I85PREP
⌘ K
CNPE study materials
CNPE study resources

CNPE: Network Governance and Professional Practice

CNPE · Work through your exam, one topic at a time.

All guide sections

Network Governance and Professional Practice

The Network Governance and Professional Practice domain tests the controls around the network: change, risk, documentation, continuity and conduct. These questions are marked on precision of terms, not opinion.

Change and risk

  • Normal changes need a request, impact analysis, rollback plan and CAB approval. Standard (pre-approved, repeatable, low risk) and emergency changes still get recorded - an emergency change documented afterwards is compliant; one never documented is not.
  • A rollback plan states the trigger, the steps and the time limit. No rollback, no approval.
  • Risk assessment scores likelihood and impact; a control lowers one or both. Residual risk is accepted by the business owner, never by the engineer alone.

Continuity and documentation

  • RTO is how long a service may be down; RPO is how much data you may lose. An RPO of 15 minutes requires replication or snapshots at least every 15 minutes; an RTO of one hour constrains the failover mechanism, not the backup interval.
  • Backups follow 3-2-1: three copies, two media, one off-site - and only a restore test proves them.
  • Keep high-level and low-level designs, as-built diagrams, rack and patching records, an IPAM source of truth, and asset records with end-of-sale and end-of-support dates.
  • Runbooks and a searchable knowledge base shorten MTTR; post-incident reviews are blameless and produce tracked actions.

Compliance and conduct

  • Frameworks map to obligations: PCI DSS for card data, HIPAA for health information, GDPR for EU personal data, ISO/IEC 27001 for an information security management system, SOC 2 for service-provider controls. Audits need evidence, so retain logs and change records for the defined period.
  • Professional practice: work within your competence, keep client data confidential, declare conflicts of interest, report findings accurately including bad news, and never test a system without written authorisation.

Worked example

An order system must survive a site loss with RTO 1 hour and RPO 15 minutes. Nightly tape backups satisfy neither: the RPO permits up to 24 hours of lost orders. The design needs log shipping or snapshots every 15 minutes, plus a warm standby that can be promoted and verified inside 60 minutes. Quote both numbers in the answer; designs that cite only one are incomplete.

Traps that cost marks

Swapping RTO and RPO. Treating an untested backup as a control. Skipping documentation because the change was urgent. Assuming a compliance certificate means the network is secure rather than that controls were evidenced on a given date.