CNSP Certification: External Network Security

What this domain tests

External Network Security covers the internet-facing attack surface: DNS, certificates, edge devices, remote access, email authentication, and exposed services. The exam tests discovery discipline and the difference between a finding and a real exposure.

Core rules

• Build the asset inventory from multiple sources: DNS records, certificate transparency, ASN ranges, and subdomain enumeration. Confirm ownership before testing.
• TLS configuration includes protocol versions, cipher suites, certificate chain, and HSTS. Weak TLS is a transport issue, not an application authentication bypass.
• Email controls are separate: SPF authorizes sending IPs, DKIM signs messages, and DMARC applies alignment plus a policy. p=none is monitoring, not enforcement.
• Edge and VPN appliances need MFA, current firmware, and management interfaces that are not internet-facing.
• A 403 or a blank page is not proof that a service is safe; it may be virtual-host routing or a CDN default.

Worked example

A DNS record shop.example.com is a CNAME to an old vendor SaaS hostname. The vendor has deprovisioned the hostname and the target returns a no-such-bucket or unclaimed-service response. Because the CNAME still exists, an attacker who registers that name can serve content under the company's domain. The reasoning: the vulnerability is the dangling DNS record, not the missing HTTP page. Remediation is to remove or repoint the record, then inventory all CNAMEs to third parties. Do not claim the resource to prove it; DNS and provider evidence is enough.

Traps

• Treating wildcard DNS as a subdomain takeover.
• Missing origin IPs behind a CDN.
• Reading DMARC p=none as blocking.
• Reporting scanner output without validating exploitability.