Domain 4 Practice Test: Communication and Network Security

How to take this test

This test covers everything Domain 4 taught in Chapters 16 and 17: the layered model and the devices that live in it, addressing and encapsulation, segmentation from subnets and VLANs to DMZs and NAC, wireless security from WPA3 to 802.1X, the secure channels that seal traffic (TLS, IPsec, SSH, DNSSEC, S/MIME, MACsec), the remote access designs built from them, and the attack and countermeasure pairs that run from ARP poisoning to deauthentication floods. Twenty-five questions cannot sample a domain this wide the way the adaptive exam does, but every stem here is built on a decision the real exam actually scores, so a wrong answer tells you which pattern you are missing rather than which fact you forgot.

Set the clock to thirty minutes before you read the first stem: a minute and a quarter per item, the pace this book assumes for a full 150-item session. Answer every question, including the ones you would rather skip, because a blank is wrong and the engine never asks why you submitted what you did. Do not look at the answer key early, and do not return to a question once you have moved past it. The real exam offers no item review, and the practice that transfers is the practice that reproduces that constraint. When a question makes you guess, guess, and keep moving; the score sheet will do the analysis afterward.

One habit matters more than any protocol list in this domain. Before you choose, name the attacker’s position: is this someone on the local segment, someone on the wire between two sites, someone on the other side of the Internet, or someone who has never touched the network at all? The exam almost never tells you the defense directly. It tells you where the attacker stands and what the attacker observes, and the correct control is the one that breaks the observation at that specific point. A question about a client whose traffic is leaving the building through the wrong door is an ARP question, not an encryption question, even though encryption is the more famous answer. Match the position to the property, then pick the control that restores the property at the place the stem described.

When you are done, score yourself honestly and read the score interpretation before you touch anything else. The number is a triage instrument, not a verdict. It tells you which of the two preceding chapters deserves your next study hours, and that is worth more than the number itself.

The 25 questions

1. A network administrator is tracing a slow transfer between a branch office and headquarters. The technician reports that the access switch forwards each frame on its destination MAC address, the distribution router chooses the next hop from the destination IP address, and the security appliance at headquarters permits or drops based on the TCP ports in each flow. Which statement correctly pairs each device with the layer at which it makes its decision?

   A. The switch forwards at Layer 2, the router at Layer 3, and the appliance’s port decision happens at Layer 4 B. All three devices forward at Layer 3, because routing is the only forwarding decision that matters C. The switch works at Layer 4, the router at Layer 2, and the appliance at Layer 3 D. The switch works at Layer 1, the router at Layer 4, and the appliance at Layer 2

2. Overnight, a public web server becomes unreachable. Packet captures show thousands of TCP SYN packets arriving from randomized source addresses, none followed by the ACK that completes the handshake, and the server’s table of half-open connections is full. What is the most likely explanation, and which control keeps the service available?

   A. MAC flooding is filling the switch forwarding table; enable port security B. DNS cache poisoning is redirecting the traffic; enable DNSSEC validation C. ARP poisoning is redirecting the connections; deploy dynamic ARP inspection D. A SYN flood is exhausting the server’s connection queue; enable SYN cookies so the server can defer state until the handshake completes

3. A bank’s network terminates remote staff VPN connections in its DMZ and proxies web traffic for a public-facing application. The security team needs a device that can inspect the application protocol itself, terminate and re-create each connection, and enforce per-user policy before traffic enters the internal network. Per NIST SP 800-41, which firewall type fits best?

   A. MAC-layer bridge filtering B. An application proxy (application gateway) C. A stateless packet filter D. A stateful inspection firewall

4. A mid-size company must publish a web storefront for customers and let partners reach an order API, while keeping internal workstations and file servers unreachable from the Internet. Which architecture best serves these requirements?

   A. Put the servers on the internal LAN and let the edge router forward inbound traffic directly to them B. Give the servers public addresses and rely on their host firewalls for protection C. Place the web server and API in a DMZ with default-deny rules between all three zones, allowing inbound only for the services the business publishes D. Duplicate the services to a second ISP and treat redundancy as the security control

5. An auditor finds that the office wireless network uses WPA2-Personal with an eight-character shared passphrase. An attacker captured a 4-way handshake and recovered the passphrase offline, then joined the network. Which change most directly closes the demonstrated weakness?

