TechclickCISSP Prep
☰

CISSP Domain 4 · 13% of the exam

Communication and Network Security

Designing and protecting networks: the OSI model, secure protocols, segmentation, wireless, remote access and modern architectures like SD-WAN, SASE and zero trust.

Practise Domain 4Domain 4 cheat sheet

Key concepts

OSI attack map

LayerExamplesAttacks / notes
7 ApplicationHTTP, DNS, SMTP, SNMPSQLi, XSS · application proxy / WAF inspects content
6 PresentationEncoding, compression, TLS formats—
5 SessionRPC, SOCKS, NetBIOSCircuit-level proxy: relays sessions without inspecting content
4 TransportTCP, UDPSYN flood, Fraggle (UDP), session hijacking
3 NetworkIP, ICMP, IPsecSmurf (ICMP), IP spoofing · routers, packet filters
2 Data linkEthernet, ARP, 802.1X, VLANARP spoofing (fix: DAI) · VLAN hopping · MAC flooding
1 PhysicalCables, radio, hubsTapping, jamming

Rule cards

Secure replacementsTelnet → SSH · FTP → SFTP/FTPS · HTTP → HTTPS · SNMPv1/2 → SNMPv3 · DNS → DNSSEC (integrity, not confidentiality) · RTP → SRTP.
Ports20/21 FTP · 22 SSH · 23 Telnet · 25 SMTP · 53 DNS · 80/443 HTTP/S · 88 Kerberos · 110 POP3 · 143 IMAP · 161/162 SNMP · 389/636 LDAP/S · 445 SMB · 1812/1813 RADIUS · 49 TACACS+ · 3389 RDP.
IPsecAH = integrity/authentication, no encryption · ESP = encryption (+ integrity) · Transport = payload only (host-to-host) · Tunnel = whole packet (gateway-to-gateway VPN) · IKE = negotiates keys/SAs.
Email securitySPF = allowed sending IPs · DKIM = domain signs mail · DMARC = policy (none/quarantine/reject) + reporting · S/MIME = X.509 + CA · PGP = web of trust.
WirelessWEP ✗ → WPA (TKIP) → WPA2 (AES-CCMP) → WPA3 (SAE) · EAP-TLS strongest (certs both sides), LEAP weak · ad hoc = no AP · infrastructure = via AP.
FirewallsPacket filter (stateless) → stateful inspection → circuit-level proxy → application proxy → NGFW (app-aware + IPS) · WAF for HTTP.
DesignBastion host = hardened + exposed · DMZ / screened subnet · micro-segmentation limits lateral movement · Zero Trust (NIST 800-207) = never trust, always verify · SDN = control plane separate from data plane · 802.1X = port-based NAC.
Modern WANSD-WAN = policy-based WAN routing · SASE = networking + security from the cloud (SWG, CASB, ZTNA, FWaaS).
IDS / IPSIDS = passive (SPAN/tap), alerts · IPS = inline, blocks · known attack → signature · zero-day → anomaly/behaviour.
AAA protocolsRADIUS = UDP, encrypts only the password · TACACS+ = TCP, encrypts the whole payload, separates AAA (device administration).
Routing / addressingDistance vector (RIP) vs link state (OSPF, full topology map) · Private ranges: 10/8, 172.16–31/12, 192.168/16.

Read the full Domain 4 cheat sheet →

10 free Domain 4 practice questions

Try each question before opening the answer. The full bank has many more Domain 4 questions with filters and progress tracking.

Question 1 · FIRST

Network monitoring shows a workstation sending large volumes of data to an unknown external IP at night. What should the security analyst do FIRST?

  1. Reimage the workstation from a clean build immediately
  2. Notify customers that their data may have been exposed
  3. Block all outbound internet traffic for the whole company
  4. Validate and scope the alert to confirm whether it is a real incident
Show answer & explanation

Answer: D — Validate and scope the alert to confirm whether it is a real incident

Detection and analysis come first: confirm it is not a false positive and understand the scope. Reimaging destroys evidence, customer notification is premature, and blocking all traffic is disproportionate.

Question 2 · NEXT

In an 802.1X deployment, a laptop has just connected to a switch port and sent its EAP identity. What happens NEXT?

  1. The laptop receives an IP address from the DHCP server
  2. The switch immediately places the laptop on the production VLAN
  3. The RADIUS server sends the laptop's password back to the switch
  4. The switch relays the request to the RADIUS server for authentication
Show answer & explanation

Answer: D — The switch relays the request to the RADIUS server for authentication

In 802.1X the supplicant talks to the authenticator (switch), which relays EAP to the authentication server (RADIUS). Network access and DHCP happen only after successful authentication; passwords are never returned.

Question 3 · LEAST

Which remote administration protocol is LEAST appropriate for managing routers over the internet?

  1. Telnet
  2. SSH version 2
  3. HTTPS to a management interface restricted by VPN
  4. SNMPv3 with authentication and privacy
Show answer & explanation

Answer: A — Telnet

Telnet sends credentials and commands in clear text. SSHv2, HTTPS behind a VPN and SNMPv3 with authPriv all provide encryption and authentication.

