CND (312-38) Network Defense Simulation
Master Layer 1 security and physical infrastructure analysis by identifying common media types and understanding their vulnerabilities to physical disruption and interference.
Network Scenario
You are conducting a physical security and infrastructure baseline audit at a newly acquired branch office. The site relies on a DOCSIS cable modem for its primary WAN connection, connecting the internal firewall to the ISP.
The network monitoring system shows the WAN link experiencing intermittent signal degradation, high Bit Error Rates (BER), and packet loss during peak business hours. You suspect Electromagnetic Interference (EMI) from nearby industrial HVAC equipment is penetrating the physical transmission medium.
Upon inspecting the wiring closet, you determine you need to identify the existing cabling to see if it lacks sufficient shielding for a high-noise environment, causing a physical-layer Denial of Service (DoS) condition.
Traffic & Logs
Below are diagnostic logs from the cable modem's administrative interface and notes from your physical layer inspection.
Question
Which of the following types of coaxial cable used for cable television and cable modems?
Expert Analysis
1. What is happening in the network
The branch office's primary WAN connection is suffering from severe signal attenuation and noise (low SNR, high uncorrectable codewords). This suggests the physical cabling connecting the ISP demarc to the cable modem is inadequate for its environment, allowing EMI/RFI to disrupt the signal.
2. Identify attack or behavior
While this is an environmental issue, the result is an unintentional Layer 1 Denial of Service (DoS). An attacker could also intentionally exploit poorly shielded coaxial cables by introducing a strong localized electromagnetic field to jam the signal or utilizing induction to eavesdrop on unencrypted baseband analog traffic.
3. Why the correct answer is correct
B. RG-59 is correct. RG-59 is a 75-ohm coaxial cable historically used for baseband video, CCTV, and older, short-run cable television (CATV) or cable modem deployments. Because of its thinner center conductor and single-layer shielding, it is highly susceptible to high-frequency attenuation and EMI over long distances.
4. Why others are wrong
A. RG-8: A 50-ohm cable ("Thicknet") historically used for older 10Base5 Ethernet bus topologies.
C. RG-58: A 50-ohm cable ("Thinnet") historically used for older 10Base2 Ethernet networks.
E. RG-62: A 93-ohm coaxial cable historically used for ARCNET and IBM 3270 terminal networks. It is not used for CATV/cable modems.
5. Defensive action
As a network defender evaluating infrastructure resilience, you must mandate a Layer 1 upgrade. Replace the legacy RG-59 cable with RG-6 (preferably Quad-Shielded). RG-6 has a thicker conductor and superior shielding, drastically reducing signal loss and protecting against the EMI causing the network dropouts.
MINI LESSON: Layer 1 Security & Physical Media
Traffic Pattern Recognition: Layer 1 issues often manifest as "Uncorrectable Codewords," Frame Check Sequence (FCS) errors, or CRC errors in your interface statistics. Traffic will look normal logically, but TCP retransmissions will spike due to dropped frames at the physical layer.
Defensive Mindset: Defense-in-depth begins at Layer 1. A state-of-the-art firewall cannot protect a network whose physical media is vulnerable to simple environmental disruption or physical tampering. Always verify that infrastructure cabling matches the required impedance (e.g., 75 ohms for broadband/video) and environmental shielding requirements.
Ready for the next scenario?
Enhance your blue team skills with more hands-on network defense simulations.
Explore more CND simulations