5.7 Communication and Network Security Case Lab

CISSP Study Guide Exam

Track your progress as you read

Finished sections get a check mark.

1 Chapter 1: CISSP Orientation, CAT, and Official Source Control

1.1 Credential Scope, CISSP Mindset, and Search Language 1.2 Exam Outline Effective Date and Eight-Domain Map 1.3 CAT Format, 100-150 Items, and Forward-Only Rules 1.4 Passing Grade, Results, Feedback, and Retake Policy 1.5 Experience, Endorsement, and Associate of ISC2 Path 1.6 Pricing, AMF, CPE, and Maintenance Overview

2 Chapter 2: Security and Risk Management

2.1 Professional Ethics, CIA, and Security Governance 2.2 Policies, Standards, Procedures, Guidelines, and Control Ownership 2.3 Legal, Regulatory, Privacy, and Investigation Context 2.4 Risk Identification, Analysis, Treatment, and Reporting 2.5 Business Continuity, BIA, and Recovery Prioritization 2.6 Personnel Security, Training, Awareness, and Culture 2.7 Threat Modeling, Supply Chain Risk, and Third-Party Governance 2.8 Security and Risk Management Case Lab

3 Chapter 3: Asset Security and Data Lifecycle

3.1 Asset and Data Classification, Ownership, and Roles 3.2 Handling Requirements, Labeling, Privacy, and Cross-Border Data 3.3 Data States and Protection Methods: DLP, DRM, and CASB 3.4 Data Lifecycle, Retention, Remanence, and Destruction 3.5 Secure Provisioning, Inventory, and Asset Management 3.6 Asset Security Case Lab

4 Chapter 4: Security Architecture, Engineering, and Cryptography

4.1 Secure Design Principles and Security Models 4.2 Control Selection, System Security, and Architecture Risk 4.3 Cryptography Foundations: Symmetric, Asymmetric, Hashing, and PKI 4.4 Cryptographic Lifecycle, Key Management, and Attack Patterns 4.5 Cloud, Container, IoT, Edge, and Shared Responsibility Architecture 4.6 Physical Site, Facility, and Environmental Security 4.7 Information System Lifecycle Engineering and Retirement 4.8 Architecture and Engineering Case Lab

5 Chapter 5: Communication, Network Security, and Zero Trust

5.1 Network Architecture, OSI/TCP/IP, and Secure Design 5.2 Secure Protocols, Encryption in Transit, and Channel Protection 5.3 Segmentation, Microsegmentation, SDN, VPC, and Zero Trust 5.4 Wireless, Cellular, Remote Access, and Third-Party Connectivity 5.5 Network Components: NAC, IDS/IPS, Firewalls, and Endpoints 5.6 Monitoring, Observability, Capacity, and Resilient Communications 5.7 Communication and Network Security Case Lab

6 Chapter 6: Identity and Access Management

6.1 Identity Proofing, Authentication, Authorization, and Accountability 6.2 Access Control Models: RBAC, MAC, DAC, ABAC, and Risk-Based Access 6.3 Federation, SSO, MFA, Passwordless, and Session Management 6.4 Provisioning, Deprovisioning, JML, and Access Reviews 6.5 Service Accounts, Non-Human Identities, and Privilege Management 6.6 Physical, Logical, Cloud, and Hybrid Access Boundaries 6.7 IAM Case Lab

7 Chapter 7: Security Assessment, Testing, and Audit Strategy

7.1 Assessment, Test, and Audit Strategy Selection 7.2 Control Testing, Vulnerability Assessment, and Penetration Testing 7.3 Log Review, Code Review, Misuse Cases, and Compliance Checks 7.4 Security Process Data, KPIs, KRIs, and Reporting 7.5 Remediation, Exceptions, Risk Acceptance, and Evidence Quality 7.6 Security Assessment and Testing Case Lab

8 Chapter 8: Security Operations, Incident Response, and Resilience

8.1 Investigations, Evidence, Forensics, and Legal Readiness 8.2 Logging, Monitoring, SOC, and Alert Triage 8.3 Configuration, Change, Patch, and Vulnerability Operations 8.4 Incident Management, Containment, Eradication, and Recovery 8.5 Disaster Recovery, Backup, Availability, and Resilience 8.6 Physical Security Operations and Safety 8.7 Security Operations Case Lab

9 Chapter 9: Software Development Security and DevSecOps

9.1 Secure SDLC Governance and Requirements 9.2 Architecture, Threat Modeling, and Design Review 9.3 Secure Coding, Code Review, and Application Testing 9.4 CI/CD, Source Control, and Environment Separation 9.5 Software Supply Chain, Third-Party Components, and Deployment 9.6 DevSecOps Vulnerability Management and Release Risk 9.7 Software Development Security Case Lab

10 Chapter 10: Integrated CISSP Governance Scenario Labs

10.1 Enterprise Risk Committee Decision Lab 10.2 Cloud Migration Security Architecture Lab 10.3 Ransomware Incident and Business Continuity Lab 10.4 Identity Modernization and Zero Trust Lab 10.5 Third-Party Breach and Contract Governance Lab 10.6 Secure SDLC Transformation Lab 10.7 Full CISSP Manager Simulation

