SSCP Domain 6, Network and Communications Security: the protocols, attacks and controls the exam expects you to know
Domain 6, Network and Communications Security, is where the SSCP (Systems Security Certified Practitioner) exam puts you at the switch, the firewall and the access point: seven sub-objectives and 16% of the outline in force since 1 October 2025 — about 16 items on a 100-item sitting, 20 on 125.
01
What Domain 6 covers (16% of the exam)
Domain 6 is the network administrator’s share of the SSCP: which port a protocol uses, where a sensor sits, which switch setting stops which attack. It ties Domain 1 as the heaviest domain on the ISC2 exam outline.
16%
of the outline
tied with D1
16–20
items
on a 100- or 125-item sitting
19.2 min
of the 2-hour clock
the same share as Domain 1
The seven sub-objectives, with the outline’s wording kept as written:
6.1 Understand and apply fundamental concepts of networking
6.2 Understand network attacks (DDoS, MITM, DNS cache poisoning)
6.3 Manage network access controls
6.4 Manage network security
6.5 Operate and configure network-based security appliances and services
6.6 Secure wireless communications
6.7 Secure and monitor Internet of Things (IoT) (configuration, network isolation, firmware updates, EOL management)
Five of the seven sub-objectives ask you to manage, operate and configure, secure or monitor, so the stems put you at a console and ask for the setting, the placement or the next step. Only 6.1 and 6.2 test understanding on its own.
Networking fundamentals: models, ports and protocols
Sub-objective 6.1 lists the OSI and TCP/IP models, topologies, peer-to-peer versus client-server, transmission media, SDN and SD-WAN, and common ports and protocols. Learn the model first, because it sorts every other Domain 6 fact: once you know the layer an attack lives on, you know which device can see it.
OSI layers, the TCP/IP layer they map to, and what sits there
OSI layer
TCP/IP
Protocols and data
Devices and controls
Attacks seen here
7 Application
Application
HTTP, DNS, SMTP, SNMP
WAF, application proxy, NGFW app rules
HTTP flood, DNS cache poisoning
6 Presentation
Application
encoding, compression, data formats
—
—
5 Session
Application
session set-up and tear-down, RPC
session timeouts
session hijacking
4 Transport
Transport
TCP, UDP, port numbers
stateful firewall
SYN flood
3 Network
Internet
IP, ICMP, IPsec
router ACL, packet filter
IP spoofing, ICMP flood
2 Data link
Link
Ethernet frames, ARP, VLAN tags, 802.1X
switch, port security, dynamic ARP inspection, NAC
ARP poisoning, VLAN hopping
1 Physical
Link
copper, fibre, radio
locked wiring closets, cable protection
tapping, jamming
Sources place TLS at layer 5, 6 or “between 4 and 7”. Learn it by what it does — it encrypts a TCP session — not by a number.
Ports to know cold, and each one’s secure twin
Cleartext or legacy protocol and the secure alternative, with default ports
Cleartext / legacy
Port
Secure alternative
Port
Telnet
23 TCP
SSH
22 TCP
FTP
20/21 TCP
SFTP (runs over SSH) or FTPS (FTP over TLS)
22 / 989–990
HTTP
80 TCP
HTTPS (TLS)
443 TCP
LDAP
389
LDAPS
636
POP3
110
POP3S
995
IMAP
143
IMAPS
993
SMTP relay
25
submission with STARTTLS / SMTPS
587 / 465
SNMP v1/v2c (cleartext community strings)
161, traps 162 UDP
SNMPv3
161 / 162 UDP
syslog
514
syslog over TLS
6514
Also learn: DNS 53 (UDP; TCP for zone transfers), DHCP 67/68, Kerberos 88, NTP 123, SMB 445, IKE 500 and 4500 UDP, RADIUS 1812/1813 UDP, TACACS+ 49 TCP, RDP 3389.
The rest of 6.1 is vocabulary. Client-server puts the service on a host you can harden and log; peer-to-peer spreads it across endpoints you may not control. SDN splits the control plane, which decides routes, from the data plane, which forwards traffic, and runs the first from a central controller; SD-WAN applies the idea to branch links.
