Overview
Domain 6 covers the network knowledge a security practitioner uses daily. It starts with fundamentals: the OSI and TCP/IP models, topologies, network relationships, transmission media, software-defined networking including SD-WAN, and commonly used ports and protocols. It covers network attacks such as DDoS, man-in-the-middle and DNS cache poisoning, with countermeasures. It covers network access controls and protocols such as IEEE 802.1X, RADIUS and TACACS+, and remote access through VPNs, thin clients and virtual desktops. It then covers network security management, including device placement, segmentation and secure device management, followed by operating security appliances: firewalls, proxies, WAFs, CASBs, IDS and IPS, NAC, DLP and UTM. It finishes with wireless security and the Internet of Things.
The domain is where identity decisions from Domain 2 and cryptography from Domain 5 are enforced in transit, and where much of the telemetry for Domain 3's monitoring comes from.
How it's tested
Questions describe a network design, an attack symptom or a configuration task and ask which device, protocol or placement is MOST appropriate, which attack is occurring, or what weakness exists. Expect practical scenarios, with some requiring knowledge of ports or OSI layers.
-
Identify the attack
Symptoms are described, such as users redirected to a fake site or traffic flooding a server, and you must name the attack and its best countermeasure.
-
Choose and place the device
A protection need is described, and you must pick the appliance and where it goes, such as inline, passive or at a segment boundary.
-
Protocol choice
An access, remote or wireless requirement is given, and you must choose the right protocol or standard.
Users report that a trusted banking site sometimes loads a lookalike page, even when they type the address correctly, and only on the corporate network. Phishing is tempting, but users typed the correct address. The pattern points to DNS cache poisoning on the internal resolver, where forged records redirect queries. The countermeasure is DNSSEC validation and securing the resolver, not just more awareness training.
Subdomains 7
Official subdomains from the ISC2 outline, in outline order.
6.1 Understand and apply fundamental concepts of networkingOSI and TCP/IP models, topologies, relationships, media, SDN and common ports and protocols.
- What it means
- Fundamentals include the seven-layer OSI model and four-layer TCP/IP model, network topologies, peer-to-peer and client-server relationships, wired and wireless media, software-defined networking including SD-WAN, network virtualization and automation, and commonly used ports and protocols.
- What to understand
- Knowing the layer tells you which controls apply: switches and VLANs at layer 2, routers and IP filtering at layer 3, ports at layer 4, and application inspection at layer 7. Common ports to recall include 22 (SSH), 23 (Telnet), 25 (SMTP), 53 (DNS), 80 and 443 (HTTP and HTTPS), 389 and 636 (LDAP and LDAPS), and 3389 (RDP). SDN separates the control plane from the data plane, which makes the controller a high-value target.
- How it shows up
- Questions ask which layer a device or attack operates at, which port a service uses, or what security risk SDN introduces.
- Common confusion
- Treating secure and insecure versions of protocols as interchangeable. Telnet and FTP send credentials in clear text, while SSH and SFTP encrypt them.
6.2 Understand network attacksDDoS, man-in-the-middle, DNS cache poisoning and their countermeasures.
- What it means
- Network attacks include distributed denial of service (DDoS), which overwhelms resources, man-in-the-middle (MITM), which intercepts or alters traffic, and DNS cache poisoning, which inserts forged DNS records. Countermeasures include content delivery networks, firewalls, network access controls and intrusion detection and prevention systems.
- What to understand
- Each attack targets a different property. DDoS targets availability, MITM targets confidentiality and integrity, and DNS poisoning targets integrity of name resolution. CDNs and upstream filtering absorb DDoS traffic, encryption with certificate validation defeats most MITM attacks, and DNSSEC protects DNS integrity.
- How it shows up
- Symptoms are described and you must identify the attack, or an attack is named and you must choose the BEST countermeasure.
- Common confusion
- Assuming a firewall alone stops a large DDoS. Volumetric attacks can saturate the link before traffic reaches the firewall, so upstream or CDN mitigation is needed.
6.3 Manage network access controls802.1X, RADIUS and TACACS+, and remote access options.
- What it means
- Network access control standards include IEEE 802.1X, which authenticates devices before granting port or wireless access, RADIUS and TACACS+ for centralized authentication, authorization and accounting, and remote access through thin clients, VPNs and virtual desktop infrastructure.
