Lesson Fifteen

Secure Network Components and Infrastructure Protection

SierraTec Secure CISSP Certification Preparation Course

Lesson Overview

Lesson Fourteen established how network communications operate through the OSI and TCP/IP models, addressing, routing, switching, segmentation, secure protocols, software-defined networking, cloud networking, and traffic flows.

Lesson Fifteen asks a different question:

How do we keep the actual network infrastructure trustworthy after the architecture has been designed?

A well-designed network can still fail if:

• routers use default credentials;

• switches run unsupported firmware;

• management interfaces are exposed;

• firewalls contain obsolete rules;

• network devices have no redundant power;

• copper cabling is accessible to unauthorized persons;

• wireless signals extend outside controlled areas;

• compromised laptops are permitted onto internal networks;

• endpoints operate without host-based security;

• critical network components reach End of Support without replacement.

The current CISSP examination places these topics primarily under Domain 4, Objective 4.2 — Secure network components.

The official objective currently contains four major areas:

• operation of infrastructure, including redundant power, warranties, and support;

• transmission media, including physical protection and signal-propagation quality;

• Network Access Control systems, including physical and virtual solutions;

• endpoint security, including host-based protection.

NIST's modern enterprise-network guidance similarly treats device/endpoint protection, security appliances, cloud-connected infrastructure, micro-segmentation, and secure network operations as interconnected components of the enterprise security architecture.

The central Lesson Fifteen question is:

How should network infrastructure, transmission media, access-control mechanisms, management interfaces, and endpoints be protected so the network architecture remains secure, available, supportable, and trustworthy in operation?

CISSP Exam Objective Alignment

The four explicit current 4.2 categories are infrastructure operations, transmission media, NAC, and endpoint security.

Learning Objectives

After completing this lesson, you should be able to:

1. Explain why network architecture and network-component security are different.

2. Explain infrastructure operational security.

3. Describe high-availability network design.

4. Explain redundant power for network devices.

5. Explain hardware redundancy.

6. Explain link redundancy.

7. Explain failover.

8. Explain why warranties and vendor support are security considerations.

9. Explain End-of-Life and End-of-Support risks.

10. Explain firmware security.

11. Explain secure network-device baselines.

12. Explain network-device configuration management.

13. Explain secure administrative access.

14. Explain why management interfaces are high-value targets.

15. Explain the role of routers in infrastructure security.

16. Explain the role of switches.

17. Explain firewall functions.

18. Distinguish packet filtering from stateful inspection.

19. Explain application-aware and next-generation firewall concepts.

20. Explain proxy security functions.

21. Explain reverse proxies.

22. Explain load balancers.

23. Explain IDS and IPS.

24. Distinguish IDS from IPS.

25. Explain network taps and switched-port analyzers conceptually.

26. Explain why security monitoring needs visibility.

27. Identify common transmission media.

28. Compare copper and fiber.

29. Explain signal attenuation.

30. Explain electromagnetic interference.

31. Explain radio-frequency interference.

32. Explain crosstalk.

33. Explain physical cable protection.

34. Explain why fiber has different interception characteristics from copper.

35. Explain wireless signal-propagation risks.

36. Define Network Access Control.

37. Explain pre-admission and post-admission NAC.

38. Explain 802.1X conceptually.

39. Define supplicant.

40. Define authenticator.

41. Define authentication server.

42. Explain RADIUS's role in NAC.

43. Explain endpoint posture assessment.

44. Explain quarantine and remediation networks.

45. Explain guest network handling.

46. Explain BYOD implications.

47. Explain agent-based and agentless NAC.

48. Explain why MAC-address authentication is weaker than strong identity.

49. Explain endpoint security.

50. Explain host firewalls.

51. Explain endpoint anti-malware.

52. Explain EDR.

53. Explain HIDS and HIPS.

54. Explain application allowlisting.

55. Explain disk encryption.

56. Explain endpoint patch management.

57. Explain mobile-device management.

58. Explain endpoint hardening.

59. Explain endpoint telemetry.

60. Apply CISSP reasoning to network-infrastructure scenarios.

Part I — Architecture Versus Component Security

1. Architecture Is the Blueprint

Lesson Fourteen answered questions such as:

• Where should segmentation occur?

• Which systems belong in separate security zones?

• Which protocols should be allowed?

• Where should firewalls be placed?

Lesson Fifteen asks:

Can the components implementing that architecture actually be trusted?

2. Example

Architecture says:

INTERNET

   │

   ▼

FIREWALL

   │

   ▼

DMZ

   │

   ▼

INTERNAL NETWORK

But suppose the firewall:

• runs unsupported firmware;

• has a default administrator password;

• sends no security logs;

• has only one power supply.

The architecture may be sound.

The implementation is not.

3. Infrastructure Security Chain

NETWORK DESIGN

      │

      ▼

NETWORK COMPONENTS

      │

      ▼

SECURE CONFIGURATION

      │

      ▼

SUPPORTED FIRMWARE

      │

      ▼

RESTRICTED MANAGEMENT

      │

      ▼

MONITORING

      │

      ▼

REDUNDANCY

      │

      ▼

TRUSTWORTHY OPERATION

Part II — Operation of Infrastructure

4. Infrastructure Is a Security Dependency

Network infrastructure includes components such as:

• routers;

• switches;

• firewalls;

• wireless controllers;

• load balancers;

• security appliances;

• management systems.

If these fail, applications may become unreachable even when the applications themselves remain healthy.

5. Availability Is a Security Objective

Suppose:

• all servers operate normally;

• storage remains available;

• identity systems function.

But the core router fails.

Users still lose access.

Therefore:

Network infrastructure is part of the organization's availability architecture.

6. Operational Infrastructure Questions

For every critical network component, ask:

• What happens if it fails?

• Is there a replacement?

• Does it have redundant power?

• Is vendor support still available?

• Can its configuration be restored?

• Is firmware current?

• Who can administer it?

• How is it monitored?

Part III — Redundant Infrastructure

7. Redundancy

Redundancy provides additional components or paths so failure of one element does not automatically eliminate the service.

             ┌── ROUTER A ──┐

INTERNET ────┤              ├──── INTERNAL

             └── ROUTER B ──┘

8. Redundancy Is Not Duplication Alone

Two devices do not provide meaningful resilience if they share the same single point of failure.

Example:

ROUTER A ──┐

           ├── SINGLE POWER STRIP

ROUTER B ──┘

Power-strip failure removes both routers.

9. Common-Mode Failure

A common-mode failure is one event capable of disabling multiple supposedly redundant components.

Examples include:

• shared power circuit;

• shared cooling system;

• shared cable route;

• common upstream carrier;

• identical defective firmware.

10. CISSP Principle

When evaluating redundancy, ask:

Are the redundant components independent enough that one event will not defeat all of them?

Part IV — Redundant Power

11. Power Is Explicitly Part of Domain 4.2

The current exam outline directly identifies redundant power as an example of infrastructure operations.

A high-value network device may have:

• dual power supplies;

• separate power circuits;

• UPS support;

• generator-backed power.

12. Dual Power Architecture

POWER SOURCE A

      │

      ▼

PSU A ──────┐

            │

          ROUTER

            │

PSU B ──────┘

      ▲

      │

POWER SOURCE B

Ideally, the two paths should not unnecessarily share the same upstream failure point.

13. Redundant Power Exam Trap

Two power supplies connected to:

the same single failed outlet

may not provide meaningful resilience.

Part V — Hardware Redundancy

14. Device Redundancy

Critical infrastructure can use multiple devices.

Examples:

FIREWALL A

    │

    ├── High Availability

    │

FIREWALL B

If Firewall A fails, Firewall B may assume operation.

15. Active/Passive

In an active/passive model:

ACTIVE DEVICE

     │

     ▼

Handles traffic



STANDBY DEVICE

     │

     ▼

Waits for failover

16. Active/Active

In an active/active design, multiple devices may simultaneously process traffic.

Benefits can include:

• capacity;

• resilience.

However, state synchronization and design complexity increase.

Part VI — Link Redundancy

17. Redundant Network Paths

SITE A

  │ \

  │  \

ISP 1 ISP 2

  │    │

  └────┘

     │

   SITE B

Multiple links can improve resilience.

