Certified Information Systems Security Professional (CISSP) Communication and Network Security Syllabus

Communication and Network Security syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Communication and Network Security in Certified Information Systems Security Professional (CISSP), not a summary of it.

1. 1

   Network Architecture and Protocols

   4 topics

   • OSI and TCP/IP Models
     • Seven OSI layers and encapsulation
     • TCP/IP model mapping
     • Protocol data units per layer
   • IP Networking Fundamentals
     • IPv4 and IPv6 addressing
     • Subnetting and CIDR
     • NAT and private address ranges
   • Core Protocols and Services
     • TCP versus UDP behavior
     • DNS, DHCP, and ICMP
     • Secure protocol alternatives (HTTPS, SSH, DNSSEC)
   • Converged and Multilayer Protocols
     • VoIP and SIP security
     • iSCSI, FCoE, and storage networks
     • Software-defined networking
2. 2

   Secure Network Components

   3 topics

   • Network Devices and Their Roles
     • Switches, routers, and VLAN segmentation
     • Firewalls: packet filtering, stateful, next-generation
     • Proxies, gateways, and load balancers
   • Network Security Services
     • IDS and IPS placement and tuning
     • Network access control (NAC)
     • Content distribution networks
   • Transmission Media and Endpoints
     • Copper, fiber, and wireless characteristics
     • Endpoint security integration
     • Cabling, signaling, and emanation security
3. 3

   Secure Communication Channels

   3 topics

   • Virtual Private Networks
     • IPsec: AH, ESP, transport vs tunnel mode
     • TLS and SSL VPNs
     • Split tunneling considerations
   • Wireless and Mobile Communications
     • Wi-Fi security (WPA2, WPA3, 802.1X)
     • Bluetooth, NFC, and Zigbee threats
     • Cellular and 5G security
   • Remote Access and Collaboration
     • Remote access methods and authentication
     • Securing email, voice, and conferencing
     • Virtualized and third-party connectivity
4. 4

   Network Attacks and Defenses

   3 topics

   • Common Network Attacks
     • DoS and DDoS techniques
     • Man-in-the-middle and session hijacking
     • ARP poisoning, DNS spoofing, and amplification
   • Microsegmentation and Zero Trust Networking
     • East-west traffic control
     • Software-defined perimeters
     • SASE and secure web gateways
   • Network Monitoring and Resilience
     • Traffic analysis and flow data
     • Redundancy and high availability

Communication and Network Security flashcards for Certified Information Systems Security Professional (CISSP)

25 of 51 cards from the Communication and Network Security deck — real questions with worked answers.

1. How many layers does the OSI model have, and what are they in order from Layer 1 to Layer 7?

   7 layers: (1) Physical, (2) Data Link, (3) Network, (4) Transport, (5) Session, (6) Presentation, (7) Application. Mnemonic: Please Do Not Throw Sausage Pizza Away.

2. At which OSI layer do routers, IP addressing, and packet routing operate?

   Layer 3, the Network layer. It handles logical addressing (IP) and path determination/routing between networks.

3. Which OSI layer do switches, MAC addressing, and frames operate at, and what are its two sublayers?

   Layer 2, the Data Link layer. Its two sublayers are LLC (Logical Link Control) and MAC (Media Access Control).

4. How do the four layers of the TCP/IP model map to the seven OSI layers?

   Application (OSI 5-7), Transport/Host-to-Host (OSI 4), Internet (OSI 3), Link/Network Access (OSI 1-2).

5. What is the key difference between TCP and UDP?

   TCP is connection-oriented, reliable, ordered, and uses a 3-way handshake with flow/error control. UDP is connectionless, best-effort, faster, with no guaranteed delivery or ordering.

6. What are the three steps of the TCP three-way handshake?

   SYN (client to server), SYN-ACK (server to client), ACK (client to server). This establishes a connection before data transfer.

7. What are the five IPv4 address classes and the default network ranges for A, B, and C?

   Class A: 1-126; Class B: 128-191; Class C: 192-223; Class D: 224-239 (multicast); Class E: 240-255 (experimental). 127 is reserved for loopback.

