Lesson Fourteen

Communication and Network Security Foundations

SierraTec Secure CISSP Certification Preparation Course

Lesson Overview

Networks allow systems, applications, users, cloud environments, and organizations to communicate.

They also create pathways through which attackers can:

• intercept information;

• impersonate systems;

• move laterally;

• exploit vulnerable services;

• disrupt availability;

• bypass security boundaries.

The CISSP professional therefore needs more than the ability to memorize protocol names or port numbers. You must understand how communication moves through network layers, where trust changes, how traffic is segmented, and where security controls should be applied.

Lesson Fourteen begins Domain 4 — Communication and Network Security, which currently represents 13% of the CISSP examination. Current Objective 4.1 requires candidates to apply secure-design principles to network architectures, including OSI and TCP/IP models, IPv4 and IPv6, secure protocols, multilayer and converged protocols, transport architecture, performance metrics, traffic flows, physical/logical/micro-segmentation, edge networks, wireless and cellular networks, CDNs, SDN, VPCs, and network monitoring and management.

Modern enterprise networking is no longer limited to a corporate LAN protected by one perimeter firewall. NIST describes today's enterprise network landscape as including geographically distributed resources, multiple cloud services, microservices, Zero Trust Network Access, and architectures such as SASE.

The central Lesson Fourteen question is:

How does communication move through networks, and how should security be designed across network layers, devices, protocols, segments, trust boundaries, and traffic paths?

CISSP Exam Objective Alignment

These areas reflect the current Objective 4.1 scope.

Learning Objectives

After completing this lesson, you should be able to:

1. Explain the purpose of layered network models.

2. Identify all seven OSI layers.

3. Explain the security relevance of each OSI layer.

4. Explain the TCP/IP model.

5. Map TCP/IP layers to the OSI model.

6. Explain encapsulation and decapsulation.

7. Define a frame, packet, segment, and data unit.

8. Explain Ethernet fundamentals.

9. Distinguish MAC addresses from IP addresses.

10. Explain switching and routing.

11. Explain IPv4.

12. Explain IPv6.

13. Distinguish unicast, broadcast, multicast, and anycast.

14. Explain why IPv6 does not use broadcast addressing.

15. Explain TCP.

16. Explain UDP.

17. Distinguish TCP from UDP.

18. Explain the TCP three-way handshake.

19. Define ports.

20. Define sockets.

21. Recognize common security-relevant ports.

22. Explain network topologies.

23. Explain the data, control, and management planes.

24. Distinguish store-and-forward from cut-through switching.

25. Explain bandwidth.

26. Explain throughput.

27. Explain latency.

28. Explain jitter.

29. Explain signal-to-noise ratio.

30. Distinguish north-south from east-west traffic.

31. Explain physical segmentation.

32. Explain logical segmentation.

33. Explain VLANs.

34. Explain VPNs.

35. Explain VRF.

36. Explain micro-segmentation.

37. Explain air-gapped systems.

38. Explain in-band versus out-of-band management.

39. Explain network overlays.

40. Explain edge networks.

41. Explain ingress and egress.

42. Explain network peering.

43. Explain the security implications of wireless networks.

44. Recognize Wi-Fi, Bluetooth, Zigbee, and satellite communication.

45. Explain cellular-network security considerations.

46. Explain CDNs.

47. Explain SDN.

48. Explain SD-WAN.

49. Explain Network Functions Virtualization.

50. Explain VPCs.

51. Explain converged protocols.

52. Explain iSCSI and VoIP conceptually.

53. Explain multilayer protocol implications.

54. Explain TLS.

55. Explain SSH.

56. Explain IPsec.

57. Explain transport and tunnel mode.

58. Explain why SSL should be treated as legacy.

59. Explain network observability.

60. Apply CISSP network-security reasoning to scenarios.

Part I — Why Networks Use Layers

1. Communication Is Complex

A single web request may involve:

USER

  │

  ▼

WEB APPLICATION

  │

  ▼

TLS

  │

  ▼

TCP

  │

  ▼

IP

  │

  ▼

ETHERNET / WI-FI

  │

  ▼

PHYSICAL SIGNAL

Layering divides this complexity into manageable functions.

2. Why Layering Helps Security

A layered model allows security professionals to ask:

Which layer is involved?

What information is visible there?

Which controls can operate there?

For example:

• MAC filtering concerns a lower network layer.

• IP filtering concerns Layer 3.

• TCP ports concern Layer 4.

• HTTP inspection operates higher in the stack.

Part II — The OSI Model

3. Seven OSI Layers

7   APPLICATION

        │

6   PRESENTATION

        │

5   SESSION

        │

4   TRANSPORT

        │

3   NETWORK

        │

2   DATA LINK

        │

1   PHYSICAL

Memory aid:

All People Seem To Need Data Processing

From Layer 7 to Layer 1:

Application — Presentation — Session — Transport — Network — Data Link — Physical

Part III — Layer 1: Physical

4. Physical Layer

The Physical layer concerns transmission of raw bits through media.

Examples:

• copper;

• fiber;

• radio;

• connectors;

• electrical signaling.

5. Physical-Layer Security

Threats include:

• cable tapping;

• cable cutting;

• RF interference;

• unauthorized physical connections.

Controls include:

• secured wiring closets;

• protected cable routes;

• physical access control.

Part IV — Layer 2: Data Link

6. Data-Link Layer

Layer 2 provides communication across a local network segment.

Important concepts include:

• Ethernet;

• MAC addresses;

• frames;

• switches;

• VLANs.

7. MAC Address

A Media Access Control address identifies a network interface at the data-link level.

Example format:

00:1A:2B:3C:4D:5E

8. Frame

A Layer 2 unit is commonly called a:

Frame

Conceptually:

┌────────────┬────────────┬────────────┐

│ DEST MAC   │ SOURCE MAC │ PAYLOAD    │

└────────────┴────────────┴────────────┘

9. Switch

A network switch forwards frames based primarily on Layer 2 addressing.

Conceptually:

DEVICE A ──┐

DEVICE B ──┼──► SWITCH ──► DEVICE C

DEVICE D ──┘

10. Switch Security Importance

A switched network can still face attacks involving:

• rogue devices;

• VLAN misconfiguration;

• Layer 2 spoofing;

• unauthorized access.

Switching alone does not establish strong trust.

Part V — Layer 3: Network

11. Network Layer

Layer 3 is primarily responsible for:

• logical addressing;

• routing;

• packet forwarding.

The most important protocol family is:

Internet Protocol

12. Packet

A Layer 3 data unit is commonly called a:

Packet

13. Router

A router makes forwarding decisions based on network-layer addressing.

NETWORK A

    │

    ▼

 ROUTER

    │

    ▼

NETWORK B

14. Switch Versus Router

Modern network devices can combine multiple functions, so the table represents foundational roles.

Part VI — Layer 4: Transport

15. Transport Layer

Layer 4 provides end-to-end transport between applications.

Two major protocols are:

• TCP;

• UDP.

16. Segment and Datagram

TCP data units are commonly called:

Segments

UDP units are commonly called:

Datagrams

Part VII — Layer 5: Session

17. Session Layer

The Session layer conceptually manages communication sessions between systems or applications.

Functions may involve:

• session establishment;

• maintenance;

• termination.

In real TCP/IP implementations, these responsibilities frequently exist within application protocols rather than as a distinct OSI implementation layer.

Part VIII — Layer 6: Presentation

18. Presentation Layer

The Presentation layer concerns representation of information.

Concepts can include:

• encoding;

• serialization;

• compression;

• cryptographic representation.

Part IX — Layer 7: Application

19. Application Layer

The Application layer provides network services directly supporting applications.

Examples include:

• HTTP;

• DNS;

• SMTP;

• SSH.

