CND (312-38) Network Defense Simulation

Network Scenario

You are a Network Security Analyst auditing the perimeter and physical security of a primary data center. The data center houses core distribution switches, the main firewall cluster, and localized Active Directory domain controllers.

Recently, the security team discovered a discrepancy between badge access logs and CCTV footage. An unauthorized individual was able to gain access to the server room because an authorized employee dropped their proximity badge in the parking lot.

To implement a robust Defense-in-Depth strategy, physical security (Layer 1) must be upgraded to ensure the individual requesting access is inherently the authorized user, rather than simply possessing an authorized token.

Traffic & Logs

Reviewing the physical access control system (PACS) logs for the incident timeline:

Question

Fill in the blank with the appropriate term. A _______________device is used for uniquely recognizing humans based upon one or more intrinsic physical or behavioral traits.

Expert Analysis

1. What is happening in the network scenario:
The logs indicate a physical security breach. An authentication server granted access to the critical data center because a valid RFID proximity badge ("something you have") was presented. The system could not verify if the person holding the badge was the actual owner.

2. Identify attack or behavior:
This is an unauthorized access event caused by a lost/stolen credential. In physical network defense, relying solely on possession-based tokens makes the facility vulnerable to credential theft or "tailgating/piggybacking".

3. Why correct answer is correct:
A biometric device measures intrinsic human characteristics (e.g., fingerprints, iris patterns, facial geometry). Because these traits are inherently tied to the individual, they cannot be easily dropped in a parking lot and used by a malicious actor.

4. Why others are wrong:
Cryptographic and proximity devices are tokens (possession). If stolen, the system cannot differentiate between the attacker and the legitimate user. Heuristic analysis applies to network traffic and software behavior (e.g., an IPS detecting a zero-day worm), not physical human authentication.

5. Defensive action:
To remediate this physical vulnerability, the network defender should implement multi-factor authentication (MFA) at the data center door. Combining the existing proximity badge (Layer 1: Possession) with a biometric scanner (Layer 2: Inherence) ensures robust physical access control.