CISSP
Domain 4 · 13%
Communication and Network Security
The domain with the most direct overlap with the CCIE track, but at a very different altitude: the exam wants "what protects this layer and why," not router configuration syntax.
OSI and TCP/IP models
Know the OSI seven layers cold (Physical, Data Link, Network, Transport, Session, Presentation, Application) and map them to the TCP/IP four-layer model (Link, Internet, Transport, Application). Exam questions like to ask "at what layer does X operate" — e.g. a switch and MAC addressing at Layer 2, a router and IP at Layer 3, TLS spanning Session/Presentation in OSI terms but sitting on top of TCP in practice.
Secure network components
- Firewall generations — packet filtering (stateless, ACL-based) → stateful inspection (tracks connection state) → application-layer/proxy (inspects payload) → next-gen (adds IPS, app awareness, identity).
- IDS vs. IPS — IDS is out-of-band/detective (alerts only); IPS is inline/preventive (can block). Both can be signature-based (known patterns, low false positives, blind to novel attacks) or anomaly/behavior-based (catches novel attacks, higher false positive rate).
- Proxies — forward proxy (represents internal clients to the outside, e.g. web filtering), reverse proxy (represents internal servers to the outside, e.g. load balancing, WAF).
- NAC (Network Access Control) — enforces device posture/compliance before granting network access.
Secure protocols
- IPsec — network layer, two modes: Transport (encrypts payload only, host-to-host) and Tunnel (encrypts entire packet, gateway-to-gateway/VPN). Two protocols: AH (Authentication Header — integrity/auth, no confidentiality) and ESP (Encapsulating Security Payload — adds confidentiality). Key exchange via IKE.
- TLS — transport-layer encryption for application protocols (HTTPS, etc.); TLS 1.3 removed legacy weak ciphers and reduced handshake round trips. Know it superseded SSL, which is now considered broken.
- SSH — encrypted remote administration, replaces Telnet/rsh/rlogin.
- Legacy protocols to flag as insecure on sight — Telnet, FTP, HTTP, SNMPv1/v2c (community strings in cleartext), WEP.
Network segmentation and architecture
VLANs segment broadcast domains logically without new physical wiring. A DMZ isolates internet-facing services from the internal network, typically behind two firewall tiers (or one firewall with three interfaces). Micro-segmentation and SDN extend this to per-workload policy enforcement, decoupling the control plane from the data plane — the same conceptual territory as SD-Access/SD-WAN on the CCIE side, described here in vendor-neutral terms.
Wireless security
Know the progression and why each step mattered: WEP (broken, static RC4 key, never use) → WPA (TKIP, stopgap) → WPA2 (AES-CCMP, the long-standing baseline) → WPA3 (SAE replaces PSK's offline dictionary-attack weakness, adds forward secrecy). 802.1X provides port-based authentication (often paired with RADIUS/EAP) for both wired and wireless access.
Remote access and converged communications
VPN types: site-to-site (gateway-to-gateway, usually IPsec) vs. remote access (client-to-gateway, IPsec or TLS/SSL VPN). Voice/multimedia convergence introduces its own protocols (SIP, RTP) and its own attack surface (toll fraud, eavesdropping on unencrypted RTP) — treat VoIP as just another application on the network that needs the same segmentation and encryption discipline as anything else.