8. List the RFC 1918 private IPv4 address ranges.

   10.0.0.0/8 (10.0.0.0-10.255.255.255), 172.16.0.0/12 (172.16.0.0-172.31.255.255), and 192.168.0.0/16 (192.168.0.0-192.168.255.255).

9. How many bits and how many bytes is an IPv4 address versus an IPv6 address?

   IPv4 is 32 bits (4 bytes); IPv6 is 128 bits (16 bytes), written as eight groups of hexadecimal.

10. In CIDR, how many usable host addresses does a /24 network provide?

    A /24 has 8 host bits = 2^8 = 256 total addresses, minus 2 (network and broadcast) = 254 usable host addresses.

11. What is the formula for the number of usable hosts in an IPv4 subnet given n host bits?

    Usable hosts = 2^n - 2, where n is the number of host bits. Subtract 2 for the network address and the broadcast address.

12. What is the APIPA address range and when is it used?

    169.254.0.0/16 (169.254.0.0-169.254.255.255). Automatic Private IP Addressing self-assigns an address when a DHCP server is unreachable.

13. What ports do HTTP and HTTPS use, and what protocol secures HTTPS?

    HTTP uses TCP port 80; HTTPS uses TCP port 443, secured by TLS (Transport Layer Security).

14. What ports and transport do DNS queries use?

    DNS uses UDP port 53 for standard queries/responses and TCP port 53 for zone transfers and responses larger than 512 bytes.

15. What ports do FTP, SSH, Telnet, and SMTP use?

    FTP: TCP 20 (data)/21 (control); SSH: TCP 22; Telnet: TCP 23; SMTP: TCP 25.

16. What ports do SNMP and its trap function use?

    SNMP uses UDP port 161 for queries and UDP port 162 for traps. SNMPv3 adds authentication and encryption.

17. What is the difference between TLS and the older SSL?

    SSL (Secure Sockets Layer) is the deprecated predecessor (SSLv2/v3 are insecure). TLS (Transport Layer Security) is its successor; TLS 1.2 and 1.3 are current, with TLS 1.3 removing weak ciphers and reducing handshake round trips.

18. What is a converged protocol, and give two examples relevant to CISSP.

    A converged protocol merges specialized/proprietary protocols with standard protocols (often over IP). Examples: FCoE (Fibre Channel over Ethernet), iSCSI (SCSI over IP), VoIP, and MPLS.

19. What is MPLS and at what conceptual layer does it operate?

    Multiprotocol Label Switching forwards data using short path labels instead of long network addresses. It operates between Layer 2 and Layer 3 (often called Layer 2.5) and is protocol-agnostic.

20. Compare iSCSI and FCoE as storage networking protocols.

    iSCSI encapsulates SCSI commands in TCP/IP, routable over standard Ethernet/IP networks (lower cost). FCoE encapsulates Fibre Channel frames directly in Ethernet, is not routable (Layer 2 only), and needs lossless Ethernet.

21. What is the difference between a hub, a switch, and a router?

    A hub (L1) repeats signals to all ports (one collision/broadcast domain). A switch (L2) forwards frames by MAC to specific ports (separate collision domains). A router (L3) forwards packets by IP between networks (separate broadcast domains).

22. What is the difference between a Layer 3 switch and a router?

    Both route by IP. A Layer 3 switch routes within a LAN/VLANs at high speed using ASIC hardware; a router connects different networks/WANs and supports more interface types, WAN protocols, and advanced features.

23. What does a proxy server do and what are forward vs reverse proxies?

    A proxy intermediates requests. A forward proxy sits in front of internal clients (filtering, anonymity, caching outbound). A reverse proxy sits in front of servers (load balancing, SSL offload, hiding backend).

24. What is the difference between a stateless (packet filter) firewall and a stateful firewall?

    A stateless firewall inspects each packet independently against rules (ports/IPs). A stateful firewall tracks the state of active connections and allows return traffic for established sessions.

25. What does a next-generation firewall (NGFW) add beyond a stateful firewall?

    An NGFW adds deep packet inspection, application-layer awareness, integrated IPS, user identity awareness, and often TLS inspection and threat intelligence feeds.

See more Communication and Network Security flashcards →

Planning Communication and Network Security for Certified Information Systems Security Professional (CISSP)

Communication and Network Security (Certified Information Systems Security Professional (CISSP)) FAQ