CND (312-38) Network Defense Simulation

Welcome to this Network Defense simulation focusing on traffic analysis and anomaly detection. You will analyze a realistic network event, interpret flow metrics, and identify the correct defensive system responsible for detecting the anomaly. Sharpen your Blue Team skills by recognizing how different security controls operate.

Network Scenario

You are a Network Security Analyst monitoring the perimeter of a mid-sized enterprise. The organization relies on standard signature-based NIPS at the edge firewall. During routine monitoring, you receive an automated alert indicating a severe bandwidth saturation event on the external WAN link.

The core router CPU utilization has spiked, and legitimate external users are reporting connection timeouts to the company's customer portal (10.0.50.12). You immediately pull NetFlow data from the edge router to investigate the traffic anomaly.

Traffic & Logs

[SYSTEM ALERT - 08:14:20] Edge-RTR-01 WAN Interface Ingress Utilization > 98% [NETFLOW EXPORT - SENSOR: EDGE-RTR-01] TIME SRC IP DST IP PROTO SPT DPT BYTES PKTS 08:14:22 198.51.100.4 10.0.50.12 UDP 53 80 1.4G 3.2M 08:14:22 203.0.113.88 10.0.50.12 UDP 53 80 1.2G 2.8M 08:14:23 192.0.2.145 10.0.50.12 UDP 53 80 1.3G 3.0M 08:14:23 203.0.113.12 10.0.50.12 UDP 53 80 1.5G 3.4M [TRAFFIC ANALYSIS ENGINE] -> Baseline UDP traffic average: 15 Mbps -> Current UDP traffic rate: 5.4 Gbps -> ALERT: Traffic flow deviation > 35,000% above 30-day baseline. Unusual flow generated.

Question

Which of the following examines network traffic to identify threats that generate unusual traffic flows, such as distributed denial of service (DDoS) attacks, certain forms of malware, and policy violations?

Look closely at the NetFlow export. The system detected a massive deviation from the "30-day baseline." Which technology relies on establishing baselines of normal volume/flow rather than looking for specific malware signatures?

Expert Analysis

1. What is happening in the network

The network edge is experiencing a massive ingress of UDP traffic originating from various external IP addresses. The source port is 53 (DNS) and the destination is port 80 on an internal web server (10.0.50.12). The sheer volume of traffic (over 5 Gbps) has saturated the WAN link, causing legitimate connections to drop.

2. Identify attack or behavior

This is a classic DNS Amplification DDoS Attack. The attackers are spoofing the source IP address of the target (10.0.50.12) and sending small queries to open DNS resolvers (port 53) on the internet. The resolvers are sending massive, amplified responses back to the target, overwhelming its network capacity.

3. Why correct answer is correct

Network Behavior Analysis (NBA) is the correct answer. NBA systems rely on traffic telemetry (like NetFlow, IPFIX, or sFlow) to learn normal network patterns over time. When a massive deviation occurs—such as a 35,000% spike in UDP traffic—the NBA immediately flags it as an anomaly indicative of a DDoS attack. It does not need a signature to know this is bad; the behavior itself is the trigger.

4. Why others are wrong

NIPS relies mostly on deep packet inspection (DPI) and signatures. While some advanced NIPS have anomaly features, standard NIPS struggle with volumetric DDoS because inspecting every packet at 5 Gbps consumes too much processing power. HIPS only protects the individual server and has no visibility into edge router NetFlow. WIPS strictly manages wireless infrastructure.

5. Defensive action

To mitigate this volumetric attack, the defender should integrate the NBA tool with the edge router using BGP Flowspec (RFC 5575) to dynamically inject routing rules that drop UDP/53 traffic destined for 10.0.50.12 at the edge. Additionally, engaging the ISP for upstream DDoS scrubbing is required if the pipe is already fully saturated.

6. MINI LESSON

Detection vs Prevention: Signatures (IDS/IPS) are great for known exploits (e.g., Log4j payload). Baselines (NBA) are essential for unknown volumetric events or insider threats moving large amounts of data.
Traffic Pattern Recognition: High volume of UDP from Port 53, 123 (NTP), or 1900 (SSDP) directed at a single host is almost always an amplification DDoS.
Data Sources: NBA requires flow data (NetFlow/sFlow). Ensure your routers and core switches are configured to export this telemetry to your analysis engine.

Ready to master Network Defense?

Practice with hundreds of realistic scenarios covering firewalls, IDS/IPS, VPNs, and packet analysis.

Explore more CND simulations