Part X — OSI Security Perspective

20. Layered Security Map

7 APPLICATION      → WAF / application controls

6 PRESENTATION     → Encoding / encryption representation

5 SESSION          → Session controls

4 TRANSPORT        → TCP/UDP ports, stateful inspection

3 NETWORK          → IP routing, ACLs, IPsec

2 DATA LINK        → VLANs, switching, Layer-2 controls

1 PHYSICAL         → Cabling, RF, physical access

NIST network-security material similarly uses layered network models as a basis for identifying where security controls operate.

Part XI — TCP/IP Model

21. TCP/IP Layers

A common four-layer view is:

APPLICATION

    │

TRANSPORT

    │

INTERNET

    │

NETWORK ACCESS

22. Mapping OSI to TCP/IP

23. Why Learn Both?

OSI provides a conceptual troubleshooting and security model.

TCP/IP reflects the practical Internet protocol architecture.

CISSP candidates should be comfortable reasoning with both.

Part XII — Encapsulation

24. What Is Encapsulation?

As information travels down a protocol stack, each layer adds information needed for its function.

APPLICATION DATA

      │

      ▼

TCP HEADER + DATA

      │

      ▼

IP HEADER + TCP SEGMENT

      │

      ▼

ETHERNET HEADER + IP PACKET

      │

      ▼

BITS ON MEDIA

25. Decapsulation

At the destination:

BITS

  ↓

FRAME

  ↓

PACKET

  ↓

SEGMENT

  ↓

APPLICATION DATA

Headers are interpreted and removed as the information moves upward.

Part XIII — Multilayer Security Implications

26. Security Controls See Different Information

A Layer 3 control may see:

• source IP;

• destination IP.

A Layer 4 control may additionally see:

• TCP/UDP ports.

An application-aware control may understand:

• URLs;

• commands;

• application behavior.

27. Encapsulation Can Hide Information

A packet can carry another protocol inside it.

Example:

OUTER IP

   │

   ▼

VPN TUNNEL

   │

   ▼

INNER IP

   │

   ▼

APPLICATION

A security device that examines only the outer header may lack visibility into the inner communication.

28. CISSP Principle

The current exam outline explicitly calls out the implications of multilayer protocols.

Think:

Controls must be placed where they can actually observe and enforce the required security policy.

Part XIV — IPv4

29. IPv4

IPv4 uses 32-bit addresses.

Example:

192.0.2.10

30. IPv4 Addressing

IPv4 supports:

• unicast;

• broadcast;

• multicast.

31. Unicast

One sender communicates with one destination.

HOST A ─────────► HOST B

32. Broadcast

One sender communicates with all systems within an applicable broadcast scope.

            ┌──► HOST B

HOST A ─────┼──► HOST C

            └──► HOST D

33. Multicast

Traffic is delivered to members of a selected group.

HOST A

  │

  └────► MULTICAST GROUP

            ├── HOST B

            └── HOST D

Part XV — IPv6

34. IPv6

IPv6 expands IP addressing from 32 bits to 128 bits and introduces an addressing architecture centered on unicast, anycast, and multicast.

Example:

2001:db8::10

35. Why IPv6 Exists

IPv6 provides:

• much larger address space;

• improved address hierarchy;

• protocol improvements supporting modern networking.

36. IPv6 Address Types

The core IPv6 addressing architecture identifies:

• unicast;

• anycast;

• multicast.

IPv6 does not use broadcast addresses; multicast replaces broadcast-style functions.

Part XVI — Anycast

37. Anycast

An anycast address can be assigned to multiple interfaces.

Traffic is routed toward one instance—typically the one considered nearest according to routing metrics.

          SERVICE ADDRESS

                │

      ┌─────────┼─────────┐

      ▼         ▼         ▼

   SITE A     SITE B     SITE C



Client routed toward

one appropriate site

38. Anycast Use

Anycast can support geographically distributed services such as:

• DNS;

• content delivery;

• resilient network services.

Part XVII — IPv4 Versus IPv6

39. Comparison

40. CISSP Trap

Do not assume:

IPv6 is automatically secure simply because it is newer.

Security still requires:

• access control;

• monitoring;

• segmentation;

• secure configuration.

Part XVIII — TCP

41. Transmission Control Protocol

TCP provides a reliable, in-order byte-stream service and uses port numbers to identify application services and separate flows. It is connection oriented and uses retransmission and sequencing to support reliable delivery.

42. TCP Characteristics

Associate TCP with:

• connection-oriented communication;

• sequencing;

• acknowledgments;

• retransmission;

• reliable ordered delivery.

43. TCP Three-Way Handshake

CLIENT                       SERVER



  SYN ─────────────────────►



      ◄──────────────── SYN-ACK



  ACK ─────────────────────►



       CONNECTION ESTABLISHED

44. Why Handshake Matters

The handshake establishes state between endpoints before normal data transfer.

Stateful network security devices can use connection state to make better filtering decisions.

Part XIX — UDP

45. User Datagram Protocol

UDP provides lightweight datagram delivery without TCP's connection establishment and reliability mechanisms.

Think:

Low overhead, but reliability must be provided elsewhere if required.

46. UDP Characteristics

Associate UDP with:

• connectionless communication;

• no TCP-style handshake;

• lower transport overhead;

• no guaranteed ordered delivery.

47. UDP Use Cases

Common use cases may include:

• DNS queries;

• voice/video traffic;

• streaming;

• real-time communication.

Protocols may add their own reliability mechanisms when required.

Part XX — TCP Versus UDP

48. Comparison

Part XXI — Ports

49. What Is a Port?

Ports allow transport-layer protocols to identify application services or communication endpoints.

TCP explicitly uses port numbers to identify application services and multiplex flows between hosts.

50. IP Address Versus Port

IP address identifies:

Host/interface location.

Port identifies:

Application/service endpoint.

51. Socket Concept

A network socket can conceptually be identified by combinations such as:

IP ADDRESS

    +

PORT

    +

PROTOCOL

Example:

192.0.2.5 : 443 / TCP

Part XXII — High-Yield Ports

52. Common Ports

Do not treat CISSP as a pure port-number examination, but know major service associations.

Part XXIII — Network Devices

53. Hub

A traditional hub repeats received signals broadly across connected ports.

It provides little traffic isolation.

54. Bridge

A bridge connects Layer 2 network segments and makes forwarding decisions based on MAC-address information.

Modern switches largely perform this role at scale.

55. Switch

A switch forwards frames between interfaces based on Layer 2 information.

56. Router

A router forwards packets between IP networks.

57. Gateway

Gateway is a broader term for a system that connects or translates between environments, networks, or protocols.

Its exact meaning depends on context.

58. Firewall

A firewall enforces traffic policy between security zones or systems.

Detailed firewall operation will be revisited under later Domain 4 and Domain 7 material.

59. Proxy

A proxy acts as an intermediary between a client and another service.

CLIENT

   │

   ▼

PROXY

   │

   ▼

DESTINATION

A proxy can provide:

• policy enforcement;

• inspection;

• hiding of internal architecture;

• logging.

Part XXIV — Network Topologies

60. Topology

Network topology describes how nodes and links are arranged.

The current CISSP outline includes topology as part of transport architecture.

61. Bus

A ─── B ─── C ─── D

Nodes share a common communication path.

62. Star

       A

       │

B ── SWITCH ── C

       │

       D

Modern Ethernet LANs commonly use star-style physical designs.

63. Ring

A ── B

│    │

D ── C

Nodes form a logical or physical ring.

64. Mesh

A ───── B

|\     /|

| \   / |

|  \ /  |

|  / \  |

| /   \ |

|/     \|

C ───── D

Multiple paths improve resilience.

65. Partial Versus Full Mesh

Full mesh provides direct links among all participating nodes.

Partial mesh provides multiple paths but not every possible direct link.

66. Security Consideration

Additional paths increase resilience but may also increase:

• complexity;

• attack surface;

• configuration requirements.

