Welcome to this CND practice simulation. Here you will evaluate how standard operational activities map to formal security frameworks. A mature network defense strategy relies heavily on structured methodologies, such as the NIST Incident Response Life Cycle, to ensure predictable and comprehensive handling of threats.

CND (312-38) Network Defense Simulation

Network Scenario

You are the lead Network Security Analyst for a growing enterprise. Following a recent security audit, the CISO has mandated that the Security Operations Center (SOC) formally map all of their playbooks and operational activities to the NIST Incident Response Life Cycle (SP 800-61). You have been given a list of routine SOC activities and must correctly map them to the corresponding phases of the NIST framework to update the organization's standard operating procedures (SOPs).

Traffic & Logs

Review the SOC Activity Report detailing recent defensive actions taken by the team:

[SOC ACTIVITY REPORT - Q3] Task 101: Upgraded edge firewalls, deployed baseline secure configurations, and established secure out-of-band communication channels for the IR team. Task 102: Analyzed Suricata IDS alerts correlated with unusual outbound DNS requests to identify a potential C2 beacon. Task 103: Isolated infected subnets using VLAN ACLs (VACLs) and restored domain controllers from known-good offline backups. Task 104: Held a "Lessons Learned" meeting to update the IDS ruleset based on a bypassed malware signature.

Question

Match the following NIST security life cycle components with their activities:

NIST Components (1-4)	Activities (i-v)
1. Preparation	i. Holding a lessons-learned meeting and improving defenses.
2. Detection and Analysis	ii. Purchasing general office equipment for HR. (Out of scope)
3. Containment, Eradication, and Recovery	iii. Reviewing IDS alerts and identifying indicators of compromise.
4. Post-Incident Activity	iv. Deploying secure baseline configurations and establishing IR communication channels.
	v. Isolating affected subnetworks and restoring servers from clean backups.

Hint: Think about the chronological order of defending a network. You prepare first (baselines/comms), then detect the threat (IDS alerts), then contain and recover (isolation/backups), and finally conduct post-incident reviews (lessons learned).

Expert Analysis

1. What is happening in the network

The SOC is structuring its daily and emergency operations to align with a formal framework. This is critical for network defense because ad-hoc responses often lead to destroyed evidence, incomplete eradication of threats, and repeated compromises via the same vulnerabilities.

2. Identify behavior

By mapping specific tasks (like isolating a VLAN or reviewing Suricata logs) to formal NIST SP 800-61 phases, the team ensures that no critical steps—especially Preparation and Post-Incident learning—are skipped during the chaos of a live cyber attack.

3. Why the correct answer is correct

A. 1-iv, 2-iii, 3-v, 4-i correctly maps the standard NIST SP 800-61 phases:

1. Preparation -> (iv) Deploying baselines and setting up IR communications happens before an incident.
2. Detection and Analysis -> (iii) Identifying IOCs and reviewing IDS alerts is how you confirm an incident is occurring.
3. Containment, Eradication, and Recovery -> (v) Isolating subnets stops the spread, and restoring from backups recovers operations.
4. Post-Incident Activity -> (i) The lessons-learned phase is essential for updating defenses to prevent recurrence.

4. Why others are wrong

Other options scramble the logical timeline. For example, mapping Preparation (1) to a lessons-learned meeting (i) puts the end of the cycle at the beginning. Mapping Detection (2) to deploying baselines (iv) confuses proactive security hardening with active threat hunting and monitoring.

5. Defensive action

Ensure that all network defense tools are aligned with these phases. Firewalls and secure baselines belong in Preparation; SIEMs and IDS/IPS belong in Detection; NAC (Network Access Control) and isolation scripts belong in Containment.

MINI LESSON: The NIST SP 800-61 Cycle in Practice

Preparation: The most crucial phase. If you do not have packet capture (PCAP) tools, centralized logging (Syslog/SIEM), and out-of-band comms set up before an incident, your analysis and containment will fail.
Detection & Analysis: Distinguishing true positives from false positives. Network defenders use NetFlow, firewall logs, and IDS signatures here.
Containment Strategy: You must decide between shutting down a system immediately (to stop damage) vs. leaving it running temporarily (to monitor attacker behavior and gather volatile memory evidence).
Post-Incident: If an attacker bypassed the perimeter firewall, the ruleset must be modified here. A failure to update defenses guarantees a repeat attack.

Ready to test more Network Defense concepts?

Master network traffic analysis, perimeter security, and threat detection.

Explore more CND simulations