CISSP - Communication and Network Security (13% of the exam) - Section 4.1

Apply secure design principles in network architectures including OSI and TCP/IP models, IP networking, secure protocols, segmentation, micro-segmentation, and SDN.

Apply secure design principles to network architectures by mapping OSI model and TCP/IP concepts to secure protocols, network segmentation, micro-segmentation, and software-defined networking (SDN) and SD-WAN deployments. Choose between segmentation strategies based on the sensitivity of traffic flows and the threat model.

OSI modelTCP/IPmicro-segmentationSDNSD-WANsecure protocols

Practice question for this objective

Free sampleCommunication and Network Securityhard

A bank is rebuilding the perimeter for a sensitive payments environment. The architect must choose between traditional VLAN-based segmentation and identity-aware micro-segmentation. Which statement BEST distinguishes micro-segmentation from VLAN segmentation in a defensible design?

AMicro-segmentation enforces policy per workload identity and on east-west traffic, whereas VLAN segmentation primarily isolates broadcast domains and relies on a separate firewall for inter-VLAN policy. Correct
BMicro-segmentation always replaces firewalls and removes the need for an Internet edge filter once it is deployed.
CMicro-segmentation is implemented only by SDN controllers and cannot be enforced at the host level.
DMicro-segmentation operates exclusively at layer 2 to isolate broadcast domains for individual virtual machines.

Distinguish micro-segmentation from VLAN segmentation by enforcement scope, identity awareness, and traffic direction inspected. VLANs create separate broadcast domains and depend on a router or firewall to police inter-VLAN flow, so they are coarse and topology-bound. Micro-segmentation, by contrast, applies policy at the workload boundary using identity, tags, or process context and inspects east-west flows that VLANs alone cannot see, which is why it is the design control of choice for limiting lateral movement.

Why A is correct: Micro-segmentation applies fine-grained policy keyed to workload, user, or process identity and inspects lateral traffic between peers in the same broadcast domain, while VLANs create layer 2 broadcast separation and depend on an external layer 3 device to filter between VLANs, which is the load-bearing distinction in design reviews.

Why B is wrong: This is tempting because vendor messaging often positions micro-segmentation as a replacement for perimeter tools, but it complements rather than replaces edge firewalls and IDS. Treating it as a wholesale replacement leaves north-south traffic unprotected and is not the way the control is positioned in CISSP-aligned architectures.

Why C is wrong: Many candidates remember that SDN enables micro-segmentation and conclude the controller is mandatory. In practice host-based agents, hypervisor distributed firewalls, and identity-aware proxies can all enforce micro-segmentation without a centralised SDN fabric, so this option is too narrow.

Why D is wrong: Confining micro-segmentation to layer 2 mirrors how VLANs work and sounds plausible, but micro-segmentation typically inspects layer 3 to layer 7 attributes and is identity-aware, not broadcast-domain-aware, so this description actually re-describes VLANs.

See more CISSP practice questions, answers explained.

Exam traps in Communication and Network Security

Answers that look right on this material and are not. Each one is a distractor from a different question in the CISSP bank for this domain.

Route all inter-workload traffic through a centralised perimeter firewall using policy-based routing on the SDN controller.
Why it is wrong: Centralised inspection forces a hairpin that creates latency, a bottleneck, and a single point of failure, and it does not solve the problem when two workloads share an overlay segment.
Approve the shared fabric provided each environment is placed in a separate VLAN with access control lists on the leaf switches
Why it is wrong: VLAN plus ACL separation on a shared fabric is the model most institutions are moving away from because misconfigurations and broadcast domains regularly bleed across, and PCI assessors increasingly challenge it where stronger isolation is technically available.
Move all voice and data through a single converged VLAN and rely on the IP PBX to negotiate codec compression dynamically.
Why it is wrong: Converging voice and data on one VLAN simplifies switching but removes the segmentation that protects voice traffic and offers no scheduling guarantees during file transfer bursts.

Examworthy is not affiliated with or endorsed by ISC2. Original, blueprint-aligned practice material only.