03
Network attacks and the controls that stop them
Sub-objective 6.2 names three attacks — DDoS, man-in-the-middle and DNS cache poisoning — and pairs them with CDN, firewalls, NAC and intrusion detection and prevention. The exam asks for recognition and defence, so learn each attack as a symptom plus the control that ends it.
Attack, where it lives, how you notice it, and the control that stops it
Attack
Layer
What you see
Control that stops it
Volumetric DDoS
3–4
link saturated from many sources
upstream scrubbing, CDN, anycast
SYN flood
4
half-open connections fill the table
SYN cookies, rate limiting
HTTP flood
7
valid-looking requests exhaust the app
WAF rules, caching
MITM by ARP poisoning
2
one MAC claims the gateway’s IP
dynamic ARP inspection with DHCP snooping; encrypt the session
DNS cache poisoning
7
resolver returns forged answers
DNSSEC validation, source-port randomisation
VLAN hopping
2
frames reach a VLAN they should not
disable auto-trunking, move the native VLAN off user VLANs, prune trunks
IP spoofing
3
internal source addresses arriving from outside
ingress and egress filtering at the edge
Match the countermeasure to the layer of the flood. Scrubbing does nothing for an application flood that looks like real traffic, and a WAF cannot absorb a link that is already full. A CDN shields only an origin whose IP address has not leaked; once it has, attackers go around it.
04
Network access control and segmentation
6.3 is about who gets onto the network: 802.1X, RADIUS, TACACS+ and remote access by thin client, VPN or VDI. 6.4 is about what they reach once on it: device placement, segmentation and secure device management.
How 802.1X admits a device
Step 01
Supplicant connects
The client plugs into a switch port or joins an access point. The port is unauthorised and passes only EAP traffic.
Step 02
Authenticator relays
The switch or access point is the authenticator. It decides nothing; it carries the EAP exchange to the server.
Step 03
Authentication server decides
Usually RADIUS checks the credential or certificate and returns accept or reject, often with a VLAN assignment.
Step 04
Port opens
On accept the port is authorised and the device lands in the named segment; on reject it stays closed or drops into a guest VLAN.
RADIUS and TACACS+ side by side
RADIUS
TACACS+
Transport
UDP 1812 / 1813
TCP 49
What is encrypted
the password only
the whole payload
Authentication, authorisation, accounting
authentication and authorisation combined
all three separated
Typical job
network access: Wi-Fi, VPN, 802.1X
device administration with per-command authorisation
For remote access, the exam weighs where the data ends up. Split tunnelling saves VPN bandwidth but sends internet traffic around corporate inspection. VDI and thin clients keep the data in the data centre, so a lost endpoint holds nothing.
Segmentation and placement (6.4)
VLAN
Separates broadcast domains at layer 2; a boundary only when an ACL or firewall zone enforces policy between VLANs.
Micro-segmentation
Policy per workload, so east-west traffic between servers in one segment is filtered too.
Inline, passive, virtual
Inline devices sit in the path and can block; passive devices get a copy and only alert; virtual appliances do either inside a hypervisor or cloud network.
Out-of-band management
A separate network for switch, router and firewall administration, unreachable from user segments.
05
Security appliances and services: firewalls, IDS/IPS, proxies, VPN
6.5 lists firewalls and proxies (with WAF and CASB), network IDS and IPS, routers and switches, traffic shaping and load balancing, NAC, DLP and UTM. The typical item gives you a problem and four useful appliances, and asks which one acts at the right layer and position.
