CISSP Network Security Concepts
Dr. Abeer Alshammari · Published 7/29/2026
Domain 4 candidates with strong hands-on networking backgrounds often over-study the wrong layer of detail. The exam does not ask you to configure a router; it asks whether you understand why a given architecture pattern reduces risk.
The OSI model, exam-relevant view
Know which layer common attacks and controls operate at: ARP spoofing (Layer 2), IP spoofing and routing attacks (Layer 3), TCP session hijacking (Layer 4), and application-layer attacks like SQL injection (Layer 7). Firewalls historically operated at Layers 3-4; modern next-gen firewalls and WAFs extend inspection to Layer 7.
Segmentation and zero trust
Network segmentation (VLANs, DMZs, microsegmentation) limits lateral movement after a breach -- a flat network means one compromised host can reach everything. Zero trust extends this principle: no implicit trust based on network location; every request is authenticated and authorized regardless of whether it originates "inside" the perimeter.
Candidates sometimes treat "firewall" as synonymous with "network security." On the exam, a firewall is one control among many in a defense-in-depth architecture -- segmentation, IDS/IPS, secure protocols, and monitoring all work together, and no single control is presented as sufficient on its own.
Try it yourself
An interactive CyberAbeer experience for this topic is in development.
Coming soon