   A. Disable SSID broadcast and add a MAC address allow list B. Move to WPA3-Personal with SAE, whose simultaneous authentication resists offline dictionary attacks on the password C. Extend the WPA2 passphrase to twenty characters and rotate it quarterly D. Reduce the transmit power of the access points so the signal does not reach the parking lot

6. Employees in one department report that browsing is slow and every page shows a certificate warning. Analysis shows each workstation’s ARP cache maps the default gateway’s IP address to a MAC address belonging to a machine connected to the guest network. Which control prevents this specific attack?

   A. Firewall rules that allow only port 443 outbound B. Longer Wi-Fi passwords on the guest network C. Static routes with ARP disabled on every workstation D. Dynamic ARP inspection, which validates ARP packets against the DHCP snooping binding table and drops the invalid ones

7. A switch in a public lobby begins receiving frames with random source MAC addresses at high rate, and it starts forwarding traffic to every port in its broadcast domain, where a capture device collects it. Which control stops the switch from behaving like a hub?

   A. Spanning Tree Protocol with BPDU guard on the edge B. Port security with a per-port MAC address limit and shutdown on violation C. Enlarging the switch’s MAC address table D. 802.1X authentication on the uplink only

8. A penetration tester on a guest VLAN sends an 802.1Q frame carrying two VLAN tags toward the trunk. The access switch strips one tag and forwards the frame onto a server VLAN the tester should not reach. What is this technique, and which configuration change closes it?

   A. MAC spoofing; enable sticky MAC learning on the access ports B. DHCP starvation; enable DHCP snooping on the segment C. Spanning-tree abuse; enable root guard on the access switches D. Double-tagging VLAN hopping; set the native VLAN to a dedicated unused VLAN and disable trunking on access ports

9. The firewall log shows two oddities: inbound packets claiming source addresses from inside the organization’s RFC 1918 range, and outbound packets claiming source addresses from the organization’s public prefix that the sending host does not own. Which control set addresses both problems?

   A. DNSSEC validation on the recursive resolvers B. Restricting DHCP leases to known MAC addresses C. Ingress and egress filtering per BCP 38 (RFC 2827), plus unicast reverse path forwarding per RFC 3704 where the topology allows D. Forcing TLS on all egress traffic

10. An employee plugs a personal switch into the wired network to add more ports. Shortly after, traffic patterns change and parts of the network become unstable because the personal switch has begun participating in spanning-tree elections. Which control stops this abuse at the edge?

    A. BPDU guard on edge ports, which shuts the port down if it receives a bridge protocol data unit B. Sticky MAC port security C. Dynamic ARP inspection D. DHCP snooping on the uplink

11. A game studio’s authentication servers are hit by a flood of responses from thousands of DNS resolvers worldwide, each response larger than the query that triggered it, with spoofed source addresses pointing at the studio’s servers. What is this called, and which mitigation is most directly effective?

    A. A SYN flood; enable SYN cookies on the authentication servers B. A reflection and amplification DDoS; reduce the impact with source-address validation, rate limiting at the reflecting infrastructure, and filtering at the network edge C. DNS tunneling; block all large DNS responses D. A MAC flood; enable port security

12. A user navigates to a banking site and the browser shows the bank’s name and a padlock, but the session is being observed by a third party that supplied the DNS answer. Investigators find the recursive resolver’s cache was loaded with fraudulent A records for the bank’s domain. Which control ensures that DNS answers cannot be silently forged?

    A. HTTP Strict Transport Security on the client browsers B. A firewall rule blocking UDP port 53 C. Rotating the bank’s TLS certificates D. DNSSEC validation per RFC 4033, which authenticates DNS records with signatures chained to a trust anchor

13. Network monitoring shows a single workstation generating a steady stream of DNS queries for unusual hostnames under an innocuous-looking domain, with responses of comparable size. The workstation’s owner denies using any such service. What is the most likely explanation, and which detection approach fits?

    A. DNS tunneling, data encoded in the query and answer streams; detect it with traffic baselining and analysis of query volume, entropy, and domain patterns B. A DNS amplification attack originating from the workstation C. Normal recursive resolution; no action is needed D. MAC address spoofing; enable port security

14. A compliance review finds a legacy application still negotiating TLS 1.0 and accepting RSA key exchange. The reviewer’s concern is that an attacker recording traffic today could decrypt past sessions if it later obtains the private key or enough computing power. Which upgrade most directly addresses this concern?