Firewall families by what they can read
Type
Layers
Decides on
Cue in the stem
Packet filter (stateless)
3–4
addresses, ports, flags per packet
simple router ACL, high throughput
Stateful inspection
3–4
the above plus connection state
return traffic only for sessions opened from inside
Application proxy / gateway
7
full content; breaks the connection in two
inspect commands inside a protocol
NGFW
3–7
application and user identity, built-in IPS
block an app regardless of port
WAF
7 (HTTP only)
requests to a web application
SQL injection or cross-site scripting at a public web app
D6-6.5-A
IDS or IPS: the placement decides
Depends
IDS
passive, fed by a SPAN port or a network TAP; alerts only
IPS
inline; can drop traffic, adds latency
Design choice
IPS fail-open keeps traffic flowing; fail-closed keeps it blocked
Blind spot
a network sensor cannot read TLS payloads without decryption; a host IDS sees the decrypted side
A TAP copies in hardware and does not drop under load; a SPAN port can. A sensor that misses traffic at peak hours points at the copy method.
A forward proxy serves internal clients going out; a reverse proxy fronts servers. A CASB sits between users and cloud services. UTM bundles firewall, IPS, anti-malware and filtering in one box — cheaper, and a single point of failure. DLP watches data leaving.
VPNs: IPsec headers and modes, TLS
IPsec: what each header does
AH
ESP
Encryption
none
yes
Integrity and origin authentication
yes, including the IP header
yes (optional, normally on)
Through NAT
fails — NAT changes the header AH signed
works with NAT traversal (UDP 4500)
Transport mode protects the payload host to host. Tunnel mode wraps the whole original packet: the gateway-to-gateway site VPN. IKE negotiates the security associations on UDP 500.
06
Securing wireless communications
6.6 covers cellular, Wi-Fi, Bluetooth and NFC, and names WPA, WPA2, WPA3 and EAP. Most items are Wi-Fi: which generation, which mode, and which settings only look like security.
Wi-Fi security generations
Generation
Encryption
Authentication
Status
WEP
RC4
shared key
broken; never acceptable
WPA
TKIP
PSK or 802.1X
deprecated
WPA2
AES-CCMP
Personal (PSK) or Enterprise (802.1X/EAP)
still common; PSK open to offline guessing
WPA3
AES (optional 192-bit mode in Enterprise)
Personal uses SAE; Enterprise uses 802.1X/EAP
current choice
Personal mode is one passphrase for everyone, so a departing employee keeps the key until it changes on every device. Enterprise mode authenticates each user through 802.1X and RADIUS, so one account can be disabled alone. SAE in WPA3-Personal resists offline dictionary attacks on a captured handshake; OWE encrypts even open guest networks.
Bluejacking
Unsolicited messages to a nearby Bluetooth device; no data taken.
Bluesnarfing
Data taken from the device: contacts, messages, files.
Bluebugging
Control of the device itself. For all three: Bluetooth off or non-discoverable when unused, pairing only with known devices.
07
IoT: isolation, firmware and end-of-life
6.7 names four tasks in its own heading: configuration, network isolation, firmware updates and EOL management. Cameras, badge readers and building sensors rarely take an endpoint agent, so the answers are network-side and lifecycle-side.
Change default credentials before the device reaches production.
Isolate IoT on its own VLAN or SSID, with a firewall rule to user and server segments.
Block outbound traffic except the endpoints the device needs.
Track firmware versions and patch on a schedule.
Record the end-of-support date at purchase and plan the replacement.
Monitor the segment: a thermostat calling an unknown address is an event of interest.
End-of-life ties to Domain 1: sub-objective 1.5 covers the asset lifecycle to disposal, and the Domain 1 guide walks through it. A device past end of support gets no firmware fixes, so isolation is the only control left until it is replaced.
08
Common Domain 6 traps
These three cost more time than anything else in the domain because every option sounds technical. Give each the same ten-second test: what is the device’s role, and where does it sit?
TRAP-6.3
The switch called the authentication server
Trap
Supplicant
the client
Authenticator
the switch or access point
Authentication server
usually RADIUS
An option with the switch deciding who gets in has swapped two roles. The switch enforces; the server decides.
TRAP-6.5
An IDS asked to block
Trap
Placement
SPAN or TAP, out of the path
Can do
detect and alert
Cannot do
drop the packet
If the requirement says stop, the answer must be inline: an IPS, a firewall rule or NAC.
