Overview
Communication and Network Security covers how networks are designed, built and used securely. Its three sub-objectives are broad: applying secure design principles in network architectures (OSI and TCP/IP models, IPv4 and IPv6, secure and converged protocols, segmentation, wireless, cellular, CDNs, SDN and virtual private clouds), securing network components such as transmission media, network access control and endpoints, and implementing secure communication channels for voice, video, remote access, data communications and third-party connectivity.
Candidates must reason about where a control operates and what it can see. A packet filter at layer 3 cannot inspect application content; TLS protects a session but not a compromised endpoint; micro-segmentation limits east-west movement that perimeter firewalls never see. This domain applies the cryptography and design principles of Domain 3 and supplies the monitoring points that Domain 7 operations depend on.
How it's tested
Expect design and placement questions: which layer a device or attack operates at, which protocol meets a requirement, how to segment a network, or which remote-access option fits a scenario. Many questions describe symptoms or requirements in business terms and expect you to translate them into a network control. Watch for words such as east-west, encrypted, legacy, wireless and third party.
-
Layer identification
A device, protocol or attack is described, and you identify its OSI layer or what a control at a given layer can and cannot inspect.
-
Protocol selection
A requirement such as encrypted site-to-site traffic or secure remote administration is given, and you choose IPsec tunnel mode, TLS, SSH or another protocol.
-
Segmentation and placement
An architecture is described and you choose where to place a firewall, NAC, IDS or segmentation boundary to contain risk.
Attackers compromised a web server and moved laterally to database servers in the same VLAN, unseen by the perimeter firewall. Options include a stronger perimeter firewall, more IDS sensors at the internet edge, antivirus on the web server, or micro-segmentation with policy between workloads. The movement was east-west inside the data center, so only controls between workloads address it. Micro-segmentation is the BEST answer.
Sub-objectives 3
Official sub-objectives from the ISC2 outline, in outline order.
4.1 Apply secure design principles in network architecturesModels, IP, secure and converged protocols, transport, traffic flows, segmentation, wireless, cellular, CDN, SDN, VPC and monitoring.
- What it means
- This objective covers the OSI and TCP/IP models; IPv4 and IPv6 addressing (unicast, broadcast, multicast, anycast); secure protocols such as IPsec, SSH and TLS; multilayer and converged protocols such as iSCSI, VoIP, InfiniBand over Ethernet and Compute Express Link; transport architecture (topology and data, control and management planes); performance metrics; north-south and east-west traffic; physical, logical and micro-segmentation; edge, wireless and cellular networks; CDNs; software-defined networking and SD-WAN; virtual private clouds; and network observability.
- What to understand
- Know what each layer does and where controls sit: switches and VLANs at layer 2, routers and IPsec at layer 3, TLS operating above TCP, and web application firewalls at layer 7. Separating the management plane from the data plane, for example through out-of-band management, prevents an attacker on production traffic from reaching device administration. WPA3 replaces WPA2's pre-shared key exchange with SAE, and enterprise wireless uses 802.1X with RADIUS.
- How it shows up
- Scenarios ask which segmentation or protocol stops a specific traffic flow, or which layer a protocol or attack belongs to, such as ARP spoofing at layer 2.
- Common confusion
- Assuming a VLAN is a security boundary on its own; without filtering between VLANs and protection against VLAN hopping, it only separates broadcast domains.
4.2 Secure network componentsInfrastructure operation, transmission media, NAC systems and endpoint security.
- What it means
- This covers operating infrastructure securely (redundant power, warranty and support), choosing and physically protecting transmission media with attention to signal quality, network access control (NAC) systems in physical and virtual forms, and host-based endpoint security.
- What to understand
- Fiber resists electromagnetic interference and is hard to tap without detection, while copper emanates and is easier to tap. NAC checks identity and device posture before granting network access and can quarantine noncompliant devices into a remediation VLAN. Endpoint controls such as host firewalls and EDR protect where network controls lose visibility, especially for encrypted traffic.
- How it shows up
- A visitor plugs a personal laptop into a conference room port and reaches internal servers, and the answer is 802.1X-based NAC with posture assessment.
- Common confusion
- Treating NAC as only authentication; posture checks such as patch level and antivirus status are what make it a security gate.
