5. Domain 4 — Communication and Network Security (13%)

Networks are the highways that connect every other security domain's assets, users, and services. Every data transmission, every authentication event, every API call traverses network infrastructure — and every hop is a potential interception or manipulation point. Domain 4 is where the abstract security principles from Domain 3 become physical packets, protocol exchanges, and firewall rules.

At 13% weight, Domain 4 spans from Layer 1 physical media through Layer 7 application protocols, and from legacy serial connections to modern SDN and wireless architectures. The CISSP doesn't test you as a network engineer — it tests whether you understand the security implications of architectural decisions: where to place controls, which protocols are secure versus deprecated, and how network attacks exploit architectural weaknesses.

⚠️ Domain Trap: Domain 4 questions are heavily scenario-based — "A company needs to connect two branch offices securely over the internet. Which solution provides encryption AND authenticates both endpoints?" — requiring you to match solution characteristics to requirements, not just recall protocol names. Knowing that IPsec exists is insufficient; you must know when IPsec is the right answer versus TLS versus SD-WAN.