CND (312-38) Network Defense Simulation

1. What is happening in the network

The Building Management System (BMS) logs indicate a physical hazard in the data center. Ionization sensors have detected elevated particulate matter consistent with combustion (fire). This is an environmental threat to the network infrastructure's physical hardware.

2. Identify attack or behavior

This is a physical security incident involving an environmental hazard (fire/combustion) rather than a logical cyber attack. Physical security is a fundamental layer of defense-in-depth.

3. Why correct answer is correct

E. Smoke alarm system is correct. In physical security, detection systems (like smoke alarms and flame detectors) are the primary mechanism for observing and alerting administrators to the presence of combustion, heat, or flame in the environment.

4. Why others are wrong

• A, C, D (Fire extinguishing system, Gaseous systems, sprinklers): These are all suppression systems. Their job is to mitigate or extinguish the fire after it has been detected, not to act as the primary detection mechanism.
• B. None: Incorrect, as an applicable detection mechanism is listed.

5. Defensive action

To defend against environmental threats, a Network Defender should ensure:

• SIEM Integration: Environmental alarms (BMS/SCADA) must be integrated into the central SIEM for immediate SOC visibility.
• Automated Shutdowns: Ensure HVAC systems automatically shut down upon detection to prevent feeding oxygen to the fire and spreading smoke to other server racks.
• Suppression Interlocks: Ensure smoke detection is tied to the pre-action or gaseous (e.g., FM-200, Novec 1230) release mechanisms to protect IT assets without water damage.