Domain 4 covers network architecture and secure communication: the OSI and TCP/IP models, network protocols and their vulnerabilities, secure network components (firewalls, VPNs, network segmentation), and wireless security. It's another technically dense domain (13% weight) that rewards genuinely understanding how traffic actually moves through a network, not just memorizing which layer a protocol "belongs to."
OSI model layers
Physical, Data Link, Network, Transport, Session, Presentation, Application, from bottom to top. Know which layer common devices and attacks operate at: a switch operates at Layer 2, a router at Layer 3, and many exam questions hinge on identifying the layer of a given attack or control.
TCP three-way handshake
SYN, then SYN-ACK, then ACK. Understanding this is essential for grasping SYN flood attacks and stateful firewall inspection, both of which show up regularly.
Firewall generations
Packet-filtering (stateless, header only), then stateful inspection (tracks connection state), then application-layer/proxy (inspects payload), then next-gen (adds intrusion prevention, deep packet inspection, identity awareness).
VPN protocols
IPSec (network-layer, tunnel or transport mode) vs. TLS-based VPNs (application-layer, easier through firewalls/NAT). Know that IPSec tunnel mode encrypts the whole original packet including headers, while transport mode only encrypts the payload.
Network segmentation and Zero Trust
VLANs, DMZs, and microsegmentation limit lateral movement. Zero Trust extends this to "never trust, always verify" for every request regardless of network location, a heavily emphasized modern concept.
IPSec tunnel mode vs. transport mode
Tunnel mode encrypts the entire original IP packet (used for site-to-site VPNs); transport mode only encrypts the payload, leaving the original IP header exposed (used for end-to-end host communication).
Stateful vs. stateless firewall
Stateless evaluates each packet independently against static rules; stateful tracks the state of active connections and can make decisions based on context, such as automatically allowing return traffic for an established session.
Practice D4 questions with instant feedback, free to start, no card required.
Start Free