CND (312-38) Network Defense Simulation

Network Scenario

You are a Network Security Analyst monitoring the enterprise edge firewall. A recent "Zero Trust" initiative mandated that all remote administrative access must occur through the corporate VPN, specifically banning direct RDP (TCP/3389) outbound to external cloud providers.

During a routine traffic analysis, you identify that the Marketing department has provisioned their own unauthorized AWS instances ("Shadow IT") and are attempting to bypass the corporate firewall rules to access them. The firewall is correctly dropping the traffic. When you notify the Marketing Manager, they refuse to comply, stating they "need this for an urgent campaign."

To enforce the network security policy and shut down this unmanaged infrastructure, you must escalate the issue up the organizational hierarchy. You need to identify the correct executive role whose primary responsibility is executing the IT policies and plans across the entire organization.

Traffic & Logs

Recent firewall traffic logs showing the dropped policy violations:

[FW-EDGE-01] TIME: 2023-10-27 14:22:01 | ACT: DENY  | SRC: 10.50.22.14 (VLAN_MKTG) | DST: 54.120.x.x (AWS_PUB) | DPT: 3389 | PROTO: TCP | RULE: DROP_OUTBOUND_RDP
[FW-EDGE-01] TIME: 2023-10-27 14:22:15 | ACT: DENY  | SRC: 10.50.22.14 (VLAN_MKTG) | DST: 54.120.x.x (AWS_PUB) | DPT: 3389 | PROTO: TCP | RULE: DROP_OUTBOUND_RDP
[FW-EDGE-01] TIME: 2023-10-27 14:23:05 | ACT: DENY  | SRC: 10.50.22.45 (VLAN_MKTG) | DST: 54.120.y.y (AWS_PUB) | DPT: 3389 | PROTO: TCP | RULE: DROP_OUTBOUND_RDP
[FW-EDGE-01] ALERT: Multiple policy violations detected from Marketing Subnet. Escalation required for policy enforcement.
                

Question

Expert Analysis

1. What is happening in the network

Users in the Marketing VLAN are attempting to initiate outbound RDP sessions to external AWS infrastructure. The enterprise edge firewall is successfully dropping these packets based on the DROP_OUTBOUND_RDP rule, indicating a functional technical control. However, the root cause is a business/policy issue: Shadow IT.

2. Identify attack or behavior

This is not a traditional malicious attack, but rather an insider policy violation (Shadow IT). By spinning up unmanaged cloud infrastructure, the department is bypassing enterprise security monitoring, patching, and access controls, creating a significant blind spot and risk exposure.

3. Why correct answer is correct

A. Chief Information Officer (CIO): The CIO is the executive leader responsible for the execution, management, and alignment of the organization's entire IT infrastructure and strategy. When technical controls (like our firewall rules) meet business resistance, the CIO provides the executive authority to enforce the IT policies and standardize the systems.

4. Why others are wrong

B. Business and functional managers: While they run specific departments (like the Marketing manager in our scenario), they do not manage or execute the enterprise-wide IT policies.

C. Senior management: This group (CEO, Board of Directors) defines the ultimate business objectives and high-level risk appetite, but they do not execute the day-to-day IT operational plans.

D. IT security practitioners: Analysts and engineers implement the technical controls (e.g., configuring the firewall rules to block port 3389), but they operate under the policies established and executed by the CIO and CISO.

5. Defensive action

Maintain the DENY rule on the firewall to protect the network. Compile the firewall logs highlighting the frequent RDP attempts and escalate the incident through the SOC manager to the CIO's office. The CIO will interface with the Marketing department to shut down the Shadow IT and align their requirements with approved enterprise solutions.

6. MINI LESSON: Policy and Network Defense

• Policy Drives Configuration: Firewall rules are merely technical implementations of written business policies.
• Shadow IT: A common network defense challenge where visibility is lost because departments bypass centralized IT.
• Organizational Structure: A network defender must know the org chart. Escaping technical deadlocks often requires knowing who holds the authority to enforce compliance across business units.