4.0 Communication and Network Security CISSP Practice Quiz

• A. Segment the architecture by trust boundary, business function, and data sensitivity, then enforce traffic flows with routed controls and policy points
• B. Provision new partner VPN tunnels with no owner, no monitoring, and no review
• C. Skip monitoring on TLS-encrypted paths because the traffic is encrypted
• D. Allow overlapping IP address ranges across acquired entities and patch routing later

Network segmentation limits lateral movement and aligns network access with business and security requirements. This is the correct answer.

• A. Separate management planes from production data planes and restrict administrative access through controlled jump hosts or privileged access paths
• B. Stand up site-to-site VPNs for partners without monitoring or ownership records
• C. Skip flow monitoring on encrypted paths because confidentiality is covered
• D. Tolerate overlapping subnets across acquired companies and reconcile later

Management interfaces are high-value targets and should be isolated and tightly monitored. This is the correct answer.

• A. Treat cloud-provider VPC networking as inherently secure with no customer review
• B. Use defense in depth with network, identity, endpoint, application, monitoring, and physical controls rather than relying on a single perimeter
• C. Build a single flat network so every system can reach every other system
• D. Use a single perimeter firewall as the entire network security architecture

Layered network security reduces dependence on one control and improves resilience when one layer fails. This is the correct answer.

• A. Skip validating customer-side cloud network controls because the provider 'handles it'
• B. Use secure network architecture reviews to evaluate topology, trust boundaries, routing, remote access, and monitoring before deployment
• C. Avoid segmentation to make a single flat network for all systems
• D. Treat the perimeter firewall as the only network security control

Architecture review identifies design weaknesses before they become operational dependencies. This is the correct answer.

• A. Treat cloud network security as a provider-only responsibility
• B. Use secure access service edge patterns when distributed users need consistent security inspection for cloud and internet access
• C. Use a single flat L2 broadcast domain across the entire enterprise
• D. Rely on a single edge firewall as the entirety of network security

SASE can combine network access and security policy enforcement for dispersed users and services. This is the correct answer.

• A. Add a new partner VPN as a permanent fixture with no review schedule
• B. Disable east-west monitoring on encrypted flows because they're 'protected'
• C. Design high availability with redundant paths, diverse providers, resilient routing, and tested failover for critical communications
• D. Use conflicting RFC1918 ranges between acquired networks and fix routing later

Network availability depends on eliminating avoidable single points of failure and proving failover behavior. This is the correct answer.

• A. Provision permanent partner VPNs with no owner or review process
• B. Disable network monitoring on encrypted segments because the traffic is encrypted
• C. Design cloud and hybrid connectivity by clarifying shared responsibility, routing, encryption, logging, and provider dependency risks
• D. Use the same address ranges in two merged networks and fix it later

Hybrid and cloud networking require explicit control ownership and visibility across environments. This is the correct answer.

• A. Assume the cloud provider's network is secure with no validation of customer scope
• B. Use one flat /16 so every device can reach every other device directly
• C. Rely on one internet firewall as the complete network security strategy
• D. Apply zero trust principles by continuously verifying identity, device posture, context, and authorization for network access

Zero trust reduces implicit trust based on location and supports secure access across distributed environments. This is the correct answer.