- What to understand
- In 802.1X the supplicant (the device) talks to the authenticator (switch or access point), which checks with the authentication server, often RADIUS. RADIUS uses UDP and encrypts only the password. TACACS+ uses TCP, encrypts the entire payload and separates authentication, authorization and accounting, which suits device administration. VDI keeps data in the data center rather than on endpoints.
- How it shows up
- Questions ask which protocol fits administrator access to network devices, what 802.1X roles are, or which remote access option keeps data off endpoints.
- Common confusion
- Assuming RADIUS encrypts the full exchange. Only the password is encrypted, which is one reason TACACS+ is preferred for device administration.
6.4 Manage network securityDevice placement, segmentation and secure device management.
- What it means
- Network security management covers the logical and physical placement of devices (inline, passive or virtual), segmentation through physical and logical separation, data and control plane separation, VLANs, ACLs, firewall zones and micro-segmentation, and secure management of network devices.
- What to understand
- Inline devices can block traffic but become a failure point, and passive devices observe copies of traffic without affecting flow. Segmentation limits lateral movement, but only if traffic between segments is filtered. Network devices should be managed over secure protocols through a separate management network, with default credentials changed.
- How it shows up
- Questions ask where to place a sensor, how to limit an attacker's lateral movement, or how to secure device management.
- Common confusion
- Treating VLANs as a security boundary by themselves. Without ACLs or firewall rules between them, VLANs mainly organize traffic.
6.5 Operate and configure network-based security appliances and servicesFirewalls, proxies, IDS and IPS, routers and switches, traffic shaping, NAC, DLP and UTM.
- What it means
- This covers firewalls and proxies (including filtering methods, WAFs and CASBs), network intrusion detection and prevention, routers and switches, traffic-shaping devices such as WAN optimizers and load balancers, network access control (NAC), data loss prevention (DLP), and unified threat management (UTM).
- What to understand
- Firewalls range from packet filtering through stateful inspection to application-layer and next-generation firewalls. A WAF protects web applications specifically. A CASB controls cloud service use. NAC checks device posture before granting access. UTM combines several functions in one device, which is simpler but creates a single point of failure.
- How it shows up
- A protection need is described and you must choose the appliance, or a configuration problem is described and you must identify it.
- Common confusion
- Assuming a network firewall protects web applications from injection attacks. That requires a WAF or application-layer inspection.
6.6 Secure wireless communicationsWireless technologies and authentication and encryption protocols.
- What it means
- Wireless technologies include cellular, Wi-Fi, Bluetooth and near-field communication (NFC). Authentication and encryption protocols include WPA, WPA2, WPA3 and the Extensible Authentication Protocol (EAP).
- What to understand
- WPA3 is the current standard. Its personal mode uses Simultaneous Authentication of Equals (SAE), which resists offline password guessing. Enterprise modes use 802.1X with EAP for per-user authentication. Original WPA and WEP are obsolete. Bluetooth and NFC have short range but still need pairing controls and updates.
- How it shows up
- Questions ask for the most secure wireless configuration, or the right authentication approach for an enterprise network.
- Common confusion
- Treating a shared pre-shared key as suitable for large enterprises. Enterprise mode with 802.1X gives individual accountability and easy revocation.
6.7 Secure and monitor Internet of Things (IoT)Configuration, network isolation, firmware updates and end-of-life management.
- What it means
- IoT security covers configuring devices securely, isolating them on separate network segments, keeping firmware updated, and managing end of life.
- What to understand
- IoT devices often ship with weak defaults, limited update support and no ability to run endpoint agents. Network isolation is therefore the primary control, along with changing default credentials, monitoring their traffic, and replacing devices that no longer receive updates.
- How it shows up
- A scenario involves cameras, sensors or smart devices on the corporate network, and you must choose the BEST control.
- Common confusion
- Expecting to protect IoT devices with the same endpoint software as laptops. Most cannot run it, so network controls carry the load.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
OSI layers
Physical, data link, network, transport, session, presentation, application.
- Remember
- Switches and VLANs are layer 2, routers are layer 3, ports are layer 4, and WAFs inspect layer 7.
- Tested as
- Layer identification questions.
- Trap
- Placing a stateful firewall at layer 7.
-
Common ports
22 SSH, 23 Telnet, 25 SMTP, 53 DNS, 80 HTTP, 443 HTTPS, 389 LDAP, 636 LDAPS, 3389 RDP.
- Remember
- Secure alternatives replace clear-text protocols such as Telnet and FTP.
- Tested as
- Configuration and filtering questions.
- Trap
- Allowing Telnet for device management.
