CISSP Communication and Network Security practice questions
7-day money-back guarantee — full refund within 7 days of purchase if you've completed under 20% of the questions. See pricing →
Certifications Tools Flashcards Career Paths Exam Guides Blog Pricing For Teams About
Try 20 questions free →

CISSP Communication and Network Security: 156 practice questions

CISSP 156 questions 12 shown free

12 of the 156 Communication and Network Security questions in the Certsqill CISSP bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for CISSP? Take the free 5-min readiness check →

1. Apply the dispatch emergency role with restricted ACLs: Which NAC action best satisfies both requirements?

Medium
A city transport agency’s NAC policy and current event are shown below.

Policy: Noncompliant maintenance tablets may reach only remediation services. During an active emergency, authorized dispatch endpoints must remain available, but their access must be restricted and logged.
Event: A dispatch laptop fails the patch check during a declared emergency. It is assigned to the dispatch role, and its certificate is valid. Which NAC action best satisfies both requirements?
  1. Allow unrestricted production access because its certificate is valid.
    A valid certificate authenticates the endpoint but does not override patch posture or restricted-emergency access requirements.
  2. Apply the dispatch emergency role with restricted ACLs and enhanced logging. ✓
    This preserves emergency availability while enforcing restricted access and accountability for the authorized endpoint.
  3. Disconnect the laptop until patch compliance is restored.
    Disconnection protects posture but violates the explicit requirement to keep authorized dispatch endpoints available.
  4. Place the laptop in the standard remediation-only quarantine network.
    Standard quarantine would block required emergency dispatch availability despite the explicit policy exception.
The trap
Applies general quarantine without considering the declared emergency exception. Confuses authentication with unrestricted authorization. Ignores the stated public-safety availability requirement.

A narrowly restricted, logged emergency role preserves necessary dispatch service without granting normal production access.

2. Allow 172.22.40.0/28 to 10.20.8.14 on TCP 443: Which rule best enforces least privilege?

Easy
An insurance provider gives an external claims auditor a site-to-site VPN tunnel. The auditor needs HTTPS access only to the claims-review API at 10.20.8.14. The firewall processes rules top-down, is stateful, and denies unmatched traffic. The auditor’s tunnel address range is 172.22.40.0/28. Which rule best enforces least privilege?
  1. Allow 172.22.40.0/28 to all of 10.20.8.0/24 using TCP 443.
    The broader destination includes systems beyond the claims-review API.
  2. Allow 172.22.40.0/28 to 10.20.8.14 using all IP protocols.
    All-protocol access exceeds the HTTPS-only requirement.
  3. Allow any VPN peer to 10.20.8.14 on TCP 443.
    The rule omits the documented auditor source range.
  4. Allow 172.22.40.0/28 to 10.20.8.14 on TCP 443. ✓
    This limits source, destination, protocol, and service to the stated requirement; unmatched traffic remains denied.
The trap
Treats VPN membership as sufficient authorization. Expands destination scope unnecessarily. Restricts the host but not the required service.

Permit only the auditor range to the API host over TCP 443.

3. Map frame errors to their subsequent TCP retransmissions: Which approach is most appropriate?

Medium
A logistics operator sees packets leave warehouse applications but never reach the carrier gateway. Ethernet counters show repeated frame errors, while TCP logs show retransmissions. The diagnostic team must preserve useful fault localization, use the confirmed lower-layer evidence, and correlate it with protocol behavior without confusing OSI and TCP/IP models. Which approach is most appropriate?
  1. Map frame errors to their subsequent TCP retransmissions across the layered models. ✓
    The confirmed frame errors identify a likely lower-layer fault, while the retransmissions are a correlated transport-layer consequence.
  2. Use only TCP/IP because OSI is not operationally relevant.
    TCP/IP is operationally useful, but OSI distinctions help separate physical, data-link, and transport symptoms.
  3. Treat retransmissions as application failures.
    TCP retransmissions are transport-layer behavior, not application failure evidence by themselves.
  4. Restart with broad lower-layer testing while disregarding the confirmed frame-error evidence.
    Lower-layer analysis is appropriate, but disregarding confirmed evidence would weaken rather than improve fault localization.
The trap
Misclassifies transport evidence. Treats one model as an exclusive diagnostic framework. Uses a valid diagnostic layer while rejecting relevant evidence.

