CND (312-38) Network Defense Simulation
Welcome to this scenario-based practice module. You will learn to recognize specific network device CLI modes, a critical skill for auditing router access, analyzing shell history logs, and understanding initial administrative (or attacker) reconnaissance.
Network Scenario
You are investigating an alert triggered by your SIEM regarding a brief connectivity drop on the external perimeter router (`10.0.1.254`). To perform a preliminary, non-disruptive check, you SSH into the router using a read-only auditing account.
Your objective is to safely gather system information (uptime, version) and verify basic external reachability without accidentally modifying any routing protocols, ACLs, or interfaces.
Traffic & Logs
SSH terminal session output (Syslog recorded):
Note: Observe the command prompt symbol and the failure of the final command, which indicates the current privilege boundary.
Question
Expert Analysis
1. What is happening in the network
An administrator (or analyst) has authenticated to the network edge router. They are currently operating within the lowest privilege shell environment, executing basic `ping` commands and querying the OS version. The attempt to view the running configuration (`show run`) was rejected by the router due to insufficient privileges.
2. Identify Attack or Behavior
This represents standard administrative troubleshooting. However, from a defensive standpoint, if an attacker guesses a weak VTY/SSH password or exploits default credentials, they will land in this exact mode. Their initial behavior will mirror this: running basic `show` and `ping` commands to map the network environment before attempting to escalate privileges to view or alter the configuration.
3. Why correct answer is correct
C. user EXEC is the correct mode. Characterized by the `>` prompt, user EXEC mode allows an operator to perform basic, non-disruptive tests (like `ping` or `traceroute`), view system information (`show version`), and temporarily modify terminal settings (`terminal length`). It strictly prevents viewing sensitive configurations or modifying device behavior.
4. Why others are wrong
- D. Global Config: Incorrect. Characterized by the `(config)#` prompt, this mode is used to make system-wide changes to the router's operation (e.g., setting hostnames, routing protocols).
- E. Privileged EXEC: Incorrect. Characterized by the `#` prompt, this mode is entered via the `enable` command and allows full viewing of configurations (`show run`), detailed debugging, and file system management.
- B. UI Config: Incorrect. This is a distractor term not used in standard Cisco IOS CLI terminology.
5. Defensive Action
Network defenders must implement AAA (Authentication, Authorization, and Accounting) via TACACS+ or RADIUS. This ensures that even in user EXEC mode, commands are logged and audited. Furthermore, VTY lines (SSH) must be protected with strong passwords, rate-limiting, and ACLs restricting access to designated management subnets only.
6. MINI LESSON: Cisco IOS Privilege Levels
- User EXEC (Level 1): Prompt:
Router>. Limited to basic troubleshooting (ping, traceroute) and harmless viewing. Cannot see running config. - Privileged EXEC (Level 15): Prompt:
Router#. Reached via theenablecommand. Full access to view configurations, restart interfaces, and debug. - Global Configuration: Prompt:
Router(config)#. Reached viaconfigure terminal. Used to write active changes to the device's operational behavior.
Ready for more network analysis?
Improve your defensive mindset with full-length CND practice exams.
Explore more CND simulations