Full Tunnel, Split Tunnel, Jump Box, SD-WAN: The Secure Communication Channels CISSP Actually Tests
Chris Rees
25+ years in IT · Pluralsight author, 4.6/5 across 2,000+ ratings
The most dangerous connection in the exam's model organization was not the one carrying its regulated data. It was a site-to-site tunnel to a maintenance contractor, built years earlier for remote diagnostics, terminating inside the operational network, with a shared account, no expiry and no logging. Objective 4.3 is a catalog of channels like that one: voice, video, collaboration, remote access, carrier links and third-party interconnects, each built for convenience first. The exam asks one question about all of them: what does this channel grant, and is that more than it needs?
The channel nobody designed
The OSI model post covers the layers, the attacks at each one, and the IPsec internals of objective 4.1. Objective 4.3 is where that architecture meets the paths people actually use, and the recurring pattern is a channel granted more reach than it needed and never revisited. Every countermeasure below is a variant of the same fix: authenticate the individual, encrypt regardless of transport, grant the narrowest unit of access, log it, and expire it.
Voice, video and collaboration
Voice over IP turned the phone system into an application on the data network, and it inherits every data-network attack. SIP signaling sets up the call; RTP media carries the audio. Unencrypted RTP on a shared segment is trivially captured and replayed as audio, so the exam's answer is SRTP for the media and TLS for the signaling. Two attacks are specific to voice. Vishing is phishing by phone, made convincing by caller ID spoofing; the control is awareness and call-back verification. Toll fraud is an attacker placing premium-rate calls on your trunk at your expense; the controls are call-pattern monitoring, restricted international dialing and hardened trunks.
| Risk | Control |
|---|---|
| Media interception | SRTP for media, TLS for signaling |
| Convergence: one outage or compromise crosses between voice and data | VoIP on its own VLAN with quality of service |
| Toll fraud | call-pattern monitoring, restricted dialing, hardened trunks |
| Uninvited meeting participants | meeting authentication, waiting rooms, unique meeting IDs |
| External guests retaining access | guest accounts with expiry and periodic review |
| Recordings and transcripts | records: classified, retained on schedule, discoverable |
| Files shared in chat | the classification, DLP and retention the file server had |
The last four rows are the modern half of the objective. A collaboration platform is a data store, often the largest in the organization, and a guest identity in it is a persistent access path, not a visitor pass.
Remote access for users: what the connection grants
The examinable distinction across every remote access option is the unit of access. A traditional VPN places a device on a network; whatever that network reaches, the device reaches.
Full tunnel sends all of the device's traffic through the gateway, so every packet can be inspected, at a cost in capacity and latency. Split tunnel sends only corporate destinations through the tunnel and lets the rest go directly: faster, cheaper, and the device is now on the corporate network and the open internet at once with no inspection of the second path. When a stem describes lateral movement after a remote user visited a website, split tunneling is the flaw being tested.
| Approach | Grants | Best fit |
|---|---|---|
| IPsec site-to-site VPN | one network to another, always on | branch offices, partners with a fixed endpoint |
| IPsec remote access VPN | a device onto the network | managed devices needing broad internal access |
| SSL/TLS VPN | the network, or a portal to specific applications | unmanaged devices, clientless browser access |
| Zero trust network access | one named application per session, re-evaluated continuously | the structural replacement for the VPN |
| VDI or remote application | a session; data stays in the data center | contractors, unmanaged devices, sensitive data |
Site-to-site connects two networks and stays up; remote access connects one device on demand. SSL/TLS VPNs work from a browser on a device you do not manage, so they pair with portal mode and VDI rather than full network access. Zero trust network access is where the outline is steering: the application is never exposed to the internet, the device never gets an internal address, and each session is authorized against identity and device posture. Whatever the option, three requirements never change: MFA, device posture, and logging that identifies the individual.
Administrative access is a different problem
Administrative remote access is the highest-risk case, and the exam wants a specific architecture. Nothing is administered from a workstation that also reads email. Administrators connect to a bastion or jump host, and from it to the target. Privileged access management vaults and injects the credentials so the administrator never sees the password, and records the session. Just-in-time elevation grants privilege for a window and a purpose, then removes it. Administrative identities are separate from daily-use accounts and never log in to ordinary endpoints: the pass-the-hash mitigation from Domain 3, applied to network design. Out-of-band management interfaces sit on their own network, because an exposed baseboard management controller is a complete compromise of the host beneath it.
Data communications: "private circuit" is a commercial term
The exam's position on carrier links is consistent: encrypt end to end regardless of how private the transport is described as being. MPLS, leased lines and private APNs separate you from other customers' traffic under the carrier's configuration. They do not give you confidentiality against the carrier, a misconfiguration, or anyone with access to the underlying infrastructure.
Backhaul aggregates traffic from many sites over carrier infrastructure, so one tap sees everything. Satellite has a downlink footprint far wider than the intended area, historically weak or absent link encryption, and latency that breaks chatty protocols. Cellular is untrusted transport: tunnel to a private APN, then authenticate again at the application layer. Even a leased line crosses third-party cross-connects. The answer in every case is your own encryption on top.
Third-party connectivity: the most common way in
Extranets, business-to-business links and cloud interconnects share a shape: a standing path from an organization you do not control into one you do. Several of the largest breaches of the last decade began at a connection built like the contractor tunnel in the opening, which is why the exam weights this sub-item most.
- Assess before connecting. The supply chain assessment is complete before any tunnel exists, and the contract names the security obligations.
- Terminate on a dedicated segment, never inside a production or operational network.