-
IDS vs. IPS
An IDS detects and alerts, usually passively. An IPS sits inline and can block.
- Remember
- An IPS can disrupt legitimate traffic if misconfigured.
- Tested as
- Placement questions.
- Trap
- Expecting a passive IDS to stop attacks.
-
RADIUS vs. TACACS+
RADIUS uses UDP and encrypts only the password. TACACS+ uses TCP, encrypts the whole payload and separates AAA.
- Remember
- TACACS+ suits network device administration.
- Tested as
- Protocol selection questions.
- Trap
- Assuming RADIUS encrypts everything.
-
802.1X roles
Supplicant, authenticator and authentication server.
- Remember
- The authenticator is the switch or access point, not the server.
- Tested as
- NAC questions.
- Trap
- Mixing up authenticator and authentication server.
-
DNS cache poisoning
Inserting forged records into a DNS resolver's cache to redirect users.
- Remember
- DNSSEC validation protects against it.
- Tested as
- Attack identification.
- Trap
- Blaming phishing when users typed the correct address.
-
Segmentation
Dividing a network into zones to limit access and lateral movement.
- Remember
- It only helps if traffic between segments is filtered.
- Tested as
- Design questions.
- Trap
- Treating VLANs alone as a security boundary.
-
Micro-segmentation
Fine-grained segmentation down to individual workloads.
- Remember
- Common in data centers and cloud to stop lateral movement.
- Tested as
- Design questions.
- Trap
- Confusing it with VLANs.
-
WPA3 SAE
WPA3 personal mode uses Simultaneous Authentication of Equals.
- Remember
- It resists offline dictionary attacks on captured handshakes.
- Tested as
- Wireless security questions.
- Trap
- Choosing WPA2-PSK as the most secure option.
-
NAC
Network access control checks device identity and posture before granting access.
- Remember
- Non-compliant devices can be quarantined or given limited access.
- Tested as
- Access control questions.
- Trap
- Confusing NAC with a firewall.
-
IoT isolation
Placing IoT devices on a separate, restricted network segment.
- Remember
- It is the primary control when devices cannot run security software.
- Tested as
- IoT questions.
- Trap
- Relying on device firmware alone.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
IDS vs. IPS
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| IDS | Monitors traffic and alerts on suspicious activity | Usually passive, cannot block on its own | Expecting it to stop attacks |
| IPS | Inspects traffic inline and can block it | Active prevention, can disrupt legitimate traffic | Deploying it untuned in blocking mode |
RADIUS vs. TACACS+
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| RADIUS | Centralized AAA, common for network and wireless access | UDP, encrypts only the password, combines authentication and authorization | Assuming the whole exchange is encrypted |
| TACACS+ | Centralized AAA, common for device administration | TCP, encrypts the full payload, separates AAA functions | Choosing RADIUS for granular command authorization |
Packet filter vs. stateful vs. application-layer firewall vs. WAF
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Packet filter | Allows or blocks based on addresses, ports and protocols | No connection context | Assuming it tracks sessions |
| Stateful firewall | Tracks connection state | Allows return traffic for established sessions | Expecting it to inspect application content |
| Application-layer or next-generation firewall | Inspects application protocols and content | Understands applications, not just ports | Assuming it replaces all other controls |
| WAF | Protects web applications from attacks such as injection | Focused on HTTP and web application threats | Using a network firewall for web application attacks |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
IDS to block
- What candidates pick
- Deploy an IDS to stop attacks reaching a server.
- Why it looks right
- IDS and IPS sound similar.
- Why it's wrong
- An IDS detects and alerts but does not sit inline to block. Prevention needs an IPS or firewall.
Clue to watch for The requirement says block, stop or prevent.
-
VLAN as firewall
- What candidates pick
- Put sensitive systems on their own VLAN as the complete isolation control.
- Why it looks right
- VLANs separate traffic.
- Why it's wrong
- If routing between VLANs is unrestricted, attackers can still reach them. ACLs or firewall rules are needed.
Clue to watch for The question asks how to prevent lateral movement.
-
RADIUS for device admin
- What candidates pick
- Use RADIUS to control administrator commands on routers and switches.
- Why it looks right
- RADIUS is the common AAA protocol.
- Why it's wrong
- TACACS+ separates authorization and encrypts the full payload, which suits granular device administration.
Clue to watch for The scenario is about network device administration or command authorization.
-
Firewall stops DDoS
- What candidates pick
- Add firewall rules to defeat a large volumetric DDoS attack.
- Why it looks right
- Firewalls block unwanted traffic.