TRAP-6.6
WPA2-Personal for a staff network
Trap
Problem
one shared key, no per-user revocation
Fix
WPA2- or WPA3-Enterprise with 802.1X
A stem that mentions staff turnover or contractors is pointing at per-user authentication.
09
Practice: 12 Domain 6 questions
Below are 12 original Domain 6 practice questions, all on the page at once, leaning on configuration and troubleshooting the way 6.4 and 6.5 are written. Pick an option (click, or keys 1–4 / A–D) and it locks: the panel shows the reasoning for all four options. J and K move between items.
Budget the set: 12 items × 72 seconds is 14.4 minutes; at the 57.6-second pace of a 125-item sitting it is 11.5. The pace meter checks your average against that window and predicts no score. Answer each item once and move on — the exam will not let you return.
12 SSCP practice items
Budget: 2 h = 7,200 s. ÷ 125 items = 57.6 s, ÷ 100 items = 72 s, so the meter holds you to 58–72 s an item. Practice arithmetic only — it predicts no score.
0/12 answered · 0 pass
Paceclock runs from when the log came into view
Item
01/12
Domain
D6
Area
Network and Communications Security
Weight
16%
Status
Open
A dedicated network security monitoring appliance repeatedly generates critical alerts regarding a sequence of incoming packets that have the FIN, PSH, and URG TCP flags set simultaneously. To most effectively analyze and drop this specific type of anomalous reconnaissance traffic, at which OSI layer must the mitigation be applied?
Pick A–D or press 1–4, then give this panel ten seconds: the verdict, and why each of the four options is right or wrong.
The packets described (FIN, PSH, URG flags set) represent a classic XMAS tree port scan. To map these observations to likely controls, defenders must identify unusual flags and malformed headers. TCP flags are a component of the Transmission Control Protocol, which operates at the OSI Transport layer (Layer 4). Mitigation, such as dropping packets with invalid flag combinations, must occur at this layer.
The Data link layer (Layer 2) handles MAC addresses. The Network layer (Layer 3) routes IP packets. The Session (Layer 5) and Application (Layer 7) layers handle higher-level application data exchanges, not TCP flags.
ALayer 2 handles frames and MAC addresses; it cannot see TCP flag combinations.
BLayer 3 handles IP addressing and routing; TCP flags live in the transport header above it.
CLayer 5 manages application sessions; TCP flags are not part of it.
DCorrect: FIN+PSH+URG is an Xmas scan; TCP flags belong to the Layer 4 transport header, so filtering happens there.
More below: why each option is right or wrong — scroll this panel
Item
02/12
Domain
D6
Area
Network and Communications Security
Weight
16%
Status
Open
A security appliance repeatedly cycles between active and offline states within a load balancer pool. Log analysis reveals temporary CPU spikes aligning with the removal events, though the appliance remains fully functional. What is the root cause?
Pick A–D or press 1–4, then give this panel ten seconds: the verdict, and why each of the four options is right or wrong.
If health-check thresholds are configured too aggressively, minor events like temporary CPU spikes can cause the health check to fail. This leads to the appliance being repeatedly removed and added back to the pool. Adjusting the threshold prevents this without requiring hardware changes.
AThroughput limits cause drops under load, not removals timed to the appliance's own CPU spikes.
BCorrect: health checks with tight timeouts fail during brief CPU spikes, so a working appliance keeps being pulled from the pool.
CSpanning tree problems cause loops or blocked ports, not removals that track CPU spikes.
DCipher settings on a management interface do not affect data-plane health checks.
More below: why each option is right or wrong — scroll this panel
Item
03/12
Domain
D6
Area
Network and Communications Security
Weight
16%
Status
Open
A junior administrator proposes disabling SSH and HTTPS on a remote site router to completely eliminate its network attack surface. What is the primary risk associated with this configuration change?
Pick A–D or press 1–4, then give this panel ten seconds: the verdict, and why each of the four options is right or wrong.