- Explicit allow-list: the hosts, ports and protocols the purpose requires, default deny both ways.
- Named individual accounts with expiry dates and MFA. No shared credentials.
- Full logging and session recording, reviewed. A connection nobody watches is one nobody controls.
- Time-bounded access where the work is periodic: enabled on request, disabled by default.
- Automatic review and removal at the end of the engagement, triggered by the calendar rather than by memory.
Cloud interconnects get the same treatment: bypassing the public internet is a performance property, not a security one. Encrypt over them anyway.
Virtualized networks: SDN, SD-WAN, VXLAN, NFV
The objective's last group describes networks where the decision about where a packet goes has left the device that forwards it.
Software-defined networking separates the control plane (deciding where traffic goes) from the data plane (moving it), and centralizes control in a controller that programs switches through a southbound API and takes instructions through a northbound API. SD-WAN applies the idea to the wide area: edge devices at each site build encrypted overlay tunnels across whatever underlay transports exist, and the controller steers each application over the best path by policy. VXLAN is the overlay encapsulation that lets a virtual Layer 2 segment span physical Layer 3 boundaries, so a tenant's network stays contiguous across a data center or cloud. Network functions virtualization replaces dedicated appliances with software instances placed and scaled on demand.
The security reading of all four is the same. Centralized control creates a single point whose compromise is the compromise of every path, so the controller is hardened, its APIs authenticated, and the controller-to-edge channel encrypted with mutual authentication. Overlay encryption is why SD-WAN can use broadband instead of MPLS without losing confidentiality: the underlay is untrusted by design. Because the network is now software, its configuration is code, with the change control code demands. Monitoring completes the objective: flow visibility into the overlay, session recording on administrative channels, call-pattern analysis on voice, and an inventory of every third-party connection with an owner and an expiry. The channel that hurts you is the one nobody is watching.
Four stems, decoded
- After a remote employee visits a malicious site, an attacker pivots from the laptop into an internal file server. Split tunneling put the device on both networks with no inspection. Full tunnel or ZTNA.
- A branch moves from MPLS to broadband under SD-WAN and the architect asks whether confidentiality is lost. No: the overlay tunnels are encrypted and the underlay was never trusted. MPLS provided separation, not confidentiality.
- A contractor's site-to-site tunnel terminates inside the operational network with a shared account. A brokered, time-bounded, recorded session to one host on a dedicated segment, with named accounts and automatic expiry.
- Administrators connect to production servers directly from their email-reading workstations. Bastion host, privileged access management with session recording, separate administrative identities, just-in-time elevation.
Key takeaways
- Every channel is judged by the unit of access it grants. A VPN grants a network, ZTNA an application, a bastion a recorded session. Least wins.
- Split tunneling trades visibility for speed. The device sits on both networks; lateral movement after a web visit is the tell.
- VoIP needs SRTP, TLS on signaling, its own VLAN, and toll-fraud monitoring. Collaboration platforms are data stores and get data-store controls.
- "Private circuit" is a commercial term. Encrypt end to end over MPLS, satellite, cellular and leased lines; the overlay never trusts the underlay.
- Third-party connections are assessed, segmented, allow-listed, individually authenticated, logged and expired. The standing tunnel nobody watches is the breach path.
Secure communication channels are objective 4.3 of CISSP Domain 4, Communication and Network Security, 13% of the exam, where the architecture of 4.1 meets the paths people actually use. Work all three Domain 4 objectives with our free CISSP Domain 4 study guide.
#CISSP #ISC2 #VPN #SplitTunneling #SDWAN #VoIP #ZTNA #ThirdPartyRisk #InfoSec #CyberSecurity
Master the network domain
Secure network architecture is the largest objective in CISSP Domain 4, 13% of the exam. Work all 19 topics across three objectives, from the reference models and IPsec through securing network components and every communication channel, with 60 practice questions.
Get the CISSP Domain 4 guideKeep reading
Assessment vs. Audit vs. Pen Test: Test Types, Team Colors, and Why Independence Decides the Answer
CISSP Domain 6 is small, and its questions hinge on distinctions candidates think they already know. Vulnerability assessment against penetration test, black, white and gray box, what red, blue, purple and white teams actually do, KPIs against KRIs, SOC 2 Type I against Type II, and the single principle, independence, that decides who may perform which test and report to whom.
Read CISSP deep divesKerberos Tickets, FAR vs. FRR, and RADIUS vs. TACACS+: The Authentication Systems CISSP Actually Tests
CISSP Domain 5 goes past MFA into the machinery. How Kerberos issues a ticket-granting ticket and why clock skew breaks it, the biometric error rates and the crossover point that compares one system to another, RADIUS against TACACS+ on encryption and command authorization, and the policy decision point, enforcement point and information point vocabulary the exam borrows from XACML.
Read CISSP deep divesWhich Layer Is It? Mapping Attacks to the OSI Model, Plus IPsec AH vs. ESP
The OSI model is on every networking exam, and the CISSP is the one that asks what attacks live at each layer. All seven layers with their unit, device and protocols, the attack the exam pins to each, the TCP/IP model's four-layer collapse, and IPsec pulled apart: AH versus ESP, transport versus tunnel mode, and what IKE and the security association actually negotiate.
ReadFollow Skillthropic
Keep learning between study sessions
The same exam-focused teaching, in smaller pieces, wherever you scroll.
Enjoyed this? Get the AI security news that matters.
Join The AI Security Brief for the top AI security news, plus what's important to the C-suite. Free, straight to your inbox.
No spam. Unsubscribe anytime.