    A. Keep TLS 1.0 but lengthen the certificate key to 4096 bits B. Add OCSP stapling to the server configuration C. Move to TLS 1.3 per RFC 8446, whose mandatory forward-secret key exchange means compromising the long-term key cannot decrypt previously recorded sessions D. Switch the cipher suite to RC4 for compatibility

15. An e-commerce team finds that customers who click an ad or type a shortened URL occasionally load the site over plain HTTP, and an attacker between them and the site rewrites links and captures the session. Which mechanism forces the browser to use the protected channel and closes this specific downgrade?

    A. HTTP Strict Transport Security (HSTS) per RFC 6797, which instructs the browser to use HTTPS for the domain and refuse plaintext B. Longer session timeouts on the web application C. DNSSEC on the site’s domain D. HTTP/2 multiplexing on the web server

16. A relying party must know, at the moment of a high-value transaction, whether the counterparty’s certificate is still valid. The certificate itself contains a URL the client can query for a real-time answer. Which mechanism provides per-certificate status at the moment it is needed?

    A. A certificate revocation list per RFC 5280, downloaded on a schedule B. Certificate pinning of the server’s public key C. The certificate’s serial number, checked against a stored database D. The Online Certificate Status Protocol (OCSP) per RFC 6960, which returns good, revoked, or unknown for a single certificate

17. Two offices connect through the Internet with a site-to-site VPN. The architects must protect the entire tunneled packet, including its inner IP headers, from inspection and modification, and they need confidentiality, integrity, and replay protection together. Which protocol and mode delivers exactly that?

    A. AH in transport mode per RFC 4302, which authenticates the original packet B. ESP in tunnel mode per RFC 4303, which encrypts and authenticates the whole inner packet inside a new outer IP header C. ESP in transport mode, which protects only the payload of the original packet D. TLS in record mode, used without IPsec

18. A hospital’s remote clinicians connect over a VPN. A security review notes that only traffic destined for the hospital network goes through the tunnel, while all other traffic leaves through the clinician’s local connection. What is this arrangement called, and what risk does it create?

    A. Split tunneling, and the exposure is that the clinician’s local network, and anything on it, can reach the hospital side of the tunnel; full tunneling moves all traffic through the inspected gateway B. Full tunneling, and the exposure is latency; split tunneling should be enabled instead C. Split tunneling, and the risk is solved by enabling WPA2 on the clinician’s local network D. Split tunneling, and medical regulation requires it, so the risk must be accepted

19. An administrator must manage a router’s configuration remotely from a workstation on an untrusted network. Which protocol choice fits, and why?

    A. Telnet, because it is simpler and the router is a single appliance B. SNMPv2 with community strings, because it is faster for configuration C. TFTP for the configuration transfer, because it uses a lightweight connection D. SSH per RFC 4251, which authenticates the host and encrypts the session, replacing the cleartext of the older tools

20. A network team must collect performance statistics from dozens of switches over the network. The previous setup used SNMP community strings sent in cleartext, and an attacker both read and modified the values. Which standard addresses this failure?

    A. SNMPv1 with longer community strings B. ICMP echo monitoring on the switches C. SNMPv3 per RFC 3411, whose user-based security model provides message integrity, authentication, and optional encryption D. NetFlow v5 exported over UDP

21. A voice over IP system records a valid call and replays the same signaling and media later to re-create the session. The protocol designers add a counter and a timestamp that the receiver checks before accepting a message. What property does this protect?

    A. Sniffing, by making the payload hard to read B. Replay, by binding each message to a nonce, timestamp, or sequence number the receiver verifies C. Source spoofing, by packet filtering at the edge D. Denial of service, by rate limiting

22. An attacker observes a client’s TCP session, predicts the sequence numbers, and injects packets that the server accepts as belonging to the client’s connection. Which control class addresses this attack directly?

    A. Blocking all inbound ICMP traffic B. Limiting the TCP window size on the server C. Enabling DHCP snooping on the segment D. Randomizing initial sequence numbers per RFC 1948 and encrypting the session so the numbers cannot be observed

23. In a coffee shop, a laptop shows two access points advertising the shop’s SSID. One is genuine; the other is a laptop with a wireless card in monitor mode that presents a portal page and captures credentials. What is this, and which control counters it at the enterprise level?

    A. A deauthentication flood; enable 802.11w B. A KRACK attack; upgrade the clients to WPA2 C. ARP poisoning; enable dynamic ARP inspection D. An evil twin, a rogue access point impersonating a legitimate SSID; counter it with wireless intrusion prevention, 802.1X with EAP-TLS, and client configuration that validates certificates

24. An attacker sends continuous spoofed 802.11 deauthentication frames at a client, knocking it off the enterprise wireless network repeatedly. The client’s association is torn down because these management frames are not protected. Which amendment closes the gap?

