CISSP COMMUNICATION AND NETWORK SECURITY EXAMINATION
PREPARATION | STUDY GUIDE | LATEST UPDATE 2026/2027 |
ACTUAL EXAM | PRACTICE QUESTIONS AND ANSWERS | EXAM
REVIEW | 100% CORRECT ANSWERS | VERIFIED SOLUTIONS
This comprehensive practice examination is designed for information security professionals
preparing for Domain 4 of the CISSP certification: Communication and Network Security. This
domain encompasses the design, implementation, and protection of network infrastructure,
including secure network architecture principles, transmission protocols, network access
controls, and secure communication channels. Each question reflects the cognitive complexity of
the adaptive testing environment, addressing network architecture design, secure protocol
implementation, network attack recognition, and defense-in-depth strategies. Candidates will
engage with scenarios involving OSI and TCP/IP model application, wireless security
configuration, network segmentation, firewall deployment, and intrusion detection system
placement. By working through these 100 advanced questions with detailed answer rationales
and verified solutions, you will identify knowledge gaps and strengthen your command of
communication and network security principles essential for passing the CISSP examination.
Table of Contents
Secure Network Architecture and Design
OSI and TCP/IP Models
Network Protocols and Services
Network Segmentation and Isolation
Wireless Network Security
Firewall and Proxy Technologies
Intrusion Detection and Prevention Systems
Virtual Private Networks and Secure Communications
Network Attacks and Countermeasures
,Question 1
A network architect is designing a multi-tier application architecture for a financial services
platform. The architecture must separate the web presentation layer, application logic layer, and
database layer to limit the impact of a compromise. The architect places each tier in a separate
network segment with a firewall between each segment. What is this security architecture pattern
called?
A) Flat network design with all servers in one subnet
B) Screened subnet or demilitarized zone architecture with tiered segmentation
C) Peer-to-peer mesh networking
D) Direct server return load balancing
Correct Answer: B
A screened subnet architecture places servers in separate security zones with controlled access
between them. The web tier may be in a public-facing DMZ, the application tier in a second
DMZ, and the database tier in the most restricted internal segment. Firewalls between tiers
enforce access control policies, limiting lateral movement if one tier is compromised. This is
fundamental to defense in depth for network architecture.
Question 2
During a forensic investigation of a suspected data exfiltration, an analyst captures packets that
appear larger than the standard Ethernet Maximum Transmission Unit of 1500 bytes. The capture
was taken on the sending server's network interface. The server was using TCP Segmentation
Offload. What phenomenon is causing the oversized packets in the capture?
A) The attacker fragmented the IP packets to evade detection
B) The network interface card aggregated multiple TCP segments into a larger packet before the
,capture point, so the capture shows the aggregated rather than wire-format packets
C) Jumbo frames were enabled on the switch
D) The packets were corrupted during capture
Correct Answer: B
TCP Segmentation Offload and Large Send Offload allow the operating system to send large
data blocks to the NIC, which then segments them into MTU-sized packets in hardware. When
packet capture occurs at the sending host, the capture sees the pre-segmentation large blocks.
This is a known forensic artifact; the actual wire traffic is standard MTU size. The analyst must
account for TSO when reconstructing sessions from host-based captures.
Question 3
A security architect is designing a Zero Trust Network Access solution to replace traditional
VPN remote access. The ZTNA solution uses a broker model where both the user's device and
the application connect outbound to a cloud proxy. Users authenticate to the proxy, which
brokers the connection without exposing the application to the internet. What is the primary
security advantage over a traditional VPN?
A) ZTNA eliminates the need for encryption
B) Applications are never exposed to the public internet; users are granted access only to specific
applications, not the entire network
C) ZTNA does not require user authentication
D) ZTNA is always less expensive than VPN
Correct Answer: B
Traditional VPNs place the remote device on the internal network, granting broad network
access that can be exploited for lateral movement. ZTNA connects users only to specific
, authorized applications through outbound connections, keeping applications invisible to the
internet. This application-level microsegmentation dramatically reduces the attack surface.
Authentication is still required; it is integrated into the broker model.
Question 4
An organization is implementing a Secure Sockets Layer inspection capability on its next-
generation firewall. The firewall terminates TLS connections from internal clients to external
servers, inspects the decrypted content, and re-encrypts before forwarding. What is the primary
security risk introduced by this inspection architecture?
A) The firewall may not support the latest TLS cipher suites
B) The firewall becomes a decryption point where plaintext traffic is processed, making it a
high-value target for attackers
C) External servers will reject re-encrypted traffic
D) Clients must disable certificate validation
Correct Answer: B
TLS inspection creates a "decryption gap" where sensitive traffic exists in plaintext on the
firewall. If the firewall is compromised, all inspected traffic is exposed. This concentrates risk
and requires the firewall to be protected with the highest security controls. Additionally, the
firewall's certificate must be trusted by all clients, which creates a trust relationship that could
be exploited if the firewall's private key is compromised.