18. Carrier Diversity

Two circuits purchased under different product names may still traverse:

the same underground conduit.

A single construction accident could disable both.

Therefore assess actual physical diversity where required.

Part VII — Failover

19. Failover

Failover transfers functionality to a backup component when the primary component becomes unavailable.

PRIMARY

   │

   X FAILURE

   │

   ▼

STANDBY

   │

   ▼

SERVICE CONTINUES

20. Failover Must Be Tested

A configuration labeled:

“High Availability”

does not guarantee successful failover.

Test:

• state synchronization;

• routing;

• sessions;

• management access;

• recovery behavior.

Part VIII — Warranty and Support

21. Why Is Warranty on the CISSP Exam?

The official 4.2 objective explicitly includes:

• warranty;

• support.

This reflects a managerial principle:

Secure infrastructure must also be maintainable and supportable.

22. Hardware Warranty

A warranty may provide:

• repair;

• replacement;

• hardware support.

If a mission-critical switch fails and replacement takes six weeks, availability risk increases.

23. Support Contract

Vendor support may provide:

• firmware;

• patches;

• technical assistance;

• security advisories;

• replacement hardware.

24. Operational Security Question

When selecting a network component, do not evaluate only:

purchase price.

Also evaluate:

• support lifetime;

• replacement availability;

• patch access;

• vendor response.

Part IX — End of Life and End of Support

25. Unsupported Network Devices

A router can continue forwarding packets after support ends.

But:

Functional does not mean acceptably secure.

26. End-of-Support Risks

An unsupported network device may stop receiving:

• vulnerability fixes;

• firmware updates;

• vendor assistance.

27. Lifecycle Flow

PROCURE

  │

  ▼

DEPLOY

  │

  ▼

OPERATE

  │

  ▼

MAINTAIN

  │

  ▼

SUPPORT WINDOW DECLINES

  │

  ▼

REPLACE / MIGRATE

  │

  ▼

RETIRE

28. Better Practice

Track support status before the device becomes unsupported.

Do not wait for:

a critical zero-day vulnerability

to discover the router has been unsupported for two years.

Part X — Firmware Security

29. Network Devices Run Software

Routers and switches commonly contain:

• operating systems;

• firmware;

• boot loaders;

• embedded services.

They therefore require security maintenance just like servers.

30. Firmware Risk

Vulnerable firmware may permit:

• remote compromise;

• privilege escalation;

• persistent unauthorized access.

31. Firmware Management

A mature process includes:

VENDOR ADVISORY

      │

      ▼

ASSESS EXPOSURE

      │

      ▼

TEST UPDATE

      │

      ▼

CHANGE APPROVAL

      │

      ▼

DEPLOY

      │

      ▼

VERIFY

Part XI — Secure Network-Device Baselines

32. Baseline

A secure baseline defines the approved security configuration for a device class.

Examples may include:

• approved firmware version;

• required logging;

• allowed management protocols;

• administrator authentication;

• unused services disabled;

• time synchronization.

33. Why Baselines Matter

Without a baseline, security cannot easily distinguish:

approved configuration

from:

unauthorized configuration.

34. Configuration Drift

Example:

APPROVED:

SSH only



TEMPORARY CHANGE:

Telnet enabled



LATER:

Telnet never disabled

The device has drifted from its secure baseline.

Part XII — Backup Network Configurations

35. Configuration Backup

Network-device configurations should be backed up according to operational requirements.

If a router fails:

REPLACEMENT ROUTER

       │

       ▼

RESTORE APPROVED CONFIG

       │

       ▼

VALIDATE

       │

       ▼

SERVICE RESTORED

36. Protect Configuration Backups

Configuration files may contain:

• topology information;

• encrypted or hashed credentials;

• network addresses;

• security rules.

They are sensitive assets.

Part XIII — Secure Administrative Access

37. Management Access Is Highly Privileged

A router administrator may be able to:

• redirect traffic;

• disable interfaces;

• change ACLs;

• modify routing;

• view configurations.

Compromise can affect the entire network.

38. Management Security

Controls may include:

• dedicated management networks;

• MFA;

• SSH;

• least privilege;

• logging;

• source restrictions.

39. Avoid Insecure Management Protocols

Legacy management methods can expose:

• credentials;

• administrative commands.

Prefer encrypted authenticated management channels.

Part XIV — Management Network

40. Separate Management Plane

ADMIN WORKSTATION

       │

       ▼

MANAGEMENT NETWORK

       │

  ┌────┼────┐

  ▼    ▼    ▼

RTR1  SW1  FW1

Users should not automatically reach privileged network-management interfaces.

41. Out-of-Band Management

A separate management path can improve:

• isolation;

• resilience;

• emergency recovery.

But it must itself be strongly protected.

Part XV — Administrator Authentication

42. Shared Administrator Accounts

Poor:

Username: admin

Used by 10 administrators

This weakens accountability.

43. Better Approach

Use:

• individually attributable accounts;

• strong authentication;

• privilege separation;

• logging.

Part XVI — AAA

44. Authentication, Authorization, Accounting

AAA provides a useful framework:

AUTHENTICATION

Who are you?

      │

      ▼

AUTHORIZATION

What may you do?

      │

      ▼

ACCOUNTING

What did you do?

Detailed AAA appears later in Domain 5, but it is highly relevant to network-device management.

Part XVII — Routers

45. Router Security

Routers are critical because they determine where traffic flows between IP networks.

A compromised router may allow an attacker to:

• redirect traffic;

• alter routes;

• disrupt connectivity;

• expose management functions.

46. Router Hardening

Conceptually:

MINIMIZE SERVICES

      +

SECURE MANAGEMENT

      +

ROUTE PROTECTION

      +

ACCESS CONTROL

      +

LOGGING

      +

PATCHING

Part XVIII — Switches

47. Switch Security

Switches can provide:

• VLANs;

• port controls;

• traffic forwarding;

• Layer 2 security features.

48. Unused Ports

Unused physical ports should be managed according to risk.

Leaving active unused ports in public areas can enable unauthorized network connection.

49. Physical + Logical Control

WALL JACK

   │

   ▼

SWITCH PORT

   │

   ▼

AUTHORIZED DEVICE?

   │

 ┌─┴─┐

YES  NO

 │    │

ALLOW BLOCK / NAC

Part XIX — Firewalls

50. Firewall

NIST describes firewalls as devices or programs that control network traffic between networks or hosts with different security postures.

51. Firewall Purpose

A firewall enforces:

Which communication is permitted across a security boundary.

52. Packet Filtering

Basic packet filtering may evaluate:

• source IP;

• destination IP;

• protocol;

• source/destination port.

53. Stateful Inspection

A stateful firewall tracks connection state.

CLIENT ── SYN ──► SERVER

         │

         ▼

FIREWALL TRACKS SESSION

         │

         ▼

RETURN TRAFFIC

MATCHES STATE?

54. Stateful Advantage

The firewall can distinguish:

expected return traffic

from:

unsolicited traffic.

Part XX — Application-Aware Firewalls

55. Higher-Layer Inspection

Application-aware firewalls may understand aspects of:

• HTTP;

• applications;

• users;

• application behavior.

This provides policy capabilities beyond basic IP and port filtering.

56. Next-Generation Firewall

A next-generation firewall may combine capabilities such as:

• stateful inspection;

• application identification;

• intrusion prevention;

• user-aware policy.

Capabilities vary by product.

Part XXI — Firewall Policy

57. Default-Deny Concept

A strong security approach generally permits required communication rather than allowing everything and attempting to block only known bad activity.

Conceptually:

DENY BY DEFAULT

       │

       ▼

ALLOW REQUIRED FLOWS

       │

       ▼

LOG IMPORTANT EVENTS

58. Rule Creep

Over time:

TEMPORARY RULE

     │

     ▼

PROJECT FINISHES

     │

     ▼

RULE REMAINS

     │

     ▼

UNNECESSARY EXPOSURE

Firewall rules require lifecycle review.

Part XXII — Host-Based Firewalls

59. Host Firewall

A host-based firewall runs on an endpoint or server.

NIST's firewall guidance distinguishes network and host-based firewall capabilities.

60. Defense in Depth

NETWORK FIREWALL

      │

      ▼

HOST FIREWALL

      │

      ▼

APPLICATION

The host firewall helps maintain protection even when devices are:

• mobile;

• remote;

• connected to other networks.

