CISSP Domain 4 Cheat Sheet: Communication and Network Security
CISSP Domain 4 cheat sheet: OSI model, secure protocols and ports, IPsec, WPA3 and 802.1X, firewall types, segmentation and common network attacks.
Updated Oct 17, 20264 min readBy Connect4IT
Domain 4, Communication and Network Security, tests whether you can design and protect networks: the OSI model, secure protocols, wireless security, network devices and common attacks. This CISSP Domain 4 cheat sheet puts the essentials into quick-review tables, ideal for the last weeks before your exam.
In the current ISC2 outline, Domain 4 carries about 13% of the exam. Check the official ISC2 outline before your exam for the latest weights.
Negotiates security associations and exchanges keys
Transport mode
Protects only the payload; host to host
Tunnel mode
Protects the whole original packet; gateway to gateway (site-to-site VPN)
5. Wireless security
WEP: broken; never use it.
WPA2: AES-CCMP. Personal mode uses a pre-shared key; Enterprise mode uses 802.1X with a RADIUS server.
WPA3: SAE replaces the pre-shared key handshake, giving protection against offline password guessing; Enterprise offers a 192-bit mode.
802.1X / EAP: EAP-TLS (certificates on both sides) is the strongest common option; PEAP and EAP-TTLS protect password-based logins inside a TLS tunnel.
Attacks: evil twin and rogue access points, deauthentication, war driving, and jamming.
6. Firewalls and network devices
Type
Inspects
Notes
Packet filter
IP, port, protocol (layer 3–4)
Fast, but no session awareness
Stateful
Connection state table
Tracks sessions; allows return traffic
Application / proxy
Full application data (layer 7)
Deep inspection, slower
NGFW
Applications, users, IPS, threat intelligence
Combines several functions
WAF
HTTP traffic
Protects web apps from SQL injection, XSS and similar attacks
IDS detects and alerts; IPS sits inline and blocks.
NAC checks device health and identity before granting network access.
Bastion host: a hardened system exposed to an untrusted network, usually in a DMZ.
7. Network segmentation and architecture
DMZ: a buffer zone for public-facing servers between the internet and the internal network.
VLANs: logical segmentation at layer 2; protect against VLAN hopping by disabling auto-trunking (DTP) and changing the native VLAN.
Micro-segmentation and SDN: fine-grained, software-defined policies, a key part of Zero Trust.
VPNs: site-to-site (IPsec) and remote access (IPsec or TLS VPN).
Converged protocols: iSCSI and FCoE (storage over IP/Ethernet), VoIP and SIP.
8. Common network attacks
Attack
How it works
Defence
SYN flood
Many half-open TCP connections exhaust the server
SYN cookies, rate limiting
Smurf
ICMP echo to a broadcast address with a spoofed source
Overflows the switch CAM table so it floods traffic
Port security
DDoS
Many sources overwhelm a target
Scrubbing services, CDN, upstream filtering
9. Exam tips for Domain 4
Map every protocol and device to its OSI layer; many questions depend on it.
If a question asks for encryption in IPsec, the answer is ESP, not AH.
Prefer answers that segment the network and apply least privilege between segments.
Frequently Asked Questions
Do I need CCNA-level networking for the CISSP?
No, but solid fundamentals help a lot: the OSI model, TCP/IP, common ports, VLANs and how firewalls and VPNs work. The CCNA 200-301 Quick Review PDF is a good refresher.
Which wireless security standard should I recommend on the exam?
WPA3, or WPA2-Enterprise with EAP-TLS where WPA3 isn’t available. WEP and WPA (TKIP) are always the wrong choice.