Correlate confirmed frame errors with TCP retransmissions across the layered models.

4. Verify the approved management path: What should the analyst verify first?

Medium
A hospital consortium separates clinical systems from a shared management network. During testing, an administrator workstation on the management network cannot reach a switch management interface, although the switch is powered and its management address responds locally. The consortium's policy permits management access only from an approved administration subnet. The workstation is confirmed to be in that approved subnet, and no routing or firewall behavior is otherwise documented. What should the analyst verify first?
  1. Confirm that the management interface supports the required encryption protocol.
    Encryption may affect session establishment but does not establish whether the authorized path is permitted.
  2. Determine whether the switch can process clinical traffic at test capacity.
    Data-plane capacity does not explain a management-path failure from an approved source.
  3. Verify the approved management path. ✓
    With source membership established, verify the effective routes and management-plane enforcement governing that path.
  4. Recheck whether the workstation remains within the approved administration subnet.
    The scenario already confirms that prerequisite.
The trap
Investigates data-plane performance instead of management access. Confuses session protection with reachability control. Repeats an established fact instead of testing the failed control.

Verify the effective management path for the confirmed approved source.

5. Block direct administrative access and require the bastion: Which corrective action best addresses the failed

Medium
A university research group uses a bastion host for administrative access to laboratory servers. A scheduled control test shows administrators can connect directly from the campus network to those servers, even though the bastion remains reachable and fully patched. The approved architecture requires administrative sessions to enter through the bastion. Which corrective action best addresses the failed control?
  1. Add another bastion without removing the existing direct routes.
    The unauthorized bypass remains available.
  2. Block direct administrative access and require the bastion. ✓
    Removing direct paths makes the bastion the required administrative entry point.
  3. Repatch the already-patched bastion before changing access controls.
    The demonstrated failure is a bypass path, not missing bastion patches.
  4. Document every direct administrative connection after use.
    Documentation does not prevent access that violates the approved architecture.
The trap
Treats patching as the failed control. Substitutes accountability for preventive restriction. Adds infrastructure while preserving the failed path.

Block direct administrative paths so the bastion becomes mandatory.

6. Local-segment multicast exposure can remain despite: Which limitation remains?

Easy
An energy utility places an IPv6-enabled monitoring service behind a perimeter firewall. Testing confirms unsolicited IPv6 unicast traffic from outside is blocked, but the service still answers discovery requests from other systems on the same operational network segment. The utility wants to describe what the implemented safeguard does not address. Which limitation remains?
  1. Local-segment multicast exposure can remain despite blocking unsolicited external unicast traffic. ✓
    The perimeter safeguard addresses external unicast ingress, not discovery visibility among systems sharing the local segment.
  2. The firewall cannot filter any IPv6 traffic because IPv6 has no broadcast mechanism.
    IPv6 firewalls can filter IPv6 traffic; absence of broadcast does not eliminate multicast or filtering capability.
  3. IPv6 prevents services from using multicast discovery unless routing is manually enabled.
    IPv6 commonly supports multicast discovery on local segments without requiring routed multicast configuration.
  4. Blocking external unicast automatically prevents all local IPv6 discovery responses.
    Perimeter unicast filtering does not inherently control local-segment multicast requests or service responses.
The trap
Extends a perimeter rule beyond its stated scope. Confuses IPv6 multicast behavior with inability to filter. Assumes multicast discovery requires routed deployment.

External unicast filtering does not eliminate multicast discovery exposure on the local operational segment.