Question 4 · NOT

All of the following are benefits of network micro-segmentation EXCEPT:

  1. It limits lateral movement after a compromise
  2. It reduces the blast radius of a breach
  3. It removes the need to patch servers inside each segment
  4. It allows workload-specific security policies
Show answer & explanation

Answer: C — It removes the need to patch servers inside each segment

Micro-segmentation restricts east-west traffic and contains breaches, but vulnerable servers still need patching; segmentation is a layer, not a replacement for hardening.

Question 5 · BEST

An organization needs a proxy that relays TCP connections between internal users and the internet without inspecting the application-level content of the traffic. Which proxy type BEST fits?

  1. Transparent caching proxy
  2. Reverse proxy with a WAF
  3. Circuit-level proxy
  4. Application-level proxy
Show answer & explanation

Answer: C — Circuit-level proxy

Relays connections with no content inspection = CIRCUIT-LEVEL proxy (Session layer, e.g. SOCKS). An application-level proxy (L7) inspects content.

Question 6 · PRIMARY

What is the PRIMARY security advantage of IKEv2 over IKEv1 in modern VPN deployments?

  1. IKEv2 uses a different encryption algorithm than IKEv1, making it immune to known-plaintext attacks
  2. IKEv2 natively supports EAP authentication, MOBIKE for IP address mobility, and eliminates the insecure Aggressive Mode
  3. IKEv2 supports both Main Mode and Aggressive Mode for flexible deployment
  4. IKEv2 requires X.509 certificates while IKEv1 supports weaker pre-shared keys
Show answer & explanation

Answer: B — IKEv2 natively supports EAP authentication, MOBIKE for IP address mobility, and eliminates the insecure Aggressive Mode

IKEv2 (RFC 7296) improves on IKEv1 in several key areas: native EAP support enables remote-access VPNs with enterprise identity providers; MOBIKE (RFC 4555) allows a VPN connection to survive IP address changes (useful for mobile workers); the Aggressive Mode design flaw is eliminated; and the protocol is simpler (always 4 messages vs up to 6) while adding DoS resistance via cookies. Incorrect options: A: IKEv2 does not have Main Mode or Aggressive Mode — it uses a single IKE_SA_INIT + IKE_AUTH exchange. C: Both IKEv1 and IKEv2 negotiate encryption algorithms through the SA; the improvement is protocol design, not algorithm. D: IKEv2 supports pre-shared keys, certificates, and EAP — it doesn't mandate certificates.

Question 7 · MOST

A network engineer is asked to explain why WEP should never be used. Which statement MOST accurately describes WEP's fundamental cryptographic weakness?

  1. WEP uses MD5 for integrity which has known collision vulnerabilities
  2. WEP relies on pre-shared keys without any key rotation mechanism
  3. WEP uses RC4 with a 24-bit Initialization Vector, leading to IV reuse and key stream recovery
  4. WEP uses AES encryption but with a weak key schedule
Show answer & explanation

Answer: C — WEP uses RC4 with a 24-bit Initialization Vector, leading to IV reuse and key stream recovery

WEP uses RC4 (a stream cipher) with a 24-bit IV prepended to the shared key. With only ~16.7 million possible IV values and the IV transmitted in plaintext, an attacker who captures sufficient traffic (as few as 40,000 packets) can statistically recover the key using the FMS or PTW attacks by exploiting IV collisions and known plaintext in the RC4 keystream. Incorrect options: A: WEP uses RC4, not AES. C: WEP uses CRC-32 for integrity, not MD5 — CRC-32 is not cryptographically secure but this is not the primary key-recovery weakness. D: Weak key rotation is a secondary concern — the IV collision attack is the fundamental cryptographic break.

Question 8

A small company exposes its web, email and FTP servers directly to constant internet attacks. Each server should be heavily hardened with unnecessary services removed. Such a system is called a:

  1. Bastion host
  2. Honeypot
  3. Proxy server
  4. Jump box
Show answer & explanation

Answer: A — Bastion host

Hardened + exposed to untrusted networks = bastion host. A honeypot is a decoy.

Question 9 · LEAST

Which wireless security option is LEAST secure for a corporate network?

  1. WEP
  2. WPA3-Personal with SAE
  3. WPA3-Enterprise 192-bit mode
  4. WPA2-Enterprise with EAP-TLS
Show answer & explanation

Answer: A — WEP

WEP uses RC4 with weak IVs and can be cracked in minutes. WPA2-Enterprise with EAP-TLS and both WPA3 modes are strong.

Question 10 · NOT

Which of the following does DNSSEC NOT provide?

  1. Integrity of DNS responses
  2. Confidentiality of DNS queries
  3. Origin authentication of DNS data
  4. Authenticated denial of existence
Show answer & explanation

Answer: B — Confidentiality of DNS queries

DNSSEC signs DNS data to prove origin and integrity, including proof that a record does not exist. It does not encrypt queries; DNS over HTTPS/TLS addresses confidentiality.

Ready for the full bank?

2,000+ explained questions, timed mocks and a CAT simulator that behaves like the real exam.

Practise freeSee plans