CISSP - Communication and Network Security (13% of the exam) - Section 4.3

Implement secure communication channels according to design for voice, multimedia collaboration, remote access, data communications, and virtualised networks.

Implement secure communication channels for VoIP, multimedia collaboration, remote access via VPN, data communications, and virtualised networks according to their design requirements. Assess risks introduced by third-party connectivity and apply appropriate encryption and authentication controls to each channel type.

VoIPVPNremote accessvirtualised networksthird-party connectivity

Practice question for this objective

Free sampleCommunication and Network Securitymedium

A security manager is reviewing how third-party suppliers connect into the corporate network. Which control approach BEST reflects the secure communication channel principle of constraining third-party connectivity?

AIssue each supplier a domain account, place them in a vendor group that is a member of the standard staff network, and rely on group policy to restrict their reachable destinations.
BTerminate supplier connections in a dedicated extranet zone with explicit allow-list firewall rules to only the systems they support, time-bound credentials, and logging of every session for review. Correct
CAllow suppliers to connect over the standard remote access VPN using their own laptops, and require the supplier to certify annually that the laptops meet the corporate security baseline.
DPublish supplier-facing applications directly on the internet protected by a web application firewall, so that no inbound third-party tunnel into the corporate network is ever required.

Apply the secure channel principle of least-privilege, monitored, time-bound third-party connectivity through a dedicated extranet. Third-party connectivity is risky because the partner organisation is outside the direct control of the security programme. The CISSP-aligned answer is structural: terminate partner traffic in a dedicated extranet zone, allow only the specific systems the partner needs through explicit firewall rules, scope credentials to the engagement window, and log sessions so that any anomaly can be investigated. This constrains the channel itself rather than relying on trust.

Why A is wrong: Adding vendors to the staff network and relying on group policy creates broad implicit access and depends on host-side enforcement of network constraints, which is fragile. It is a defensible-but-second-best answer for environments that lack any segmentation, but it does not constrain the channel itself.

Why B is correct: An extranet zone with explicit allow-list rules, time-bound credentials, and session logging directly constrains the third-party channel to the minimum necessary access and supports detection and review. This matches the manager-led, least-privilege CISSP guidance for third-party connectivity.

Why C is wrong: Annual self-certification offers weak assurance, and using the standard VPN puts suppliers into the same trust zone as staff. Candidates may find this tempting because attestation sounds governance-aligned, but it does not constrain the channel or enforce posture at connection time.

Why D is wrong: Publishing applications can be appropriate for some workloads but is not a general answer for constraining third-party connectivity, and it ignores cases where suppliers need to reach internal systems. As a sole approach it leaves no structured channel control for supplier access.

See more CISSP practice questions, answers explained.

Exam traps in Communication and Network Security

Answers that look right on this material and are not. Each one is a distractor from a different question in the CISSP bank for this domain.

Provide an SSL portal VPN allowing clientless browser access to a curated set of internal web applications.
Why it is wrong: A clientless portal is convenient and reduces endpoint footprint, but it leaves non-web applications uncovered and does not enforce consistent inspection of all analyst traffic.
The management plane carries production user traffic and is therefore the plane that must enforce confidentiality and integrity of business data through encryption and microsegmentation policies.
Why it is wrong: This conflates the planes. Production user traffic traverses the data plane, not the management plane. Candidates who do not have a clear plane model may pick this because confidentiality and integrity sound like the most important goals.
SRTP encrypts the signalling exchange that establishes the call, while SIP over TLS encrypts the resulting audio and video media streams between endpoints.
Why it is wrong: This reverses the roles of the two protocols. Candidates who recall that both protect VoIP but confuse signalling with media often pick this answer. SRTP operates on the media, not the call setup, and SIP over TLS protects the signalling channel, not the audio.

Examworthy is not affiliated with or endorsed by ISC2. Original, blueprint-aligned practice material only.