Network Architecture, Segmentation and Traffic Control
This topic covers secure network design, OSI and TCP/IP models, segmentation, routing, switching, traffic flows, firewalls, VPNs, remote access, and network performance.
How to study for CISSP
Treat each CISSP question as a risk decision: identify the owner, objective, control type, lifecycle phase, and business consequence before choosing.
Core concepts
Concept 1
Network Architecture, Segmentation and Traffic Control questions test whether a security leader can choose a defensible control, process, or governance response for a business risk.
Exam cue: Identify the domain objective: govern risk, protect assets, engineer securely, secure networks, control identity, test, operate, or secure software.
Concept 2
The best CISSP answer usually protects people, policy, data, and mission before jumping to a narrow technical fix.
Exam cue: Match the response to the risk owner, data owner, control objective, lifecycle phase, and assurance evidence in the scenario.
Concept 3
Eliminate answers that skip authorization, ignore legal or contractual duties, weaken least privilege, or confuse preventive, detective, and corrective controls.
Exam cue: Prefer documented policy, due care, defense in depth, least privilege, validated recovery, and continuous improvement.
Risk pitfalls and guardrails
Choosing a tool before confirming business requirements, ownership, and risk treatment.
Guardrail: Avoid answers that jump to a tool, ignore the risk owner, weaken least privilege, skip evidence, or treat one security objective as the only concern.
Treating confidentiality as the only goal when integrity, availability, authenticity, accountability, and safety also matter.
Guardrail: Avoid answers that jump to a tool, ignore the risk owner, weaken least privilege, skip evidence, or treat one security objective as the only concern.
Ignoring legal, regulatory, contractual, audit, and evidence-handling obligations.
Guardrail: Avoid answers that jump to a tool, ignore the risk owner, weaken least privilege, skip evidence, or treat one security objective as the only concern.
Memory anchors
OSI Model
The OSI model separates network functions into physical, data link, network, transport, session, presentation, and application layers.
Segmentation
Segmentation divides networks to limit blast radius, enforce policy, and reduce unauthorized movement.
DMZ
A demilitarized zone exposes public services while isolating them from trusted internal networks.
Firewall Rule
Firewall rules permit or deny traffic based on source, destination, service, state, and policy.
Zero Trust Network
A zero trust network continuously verifies identity, device, context, and authorization rather than trusting location.
VPN
A VPN protects traffic across untrusted networks using authenticated encrypted tunnels.
SDN
Software-defined networking separates control logic from forwarding to centralize and automate policy.
NAC
Network access control evaluates devices and users before granting network access.
East-West Traffic
East-west traffic moves laterally within a data center or environment and needs segmentation and monitoring.
Traffic Baseline
A traffic baseline helps identify anomalies, capacity issues, and policy violations.
Checkpoint rule
Do the check-up only after you can summarize each concept in one sentence and identify one dangerous pitfall from memory.
Knowledge Check (after reading)
Short check-up to confirm understanding of this module.
Check-up Questions
A network team needs to troubleshoot a switch forwarding frames based on hardware addresses. Which OSI layer is MOST directly involved?
A router selects the next hop for an IPv6 packet. Which OSI layer provides the relevant addressing and forwarding function?
Answer all questions to submit.
Next step personalized recommendations
Continue learning
Move forward only after this module is stable.
What is Pass Harbor?
Completely free exam prep for 317 U.S. exams.
- Practice questions
- Flashcards
- Study guides
- Mock exams
- No registration
- No paywall
- Start instantly
“No more expensive exam prep. Quality study tools should be accessible to everyone.”