Part XXIII — Proxies

61. Proxy

A proxy intermediates communication.

CLIENT

  │

  ▼

PROXY

  │

  ▼

SERVER

62. Forward Proxy

A forward proxy commonly acts on behalf of clients.

It may provide:

• web filtering;

• policy enforcement;

• logging.

63. Reverse Proxy

A reverse proxy acts in front of servers.

INTERNET

   │

   ▼

REVERSE PROXY

   │

   ▼

APPLICATION SERVERS

64. Reverse Proxy Benefits

Depending on design:

• hides backend infrastructure;

• terminates TLS;

• filters requests;

• distributes traffic.

Part XXIV — Load Balancers

65. Load Balancer

A load balancer distributes connections or requests across multiple resources.

            ┌── SERVER A

CLIENT ─► LB├── SERVER B

            └── SERVER C

66. Security and Availability

Load balancing can improve:

• availability;

• performance;

• resilience.

It can also become:

a critical infrastructure dependency.

67. Avoid Single Point of Failure

A redundant server farm with only one load balancer can still have:

one critical failure point.

Part XXV — IDS and IPS

68. Intrusion Detection System

An IDS monitors activity and generates alerts when suspicious behavior is detected.

69. Intrusion Prevention System

An IPS can operate inline and take automated action such as:

• dropping packets;

• blocking sessions.

70. Comparison

71. Exam Memory Aid

IDS = Detect

IPS = Detect + Potentially Prevent

Part XXVI — Signature and Anomaly Detection

72. Signature-Based

Signature-based detection looks for known patterns associated with known threats.

Strength:

Recognizes known attacks well.

Limitation:

Unknown attacks may not match a signature.

73. Anomaly-Based

Anomaly-based approaches identify deviations from expected behavior.

Strength:

Potentially detects previously unknown activity.

Limitation:

May generate false positives.

Part XXVII — Network Visibility

74. Security Tools Need Traffic

An IDS cannot analyze traffic it never receives.

Therefore network monitoring design must consider:

• encrypted traffic;

• switching architecture;

• cloud traffic;

• east-west traffic.

Part XXVIII — SPAN and Network Taps

75. SPAN / Port Mirroring

A switch can copy traffic from selected interfaces to a monitoring interface.

TRAFFIC

 A ───► SWITCH ───► B

          │

          └──► MONITOR

76. Network Tap

A network tap provides a mechanism for observing traffic on a link.

Taps may be designed specifically for:

• monitoring;

• packet capture;

• security analysis.

77. Monitoring Tradeoff

Monitoring architecture should provide:

• adequate visibility;

• appropriate capacity;

• controlled access to captured traffic.

Captured network traffic may itself contain sensitive information.

Part XXIX — Transmission Media

78. Official Domain 4.2 Requirement

The current CISSP outline explicitly requires candidates to secure transmission media, including:

• physical security of the media;

• signal-propagation quality.

79. Major Media Types

At CISSP level, understand:

COPPER

FIBER

WIRELESS / RADIO

Each has different:

• performance;

• distance;

• interference;

• interception considerations.

Part XXX — Copper Cabling

80. Copper

Copper cabling transmits information using electrical signals.

Common forms include:

• twisted pair;

• coaxial cable.

81. Copper Advantages

Copper is:

• widely available;

• relatively easy to install;

• cost-effective in many LAN environments.

82. Copper Security Considerations

Electrical signals may be affected by:

• electromagnetic interference;

• radio-frequency interference;

• crosstalk;

• attenuation.

Physical tapping is also a concern.

Part XXXI — Twisted Pair

83. Twisted Pair

Twisting conductors helps reduce electromagnetic interference and crosstalk.

Common network cabling uses twisted-pair designs.

84. Shielded Versus Unshielded

Shielding can provide additional resistance against interference where appropriate.

Selection depends on:

• environment;

• performance;

• cost;

• installation requirements.

Part XXXII — Crosstalk

85. Crosstalk

Crosstalk occurs when a signal in one communication path creates unwanted interference in another.

Conceptually:

CABLE A SIGNAL

     │

     └──── unwanted coupling ───► CABLE B

86. Security Impact

Crosstalk can cause:

• communication errors;

• degraded performance.

It can also be relevant to information leakage under certain conditions.

Part XXXIII — EMI and RFI

87. Electromagnetic Interference

EMI can originate from:

• motors;

• electrical equipment;

• power systems.

88. Radio-Frequency Interference

RFI is interference caused by radio-frequency sources.

Examples can include:

• transmitters;

• certain wireless equipment.

89. Infrastructure Planning

Avoid unnecessarily routing sensitive or high-speed copper cabling near strong interference sources.

Part XXXIV — Fiber-Optic Cable

90. Fiber

Fiber carries information using light rather than electrical signaling.

91. Fiber Advantages

Fiber commonly supports:

• high bandwidth;

• long distances;

• resistance to electromagnetic interference.

92. Fiber Security Advantage

Because fiber does not normally radiate electrical signals like copper, certain forms of electromagnetic interception are reduced.

93. Fiber Is Not Untappable

A critical exam point:

More difficult to intercept does not mean impossible to intercept.

Physical access and specialized tapping techniques can still create risk.

Part XXXV — Attenuation

94. Attenuation

Attenuation is the reduction in signal strength as a signal travels through a transmission medium.

STRONG SIGNAL

     │

     ▼

────────────── CABLE ──────────────

                                  │

                                  ▼

                           WEAKER SIGNAL

95. Excessive Attenuation

Excessive signal loss can cause:

• errors;

• retransmission;

• reduced performance;

• connectivity failure.

Part XXXVI — Signal Propagation Quality

96. Why the Exam Includes Signal Quality

Signal quality affects:

• reliability;

• throughput;

• availability.

Security architecture must consider whether the communication medium can reliably support the mission.

97. Signal Quality Factors

Examples:

• attenuation;

• interference;

• physical damage;

• distance;

• connector quality.

Part XXXVII — Physical Protection of Cabling

98. Cable Security

Communication cabling may traverse:

• ceilings;

• floors;

• conduits;

• closets;

• public areas.

99. Controls

Sensitive cable routes may require:

• conduit;

• locked wiring closets;

• secure building pathways;

• inspection;

• tamper evidence.

100. Cable-Cut Availability Risk

An attacker does not need to decrypt information if the objective is:

deny service.

Physical cable protection supports availability.

Part XXXVIII — Wireless Media

101. Wireless Transmission

Wireless communication uses radio-frequency or similar propagation instead of a physical conductor.

NIST notes that WLAN security depends on securing wireless components throughout design, deployment, maintenance, and monitoring.

102. Different Physical Boundary

A cable terminates at physical locations.

Wireless signals may pass:

• through walls;

• into parking areas;

• into neighboring spaces.

103. Signal Leakage

┌──────────────────────┐

│    OFFICE BUILDING   │

│       ACCESS POINT   │

│          )))         │

└──────────)))─────────┘

           )))

       PARKING AREA

Attackers may attempt to connect from outside the organization's physical perimeter.

104. Wireless Controls

Consider:

• encryption;

• authentication;

• access-point placement;

• transmit power;

• rogue-AP detection;

• guest segmentation.

Part XXXIX — Network Access Control

105. What Is NAC?

Network Access Control determines whether a user or device should be permitted to connect to or remain connected to a network.

NIST's glossary describes NAC as controlling access based on credentials and, in some implementations, client-device health checks.

106. NAC Question

Instead of asking only:

Is there an Ethernet cable connected?

NAC asks:

Who or what is connecting, and should it receive network access?

Part XL — NAC Decision Flow

107. Basic Model

DEVICE CONNECTS

      │

      ▼

IDENTIFY / AUTHENTICATE

      │

      ▼

CHECK POLICY / POSTURE

      │

  ┌───┴────────────┐

  ▼                ▼

COMPLIANT       NONCOMPLIANT

  │                │

  ▼                ▼

ALLOW           RESTRICT /

                QUARANTINE

Part XLI — Pre-Admission NAC

108. Pre-Admission

Pre-admission NAC evaluates the endpoint:

before normal access is granted.

Possible checks include:

• authentication;

• device identity;

• security posture.