Part XXV — Network Planes

67. Three Important Planes

Modern network devices can be viewed through:

DATA PLANE

CONTROL PLANE

MANAGEMENT PLANE

The current CISSP outline explicitly includes these concepts.

68. Data Plane

The data plane handles forwarding of normal user or application traffic.

Example:

Forward this packet from interface A to interface B.

69. Control Plane

The control plane determines how traffic should be forwarded.

Functions can include:

• route calculation;

• topology learning;

• routing protocols.

70. Management Plane

The management plane allows administrators or management systems to:

• configure;

• monitor;

• manage

network devices.

71. Security Importance

Compromise of the management or control plane may allow an attacker to affect large amounts of data-plane traffic.

Therefore:

Management interfaces deserve especially strong protection.

Part XXVI — Store-and-Forward Switching

72. Store and Forward

A store-and-forward switch receives the complete frame before forwarding.

This can allow validation such as error checking before transmission.

73. Concept

FRAME ARRIVES

     │

     ▼

STORE COMPLETE FRAME

     │

     ▼

CHECK

     │

     ▼

FORWARD

Part XXVII — Cut-Through Switching

74. Cut Through

Cut-through switching begins forwarding before the complete frame has been received.

Benefit:

Lower latency.

Tradeoff:

Less opportunity to validate the complete frame before forwarding.

75. Comparison

Part XXVIII — Performance Metrics

76. Why Performance Matters to Security

Security controls consume network resources.

Poor performance can affect:

• availability;

• voice/video quality;

• user behavior.

The current CISSP outline explicitly includes bandwidth, latency, jitter, throughput, and signal-to-noise ratio.

77. Bandwidth

Bandwidth is the theoretical or designed capacity of a communication channel.

Think:

How much could the path carry?

78. Throughput

Throughput is the amount of useful traffic actually delivered over a period.

Think:

How much are we really getting?

79. Bandwidth Versus Throughput

A link may have:

1 Gbps bandwidth

but achieve:

700 Mbps actual throughput

because of:

• overhead;

• congestion;

• errors;

• processing.

80. Latency

Latency is the delay experienced when traffic moves from source to destination.

81. Jitter

Jitter is variation in packet delay over time.

Voice and video can be particularly sensitive to jitter.

82. Signal-to-Noise Ratio

Signal-to-noise ratio compares desired signal strength to background noise or interference.

Low SNR can reduce:

• communication quality;

• reliability;

• performance.

Part XXIX — Traffic Flows

83. North-South Traffic

North-south traffic generally refers to traffic entering or leaving an environment.

INTERNET

   │

   ▼

ENTERPRISE

84. East-West Traffic

East-west traffic generally refers to traffic moving laterally among internal workloads, systems, or services.

SERVER A ───── SERVER B

     │

     └──────── SERVER C

85. Why East-West Security Matters

Traditional perimeter security focused heavily on north-south traffic.

Modern cloud and microservice environments may generate extensive east-west communication.

Compromise of one workload can create lateral-movement risk.

NIST notes that the modern enterprise network includes cloud services, distributed resources, and microservice architectures, increasing the importance of newer network-security frameworks.

Part XXX — Segmentation

86. What Is Segmentation?

Segmentation divides networks or systems into distinct security zones.

Objectives can include:

• limiting broadcast scope;

• limiting lateral movement;

• applying different policies;

• separating sensitive assets.

87. Flat Network

USER PCS

   │

SERVERS

   │

DATABASES

   │

ADMIN SYSTEMS

   │

BACKUPS



Everything broadly reachable.

A flat network creates large compromise pathways.

88. Segmented Network

USER VLAN

   │

FIREWALL

   │

APPLICATION ZONE

   │

FIREWALL

   │

DATABASE ZONE



ADMIN ZONE ── Separate controls



BACKUP ZONE ─ Separate controls

Part XXXI — Physical Segmentation

89. Physical Segmentation

Physical segmentation uses physically separate infrastructure or paths.

Examples listed by ISC2 include:

• in-band;

• out-of-band;

• air-gapped approaches.

90. Air Gap

An air-gapped environment intentionally lacks normal direct network connectivity to other environments.

CORPORATE NETWORK



      X



ISOLATED SYSTEM

91. Air Gap Is Not Magic

Air-gapped systems can still be exposed through:

• removable media;

• maintenance devices;

• insider access;

• supply-chain compromise.

Isolation reduces attack paths but does not eliminate risk.

Part XXXII — In-Band Management

92. In Band

In-band management uses the same production network infrastructure for:

• business traffic;

• network administration.

93. Risk

If the production network fails or is compromised, management access may also become unavailable.

Part XXXIII — Out-of-Band Management

94. Out of Band

Out-of-band management uses a separate management path.

PRODUCTION NETWORK

       │

       ▼

   ROUTER/SWITCH



       ▲

       │

SEPARATE MANAGEMENT

      NETWORK

95. Benefits

Out-of-band management can improve:

• administrative isolation;

• resilience;

• emergency access.

It must itself be strongly secured because it provides privileged control.

Part XXXIV — Logical Segmentation

96. Logical Segmentation

Logical segmentation creates separate security domains using shared physical infrastructure.

Current ISC2 examples include:

• VLANs;

• VPNs;

• Virtual Routing and Forwarding;

• virtual domains.

Part XXXV — VLANs

97. Virtual LAN

A VLAN logically separates Layer 2 broadcast domains on switching infrastructure.

Conceptually:

SWITCH

 ├── VLAN 10: USERS

 ├── VLAN 20: FINANCE

 └── VLAN 30: SERVERS

98. VLAN Security Benefit

VLANs can improve:

• organization;

• segmentation;

• traffic isolation.

99. VLAN Is Not Complete Security

Inter-VLAN traffic still requires appropriate:

• routing;

• access controls;

• firewalls

when different trust levels exist.

Part XXXVI — VPN

100. Virtual Private Network

A VPN creates a logically protected communication path across another network.

SITE A

  │

  ▼

ENCRYPTED TUNNEL

  │

  ▼

INTERNET

  │

  ▼

SITE B

101. VPN Does Not Automatically Make Endpoints Trusted

A VPN protects a communication path.

It does not automatically prove that:

• endpoint is uncompromised;

• user is authorized for every resource.

Zero Trust concepts still apply.

Part XXXVII — VRF

102. Virtual Routing and Forwarding

VRF allows multiple logically separate routing tables or routing domains to coexist on shared network infrastructure.

Conceptually:

ROUTER

 ├── VRF A → CUSTOMER A

 └── VRF B → CUSTOMER B

This can provide strong logical traffic separation.

Part XXXVIII — Micro-Segmentation

103. What Is Micro-Segmentation?

Micro-segmentation applies fine-grained controls between individual:

• workloads;

• applications;

• services.

Instead of trusting an entire network segment, communication can be restricted at much smaller boundaries.

104. Traditional Segmentation

USER NETWORK

      │

   FIREWALL

      │

SERVER NETWORK

105. Micro-Segmentation

APP A ──POLICY──► DB A



APP B ──BLOCK────► DB A



APP C ──POLICY──► SERVICE D

106. Current CISSP Examples

The current outline associates micro-segmentation with:

• overlays/encapsulation;

• distributed firewalls;

• routers;

• IDS/IPS;

• Zero Trust.

Part XXXIX — Zero Trust and Networks

107. Zero Trust Principle

Network location alone should not determine trust.

NIST Zero Trust Architecture shifts emphasis from protecting network segments toward protecting individual resources, identities, services, and workflows.

108. Traditional Model

INSIDE NETWORK

     =

TRUSTED

109. Zero Trust Model

USER / DEVICE

      │

      ▼

IDENTITY

      │

      ▼

DEVICE / CONTEXT

      │

      ▼

POLICY

      │

      ▼

SPECIFIC RESOURCE

Part XL — Edge Networks

110. Network Edge

The network edge is where an enterprise environment connects with:

• Internet;

• cloud providers;

• telecom carriers;

• partners;

• external networks.