7. The engineer may perform restoration: Which boundary is correct?

Medium
A government records office stores encrypted configuration backups for its network devices. The network team can restore a device configuration from an approved backup, but policy assigns authorization for production configuration changes to the system owner. During an outage, an engineer proposes restoring the latest backup immediately and treating that restoration as approval for all settings it contains. Which boundary is correct?
  1. Restoring any approved backup automatically supersedes the system owner’s authorization.
    Backup approval supports recovery, but policy still reserves production configuration authorization to the system owner.
  2. The engineer may perform restoration, while the system owner retains production-change authorization. ✓
    Operational recovery responsibility and authorization for resulting production changes remain separate under the stated policy.
  3. Backup encryption makes the engineer accountable for approving every restored setting.
    Encryption protects backup confidentiality but does not transfer production-change authorization to the restoring engineer.
  4. The backup vendor becomes accountable for settings restored from vendor-managed files.
    Vendor involvement does not replace the records office’s internal authorization boundary or accountability.
The trap
Mistakes custody or service involvement for organizational authority. Treats recovery approval as unrestricted change approval. Confuses confidentiality protection with change authority.

Restoration execution may be delegated, but production configuration authorization remains with the system owner.

8. Seek designated approval with scope: What is the appropriate response?

Hard
A remote clinical service requires encrypted voice communications whenever patient information is discussed. A regional clinic requests an exception because one rural partner supports only an unencrypted telephone connection. The service’s policy allows exceptions only when formally approved by the designated risk authority, documented with scope and duration, and accompanied by compensating safeguards. The clinic asks the operations team to approve the exception informally for recurring calls. What is the appropriate response?
  1. Permit recurring unencrypted calls because interoperability is operationally necessary.
    Operational need alone does not satisfy formal approval, documentation, duration, and safeguard requirements.
  2. Replace voice encryption with caller authentication while retaining the recurring exception.
    Caller authentication does not provide voice confidentiality or satisfy the exception policy by itself.
  3. Allow the exception after documenting the partner’s telephone limitations.
    Documentation alone is insufficient; designated approval and compensating safeguards are also required.
  4. Seek designated approval with scope, duration, and safeguards. ✓
    Recurring unencrypted calls require every stated exception condition before they are permitted.
The trap
Completes only one required exception element. Confuses identity assurance with communications encryption. Treats convenience as an authorized policy exception.

Seek designated approval with scope, duration, and safeguards.

9. A valid certificate chain whose identity matches: Which evidence is most directly needed?

Medium
An industrial manufacturer plans to authorize a new TLS connection from a production gateway to a supplier service. The gateway can establish a cryptographic session, but the authorization decision requires evidence that it is communicating with the intended supplier endpoint rather than an impersonator. Which evidence is most directly needed?
  1. A supplier invoice confirming the gateway’s connection identifier.
    Commercial documentation does not provide cryptographic evidence that the live TLS endpoint is authentic.
  2. A packet capture showing that the TLS handshake completed successfully.
    Handshake completion demonstrates protocol negotiation, not that the remote endpoint has an authorized identity.
  3. A firewall rule permitting outbound traffic to the supplier’s address.
    A firewall rule permits traffic but does not authenticate the remote TLS endpoint or prevent impersonation.
  4. A valid certificate chain whose identity matches the intended hostname. ✓
    Certificate trust and hostname identity directly support authenticating the intended TLS endpoint.
The trap
Uses business evidence instead of endpoint identity evidence. Confuses network reachability with endpoint authentication. Treats successful negotiation as identity validation.

Validate the certificate chain and hostname identity to authenticate the intended TLS endpoint.

10. Disable the eight unused switch ports: Select TWO actions that directly address documented baseline gaps.

Medium
A pharmaceutical laboratory reviews this switch-room record: five access switches are installed in three rooms; two rooms have badge-controlled doors and cameras; one room has an unlocked door; eight unused switch ports remain enabled; and the switches use unique administrator credentials. The baseline requires physical access restriction and removal of unnecessary services or interfaces. Select TWO actions that directly address documented baseline gaps.

