ExamworthyExamworthy
Open the appStart free

CISSP - Communication and Network Security - Section 4.1

Apply secure design principles in network architectures including OSI and TCP/IP models, IP networking, secure protocols, segmentation, micro-segmentation, and SDN.

Apply secure design principles to network architectures by mapping OSI model and TCP/IP concepts to secure protocols, network segmentation, micro-segmentation, and software-defined networking (SDN) and SD-WAN deployments. Choose between segmentation strategies based on the sensitivity of traffic flows and the threat model.

OSI modelTCP/IPmicro-segmentationSDNSD-WANsecure protocols

Practice question for this objective

Free sampleCommunication and Network Securityhard

A bank is rebuilding the perimeter for a sensitive payments environment. The architect must choose between traditional VLAN-based segmentation and identity-aware micro-segmentation. Which statement BEST distinguishes micro-segmentation from VLAN segmentation in a defensible design?

  • AMicro-segmentation enforces policy per workload identity and on east-west traffic, whereas VLAN segmentation primarily isolates broadcast domains and relies on a separate firewall for inter-VLAN policy. Correct
  • BMicro-segmentation always replaces firewalls and removes the need for an Internet edge filter once it is deployed.
  • CMicro-segmentation is implemented only by SDN controllers and cannot be enforced at the host level.
  • DMicro-segmentation operates exclusively at layer 2 to isolate broadcast domains for individual virtual machines.
Distinguish micro-segmentation from VLAN segmentation by enforcement scope, identity awareness, and traffic direction inspected. VLANs create separate broadcast domains and depend on a router or firewall to police inter-VLAN flow, so they are coarse and topology-bound. Micro-segmentation, by contrast, applies policy at the workload boundary using identity, tags, or process context and inspects east-west flows that VLANs alone cannot see, which is why it is the design control of choice for limiting lateral movement.

Why A is correct: Micro-segmentation applies fine-grained policy keyed to workload, user, or process identity and inspects lateral traffic between peers in the same broadcast domain, while VLANs create layer 2 broadcast separation and depend on an external layer 3 device to filter between VLANs, which is the load-bearing distinction in design reviews.

Why B is wrong: This is tempting because vendor messaging often positions micro-segmentation as a replacement for perimeter tools, but it complements rather than replaces edge firewalls and IDS. Treating it as a wholesale replacement leaves north-south traffic unprotected and is not the way the control is positioned in CISSP-aligned architectures.

Why C is wrong: Many candidates remember that SDN enables micro-segmentation and conclude the controller is mandatory. In practice host-based agents, hypervisor distributed firewalls, and identity-aware proxies can all enforce micro-segmentation without a centralised SDN fabric, so this option is too narrow.

Why D is wrong: Confining micro-segmentation to layer 2 mirrors how VLANs work and sounds plausible, but micro-segmentation typically inspects layer 3 to layer 7 attributes and is identity-aware, not broadcast-domain-aware, so this description actually re-describes VLANs.

See more CISSP practice questions, answers explained.

More in this domain

Back to all Communication and Network Security objectives, or the CISSP cert hub.

Examworthy is not affiliated with or endorsed by (ISC)2. Original, blueprint-aligned practice material only.