109. Example

LAPTOP CONNECTS

     │

     ▼

MFA/DEVICE AUTH

     │

     ▼

PATCH STATUS?

     │

     ▼

EDR RUNNING?

     │

     ▼

COMPLIANT?

     │

     ▼

PRODUCTION NETWORK

Part XLII — Post-Admission NAC

110. Post-Admission

Post-admission NAC continues evaluating activity after the device has joined.

If conditions change, access can be:

• restricted;

• terminated;

• moved to quarantine.

111. Why Post-Admission Matters

A device might be compliant at 9:00 AM and compromised at 2:00 PM.

Trust should not necessarily be permanent.

Part XLIII — 802.1X

112. What Is 802.1X?

802.1X provides port-based network access-control concepts for wired and wireless networks.

NIST implementation guidance describes 802.1X as a mechanism for authenticating an endpoint to a network device, with the network device forwarding authentication requests to a supporting authentication infrastructure.

113. Three Important Roles

Remember:

SUPPLICANT

      │

      ▼

AUTHENTICATOR

      │

      ▼

AUTHENTICATION SERVER

114. Supplicant

The supplicant is:

the endpoint requesting network access.

Example:

• laptop;

• workstation.

115. Authenticator

The authenticator controls the network access point.

Examples:

• Ethernet switch;

• wireless access point.

116. Authentication Server

The authentication server validates authentication information and supports the network-access decision.

RADIUS is commonly used for this role.

117. 802.1X Flow

LAPTOP

Supplicant

   │

   ▼

SWITCH

Authenticator

   │

   ▼

RADIUS

Authentication Server

   │

   ▼

ALLOW / DENY

Part XLIV — RADIUS

118. RADIUS

Remote Authentication Dial-In User Service is widely used to centralize AAA-related functions for network access.

Conceptually:

ACCESS DEVICE

      │

      ▼

RADIUS SERVER

      │

      ├── Authenticate

      ├── Authorize

      └── Account

Detailed AAA and RADIUS concepts will be expanded in Domain 5.

Part XLV — Endpoint Posture

119. What Is Posture?

Endpoint posture is the device's security condition.

Possible checks include:

• approved operating system;

• patch level;

• EDR status;

• firewall status;

• disk encryption;

• device management.

120. Identity + Posture

A user can be legitimate while the device is dangerous.

Example:

AUTHORIZED USER

       +

COMPROMISED LAPTOP

       =

NETWORK RISK

Therefore modern admission decisions may consider both.

Part XLVI — Quarantine Networks

121. Quarantine

A noncompliant endpoint may be placed in a restricted network.

NONCOMPLIANT DEVICE

        │

        ▼

QUARANTINE VLAN

        │

        ├── Patch server

        ├── EDR remediation

        └── Limited support

122. Purpose

Quarantine allows remediation without giving the device unrestricted production access.

Part XLVII — Remediation

123. Remediation Flow

DEVICE FAILS POSTURE

       │

       ▼

QUARANTINE

       │

       ▼

UPDATE / CLEAN / CONFIGURE

       │

       ▼

REASSESS

       │

   ┌───┴───┐

 PASS     FAIL

  │         │

ALLOW     REMAIN

Part XLVIII — Guest Networks

124. Guest Access

Visitors may need Internet access.

They generally should not automatically obtain:

• production-server access;

• management-plane access;

• internal business-system access.

125. Guest Segmentation

GUEST DEVICE

     │

     ▼

GUEST NETWORK

     │

     ▼

INTERNET



        X



INTERNAL SENSITIVE NETWORK

Part XLIX — BYOD

126. Bring Your Own Device

BYOD permits personally owned devices to access organizational services.

Risk arises because the organization may have less control over:

• configuration;

• patching;

• applications;

• storage.

127. BYOD Controls

Possible approaches include:

• NAC;

• MDM/UEM;

• containerization;

• application-level access;

• Zero Trust access;

• separate networks.

Part L — Agent-Based NAC

128. Agent-Based

A software agent on an endpoint may collect detailed security information.

Advantages:

• rich posture visibility.

Challenges:

• deployment;

• maintenance;

• privacy;

• device compatibility.

Part LI — Agentless NAC

129. Agentless

Agentless solutions assess devices without installing a permanent endpoint agent.

Advantages:

• easier coverage in some environments.

Limitations:

• potentially less detailed posture information.

Part LII — MAC Authentication

130. MAC-Based Admission

Some environments identify endpoints by MAC address.

But:

MAC addresses can be observed or spoofed.

Therefore MAC-based identification should not be considered equivalent to strong cryptographic identity.

131. CISSP Principle

Choose the strength of network admission control based on:

• asset value;

• device type;

• risk.

Part LIII — Virtual NAC

132. NAC Is Not Only a Physical Switch Feature

The current outline explicitly identifies:

physical and virtual NAC solutions.

Virtual environments may enforce admission or segmentation using:

• virtual switches;

• cloud policy;

• software-defined controls;

• identity-aware policies.

Part LIV — Endpoint Security

133. Endpoint Is the Edge of Trust

Endpoints include:

• workstations;

• laptops;

• servers;

• mobile devices;

• virtual machines.

The official objective specifically includes endpoint security, such as host-based security.

134. Why Endpoint Security Matters

The network may be secure.

But if an authorized endpoint is compromised:

ATTACKER

   │

   ▼

COMPROMISED AUTHORIZED DEVICE

   │

   ▼

LEGITIMATE NETWORK CONNECTION

   │

   ▼

INTERNAL RESOURCES

Network security and endpoint security must complement each other.

Part LV — Endpoint Security Layers

135. Layered Endpoint Protection

PATCHING

   │

   ▼

HOST FIREWALL

   │

   ▼

ANTI-MALWARE / EDR

   │

   ▼

APPLICATION CONTROL

   │

   ▼

DISK ENCRYPTION

   │

   ▼

LEAST PRIVILEGE

   │

   ▼

LOGGING / MONITORING

Part LVI — Host Firewall

136. Host-Based Firewall

A host firewall applies network policy directly to an endpoint.

Benefit:

protection travels with the device.

137. Remote Laptop Example

A laptop leaves the protected office LAN and joins hotel Wi-Fi.

The enterprise perimeter firewall no longer surrounds the device.

A properly configured host firewall still provides local network filtering.

Part LVII — Anti-Malware

138. Anti-Malware

Anti-malware tools attempt to detect and prevent malicious software.

They may use:

• signatures;

• heuristics;

• behavior analysis.

139. Limitation

No anti-malware product detects every threat.

Use defense in depth.

Part LVIII — Endpoint Detection and Response

140. EDR

Endpoint Detection and Response provides endpoint monitoring, detection, investigation, and response capabilities.

141. EDR Concept

ENDPOINT ACTIVITY

      │

      ▼

TELEMETRY

      │

      ▼

DETECTION / ANALYTICS

      │

      ▼

ALERT

      │

      ▼

INVESTIGATION

      │

      ▼

RESPONSE

142. Possible EDR Response

Depending on architecture, EDR may:

• isolate a host;

• terminate a process;

• collect evidence;

• support investigation.

Part LIX — HIDS

143. Host-Based IDS

A HIDS monitors a host for suspicious activity.

Sources can include:

• logs;

• files;

• system events;

• integrity changes.

Part LX — HIPS

144. Host-Based IPS

A HIPS can attempt to actively prevent certain malicious host behaviors.

Again:

HIDS = Detect



HIPS = Detect + Prevent

Part LXI — Application Allowlisting

145. Allowlisting

Application allowlisting permits approved software to execute while blocking unauthorized software.

146. Allowlist Versus Blocklist

Blocklist:

Block known bad applications.

Allowlist:

Permit approved applications.

Allowlisting can provide stronger control in stable, tightly managed environments.

Part LXII — Disk Encryption

147. Full-Disk Encryption

Disk encryption protects stored information if a device is:

• lost;

• stolen.

It primarily protects:

Data at Rest.

148. Limitation

Disk encryption does not automatically protect data when:

• the device is unlocked;

• malware runs under an authorized session.

Part LXIII — Endpoint Patching

149. Patching

Endpoints should receive appropriate:

• operating-system updates;

• application updates;

• firmware updates.