- Why it's wrong
- Volumetric attacks can saturate the link before traffic reaches the firewall. Upstream filtering or a CDN is needed.
Clue to watch for The attack is large and the internet link is saturated.
-
Shared key for the enterprise
- What candidates pick
- Use WPA2 or WPA3 with a single pre-shared key for a large company network.
- Why it looks right
- It is simple to deploy.
- Why it's wrong
- One shared key gives no individual accountability and is hard to revoke. Enterprise mode with 802.1X is better.
Clue to watch for The scenario involves many employees or staff turnover.
-
Agent on IoT
- What candidates pick
- Install endpoint protection software on IP cameras.
- Why it looks right
- Endpoint software protects other devices.
- Why it's wrong
- Most IoT devices cannot run agents. Network isolation, default credential changes and monitoring are the practical controls.
Clue to watch for The devices are cameras, sensors or other embedded systems.
Answer framework
For any Domain 6 scenario, use these steps to find the answer the SSCP expects.
- Identify the OSI layer and the protocols involved, because that determines which devices and controls can actually act on the traffic.
- If an attack is described, match the symptoms to the attack type and to the property it targets: confidentiality, integrity or availability.
- Choose the appliance that matches the need, such as IPS to block, IDS to detect, WAF for web applications, NAC for device posture or DLP for data leaving.
- Decide placement and segmentation, putting blocking devices inline, filtering traffic between segments, and isolating IoT and management networks.
- Prefer secure protocols and enterprise authentication, such as SSH over Telnet, TACACS+ for device administration, and WPA3 with 802.1X for staff.
Practice question
Want more like this? The SSCP practice test has questions for every domain.
Checklist
0 of 13
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
This is a large domain, so start by locking down fundamentals in 6.1: the OSI layers and the common ports. Many questions assume you know them, and weak recall makes later topics harder.
Next, study attacks and countermeasures in 6.2 together with appliances in 6.5. For each attack, name the property it targets and the device or protocol that stops it. Build a comparison of firewall types, IDS versus IPS, WAF, NAC, DLP and UTM.
Then cover network access control in 6.3, especially 802.1X roles and RADIUS versus TACACS+, and segmentation and placement in 6.4. Candidates commonly underestimate the placement questions and the point that VLANs need filtering to provide security.
Finish with wireless in 6.6 and IoT in 6.7. These are shorter, but WPA3, enterprise authentication and IoT isolation produce clear questions.
Afterwards, take mixed practice with Domains 2 and 5, since network access control applies identity concepts and network protocols apply cryptography.
FAQ
How much of the SSCP exam is Domain 6?
Network and Communications Security carries 16% under the outline effective 1 October 2025, tied for the largest share.
Do I need to memorize port numbers?
The outline lists commonly used ports and protocols, so know the main ones and their secure alternatives, such as SSH on 22 instead of Telnet on 23.
What is the difference between an IDS and an IPS?
An IDS detects and alerts, usually from a passive position. An IPS sits inline and can block malicious traffic.
When should I choose TACACS+ over RADIUS?
For administering network devices, because TACACS+ encrypts the full payload and separates authentication, authorization and accounting, allowing command-level control.
Are VLANs a security control?
They support segmentation, but they provide security only when traffic between them is restricted with ACLs or firewall rules.
What is the most secure Wi-Fi option?
WPA3, with enterprise mode using 802.1X for organizations and SAE-based personal mode for smaller environments.
How does Domain 6 relate to Domain 2?
Domain 6's network access controls, such as 802.1X, RADIUS, TACACS+ and NAC, enforce the identity and access decisions covered in Domain 2.
Other Cybersecurity certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
- CISSP Same subject: Domain 4: Communication and Network Security (13%)
- CompTIA Cybersecurity Analyst+ Study guide
- Microsoft Security Operations Analyst Associate Study guide
- Certified Ethical Hacker Study guide
- Penetration Tester Study guide
- Certified in Risk and Information Systems Control Study guide
- CompTIA PenTest+ Study guide
- CompTIA SecurityX (CASP+) Study guide
- Azure Security Engineer Associate Study guide
- CISM (Certified Information Security Manager) Study guide
- CompTIA Security+ Study guide
- Certified Information Systems Auditor Study guide
- Certified Cloud Security Professional Study guide
Test your Domain 6 knowledge
You have covered networking fundamentals, attacks, access control, segmentation, security appliances, wireless and IoT. Test whether you can choose and place the right controls under exam conditions.