Home ExamRange Practice Tests

CND (312-38) Network Defense Simulation

In this module, you will evaluate a critical component of a disaster recovery and backup infrastructure. You will learn to identify the types of storage media utilized for air-gapped network backups and long-term log retention.

Network Scenario

You are auditing the Business Continuity and Disaster Recovery (BCDR) architecture for a financial institution. The network generates massive amounts of PCAP (Packet Capture) data and syslog archives daily. To defend against ransomware, the security policy requires that long-term archival data must be physically isolated (air-gapped) after being written.


The network engineering team is deploying an LTO (Linear Tape-Open) tape library system for this exact purpose. As a Network Defender, you must verify the operational characteristics of this backup media to ensure logs can be properly retained and eventually restored during a forensic investigation.

Traffic & Logs

[08:15:22] [INFO] Backup Job #9942 Initiated: Core_Switch_PCAPS_Q3 [08:15:25] [INFO] Target Media: TapeDrive_LTO8_Unit_01 [08:15:30] [WARN] Seek time latency detected. Media requires spooling to block 0x4A2B. [08:16:01] [INFO] Writing data blocks. Operation mode: Append-Only. [08:45:00] [INFO] Volume complete. Ejecting media for secure offsite vaulting. [08:45:05] [INFO] Alert: Data retrieval from this device requires reading previous blocks to reach target sector.

Question

Fill in the blank with the appropriate term. In computing, ______________ is a class of data storage devices that read their data in sequence.
Hint: Look at the backup logs. The media requires "spooling" and "reading previous blocks to reach the target sector," meaning it cannot jump directly to a location like a hard drive or RAM. It reads in a specific order.

Expert Analysis

1. What is happening in the network

The organization is utilizing a tape backup system (LTO-8) to archive network packet captures. The system logs clearly indicate that finding a specific piece of data requires the physical media to "spool" sequentially to reach the correct block.

2. Identify behavior

This behavior is characteristic of Sequential Access Memory. Unlike flash storage or spinning disks where the read head can jump directly to a sector, tape drives must read the data in a linear sequence from start to finish.

3. Why the correct answer is correct

SAM (Sequential Access Memory) is a class of data storage devices that read stored data in a sequence. Magnetic tape is the most common example of SAM used in modern enterprise environments for deep archiving.

4. Why others are wrong

RAM (Random Access Memory) and ROM (Read-Only Memory) allow data to be accessed in any order in constant time. DASD (Direct Access Storage Device), like hard disk drives, also allow direct/random access to blocks without reading all preceding data.

5. Defensive action

Network defenders incorporate SAM technologies (like tape backups) into their disaster recovery plans because they are easily taken offline (air-gapped). If ransomware encrypts network-attached storage (NAS/SAN/DASD), the offline sequential tapes remain secure and untainted.

6. MINI LESSON: Data Storage in Network Defense

  • Air-Gapping: The physical isolation of backup media from the production network. Crucial for defeating modern lateral-moving malware.
  • Recovery Time Objective (RTO): SAM devices have high sequential read/write speeds but very poor random read speeds. They are ideal for full restorations but poor for quick, single-file retrievals.
  • The 3-2-1 Backup Rule: Maintain 3 copies of data, across 2 different media types (e.g., Disk and Tape/SAM), with 1 copy stored offsite.

Ready to advance your Network Defense skills?

Master storage protocols, disaster recovery, and network analysis.

Explore more CND simulations