Free CISSP Communication and Network Security Practice Questions (2026)

Domain 4, Communication and Network Security, accounts for 13% of your CISSP score. Most candidates who fail this section make the same mistake: they treat it like a vocabulary test of ports and protocols. The real exam, however, doesn't care if you know port 80. It tests whether you can decide how to secure it within a layered defense, and that's where the points are won or lost.

Key facts

Domain name

Communication and Network Security (Domain 4)

Exam weight

13% of the total score

Official body

(ISC)²

Key topics

OSI & TCP/IP models, secure protocols, network attacks, wireless security

Passing score

700 out of 1000 for the full CISSP exam

Relevant standards

NIST SP 800 series, IETF RFCs

According to the official (ISC)² CISSP Certification Exam Outline, Domain 4 accounts for 13% of the total exam weight (ISC²).

How were these practice questions designed?

I’ve written these 10 questions to simulate the specific thinking process required for the real CISSP exam. They are mapped directly to the 2026 (ISC)² CISSP Certification Exam Outline for Domain 4.

You'll find a mix of difficulties. Some questions test foundational knowledge, while others present a scenario that requires you to think like a security architect. The goal isn't to get a perfect score. The goal is to identify your blind spots before exam day.

For every question, I’ve included a detailed rationale. I explain why the best choice is correct and, just as importantly, why the other options are tempting but wrong. This is the core of the VoraPrep method: we teach you to see the exam through the eyes of the person who wrote the question. Try VoraPrep's free CISSP practice questions to see this in action.

Communication and Network Security Practice Questions

Take your time and read each question carefully. Choose the best possible answer, just as you would on exam day.

---

Question 1

A network architect is designing a secure communication channel between two offices over the public internet. The primary requirement is to encrypt the entire original IP packet, including the header, and encapsulate it within a new IP packet for transport. Which of the following solutions should the architect choose?

Answer and Explanation Correct Answer: C. IPsec in Tunnel Mode Explanation: This question tests your understanding of the fundamental difference between IPsec's two primary modes.

• IPsec in Tunnel Mode (Correct): This mode encrypts the entire original IP packet (both the header and the payload) and then wraps it in a new IP packet with a new header. This is ideal for creating a site-to-site VPN between two network gateways (like two office routers), as it completely hides the internal network addressing scheme from anyone monitoring traffic on the public internet. The question's requirement to "encrypt the entire original IP packet" is the key phrase that points directly to Tunnel Mode.
• IPsec in Transport Mode (Tempting Wrong Answer): This is the most common distractor. In Transport Mode, IPsec only encrypts the payload (the data) of the original IP packet. The original IP header remains intact and unencrypted. This is efficient for end-to-end communication between two hosts, but it does not meet the requirement of encrypting the entire original packet, including its header.
• TLS (Incorrect): Transport Layer Security primarily operates at the Presentation Layer (Layer 6) of the OSI model. It provides encryption for application-layer protocols like HTTP but does not operate at the Network Layer (Layer 3) to encrypt entire IP packets for routing.
• SSH (Incorrect): Secure Shell is an application-layer protocol used for secure remote administration. Like TLS, it does not provide network-layer encryption for all traffic between two sites.

Feature	IPsec Transport Mode	IPsec Tunnel Mode
What is Encrypted?	IP Payload only	Entire original IP Packet
Original IP Header	Remains intact, visible	Encrypted, hidden
Primary Use Case	Host-to-host (end-to-end)	Gateway-to-gateway (site-to-site VPN)

---

Question 2

A security analyst is reviewing network traffic logs and notices a large volume of TCP packets sent to a specific server. All the packets have the SYN flag set, but the server's SYN/ACK responses are never acknowledged. The server's resources are being exhausted as it waits for the final ACK, leading to a denial of service for legitimate users. What type of attack is this?

Answer and Explanation Correct Answer: C. SYN Flood Explanation: This scenario perfectly describes a classic SYN flood attack, which exploits the TCP three-way handshake process.

• SYN Flood (Correct): The TCP handshake is SYN -> SYN/ACK -> ACK. In a SYN flood, the attacker sends a high volume of SYN packets (often from spoofed IP addresses) but never sends the final ACK. The server allocates resources for each of these "half-open" connections and eventually runs out of resources, preventing legitimate users from connecting.
• Smurf Attack (Incorrect): A Smurf attack is a DDoS attack that uses spoofed ICMP echo requests (pings) sent to a network's broadcast address. It does not involve manipulating the TCP handshake.
• Teardrop Attack (Incorrect): A Teardrop attack involves sending fragmented IP packets that are designed to overlap, causing the target operating system to crash when it tries to reassemble them. It exploits IP fragmentation, not the TCP handshake.
• Ping of Death (Incorrect): This is a legacy attack that involves sending a malformed, oversized ICMP ping packet that would crash older, unpatched systems. It is not related to TCP SYN packets.

