CND (312-38) Network Defense Simulation

Learn to differentiate wireless network architectures based on coverage area and use cases. This scenario focuses on identifying the appropriate network classification for short-range personal connectivity.

Network Scenario

An enterprise office implements a BYOD (Bring Your Own Device) policy. Employees utilize various peripherals including wireless keyboards, headsets, and smartwatches. The Network Security team is auditing the office environment to identify potential "hidden" networks that could be used for data exfiltration via proximity-based attacks.

You are observing small pockets of low-power radio frequency (RF) activity centered around individual workstations. These signals do not extend beyond the immediate cubicle area, typically dropping off after 15–30 feet.

Traffic & Logs

# RF Spectrum Analysis - Scan Results

[10:45:01] Detected IEEE 802.15.1 (Bluetooth) pairing request. Signal Strength: -45dBm (Strong)
[10:45:15] Device ID: PER-HID-0293 connected to Workstation-A.
[10:46:22] Beacon frame detected at 2.4GHz. Proximity: < 5 meters.
[10:48:00] Signal attenuation > 90% observed at boundary of 10 meters.
[10:50:05] ALERT: Unrecognized short-range link established. Classification: Personal Space Connectivity.

Question

Which of the following wireless networks provides connectivity over distance up to 20 feet?

Expert Analysis

1. What is happening in the network

The logs show low-power RF activity utilizing the 2.4GHz spectrum with very high signal attenuation outside of 5–10 meters. This behavior is characteristic of peripherals connecting to a host device within a very localized "bubble."

2. Identify behavior

The activity is identified as **Wireless Personal Area Network (WPAN)** communication. Common protocols here include Bluetooth (802.15.1) and Zigbee (802.15.4), which are designed for power efficiency and short distance rather than broad coverage.

3. Why Correct (B) is Correct

WPAN is specifically designed for distances around 10 meters (roughly 30 feet) or less. Connectivity at 20 feet falls squarely within the operational envelope of a Personal Area Network, often used for connecting personal peripherals to a PC or mobile device.

4. Why others are wrong

WMAN: Wireless Metropolitan Area Networks (e.g., WiMAX) cover entire cities or large campuses (miles).
WLAN: Wireless Local Area Networks (e.g., Wi-Fi) typically cover 100–300 feet (30–100 meters) indoors.
WWAN: Wireless Wide Area Networks (e.g., LTE/5G) cover vast geographical areas using cellular towers.

5. Defensive Action

Defenders must monitor WPANs for unauthorized "Bluejacking" or "Bluesnarfing." Organizations should enforce policies requiring Bluetooth to be in "non-discoverable" mode and use strong pairing PINs to prevent unauthorized entry points into endpoints.

MINI LESSON: Traffic Pattern Recognition

In network defense, distance often dictates the protocol and the potential threat surface:

WPAN (< 30 ft): Threat = Proximity/Physical Access required.
WLAN (100-300 ft): Threat = Wardriving/Parking lot intercept.
WWAN/WMAN (Miles): Threat = Large scale infrastructure/Carrier-grade attacks.

Explore more CND simulations

Go to Practice Tests