150. Patch Lifecycle

DISCOVER UPDATE

      │

      ▼

ASSESS

      │

      ▼

TEST

      │

      ▼

DEPLOY

      │

      ▼

VERIFY

Part LXIV — Endpoint Hardening

151. Hardening

Hardening reduces unnecessary attack surface.

Examples:

• disable unused services;

• remove unnecessary software;

• restrict administrative rights;

• enable security features.

152. Secure Default

A managed endpoint should start from:

a secure approved baseline

rather than from an unrestricted consumer configuration.

Part LXV — Least Privilege

153. Local Administrator Risk

Users with permanent local administrator rights can:

• install software;

• modify controls;

• disable protections.

Where feasible, users should operate with only the privilege required for their role.

Part LXVI — Endpoint Logging

154. Endpoint Telemetry

Endpoints can generate security information including:

• authentication events;

• process execution;

• malware detection;

• configuration changes.

155. Centralized Monitoring

ENDPOINTS

  │ │ │

  ▼ ▼ ▼

CENTRAL LOGGING / SIEM

       │

       ▼

ANALYSIS

       │

       ▼

RESPONSE

Part LXVII — MDM and UEM

156. Mobile Device Management

MDM can enforce security controls on:

• smartphones;

• tablets.

Possible controls include:

• encryption;

• screen lock;

• application policy;

• remote wipe.

157. Unified Endpoint Management

UEM extends centralized endpoint-management concepts across broader device types.

Part LXVIII — Endpoint Isolation

158. Compromised Host

When a host is compromised:

ENDPOINT

   │

   ▼

EDR / NAC DECISION

   │

   ▼

ISOLATE

   │

   ▼

INVESTIGATE

   │

   ▼

REMEDIATE

This demonstrates how NAC and endpoint security can work together.

Part LXIX — Endpoint + NAC Integration

159. Continuous Trust

Modern security can combine:

• user identity;

• device identity;

• posture;

• behavior;

• network policy.

USER

  +

DEVICE

  +

POSTURE

  +

CONTEXT

  │

  ▼

ACCESS DECISION

This aligns with modern enterprise architectures that move beyond simple perimeter-based trust. NIST's secure enterprise-network guidance specifically discusses device/endpoint security, cloud access, micro-segmentation, and Zero Trust-related frameworks as integrated concerns.

Part LXX — Secure Infrastructure Monitoring

160. Network Devices Need Logs

Network logs may include:

• administrator login;

• configuration change;

• interface state;

• denied traffic;

• routing events.

161. Configuration Change Alert

Example:

FIREWALL RULE CHANGED

       │

       ▼

LOG GENERATED

       │

       ▼

SIEM

       │

       ▼

AUTHORIZED CHANGE?

   ┌───┴────┐

  YES      NO

   │        │

CLOSE   INVESTIGATE

Part LXXI — Time Synchronization

162. Accurate Time

Network infrastructure should use appropriate trusted time synchronization.

Without consistent timestamps:

• log correlation becomes difficult;

• investigations become harder.

Part LXXII — SNMP

163. Simple Network Management Protocol

SNMP supports monitoring and management of network devices.

Older versions have weaker security characteristics.

For sensitive management, use:

appropriately secured modern configurations rather than legacy insecure settings.

164. SNMPv3 Concept

SNMPv3 can provide security capabilities such as:

• authentication;

• integrity;

• privacy/encryption

depending on configuration.

165. Exam Principle

Do not expose powerful network-management protocols broadly to untrusted networks.

Part LXXIII — Secure Infrastructure Design Example

166. Enterprise Network

                         INTERNET

                            │

                            ▼

                      EDGE ROUTERS

                       A         B

                        \       /

                         \     /

                       FIREWALL HA

                            │

                            ▼

                         DMZ

                            │

                            ▼

                    INTERNAL FIREWALL

                            │

            ┌───────────────┼──────────────┐

            ▼               ▼              ▼

         USERS           SERVERS         ADMIN

           │                │              │

           ▼                ▼              ▼

          NAC          HOST SECURITY   MGMT NETWORK

           │                │              │

           └───────────────┬┴──────────────┘

                           ▼

                      SIEM / MONITORING

Supporting controls include:

• redundant power;

• supported firmware;

• configuration backups;

• endpoint posture checks;

• secure administrative access.

Part LXXIV — SierraTec Secure HARDNET Model

167. HARDNET

Use the SierraTec Secure HARDNET model for network-component questions.

H — Harden Components

Remove defaults and unnecessary services.

A — Assure Availability

Use redundancy, supported hardware, power, and failover.

R — Restrict Administration

Protect privileged management interfaces.

D — Defend Transmission

Protect media and signal quality.

N — Network Admission

Authenticate and evaluate devices before granting access.

E — Endpoint Protection

Use layered host security.

T — Telemetry and Testing

Monitor infrastructure and test controls.

168. HARDNET Diagram

H

HARDEN

   │

   ▼

A

ASSURE AVAILABILITY

   │

   ▼

R

RESTRICT ADMINISTRATION

   │

   ▼

D

DEFEND TRANSMISSION

   │

   ▼

N

NETWORK ADMISSION

   │

   ▼

E

ENDPOINT PROTECTION

   │

   ▼

T

TELEMETRY & TEST

Part LXXV — Worked CISSP Scenarios

169. Scenario 1 — Redundant Power

A core switch has two power supplies, but both are plugged into the same nonredundant power strip.

What is the GREATEST concern?

A. Common-mode failure.

B. Excessive authentication.

C. Too much encryption.

D. VLAN hopping.

Correct Answer

A

The duplicate power supplies do not remove the shared power-strip dependency.

170. Scenario 2 — Vendor Support

A critical firewall works correctly but has reached End of Support.

What should management do?

A. Assess risk and plan replacement or an appropriately governed mitigation.

B. Assume it is secure because traffic still passes.

C. Disable backups.

D. Ignore future vulnerability disclosures.

Correct Answer

A

171. Scenario 3 — Failover

An organization purchases a standby router but never tests failover.

What is the PRIMARY concern?

A. The organization does not have assurance that redundancy will work when required.

B. The router is automatically insecure.

C. The standby router needs no configuration.

D. Testing would reduce availability permanently.

Correct Answer

A

172. Scenario 4 — Management Interface

Network-device management interfaces are accessible from every employee VLAN.

What is the BEST improvement?

A. Restrict administrative access through a dedicated protected management path.

B. Enable Telnet.

C. Remove authentication.

D. Publish the configuration.

Correct Answer

A

173. Scenario 5 — Firewall

A firewall permits only return traffic associated with previously established connections.

Which capability is MOST relevant?

A. Stateful inspection.

B. Data masking.

C. Tokenization.

D. Physical redundancy.

Correct Answer

A

174. Scenario 6 — IDS

A security device monitors network traffic and sends alerts but does not sit inline.

Which technology BEST matches?

A. IDS.

B. IPS.

C. Load balancer.

D. Router only.

Correct Answer

A

175. Scenario 7 — IPS

A security appliance detects a known exploit and automatically drops the offending packets.

Which technology is MOST directly represented?

A. IPS.

B. Passive IDS only.

C. Hub.

D. UPS.

Correct Answer

A

176. Scenario 8 — Fiber

An organization requires high-bandwidth communication across a facility containing significant electromagnetic interference.

Which medium is generally preferable?

A. Fiber-optic cabling.

B. Unshielded copper beside high-power motors.

C. Open wireless only.

D. Telephone cord.

Correct Answer

A

177. Scenario 9 — Signal Loss

A long cable run experiences progressively weaker signal levels and increased errors.

Which concept BEST describes the issue?

A. Attenuation.

B. Authentication.

C. Hash collision.

D. Revocation.

Correct Answer

A

178. Scenario 10 — NAC

A laptop connects to an internal switch. Before receiving production access, the organization checks its device identity, patch level, and EDR status.

Which control is MOST directly involved?

A. NAC.

B. CDN.

C. Data masking.

D. PKI only.

Correct Answer

A

Part LXXVI — Additional NAC Scenarios

179. Scenario 11 — 802.1X Role

A workstation requests access through a switch.

What is the workstation called in 802.1X terminology?

A. Supplicant.

B. Authenticator.

C. Authentication server.

D. Proxy.

Correct Answer

A

180. Scenario 12 — Authenticator

In an 802.1X deployment, which component normally controls whether the endpoint's network port is authorized?