---

Question 3

An organization is implementing a new wireless network and wants to use the most secure authentication protocol available for its corporate users. The security policy requires mutual authentication, where both the client and the server validate each other's identity using digital certificates. Which EAP method should be implemented?

Answer and Explanation Correct Answer: C. EAP-TLS Explanation: This question requires you to know the specific characteristics of different Extensible Authentication Protocol (EAP) types used in 802.1X authentication.

• EAP-TLS (Correct): EAP-Transport Layer Security is widely considered the most secure EAP standard. It requires both the client (e.g., a user's laptop) and the authentication server (e.g., RADIUS) to have a digital certificate. This provides true mutual authentication. The client verifies the server's certificate, and the server verifies the client's certificate. This is the only option listed that meets the strict requirement for certificate-based mutual authentication.
• PEAP (Tempting Wrong Answer): Protected EAP is very common, which is why it's a dangerous distractor. In PEAP (specifically PEAPv0/EAP-MSCHAPv2), only the server is required to have a certificate, which the client validates. The client authenticates using a less secure method (username and password) inside the encrypted tunnel. This is not the certificate-based mutual authentication the question demands. This is a classic VoraPrep "think like the examiner" moment: they are testing if you can select the protocol that meets the most stringent requirement.
• EAP-MD5 (Incorrect): This is an obsolete and insecure EAP method that only provides one-way authentication and is vulnerable to offline password cracking. It should never be used.
• LEAP (Incorrect): Lightweight Extensible Authentication Protocol is a proprietary Cisco protocol with known security vulnerabilities. It has long been superseded by more secure methods like PEAP and EAP-TLS.

---

Question 4

A firewall administrator needs to write a rule that allows a web server in the DMZ (IP: 192.168.100.5) to initiate connections to a database server in the internal network (IP: 10.10.10.50) on the standard MySQL port. All other traffic from the DMZ to the internal network should be blocked. Which rule is the MOST appropriate?

Answer and Explanation Correct Answer: A. ALLOW SRC:192.168.100.5 DST:10.10.10.50 DstPort:3306 Explanation: This question tests the principle of least privilege as applied to firewall rules. The goal is to be as specific as possible to allow only the required traffic and nothing more.

• Rule A (Correct): This rule is the most precise. It specifies the exact source IP, the exact destination IP, and the exact destination port (3306 is the default for MySQL). It allows only the web server to talk to the database server on the required port.
• Rule B (Incorrect): This rule is too permissive. By specifying SRC:ANY, it would allow any machine to connect to the database server on port 3306, not just the intended web server. This violates the principle of least privilege.
• Rule C (Incorrect): This rule is also dangerously permissive. By specifying DstPort:ANY, it would allow the web server to connect to the database server on any port, opening it up to enumeration and attack on other services.
• Rule D (Incorrect): This rule explicitly denies the traffic, which is the opposite of the stated goal.

---

Question 5

Which layer of the OSI model is conceptually responsible for formatting data with the appropriate character encoding, compression, and encryption?

Answer and Explanation Correct Answer: B. Presentation Layer (Layer 6) Explanation: This is a direct test of your knowledge of the OSI model's functions. The Presentation Layer is the "translator" of the network.

• Presentation Layer (Correct): For the CISSP exam, you must know that Layer 6 is conceptually responsible for ensuring data is in a usable format for the Application Layer. Its functions include data translation (e.g., ASCII to EBCDIC), character encoding, data compression, and encryption/decryption. Protocols like TLS, which handle encryption, are best mapped to Layer 6 in the OSI model context.
• Session Layer (Incorrect): Layer 5 is responsible for establishing, managing, and terminating sessions between two communicating hosts. It handles dialogue control and synchronization.
• Application Layer (Incorrect): Layer 7 is where the user interacts with the network. It provides services to end-user applications (e.g., HTTP, SMTP, FTP). While many modern applications handle their own encryption, the conceptual OSI function resides at Layer 6.
• Transport Layer (Incorrect): Layer 4 is responsible for end-to-end connections and reliability through protocols like TCP and UDP. It handles segmentation, flow control, and error correction.