4.3 Implement secure communication channels according to designVoice, video and collaboration; remote access; data communications; third-party connectivity.
- What it means
- This covers securing voice, video and collaboration tools such as conferencing and meeting rooms, remote access including network administrative functions, data communications such as backhaul and satellite links, and third-party connectivity with telecom providers and hardware support vendors.
- What to understand
- Remote administration should use encrypted, strongly authenticated channels such as SSH or a VPN to a hardened jump host, never Telnet or exposed RDP. VoIP needs SRTP for media and TLS for SIP signaling, plus separation from data VLANs. Third-party connections should be restricted to specific systems, monitored, time-bound and governed by contract.
- How it shows up
- A hardware vendor needs remote access to maintain one appliance, and the BEST answer grants access through a monitored, time-limited connection to that system only.
- Common confusion
- Granting a vendor a full-tunnel site-to-site VPN for convenience; least privilege applies to third-party connectivity as much as to employees.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
OSI layers
Physical (1), Data Link (2), Network (3), Transport (4), Session (5), Presentation (6) and Application (7).
- Remember
- Switches and MAC addresses at 2, routers and IP at 3, TCP and UDP at 4, application gateways and WAFs at 7.
- Tested as
- Placing devices, protocols and attacks at the correct layer.
- Trap
- Placing TLS at layer 7 in every answer; it is commonly described at layers 5 and 6, operating above TCP and below the application.
-
IPsec AH vs. ESP
Authentication Header provides integrity and origin authentication without confidentiality; Encapsulating Security Payload provides confidentiality and can also provide integrity.
- Remember
- If the requirement includes encryption, ESP is required.
- Tested as
- VPN design questions.
- Trap
- Choosing AH for a confidentiality requirement.
-
IPsec transport vs. tunnel mode
Transport mode protects the payload and keeps the original IP header; tunnel mode encapsulates the entire original packet inside a new one.
- Remember
- Gateway-to-gateway VPNs use tunnel mode; host-to-host often uses transport mode.
- Tested as
- Site-to-site VPN scenarios.
- Trap
- Choosing transport mode when internal addresses must be hidden.
-
Micro-segmentation
Fine-grained policy enforced between individual workloads, often through distributed firewalls or network overlays.
- Remember
- It controls east-west traffic and supports zero trust architectures.
- Tested as
- Lateral movement scenarios.
- Trap
- Relying on perimeter controls for traffic that never crosses the perimeter.
-
North-south vs. east-west
North-south traffic enters or leaves the data center; east-west traffic moves between systems inside it.
- Remember
- Most lateral movement is east-west and invisible to edge firewalls.
- Tested as
- Sensor and firewall placement questions.
- Trap
- Adding edge IDS sensors to detect internal lateral movement.
-
802.1X
Port-based network access control with a supplicant, an authenticator (switch or access point) and an authentication server, typically RADIUS.
- Remember
- It authenticates devices or users before the port passes normal traffic.
- Tested as
- Wired and wireless access control questions.
- Trap
- Confusing the authenticator (switch) with the authentication server.
-
Converged protocols
Protocols that carry specialized traffic over standard IP or Ethernet networks, such as iSCSI for storage and VoIP for voice.
- Remember
- Convergence lowers cost but exposes storage or voice to IP network threats; isolate them with dedicated VLANs and encryption.
- Tested as
- Architecture risk questions.
- Trap
- Assuming iSCSI traffic is protected because storage is internal.
-
Software-defined networking (SDN)
Separates the control plane, which decides where traffic goes, from the data plane, which forwards it, under a centralized controller.
- Remember
- The controller is a high-value target; protect its APIs and management access.
- Tested as
- Modern architecture questions including SD-WAN.
- Trap
- Thinking SDN removes the need for segmentation policies.
-
Out-of-band management
Managing network devices over a separate, dedicated network rather than the production data path.
- Remember
- It keeps management reachable during incidents and isolates it from attackers on production traffic.
- Tested as
- Management plane protection questions.
- Trap
- Accepting in-band management over unencrypted protocols such as Telnet.
-
Wireless security
WPA2 uses AES-CCMP; WPA3 adds Simultaneous Authentication of Equals for personal mode and stronger enterprise options.
