ExamworthyExamworthy
Open the appStart free

CISSP - Communication and Network Security - Section 4.2

Secure network components including operation of infrastructure, transmission media, network access control (NAC) devices, and endpoint security.

Describe how firewalls, network access control (NAC) devices, transmission media, and endpoint security components combine to protect network infrastructure. Select and configure these components to enforce access policies, limit lateral movement, and maintain visibility across the network perimeter and interior.

NACtransmission mediaendpoint securityfirewallsnetwork infrastructure

Practice question for this objective

Free sampleCommunication and Network Securitymedium

A logistics company runs a flat internal network that includes printers, finance workstations, warehouse handhelds, and a small data centre. The CISO has approved a project to introduce network segmentation after a worm propagated freely across all hosts during a recent tabletop exercise. The lead network engineer must decide what to deploy at the new segment boundaries to minimise lateral movement during a future intrusion. Which control PRIMARILY meets that objective?

  • AStateful inspection firewalls enforcing least-privilege rulesets between each segment and logging east-west flows centrally. Correct
  • BRouter access control lists filtering inbound packets at the perimeter Internet edge during business hours.
  • CA network intrusion detection sensor mirroring all traffic from the core switch to a SOC analytics platform.
  • DHost-based antivirus with signature updates pushed twice daily to every endpoint in the estate.
Use internal firewalls at segment boundaries to enforce least-privilege east-west rules and contain lateral movement on previously flat networks. Worms exploit any reachable service, so the most direct mitigation is to remove unnecessary reachability between hosts. Internal stateful firewalls placed between segments enforce explicit allow-listed flows and track connection state, so unsolicited east-west traffic is dropped rather than relayed. Centralised logging of those decisions then gives responders the data to scope a future intrusion. Other layers such as IDS and antivirus add value but do not stop a worm from crossing a segment boundary on their own.

Why A is correct: Stateful firewalls applied between internal zones enforce explicit allow lists for east-west traffic, which is exactly what stops worm-style propagation between previously flat segments. The matching connection-state tracking and centralised logging give the SOC both the prevention and the visibility needed to limit and detect lateral movement, making this the PRIMARY control for the objective.

Why B is wrong: Perimeter ACLs protect against external traffic and ignore internal segment-to-segment flows, so they do nothing about a worm already inside the network. Time-of-day filtering further weakens coverage, and ACLs are stateless, missing connection-context attacks that stateful inspection would catch.

Why C is wrong: Passive detection helps the SOC see a worm spreading but cannot stop the propagation in line. Detection without enforcement leaves the lateral movement requirement unmet, and a single mirrored sensor at the core has blind spots into intra-segment traffic that never crosses it.

Why D is wrong: Endpoint antivirus is a useful layer but is signature-driven, lags against novel worms, and has historically failed on the very type of incident described in the tabletop. It also does not provide network-level segmentation, which is the control the CISO has specifically approved.

See more CISSP practice questions, answers explained.

More in this domain

Back to all Communication and Network Security objectives, or the CISSP cert hub.

Examworthy is not affiliated with or endorsed by (ISC)2. Original, blueprint-aligned practice material only.