OSI Layer	Name	PDU	Key Security Concern
Layer 7	Application	Data	Application-level attacks (SQLi, XSS)
Layer 6	Presentation	Data	Poorly implemented encryption
Layer 5	Session	Data	Session hijacking
Layer 4	Transport	Segment/Datagram	Port scanning, SYN floods
Layer 3	Network	Packet	IP spoofing, routing attacks
Layer 2	Data Link	Frame	MAC spoofing, ARP poisoning
Layer 1	Physical	Bit	Wiretapping, cable cutting

---

Question 6

A company wants to prevent employees from accessing unauthorized websites. They deploy a network device that inspects the full URL of outbound web requests and can block access based on categories (e.g., social media, gambling). This device operates at which layer of the OSI model?

Answer and Explanation Correct Answer: C. Layer 7 (Application) Explanation: The key to this question is what is being inspected. The device is looking at the full URL, which is part of the HTTP protocol data.

• Layer 7 (Correct): The HTTP protocol, including URLs, headers, and content, exists at the Application Layer. Any device that makes decisions based on this level of detail is a Layer 7 device. Examples include web content filters, most proxies, Web Application Firewalls (WAFs), and modern Next-Generation Firewalls (NGFWs) with application awareness.
• Layer 3 (Tempting Wrong Answer): A traditional router or packet-filtering firewall operates at Layer 3. It makes decisions based on source and destination IP addresses. It has no visibility into the URL and could only block traffic to the entire web server's IP, not specific pages.
• Layer 4 (Incorrect): A stateful firewall operates up to Layer 4. It can make decisions based on TCP/UDP ports but still cannot see the application data like a URL. An Intrusion Detection/Prevention System (IDS/IPS) may also operate here, looking for patterns, but a URL-based filter is definitively Layer 7.
• Layer 2 (Incorrect): A switch operates at Layer 2, making forwarding decisions based on MAC addresses. It has no concept of IP addresses, ports, or URLs.

---

Question 7

Which of the following is a primary benefit of network segmentation?

Answer and Explanation Correct Answer: B. It contains security breaches to a smaller area of the network. Explanation: Network segmentation is a core security architecture principle. Think of it like watertight compartments on a ship.

• Containment (Correct): The main security driver for segmentation is to limit the "blast radius" of an attack. If an attacker compromises a server in one segment, segmentation prevents them from easily moving laterally to other, more sensitive segments. This applies to traditional data centers (using VLANs and subnets) and modern cloud environments (using Virtual Private Clouds, or VPCs, and security groups). Each segment boundary is a control point to enforce security policies.
• Bandwidth (Incorrect): While segmentation can improve performance by reducing the size of broadcast domains, its primary benefit from a CISSP perspective is security. The goal isn't speed; it's control.
• IP Management (Incorrect): Segmentation often makes IP address management more complex, as you now have multiple subnets to plan and manage.
• Eliminates Firewalls (Incorrect): Segmentation relies heavily on firewalls or other Layer 3 devices (like router ACLs or cloud network ACLs) to enforce access control rules between the segments. It increases the need for well-configured firewalls, it does not eliminate them.

---

Question 8

What is the purpose of DNSSEC?

Answer and Explanation Correct Answer: B. To provide authentication and integrity for DNS data. Explanation: DNSSEC (Domain Name System Security Extensions) was created specifically to combat DNS cache poisoning and spoofing attacks. It does not provide confidentiality.

• Authentication and Integrity (Correct): DNSSEC uses digital signatures to provide origin authentication and data integrity. When your resolver receives a DNS response, DNSSEC allows it to verify that the response truly came from the authoritative server for that domain (authentication) and that the data was not modified in transit (integrity).
• Encryption (Tempting Wrong Answer): This is a critical distinction for the exam. DNSSEC signs data, it does not encrypt it. The DNS responses are still sent in cleartext. Other protocols, like DNS over TLS (DoT) or DNS over HTTPS (DoH), are designed to provide confidentiality (encryption) for the DNS query/response path.
• Faster Lookups (Incorrect): The cryptographic verification process adds a small amount of latency to DNS lookups. Speed is not its goal.
• Hiding IP Address (Incorrect): DNSSEC has no function related to hiding the IP address of the client or resolver.

---

Question 9

A security team is implementing a solution to protect against man-in-the-middle attacks on the local network. The solution should prevent an attacker from falsely mapping their own MAC address to the IP address of the network's default gateway. What technology should they implement on their network switches?

Answer and Explanation Correct Answer: D. Dynamic ARP Inspection (DAI) Explanation: The attack described is ARP poisoning or ARP spoofing. Dynamic ARP Inspection is the specific countermeasure for this Layer 2 attack.

