CISSP Domain 4: Communication and Network Security explained

Domain 4 at a glance

The subdomains in plain words

1. 4.1 Secure network architecture: the OSI and TCP/IP models, addressing and name resolution, converged protocols, secure protocols, segmentation, wireless and cellular, content delivery and software-defined networks.
2. 4.2 Secure network components: zones, firewalls, network access control, endpoint security, transmission media and operating the hardware reliably.
3. 4.3 Secure communication channels: voice, collaboration tools, remote access, VPNs, WAN links, email and third-party connections.

What the exam tends to test

• Layers as a map. Knowing at which layer a protocol, device or attack works lets you reason about which control can stop it.
• Zones before boxes. Segment first, then place devices at the boundaries. The question often rewards the architectural answer over a single device.
• The right protocol for the goal. Which protocol adds confidentiality, which adds integrity, and which merely looks secure.
• Trade-offs in remote access. Strength of authentication, where encryption ends and what is logged.
• Availability counts too. Redundant power, load balancing and support contracts are security decisions.

How deep to go

You need breadth more than depth. Know what each layer does, where common devices sit and what each secure protocol adds. You do not need command syntax, long subnetting drills or vendor features. When a question looks deeply technical, look for the design decision hidden inside it: where to segment, what to encrypt, what to monitor.

Common traps

• Trusting hidden SSIDs or MAC filtering. Both are easy to bypass and are not real security controls.
• Assuming a firewall sees everything. Traffic tunnelled inside an allowed protocol can pass unseen.
• Mixing up IPsec modes. Transport mode protects the payload; tunnel mode wraps the whole packet.
• Equating encryption to the provider with end-to-end encryption. Read where the encryption stops.
• Choosing the cleverest technical fix when the scenario asks what a manager should do first, such as review the architecture or the policy.

How to study it

1. Learn the OSI layers with one protocol, one device and one attack for each. That single grid answers a surprising number of questions.
2. Study firewall types by what they inspect, not by vendor names.
3. Practise wireless and remote-access scenarios as risk trade-offs: what is gained, what is exposed, what compensates.
4. If you work in networking already, as many candidates in Bengaluru, Pune and Hyderabad do, move some hours from here to Domain 1 and Domain 6. If you come from audit or GRC, do the reverse.
5. From 15 April 2027 the outline names micro-segmentation, edge networks, virtual private clouds and software-defined security under 4.1; see what changes in 2027.

Worked example: thinking it through

Our own illustration, not an exam item.

The situation. Your sales team works from client offices and cafés across India, often on public Wi-Fi, and needs access to the CRM and internal file shares. The head of sales wants it simple. What is the best way to provide secure access?

• Hide the office wireless network name and filter devices by MAC address.
• A VPN with multi-factor authentication, set by policy to protect all traffic to company systems.
• Ban remote access until staff return to the office.
• Tell staff to use only cafés with password-protected Wi-Fi.

The reasoning. Hiding the network name and filtering MAC addresses do nothing for people outside the office, and both are weak even inside it. A ban removes the risk by removing the business activity, which a manager should rarely choose when a reasonable control exists. Shared café passwords give no real protection between users. A VPN with strong authentication protects the channel whatever network the person is on, and policy makes it consistent. It is the answer that balances security with what the business needs to do.

Next steps

Check the full weight picture on the domains overview and pair this domain with Domain 3. Then test yourself on our own practice questions.