111. Ingress

Ingress means traffic:

entering an environment.

112. Egress

Egress means traffic:

leaving an environment.

113. Egress Security

Organizations often focus heavily on incoming traffic.

But outbound communication matters for detecting:

• data exfiltration;

• malware command-and-control;

• unauthorized cloud services.

Part XLI — Peering

114. Peering

Peering is direct network interconnection between autonomous networks or providers for traffic exchange.

Security considerations can include:

• route trust;

• contractual relationships;

• traffic filtering;

• monitoring.

Part XLII — Wireless Networks

115. Wireless Changes the Physical Boundary

Wired network access usually requires a physical connection.

Wireless signals can extend:

beyond office walls.

Therefore wireless networks have different physical exposure characteristics.

116. Current CISSP Wireless Examples

The current outline specifically lists:

• Bluetooth;

• Wi-Fi;

• Zigbee;

• satellite.

117. Wi-Fi

Wi-Fi provides wireless LAN communication.

Security considerations include:

• strong authentication;

• encryption;

• rogue access points;

• signal range;

• guest segmentation.

Detailed wireless protection will be expanded later.

118. Bluetooth

Bluetooth supports short-range wireless communication among devices.

Risks can involve:

• unauthorized pairing;

• weak configuration;

• unnecessary discoverability.

119. Zigbee

Zigbee is commonly associated with low-power device and IoT communication.

Security concerns include:

• device authentication;

• key management;

• weak embedded-device security.

120. Satellite

Satellite communication supports long-distance communication where terrestrial infrastructure may be limited or unavailable.

Security may involve:

• transmission confidentiality;

• latency;

• availability;

• ground infrastructure.

Part XLIII — Cellular and Mobile Networks

121. 4G and 5G

The current CISSP outline specifically identifies both 4G and 5G mobile networks.

Security professionals should recognize cellular networks as part of modern enterprise connectivity, particularly for:

• mobile users;

• remote sites;

• IoT;

• backup communication.

122. Cellular Does Not Equal Trusted

A cellular connection still requires:

• application security;

• identity security;

• encrypted communication;

• endpoint security.

Part XLIV — Content Delivery Networks

123. CDN

A Content Delivery Network distributes content across geographically dispersed infrastructure.

                ORIGIN

                  │

          ┌───────┼───────┐

          ▼       ▼       ▼

       EDGE A   EDGE B   EDGE C

          │       │       │

        USERS   USERS   USERS

124. Benefits

A CDN can improve:

• performance;

• availability;

• scalability.

Depending on design, it can also provide security services such as traffic filtering or DDoS absorption.

Part XLV — Software-Defined Networking

125. SDN

Software-Defined Networking separates network-control decisions from packet-forwarding functions and enables centralized or programmable network control.

The current outline explicitly includes SDN and APIs.

126. Traditional Concept

NETWORK DEVICE

 ├── CONTROL LOGIC

 └── FORWARDING

127. SDN Concept

SDN CONTROLLER

       │

       ▼

   PROGRAMMING

       │

   ┌───┼────┐

   ▼   ▼    ▼

SW1  SW2   SW3

128. SDN Security Benefit

SDN may enable:

• centralized policy;

• automated segmentation;

• rapid reconfiguration.

129. SDN Security Risk

A compromised controller can have broad impact.

Therefore:

Centralized control can create centralized security importance.

Part XLVI — SD-WAN

130. Software-Defined WAN

SD-WAN applies software-defined management and policy to wide-area networking.

Potential benefits include:

• dynamic path selection;

• centralized policy;

• use of multiple connectivity providers.

Part XLVII — Network Functions Virtualization

131. NFV

Network Functions Virtualization implements network functions in software rather than relying exclusively on dedicated appliances.

Examples can include:

• virtual firewalls;

• virtual routers;

• virtual load balancers.

132. Security Consideration

Virtualization increases:

• flexibility;

• automation;

but also requires protection of:

• orchestration;

• hypervisors;

• management interfaces.

Part XLVIII — Virtual Private Cloud

133. VPC

A Virtual Private Cloud is a logically isolated cloud network environment.

It may include:

• subnets;

• routing tables;

• gateways;

• network ACLs;

• security groups.

134. VPC Does Not Mean Physically Private

A VPC commonly uses shared cloud-provider infrastructure while providing logical isolation.

Part XLIX — Converged Protocols

135. Convergence

Converged networking carries different classes of traffic over shared infrastructure.

The current CISSP outline gives examples including:

• iSCSI;

• VoIP;

• InfiniBand over Ethernet;

• Compute Express Link.

136. Security Implication

Convergence can reduce infrastructure complexity but may also combine risks.

A network outage may affect:

• data;

• voice;

• storage

simultaneously.

Part L — iSCSI

137. Internet Small Computer Systems Interface

iSCSI carries storage commands over IP networks.

Conceptually:

SERVER

   │

   ▼

IP NETWORK

   │

   ▼

STORAGE

138. Security Consideration

Storage traffic may contain highly sensitive information.

Therefore consider:

• segmentation;

• authentication;

• confidentiality;

• availability.

Part LI — VoIP

139. Voice over IP

VoIP carries voice communications using IP networks.

140. VoIP Security Needs

VoIP has security requirements involving:

• confidentiality;

• availability;

• integrity;

• signaling;

• latency;

• jitter.

141. Availability Matters

A network problem can become:

a communications outage.

Converged environments therefore increase dependency on network resilience.

Part LII — InfiniBand over Ethernet and CXL

142. High-Performance Interconnects

ISC2's current outline also references InfiniBand over Ethernet and Compute Express Link among converged-protocol examples.

For CISSP-level reasoning, recognize these as examples of increasingly converged, high-performance interconnect environments where:

• shared infrastructure;

• data movement;

• management;

• isolation

must be secured.

Deep engineering details are beyond the required conceptual focus of this lesson.

Part LIII — Secure Protocols

143. Why Secure Protocols Matter

Many early Internet protocols were designed in environments where confidentiality and authentication were not primary built-in requirements.

Modern networks require protection against:

• eavesdropping;

• modification;

• impersonation.

144. High-Yield Secure Protocols

The current CISSP outline explicitly names:

• IPsec;

• SSH;

• SSL/TLS.

For current secure design, treat SSL as legacy and use modern TLS configurations instead.

NIST's current final TLS guidance addresses TLS 1.2 and TLS 1.3, with NIST actively reviewing the publication in 2026 for further modernization.

Part LIV — TLS

145. Transport Layer Security

TLS protects application communication across untrusted networks.

It can support:

• confidentiality;

• integrity;

• endpoint authentication.

146. TLS Concept

CLIENT

   │

   ▼

TLS NEGOTIATION

   │

   ├── Certificate validation

   ├── Key establishment

   └── Algorithm negotiation

   │

   ▼

ENCRYPTED APPLICATION DATA

   │

   ▼

SERVER

NIST describes TLS as providing mechanisms to protect information transmitted across the Internet.

147. HTTPS

HTTPS is:

HTTP protected through TLS.

Therefore:

HTTP + TLS = HTTPS

148. TLS Exam Trap

TLS security depends on more than encryption.

Also consider:

• certificate validation;

• algorithms;

• protocol versions;

• keys;

• configuration.

Part LV — SSH

149. Secure Shell

SSH provides secure remote login and related network services over insecure networks.

The SSH transport protocol provides encryption, host authentication, and integrity protection.

150. SSH Use

Common uses include:

• secure command-line administration;

• encrypted tunnels;

• file-transfer mechanisms built on SSH.

151. SSH Versus Telnet

TELNET

Credentials/data may be exposed



SSH

Encrypted protected channel

For secure administration:

Prefer SSH over Telnet.

