14.1 Manage Network Security

ISC2 Systems Security Certified Practitioner SSCP

Track your progress as you read

Finished sections get a check mark.

1 Introduction and Exam Overview

1.1 Current Exam Facts 1.2 Computerized Adaptive Testing, Scoring, and Retakes 1.3 Eligibility, Associate Pathway, Endorsement, and Maintenance

2 Ethics and Security Concepts

2.1 Comply with Codes of Ethics 2.2 Understand Security Concepts 2.3 Identify and Implement Security Controls

3 Functional Controls, Assets, and Change Management

3.1 Document and Maintain Functional Security Controls 3.2 Support and Implement the Asset Management Lifecycle 3.3 Support and Implement the Change Management Lifecycle

4 Security Awareness and Physical Security Operations

4.1 Support and Implement Security Awareness and Training 4.2 Collaborate with Physical Security Operations

5 Authentication Methods and Trust Architectures

5.1 Implement and Maintain Authentication Methods 5.2 Federated Access with OAuth2, SAML, and OpenID Connect 5.3 Understand and Support Internetwork Trust Architectures

6 Identity Lifecycle and Access Control Models

6.1 Support and Implement the Identity Management Lifecycle 6.2 Mandatory, Discretionary, and Role-Based Access Control 6.3 Rule-Based, Attribute-Based, and Privileged Access Management

7 Risk Management, Visibility, and Legal Concerns

7.1 Risk Management Concepts and Treatment 7.2 Risk Visibility, Reporting, and Threat Intelligence 7.3 Legal and Regulatory Concerns

8 Assessments, Monitoring, and Analysis

8.1 Security Assessments and Vulnerability Management 8.2 Operate and Monitor Security Platforms 8.3 Analyze Monitoring Results

9 Incident Response and Forensic Investigations

9.1 Incident Response: Preparation, Detection, Analysis, and Escalation 9.2 Containment, Eradication, Recovery, and Lessons Learned 9.3 Understand and Support Forensic Investigations

10 Business Continuity and Disaster Recovery

10.1 Business Continuity and Emergency Response 10.2 Disaster Recovery and Restoration Metrics 10.3 Backup, Redundancy, Testing, and Drills

11 Cryptography Foundations

11.1 Reasons and Requirements for Cryptography 11.2 Hashing, Salting, Symmetric, Asymmetric, and ECC 11.3 Digital Signatures, HMAC, Algorithm Strength, and Cryptanalysis

12 Secure Protocols and Public Key Infrastructure

12.1 Understand and Implement Secure Protocols 12.2 Understand Public Key Infrastructure

13 Networking Fundamentals, Attacks, and Access Controls

13.1 Understand and Apply Fundamental Concepts of Networking 13.2 Understand Network Attacks and Countermeasures 13.3 Manage Network Access Controls

14 Network Security Operations, Wireless, and IoT

14.1 Manage Network Security 14.2 Operate and Configure Network-Based Security Appliances and Services 14.3 Secure Wireless Communications 14.4 Secure and Monitor Internet of Things

15 Malware, Malicious Activity, and Endpoint Security

15.1 Identify and Analyze Malicious Code 15.2 Malicious Activity, Social Engineering, and Behavior Analytics 15.3 Implement and Operate Endpoint Device Security

16 Mobile, Cloud, and Virtual Environments

16.1 Administer and Manage Mobile Devices 16.2 Cloud Security: Deployment, Service Models, and Shared Responsibility 16.3 Cloud Legal, Regulatory, and Third-Party Requirements 16.4 Operate and Maintain Secure Virtual Environments

14.1 Manage Network Security

Key Takeaways Explain This Topic AI

SSCP Knowledge Area 6.4 (outline effective 1 October 2025) covers placement of network devices (inline, passive, virtual), segmentation, and secure device management — not just buying a firewall.

Inline devices sit in the forwarding path and can drop traffic; passive TAP or Switched Port Analyzer (SPAN) sensors only see a copy and cannot block.

Virtual local area network (VLAN) tags are not a security boundary by themselves. Pair them with access control lists (ACLs), firewall zones, and micro-segmentation so east-west flows are explicit.

Protect the control plane separately from the data plane. Control-plane policing and management Virtual Routing and Forwarding (VRF) stop a flood of data-plane packets from killing the router CPU.

Secure device management means out-of-band administration, Authentication, Authorization, and Accounting (AAA), unused services disabled, and encrypted off-box configuration backups — not Telnet to the production switch virtual interface.

