ExamRange – CND 312-38 Simulation

In this module, you will evaluate the security implications of persistent WAN connections. You will identify which connectivity types maintain an "always-on" state, creating a permanent exposure window for remote endpoints.

Network Scenario

You are configuring a remote access VPN policy for teleworkers. The threat intelligence team has noted a massive increase in automated, opportunistic port scanning directed at residential IP ranges.

Employees utilizing legacy technologies (like dial-up) acquire an IP address dynamically, use the internet, and then terminate the connection. This drops their presence from the internet. However, modern broadband technologies maintain a constant state of sync with the ISP. While convenient, this constant connection means the endpoint's public IP remains static for days or weeks, making it continuously vulnerable to background internet radiation, brute-forcing, and vulnerability scanning.

You need to identify which of the following connection technologies create this "always-on" risk profile so you can mandate stricter host-based firewall configurations for users on these networks.

Traffic & Logs

External Firewall & Teleworker VPN Connection Logs

[10:00:00] [INFO] IDS_Sensor_External: Routine automated SSH brute-force attempts detected targeting ISP Block 203.0.113.0/24. [12:00:00] [WARN] Policy_Alert: Teleworker endpoint 203.0.113.88 has been online for 168+ hours without IP rotation or circuit disconnect. [12:05:00] [INFO] Connection Profile Check: Circuit type identified as Persistent/Broadband. [12:05:05] [ACTION] Applying "Strict_AlwaysOn" endpoint firewall template to device. Defaulting to DROP for all inbound traffic. [14:12:22] [WARN] Failed login attempt logged from WAN interface on Teleworker endpoint 203.0.113.88.

Question

Expert Analysis

1. What is happening in the network

A teleworker is connected to the corporate VPN using a broadband connection. Because the connection is persistent (online for over 168 hours), the endpoint's public IP has become a target for automated internet background noise, resulting in SSH brute-force attempts directly against the teleworker's home router/endpoint.

2. Identify behavior

The behavior identified is a persistent exposure window. "Always-on" connections do not drop the circuit to the ISP, meaning the public IP address is highly static. Attackers can scan, index, and continuously attack these IPs over long periods.

3. Why the correct answer is correct

DSL (Digital Subscriber Line) and Cable Modems are broadband technologies designed to be "always-on". They constantly maintain synchronization with the ISP's infrastructure (DSLAM or CMTS), providing a persistent internet connection.

4. Why others are wrong

Analog Modems and Digital Modems (ISDN) are dial-up technologies. They establish a circuit-switched connection over telephone lines only when data needs to be transmitted, and they hang up when idle. This breaks the internet connection and changes the IP address upon the next dial-in.

5. Defensive action

When defending networks with remote users on "always-on" connections, defenders must assume the endpoint is under constant attack from the WAN side. Enforce strict endpoint firewall policies (deny all inbound), disable remote administration on residential routers, and mandate robust VPN tunneling for corporate access.

6. MINI LESSON: Attack Surface Exposure Time

Exposure Window: The duration a device is accessible from an untrusted network. "Always-on" means a 24/7 exposure window.
IP Churn: Technologies that disconnect frequently cause IP churn. Attackers mapping an IP today might find a different user on that IP tomorrow, complicating targeted attacks.
Defense-in-Depth: Because the ISP connection is persistent, the first line of defense must be pushed directly to the endpoint (host-based IPS/Firewall).

CND (312-38) Network Defense Simulation