    A. WPA2 with CCMP, which protects data frames B. MAC address filtering on the access points C. Lowering the access point transmit power D. IEEE 802.11w Protected Management Frames, which authenticate deauthentication and disassociation frames so the spoofed ones are dropped

25. A contractor’s laptop connects to the guest Wi-Fi, and the organization must keep that device from reaching the internal network while still letting employees’ managed laptops through. Which control is purpose-built for this admission decision?

    A. Static IP reservations for employees B. A DMZ dedicated to the guest network C. Network Access Control (NAC), which evaluates device posture and identity at connection time and places the device on the appropriate segment, denying or quarantining noncompliant endpoints D. A stateful firewall between the guest VLAN and the internal network

Answer key

Rationales

1. A. The switch is a Layer 2 device: it forwards frames on destination MAC addresses. The router is a Layer 3 device: it forwards packets on destination IP addresses. The appliance’s port check happens at Layer 4, the transport layer, because TCP and UDP ports are transport-layer identifiers. Each device in the path reads the header of the protocol it was built to forward, which is exactly what the OSI reference model of ISO/IEC 7498-1 describes. Options B, C, and D misplace one or more devices in the stack.

2. D. A flood of SYNs that never complete leaves the server’s half-open connection table full, which is the classic SYN flood. SYN cookies, per the technique described across the network security literature and implemented in every major OS, let the server respond to a SYN without committing connection state, then reconstruct the state only when the client’s ACK returns the matching cookie. The flood of handshakes stops exhausting the queue. MAC flooding (option A), DNS poisoning (option B), and ARP poisoning (option C) each describe a different symptom than the capture shows.

3. B. NIST SP 800-41 describes the firewall family that includes packet filters, stateful inspection devices, and application proxies. The application proxy is the type that terminates the client connection and re-creates a new connection to the server, which lets it inspect the application protocol itself, apply per-user policy, and hide the internal server from the client. Packet filters (option C) and stateful devices (option D) make decisions on headers and connection state, not application content, and MAC-layer filtering (option A) works below all of them.

4. C. A DMZ is the zone designed for exactly this problem: systems that must be reachable from the Internet sit in a segment with default-deny rules, inbound access is limited to the published services, and the internal network is never directly reachable. Options A and B expose internal or host-only systems to the Internet, and option D confuses availability engineering with access control, which solves nothing about reachability.

5. B. WPA2-Personal uses a pre-shared key and the 4-way handshake, which an attacker can capture and test offline against the passphrase, and short shared passwords fall quickly. WPA3-Personal replaces the handshake with SAE, Simultaneous Authentication of Equals, where password verification cannot be run offline against a capture: each guess requires interacting with the real network. Hiding the SSID (option A), lengthening the WPA2 password (option C), and lowering transmit power (option D) are marginal, not structural, fixes.

6. D. The symptom, a workstation whose ARP cache maps the gateway’s IP to an attacker’s MAC, is ARP cache poisoning, also called ARP spoofing. Dynamic ARP inspection validates ARP messages against the binding table built by DHCP snooping and drops packets that do not match, so the poisoned mapping never enters the cache. Firewall rules (option A), guest passwords (option B), and static routes (option C) do not check what ARP messages say.

7. B. Flooding the switch with frames that carry random source MAC addresses exhausts the MAC address table, and the switch falls back to flooding traffic to every port, which is how the attacker captures it. Port security limits how many MAC addresses a port may learn and shuts the port down (or otherwise restricts it) on violation, closing the flood. BPDU guard (option A) addresses spanning-tree abuse, a larger table (option C) raises the cost of the flood instead of stopping it, and 802.1X on the uplink (option D) does not police MAC learning.

8. D. Double-tagging VLAN hopping works because the access switch strips the outer tag of a doubly tagged frame and forwards it onto a trunk, where the inner tag tells the next switch which VLAN it belongs to, effectively jumping the frame onto a VLAN the sender was never assigned. Hardening includes assigning the native VLAN to a dedicated unused VLAN, never using VLAN 1 for user traffic, and disabling trunking on access ports. MAC spoofing (option A), DHCP starvation (option B), and spanning-tree abuse (option C) are different attacks with different controls.

