CISSP cheat sheet · Domain 4 · 13% of exam
Communication and Network Security Designing and protecting networks: the OSI model, secure protocols, segmentation, wireless, remote access and modern architectures like SD-WAN, SASE and zero trust.
Rule cards Secure replacements Telnet → SSH · FTP → SFTP/FTPS · HTTP → HTTPS · SNMPv1/2 → SNMPv3 · DNS → DNSSEC (integrity, not confidentiality) · RTP → SRTP. Ports 20/21 FTP · 22 SSH · 23 Telnet · 25 SMTP · 53 DNS · 80/443 HTTP/S · 88 Kerberos · 110 POP3 · 143 IMAP · 161/162 SNMP · 389/636 LDAP/S · 445 SMB · 1812/1813 RADIUS · 49 TACACS+ · 3389 RDP. IPsec AH = integrity/authentication, no encryption · ESP = encryption (+ integrity) · Transport = payload only (host-to-host) · Tunnel = whole packet (gateway-to-gateway VPN) · IKE = negotiates keys/SAs. Email security SPF = allowed sending IPs · DKIM = domain signs mail · DMARC = policy (none/quarantine/reject) + reporting · S/MIME = X.509 + CA · PGP = web of trust. Wireless WEP ✗ → WPA (TKIP) → WPA2 (AES-CCMP) → WPA3 (SAE) · EAP-TLS strongest (certs both sides), LEAP weak · ad hoc = no AP · infrastructure = via AP. Firewalls Packet filter (stateless) → stateful inspection → circuit-level proxy → application proxy → NGFW (app-aware + IPS) · WAF for HTTP. Design Bastion host = hardened + exposed · DMZ / screened subnet · micro-segmentation limits lateral movement · Zero Trust (NIST 800-207) = never trust, always verify · SDN = control plane separate from data plane · 802.1X = port-based NAC. Modern WAN SD-WAN = policy-based WAN routing · SASE = networking + security from the cloud (SWG, CASB, ZTNA, FWaaS). IDS / IPS IDS = passive (SPAN/tap), alerts · IPS = inline, blocks · known attack → signature · zero-day → anomaly/behaviour. AAA protocols RADIUS = UDP, encrypts only the password · TACACS+ = TCP, encrypts the whole payload, separates AAA (device administration). Routing / addressing Distance vector (RIP) vs link state (OSPF, full topology map) · Private ranges: 10/8, 172.16–31/12, 192.168/16.
⚠ Exam traps RADIUS encrypts only the password; TACACS+ encrypts everything. DNSSEC provides integrity and origin authentication, NOT confidentiality. Protecting the WHOLE packet including the original header = IPsec tunnel mode. Do not over-use segmentation: ask what the ROOT cause is before choosing a network control. Ready for the full bank? 2,000+ explained questions, timed mocks and a CAT simulator that behaves like the real exam.
