CND (312-38) Network Defense Simulation
Welcome to this Network Defense simulation. In this scenario, you will act as a Network Security Analyst identifying fundamental infrastructure components necessary for enforcing physical and link-layer wireless security policies.
Network Scenario
Your organization is integrating a newly acquired branch office into the corporate security monitoring framework. As part of a defense-in-depth strategy, the security team needs to enforce 802.1X port-based authentication on all access layer switches to prevent rogue devices from joining the wired network.
During the network mapping phase, you discover several switch ports trunking multiple VLANs. You query the switch using Link Layer Discovery Protocol (LLDP) to identify the connected devices broadcasting the branch's wireless networks.
Traffic & Logs
Switch_Branch_01# show lldp neighbors detail
------------------------------------------------
Local Intf: Gi1/0/24
Chassis id: 00:1A:2B:3C:4D:5E
Port id: eth0
System Name: Branch-Floor1-WiFi
System Description: Enterprise Wireless Infrastructure
Time remaining: 112 seconds
System Capabilities: B, W
Enabled Capabilities: B, W
Management Addresses:
IP: 10.50.10.5
OID:
VLAN: 50
Auto Negotiation - supported, enabled
Physical media capabilities:
1000baseT(FD)
100base-TX(HD)
100base-TX(FD)
10base-T(HD)
10base-T(FD)
Note: System Capabilities 'B' denotes Bridge, 'W' denotes WLAN Access Point.
Question
Expert Analysis
1. What is happening in the network
The network defender is auditing switch ports to identify infrastructure endpoints. The LLDP query reveals a device on Gi1/0/24 bridging a wired connection to wireless clients.
2. Identify attack or behavior
This is a foundational network mapping exercise. Identifying infrastructure hardware is critical before implementing access control lists (ACLs), rogue detection, or NAC (Network Access Control) like 802.1X. Unidentified devices acting as bridges are prime vectors for network bridging attacks or unauthorized access.
3. Why correct answer is correct
B. WAP (Wireless Access Point): A WAP operates primarily at OSI Layer 2. It serves as the central transmitter and receiver of wireless radio signals and bridges the 802.11 (wireless) traffic to the 802.3 (wired Ethernet) network. This is the exact device that allows wireless devices to connect to the broader network infrastructure.
4. Why others are wrong
- A. Express card & C. WNIC: These are client-side components (Wireless Network Interface Cards). They allow an individual device to connect, but they do not serve as the infrastructure node that "allows [other] wireless communication devices to connect."
- D. Wireless repeater: A repeater extends the range of an existing wireless signal by regenerating it. It does not act as the primary bridge connecting the wireless network to the wired backbone.
5. Defensive action
Once WAPs are identified, defenders should ensure switch ports connected to them are configured as trusted trunk ports, utilize MAC Security (MACsec) if supported, and are monitored heavily for anomalous VLAN hopping or rogue MAC addresses appearing behind the port.
6. MINI LESSON
In network defense, properly distinguishing between infrastructure (WAP, Switches, Routers) and clients (WNICs, endpoints) is critical for configuring IDS/IPS zones. A WAP acts as a network bridge. If an attacker physically replaces an authorized WAP with a rogue WAP, they bypass wireless encryption. This is why securing the physical switch port via 802.1X or strict MAC filtering (though MACs can be spoofed) is a vital layer of defense-in-depth.