9. C. Packets that claim source addresses the network could not have produced are spoofed, and the paired fix is ingress and egress filtering per BCP 38 (RFC 2827): block inbound traffic that claims internal or otherwise impossible source addresses and outbound traffic that does not originate from the organization’s own prefixes. Unicast reverse path forwarding, per RFC 3704, drops packets whose source address is not reachable through the interface they arrived on. DNSSEC (option A), DHCP controls (option B), and TLS egress (option D) do not validate source addresses.

10. A. The personal switch is generating bridge protocol data units and competing in the spanning-tree election, which can redirect traffic and destabilize the network. BPDU guard, configured on the edge ports where users connect, shuts a port down the moment it receives a BPDU, so an unauthorized switch cannot join the topology. Sticky MAC (option B), DAI (option C), and DHCP snooping (option D) police other behaviors and leave the BPDU stream untouched.

11. B. The signature is a reflection and amplification attack: the attacker sends small queries with a spoofed source address to open resolvers, which respond with much larger answers aimed at the victim, multiplying the attacker’s bandwidth. Effective mitigations include BCP 38 source-address validation so the spoofing cannot happen, rate limiting and response-size controls at the reflecting infrastructure, and filtering at the victim’s edge. SYN cookies (option A) treat a different flood, DNS tunneling (option C) is an exfiltration channel, not a flood, and MAC flooding (option D) is a local-layer attack.

12. D. Loading fraudulent A records into a resolver’s cache is DNS cache poisoning, and DNSSEC, defined across RFC 4033, RFC 4034, and RFC 4035, makes the records verifiable: each answer carries signatures chained to a trust anchor, and a validating resolver rejects anything that does not verify. HSTS (option A) governs the browser’s transport choice, blocking UDP 53 (option B) would break resolution entirely, and rotating the bank’s TLS certificates (option C) does nothing about the DNS answer that steered the user to the wrong place.

13. A. A workstation emitting a steady stream of DNS queries for odd hostnames under one domain is the classic profile of DNS tunneling, where data is encoded in query names and answers to move information through a channel that filtering usually allows. Detection comes from baselining normal DNS volume and looking for anomalies: query rate, name entropy, and domain patterns. An amplification attack (option B) sends floods at a target rather than trickling queries, normal resolution (option C) does not match the profile, and MAC spoofing (option D) is unrelated to the DNS stream.

14. C. TLS 1.3, defined in RFC 8446, removes the RSA key exchange and requires ephemeral key exchanges, so every session uses forward secrecy: the long-term certificate key can authenticate the server but can never decrypt recorded sessions, because no session key is derived from it. That is precisely the exposure the reviewer identified. A longer certificate key (option A) still lets recorded TLS 1.0 sessions be decrypted later, OCSP stapling (option B) is about revocation status, and RC4 (option D) is a broken cipher that NIST and the IETF have long since retired.

15. A. The failure is that the client can be talked onto plain HTTP before it ever reaches the HTTPS site. HSTS, per RFC 6797, has the site tell the browser, over an authenticated HTTPS connection, to use only HTTPS for that domain from then on, and the browser refuses plaintext, which closes the SSL-stripping downgrade. Longer timeouts (option B) do not force the channel, DNSSEC (option C) authenticates DNS records, not the web transport, and HTTP/2 (option D) runs over the same unforced channel.

16. D. OCSP, defined in RFC 6960, answers a single certificate’s status at the moment of inquiry with a response of good, revoked, or unknown, which is what a relying party needs for a high-value transaction. A CRL (option A) is a periodically downloaded list whose freshness depends on the last download, pinning (option B) fixes a key rather than checking its status, and a serial number lookup (option C) depends on the client having a current database, which is precisely what OCSP provides on demand.

17. B. ESP in tunnel mode, per RFC 4303 and the IPsec framework of RFC 4301, wraps the entire inner packet, including its IP headers, in encryption and authentication, inside a new outer IP header, and its sequence numbers provide replay protection: confidentiality, integrity, and replay resistance for the whole tunneled packet. AH in transport mode (option A) authenticates but never encrypts, ESP transport mode (option C) protects only the payload of the original packet, and TLS alone (option D) does not build the site-to-site tunnel the stem describes.

18. A. Sending only hospital-bound traffic through the VPN is split tunneling, and the exposure is that the clinician’s machine is reachable from, and reaches, the untrusted local network while it is also trusted on the hospital network: malware on the local side can ride through the client into the tunnel. Full tunneling routes all traffic through the corporate gateway, where it can be inspected and filtered. Option B mislabels the arrangement, option C treats wireless encryption as a cure for a tunneling policy, and option D invents a regulatory requirement.