Part LVI — IPsec

152. Internet Protocol Security

IPsec provides security at the IP layer.

It can protect traffic independently of the application protocol.

NIST describes IPsec as a framework for protecting communications over public networks and supporting VPNs.

153. IPsec Security Services

IPsec can support:

• confidentiality;

• integrity;

• authentication;

• anti-replay protections.

154. ESP

Encapsulating Security Payload is the major IPsec mechanism associated with confidentiality and can also provide integrity/authentication capabilities depending on configuration.

155. AH

Authentication Header historically provides integrity and authentication but not confidentiality.

For CISSP:

ESP is the more commonly encountered mechanism in modern protected IPsec designs.

Part LVII — IPsec Modes

156. Transport Mode

Transport mode protects the IP payload while leaving the original outer IP header available for routing.

ORIGINAL IP HEADER

        │

IPSEC-PROTECTED PAYLOAD

157. Tunnel Mode

Tunnel mode encapsulates the original IP packet inside a new protected packet.

NEW IP HEADER

     │

IPSEC

     │

ORIGINAL IP PACKET

158. Typical Conceptual Use

Transport mode:

Host-to-host style protection.

Tunnel mode:

VPN gateway/site-to-site protection.

Real implementations can vary.

Part LVIII — TLS Versus IPsec

159. Comparison

Part LIX — Multilayer Protection

160. Multiple Secure Layers Can Coexist

Example:

HTTPS

  │

 TLS

  │

 TCP

  │

 IP

  │

IPsec VPN

  │

Ethernet

161. Benefit and Cost

Multiple protection layers may increase:

• defense;

• separation.

But they may also increase:

• overhead;

• complexity;

• monitoring challenges.

Part LX — Network Monitoring and Management

162. Current Objective

The current CISSP outline explicitly includes:

• network observability;

• traffic flow/shaping;

• capacity management;

• fault detection and handling.

Part LXI — Network Observability

163. Observability

Network observability involves obtaining enough information about network state and behavior to understand:

• traffic;

• performance;

• failures;

• anomalies.

Sources may include:

• device logs;

• flow records;

• packet data;

• telemetry;

• performance metrics.

164. Security Value

Without network visibility:

Attacks can occur without detection.

Observability supports:

• troubleshooting;

• anomaly detection;

• incident response.

Part LXII — Traffic Shaping

165. Traffic Shaping

Traffic shaping controls how bandwidth is allocated or traffic is prioritized.

It can help ensure that critical applications receive adequate resources.

166. Example

NETWORK CAPACITY

     │

     ├── Voice → High priority

     ├── Business apps → Normal

     └── Bulk backups → Lower priority

Part LXIII — Capacity Management

167. Capacity Management

Capacity management ensures infrastructure can support expected demand.

Security relevance includes:

• availability;

• resilience;

• planning for traffic growth.

168. Capacity and DDoS

Capacity alone does not solve denial-of-service attacks.

But inadequate capacity can make ordinary traffic spikes look like outages.

Part LXIV — Fault Detection

169. Fault Detection

Networks should detect:

• failed links;

• device failures;

• routing problems;

• degraded performance.

170. Fault Handling

A resilient architecture may:

DETECT FAILURE

      │

      ▼

REROUTE / FAIL OVER

      │

      ▼

ALERT

      │

      ▼

REPAIR

Part LXV — Network Trust Boundaries

171. Every Connection Crosses Trust

Examples:

INTERNET

   │

   ▼

DMZ

   │

   ▼

APPLICATION

   │

   ▼

DATABASE

Each transition should have clearly defined:

• authentication;

• authorization;

• permitted protocols;

• monitoring.

172. DMZ Concept

A DMZ is a network zone used to separate externally accessible services from more trusted internal resources.

INTERNET

   │

FIREWALL

   │

  DMZ

   │

FIREWALL

   │

INTERNAL NETWORK

173. Security Principle

An Internet-facing system should not automatically receive unrestricted access to the internal enterprise.

Part LXVI — Network Security Architecture Example

174. Layered Enterprise Architecture

                         INTERNET

                            │

                            ▼

                    EDGE SECURITY

                            │

                            ▼

                          DMZ

                            │

                            ▼

                    INTERNAL FIREWALL

                            │

              ┌─────────────┼─────────────┐

              ▼             ▼             ▼

          USER VLAN     APP ZONE      ADMIN ZONE

                            │

                            ▼

                       DATA ZONE

                            │

                            ▼

                       BACKUP ZONE

Supporting controls:

• identity;

• encryption;

• logging;

• IDS/IPS;

• micro-segmentation;

• endpoint security.

Part LXVII — CISSP Network Decision Model

175. SierraTec Secure NETWORK Model

Use the NETWORK model when evaluating network-security scenarios.

N — Name the Assets

What systems and data communicate?

E — Establish Trust Boundaries

Where does trust change?

T — Trace the Traffic

Which path, protocol, port, and direction are used?

W — Wall Off Unnecessary Access

Use segmentation and least privilege.

O — Observe Communication

Log, monitor, and inspect where appropriate.

R — Require Secure Protocols

Protect confidentiality, integrity, and authentication.

K — Keep Resilience

Design for availability, capacity, redundancy, and failure.

176. NETWORK Diagram

N

NAME ASSETS

    │

    ▼

E

ESTABLISH BOUNDARIES

    │

    ▼

T

TRACE TRAFFIC

    │

    ▼

W

WALL OFF ACCESS

    │

    ▼

O

OBSERVE

    │

    ▼

R

REQUIRE SECURE PROTOCOLS

    │

    ▼

K

KEEP RESILIENCE

Part LXVIII — Worked CISSP Scenarios

177. Scenario 1 — OSI

A security device makes filtering decisions using source and destination IP addresses.

Which OSI layer is MOST directly involved?

A. Physical
B. Data Link
C. Network
D. Presentation

Correct Answer

C

178. Scenario 2 — MAC Address

A switch forwards traffic using hardware interface addresses.

Which layer is MOST directly involved?

A. Layer 2.

B. Layer 7.

C. Layer 5.

D. Layer 1 only.

Correct Answer

A

179. Scenario 3 — TCP

An application requires reliable, ordered transport.

Which protocol is MOST appropriate?

A. TCP.

B. UDP.

C. ARP.

D. Ethernet only.

Correct Answer

A

180. Scenario 4 — Real-Time Traffic

A real-time voice application prioritizes low latency over guaranteed transport-layer retransmission.

Which transport protocol is commonly more appropriate?

A. UDP.

B. TCP only.

C. IPsec AH.

D. ARP.

Correct Answer

A

181. Scenario 5 — IPv6

Which statement about IPv6 is MOST accurate?

A. IPv6 uses 128-bit addresses and does not use broadcast addressing.

B. IPv6 uses 32-bit addresses.

C. IPv6 removes multicast.

D. IPv6 automatically eliminates cyberattacks.

Correct Answer

A

182. Scenario 6 — East-West

An attacker compromises one cloud workload and begins scanning adjacent application servers.

Which traffic direction is MOST relevant?

A. East-west.

B. North-south only.

C. Physical only.

D. Satellite.

Correct Answer

A

183. Scenario 7 — Segmentation

A workstation compromise provides direct access to production databases and backup systems.

What architectural weakness is MOST evident?

A. Insufficient segmentation.

B. Too much encryption.

C. Excessive bandwidth.

D. Too many certificates.

Correct Answer

A

184. Scenario 8 — Administration

Network administrators must still access routers when the production network is unavailable.

Which architecture BEST supports this?

A. Out-of-band management.

B. Single in-band path only.

C. Public Internet Telnet.

D. Shared user VLAN.

Correct Answer

A

185. Scenario 9 — TLS

An organization wants to protect web traffic from eavesdropping and tampering.

Which protocol is MOST appropriate?

