CISSP - Communication and Network Security (13% of the exam) - Section 4.2

Secure network components including operation of infrastructure, transmission media, network access control (NAC) devices, and endpoint security.

Describe how firewalls, network access control (NAC) devices, transmission media, and endpoint security components combine to protect network infrastructure. Select and configure these components to enforce access policies, limit lateral movement, and maintain visibility across the network perimeter and interior.

NACtransmission mediaendpoint securityfirewallsnetwork infrastructure

Practice question for this objective

Free sampleCommunication and Network Securitymedium

A logistics company runs a flat internal network that includes printers, finance workstations, warehouse handhelds, and a small data centre. The CISO has approved a project to introduce network segmentation after a worm propagated freely across all hosts during a recent tabletop exercise. The lead network engineer must decide what to deploy at the new segment boundaries to minimise lateral movement during a future intrusion. Which control PRIMARILY meets that objective?

AStateful inspection firewalls enforcing least-privilege rulesets between each segment and logging east-west flows centrally. Correct
BRouter access control lists filtering inbound packets at the perimeter Internet edge during business hours.
CA network intrusion detection sensor mirroring all traffic from the core switch to a SOC analytics platform.
DHost-based antivirus with signature updates pushed twice daily to every endpoint in the estate.

Use internal firewalls at segment boundaries to enforce least-privilege east-west rules and contain lateral movement on previously flat networks. Worms exploit any reachable service, so the most direct mitigation is to remove unnecessary reachability between hosts. Internal stateful firewalls placed between segments enforce explicit allow-listed flows and track connection state, so unsolicited east-west traffic is dropped rather than relayed. Centralised logging of those decisions then gives responders the data to scope a future intrusion. Other layers such as IDS and antivirus add value but do not stop a worm from crossing a segment boundary on their own.

Why A is correct: Stateful firewalls applied between internal zones enforce explicit allow lists for east-west traffic, which is exactly what stops worm-style propagation between previously flat segments. The matching connection-state tracking and centralised logging give the SOC both the prevention and the visibility needed to limit and detect lateral movement, making this the PRIMARY control for the objective.

Why B is wrong: Perimeter ACLs protect against external traffic and ignore internal segment-to-segment flows, so they do nothing about a worm already inside the network. Time-of-day filtering further weakens coverage, and ACLs are stateless, missing connection-context attacks that stateful inspection would catch.

Why C is wrong: Passive detection helps the SOC see a worm spreading but cannot stop the propagation in line. Detection without enforcement leaves the lateral movement requirement unmet, and a single mirrored sensor at the core has blind spots into intra-segment traffic that never crosses it.

Why D is wrong: Endpoint antivirus is a useful layer but is signature-driven, lags against novel worms, and has historically failed on the very type of incident described in the tabletop. It also does not provide network-level segmentation, which is the control the CISO has specifically approved.

See more CISSP practice questions, answers explained.

Exam traps in Communication and Network Security

Answers that look right on this material and are not. Each one is a distractor from a different question in the CISSP bank for this domain.

Deploy host-based firewall policies on every workload that block all inbound traffic except SSH from a jump host
Why it is wrong: Host firewalls add a layer, but a single static rule set that only opens SSH ignores the legitimate east-west application flows the claims platform needs and will not survive a workload owner's first ticket. The control is also workload-managed, so a compromised host can usually disable or rewrite it.
The first is agentless and the second is agent-based, which is the defining boundary between admission-time and continuous NAC.
Why it is wrong: Agent presence is a deployment choice, not the distinguishing factor. Continuous NAC can be performed agentless using flow telemetry, and admission-time NAC can use an agent. The boundary the question asks about is the evaluation lifecycle, not the agent.
Rotate the shared API key on a 30-day schedule and log all controller calls to the SIEM for review
Why it is wrong: Key rotation and logging are sensible hygiene but they preserve the shared-secret model and the shared transport, so a foothold on any monitoring host on the management VLAN can still impersonate the controller within the rotation window.

Examworthy is not affiliated with or endorsed by ISC2. Original, blueprint-aligned practice material only.