Locking out all management protocols without establishing an alternate out-of-band access method creates a self-inflicted denial of service against the administrative team. This over-hardening completely prevents legitimate management and troubleshooting. It does not inherently create routing loops, impact user traffic to web applications, or force a Telnet fallback.
ADisabling management services does not change routing, so no loops follow.
BCorrect: with SSH and HTTPS off and no out-of-band path, the remote team cannot manage the router, a self-inflicted denial of service.
CRouters do not silently turn on Telnet when SSH is disabled.
DDisabling management services affects traffic to the router, not encrypted traffic routed through it.
More below: why each option is right or wrong — scroll this panel
Item
04/12
Domain
D6
Area
Network and Communications Security
Weight
16%
Status
Open
An organization is upgrading a legacy environment to enforce strong administrative access controls. Which action best aligns with industry best practices for secure management?
Pick A–D or press 1–4, then give this panel ten seconds: the verdict, and why each of the four options is right or wrong.
Secure administrative access requires enforcing role-based accounts, using separate audit accounts, and requiring MFA for SSH access using secure management protocols. Utilizing Telnet or HTTP exposes credentials.
Sharing a privileged account for audits violates non-repudiation. Disabling role-based access violates the principle of least privilege.
AShared privileged accounts destroy accountability; every admin and auditor needs a named account.
BTelnet sends credentials in clear text, even on a local subnet.
CCorrect: SSH encrypts the session and MFA protects the credentials, the expected baseline for administrative access.
DHTTP exposes credentials and data in transit, read-only or not.
More below: why each option is right or wrong — scroll this panel
Item
05/12
Domain
D6
Area
Network and Communications Security
Weight
16%
Status
Open
An IPsec VPN troubleshooting log indicates that IKE Phase 1 completes successfully, but Phase 2 drops during the Perfect Forward Secrecy exchange. Which issue is preventing the tunnel from establishing?
Pick A–D or press 1–4, then give this panel ten seconds: the verdict, and why each of the four options is right or wrong.
IKE Phase 1 establishes the management channel; Phase 2 establishes IPsec Security Associations. Perfect Forward Secrecy requires a fresh Diffie-Hellman exchange for Phase 2 keys.
If Phase 2 drops during this exchange, it indicates mismatched DH groups or cipher suites between peers. Pre-shared keys relate to Phase 1.
AMain mode belongs to Phase 1, which completed successfully.
BPre-shared keys authenticate Phase 1, which already succeeded.
CExpired ISAKMP SAs would break the Phase 1 channel, not fail only at the PFS step.
DCorrect: PFS runs a fresh Diffie-Hellman exchange in Phase 2; if the peers propose different DH groups, Phase 2 fails there.
More below: why each option is right or wrong — scroll this panel
Item
06/12
Domain
D6
Area
Network and Communications Security
Weight
16%
Status
Open
A security team must provide third-party contractors with highly secure access to a single internal web application. To firmly adhere to the principle of least privilege, the contractors' local LAN traffic must not be exposed to the internal corporate environment. Which solution best meets this requirement?
Pick A–D or press 1–4, then give this panel ten seconds: the verdict, and why each of the four options is right or wrong.
Application-based tunneling provides granular, least-privilege access by strictly routing only the specific application's traffic through the secure tunnel, isolating the client's local network. Traditional split tunneling typically routes entire subnets, which grants overly broad access.
Full forced tunneling routes all client traffic, including local LAN internet requests, directly through the corporate gateway, exposing the environment unnecessarily. A posture assessment checks device health but does not control traffic routing.
ACorrect: per-application tunneling carries only that one app's traffic, so the contractor's LAN never touches the corporate network.
BForced tunneling sends all of the contractor's traffic into the corporate network, exposing far more than one application.
CPosture checks gate connections; they do not limit what flows once connected.
DSplit tunneling still routes whole corporate subnets, wider than one application.
More below: why each option is right or wrong — scroll this panel
Item
07/12
Domain
D6
Area
Network and Communications Security
Weight
16%
Status
Open
Following a weekend maintenance window, an enterprise experiences a massive outage affecting all external internet connectivity. The security team recently changed the perimeter intrusion detection system to an intrusion prevention system. Which action most likely caused this immediate organizational outage?