A. TLS.

B. Telnet.

C. FTP without protection.

D. ARP.

Correct Answer

A

186. Scenario 10 — SSH

An administrator needs secure remote command-line access to a Linux server.

Which protocol is MOST appropriate?

A. SSH.

B. Telnet.

C. HTTP.

D. SNMPv1.

Correct Answer

A

SSH is specifically designed to provide secure remote login and encrypted, integrity-protected communication over untrusted networks.

Part LXIX — Additional Scenarios

187. Scenario 11 — IPsec

Two corporate sites must protect IP traffic traversing the public Internet.

Which technology is MOST directly appropriate?

A. IPsec tunnel.

B. Plain HTTP.

C. Hub.

D. ARP.

Correct Answer

A

188. Scenario 12 — VLAN

Finance and guest devices use the same switching hardware but should belong to separate logical broadcast domains.

Which technology is MOST directly appropriate?

A. VLAN.

B. UPS.

C. RAID.

D. Hashing.

Correct Answer

A

189. Scenario 13 — VRF

A service provider needs multiple customers to use the same router while maintaining distinct routing domains.

Which technology BEST fits?

A. VRF.

B. NAT only.

C. Ethernet hub.

D. SMTP.

Correct Answer

A

190. Scenario 14 — Micro-Segmentation

A cloud application should allow Web Service A to communicate only with Database A while denying unrelated workloads.

Which design is MOST appropriate?

A. Micro-segmentation.

B. Flat internal network.

C. Disable all monitoring.

D. Publicly expose every workload.

Correct Answer

A

191. Scenario 15 — Performance

Users report that video conferences have inconsistent delay despite adequate average bandwidth.

Which metric is MOST relevant?

A. Jitter.

B. Certificate validity.

C. Hash length.

D. VLAN ID.

Correct Answer

A

192. Scenario 16 — CDN

A global website wants to serve content from locations closer to users and improve resilience.

Which technology is MOST appropriate?

A. CDN.

B. Single local hub.

C. Telnet.

D. Flat VLAN.

Correct Answer

A

193. Scenario 17 — SDN

An enterprise wants centralized, programmable control of network forwarding policies.

Which architecture is MOST appropriate?

A. SDN.

B. Bus topology only.

C. FTP.

D. Static unmanaged hubs.

Correct Answer

A

194. Scenario 18 — VPC

An organization wants a logically isolated network environment within a public-cloud provider.

Which concept BEST fits?

A. VPC.

B. VLAN cable.

C. Physical air gap necessarily.

D. Telnet domain.

Correct Answer

A

Part LXX — Common CISSP Exam Traps

195. Trap — Switch Equals Router

A switch primarily forwards Layer 2 frames.

A router primarily forwards Layer 3 packets.

196. Trap — MAC Address Equals IP Address

MAC:

Data-link addressing.

IP:

Network-layer addressing.

197. Trap — TCP Is Secure Because It Is Reliable

TCP provides reliable ordered transport, not inherent confidentiality or authentication.

RFC 9293 explicitly notes that TCP itself does not provide normal cryptographic confidentiality or authentication and relies on protocols such as TLS or IPsec when these properties are required.

198. Trap — UDP Means Bad Security

UDP is a transport protocol.

Its security depends on:

• application;

• authentication;

• encryption;

• implementation.

199. Trap — IPv6 Uses Broadcast

IPv6 does not use broadcast addressing; multicast replaces those functions.

200. Trap — VLAN Equals Firewall

A VLAN creates logical network separation.

Security policy between trust zones may still require firewalls or other enforcement.

201. Trap — VPN Means Fully Trusted Device

A VPN protects communication.

Endpoint compromise and user authorization remain separate concerns.

202. Trap — Air Gap Means Zero Risk

Removable media and physical access can still create attack paths.

203. Trap — Inside Network Equals Trusted

Modern Zero Trust architecture does not grant implicit trust solely because a system is inside the corporate network.

204. Trap — High Bandwidth Means Low Latency

Bandwidth and latency measure different characteristics.

A high-bandwidth satellite link can still have relatively high latency.

205. Trap — Throughput Equals Bandwidth

Bandwidth is capacity.

Throughput is actual delivered performance.

206. Trap — Jitter Equals Latency

Latency:

Delay.

Jitter:

Variation in delay.

207. Trap — SSL Is Preferred Modern Security

SSL is legacy.

Use supported modern TLS configurations.

208. Trap — SSH Is Only Encryption

SSH also provides host authentication and integrity protection in addition to encryption.

209. Trap — IPsec Only Protects Web Traffic

IPsec operates at the network layer and can protect broader IP traffic.

210. Trap — More Segments Automatically Means Better Security

Excessive segmentation can create:

• complexity;

• misconfiguration;

• operational burden.

Segmentation should reflect trust and risk.

Part LXXI — Knowledge Check

211. Knowledge Check

Question 1

Which OSI layer is primarily responsible for logical IP addressing?

A. Layer 1
B. Layer 2
C. Layer 3
D. Layer 6

Correct Answer

C

Question 2

Which layer uses MAC addresses?

A. Data Link.

B. Network.

C. Transport.

D. Application.

Correct Answer

A

Question 3

Which device primarily forwards packets between IP networks?

A. Router.

B. Hub.

C. Repeater.

D. Cable.

Correct Answer

A

Question 4

Which transport protocol provides reliable ordered byte-stream delivery?

A. TCP.

B. UDP.

C. ARP.

D. Ethernet.

Correct Answer

A

Question 5

Which transport protocol normally has lower overhead and no connection-establishment handshake?

A. UDP.

B. TCP.

C. TLS.

D. IPsec.

Correct Answer

A

Question 6

What does a port number identify?

A. Application/service endpoint.

B. Physical building.

C. MAC manufacturer only.

D. Encryption key.

Correct Answer

A

Question 7

Which protocol commonly uses TCP port 443?

A. HTTPS.

B. SSH.

C. Telnet.

D. SMTP only.

Correct Answer

A

Question 8

What is north-south traffic?

A. Traffic entering or leaving an environment.

B. Only server-to-server traffic.

C. Physical cable traffic.

D. Traffic flowing geographically north.

Correct Answer

A

Question 9

What is east-west traffic?

A. Lateral traffic among internal workloads or systems.

B. Internet traffic only.

C. Satellite traffic.

D. Power-grid communication.

Correct Answer

A

Question 10

What does a VLAN primarily provide?

A. Logical Layer 2 segmentation.

B. Physical encryption.

C. Certificate validation.

D. Key management.

Correct Answer

A

Question 11

Which technology creates separate logical routing tables on shared infrastructure?

A. VRF.

B. TLS.

C. HMAC.

D. UPS.

Correct Answer

A

Question 12

What is micro-segmentation?

A. Fine-grained network/workload isolation.

B. Increasing cable length.

C. Compressing packets.

D. Disabling routing.

Correct Answer

A

Question 13

What is the primary benefit of out-of-band management?

A. Separate administrative access path.

B. Higher user bandwidth.

C. Replacing authentication.

D. Eliminating configuration management.

Correct Answer

A

Question 14

What metric measures variation in packet delay?

A. Jitter.

B. Bandwidth.

C. Throughput.

D. Port number.

Correct Answer

A

Question 15

Which mode begins forwarding a frame before receiving it completely?

A. Cut-through.

B. Store-and-forward.

C. Tunnel mode.

D. Transport mode.

Correct Answer

A

Question 16

Which network plane primarily forwards user traffic?

A. Data plane.

B. Control plane.

C. Management plane.

D. Policy plane only.

Correct Answer

A

Question 17

Which plane is primarily associated with determining forwarding and routing behavior?

A. Control plane.

B. Data plane only.

C. Application plane.

D. Physical plane.

Correct Answer

A

Question 18

Which protocol is designed for secure remote login?

