I85PREP
⌘ K
GISP study materials
GISP study resources

GISP: Communication and Network Security: Segmentation, Filtering, and Secure Protocols

GISP · Work through your exam, one topic at a time.

All guide sections

Communication and Network Security: Segmentation, Filtering, and Secure Protocols

What this domain tests

Domain 4 moves from architecture to data in motion. The exam tests whether you can place a control at the right layer, design deny-by-default filtering between zones, choose protocols that still make sense in 2024 and beyond, and recognize where encryption stops protecting you.

Core rules

  • Map controls to layers: switches and ARP at layer 2, routers and IPsec at layer 3, stateful firewalls at layer 3-4, proxies and web application firewalls at layer 7. ARP spoofing and VLAN hopping are layer 2 attacks, which is why segmentation needs ACLs and native VLAN hygiene, not just separate VLAN IDs.
  • Firewalls follow default deny with an implicit deny at the end. Rule order matters, stateful devices track sessions, and any allow rule should name source, destination, port, and purpose. Microsegmentation pushes policy to individual workloads rather than subnets.
  • IDS detects and alerts, often from a span port or tap; IPS sits inline and can block. A tap-based sensor can never drop traffic, a common exam discriminator.
  • Wireless: WPA3 uses SAE to resist offline dictionary attacks; 802.1X with EAP gives per-user credentials and accounting, while a shared pre-shared key does not. Rogue access points and evil twins require monitoring and client configuration controls.
  • Choose secure replacements: SSH for Telnet, SFTP or SCP for FTP, TLS 1.2+ for HTTP, SNMPv3 for SNMPv1. DNSSEC signs records for integrity and origin authentication but does not encrypt queries; DoH and DoT provide confidentiality.
  • IPsec uses AH for integrity and ESP for confidentiality plus integrity; transport mode protects host-to-host payloads, tunnel mode protects site-to-site traffic.

Worked example

A public web application needs a database that must never be reachable from the internet. Place a reverse proxy or WAF in the DMZ accepting 443 from any source; allow only that proxy to reach the application tier on 8443; allow only the application tier to reach the database on 5432; deny everything else explicitly and log denies. The database has no internet route, and administrative access flows through a bastion host with multi-factor authentication. The reasoning: each hop narrows the source, so a compromised web tier cannot reach the database directly.

Traps that cost marks

  • Treating a VLAN alone as a security boundary without filtering between segments.
  • Claiming an inline IPS function for a sensor cabled to a span port.
  • Saying WPA2-Personal provides per-user accountability; the pre-shared key is shared.
  • Assuming HTTPS protects data from internal actors or from malicious code on an endpoint, where traffic is already decrypted.