A. Switch or wireless access point acting as authenticator.

B. End-user document.

C. Backup server.

D. HSM.

Correct Answer

A

181. Scenario 13 — Quarantine

A device authenticates successfully but lacks required security updates.

What should a risk-based NAC system BEST do?

A. Place the device in restricted remediation access rather than grant full production access.

B. Grant unrestricted access because the username was valid.

C. Disable all network controls.

D. Give the user administrative rights.

Correct Answer

A

182. Scenario 14 — MAC Address

An organization relies solely on MAC addresses to authenticate high-risk administrative workstations.

What is the PRIMARY concern?

A. MAC addresses can be spoofed and are not strong identity proof.

B. MAC addresses are encrypted automatically.

C. MAC addresses are certificates.

D. MAC addresses are impossible to observe.

Correct Answer

A

Part LXXVII — Endpoint Scenarios

183. Scenario 15 — Hotel Wi-Fi

A corporate laptop is frequently used on hotel networks.

Which control provides endpoint-level network filtering regardless of the local perimeter?

A. Host firewall.

B. Data-center firewall only.

C. Network hub.

D. Load balancer.

Correct Answer

A

184. Scenario 16 — Lost Laptop

An employee laptop containing sensitive information is stolen.

Which endpoint control MOST directly protects the confidentiality of stored information when properly configured?

A. Full-disk encryption.

B. Network IDS only.

C. Load balancing.

D. VLAN tagging.

Correct Answer

A

185. Scenario 17 — Malware Investigation

Security operations needs detailed endpoint process activity and the ability to isolate infected systems.

Which technology BEST fits?

A. EDR.

B. Passive network hub.

C. Generator.

D. RAID.

Correct Answer

A

186. Scenario 18 — Application Control

A kiosk should execute only a small approved set of applications.

Which approach BEST fits?

A. Application allowlisting.

B. Allow every executable.

C. Disable endpoint controls.

D. Provide permanent administrator rights.

Correct Answer

A

187. Scenario 19 — BYOD

Personally owned devices require access to email but should not receive unrestricted connectivity to sensitive internal systems.

Which approach is BEST?

A. Apply risk-based access controls such as managed application access, NAC, segmentation, and device policy.

B. Place all BYOD devices directly on the server-management network.

C. Remove authentication.

D. Share administrator credentials.

Correct Answer

A

Part LXXVIII — Common CISSP Exam Traps

188. Trap — Network Architecture Alone Provides Security

Architecture requires securely operated components to enforce it.

189. Trap — Two Devices Always Mean Redundancy

Shared dependencies can defeat both.

Look for common-mode failure.

190. Trap — Warranty Is Only a Purchasing Issue

Hardware replacement and vendor support directly affect operational availability.

191. Trap — Working Device Means Supported Device

A device can operate normally after vendor security support ends.

The risk still increases.

192. Trap — Firmware Is Not Software

Network devices rely on firmware and operating-system code that can contain vulnerabilities.

193. Trap — Firewall Equals Complete Security

A firewall controls traffic according to policy.

It does not replace:

• endpoint security;

• identity;

• patching;

• monitoring.

194. Trap — IDS and IPS Are Identical

IDS primarily detects.

IPS may actively prevent.

195. Trap — Fiber Cannot Be Tapped

Fiber can be more resistant to some interception techniques but is not invulnerable.

196. Trap — NAC Is Only Authentication

NAC may consider:

• identity;

• device security posture;

• context.

197. Trap — Valid User Means Safe Device

A legitimate user can operate a compromised endpoint.

198. Trap — MAC Address Is Strong Authentication

MAC addresses can be spoofed.

199. Trap — NAC Happens Only Once

Post-admission monitoring can reassess endpoints after initial admission.

200. Trap — Quarantine Means Disconnect From Everything

A quarantine network may permit limited remediation services while denying production resources.

201. Trap — Endpoint Protection Means Antivirus Only

Modern endpoint security can include:

• firewall;

• EDR;

• patching;

• encryption;

• application control;

• hardening.

202. Trap — Disk Encryption Stops Malware

Disk encryption primarily protects stored data when the device is not properly unlocked by an attacker.

It does not replace runtime endpoint security.

203. Trap — Administrator Accounts Should Be Shared for Convenience

Shared privileged accounts reduce accountability and increase security risk.

Part LXXIX — Knowledge Check

204. Knowledge Check

Question 1

Which issue is explicitly included in CISSP Domain 4.2 infrastructure operations?

A. Redundant power.

B. Copyright.

C. Data classification only.

D. Software patents.

Correct Answer

A

Question 2

Why are vendor warranties relevant to network security?

A. They can affect timely hardware replacement and service availability.

B. They provide encryption.

C. They replace firewalls.

D. They authenticate users.

Correct Answer

A

Question 3

What is a common-mode failure?

A. A single condition capable of defeating multiple redundant components.

B. Successful device failover.

C. Strong endpoint encryption.

D. VLAN separation.

Correct Answer

A

Question 4

What is a secure configuration baseline?

A. Approved reference configuration for a device.

B. Password shared by all administrators.

C. Unrestricted default configuration.

D. Warranty certificate.

Correct Answer

A

Question 5

Which network component primarily controls traffic between security zones according to policy?

A. Firewall.

B. UPS.

C. Fiber cable.

D. HSM.

Correct Answer

A

Question 6

What does a stateful firewall track?

A. Connection state.

B. Humidity.

C. Physical badges.

D. Disk sectors.

Correct Answer

A

Question 7

Which technology primarily alerts on suspicious traffic without necessarily blocking it?

A. IDS.

B. IPS only.

C. UPS.

D. Router warranty.

Correct Answer

A

Question 8

Which technology can be placed inline to block detected attacks?

A. IPS.

B. Passive IDS only.

C. Network tap.

D. Patch panel.

Correct Answer

A

Question 9

Which medium is inherently resistant to electromagnetic interference?

A. Fiber.

B. Unshielded copper.

C. Coax only.

D. Radio.

Correct Answer

A

Question 10

What is attenuation?

A. Loss of signal strength over distance.

B. User authentication.

C. Firewall rule removal.

D. Device revocation.

Correct Answer

A

Question 11

What is crosstalk?

A. Unwanted signal coupling between communication paths.

B. Secure authentication.

C. Network redundancy.

D. Load balancing.

Correct Answer

A

Question 12

What is the primary purpose of NAC?

A. Control which devices/users receive network access.

B. Replace routing.

C. Create backups.

D. Encrypt every file.

Correct Answer

A

Question 13

In 802.1X, what is the endpoint requesting access called?

A. Supplicant.

B. Authenticator.

C. Authentication server.

D. Relying party.

Correct Answer

A

Question 14

In 802.1X, what commonly acts as the authenticator?

A. Switch or access point.

B. Certificate Authority.

C. User's document.

D. Backup tape.

Correct Answer

A

Question 15

What does endpoint posture represent?

A. Security condition of the endpoint.

B. Physical sitting position of a user.

C. Network topology.

D. Warranty status only.

Correct Answer

A

Question 16

Why might a device be placed on a quarantine network?

A. It is noncompliant and requires remediation.

B. It has perfect security.

C. It requires unrestricted database access.

D. It is a router.

Correct Answer

A

Question 17

Which endpoint control can continue filtering network traffic when a laptop leaves the corporate network?

A. Host firewall.

B. Corporate perimeter firewall alone.

C. Data-center load balancer.

D. UPS.

Correct Answer

A

Question 18

Which technology provides endpoint telemetry, investigation, and response capability?

A. EDR.

B. Cable conduit.

C. VLAN.

D. Generator.

Correct Answer

A

Question 19

What does application allowlisting do?

A. Restricts execution to approved applications.

B. Allows every application except known malware.

C. Encrypts network traffic.

D. Replaces patching.

Correct Answer

A

Question 20

Which statement is MOST accurate?

A. Network and endpoint security should operate as complementary layers.

B. Endpoint security makes segmentation unnecessary.

C. NAC replaces authentication.

D. Fiber eliminates every physical threat.

Correct Answer

A

Part LXXX — Original CISSP-Style Practice Questions

205. Practice Question 1

A company's two Internet routers use different carriers but both carrier circuits enter the building through the same underground conduit.

