The CISSP exam doesn't test if you can list protocols. It tests if you can choose the single right control to stop a multi-million dollar breach, and the most common failure is picking the obvious technical fix over the correct management process.
Per VoraPrep's CISSP analysis, this 2026 cheat sheet for CISSP Domain 4 (Communication and Network Security) focuses on the judgment required to pass. It covers core network models, secure protocols, and wireless security, emphasizing the management perspective over pure technical memorization to help you avoid common exam traps.
Key facts
- Official Body
- (ISC)²
- Exam Domain 4 Weight
- Approximately 14% of the exam.
- Passing Score
- 700 out of 1000 scaled points.
- Study Hours
- Most candidates report 120-180 hours of focused study.
- Exam Format
- Computerized Adaptive Testing (CAT) for English exams (125-175 questions, 4 hours).
- Pass Rate
- Industry analysis places the global CISSP pass rate around 50-55%, highlighting its difficulty.
What Are the Core Network Models and Security Controls?
Your entire understanding of Domain 4 rests on the foundational network models. The myth is that you only need to memorize the OSI layers. The reality is the exam expects you to be fluent in both the OSI and TCP/IP models and, more importantly, to know which security controls operate at each layer.
The OSI Model vs. The TCP/IP Model
The OSI model is a 7-layer conceptual framework, while the TCP/IP model is a 4-layer practical model that maps directly to the protocols that run the internet. You need to know both.
| OSI Model (7 Layers) | TCP/IP Model (4 Layers) | Key Protocols & Concepts |
|---|---|---|
| 7. Application | 4. Application | HTTP, FTP, SMTP, DNS, SNMPv3 |
| 6. Presentation | TLS, Data Formatting (ASCII, JPEG) | |
| 5. Session | NetBIOS, Session Management | |
| 4. Transport | 3. Transport | TCP, UDP |
| 3. Network | 2. Internet | IP, ICMP, IPsec, Routers |
| 2. Data Link | 1. Network Access | Ethernet, MAC Addresses, Switches |
| 1. Physical | Cables, Hubs (Legacy), Repeaters |
Key Security Controls by OSI Layer
The exam will give you a scenario and ask for the most appropriate control. Linking controls to their operational layer is a non-negotiable skill.
| Layer | Function | Associated Security Controls |
|---|---|---|
| 7. Application | User services, APIs | Web Application Firewall (WAF), Secure Coding, Input Validation |
| 6. Presentation | Data formatting, encryption | Application-level encryption, Data Loss Prevention (DLP) |
| 5. Session | Dialogue control, tunneling | Authentication, Authorization, Kerberos, PPTP |
| 4. Transport | End-to-end connections | Stateful Firewalls, Transport Layer Security (TLS), Port Filtering |
| 3. Network | Logical addressing, routing | Routers, IPsec (VPNs), Packet-filtering Firewalls, Network IDS/IPS |
| 2. Data Link | Physical addressing (MAC) | Switches, 802.1X (Port-based NAC), MAC Filtering, ARP Inspection |
| 1. Physical | Bit transmission | Shielded Cabling, Physical Access Controls, Fire Suppression |
- A. An Intrusion Prevention System (IPS)
- B. A Web Application Firewall (WAF)
- C. 802.1X Network Access Control (NAC)
- D. IPsec in tunnel mode
How Does the CISSP Test Wireless and Modern Network Security?
The CISSP exam has evolved beyond simple wired networks. You must be prepared for questions on securing modern, complex environments. If you haven't reviewed these topics, you are giving up points.
Studying for CISSP? Benchmark your score in 5 minutes.
Get an instant weak-spot assessment and a custom 12-week study plan PDF generated for your exam window.
Securing Wireless Networks
Memorizing "WPA2" is not enough. You need to understand the progression of wireless security and its components.
- WPA2 vs. WPA3: WPA3 is the current standard, offering stronger encryption (GCMP-256) and replacing the Pre-Shared Key (PSK) with Simultaneous Authentication of Equals (SAE) to protect against offline dictionary attacks.
- Enterprise Mode (802.1X): This is the gold standard for corporate environments. Instead of a shared password, each user authenticates against a central server (typically RADIUS) using their own credentials, often via Extensible Authentication Protocol (EAP).
- Common Attacks: Be able to identify and mitigate attacks like Evil Twins (rogue APs masquerading as legitimate ones), deauthentication attacks (forcing clients to disconnect), and jamming (creating RF interference). Try VoraPrep's free CISSP practice questions to see how these scenarios are tested.
Key Modern Concepts (SDN, NAC, NFV)
These topics appear on the exam because they change how we manage network security.
- Network Access Control (NAC): A policy-based solution that controls access to the network. It can check devices for compliance (e.g., up-to-date antivirus, OS patches) before granting access. It's a powerful administrative and technical control.
- Software-Defined Networking (SDN): Decouples the control plane (decision-making) from the data plane (forwarding traffic). This centralizes network management but also creates a single point of failure if the SDN controller is compromised.
- Network Function Virtualization (NFV): Virtualizes network services that traditionally ran on dedicated hardware, such as firewalls, routers, and load balancers. This provides flexibility but introduces risks associated with the underlying hypervisor.
Calculate Your CISSP Score & Study Hours by Domain
Adjust your practice scores across official CISSP blueprint domains to predict your pass probability and generate a domain-weighted study schedule.
What Are the Most Common Exam Traps in Domain 4?
The CISSP is a test of judgment. The right answer is often not the most technical one, but the one that best aligns with a security manager's priorities: risk mitigation, business continuity, and policy enforcement.
- Tempting Wrong Answer: "Deploy a new IPS signature to block known exploit patterns."
- Why it's tempting: It's a direct, hands-on technical action to stop the attack. It feels proactive.
- Correct CISSP Answer: "Implement a temporary firewall rule to block external access to the vulnerable service and notify senior management of the risk."
- Why it's right: This answer prioritizes immediate risk containment (blocking access) and follows the management process (notifying leadership). The IPS signature is a good subsequent step, but containment and communication come first.
- Tempting Wrong Answer: "Install a host-based intrusion detection system (HIDS) to monitor for unauthorized file access."
- Why it's tempting: A HIDS is a valid security tool that can detect malicious activity.
- Correct CISSP Answer: "Implement a technical policy using endpoint security software to block the use of all unauthorized removable media."
- Why it's right: The question asks for a preventative control. The HIDS is detective; it alerts you after the activity has started. Blocking the drives in the first place prevents the incident entirely. Pay close attention to keywords like "prevent," "detect," "deter," and "correct."
How to Turn This Cheat Sheet into a Weekly Drill
This guide is a tool, not a textbook. Use it to actively train your judgment. Here is a simple, effective weekly drill for Domain 4.
Step 1: Isolate a Concept
Pick one section from this cheat sheet for the week. For example, "Wireless Security" or "Key Security Controls by OSI Layer." Spend 30 minutes reviewing the concepts here and in your primary study material.
Step 2: Take a Targeted Quiz
Use an adaptive practice bank, like the one in the VoraPrep CISSP course, to take a 15-20 question quiz focused only on that topic. Don't worry about the score. The goal is to generate learning opportunities.
Step 3: Analyze Your Mistakes (The Right Way)
For every question you got wrong, do not just read the explanation. Write down the answer to this question: "What management principle did I ignore?"
- Did you pick a technical tool over a policy?
- Did you choose a detective control when a preventative one was asked for?
- Did you forget to prioritize life safety or risk containment?
This process forces you to move beyond technical memorization and start thinking like the examiner. VoraPrep's detailed rationales, which explain why each distractor is wrong, are built for this type of analysis.