CND (312-38) Network Defense Simulation

Welcome to this interactive network defense scenario. You will evaluate common security configurations applied to a public-facing wireless network, differentiating between actual cryptographic protection and mere obfuscation techniques.

Network Scenario

You are a network security consultant evaluating a newly deployed guest Wi-Fi network at a local cafe. The cafe owner, attempting to secure the network against local eavesdroppers, has configured the wireless router using advice found on various tech blogs.

They want to ensure that user traffic cannot be sniffed effortlessly by anyone sitting in the cafe with a laptop. You need to identify which of their applied configurations actually constitute "security measures" (providing data protection) versus those that are simply "security through obscurity."

Traffic & Logs

You pull the configuration from the Wireless Access Point (WAP) controller to review the active settings on the `Cafe-Guest` interface:

wlan config cafe-guest-net ssid Cafe-Guest broadcast-ssid disable mac-filtering enable mac-list allow 00:1A:2B:3C:4D:5E 00:99:88:77:66:55 security wpa-tkip encryption wep 128-bit status active ! end

Question

You just set up a wireless network to customers in the cafe. Which of the following are good security measures implemented? Each correct answer represents a complete solution. Choose all that apply.

Select all correct options, then click Submit.

Defensive Hint: Focus on confidentiality. Which of these options actually manipulate the data payload to protect it from packet sniffers? "Hidden" networks and whitelists do not encrypt data. While some of these algorithms are deprecated in modern enterprise networks, they are still fundamentally *encryption measures*.

Incorrect Analysis: You selected options that either do not provide cryptographic security or missed the actual encryption mechanisms. Obfuscation techniques like hiding the SSID or checking MAC addresses provide zero protection against a passive packet sniffer.

Expert Analysis

1. What is happening in the network

The cafe manager has enabled multiple layers of configuration: two forms of encryption (WEP/WPA), disabled SSID broadcasting, and enabled MAC filtering. A network defender must evaluate which of these actually secure the data layer.

2. Identify behavior or attack

In a cafe environment, the primary threat is passive eavesdropping using tools like Wireshark or Kismet, followed by active attacks (deauthentication, MITM). If a network only uses MAC filtering or hides the SSID, all traffic is still sent over the air in cleartext, meaning session cookies, unencrypted HTTP traffic, and DNS queries are visible to everyone.

3. Why correct answers are correct

A. WEP encryption and B. WPA encryption. While WEP is cryptographically broken and WPA (TKIP) is highly vulnerable, in the context of foundational security mechanisms, they are the only options listed that actually encrypt the data payload, providing a layer of confidentiality (even if flawed) over a completely open network.

4. Why others are wrong

C. Not broadcasting the SSID: This is security through obscurity. The SSID is still transmitted in cleartext during client probe requests and association frames. Anyone with a passive scanner will see the SSID the moment a legitimate client connects.
D. The MAC-filtering router: MAC addresses are transmitted in the cleartext header of every 802.11 frame. An attacker can easily sniff an allowed MAC address from the air and spoof their own network interface to bypass the filter instantly.

5. Defensive action

For modern network defense, WEP and WPA(TKIP) must be replaced with WPA2/WPA3 (AES-CCMP). However, for a public cafe, managing passwords or MAC lists is unrealistic. The modern approach is to deploy an "Open" network using Opportunistic Wireless Encryption (OWE / WPA3-Enhanced Open) which provides individualized encryption for every user without requiring a shared password, combined with Client/AP Isolation to prevent guests from communicating with each other.

6. MINI LESSON:

Encryption vs. Obfuscation: True security relies on mathematical complexity (encryption), not on hiding identifiers (obfuscation). If a control relies on the attacker "not knowing" a cleartext value (like an SSID or MAC), it will fail against a prepared adversary.
Traffic Pattern Recognition: MAC filtering and hidden SSIDs provide a false sense of security. A network monitor will instantly reveal client MACs communicating with the BSSID, and the true SSID will appear in the Probe Response frames.

Ready to master more defensive concepts?

Explore more realistic CND scenarios and elevate your Blue Team skills.

Explore more CND simulations