What is the GREATEST concern?

A. Physical common-mode failure.

B. Too much redundancy.

C. Lack of endpoint encryption.

D. DNS caching.

Correct Answer

A

206. Practice Question 2

A core firewall has not received firmware security updates because the organization's support contract expired.

What is the BEST action?

A. Assess the risk and restore supported maintenance or migrate to supported infrastructure.

B. Ignore the issue if traffic still flows.

C. Disable firewall logging.

D. Publish the configuration.

Correct Answer

A

207. Practice Question 3

A temporary firewall rule was added six months ago and no one can determine whether it is still needed.

What process should address this?

A. Configuration and rule lifecycle review.

B. Data destruction.

C. Password hashing.

D. Physical media disposal.

Correct Answer

A

208. Practice Question 4

A security team wants visibility into traffic traversing a switch without placing the monitoring device inline.

Which technique is MOST directly applicable?

A. Port mirroring/SPAN or an appropriate network tap.

B. UPS.

C. Disk encryption.

D. RAID.

Correct Answer

A

209. Practice Question 5

A laptop presents valid user credentials but its endpoint security software is disabled.

What should a mature NAC design consider?

A. Restricting access based on both identity and endpoint posture.

B. Granting unrestricted access because authentication succeeded.

C. Removing all endpoint controls.

D. Publishing the device MAC address.

Correct Answer

A

210. Practice Question 6

A network switch authenticates devices through an external RADIUS service before allowing production connectivity.

Which general technology is being implemented?

A. 802.1X/NAC.

B. CDN.

C. IPsec tunnel only.

D. File encryption.

Correct Answer

A

211. Practice Question 7

A compromised endpoint is automatically moved from the production VLAN into a restricted remediation segment.

Which controls are working together?

A. Endpoint detection and NAC.

B. Generator and UPS only.

C. RAID and load balancing.

D. PKI and copyright.

Correct Answer

A

212. Practice Question 8

A company uses full-disk encryption but does not patch its laptops or deploy endpoint detection.

Which statement is BEST?

A. Data-at-rest protection exists, but runtime endpoint compromise remains a significant risk.

B. Full-disk encryption eliminates malware risk.

C. Patch management is no longer necessary.

D. Network access controls are unnecessary.

Correct Answer

A

213. Practice Question 9

A data center's copper network cables run next to large electrical motors and experience intermittent communication errors.

Which problem is MOST likely?

A. Electromagnetic interference.

B. Certificate revocation.

C. Tailgating.

D. Hash collision.

Correct Answer

A

214. Practice Question 10

An organization is replacing network switches. One product is cheaper, but vendor support will end in 12 months. Another has several years of support remaining.

Which factor should security leadership consider MOST?

A. Total lifecycle and support risk, not purchase price alone.

B. Choose the cheaper device regardless of support.

C. Warranty and support are unrelated to cybersecurity.

D. Switches do not require security patches.

Correct Answer

A

Part LXXXI — Infrastructure Operations Memory Table

215. Infrastructure Concepts

Part LXXXII — Network Component Memory Table

216. Component Associations

Part LXXXIII — Transmission Media Memory Table

217. Media Comparison

Part LXXXIV — NAC Memory Table

218. 802.1X Roles

Part LXXXV — Endpoint Security Memory Table

219. Endpoint Controls

Part LXXXVI — Key Terms

220. Key Terms

Infrastructure Operations

Processes necessary to keep network infrastructure secure, available, supported, and maintainable.

Redundancy

Additional component or path intended to preserve service after failure.

Common-Mode Failure

Single event capable of defeating multiple redundant components.

Failover

Transfer of operations to a backup component.

High Availability

Architecture intended to maintain service despite component failures.

End of Support

Point at which normal vendor security and technical support ends.

Firmware

Software embedded within hardware devices.

Configuration Baseline

Approved reference configuration.

Configuration Drift

Deviation from approved configuration over time.

Firewall

Device or software controlling network traffic according to policy.

Stateful Inspection

Firewall capability tracking network connection state.

Proxy

Intermediary communicating on behalf of another system.

Reverse Proxy

Proxy positioned in front of server resources.

Load Balancer

Component distributing connections or requests among resources.

IDS

Intrusion Detection System.

IPS

Intrusion Prevention System.

Signature-Based Detection

Detection based on known threat patterns.

Anomaly Detection

Detection based on deviations from expected behavior.

Network Tap

Mechanism for providing monitoring access to network traffic.

SPAN

Switch-port mirroring capability used for traffic monitoring.

Transmission Media

Physical or wireless mechanisms carrying network signals.

Copper

Electrical transmission medium.

Fiber Optic

Light-based transmission medium.

Attenuation

Loss of signal strength over distance.

EMI

Electromagnetic Interference.

RFI

Radio-Frequency Interference.

Crosstalk

Unwanted signal coupling between communication paths.

NAC

Network Access Control.

Pre-Admission NAC

Assessment performed before production network access.

Post-Admission NAC

Assessment and control after network admission.

802.1X

Port-based network-access control framework.

Supplicant

Endpoint requesting 802.1X network access.

Authenticator

Network device controlling access in 802.1X.

Authentication Server

System validating network-access credentials or policy.

RADIUS

Centralized Authentication, Authorization, and Accounting protocol commonly used with network access.

Posture Assessment

Evaluation of endpoint security condition.

Quarantine Network

Restricted environment used for noncompliant endpoints.

Endpoint Security

Security controls applied directly to endpoint devices.

Host Firewall

Firewall operating on an individual endpoint.

EDR

Endpoint Detection and Response.

HIDS

Host-Based Intrusion Detection System.

HIPS

Host-Based Intrusion Prevention System.

Application Allowlisting

Policy permitting only approved executable software.

MDM

Mobile Device Management.

UEM

Unified Endpoint Management.

Part LXXXVII — CISSP Exam Focus

221. Secure Network Component Mindset

Use this sequence:

NETWORK COMPONENT

       │

       ▼

IS IT SUPPORTED?

       │

       ▼

IS IT HARDENED?

       │

       ▼

IS MANAGEMENT RESTRICTED?

       │

       ▼

IS IT REDUNDANT?

       │

       ▼

IS TRAFFIC / MEDIA PROTECTED?

       │

       ▼

ARE DEVICES VERIFIED BEFORE ACCESS?

       │

       ▼

ARE ENDPOINTS PROTECTED?

       │

       ▼

IS EVERYTHING MONITORED?

For CISSP questions:

• Domain 4.2 currently centers on infrastructure operations, transmission media, NAC, and endpoint security.

• Redundant components should not share avoidable common failure points.

• Redundant power should use meaningful independent power paths where required.

• High-availability systems must be tested.

• Hardware warranty and vendor support affect availability and security.

• A working unsupported network device can still represent unacceptable risk.

• Network-device firmware requires lifecycle management.

• Baselines help identify configuration drift.

• Protect configuration backups.

• Management interfaces are high-value targets.

• Separate privileged management from ordinary user access.

• Use secure management protocols.

• Routers and switches should follow hardened approved configurations.

• Firewalls enforce communication policy but do not replace endpoint security.

• Stateful firewalls understand connection state.

• IDS primarily detects.

• IPS may block.

• Monitoring requires visibility into relevant traffic.

• Copper may be affected by EMI, RFI, attenuation, and crosstalk.

• Fiber is resistant to EMI but is not impossible to tap.

• Wireless signals can extend beyond physical facility boundaries.

• NAC decides whether a user/device should receive network access.

• NIST describes NAC in terms of credentials and, where applicable, client health checks.

• In 802.1X, remember supplicant → authenticator → authentication server. NIST deployment guidance describes 802.1X authentication of endpoints through network devices with authentication forwarded to supporting infrastructure.

• Successful user authentication does not guarantee a safe endpoint.

• Posture checks can consider device security state.

• Noncompliant endpoints can be quarantined.

• MAC-address identification is weaker than robust authentication.

• Endpoint security is broader than antivirus.

• Host firewalls remain important outside the enterprise perimeter.

• EDR improves endpoint detection, investigation, and response.

• Full-disk encryption protects data at rest, not all runtime activity.

• Application allowlisting can restrict unauthorized execution.

• NAC and endpoint security can work together for continuous access decisions.

• Network infrastructure should be monitored for configuration and operational changes.

