Home › Certifications › CISSP › Communication and Network Security
49 multiple-choice questions and 38 flashcards on Communication and Network Security, about 13% of the CISSP bank. Every one carries a written rationale.
Communication and Network Security is one of 8 chapters in CoStudy's CISSP bank, and it holds 49 of the bank's 375 multiple-choice questions — roughly 13% of the total. That proportion is not arbitrary: chapters follow the certifying body's published exam outline, and the number of questions in each is set by that domain's published weight, so the share of your practice time this chapter takes matches the share of the real exam it accounts for.
Studying by chapter is worth doing once you have a diagnostic score. A single overall percentage tells you whether you are close; it does not tell you which domain is dragging. Working a weak chapter in isolation, and re-testing it in isolation, is the fastest way to move a score that has stalled — and it is why the mock exams in CoStudy report by domain rather than as one number.
10 questions drawn from this chapter, with the full rationale shown — the controlling principle behind the right answer, and why each wrong option tempts and fails.
A data centre already separates tiers with VLANs and a perimeter firewall, yet an intrusion spread freely between application servers in one tier. Which approach BEST prevents recurrence?
Answer: D — Apply micro-segmentation with per-workload policy at the virtual interface
D) Correct — micro-segmentation enforces policy at the individual workload, so east-west traffic between peers in the same tier is controlled rather than implicitly trusted. A) adds capacity at the perimeter, which the traffic never crossed. B) is expensive and still leaves peers within a tier able to talk freely. C) is the closest wrong answer: more VLANs subdivide broadcast domains but still permit unrestricted communication inside each one.
After enabling IPv6, a security team finds hosts generating new global addresses periodically, which breaks their address-based log correlation. What is the MOST likely cause?
Answer: D — SLAAC privacy extensions generating rotating temporary addresses
D) Correct — privacy extensions create temporary interface identifiers that change on a schedule, which is exactly the observed behaviour. A) would produce multiple simultaneous prefixes rather than periodic rotation of identifiers. B) affects lease timing, not the generation of new addresses by the host itself. C) is a misconception; the absence of NAT does not compel rotation, and privacy extensions are a distinct mechanism.
A classified programme requires that an observer of an encrypted link cannot infer operational tempo from the pattern of communications. Which measure addresses this requirement?
Answer: C — Generating constant-rate traffic padding so the link presents a uniform load
C) Correct — traffic flow confidentiality requires that observable volume and timing be decoupled from real activity, which constant-rate padding achieves. A) strengthens confidentiality of content but leaves the metadata pattern intact. B) limits the material exposed by a key compromise and does not change observable volume. D) makes the problem worse, since compressed volume varies with content and can leak information.
Staff at a conference connect to an access point broadcasting the corporate SSID, and credentials are later abused. Which control would have been MOST effective in preventing this?
Answer: A — Mutual certificate authentication so clients validate the network first
A) Correct — an evil twin succeeds because the client trusts the network without verifying it; server certificate validation under EAP-TLS or PEAP with proper trust anchors stops credentials being offered to an impostor. B) does not help, as the rogue AP does not need the real key. C) is a persistent misconception, since hidden SSIDs are trivially discovered and clients probe for them. D) may detect rogues on premises but the incident occurred at a conference venue.
A media company places its site behind a content distribution network. Which statement about the resulting security posture is MOST accurate?
Answer: A — Origin servers must still be protected, since direct-to-origin requests bypass CDN controls
A) Correct — a CDN only protects what passes through it, so an exposed origin address lets an attacker route around edge filtering, which is why origin cloaking and allow-listing matter. B) is wrong; the edge-to-origin leg still needs protection. C) is a misconception, since dynamic requests are forwarded to the application uncached. D) overstates the benefit; CDNs absorb much volumetric traffic but do not eliminate the risk.
TLS 1.3 differs from TLS 1.2 in that TLS 1.3:
Answer: B — Mandates forward secrecy, removes legacy weak ciphers and completes the handshake in one round trip
B) Correct: TLS 1.3 permits only ephemeral key agreement, so forward secrecy is not optional; it removes static RSA key transport, renegotiation and the weak ciphers and hashes carried by earlier versions; and it reduces the full handshake to a single round trip. A) A direction reversal — RC4 and its peers were removed, not restored. C) Certificates remain the basis of server authentication. D) Negotiation still occurs, but the menu is restricted to a small set of strong suites.
At which OSI layer does IPsec operate?
Answer: B — Layer 3 (Network)
B) Correct: IPsec secures IP packets at Layer 3. A) Off-by-one — L2 includes PPTP, L2TP. C) Off-by-one — TLS is L4-ish (sits above transport). D) Application-layer protocols are above transport.
In a virtualised data centre, which traffic pattern is MOST likely to evade a security team's existing controls?
Answer: D — East-west traffic between virtual machines on the same host
D) Correct — traffic switched inside the virtual switch never reaches a physical inspection point, which is the visibility gap that drives virtual firewalls and micro-segmentation. A) traverses inter-site links where inspection or at least flow records are typically available. B) crosses the perimeter and is the best-inspected path in most designs. C) should be on a dedicated management network and is normally tightly controlled.
Which BEST describes the security benefit of mutual TLS (mTLS)?
Answer: A — Client and server each authenticate with certificates, mitigating impersonation in either direction
A) Correct: in mutual TLS both peers present and validate certificates, so a rogue client cannot reach the service and a spoofed service cannot collect client traffic — which is why it underpins service-to-service authentication in zero trust architectures. B) That describes ordinary one-way TLS, a direction reversal of the mutual case. C) Biometrics authenticate a person and play no part in the TLS handshake. D) mTLS authenticates the endpoint or workload; user authentication and authorization are still required above it.
Which capability distinguishes an application proxy firewall from a stateful inspection firewall?
Answer: B — It terminates the client connection and opens a separate one to the server
B) Correct — the proxy breaks the connection into two and understands the application protocol, which is what stateful inspection does not do. A) describes stateful inspection itself, the device being contrasted. C) describes a static packet filter, an older and simpler design. D) is a deployment mode available to several firewall types and does not distinguish the architectures.
4 cards from the 38 in this chapter.
What is a DoS vs. DDoS attack?
DoS: single source overwhelms target. DDoS: distributed (botnet). Mitigations: anti-spoofing, scrubbing services, rate limiting, anycast.
What is the difference between site-to-site and remote access VPN?
Site-to-site: gateway-to-gateway (e.g., HQ to branch). Remote access: client-to-gateway (e.g., teleworker to corporate). Different config models.
What is a stateful firewall?
Tracks connection state (TCP flags, related flows). Allows return traffic for established connections automatically. Standard for modern firewalls.
What is an edge network, and what security problem does moving compute to the edge create?
An edge network places compute, storage and inspection close to where data is produced or consumed — branch sites, cell sites, factory floors, content delivery points — to cut latency and backhaul. The security problem is that trusted processing now sits in physically uncontrolled locations with intermittent connectivity, so device theft, tamper and offline operation become real. Controls shift to hardware root of trust, secure boot, signed remote updates, encrypted storage, mutual authentication back to the core, and local policy that fails safe when the link drops.
These are a sample. The full Communication and Network Security chapter runs 87 items with per-chapter progress tracking, on the web and in the iOS app.