Question 5
A network engineer is configuring a switch to prevent Address Resolution Protocol spoofing
attacks. The attacker has been sending unsolicited ARP replies to associate their MAC address
with the default gateway's IP address, redirecting traffic. Which feature prevents this attack by
PREPARATION | STUDY GUIDE | LATEST UPDATE 2026/2027 |
ACTUAL EXAM | PRACTICE QUESTIONS AND ANSWERS | EXAM
REVIEW | 100% CORRECT ANSWERS | VERIFIED SOLUTIONS
This comprehensive practice examination is designed for information security professionals
preparing for Domain 4 of the CISSP certification: Communication and Network Security. This
domain encompasses the design, implementation, and protection of network infrastructure,
including secure network architecture principles, transmission protocols, network access
controls, and secure communication channels. Each question reflects the cognitive complexity of
the adaptive testing environment, addressing network architecture design, secure protocol
implementation, network attack recognition, and defense-in-depth strategies. Candidates will
engage with scenarios involving OSI and TCP/IP model application, wireless security
configuration, network segmentation, firewall deployment, and intrusion detection system
placement. By working through these 100 advanced questions with detailed answer rationales
and verified solutions, you will identify knowledge gaps and strengthen your command of
communication and network security principles essential for passing the CISSP examination.
Table of Contents
Secure Network Architecture and Design
OSI and TCP/IP Models
Network Protocols and Services
Network Segmentation and Isolation
Wireless Network Security
Firewall and Proxy Technologies
Intrusion Detection and Prevention Systems
Virtual Private Networks and Secure Communications
Network Attacks and Countermeasures
,Question 1
A network architect is designing a multi-tier application architecture for a financial services
platform. The architecture must separate the web presentation layer, application logic layer, and
database layer to limit the impact of a compromise. The architect places each tier in a separate
network segment with a firewall between each segment. What is this security architecture pattern
called?
A) Flat network design with all servers in one subnet
B) Screened subnet or demilitarized zone architecture with tiered segmentation
C) Peer-to-peer mesh networking
D) Direct server return load balancing
Correct Answer: B
A screened subnet architecture places servers in separate security zones with controlled access
between them. The web tier may be in a public-facing DMZ, the application tier in a second
DMZ, and the database tier in the most restricted internal segment. Firewalls between tiers
enforce access control policies, limiting lateral movement if one tier is compromised. This is
fundamental to defense in depth for network architecture.
Question 2
During a forensic investigation of a suspected data exfiltration, an analyst captures packets that
appear larger than the standard Ethernet Maximum Transmission Unit of 1500 bytes. The capture
was taken on the sending server's network interface. The server was using TCP Segmentation
Offload. What phenomenon is causing the oversized packets in the capture?
A) The attacker fragmented the IP packets to evade detection
B) The network interface card aggregated multiple TCP segments into a larger packet before the
,capture point, so the capture shows the aggregated rather than wire-format packets
C) Jumbo frames were enabled on the switch
D) The packets were corrupted during capture
Correct Answer: B
TCP Segmentation Offload and Large Send Offload allow the operating system to send large
data blocks to the NIC, which then segments them into MTU-sized packets in hardware. When
packet capture occurs at the sending host, the capture sees the pre-segmentation large blocks.
This is a known forensic artifact; the actual wire traffic is standard MTU size. The analyst must
account for TSO when reconstructing sessions from host-based captures.
Question 3
A security architect is designing a Zero Trust Network Access solution to replace traditional
VPN remote access. The ZTNA solution uses a broker model where both the user's device and
the application connect outbound to a cloud proxy. Users authenticate to the proxy, which
brokers the connection without exposing the application to the internet. What is the primary
security advantage over a traditional VPN?
A) ZTNA eliminates the need for encryption
B) Applications are never exposed to the public internet; users are granted access only to specific
applications, not the entire network
C) ZTNA does not require user authentication
D) ZTNA is always less expensive than VPN
Correct Answer: B
Traditional VPNs place the remote device on the internal network, granting broad network
access that can be exploited for lateral movement. ZTNA connects users only to specific
, authorized applications through outbound connections, keeping applications invisible to the
internet. This application-level microsegmentation dramatically reduces the attack surface.
Authentication is still required; it is integrated into the broker model.
Question 4
An organization is implementing a Secure Sockets Layer inspection capability on its next-
generation firewall. The firewall terminates TLS connections from internal clients to external
servers, inspects the decrypted content, and re-encrypts before forwarding. What is the primary
security risk introduced by this inspection architecture?
A) The firewall may not support the latest TLS cipher suites
B) The firewall becomes a decryption point where plaintext traffic is processed, making it a
high-value target for attackers
C) External servers will reject re-encrypted traffic
D) Clients must disable certificate validation
Correct Answer: B
TLS inspection creates a "decryption gap" where sensitive traffic exists in plaintext on the
firewall. If the firewall is compromised, all inspected traffic is exposed. This concentrates risk
and requires the firewall to be protected with the highest security controls. Additionally, the
firewall's certificate must be trusted by all clients, which creates a trust relationship that could
be exploited if the firewall's private key is compromised.
Question 5
A network engineer is configuring a switch to prevent Address Resolution Protocol spoofing
attacks. The attacker has been sending unsolicited ARP replies to associate their MAC address
with the default gateway's IP address, redirecting traffic. Which feature prevents this attack by
