CND (312-38) Network Defense Simulation

Welcome to this interactive network defense scenario. You will learn to identify core wireless security standards by analyzing Wi-Fi deployment protocols and network parameters to ensure robust network encryption and authentication.

Network Scenario

You are the Network Security Analyst for a regional healthcare provider. Following a recent compliance audit, it was discovered that a branch clinic's wireless network is still utilizing legacy security protocols that are susceptible to offline dictionary attacks and Initialization Vector (IV) collisions.

You have been tasked with migrating the branch's wireless infrastructure to a standard that mandates CCMP (Counter Mode CBC-MAC Protocol) based on AES encryption, replacing the deprecated TKIP and WEP algorithms. You capture network traffic to verify the beacon frames are advertising the correct robust security parameters.

Traffic & Logs

A packet capture of the Management Frames from the new Access Point reveals the following Information Elements:

Frame 182: 214 bytes on wire IEEE 802.11 Beacon frame, Flags: ........C Tagged parameters (72 bytes) Tag: SSID parameter set: "Clinic-Secure-WiFi" Tag: Supported Rates Tag: RSN Information Tag Number: 48 (RSN Information) Tag length: 20 RSN Version: 1 Group Cipher Suite: 00:0f:ac (OUI: IEEE 802.11) Type 4 (AES (CCM)) Pairwise Cipher Suite Count: 1 Pairwise Cipher Suite List: 00:0f:ac (OUI: IEEE 802.11) Type 4 (AES (CCM)) Auth Key Management (AKM) Suite Count: 1 Auth Key Management (AKM) List: 00:0f:ac (OUI: IEEE 802.11) Type 1 (802.1X)

Question

Which of the following standards is an amendment to the original IEEE 802.11 and specifies security mechanisms for wireless networks?

Defensive Hint: Look at the packet capture. The "RSN Information" (Robust Security Network) element was introduced by a specific amendment specifically designed to fix the critical security flaws of WEP and WPA. It is the foundation for WPA2.

Incorrect Analysis: The selected protocol is not responsible for defining security controls. In network defense, deploying the wrong 802.11 standard amendment means you might be configuring speed/frequency properties (PHY layer) or Quality of Service (MAC layer) rather than actual encryption and authentication mechanisms. Re-evaluate the packet capture's "RSN" parameters.

Expert Analysis

1. What is happening in the network

The defender is verifying the configuration of an Access Point to ensure it broadcasts the correct security parameters. The packet capture shows an 802.11 Beacon frame containing an RSN (Robust Security Network) Information Element. It explicitly advertises AES (CCM) for both Group and Pairwise ciphers and requires 802.1X for Authentication Key Management.

2. Identify behavior or attack

Legacy environments using WEP or WPA (TKIP) are highly vulnerable to key recovery attacks (e.g., FMS attack, PTW attack, dictionary attacks on 4-way handshakes). By identifying and enforcing the correct security amendment, defenders mitigate eavesdropping, data manipulation, and unauthorized network access.

3. Why correct answer is correct

C. 802.11i is the IEEE amendment specifically dedicated to security. It defined the concept of RSN (Robust Security Network), standardized AES-CCMP encryption, and mandated 802.1X authentication. The Wi-Fi Alliance adopted this standard and branded it as WPA2.

4. Why others are wrong

802.11b/a: These are Physical (PHY) layer standards defining frequency bands (2.4 GHz / 5 GHz) and modulation techniques, not security mechanisms.
802.11e: This is a MAC layer amendment defining Quality of Service (QoS) to prioritize voice and video traffic, not security.

5. Defensive action

As a network defender, you must configure enterprise access points to reject legacy association requests. Enforce 802.11i (WPA2/WPA3 Enterprise), disable PMK caching if vulnerable, deploy a secure RADIUS server for 802.1X handling, and continuously monitor the airwaves with a WIDS (Wireless Intrusion Detection System) for rogue APs or deauthentication attacks.

6. MINI LESSON:

Traffic Pattern Recognition: WEP frames hide the payload but expose a 24-bit IV. 802.11i/WPA2 frames encrypt the payload using AES-CCMP and protect integrity with a MIC, visible in the RSN Information Element of Beacon/Probe responses.
Protocol Behavior: 802.11 operates across multiple amendments. Understanding the difference between operational amendments (a/b/g/n/ac/ax) and functional amendments (e for QoS, i for Security, r for Roaming) is critical for proper defensive configuration.
Prevention vs Detection: WEP/WPA relies heavily on detection because prevention is mathematically broken. 802.11i offers strong prevention through mathematical complexity (AES), forcing attackers to rely on social engineering or targeting the physical RADIUS server.

Ready to master more defensive concepts?

Explore more realistic CND scenarios and elevate your Blue Team skills.

Explore more CND simulations