(ISC)² CISSP Communication and Network Security Practice Questions

Free CISSP Communication and Network Security practice test questions

8 questions from this domain with answers and explanations - different from the samples on the main (ISC)² CISSP page. Sign up free to practice the full set.

1. Question 1Communication and Network Security

   At which OSI layer does IP addressing and routing occur?

   • ALayer 7 (Application)
   • BLayer 4 (Transport)
   • CLayer 3 (Network)Correct
   • DLayer 2 (Data Link)
   ✓ Correct answer: C

   IP addressing and routing occur at Layer 3, the Network layer, which handles logical addressing and determines the best path for packets between different networks. Layer 2 only handles addressing and delivery within a single local segment using MAC addresses, Layer 4 manages end-to-end transport such as segmentation and reliability, and Layer 7 concerns application-level data exchange.

   Why the other options are wrong

   • ALayer 7 handles application data exchange between programs, not logical addressing or path selection.
   • BLayer 4 manages end-to-end transport, segmentation and reliability, which sits above routing, not IP addressing itself.
   • DLayer 2 addresses and delivers frames only within one local segment using MAC addresses, not routing.
2. Question 2Communication and Network Security

   A zero trust network architecture is being designed. Which principle most distinguishes it from a traditional perimeter model?

   • AGranting broad internal network reachability the moment a user connects over the corporate VPN tunnel
   • BNo implicit trust from network location; every request is authenticated, authorized, and verifiedCorrect
   • CUsing static allow-lists of trusted internal IP address ranges as the sole network access control
   • DMaintaining a hardened network perimeter that implicitly trusts every internal host located inside it
   ✓ Correct answer: B

   Zero trust removes the assumption that network location implies trustworthiness: every request, inside or outside the network, must be authenticated, authorized, and continuously verified against policy before access is granted. A traditional perimeter model instead grants broad reachability once a user is inside, for example after a VPN connection, or trusts static internal IP ranges, exactly the implicit trust zero trust eliminates.

   Why the other options are wrong

   • ABroad reachability after VPN connection is the implicit trust zero trust eliminates.
   • CIP allow-lists trust network location, which zero trust explicitly rejects.
   • DImplicitly trusting internal hosts is the traditional perimeter model zero trust replaces.
3. Question 3Communication and Network Security

   A flat corporate network let a compromised reception kiosk reach and infect production database servers. Which design change BEST limits such lateral movement going forward?

   • APlacing all hosts on one large flat subnet with a single broadcast domain for easier management
   • BRelying on endpoint antivirus alone on each host to stop the internal spread
   • CAssigning static IP addresses to every internal device to track them more easily
   • DNetwork segmentation with VLANs/subnets and inter-zone ACLs (and microsegmentation for critical assets)Correct
   ✓ Correct answer: D

   Flat networks let any compromised host reach any other host, which is exactly what allowed the kiosk to pivot to production databases. Segmenting into VLANs/subnets with inter-zone ACLs, plus microsegmentation around critical assets, confines a compromise to its zone and enforces least-privilege network paths between tiers, directly limiting lateral movement rather than just detecting or slowing it afterward.

   Why the other options are wrong

   • AA single flat subnet is exactly the design that allowed the lateral movement, so it worsens rather than limits the problem.
   • BEndpoint antivirus can miss or be disabled by malware and does not restrict which zones a compromised host can reach.
   • CStatic addressing aids inventory tracking but places no barrier between the kiosk and the production database servers.
4. Question 4Communication and Network SecuritySelect all that apply

   An organization is hardening its border routers against routing-protocol attacks and spoofing. Which TWO controls most directly reduce the risk of malicious route injection and IP source spoofing at the network edge? (Choose TWO)

   • AConfigure neighbor authentication (such as MD5/keychain) on BGP/OSPF peering sessionsCorrect
   • BImplement ingress filtering per BCP 38 to drop packets with spoofed source addressesCorrect
   • CDisable QoS marking on all edge interfaces
   • DIncrease the MTU on the WAN links to reduce fragmentation
   ✓ Correct answer: A, B

   Authenticating routing adjacencies (for example, BGP or OSPF MD5/keychain) ensures only trusted peers can exchange routes, blocking forged route advertisements. BCP 38 ingress filtering drops inbound packets whose source addresses could not legitimately arrive on that interface, mitigating spoofing and reducing participation in reflection attacks. Together they protect both the control plane and the data plane at the border.

   Why the other options are wrong

   • CDisabling QoS marking affects traffic prioritization, not route authenticity or spoofing protection, and could degrade real-time services.
   • DAdjusting MTU influences fragmentation and throughput but has no bearing on route injection or source spoofing defenses.
5. Question 5Communication and Network SecuritySelect all that apply

   A team is securing a fleet of IoT sensors that communicate over the corporate wireless network. Which TWO network-layer controls most directly reduce the risk these constrained devices pose to the rest of the enterprise? (Choose TWO)

   • AIsolate the IoT devices on a dedicated segment/VLAN with egress filtering to only required destinationsCorrect
   • BPlace the IoT devices on the same VLAN as user workstations for unified monitoring
   • CApply default-deny access control between the IoT segment and sensitive internal zonesCorrect
   • DDisable all logging and monitoring on the IoT segment to reduce constrained-device overhead
   ✓ Correct answer: A, C

   Constrained IoT devices often cannot run endpoint controls, so network containment is essential. Putting them on a dedicated VLAN with egress filtering ensures they can reach only the destinations they need, and a default-deny policy between that segment and sensitive internal zones prevents a compromised sensor from pivoting into critical systems. Together these enforce least privilege at the network layer.