222. Lesson Summary

Lesson Fifteen focused on securing the network components that implement the architecture introduced in Lesson Fourteen.

The current CISSP Objective 4.2 defines four major areas:

INFRASTRUCTURE OPERATIONS

         │

TRANSMISSION MEDIA

         │

NETWORK ACCESS CONTROL

         │

ENDPOINT SECURITY

You learned that infrastructure security includes more than configuring routers and switches.

A critical device must be:

SUPPORTED

    +

PATCHED

    +

HARDENED

    +

REDUNDANT

    +

MONITORED

    =

TRUSTWORTHY INFRASTRUCTURE

You examined availability engineering through:

• device redundancy;

• power redundancy;

• link redundancy;

• failover;

• warranty;

• vendor support.

You learned that redundant architecture must consider common-mode failures.

REDUNDANT DEVICE A

       +

REDUNDANT DEVICE B

       +

SAME SINGLE FAILURE POINT

       =

NOT TRUE RESILIENCE

You examined network-security components including:

• routers;

• switches;

• firewalls;

• proxies;

• load balancers;

• IDS;

• IPS;

• traffic-monitoring mechanisms.

NIST describes firewalls as components that control network traffic between networks or systems with differing security postures and emphasizes proper policy, configuration, deployment, testing, and management.

You then studied transmission media.

COPPER

  │

  ├── EMI

  ├── RFI

  ├── Crosstalk

  └── Attenuation



FIBER

  │

  ├── Light

  ├── High bandwidth

  ├── EMI resistant

  └── Still physically protect



WIRELESS

  │

  └── Signals may cross facility boundaries

The official CISSP objective specifically requires candidates to understand both the physical security of transmission media and signal-propagation quality.

The lesson then introduced Network Access Control.

DEVICE CONNECTS

      ↓

AUTHENTICATE

      ↓

ASSESS POSTURE

      ↓

APPLY POLICY

      ↓

ALLOW / RESTRICT / QUARANTINE

NIST recognizes NAC as a mechanism that can consider both credentials and device health when making access decisions.

For 802.1X, remember:

SUPPLICANT

    ↓

AUTHENTICATOR

    ↓

AUTHENTICATION SERVER

Finally, you studied endpoint security as a critical network-control layer:

PATCHING

    ↓

HOST FIREWALL

    ↓

ANTI-MALWARE / EDR

    ↓

APPLICATION CONTROL

    ↓

DISK ENCRYPTION

    ↓

LEAST PRIVILEGE

    ↓

MONITORING

NIST's modern enterprise-network guidance similarly recognizes endpoint/device security as part of the broader enterprise network-security environment alongside micro-segmentation, cloud access, VPNs, SASE, and Zero Trust-related approaches.

The central Lesson Fifteen principle is:

A secure network is not created simply by designing the correct topology. Every device, management interface, transmission path, endpoint, and network-access decision must remain hardened, supported, monitored, appropriately redundant, and governed throughout its operational lifecycle.

Exam Readiness Check

Before continuing to Lesson Sixteen, make sure you can explain:

• The four current CISSP Domain 4.2 categories.

• Why network-component security differs from network architecture.

• Why infrastructure availability is part of security.

• What redundancy means.

• What common-mode failure means.

• Why dual power supplies may still share a single failure point.

• What active/passive and active/active mean conceptually.

• What failover means.

• Why failover must be tested.

• Why warranty matters to security.

• Why vendor support matters.

• Why End of Support creates risk.

• Why network-device firmware requires patching.

• What a network-device security baseline is.

• What configuration drift means.

• Why configuration backups require protection.

• Why management interfaces are high-value targets.

• Why dedicated management networks improve security.

• Why administrator actions should be attributable.

• What AAA means.

• What routers do.

• What switches do.

• What firewalls do.

• What packet filtering means.

• What stateful inspection means.

• What an application-aware firewall does conceptually.

• What a forward proxy does.

• What a reverse proxy does.

• What a load balancer does.

• Why a load balancer can become a single point of failure.

• The difference between IDS and IPS.

• The difference between signature and anomaly detection.

• Why monitoring tools need traffic visibility.

• What a network tap does.

• What SPAN/port mirroring does.

• Why monitored traffic itself may be sensitive.

• The differences among copper, fiber, and wireless media.

• What attenuation means.

• What EMI means.

• What RFI means.

• What crosstalk means.

• Why fiber is resistant to EMI.

• Why fiber is not impossible to intercept.

• Why wireless extends the network's effective physical exposure.

• What NAC does.

• What pre-admission NAC means.

• What post-admission NAC means.

• What 802.1X does.

• What a supplicant is.

• What an authenticator is.

• What an authentication server is.

• How RADIUS supports NAC.

• What endpoint posture means.

• Why valid credentials alone may be insufficient.

• What a quarantine network does.

• How guest networks should be separated.

• Why BYOD needs special controls.

• The difference between agent-based and agentless NAC.

• Why MAC addresses are weak authentication identifiers.

• What endpoint security means.

• What a host firewall does.

• What EDR does.

• The difference between HIDS and HIPS.

• What application allowlisting does.

• What full-disk encryption protects.

• Why disk encryption does not stop runtime malware.

• Why endpoint patching matters.

• What MDM and UEM do.

• How NAC and endpoint security can integrate.

• Why endpoint and network telemetry should be centrally monitored.

Coming Next

Lesson Sixteen: Secure Communication Channels, Remote Access, and Third-Party Connectivity

Lesson Sixteen will address CISSP Domain 4.3 — Implement secure communication channels according to design.

The current outline explicitly includes:

• voice, video, and collaboration technologies;

• conferencing and collaboration rooms;

• remote access;

• network administrative functions;

• data communications;

• backhaul networks;

• satellite communications;

• third-party connectivity;

• telecommunications providers;

• hardware-support connectivity.

Lesson Sixteen will therefore cover:

• secure remote access architecture;

• VPNs;

• client VPN;

• site-to-site VPN;

• IPsec;

• TLS VPNs;

• remote desktop;

• RDP security;

• SSH;

• bastion hosts;

• jump servers;

• privileged access workstations;

• remote administrative access;

• split tunneling;

• full tunneling;

• remote-access MFA;

• endpoint posture;

• Zero Trust Network Access;

• voice security;

• VoIP;

• SIP concepts;

• secure voice;

• video conferencing;

• collaboration platforms;

• meeting-room security;

• screen sharing;

• recording controls;

• data communication;

• private circuits;

• MPLS concepts;

• backhaul networks;

• satellite communication;

• telecom-provider risk;

• partner connectivity;

• vendor remote support;

• third-party VPN access;

• restricted vendor accounts;

• time-limited access;

• monitoring of remote sessions;

• third-party connection termination;

• original secure-channel architecture diagrams;

• scenario-based CISSP questions.

The central Lesson Sixteen question will be:

How should remote users, administrators, business partners, communications platforms, carriers, and third-party support providers connect to organizational resources without weakening identity, segmentation, confidentiality, monitoring, or least-privilege requirements?

Publication and Independence Notice

This lesson is independently developed educational material for the SierraTec Secure CISSP Certification Preparation Course.

CISSP is administered by ISC2. SierraTec Secure's course is independent certification-preparation material and should not be represented as official ISC2 training unless separately authorized.

The current examination alignment was verified against the ISC2 CISSP Certification Exam Outline. Domain 4.2 currently identifies infrastructure operations, transmission-media protection and propagation quality, physical/virtual Network Access Control, and host-based endpoint security.

Supporting firewall concepts were aligned with NIST SP 800-41 Rev. 1, which describes firewalls as controlling network traffic between systems or networks with differing security postures.

NAC terminology was supplemented by NIST definitions and practice guidance. NIST describes NAC as controlling network access based on credentials and, in applicable implementations, device-health information; NIST implementation material also identifies 802.1X as a mechanism for authenticating endpoints through network devices to supporting authentication infrastructure.

Wireless infrastructure concepts were supplemented by NIST SP 800-153, which emphasizes securing wireless clients, access points, and switching components throughout the WLAN lifecycle.

The SierraTec Secure HARDNET model, diagrams, comparison tables, scenarios, knowledge checks, and practice questions are original educational material and are not actual, recalled, leaked, or official CISSP examination questions.