A. SSH.

B. Telnet.

C. FTP.

D. ARP.

Correct Answer

A

Question 19

Which protocol suite protects communications at the IP layer?

A. IPsec.

B. HTTP.

C. SMTP.

D. Ethernet.

Correct Answer

A

Question 20

Which concept rejects implicit trust based solely on network location?

A. Zero Trust.

B. Broadcast routing.

C. Store-and-forward.

D. VLAN tagging alone.

Correct Answer

A

Part LXXII — Original CISSP-Style Practice Questions

212. Practice Question 1

A company wants to protect a sensitive database from direct access by ordinary workstation networks.

What should the architect consider FIRST?

A. Appropriate network segmentation and access policy.

B. Increasing screen resolution.

C. Disabling all routing.

D. Installing an Ethernet hub.

Correct Answer

A

213. Practice Question 2

A firewall allows connections based on source address, destination address, protocol, port, and established TCP session state.

Which layers are MOST directly relevant?

A. Network and Transport.

B. Physical only.

C. Presentation only.

D. Session only.

Correct Answer

A

214. Practice Question 3

A remote administrator uses Telnet to manage routers across an untrusted network.

What is the BEST improvement?

A. Replace Telnet with appropriately configured SSH.

B. Increase Telnet timeout.

C. Use a larger monitor.

D. Disable encryption.

Correct Answer

A

215. Practice Question 4

A company separates user systems and production servers using VLANs but permits unrestricted routing between the VLANs.

What is the GREATEST concern?

A. Logical segmentation exists, but meaningful security-policy enforcement is insufficient.

B. VLANs automatically block all communication.

C. Routing eliminates network risk.

D. Encryption is impossible between VLANs.

Correct Answer

A

216. Practice Question 5

A cloud workload is allowed to communicate only with the exact services required for its function.

Which architecture principle is MOST clearly demonstrated?

A. Micro-segmentation and least privilege.

B. Flat networking.

C. Broadcast trust.

D. Unrestricted east-west traffic.

Correct Answer

A

217. Practice Question 6

An organization has high-bandwidth network links, but users experience long delays when communicating with a distant satellite-connected site.

Which metric BEST explains the problem?

A. Latency.

B. Port number.

C. MAC address.

D. VLAN ID.

Correct Answer

A

218. Practice Question 7

Voice calls sound uneven because packets arrive with inconsistent timing.

Which performance metric is MOST relevant?

A. Jitter.

B. Bandwidth only.

C. Certificate chain.

D. Hash collision.

Correct Answer

A

219. Practice Question 8

A network-management system is reachable from every employee workstation using the same production path used for normal business traffic.

Which architecture would BEST reduce the risk?

A. Separate and strongly protected management-plane access, potentially using out-of-band management.

B. Enable Telnet for everyone.

C. Remove authentication.

D. Place all systems in one VLAN.

Correct Answer

A

220. Practice Question 9

A security tool cannot inspect application traffic because all traffic is encapsulated inside an encrypted VPN tunnel.

Which concept BEST explains this limitation?

A. Multilayer protocol and encapsulation implications.

B. Lack of bandwidth.

C. DHCP.

D. Physical topology.

Correct Answer

A

221. Practice Question 10

A security architect is selecting controls for a multinational microservices platform with extensive workload-to-workload communication.

What should receive particular attention?

A. East-west traffic and micro-segmentation.

B. Only Internet ingress.

C. Only physical cable length.

D. Removing all authentication between services.

Correct Answer

A

Part LXXIII — OSI Memory Table

222. OSI Layers

Part LXXIV — Protocol Memory Table

223. Know the Association

Part LXXV — Performance Memory Table

224. Performance Metrics

Part LXXVI — Segmentation Memory Table

225. Segmentation Types

Part LXXVII — Key Terms

226. Key Terms

OSI Model

Seven-layer conceptual model for network communication.

TCP/IP Model

Practical layered model underlying Internet communications.

Encapsulation

Adding protocol information as data moves down networking layers.

Decapsulation

Removing and interpreting protocol headers as data moves upward.

Frame

Data-link-layer transmission unit.

Packet

Network-layer transmission unit.

Segment

Common term for a TCP transport unit.

MAC Address

Data-link-layer interface identifier.

IP Address

Logical network-layer address.

Switch

Device primarily forwarding Layer 2 frames.

Router

Device primarily forwarding Layer 3 packets.

TCP

Reliable, connection-oriented, ordered byte-stream transport.

UDP

Connectionless datagram transport.

Port

Transport-layer application/service identifier.

Socket

Communication endpoint characterized by protocol/address/port information.

IPv4

32-bit Internet Protocol addressing architecture.

IPv6

128-bit Internet Protocol addressing architecture.

Unicast

One-to-one delivery.

Broadcast

One-to-all delivery within an applicable IPv4 broadcast scope.

Multicast

Delivery to a defined group.

Anycast

Delivery to one of multiple interfaces sharing an address.

Data Plane

Network function responsible for forwarding normal traffic.

Control Plane

Network function determining forwarding behavior.

Management Plane

Administrative interface for network configuration and monitoring.

Store-and-Forward

Switching technique that receives a complete frame before forwarding.

Cut-Through

Switching technique that begins forwarding before the entire frame arrives.

Bandwidth

Nominal communication capacity.

Throughput

Actual achieved data-delivery rate.

Latency

Communication delay.

Jitter

Variation in delay.

SNR

Signal-to-Noise Ratio.

North-South Traffic

Traffic entering or leaving an environment.

East-West Traffic

Lateral traffic between internal systems or workloads.

Segmentation

Division of network environments into distinct security zones.

VLAN

Virtual Local Area Network.

VRF

Virtual Routing and Forwarding.

VPN

Virtual Private Network.

Air Gap

Intentional lack of normal network connectivity between environments.

In-Band Management

Administrative communication sharing the production network path.

Out-of-Band Management

Administrative communication using a separate management path.

Micro-Segmentation

Fine-grained isolation among workloads or services.

Zero Trust

Architecture avoiding implicit trust based only on network location.

Ingress

Traffic entering an environment.

Egress

Traffic leaving an environment.

Peering

Interconnection between networks for traffic exchange.

CDN

Content Delivery Network.

SDN

Software-Defined Networking.

SD-WAN

Software-Defined Wide Area Network.

NFV

Network Functions Virtualization.

VPC

Virtual Private Cloud.

TLS

Transport Layer Security.

SSH

Secure Shell.

IPsec

Internet Protocol Security.

ESP

IPsec Encapsulating Security Payload.

Network Observability

Ability to understand network state and behavior through telemetry and monitoring.

Part LXXVIII — CISSP Exam Focus

227. Network Security Mindset

Remember:

APPLICATION

     │

     ▼

TRANSPORT

     │

     ▼

NETWORK

     │

     ▼

DATA LINK

     │

     ▼

PHYSICAL

Then ask:

WHAT ASSET?

     ↓

WHAT TRAFFIC?

     ↓

WHICH LAYER?

     ↓

WHICH TRUST BOUNDARY?

     ↓

WHICH PROTOCOL?

     ↓

WHICH CONTROL?

     ↓

HOW IS IT MONITORED?

For CISSP questions:

• Understand OSI conceptually rather than merely memorizing seven words.

• Know where MAC, IP, TCP/UDP, and applications operate.

• Switches primarily use Layer 2 information.

• Routers primarily use Layer 3 information.

• TCP provides reliable ordered transport but not inherent encryption.

• UDP is lightweight and connectionless.

• Ports identify application/service endpoints.

• IPv4 uses 32-bit addresses.

• IPv6 uses 128-bit addresses.

• IPv6 does not use broadcast addressing.

• Unicast = one destination.

• Multicast = selected group.

• Anycast = one member of a distributed group.

• Segmentation reduces lateral movement.

• VLANs create logical separation but do not automatically enforce complete security policy.