• Dynamic ARP Inspection (Correct): DAI is a switch feature that validates ARP packets on the network. It maintains a trusted database of IP-to-MAC address bindings (usually learned via DHCP snooping). When an ARP reply arrives at a switch port, the switch checks if the IP-MAC pair matches the trusted database. If it doesn't, the malicious packet is dropped, preventing the ARP cache of other devices from being poisoned.
• Spanning Tree Protocol (Incorrect): STP is a Layer 2 protocol designed to prevent switching loops in networks with redundant paths. It has no role in validating ARP packets.
• 802.1X (Incorrect): 802.1X is a port-based network access control (PNAC) standard used for authentication. It determines whether a device is allowed on the network, but it does not inspect the ARP traffic that device sends once it's connected.
• Port Security (Incorrect): Port security is a switch feature that limits the number of MAC addresses that can be learned on a given port. While useful, it does not validate the content of ARP packets and is not the primary defense against ARP spoofing.

---

Question 10

Which of the following cellular technologies first introduced the concept of SIM cards and is considered a "2G" technology?

Answer and Explanation Correct Answer: B. GSM Explanation: This is a knowledge-based question on the evolution of cellular networking standards.

• GSM (Correct): Global System for Mobiles is the standard that defined the second generation (2G) of digital cellular networks. A key innovation of GSM was the Subscriber Identity Module (SIM) card, which decoupled the user's identity and phone number from the physical handset.
• LTE (Incorrect): Long-Term Evolution is a 4G technology.
• CDMA (Incorrect): Code Division Multiple Access was a competing 2G/3G technology. A key differentiator was that most early CDMA phones did not use removable SIM cards; subscriber information was programmed directly into the phone. While later generations of CDMA adopted a similar concept with R-UIM cards, GSM is famous for introducing the SIM card as a core part of its architecture from the 2G era.
• 5G NR (Incorrect): 5G New Radio is the global standard for 5G networks.

How can I master Domain 4 in 7 days?

Don't just count your right and wrong answers. A score of 7/10 might feel good, but the three questions you missed could represent a critical gap that shows up on exam day. The real value is in the analysis. Let's turn your results into a concrete, one-week action plan.

If you scored 8 or more: You have a solid foundation. Your focus is on mastering nuance and speed. If you scored 5-7: You understand the key concepts but have gaps in specific areas. Your focus is targeted remediation. If you scored 4 or less: You need a foundational review. This is correctable, but it requires starting from the beginning.

Here is your 7-day improvement sprint.

Day 1: Triage Your Mistakes

Go back through each question you missed. For each one, write down the real reason you got it wrong. Was it:

• A knowledge gap? (e.g., "I didn't know what DAI was.")
• A reading comprehension issue? (e.g., "I missed the phrase 'entire original packet'.")
• An analysis failure? (e.g., "I picked PEAP because it's common, not because it met the specific requirement for mutual authentication.")

This triage is the most important step. Be brutally honest with yourself.

Day 2: Deep Dive on OSI and TCP/IP

Spend 90 minutes focused solely on the OSI and TCP/IP models. For each layer, write down its primary function, key protocols, a common attack, and a common security control. You must be able to explain why a packet-filtering firewall is a Layer 3/4 device and a WAF is a Layer 7 device.

Day 3: Master Secure Protocols

Focus on the "secure vs. insecure" protocol pairs. The exam loves to test your knowledge of which protocol to use.

Insecure Protocol	Secure Alternative(s)	Key Security Service Added
Telnet (Port 23)	SSH (Port 22)	Confidentiality, Integrity, Authentication
FTP (Port 21)	SFTP (Port 22), FTPS (989/990)	Confidentiality, Integrity
HTTP (Port 80)	HTTPS (Port 443) via TLS	Confidentiality, Integrity, Authentication
SNMPv1/v2	SNMPv3	Confidentiality, Integrity, Authentication

Day 4: Solidify Wireless and Remote Access

Dedicate a session to WPA2 vs. WPA3, focusing on why WPA3's Simultaneous Authentication of Equals (SAE) is a major security upgrade over WPA2-PSK. Then, review VPNs. Draw a diagram showing the difference between IPsec Transport Mode and Tunnel Mode. A visual will stick in your head better than text.

Day 5: Map Attacks to Defenses

List the top network attacks from this domain: ARP Poisoning, MAC Spoofing, SYN Floods, Smurf Attacks, and DNS Poisoning. For each one, write down the specific defensive technology designed to mitigate it (e.g., ARP Poisoning -> Dynamic ARP Inspection).