11 Chapter 11: Final Review, Endorsement, CPE, and Test-Day Strategy

11.1 Final 45-Day CISSP Study Plan 11.2 CAT Timing and Forward-Only Decision Workflow 11.3 Mixed-Domain Remediation and Manager Mindset Review 11.4 Test-Day Checklist and Pearson VUE Readiness 11.5 Endorsement, Associate Path, and Work Experience Documentation 11.6 CPE, AMF, and Three-Year Maintenance Plan 11.7 CISSP Final Mixed Review

5.7 Communication and Network Security Case Lab

Key Takeaways Explain This Topic AI

Case analysis should begin with business objectives, critical assets, threat scenarios, regulatory duties, and operational constraints.

A defensible network design uses layered controls across identity, segmentation, secure channels, endpoint security, monitoring, and resilience.

Tradeoff analysis is essential because stronger inspection, segmentation, or remote access controls can affect latency, supportability, and availability.

Risk registers, decision memos, and phased implementation plans help leaders communicate why controls were chosen and what residual risk remains.

The best case-lab answers avoid single-control thinking and explain how prevention, detection, response, and recovery work together.

Last updated: May 2026

Case scenario: hybrid claims platform

A regional insurance company runs a claims platform used by customers, employees, adjusters, and repair partners. The public portal is hosted in a cloud VPC. Core policy data remains in an on-premises data center. Adjusters work from the field using managed laptops and cellular connections. Repair partners need limited access to upload documents and status updates. The board is concerned about ransomware, customer data exposure, outage during storms, and audit findings from broad internal network access.

Start with business outcomes. Customers must file claims during severe weather events. Employees need reliable access to claims workflows. Partners need only the functions related to assigned claims. Policy databases contain sensitive personal data and must not be reachable from general user networks. Incident responders need out-of-band communication and administrative access if the primary network is degraded. These statements guide the network design better than a generic goal to improve security.

A reasonable target architecture uses a cloud edge with DDoS protection, WAF or API protection, TLS with managed certificate lifecycle, private connectivity between cloud and data center, and a restricted service tier that talks to on-premises data through approved ports. Internal users access applications through identity-aware access or VPN with MFA and device posture. Administrators use privileged access workstations or bastion services. Partners use a portal or API gateway, not broad VPN access.

Requirement Control choice Residual risk to document

Public customer portal WAF, TLS, DDoS, secure DNS, monitoring App logic flaws still need SDLC controls.

Cloud to data center data access Private link or VPN, firewall allowlist, mutual authentication Link outage needs queued or degraded processing.

Field adjuster access Managed devices, MFA, ZTNA or VPN, cellular policy Lost devices and weak local networks remain possible.

Partner uploads Partner portal, least privilege, malware scanning, audit logs Partner account compromise still needs detection.

Ransomware containment Segmentation, EDR, immutable backups, restricted admin paths Recovery time depends on testing and dependency mapping.

Decision memo and implementation plan

The decision memo should explain why broad network trust is being removed. The current flat internal access lets user workstations reach too many server networks, which increases ransomware blast radius. The future state separates user, application, data, management, partner, and backup environments. It also uses identity-aware access for remote users, monitored administrative paths, and explicit application flows. The risk reduction is improved containment, better audit evidence, and faster incident scoping.

The memo should also acknowledge tradeoffs. More segmentation can initially increase troubleshooting time. TLS inspection can create privacy and application compatibility issues. Full-tunnel remote access can increase bandwidth needs. Microsegmentation depends on accurate flow mapping. Partner access changes may require contract updates and support coordination. Leadership should see that these are managed implementation risks, not reasons to keep broad trust.

A phased plan reduces outage risk. Phase one inventories data flows, certificates, remote access groups, firewall rules, partner accounts, and monitoring gaps. Phase two implements logging improvements, MFA enforcement, certificate ownership, and firewall rule cleanup. Phase three moves high-value databases into restricted segments and pilots microsegmentation for the claims application. Phase four replaces broad partner VPN access with a portal or API gateway. Phase five tests failover, incident response, and recovery communications.

Case analysis workflow:

Identify business services, critical data, users, partners, and recovery objectives.

Draw trust boundaries and normal data flows before selecting controls.

Select layered controls for ingress, egress, lateral movement, remote access, administration, and monitoring.

Record tradeoffs, owners, implementation dependencies, and residual risk.

Validate with tabletop exercises, technical tests, and recurring access reviews.

The final answer should sound like a security leader, not a device catalog. It should explain that a WAF reduces some web attack risk but does not replace secure coding. It should explain that segmentation reduces lateral movement but must be paired with backups and endpoint containment for ransomware. It should explain that secure remote access protects field work but must preserve claims operations during storms. Defense in depth is valuable because each layer assumes another layer may fail.