CISSP Domain 4 Guide: Communication and Network Security

What Domain 4 covers

• OSI and TCP/IP models and where controls sit in each
• Secure network architecture: segmentation, DMZ, zero trust, micro-segmentation
• Secure protocols and their insecure predecessors
• Wireless and cellular security
• Remote access, VPNs, and tunnelling
• Network attacks and their countermeasures
• Converged protocols, voice, and multimedia

The OSI model as an exam tool

When a question names an attack, identify the layer first. ARP poisoning is layer 2, so the control is layer 2 — dynamic ARP inspection or port security, not a firewall rule.

Secure protocol substitutions

Segmentation and architecture

• Segmentation limits blast radius. It is the answer to a surprising number of 'how do we reduce impact' questions.
• A DMZ hosts services reachable from untrusted networks; internal systems never sit in it.
• Zero trust removes implicit trust based on network location — verify every request, every time.
• Out-of-band management keeps administrative access off the production data path.

Attacks to recognise

• ARP poisoning / MAC flooding — layer 2; counter with port security and DAI.
• DNS poisoning — counter with DNSSEC.
• Session hijacking — counter with encrypted sessions and token rotation.
• DDoS — counter with upstream scrubbing, rate limiting, and capacity.
• VLAN hopping — counter by disabling auto-trunking and unused ports.
• Evil twin / rogue AP — counter with 802.1X, wireless IDS, and mutual authentication.

Study checklist

1. Place any named protocol or attack at the correct OSI layer instantly.
2. Recite the secure replacement for each legacy protocol.
3. Explain what segmentation, a DMZ, and zero trust each buy you.
4. Compare IPsec tunnel and transport modes and when each is used.

Frequently asked questions