Select two. More than one option is correct — every correct one is ticked below.

  1. Remove cameras from badge-controlled rooms to standardize surveillance.
    Removing existing safeguards reduces protection and does not correct the unlocked-room deficiency.
  2. Enable additional unused ports for easier laboratory equipment deployment.
    Enabling unused ports increases unnecessary exposure and conflicts with the stated baseline requirement.
  3. Disable the eight unused switch ports. ✓
    Disabling unused ports removes unnecessary active interfaces and directly addresses a documented baseline gap.
  4. Install badge control and camera coverage for the unlocked room. ✓
    Securing the unlocked room extends physical access restriction and monitoring to all documented switch locations.
  5. Replace unique administrator credentials with shared emergency credentials.
    Shared credentials weaken accountability and contradict the existing stronger individual-account practice.
The trap
Expands the exact condition the baseline requires removing. Removes accountability without addressing a recorded gap. Weakens controls instead of closing the identified gap.

Disable unused interfaces and secure the unlocked switch room to close the two recorded baseline gaps.

11. Use full-tunnel VPN routing for remote editor internet: Which control most directly addresses this failure?

Hard
A media production company permits remote editors to use split-tunnel VPN connections. An investigation shows that private production traffic traverses the VPN, while internet traffic uses the editor’s home network and bypasses company DNS filtering and inspection. The demonstrated concern is that hostile internet content can reach the remote endpoint without enterprise network controls. Which control most directly addresses this failure?
  1. Add more logging to the existing split-tunnel configuration.
    Additional logs improve visibility but leave internet traffic outside the company’s filtering and inspection path.
  2. Use full-tunnel VPN routing for remote editor internet traffic. ✓
    Full tunneling routes internet traffic through enterprise controls, directly correcting the demonstrated split-tunnel bypass.
  3. Require stronger passwords for the production applications.
    Stronger passwords improve authentication but do not route bypassed internet traffic through enterprise inspection controls.
  4. Increase production server storage for additional remote session records.
    Storage capacity does not change remote traffic routing or restore enterprise inspection of internet sessions.
The trap
Changes capacity while leaving the network-control gap intact. Addresses identity strength rather than traffic-path bypass. Monitors the bypass without preventing its consequence.

Full-tunnel routing brings remote internet traffic back through enterprise filtering and inspection.

12. Use IPsec tunnel mode between the office gateways: Which choice resolves the requirements?

Hard
A construction engineering group must connect two private office networks across an untrusted provider. Policy requires protection of application payloads and private internal addressing while traffic crosses the provider. Engineers propose IPsec transport mode because it is simpler for host-to-host sessions. The design must protect the routed network connection between the two office gateways, not merely selected host pairs. Which choice resolves the requirements?
  1. Use TLS between selected applications and leave provider-facing network traffic unchanged.
    TLS protects selected application sessions but does not provide the required gateway-to-gateway network protection or address concealment.
  2. Use application-layer encryption while relying on provider routing confidentiality.
    Application encryption does not protect private addressing or satisfy the requirement to secure traffic across the untrusted provider.
  3. Use IPsec tunnel mode between the office gateways. ✓
    Tunnel mode protects traffic between networks through gateways and encapsulates the original packet addressing across the provider.
  4. Use IPsec transport mode between representative hosts in both offices.
    Transport mode protects host payloads but does not create the required gateway-to-gateway tunnel for whole networks.
The trap
Protects applications while leaving the required network path exposed. Confuses host-to-host protection with routed network protection. Assumes the provider supplies confidentiality not required or established.

IPsec tunnel mode protects the routed office-to-office connection and encapsulates private internal addresses.

144 more Communication and Network Security questions

The remaining 144 questions in this domain are part of the full CISSP bank — 1200 questions, every option explained. Start with the free five-minute check and see your score per domain.

Test your CISSP readiness — free

Other CISSP domains

Part of the Certsqill CISSP question bank · Communication and Network Security · Every answer, right and wrong, comes with its own explanation.