• Micro-segmentation provides finer-grained workload control.

• Air gaps reduce connectivity but do not eliminate risk.

• Out-of-band management separates privileged management access.

• East-west traffic is increasingly important in cloud and microservice architectures.

• Management-plane compromise can threaten the entire network.

• High bandwidth does not necessarily mean low latency.

• Jitter matters to real-time communications.

• Store-and-forward emphasizes full-frame processing.

• Cut-through emphasizes lower latency.

• SSL should be treated as legacy; use supported TLS.

• SSH is preferable to insecure remote-shell protocols.

• IPsec protects IP traffic and is widely associated with VPNs.

• Zero Trust focuses on individual resources rather than simply trusting network location.

• SDN centralizes programmable network control and therefore makes control-plane security important.

• VPCs provide logical—not necessarily physical—isolation.

• Observability, capacity, fault detection, and traffic management are part of network security architecture.

228. Lesson Summary

Lesson Fourteen introduced the foundation of Communication and Network Security, which currently represents 13% of the CISSP examination.

You began with the OSI model:

7 APPLICATION

6 PRESENTATION

5 SESSION

4 TRANSPORT

3 NETWORK

2 DATA LINK

1 PHYSICAL

and learned that layered networking provides a structured way to understand where communication and security controls operate.

You then examined encapsulation:

DATA

  ↓

SEGMENT

  ↓

PACKET

  ↓

FRAME

  ↓

BITS

You studied fundamental addressing:

MAC

Data Link



IP

Network



PORT

Transport/Application endpoint

You learned that TCP provides reliable, ordered, connection-oriented transport while UDP provides lightweight datagram delivery. The current TCP standard describes TCP as a reliable, in-order byte-stream protocol that uses port numbers to identify application services and flows.

You examined IPv4 and IPv6. IPv6 expands address size from 32 to 128 bits and defines unicast, anycast, and multicast address types; it does not use broadcast addresses.

You then moved beyond protocol fundamentals into secure network architecture, including:

PHYSICAL SEGMENTATION

          ↓

LOGICAL SEGMENTATION

          ↓

VLAN / VRF / VPN

          ↓

MICRO-SEGMENTATION

          ↓

ZERO TRUST

You learned that network traffic should be considered in both directions:

NORTH-SOUTH

External ↔ Internal



EAST-WEST

Internal ↔ Internal

The importance of east-west controls has increased as enterprise networks have evolved toward cloud services, distributed workloads, and microservices. NIST SP 800-215 describes this shift and the associated use of modern frameworks such as Zero Trust Network Access and SASE.

You also examined secure protocols:

TLS

Application communication protection



SSH

Secure remote administration



IPsec

Network-layer protection / VPN

NIST describes TLS as a mechanism for protecting information transmitted electronically, while SSH provides encrypted remote communication with server authentication and integrity protection.

You also studied modern network architecture concepts required by the current CISSP outline, including:

• SDN;

• SD-WAN;

• NFV;

• VPCs;

• CDNs;

• wireless;

• cellular connectivity;

• network performance;

• observability;

• traffic shaping;

• fault detection.

The central Lesson Fourteen principle is:

Network security is not simply about blocking packets at a perimeter. A secure network architecture understands every communication path, protocol layer, trust boundary, workload relationship, management interface, and dependency—and applies segmentation, encryption, authentication, monitoring, and resilience according to risk.

Exam Readiness Check

Before proceeding, make sure you can explain without reviewing the lesson:

• All seven OSI layers.

• The TCP/IP model.

• How OSI maps to TCP/IP.

• What encapsulation means.

• What decapsulation means.

• The difference between a frame, packet, and segment.

• What a MAC address is.

• What an IP address is.

• The role of a switch.

• The role of a router.

• The difference between switching and routing.

• What IPv4 is.

• What IPv6 is.

• Why IPv6 does not use broadcast.

• What unicast means.

• What multicast means.

• What anycast means.

• What TCP does.

• What UDP does.

• The TCP three-way handshake.

• The difference between TCP and UDP.

• What a port is.

• What a socket is.

• Major common port associations.

• What network topology means.

• What star and mesh topologies look like.

• What the data plane does.

• What the control plane does.

• What the management plane does.

• Why the management plane deserves strong protection.

• The difference between store-and-forward and cut-through.

• The difference between bandwidth and throughput.

• What latency means.

• What jitter means.

• What SNR means.

• What north-south traffic is.

• What east-west traffic is.

• Why east-west traffic matters.

• What physical segmentation means.

• What logical segmentation means.

• What an air gap is.

• Why an air gap does not eliminate risk.

• The difference between in-band and out-of-band management.

• What a VLAN does.

• What VRF does.

• What a VPN does.

• What micro-segmentation does.

• How Zero Trust affects network design.

• What ingress and egress mean.

• What peering means.

• Why wireless changes the physical attack boundary.

• What Wi-Fi, Bluetooth, Zigbee, and satellite represent.

• How 4G/5G can support enterprise connectivity.

• What a CDN does.

• What SDN means.

• What SD-WAN means.

• What NFV means.

• What a VPC is.

• What converged networking means.

• What iSCSI does.

• What VoIP does.

• Why converged infrastructure can create shared failure risk.

• What TLS protects.

• Why SSL is legacy.

• What SSH provides.

• What IPsec provides.

• The difference between IPsec transport and tunnel mode.

• Why layered encryption can reduce monitoring visibility.

• What network observability means.

• Why capacity management is a security concern.

• Why fault detection and failover matter.

Coming Next

Lesson Fifteen: Secure Network Components and Infrastructure Protection

Lesson Fifteen will continue Domain 4 with Objective 4.2 — Secure Network Components and expand the infrastructure mechanisms supporting secure network architecture.

It will cover:

• network-device security;

• routers;

• switches;

• gateways;

• proxies;

• firewalls;

• next-generation firewalls;

• load balancers;

• IDS;

• IPS;

• network taps;

• packet brokers;

• secure device administration;

• infrastructure redundancy;

• power;

• warranties;

• vendor support;

• End of Support;

• firmware;

• network-device hardening;

• configuration baselines;

• secure management protocols;

• SNMP security;

• logging;

• transmission media;

• copper;

• fiber;

• wireless media;

• signal propagation;

• electromagnetic interference;

• crosstalk;

• attenuation;

• Network Access Control;

• 802.1X concepts;

• endpoint posture;

• host-based protection;

• infrastructure trust;

• original network-security diagrams;

• CISSP scenarios and practice questions.

The central Lesson Fifteen question will be:

How should network devices, transmission media, management interfaces, access-control mechanisms, and endpoints be hardened so that the architecture designed in Lesson Fourteen remains trustworthy in operation?

Publication and Independence Notice

This lesson is independently developed educational material for the SierraTec Secure CISSP Certification Preparation Course.

CISSP is administered by ISC2. SierraTec Secure's program is independent certification-preparation material and should not be represented as official ISC2 training unless separately authorized.

The current examination alignment was verified against the official CISSP Certification Exam Outline. Domain 4 currently represents 13% of the examination. Objective 4.1 covers OSI/TCP-IP models, IPv4/IPv6, secure protocols, multilayer and converged protocols, transport architecture, network-performance metrics, traffic flows, segmentation, edge networking, wireless/cellular networks, CDNs, SDN, VPCs, and monitoring and management.

Modern network-security context was supplemented by NIST SP 800-215 and NIST SP 800-207. TCP and IPv6 concepts were cross-checked against current IETF RFC material.

TLS concepts were checked against NIST SP 800-52 Rev. 2 and NIST's May 2026 review notice; SSH concepts were checked against RFC 4253; IPsec concepts were supplemented by NIST IPsec guidance.

The SierraTec Secure NETWORK framework, diagrams, explanations, knowledge checks, and practice questions are original instructional material and are not actual, recalled, leaked, or official CISSP examination questions.