at once — for example a web server farm of several web servers behind one load balancer.

Worked example — a server failing behind a load balancer:

Requests arrive and are distributed evenly across the web servers.
One server stops responding. The load balancer detects this and removes it from rotation automatically.
The remaining servers absorb the load while technicians investigate.
Technicians fix the problem and put the server back into service.
The load balancer automatically detects the server is healthy again and resumes sending it requests.

This all happens quickly — end users typically never notice the outage occurred at all.

15. Proxy server

A proxy server sits between a client and the service it wants to reach:

The client sends a request to the proxy.
The proxy makes that request on the client’s behalf.
The proxy receives the response, and evaluates it — checking it looks appropriate and safe.
If it passes, the proxy forwards the response to the end user.

Uses:

Security — the primary purpose.
Access control — restrict what users can reach.
Caching — store frequently requested content for faster future access.
Content scanning — limit what kind of information can pass through.

Users often don’t know it’s there. A proxy commonly sits invisibly in the network path, evaluating traffic without the end user realising.

16. SCADA / ICS

SCADA (Supervisory Control and Data Acquisition) — also called ICS (Industrial Control System) — is used to view, manage, control and maintain large-scale industrial equipment remotely, over a network.

Where you’ll find it: power utilities, oil and gas, manufacturing, and similar industries controlling large-scale physical equipment.

Security implication: because SCADA/ICS controls valuable and often critical physical systems, these networks need to be very secure. Most organisations use a completely segmented network, accessible only by physically visiting that part of the network, or through a very controlled access system.

17. Legacy systems

Once technology is installed and running, it tends to keep running as long as it has power and keeps working. It’s common to find data centre equipment that’s 10, 15, 20 years old or more — a legacy system.

Old doesn’t mean unimportant. A legacy system is often still critical — frequently the very reason it hasn’t been replaced yet. Knowing how to manage and maintain legacy systems is just as valuable a skill as managing current ones.

18. Embedded systems

An embedded system is a purpose-built device where you typically have no direct access to its underlying operating system.

Examples: a fire alarm system, a time clock system — self-contained units you interact with daily, without ever touching the OS underneath.

Support comes from the manufacturer: they provide whatever tools are needed to keep the system running.
Low ongoing maintenance is typical for these systems.

19. IoT devices

IoT (Internet of Things) covers a broad category of network-connected devices, including:

Appliances — refrigerators, coffee makers.
Voice-controlled “smart” devices.
Heating and air-conditioning controls.
Doorbells and garage door access.

The challenge: manufacturers of these products are often experts in the appliance itself, but not necessarily experts in network security. That mismatch is a real risk.

The mitigation: put IoT devices on their own segmented network, limiting what an attacker could reach even if one IoT device were compromised.

20. Security perspective

Redundancy protects critical services. DHCP, DNS and especially authentication servers should run in pairs (or more) — a single point of failure for authentication takes down access to everything else.
Centralised logging (syslog/SIEM) is a detection tool, not just storage. Correlating events across many systems is how attacks that touch multiple devices get noticed.
Time matters for security, not just convenience. Correct, synchronised time (NTP) is essential for making sense of logs during an investigation, and for encryption protocols that depend on accurate timestamps.
A proxy and a UTM are both chokepoints you can trust — but only if traffic is actually forced through them. Devices that bypass the proxy or firewall (e.g. using a personal hotspot) undermine every control behind it.
Segment what you can’t fully trust. SCADA/ICS and IoT devices share the same lesson: isolate systems that are hard to secure directly, so a compromise there doesn’t spread.
Legacy and embedded systems are common weak points. They often can’t be patched like a normal server, so isolation and monitoring matter even more.
A load balancer’s automatic failover is a resilience feature — not a substitute for fixing the underlying fault. Removing a failed server from rotation buys time; it doesn’t resolve the cause.

Summary

DNS resolves names to addresses, is distributed and cached, and is managed by a provider or internally.
DHCP automatically configures IP settings; enterprises run it redundantly.
File sharing uses SMB (Windows) or AFP (macOS), hidden behind the OS’s file interface.
Print services queue and manage jobs, over SMB, IPP or LPD.
Email demands very high uptime.
Syslog consolidates logs to a central SIEM for correlation, which needs plenty of storage.
Web servers serve HTTP/HTTPS and HTML pages.
AAA/authentication servers check credentials centrally, and run redundantly since everything else depends on them.
Database servers store data in relational tables, queried with SQL.
NTP keeps clocks accurate — vital for logs and encryption.
Spam gateways filter unwanted email, imperfectly.
UTM / next-gen firewall / web security gateway bundles filtering, malware scanning, firewall, IPS, bandwidth shaping and VPN into one device.
Load balancers spread traffic across servers and automatically route around failures.
Proxy servers make requests on a client’s behalf, for security, access control, caching and content scanning.
SCADA/ICS controls industrial equipment remotely, on a tightly segmented network.
Legacy systems are old but often still critical.
Embedded systems are purpose-built, with no direct OS access and manufacturer-provided support.
IoT devices cover smart appliances and controls; put them on their own segmented network.

