Network & Endpoint Security (CISA Domain 5, Section 5.4)

Every attack on an organisation travels across a network and lands on an endpoint. Section 5.4 of the CISA body of knowledge asks the IS auditor to judge whether both are controlled: whether every connection runs over a trusted, segmented path, and whether every device is hardened, monitored and able to be contained. This course is written from the auditor’s point of view throughout. The question is never just “is this control in place?” but “what evidence proves it is working at the point where it is actually enforced?” It is independently produced exam preparation and staff development material. It is not affiliated with or endorsed by ISACA, and it does not replace official exam guidance. The programme builds from foundations to defence: the OSI model, encapsulation, LANs and WANs, IPv4, IPv6 and NAT, and how protection maps to each layer; network infrastructure, architectures (centralised, distributed, hybrid and software-defined), application models and network types; core services such as DNS, DHCP, directory, RADIUS and PKI, and the swap from cleartext protocols to secure alternatives; VPNs and why the tunnel never protects the device, network-attached storage, CDNs and time synchronisation; networked applications, middleware and on-demand computing; device hardening and wireless security; firewalls from packet filters to next-generation, WAFs, the rule lifecycle, DMZ design, classic firewall architectures, UTM and IDS/IPS; segmentation methods and zero trust; and the full endpoint lifecycle, including hardening, preventive controls, EDR, XDR and endpoint incident response. The recurring thread is the assurance chain: map, inventory, harden, segment, monitor and respond. If the early links are missing, nothing after them can be relied on. The final modules pull it together into audit practice: defence in depth and the layered architecture, logging and telemetry quality, audit objectives covering both design and operating effectiveness, and worked evidence and tests for devices, firewalls, segmentation, VPNs, endpoints and response. A case study traces how a contractor’s remote laptop became a route to customer data, and ten practice questions build the CISA habit of choosing the FIRST, BEST, MOST or GREATEST answer. Assessment is an online 20-question exam at a 70% pass mark, leading to a verifiable SKEDMIA certificate.