Last updated: August 2026

Why managing network security is an operations exam topic

Domain 6 of the ISC2 Systems Security Certified Practitioner ( SSCP ) exam — Network and Communications Security — is weighted at 16% under the outline effective 1 October 2025. Knowledge Area 6.4 is Manage network security . The outline names three piles: logical and physical placement of network devices (inline, passive, virtual), segmentation (physical/logical, data/control plane, virtual local area network (VLAN) , access control list (ACL) , firewall zones, micro-segmentation), and secure device management .

This is not a shopping list for a vendor bill of materials. The Computerized Adaptive Testing ( CAT ) items will look like a Tuesday change window: an intrusion prevention system (IPS) hung off a mirror port that never dropped a packet, a camera VLAN that can still route to payroll, a core switch administered with Telnet on the production switch virtual interface (SVI) . Knowledge Area 6.1 already taught you topologies and ports. 6.2 taught attacks and countermeasures. 6.3 taught IEEE 802.1X , Remote Authentication Dial-In User Service (RADIUS) , and Terminal Access Controller Access-Control System Plus (TACACS+) as access protocols. 6.4 asks whether the boxes you already own are in the right place, whether traffic is actually isolated, and whether the administrator path is harder to steal than a workstation.

Logical and physical placement: inline, passive, and virtual

Placement is where the device sits relative to the packets it is supposed to see or stop. Get this wrong and you buy a prevention product that can only write a log.

Placement How packets reach the device Can it drop or reset? Typical SSCP use Failure mode

Inline The device is in the forwarding path; traffic must traverse it Yes — drop, reject, TCP reset, rewrite Firewall, IPS, web proxy, data loss prevention (DLP) that must stop an upload The device is now a choke point. Fail-closed takes the path down; fail-open forwards uninspected traffic

Passive A copy arrives from a network test access point (TAP) or Switched Port Analyzer (SPAN) / mirror session No. Alert, log, and maybe ask another system to block later Network intrusion detection system (NIDS) , packet capture, threat-hunting sensors The original session continues. Oversubscribed SPAN drops the copy; the live path still works

Virtual The function runs as a virtual machine, container, hypervisor vSwitch filter, or cloud security group / network virtual appliance Depends: the logical placement can still be inline (service chain) or passive (mirror to a sensor virtual network interface card (vNIC) ) Software-defined networking (SDN) service insertion, cloud inspection, micro-segmentation agents A vSwitch mirror with no prevent action is still passive, even if the logo says IPS

Inline is how you stop something. A next-generation firewall at the Internet edge, an IPS between the demilitarized zone (DMZ) and the internal virtual local area network (VLAN) , a reverse proxy in front of a patient portal — those boxes only prevent if packets cannot go around them. Hairpinning a copy to a sensor while production uses a bypass switch is not inline. If the stem says "the IPS must block the exploit," the sensor belongs in the forwarding path, with an explicit fail-open or fail-closed decision that matches availability requirements. A hospital pharmacy network often fails open (medication cabinets must keep working). A payment Payment Card Industry (PCI) segment often fails closed (uninspected cardholder traffic is worse than a brief outage).

Passive is how you see something without becoming the outage. A TAP is a hardware splitter that copies frames and usually cannot inject. A SPAN session is a switch feature that mirrors frames to a destination port; it shares the switch fabric, can oversubscribe, and will silently drop the copy under load while the live conversation continues. Passive is the right answer when the requirement is detection, forensics, or a change window that cannot risk a new choke point. It is the wrong answer when the requirement is "stop the session now." A NIDS that pages the security operations center (SOC) after command-and-control ( C2 ) has already uploaded the database is working as designed for detection and failing the prevention objective someone wrote into the ticket.

Virtual does not pick a side. A virtual firewall inserted in an SDN service chain is inline. A virtual sensor attached to a promiscuous port group is passive. Cloud security groups and network access control lists are logical inline filters at the hypervisor or virtual private cloud (VPC) boundary. The exam trick is the word "virtual" in a stem that never says whether prevent actions are enabled. Ask: does the packet have to go through this function, or is the function watching a copy?

Scenario — IPS on a SPAN port. You are the network security administrator for a regional clinic. Leadership bought an IPS license. The integrator, afraid of latency, attached the appliance to a core-switch SPAN of the Internet edge. Two weeks later the SOC has fifty "meterpreter" alerts and zero blocked sessions. The EHR is still reachable from the infected workstation because the live path never traversed the appliance. The SSCP diagnosis is passive placement of a prevention product . Move the function inline (or enable prevent on a firewall that already sits inline) if the objective is block. Keep the TAP/SPAN copy for a NIDS if the objective is alert. Do not rename the SPAN port "inline" in the runbook.