- Remember
- Enterprise mode with 802.1X gives per-user credentials; WEP and TKIP are obsolete.
- Tested as
- Wireless design scenarios.
- Trap
- Relying on hidden SSIDs or MAC filtering as security controls.
-
Performance metrics
Bandwidth is capacity, throughput is achieved rate, latency is delay, jitter is variation in delay, and signal-to-noise ratio measures signal quality.
- Remember
- Jitter matters most for voice and video quality.
- Tested as
- Availability and channel design questions.
- Trap
- Using bandwidth and throughput interchangeably.
-
Virtual private cloud (VPC)
A logically isolated network within a public cloud, with its own subnets, routing and security groups.
- Remember
- Under shared responsibility, the customer configures VPC segmentation and access rules.
- Tested as
- Cloud network design questions.
- Trap
- Assuming the provider secures VPC rules by default.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
IPsec AH vs. ESP, transport vs. tunnel
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| AH | Authentication Header | Integrity and origin authentication, no encryption | Selecting it when confidentiality is required |
| ESP | Encapsulating Security Payload | Encryption plus optional integrity | Assuming it always protects the outer IP header |
| Transport mode | Protects payload; original header retained | Typically host to host | Using it to hide internal addressing between sites |
| Tunnel mode | Encapsulates the entire original packet | Typically gateway to gateway | Thinking it is only for remote users |
Physical vs. logical vs. micro-segmentation
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Physical segmentation | Separate hardware, including air gaps and out-of-band networks | Strongest isolation, highest cost | Assuming air-gapped networks cannot be reached through removable media |
| Logical segmentation | VLANs, VPNs, virtual routing and forwarding | Separates traffic on shared hardware | Treating a VLAN as a filter without inter-VLAN controls |
| Micro-segmentation | Policy between individual workloads | Controls east-west traffic at fine granularity | Expecting perimeter firewalls to do the same job |
Packet filter vs. stateful vs. application-level firewall
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Packet filter | Rules on addresses, ports and protocol per packet | Layer 3 and 4, no session awareness | Expecting it to block application-layer attacks |
| Stateful inspection | Tracks connection state | Allows return traffic only for established sessions | Assuming it inspects payload content |
| Application-level (proxy, WAF, NGFW) | Inspects application content and identity | Layer 7 visibility, more processing cost | Assuming it can inspect encrypted traffic without TLS inspection |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Perimeter for internal threats
- What candidates pick
- A stronger edge firewall to stop lateral movement.
- Why it looks right
- Firewalls are the classic network control.
- Why it's wrong
- East-west traffic never crosses the edge; segmentation between internal workloads is required.
Clue to watch for Compromise spreads between internal servers or virtual machines.
-
AH for secrecy
- What candidates pick
- IPsec AH for a link that must be confidential.
- Why it looks right
- AH sounds like the security option.
- Why it's wrong
- AH provides no encryption; ESP is required for confidentiality.
Clue to watch for The requirement mentions confidentiality, privacy or encryption.
-
VLAN equals security
- What candidates pick
- Putting sensitive systems on their own VLAN without further controls.
- Why it looks right
- Separation seems like isolation.
- Why it's wrong
- VLANs separate broadcast domains; without access control between them and protection against VLAN hopping, attackers can still reach them.
Clue to watch for The option relies solely on a VLAN for protection.
-
Full VPN for a vendor
- What candidates pick
- A site-to-site VPN for a vendor that supports one appliance.
- Why it looks right
- It is easy to set up and reliable.
- Why it's wrong
- It grants broad network reach; third-party access should be limited, monitored and time-bound.
Clue to watch for A third party needs access to a specific system.
-
Encryption hides the attack from you
- What candidates pick
- Relying on a network IDS to detect malware inside TLS sessions.
- Why it looks right
- The IDS already monitors that segment.
- Why it's wrong
- Encrypted payloads are invisible without TLS inspection or endpoint-based detection.
Clue to watch for Traffic is encrypted and the threat is in the content.
-
In-band management
- What candidates pick
- Managing switches over the production network with Telnet for convenience.
- Why it looks right
- No extra infrastructure required.
- Why it's wrong
- Credentials travel in cleartext and management is exposed to anyone on the data plane; use SSH and out-of-band or dedicated management networks.