Day 6: Run a Practice Question Sprint

Now it's time to build volume and speed. Using an adaptive question bank like VoraPrep's, do a timed 50-question quiz composed only of Domain 4 questions. The goal is to train your brain to quickly identify what is being asked and eliminate the obvious distractors. Try VoraPrep's adaptive CISSP question bank to target your weak areas automatically.

Day 7: Consolidate and Review

Look at your notes from the week. Create a single "cheat sheet" page for Domain 4. It should include your weakest areas, key model diagrams, and protocol port numbers you struggle to remember. Review this sheet right before you go to sleep.

Get More CISSP Practice on VoraPrep

This small sample shows the level of thinking required to pass the CISSP exam. Simply reading a textbook is not enough. You have to actively test your knowledge and, more importantly, your judgment.

That's why VoraPrep exists. We offer a complete, 6-pillar course designed to get you certified. When you sign up, you get:

1. Textbook-Grade Lessons: Our interactive study guides cover every topic on the CISSP blueprint in detail.
2. Adaptive Practice Questions: A bank of over 2,200 CISSP questions that adapts to your performance, forcing you to work on your weak areas until they become strengths.
3. 1:1 Exam Simulators: Take full-length, timed mock exams that replicate the Pearson VUE testing environment, so there are no surprises on exam day.
4. Spaced-Repetition Flashcards: Our FSRS flashcards help you memorize key terms, standards, and models for long-term retention.
5. Personalized Study Plan: Enter your exam date, and our platform builds a dynamic daily study schedule to keep you on track.
6. Vory, Your 24/7 Tutor: Stuck on a concept? Ask Vory inside any lesson or question for a step-by-step explanation, available anytime.

Unlike overpriced passive video lecture bundles that cost thousands, VoraPrep provides a complete, interactive course for a simple monthly or yearly subscription. You can see a full breakdown on our VoraPrep vs. Everybody comparison page.

Related Resources

• Best CISSP Review Courses (2026): An Honest, Objective Comparison, Compare the best CISSP review courses for 2026.
• Free CISSP Security Architecture and Engineering Practice Questions (2026), Stop memorizing CISSP Domain 3.
• Free CISSP Asset Security Practice Questions (2026), Test your knowledge with these free 2026 CISSP Asset Security (Domain 2) practice questions.
• Free CISSP Security and Risk Management Practice Questions (2026), Get free, expert-written 2026 CISSP Security and Risk Management practice questions.
• CISSP Exam Retake Strategy (2026): How to Pass on Your Next Attempt, Failed the CISSP exam? Get the official 2026 retake policy, waiting periods, and a 3-week plan to analyze your score report.

Official resources and references

• (ISC)² CISSP Certification Page: The official source for all exam information.
• (ISC)² CISSP Exam Outline: The blueprint for the exam. Every candidate must read this document.
• NIST Special Publications (SP 800 Series): Many CISSP concepts are derived from the standards and guidelines published by NIST.

Frequently asked questions

How many questions are on the CISSP exam from Domain 4?

Domain 4, Communication and Network Security, makes up 13% of the CISSP exam. Since the CAT exam has between 125 and 175 questions, you can expect approximately 16 to 23 questions from this domain.

What is the hardest part of CISSP Domain 4?

Many candidates find the practical application of the OSI model to be the most challenging part. It's not about memorizing the layers, but understanding which security controls and attacks apply at each layer. Firewall rule logic and the specifics of IPsec modes are also common stumbling blocks.

How does Domain 4 cover modern topics like cloud and SDN?

The CISSP exam evolves to include modern technologies. For Domain 4, you are expected to apply core security principles to new contexts. This means understanding how segmentation works in the cloud (VPCs, security groups), the security implications of Software-Defined Networking (SDN) separating the control and data planes, and how to secure IoT devices on a network.

Are these CISSP Domain 4 practice questions updated for the 2026 exam?

Yes, these questions and the entire VoraPrep question bank are aligned with the current (ISC)² CISSP exam outline. We continuously monitor for any changes to ensure our content is always up to date.

Where can I find more free CISSP Communication and Network Security questions?

While this page provides a great starting point, the best way to get more practice is to start a free trial with a comprehensive prep provider. VoraPrep offers a 14-day free trial that gives you access to a portion of our 2,200+ question bank, including many more questions on CISSP Domain 4.

---

Ready to Pass Your CISSP Exam?

Stop guessing and start preparing with a system built for success. VoraPrep offers a complete course with adaptive practice, detailed lessons, and a 24/7 tutor named Vory to guide you. See why hundreds of candidates pass with us.

Visit voraprep.com to get started.

Start Your Free 14-Day Trial at voraprep.com →