CND (312-38) Network Defense Simulation

In this simulation, you will analyze a post-incident Business Continuity and Disaster Recovery (BC/DR) scenario. Understanding the correct sequence of bringing systems back online is critical for minimizing downtime and maintaining organizational resilience.

01. Network Scenario

A severe ransomware infection has completely compromised the primary data center. The incident response team has severed all external connections to contain the spread. The primary site is deemed temporarily unusable for the next 72 hours.

The Network Defense team is now coordinating with the DR (Disaster Recovery) site (a warm standby location) to bring services back online based strictly on the Business Impact Analysis (BIA) prioritization.

Primary Site Status

• Network: ISOLATED (Air-gapped)
• Storage: ENCRYPTED / COMPROMISED
• Phase: Containment/Eradication

DR Site Activation

• Priority 1: IAM / Active Directory
• Priority 2: Core Database Clusters
• Priority 3: Internal ERP Systems

02. Traffic & Logs

[DR ORCHESTRATOR] 14:02:11 - Initiating BC/DR Failover Sequence
[INFO] Primary Site Heartbeat: TIMEOUT
[ACTION] Activating Warm Site VMs...
[INFO] BIA Tier 1 Startup - Domain Controllers (dc-dr-01): ONLINE
[INFO] BIA Tier 1 Startup - VPN Gateway (vpn-dr-01): ONLINE
[INFO] BIA Tier 2 Startup - App Servers pending DB synchronization...
[WARNING] Non-critical systems (Marketing web, Dev environment) halted until Tier 1/2 are verified.
[STATUS] Operations transitioning to alternate location based on criticality.

03. Question

Which BC/DR activity works on the assumption that the most critical processes are brought back from a remote location first, followed by the less critical functions?

Expert Analysis

1. What is happening in the network

A catastrophic failure (ransomware) has forced the organization to abandon the primary network environment. The defense team is utilizing an orchestration tool to spin up critical infrastructure at a remote disaster recovery (DR) site, strictly following the Business Impact Analysis (BIA) tiering.

2. Identify attack or behavior

The network logs show a transition from Incident Containment into the formal Disaster Recovery phase. The key behavior is the staggered, prioritized startup of services at an alternate location to achieve Recovery Time Objectives (RTO).

3. Why correct answer is correct

Recovery (A) is the specific BC/DR phase where operations are moved to an alternate location (hot/warm/cold site) and critical systems are brought online first according to the Disaster Recovery Plan (DRP). This ensures survival of the business while the primary site is inoperable.

4. Why others are wrong

Restoration (B): This is the final phase. It involves returning operations from the alternate remote location back to the original, repaired primary facility.
Response (C): This is the immediate reaction to the incident (e.g., pulling the plug, isolating the network, ensuring human safety) before the decision to move to the DR site is made.
Resumption (D): This refers to the actual restart of business operations (users logging in, transactions occurring) after the IT infrastructure has been successfully recovered at the alternate site.

5. Defensive Action

Ensure your Disaster Recovery Plan is strictly aligned with the BIA. Network defenders must configure firewalls, DNS, and routing protocols (like BGP) at the DR site to automatically accept traffic for Tier 1 systems during the Recovery phase.

MINI LESSON: The 4 Phases of BC/DR

1. Response: Immediate reaction. Containment, safety, and assessing the damage.
2. Recovery: Bringing critical IT systems online at a remote/alternate site based on BIA priorities.
3. Resumption: Business units begin working again using the newly recovered IT systems.
4. Restoration: Migrating operations and data back to the primary, permanent facility once it is safe.

Ready to test more defensive configurations?

Explore more CND simulations