Certified Information Systems Security Professional (CISSP) Communication and Network Security Syllabus

What is the difference between a hub, a switch, and a router?

A hub (L1) repeats signals to all ports (one collision/broadcast domain). A switch (L2) forwards frames by MAC to specific ports (separate collision domains). A router (L3) forwards packets by IP between networks (separate broadcast domains).

What is the difference between a Layer 3 switch and a router?

Both route by IP. A Layer 3 switch routes within a LAN/VLANs at high speed using ASIC hardware; a router connects different networks/WANs and supports more interface types, WAN protocols, and advanced features.

What does a proxy server do and what are forward vs reverse proxies?

A proxy intermediates requests. A forward proxy sits in front of internal clients (filtering, anonymity, caching outbound). A reverse proxy sits in front of servers (load balancing, SSL offload, hiding backend).

What is the difference between a stateless (packet filter) firewall and a stateful firewall?

A stateless firewall inspects each packet independently against rules (ports/IPs). A stateful firewall tracks the state of active connections and allows return traffic for established sessions.

What does a next-generation firewall (NGFW) add beyond a stateful firewall?

An NGFW adds deep packet inspection, application-layer awareness, integrated IPS, user identity awareness, and often TLS inspection and threat intelligence feeds.

What is the difference between an IDS and an IPS?

An IDS (Intrusion Detection System) passively monitors and alerts on suspicious traffic (out-of-band). An IPS (Intrusion Prevention System) sits inline and can actively block/drop malicious traffic in real time.

Compare signature-based and anomaly/behavior-based detection.

Signature-based detection matches known attack patterns (low false positives, misses zero-days). Anomaly/behavior-based detection flags deviations from a baseline (detects novel attacks, but higher false-positive rate).

What is NAT and how does PAT differ from it?

NAT (Network Address Translation) maps private IPs to public IPs. PAT (Port Address Translation / NAT overload) maps many private IPs to a single public IP using unique port numbers to track sessions.

What is the difference between baseband and broadband transmission?

Baseband uses the entire medium for a single channel/signal (e.g., Ethernet). Broadband divides the medium into multiple channels carrying multiple signals simultaneously (e.g., cable TV).

Compare UTP, coaxial, and fiber-optic cabling on speed, distance, and EMI immunity.

UTP (copper twisted pair): cheap, ~100m, susceptible to EMI. Coax: more EMI resistant, longer runs. Fiber: highest speed/bandwidth, longest distance, immune to EMI, hardest to tap—best for security.

What is the difference between single-mode and multimode fiber?

Single-mode fiber has a thin core, uses laser light, and supports very long distances/high bandwidth. Multimode has a larger core, uses LED light, costs less, but has shorter range due to modal dispersion.

What are the Ethernet UTP category speeds for Cat5e, Cat6, and Cat6a?

Cat5e: 1 Gbps up to 100m. Cat6: 1 Gbps (10 Gbps up to ~55m). Cat6a: 10 Gbps up to 100m.

What is the main security advantage of a VPN?

A VPN creates an encrypted tunnel over an untrusted network (like the Internet), providing confidentiality, integrity, and authentication for data in transit between endpoints.

What are the two IPsec protocols and what does each provide?

AH (Authentication Header) provides integrity and authentication but no encryption. ESP (Encapsulating Security Payload) provides confidentiality (encryption) plus integrity and authentication.

What is the difference between IPsec transport mode and tunnel mode?

Transport mode encrypts only the payload, leaving the original IP header intact (host-to-host). Tunnel mode encrypts the entire original packet and adds a new IP header (gateway-to-gateway/site-to-site).

What is the role of IKE in IPsec?

Internet Key Exchange negotiates the security association (SA), authenticates peers, and establishes shared keys. It operates in two phases (IKE Phase 1 builds a secure channel; Phase 2 negotiates the IPsec SA).

Compare IPsec VPNs with SSL/TLS VPNs.

IPsec VPNs operate at Layer 3, often need a client, and give full network access (site-to-site or remote). SSL/TLS VPNs operate at the session/application layer, are typically clientless (browser-based), and give granular application access.

What is the difference between WEP, WPA2, and WPA3 wireless security?

WEP uses weak RC4/short IV (broken). WPA2 uses AES-CCMP with 802.11i (strong but vulnerable to KRACK). WPA3 adds SAE (Simultaneous Authentication of Equals) replacing PSK handshake, forward secrecy, and protection against offline dictionary attacks.

What is the difference between WPA2-Personal (PSK) and WPA2-Enterprise?

WPA2-Personal uses a shared pre-shared key (PSK) for all users. WPA2-Enterprise uses 802.1X/EAP with a RADIUS server for per-user authentication and unique session keys.

What is 802.1X and what are its three components?

802.1X is a port-based network access control standard. Components: Supplicant (client), Authenticator (switch/AP), and Authentication Server (RADIUS). It uses EAP for the authentication exchange.

What are the three AAA protocols' key differences (RADIUS vs TACACS+ vs Diameter)?

RADIUS uses UDP, encrypts only the password, combines authN+authZ. TACACS+ uses TCP, encrypts the entire payload, and separates authentication, authorization, and accounting. Diameter is the successor to RADIUS with reliability and better security.

What are common secure remote access methods for administrators?

SSH (encrypted CLI, replaces Telnet), RDP over TLS/VPN, jump/bastion hosts, and VPN tunnels. Avoid clear-text protocols like Telnet, rlogin, and unencrypted RDP.

What is a man-in-the-middle (MITM) attack and one common technique enabling it on a LAN?

An attacker secretly relays/alters communication between two parties who believe they talk directly. ARP poisoning/spoofing on a LAN lets the attacker associate their MAC with the victim's IP to intercept traffic.

What is a SYN flood attack and what category does it fall under?

A SYN flood is a denial-of-service attack that sends many SYN packets without completing the handshake (no final ACK), exhausting the server's half-open connection table. Mitigated with SYN cookies.

What is the difference between DoS and DDoS attacks?

DoS comes from a single source overwhelming a target. DDoS uses many distributed, often botnet-controlled, sources simultaneously, making it harder to block and capable of far larger volume.

What is DNS cache poisoning (spoofing)?

An attacker injects forged DNS records into a resolver's cache so that legitimate domain names resolve to attacker-controlled IPs, redirecting users. Mitigated by DNSSEC, which authenticates DNS responses.

What is a smurf attack?

An ICMP-based amplification DoS where the attacker sends ICMP echo requests with a spoofed source (victim's IP) to a broadcast address, causing all hosts to flood the victim with replies.

What is Zero Trust networking and its core principle?

Zero Trust assumes no implicit trust based on network location. Core principle: 'never trust, always verify'—every access request is authenticated, authorized, and continuously validated regardless of whether it originates inside or outside the perimeter.

What is microsegmentation and what security benefit does it provide?

Microsegmentation divides the network into small, isolated zones (down to individual workloads) with granular per-segment policies. It limits lateral movement, containing breaches and reducing the attack surface.

What are the three primary network monitoring data sources (telemetry types)?

Full packet capture (deepest detail, storage heavy), flow data like NetFlow/sFlow (metadata about conversations), and logs/SNMP (device and event data). SIEM aggregates and correlates these.

What network resilience techniques improve availability, and what does each address?

Redundancy (duplicate components), load balancing (distribute traffic), failover/HA clustering (automatic switchover), and protocols like STP (loop prevention) and HSRP/VRRP (gateway redundancy) to eliminate single points of failure.