Clue to watch for Administrative access to network devices across shared networks.
Answer framework
Work through Domain 4 scenarios by locating the traffic and the layer before picking a control.
- Identify the traffic flow at issue: north-south through the edge, east-west between internal workloads, remote access by staff or administrators, or third-party connectivity.
- Determine the OSI layer where the threat or requirement lives, because a control only sees what its layer exposes.
- Choose the protocol or control that meets the stated property, such as ESP for confidentiality or 802.1X for admission.
- Apply segmentation and least privilege so a compromise in one zone cannot reach unrelated systems or the management plane.
- Confirm visibility: make sure monitoring can still observe the traffic after encryption, segmentation or cloud migration, or add endpoint and flow-based monitoring.
Practice question
Want more like this? The CISSP practice test has questions for every domain.
Checklist
0 of 12
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Start by mastering the OSI and TCP/IP models with concrete examples at each layer, because nearly every network question depends on knowing where something operates. Then study secure protocols (IPsec, TLS, SSH, SRTP) and their modes, followed by segmentation, firewalls and traffic flows. Leave wireless, cellular, CDN, SDN and VPC topics for a second pass once the fundamentals are solid.
High-priority concepts are the layer model, IPsec modes and headers, segmentation types, east-west monitoring and 802.1X. Commonly underestimated areas are the 2024 additions such as Compute Express Link, InfiniBand over Ethernet, network observability and virtual private clouds, which candidates skip because they seem niche, and secure communication channels (4.3), especially third-party connectivity.
Because Domain 4 has only three objectives, use the sub-bullets of the official outline as your checklist and make sure each term has one sentence of meaning and one security implication in your notes. Afterwards, practice mixed questions with Domain 5 (authentication protocols) and Domain 7 (detection and monitoring), which reuse these network concepts constantly.
FAQ
Why does Domain 4 have only three sub-objectives?
ISC2 groups network content into three broad objectives, but each has many sub-bullets. Objective 4.1 alone lists models, IP versions, protocols, segmentation, wireless, cellular, CDNs, SDN, VPCs and monitoring.
Do I need to memorize port numbers for the CISSP?
The outline does not list port numbers. Knowing common ones such as 22 for SSH, 443 for HTTPS and 3389 for RDP helps you read scenarios, but design reasoning matters far more.
How deep is the OSI model tested?
You should be able to place devices, protocols and attacks at a layer and explain what a control at that layer can inspect. Encapsulation order and the function of each layer are fair game.
What is the difference between zero trust and micro-segmentation?
Zero trust is the principle of verifying every request without implicit trust from network location. Micro-segmentation is one technique that implements it by enforcing policy between individual workloads.
Is wireless security still tested?
Yes. The outline lists wireless networks including Bluetooth, Wi-Fi, Zigbee and satellite, and cellular 4G and 5G. Know WPA2 and WPA3 differences, enterprise authentication and common wireless attacks such as evil twins.
How does Domain 4 connect to Domain 7?
Domain 4 designs the network and places controls; Domain 7 operates them through logging, monitoring, IDS and IPS, and incident response. Sensor placement decisions made here determine what operations can see.
How long should I study Domain 4?
Our editorial planning estimate is 30 to 35 hours within a 250-hour plan. Candidates without networking experience should budget toward the upper end.
Other Cybersecurity certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
- Systems Security Certified Practitioner Same subject: Domain 6: Network and Communications Security (16%)
- CompTIA Cybersecurity Analyst+ Study guide
- Microsoft Security Operations Analyst Associate Study guide
- Certified Ethical Hacker Study guide
- Penetration Tester Study guide
- Certified in Risk and Information Systems Control Study guide
- CompTIA PenTest+ Study guide
- CompTIA SecurityX (CASP+) Study guide
- Azure Security Engineer Associate Study guide
- CISM (Certified Information Security Manager) Study guide
- CompTIA Security+ Study guide
- Certified Information Systems Auditor Study guide
- Certified Cloud Security Professional Study guide
Test your Domain 4 knowledge
You have covered network architecture, segmentation, secure protocols, network components and secure channels. Test whether you can place controls and choose protocols correctly in exam scenarios.