CND (312-38) Network Defense Simulation
Master the fundamentals of physical network architecture. Understanding how endpoints physically connect to central devices is critical for identifying rogue hardware, isolating compromised segments, and planning physical access controls.
Network Scenario
You are a Network Security Analyst auditing the physical access layer of the Finance department following alerts of an unauthorized MAC address spoofing attempt. To deploy appropriate defensive controls (like port security and physical switch protection), you are reviewing the structural layout of the network.
The documentation states: "All Finance endpoints are located in Open Area B. Each workstation has a dedicated Cat6 Unshielded Twisted-Pair (UTP) cable running from the wall jack directly to a central Cisco Catalyst 9200 access switch located in Wiring Closet IDF-2."
Traffic & Logs
A partial output of the access switch's MAC address table confirms the baseline port mapping expected in this specific physical layout:
*Note: 1-to-1 mapping confirms centralized endpoint termination.
Question
Which of the following topologies is a type of physical network design where each computer in the network is connected to a central device through an unshielded twisted-pair (UTP) wire?
Expert Analysis
1. What is happening in the network
The network documentation and the 1-to-1 MAC address mapping indicate a centralized access layer design. Each endpoint relies on a dedicated UTP cable terminating at a single core device (the Catalyst switch in IDF-2). The analyst must recognize this standard LAN architecture to properly deploy layer 2 security controls.
2. Identify behavior
This layout creates individual collision domains for every endpoint (assuming a switch, not a hub, is the central device). However, it establishes a single point of failure and a concentrated area where all physical traffic converges.
3. Why correct answer is correct (B. Star topology)
Star topology is the exact physical design described. Every node connects individually to a central connection device (switch or hub) using UTP cabling. For a network defender, this topology is highly advantageous because it allows centralized application of security policies (like 802.1X, MAC filtering, and Port Security) at the switch level, and allows easy traffic mirroring (SPAN) for IDS monitoring.
4. Why others are wrong
- A. Mesh topology: Every node connects to every other node. While excellent for redundancy and routing at Layer 3, it is not used for physical endpoint UTP connections due to excessive cabling and cost.
- C. Ring topology: Devices are connected in a closed loop (like legacy Token Ring or FDDI). If one cable breaks, the ring can fail (unless it's a dual ring). It lacks the central device characteristic.
- D. Bus topology: All devices share a single common physical cable (a backbone or bus). This is a security nightmare, as any host can passively sniff all traffic on the shared medium. It does not use a central device for individual connections.
5. Defensive action
In a Star topology, the physical security of the central device (wiring closet) is paramount. Furthermore, because a wall jack connects directly to the switch, an attacker could unplug a legitimate PC and plug in a rogue device or a mini-switch. The defender must implement Port Security (Sticky MAC), BPDU Guard, and 802.1X Authentication on all access ports to ensure only authorized endpoints can utilize the physical star connections.
Ready for more complex defensive scenarios?
Master IDS log analysis, packet inspection, and threat hunting.
Explore more CND simulations