Case 03: The Harbor Clinic Night Shift

The evidence

ssid              HarborClinic-Staff
security          wep
beacon-broadcast  enable
tx-power          max      # signal reaches the parking lot
mac-filter        disable
auth              shared-password

Fa0/2   (reception PC)       1 dynamic address
Fa0/5   (exam room printer)  1 dynamic address
Fa0/7   (waiting room wall port)  8,187 dynamic addresses
Total in use: 8,191 of 8,192   <- table nearly full

02:03  192.0.2.10    -> 10.0.1.20:443   ALLOW  rule 1   portal page load
02:06  198.51.100.23 -> 10.0.1.20:443   ALLOW  rule 1   portal login form
02:08  192.0.2.77    -> 10.0.1.30:3389  ALLOW  rule 3   238 failed logins in 90 s
02:10  192.0.2.77    -> 10.0.1.30:3389  ALLOW  rule 3   login SUCCESS: contractor
02:14  10.0.1.30     -> 203.0.113.66:443 ALLOW out     outbound connection

The questions

1. Analyze E1 Choose one

   1. Which setting in Evidence 1 is the biggest weakness for keeping intercepted wireless frames unreadable?

   Which setting in Evidence 1 is the biggest weakness for keeping intercepted wireless frames unreadable?

   Asecurity wepBssid HarborClinic-StaffCbeacon-broadcast enableDmac-filter disable
   Show answer

   Answer: A. Wired Equivalent Privacy (WEP) has known vulnerabilities and is insecure, so captured frames can be read. Encryption is what protects intercepted frames; Wi-Fi Protected Access 3 (WPA3) is currently the strongest. CED 3.2.B.3

2. Mitigate E1 Select all that apply

   2. Select every change that would bring the access point in Evidence 1 in line with good wireless security.

   Select every change that would bring the access point in Evidence 1 in line with good wireless security.

   ASwitch encryption to WPA3BDisable beacon broadcastingCLower the transmit power and aim the signal inside the buildingDEnable media access control (MAC) filtering and require each user to authenticateERename the network (SSID) to something longerFKeep transmit power at max so the signal is stronger
   Show answer

   Answer: A, B, C, D. WPA3, disabled beacons, a signal limited to the building and MAC filtering with authentication all match 3.2.B. A longer network name adds no protection, and a maximum signal helps war drivers in the parking lot. CED 3.2.B.1, 3.2.B.2, 3.2.B.3, 3.2.B.4

3. Analyze E2E4 Choose one

   3. At 02:06 a request from 198.51.100.23 reached the portal, even though rule 2 denies that range. Why?

   At 02:06 a request from 198.51.100.23 reached the portal, even though rule 2 denies that range. Why?

   ARule 1 allows all port 443 traffic and matches first, so rule 2 is never reachedBDeny rules only apply to outbound trafficCRule 4 overrides every other ruleDThe firewall checks rules from the bottom up
   Show answer

   Answer: A. Access control list rules are checked in order and the first match is executed. The broad allow rule sits above the specific deny rule. CED 3.4.B.2

4. Mitigate E2 Choose one

   4. Which change fixes the problem from question 3 without blocking legitimate patients?

   Which change fixes the problem from question 3 without blocking legitimate patients?

   AMove rule 2 above rule 1BDelete rule 1CMove rule 4 to the topDChange rule 2 to ALLOW
   Show answer

   Answer: A. Specific rules go before broad ones. With the deny for the malicious range first, its traffic is blocked and everyone else still matches rule 1. Deleting rule 1 or moving the default deny up would block patients too. CED 3.4.D.3

5. Detect E4 Choose one

   5. What do the 02:08 and 02:10 log lines show?

   What do the 02:08 and 02:10 log lines show?

   AAn online password attack that succeededBA smurf attackCDNS poisoningDA normal contractor login
   Show answer

   Answer: A. Hundreds of failed logins in a short time, at an unusual hour, from an unknown address, then a success: the signs of an online password attack, and it worked. CED 1.2.A.2

6. Mitigate E2E4 Select all that apply

   6. Select the two changes that best reduce the risk from rule 3.

   Select the two changes that best reduce the risk from rule 3.

   ALimit rule 3 to the contractor’s known address instead of ALLBRequire multifactor authentication (MFA) for the contractor accountCMove rule 3 below rule 4DAllow port 3389 outbound as well
   Show answer

   Answer: A, B. Restricting the source address shrinks who can even try, and MFA means a guessed password alone is not enough. Moving rule 3 below the default deny would block the contractor completely. CED 3.4.D.2, 1.2.C.3

7. Detect E3 Choose one

   7. What does Evidence 3 indicate on port Fa0/7?

   What does Evidence 3 indicate on port Fa0/7?

   AMAC flooding: a device is filling the switch’s table with fake addressesBAddress resolution protocol (ARP) poisoning of the default gatewayCAn evil twin access pointDA jamming attack
   Show answer

   Answer: A. Thousands of MAC addresses on one port and a nearly full table are the signature of MAC flooding. Once the table overflows, the switch sends frames out of every port, so the adversary can eavesdrop. CED 3.5.E.4, 3.1.A.2

8. Mitigate E3 Choose one

   8. Which control most directly stops the attack in Evidence 3 from happening again?

   Which control most directly stops the attack in Evidence 3 from happening again?

   AEnable port security with a maximum of one address on Fa0/7BAdd a second firewall to the screened subnetCSwitch the access point to WPA3DRaise the artificial intelligence (AI) alert threshold
   Show answer

   Answer: A. Port security limits the number of MAC addresses on a switch port, which prevents MAC flooding. A wall port in a public waiting room is exposed, so it could also be disabled when not needed. CED 3.3.B.4

9. Detect E4 Select all that apply

   9. Select every line in Evidence 4 that is an indicator of compromise.

   Select every line in Evidence 4 that is an indicator of compromise.

   A02:03 portal page load from 192.0.2.10B02:06 request from 198.51.100.23C02:08 238 failed logins in 90 secondsD02:14 outbound connection from 10.0.1.30 to 203.0.113.66
   Show answer

   Answer: B, C, D. 198.51.100.0/24 is a known malicious range, the burst of failed logins is a password attack, and the server the contractor account just logged in to is now calling a known malicious address. The 02:03 page load is normal. CED 3.5.E.7

10. Detect Choose one

    10. The clinic wants better detection on its network, which carries sensitive patient data. Which detection method fits best?

    The clinic wants better detection on its network, which carries sensitive patient data. Which detection method fits best?

    AHybrid detection, accepting higher cost and more alertsBSignature-based only, because it is cheapestCNo detection, because the firewall is enoughDAnomaly-based only on the guest Wi-Fi
    Show answer

    Answer: A. Networks with more sensitive or critical data or services will likely consider a hybrid approach, which combines signature- and anomaly-based detection but costs more and generates more alerts. CED 3.5.C.3