Glossary

Term

Definition

Data centre

A facility housing racks of servers and network equipment

DNS

Domain Name System — resolves domain names to IP addresses

FQDN

Fully qualified domain name

DHCP

Dynamic Host Configuration Protocol — automatic IP configuration

SMB

Server Message Block — Windows file/print sharing

AFP

Apple Filing Protocol — macOS file sharing

IPP

Internet Printing Protocol

LPD

Line Printer Daemon

Syslog

A protocol for sending log messages to a central collector

SIEM

Security Information and Event Manager

Web server

Serves HTTP/HTTPS requests and HTML pages

HTML

Hypertext Markup Language — the language web pages are written in

AAA server

Authentication, Authorization and Accounting server

Database server

Stores data in relational tables

SQL

Structured Query Language — used to query databases

NTP

Network Time Protocol

Spam gateway

Filters unsolicited email

UTM

Unified Threat Management — an all-in-one security appliance

Load balancer

Distributes traffic across multiple servers

Server farm

A group of servers performing the same role behind a load balancer

Proxy server

Makes requests on behalf of a client, inspecting the response

SCADA

Supervisory Control and Data Acquisition

ICS

Industrial Control System — another name for SCADA-controlled environments

Legacy system

Old equipment or software still in use

Embedded system

A purpose-built device with no direct OS access

IoT

Internet of Things — network-connected everyday devices

Review questions

What does DNS do, and how is load distributed across its servers?
Why do enterprises typically run multiple DHCP servers?
Which file-sharing protocol is associated with Windows, and which with macOS?
Name three protocols a network printer might support.
Why does email require an especially high uptime expectation?
What’s the difference between syslog and a SIEM?
What language is used to build web pages, and what protocol serves them?
What does AAA stand for, and why do enterprises run redundant authentication servers?
What is a relational database, and what language is used to query it?
Give two reasons accurate time (NTP) matters on a network.
Name three functions commonly bundled into a UTM/all-in-one security appliance.
Describe what happens when a server fails behind a load balancer.
What are the two main purposes of a proxy server described in this lesson?
Why are SCADA/ICS networks usually completely segmented?
What’s the defining trait of an embedded system?
Why are IoT devices often put on their own network segment?

Answer key

DNS resolves fully qualified domain names to IP addresses (and can work in reverse). Load is distributed primarily by which domain names a group of servers supports.
For redundancy — if one DHCP server becomes unavailable, others can still assign addresses.
SMB (Server Message Block) for Windows; AFP (Apple Filing Protocol) for macOS.
Any three of: SMB, IPP (Internet Printing Protocol), LPD (Line Printer Daemon).
Users expect email to always be available, so it must be planned, designed and implemented for maximum uptime.
Syslog is the protocol that sends log data to a central point; a SIEM is the central server that consolidates and correlates that data.
HTML (Hypertext Markup Language), served over HTTP or HTTPS.
Authentication, Authorization and Accounting. Because the authentication server gates access to every other resource, its failure would block everything — so redundancy is essential.
A database where tables are linked together so related data can be connected. SQL (Structured Query Language) is used to query it.
Any two of: comparing log files across systems only works if their clocks agree; many encryption technologies require the correct date and time to function.
Any three of: URL filtering/content inspection, malware scanning, spam filtering, firewall, IPS, bandwidth shaping, VPN, router/switch interfaces, CSU/DSU.
The load balancer detects the failed server, removes it from rotation, and distributes the load across the remaining servers. Once fixed, the load balancer automatically detects it’s healthy and resumes sending it traffic — usually with no visible outage to users.
Security, and access control (the lesson also mentions caching and content scanning as additional benefits).
Because they control valuable, often critical physical equipment, so unauthorised access must be very difficult — hence segmentation and controlled access.
It’s purpose-built, and you typically have no direct access to its operating system.
Their manufacturers are often not experts in network security, so isolating them limits what an attacker could reach if one were compromised.