Pick A–D or press 1–4, then give this panel ten seconds: the verdict, and why each of the four options is right or wrong.
Switching an IPS to inline blocking without prior tuning and monitoring is a critical administrative error that frequently causes unexpected outages or application failures. An IPS actively drops traffic it deems malicious.
If baseline organizational traffic generates false positives on default signatures, turning on blocking immediately disrupts legitimate enterprise workflows. A graduated deployment strategy is always required.
AOld firmware might cause bugs, but the classic cause of an outage after an IDS-to-IPS switch is untuned blocking.
BCorrect: an IPS blocks what it flags; going inline without tuning lets false positives drop legitimate traffic and cut connectivity.
CDefault-permit lets traffic through; logging load does not usually cut all connectivity.
DSignatures do not need to recognize routing protocols for that traffic to pass.
More below: why each option is right or wrong — scroll this panel
Item
08/12
Domain
D6
Area
Network and Communications Security
Weight
16%
Status
Open
A security engineer configures a firewall rule to permit traffic from a partner network, 10.10.10.0/24. They mistakenly enter the source CIDR as 10.10.10.128/25. Which specific IP address block will be unintentionally denied access by this configuration?
Pick A–D or press 1–4, then give this panel ten seconds: the verdict, and why each of the four options is right or wrong.
Off-by-one subnet mistakes cause dropped traffic. A /24 mask includes 256 addresses (0 to 255). A /25 mask splits this block into two 128-address subnets.
Entering 10.10.10.128/25 explicitly permits the upper half (.128 to .255). Consequently, the lower half (10.10.10.0 to 10.10.10.127) is unintentionally excluded and denied access.
ACorrect: 10.10.10.128/25 covers only .128 to .255, so the lower half, .0 to .127, is denied.
BThis range spans two /24s and includes addresses never in the partner network.
CThis is exactly the range the /25 permits.
DThis lies in 10.10.11.0, outside the partner network altogether.
More below: why each option is right or wrong — scroll this panel
Item
09/12
Domain
D6
Area
Network and Communications Security
Weight
16%
Status
Open
A senior network administrator actively enables BGP route dampening to stabilize the enterprise network against flapping communication links. Shortly after implementation, users report persistent unreachability to a specific external partner network, even though the physical link to that partner is currently completely stable. What is the most likely cause?
Pick A–D or press 1–4, then give this panel ten seconds: the verdict, and why each of the four options is right or wrong.
Applying route dampening without properly tuning thresholds causes severe reachability issues. Dampening assigns a penalty to a route each time it flaps. If the penalty exceeds the suppress limit, the router stops advertising the route until the penalty decays, even if the link stabilizes. Consequently, a valid route is being suppressed by an overzealous dampening configuration.
Spanning tree operates at Layer 2. A hardware failure contradicts the stable link prompt. Firewall keepalive drops and GRE tunnel timeouts are completely unrelated to BGP route dampening mechanics.
ACorrect: dampening penalizes routes that flapped; a route can stay suppressed after the link stabilizes until the penalty decays.
BThe stem says the link is stable, which rules out a failed interface.
CDropped keepalives would bring the BGP session down, not cause suppression tied to dampening.
DThe partner's internal spanning tree does not affect the BGP routes you receive.
More below: why each option is right or wrong — scroll this panel
Item
10/12
Domain
D6
Area
Network and Communications Security
Weight
16%
Status
Open
Two internal routers fail to establish an OSPFv3 neighbor adjacency over a direct point-to-point connection. Both interfaces are successfully configured with 2001:db8::/64 addresses, but attempts to transmit to the multicast address ff02::5 fail. What is the most likely cause?
Pick A–D or press 1–4, then give this panel ten seconds: the verdict, and why each of the four options is right or wrong.
IPv6 routing protocols like OSPFv3 require link-local addresses (fe80::/10) to form neighbor adjacencies and act as next-hop addresses. Without valid link-local addresses, routers cannot complete neighbor discovery or use local-scope multicast (ff02::5), even with global unicast addresses assigned.