Physical placement still matters even when the function is virtual. Put the inline firewall where the trust boundary actually is: between Internet and DMZ, between DMZ and internal, between guest wireless and corporate, between operational technology (OT) / Internet of Things (IoT) and clinical. A virtual firewall in the wrong VPC, or a physical IPS on the wrong side of the NAT boundary, inspects the wrong traffic. Draw the flows first: who talks to whom, which interface is untrusted, which interface is trusted, what happens if the box dies.

Segmentation: more than a VLAN ID

Segmentation is how you limit blast radius. The outline's examples are physical/logical , data/control plane , VLAN , ACL , firewall zones , and micro-segmentation . Treat them as a stack, not as synonyms.

Technique What it actually isolates What it does not do SSCP operations note

Physical Separate switches, cables, air-gaps, distinct hardware Cheap or convenient Use for high-assurance OT, backup networks, or true air-gaps. Two cables in the same unlocked closet is not an air-gap

Logical VLANs, Virtual Routing and Forwarding (VRF) , overlays such as VXLAN Stop a router from forwarding between VLANs Logical isolation is real only if the Layer 3 device refuses the route

Data plane vs control plane Data plane forwards user packets; control plane is routing, ARP, management CPU "The network is up" if the CPU is dead Control-plane policing (CoPP) and management VRF keep floods from killing the box

VLAN Layer 2 broadcast domain Authenticate users or inspect HTTP VLAN hopping, native-VLAN mismatch, and unrestricted inter-VLAN routing undo the picture on the whiteboard

ACL Permit/deny by IP, port, protocol, sometimes user/SGT Application identity by itself Apply closest to the source or on the Layer 3 boundary; "permit ip any any" at the bottom is not a design

Firewall zones Trust labels (Untrust, DMZ, Internal, Guest, PCI) with default-deny between zones Host-by-host east-west inside a zone Zone policy is how you say "guest may hit DNS and a proxy, never the EHR"

Micro-segmentation Workload-to-workload policy (hypervisor, agent, or cloud security group) A substitute for a missing Internet firewall Stops east-west ransomware from a printer VLAN to a domain controller even when both VLANs are "internal"

Physical versus logical. Physical segmentation is separate hardware and often separate people. A backup network that shares the production core is not physically segmented. Logical segmentation is cheaper and is how most enterprises isolate guest, voice, PCI, and IoT. The exam will offer "buy a second switch" when an ACL plus a firewall zone would meet the requirement — and it will offer "we have VLANs" when the routing table still has a default between them.

Data plane and control plane. The data plane is the forwarding path: switching ASICs, routing lookups, NAT. The control plane is how the device learns and is administered : Open Shortest Path First ( OSPF ), Border Gateway Protocol ( BGP ), Spanning Tree, Secure Shell (SSH) to the CPU. A distributed denial of service that never matches a firewall rule can still punt packets to the CPU and take down BGP. CoPP rate-limits what the CPU will process. A management VRF or dedicated out-of-band (OOB) network keeps SSH and TACACS+ off the same path as YouTube. Software-defined networking (SDN) makes this explicit: the controller is control plane; the vSwitch is data plane. Compromise of the controller is compromise of every virtual firewall policy. Protect the controller like a domain controller, not like a lab hypervisor.

VLANs carve one physical LAN into multiple broadcast domains. That is necessary and not sufficient. Hosts in VLAN 20 (cameras) and VLAN 30 ( electronic health record (EHR) workstations) still talk the moment a Layer 3 SVI exists with a default route and no ACL. Attackers also abuse VLAN hopping (double tagging against a native VLAN, or a rogue trunk). Operations hygiene: do not use VLAN 1; change the native VLAN on trunks; prune unused VLANs; disable Dynamic Trunking Protocol where you do not need it; put unused ports in a black-hole VLAN and shut them.

ACLs are the first enforcement layer many SSCPs actually type. Standard ACLs match source IP; extended ACLs match source, destination, protocol, and ports. Apply them inbound on the interface closest to the source when you can, so denied packets die before they consume core bandwidth. Remember implicit deny. Remember that an ACL on a router is not a stateful firewall unless the platform is tracking connections — a later 6.5 topic. An ACL that permits tcp any any eq 443 to the EHR is not "HTTPS security"; it is a port allow.

Firewall zones wrap ACLs in a default-deny trust model. You assign interfaces to zones (Untrust, DMZ, Internal, Guest, IoT, PCI) and write the allowed conversations: Guest → Proxy:TCP/443; IoT → Video management:TCP/554; PCI → Payment processor:TCP/443. Everything else is dropped and logged. Zones scale better than a 400-line interface ACL that nobody dares to edit. They also match how CAT stems are written: "the guest zone should not reach the EHR zone."