   Why the other options are wrong

   • BPlacing IoT devices on the same VLAN as workstations removes isolation and increases lateral-movement risk.
   • DDisabling logging eliminates the visibility needed to detect and investigate IoT-originated attacks.
6. Question 6Communication and Network Security

   A retailer uses a content distribution network (CDN) to serve images and static assets globally. The security manager must explain the primary security and resilience benefit the CDN provides for the public web tier. Which statement best captures that benefit?

   • AIt absorbs and disperses volumetric traffic across distributed edge nodes, improving DDoS resilience and offloading the originCorrect
   • BIt transparently encrypts the origin database at rest for the web tier without requiring any changes to the application code
   • CIt removes the need to deploy or manage any TLS certificates on the origin web servers behind the edge network
   • DIt performs static source-code analysis on the retailer's web application code before each release is published
   ✓ Correct answer: A

   By caching content on many globally distributed edge nodes, a CDN spreads out request volume, including volumetric DDoS, so the origin is shielded and remains available. Many CDNs also bundle WAF and rate-limiting, but the core resilience benefit is distributed absorption and origin offload.

   Why the other options are wrong

   • BA CDN caches and delivers content at the edge; it does not encrypt the origin database.
   • CCDNs still require secure origin connections, so origin TLS certificates remain necessary.
   • DSource-code analysis is a development testing activity unrelated to content delivery.
7. Question 7Communication and Network Security

   During incident triage, an analyst finds an attacker injecting forged responses that redirect users to a malicious host by corrupting the mapping of hostnames to IP addresses. The team must map this attack to the correct OSI layer so the right control owner is assigned. At which OSI layer does the affected name-resolution service operate?

   • ALayer 3 (Network), because it manipulates IP routing tables
   • BLayer 4 (Transport), because it hijacks TCP sessions
   • CLayer 7 (Application), because DNS is an application-layer serviceCorrect
   • DLayer 2 (Data Link), because it rewrites MAC address bindings
   ✓ Correct answer: C

   DNS runs at OSI Layer 7 as an application-layer protocol, even though it rides over UDP/TCP transport. Cache poisoning and forged-response attacks corrupt application-layer name data, so the preventive control (DNSSEC, resolver hardening) belongs to the application/DNS owner rather than the routing or switching teams.

   Why the other options are wrong

   • AIP routing manipulation is a Layer 3 concern; DNS poisoning does not alter routing tables.
   • BTCP session hijacking is a Layer 4 attack; DNS resolution itself is not a transport function.
   • DMAC binding manipulation (ARP spoofing) is Layer 2; DNS operates far above the data link layer.
8. Question 8Communication and Network Security

   In a cloud VPC, an engineer must ensure a specific subnet blocks a known-malicious IP range for ALL instances in that subnet, statelessly, even before instance-level rules are evaluated. Which construct is the BEST fit?

   • AA security group attached to each instance
   • BA network ACL (NACL) applied at the subnet boundaryCorrect
   • CA host-based firewall on every instance
   • DA route table entry pointing the range to a NAT gateway
   ✓ Correct answer: B

   NACLs operate at the subnet boundary, apply to every instance in the subnet, support explicit deny rules, and are stateless (return traffic must be allowed separately). Security groups are stateful and instance-scoped and cannot express deny rules, so a subnet-wide stateless block belongs at the NACL.

   Why the other options are wrong

   • ASecurity groups are stateful, instance-scoped, and allow-only (no deny rules), so they cannot enforce a stateless subnet-wide block of a malicious range.
   • CHost-based firewalls must be configured on each instance individually and are not evaluated at the subnet boundary, missing the centralized requirement.
   • DA route table change alters where traffic is forwarded but does not deny it, and routing the range through NAT does not block it.

How Communication and Network Security is tested

This domain holds 138 of the 1,117 questions in the CISSP bank, about 12%. The mix is 116 single-answer multiple choice and 22 multiple-response, so it is worth practising the formats as well as the content.

Once you have a few attempts recorded, CertGrid scores every domain separately and points you at the weakest one, so you can drill Communication and Network Security on its own rather than re-running full-length mocks.

Other CISSP exam domains

• Security and Risk Management172 questions
• Asset Security109 questions
• Security Architecture and Engineering141 questions
• Identity and Access Management138 questions
• Security Assessment and Testing130 questions
• Security Operations157 questions
• Software Development Security132 questions
• All CISSP practice questions1,117 total
• Communication and Network Security study notesKey concepts
• Security practice examsAll Security

CISSP Communication and Network Security FAQ