19. D. SSH, defined in RFC 4251, authenticates the remote host and encrypts the entire session, including passwords and configuration commands, so it is the correct replacement for Telnet and the other cleartext management protocols on any untrusted path. Telnet (option A) sends everything in the clear, SNMPv2 community strings (option B) travel in cleartext and are a poor configuration channel, and TFTP (option C) has no authentication and no encryption at all.

20. C. SNMPv3, defined in RFC 3411, replaced the community-string model with a user-based security model that provides message integrity, authentication, and optional encryption, which addresses both the reading and the modification the attacker performed. Longer community strings (option A) stay in cleartext, ICMP (option B) has no management data and no security, and NetFlow (option D) is an export mechanism, not a management protocol with security.

21. B. Replaying a captured valid exchange is a replay attack, and the defense is freshness: a nonce, timestamp, or sequence number that the receiver verifies, so a message captured from an earlier session cannot be accepted again. The counter and timestamp in the stem are exactly that mechanism. Encrypting the payload (option A) protects confidentiality, packet filtering (option C) addresses spoofed sources, and rate limiting (option D) addresses floods; none of them establishes freshness.

22. D. Sequence number prediction lets an off-path attacker inject packets into a TCP session, and the paired controls are randomization, so the numbers cannot be predicted, and encryption of the transport session, so the numbers cannot be observed. RFC 1948 was written specifically to defend against sequence number attacks by making initial sequence numbers unpredictable. ICMP blocking (option A), window sizing (option B), and DHCP snooping (option C) do not touch the prediction problem.

23. D. A second access point presenting the same SSID to lure clients is an evil twin, a rogue access point that impersonates a legitimate one. Enterprise countermeasures include wireless intrusion prevention that detects and contains rogue APs, and 802.1X with EAP-TLS, where the client validates the server certificate and authenticates with a certificate rather than a shared password, so a fake portal cannot harvest usable credentials. Deauthentication floods (option A), KRACK (option B), and ARP poisoning (option C) are different attacks with different fixes.

24. D. Deauthentication and disassociation frames are 802.11 management frames, and in classic WPA2 they are sent unauthenticated, so anyone can spoof them and knock a client off the network. IEEE 802.11w, Protected Management Frames, authenticates these frames so spoofed ones are rejected. CCMP (option A) protects data frames, not management frames, MAC filtering (option B) does not protect frames at all, and transmit power (option C) does not address the forged deauthentication.

25. C. Network Access Control is the control built for the admission decision: it evaluates the device’s posture and identity at connection time and dynamically places it on the right segment, denying or quarantining endpoints that fail the policy, which is exactly the contractor-versus-employee split the stem describes. Static reservations (option A) only fix addressing, a guest DMZ (option B) describes the topology the NAC decision feeds, and a stateful firewall (option D) enforces rules between zones but never asks what the device is.

Reading your Domain 4 score

Score yourself against the bands Chapter 1 set for every domain test in this book:

The single number hides the information you need, so break the misses down by area. Domain 4 is several disciplines under one label, and the triage that matters is at the topic level:

Two habits make the score useful. First, log the result and the area misses on your score sheet, because the full practice exam in Chapter 33 will re-test this domain and you want the comparison. Second, treat a miss pattern as a question about process, not just facts. If your misses cluster on questions where you picked a technically famous control, encryption, for example, that did not fit the attacker’s position, your problem is position mapping, and the fix is to name the attacker’s vantage point and the property at risk before you look at the options. If the misses cluster on questions with named standards, RFC 8446, RFC 6960, RFC 3411, your problem is source recall, and the fix is to redraw each standard’s structure cold, without the chapter open.

What the score means for your plan

Domain 4 carries 13 percent of the current outline’s weight, tied with security architecture and engineering and identity and access management for the second-largest share behind security and risk management. It is also the domain that the rest of the book leans on without saying so. Identity federation in Domain 5 rides on TLS and certificates. The monitoring and intrusion detection of Domain 7 watches the very attacks you just matched to controls. The software testing of Domain 8 targets applications that speak the protocols you just studied. A candidate who treats Domain 4 as one exam section to memorize and forget is discarding the substrate every other domain runs on.

Pass this test at the level your score band demands and you have earned the right to move to Part VI with confidence. Fail it, and you have earned something rarer: a precise list of what to re-read, organized by the discipline that matters. Either way, the score sheet is now the authority on where your Domain 4 hours go. The next chapter opens Domain 5, Identity and Access Management, where the certificates and federation protocols you just worked with get put to work deciding who a user is and what they may do.