Micro-segmentation is policy at the workload, not at the subnet. Two application servers in the same VLAN should not be able to Remote Desktop Protocol (RDP) to each other just because they share a prefix. Hypervisor firewalls, host agents, and cloud security groups implement this. Ransomware that lands on a kiosk should not have Layer 3 adjacency to the imaging archive. Micro-segmentation does not replace the Internet firewall. It is how you survive the host that is already inside.

Scenario — VLANs without enforcement. Finance is VLAN 40. Clinical workstations are VLAN 30. The core has SVIs for both and a default permit. A phishing implant on a finance PC scans 10.30.0.0/16 and finds the EHR. The diagram in the audit binder said "segmented." The SSCP answer is: add ACLs or, better, firewall zones that allow only the flows the business named (for example finance print servers and a jump host), and use micro-segmentation if east-west inside VLAN 30 is still too open. Do not claim VLAN IDs as a control in the risk register.

Secure device management

The outline's third bullet is secure device management . Firewalls, switches, wireless controllers, and virtual appliances are privileged endpoints. If an attacker owns the core switch, segmentation is a story you tell yourself.

Control What to do What "done" looks like

Out-of-band management Dedicated management network, console server, or management VRF; do not share the production SVI A data-plane outage or a compromised user VLAN does not become SSH to the core

In-band (if you must) Management through production, restricted by ACL to jump hosts, still encrypted Acceptable as a backup path, not as the only path for a device that enforces policy

Disable unused services No Telnet, no HTTP admin, no Simple Network Management Protocol (SNMP) v1/v2c communities, no unused routing protocols, no unused physical ports show ip sockets / equivalent is a short list you can explain

AAA TACACS+ (or RADIUS) for device administrators; local admin only as break-glass Named accounts, command authorization, accounting of who typed erase

Encrypted administration SSH, HTTPS, SNMPv3 Telnet and HTTP to network gear are findings, not "temporary"

Configuration backups Versioned, encrypted, off-box, with a tested restore and change control Ransomware on the jump host does not delete the only copy of running-config

Time and logging Network Time Protocol (NTP) to a trusted source; syslog/trap to a collector that the device cannot wipe Incident timelines need the same clock

Out-of-band means the packets that administer the device do not ride the same path as the packets the device forwards. A console server on a separate switch, a management VRF that only jump hosts can route to, a lights-out card — those survive a data-plane incident. In-band management is convenient and is how many branch routers are reached, but when that WAN circuit is the incident, you have no lever. The SSCP preference in a stem that offers both is OOB for core and security appliances, with a documented break-glass console.

Disable unused services is hardening, not decoration. Telnet on TCP/23, HTTP on TCP/80, Cisco Discovery Protocol on user ports, Universal Plug and Play on a firewall, default SNMP communities public / private , and unused Layer 3 protocols are all remote-control or reconnaissance gifts. Shut unused switch ports and put them in an unused VLAN. Change default credentials on day zero — Knowledge Area 6.7 will say the same for cameras; 6.4 says it for the switch the cameras plug into.

AAA for devices is usually TACACS+ because it can authorize commands (no configure terminal for the help-desk role) and because accounting is granular. RADIUS is common for 802.1X network access (6.3). Do not mix them up on the exam: RADIUS to let a laptop on a VLAN is not the same as TACACS+ to let a named engineer change an ACL. Local accounts are the break-glass when the AAA server is down; they are unique, vaulted, and monitored, not admin/admin .

Configuration backups are part of change and recovery, not a nightly courtesy. Store them off the device, encrypted, with version history that maps to change tickets. Test a restore on a spare or a lab image. After a ransomware event that hits the network team's file share, the person who can still bring up a replacement firewall is the person whose backups were not only on that share.

Scenario — in-band Telnet. The core pair is managed by Telnet to the production SVI. SNMP v2c community public is used for graphing. The only copy of the configuration is running-config . An implant on a user VLAN brute-forces Telnet, dumps the config (including the SNMP community and the TACACS key if it was stored), and erases the startup file. Segmentation, IPS placement, and VLAN design are now whoever the attacker wants them to be. The SSCP fix is OOB or a locked-down management VRF, SSH/HTTPS only, AAA with named accounts, unused services off, SNMPv3, and encrypted off-box backups that a compromised data-plane host cannot delete.

Exam traps for 6.4

Calling a SPAN/TAP sensor "inline" because the purchase order said IPS.

Treating VLAN IDs as a control when inter-VLAN routing is unrestricted.

Forgetting that the control plane can die while the data plane still forwards stale entries — or the reverse.

Managing security appliances in-band with Telnet so the incident takes the lever with it.

Micro-segmentation as a reason to remove the Internet firewall.

When you sit the item, ask three questions: Does this box sit in the path or on a copy? What actually drops a packet between these two subnets? How would I still administer this device if the production VLAN were hostile?