AULAs do not override multicast, and none are in use here.
BSite-local addresses are deprecated and not required for anything.
CCorrect: OSPFv3 forms adjacencies over link-local addresses and ff02::5; without fe80:: addresses the hellos cannot work.
DGlobal unicast addresses route fine and do not block link-scope multicast.
More below: why each option is right or wrong — scroll this panel
Item
11/12
Domain
D6
Area
Network and Communications Security
Weight
16%
Status
Open
A network administrator attempts to provision a new IPsec site-to-site tunnel. The tunnel fails to establish, and the gateway logs indicate a transform set configuration payload rejection. Which misconfiguration is most likely causing this failure?
Pick A–D or press 1–4, then give this panel ten seconds: the verdict, and why each of the four options is right or wrong.
Mixing configuration guidance across protocol layers causes failures. Applying TLS settings (like an SSL/TLS cipher suite) when the deployment requires IPsec tunnel parameters (ESP transform sets) will cause the gateway to reject the configuration payload due to protocol incompatibility.
AOverlapping subnets cause routing or traffic-selector problems, not a transform set rejection.
BIKE version mismatches fail in initial negotiation, not as a transform set error.
CA wrong pre-shared key fails Phase 1 authentication.
DCorrect: a transform set defines ESP algorithms; a TLS cipher suite there is a wrong-layer setting the gateway rejects.
More below: why each option is right or wrong — scroll this panel
Item
12/12
Domain
D6
Area
Network and Communications Security
Weight
16%
Status
Open
An organization needs to migrate its legacy IPv4 network to IPv6. The current perimeter heavily relies on Network Address Translation (NAT) for outbound internet access and stateful traffic inspection. Which transition strategy minimizes connectivity risks while maintaining security controls?
Pick A–D or press 1–4, then give this panel ten seconds: the verdict, and why each of the four options is right or wrong.
A dual-stack architecture allows IPv4 and IPv6 to operate simultaneously and natively, avoiding the security and connectivity pitfalls of tunneling mechanisms. Tunneling IPv6 inside IPv4 bypasses stateful inspection and often fails across NAT boundaries.
ANAT64 lets IPv6-only clients reach IPv4 services, and doing it only on core switches does not secure the perimeter.
BISATAP tunnels IPv6 inside IPv4, hiding it from inspection tools.
CCorrect: native dual-stack runs IPv4 and IPv6 side by side, so both can be inspected and the move can be gradual.
DTeredo is built to traverse NAT and slips past perimeter controls, the opposite of the goal.
More below: why each option is right or wrong — scroll this panel
For a mixed set, the 60 SSCP practice questions are weighted like the outline, with 10 Domain 6 items behind the D6 tab. The SSCP overview puts the whole exam on one screen.
Seven sub-objectives: networking fundamentals (6.1), network attacks (6.2), access controls (6.3), network security and segmentation (6.4), appliances and services (6.5), wireless (6.6) and IoT (6.7) — 16% of the outline. The full list is in section 01.
How many Domain 6 questions are on the SSCP exam?
ISC2 builds each sitting to the domain weights but publishes no per-domain counts. At 16%, that is about 16 items on a 100-item exam and 20 on a 125-item one.
Which OSI layer does a firewall work at?
It depends on the type. Packet filters and stateful firewalls work at layers 3 and 4; application proxies and WAFs at layer 7; an NGFW spans 3 to 7. See the firewall table.
What is the difference between IDS and IPS?
An IDS gets a copy of traffic from a SPAN port or TAP and alerts. An IPS sits inline and can drop traffic, at the cost of latency and a fail-open or fail-closed choice.
How does 802.1X work?
The supplicant connects to the authenticator (switch or access point), which passes only EAP and relays it to the authentication server, usually RADIUS. On accept the port opens, often into an assigned VLAN. Steps are in section 04.
Log a few items every day
The app keeps the same rhythm on your iPhone; the full log stays free on this site.