CND (312-38) Network Defense Simulation

Learn how to ensure business resilience by distinguishing between technical recovery and high-level continuity strategies. This scenario explores how network defenders prepare for major service interruptions.

Network Scenario

You are a Network Security Analyst for a regional logistics provider. The infrastructure consists of a hybrid cloud environment with core databases hosted on-premise and client-facing web portals in AWS.

Management is currently reviewing the organization's resilience posture following a recent 4-hour ISP outage that halted all shipping operations. While the technical team restored the firewall configuration and VPN tunnels within 30 minutes, the warehouse staff was unable to process orders for the remaining duration because they lacked instructions on manual override procedures.

Traffic & Logs

# Availability Monitoring Log - Outage Period

[2023-10-12 14:02:11] ALERT: WAN Interface (Gi0/1) Down - Link failure

[2023-10-12 14:02:15] CRITICAL: VPN Tunnel Site-to-Site [PROD_AWS] - Connection Lost

[2023-10-12 14:05:00] INFO: Failover script initiated... No secondary ISP detected.

[2023-10-12 14:35:00] SUCCESS: Tech Team manual restore of WAN configs.

[2023-10-12 14:40:00] BUSINESS LOG: Warehouse floor reports zero productivity. No manual process active.

[2023-10-12 18:15:00] RESOLVED: External ISP fiber break repaired. Full sync restored.

Question

Which of the following strategies is used to minimize the effects of a disruptive event on a company, and is created to prevent interruptions to normal business activity?

Focus on the scope. One plan is about fixing the broken servers (technical), while the other is about keeping the money flowing and staff working even when the servers are broken.

Expert Analysis

1. What is happening in the network

The logs show a physical layer failure (fiber break) leading to a total loss of connectivity. While the network team restored the internal configurations (Defense-in-depth), the business functionality remained "Down" because there was no non-technical process to handle the outage.

2. Identify attack or behavior

This is an Availability Disruption. In a CND context, defense isn't just stopping hackers; it is ensuring the CIA triad (Confidentiality, Integrity, Availability) is maintained against all threats, including hardware or provider failure.

3. Why correct answer is correct

Business Continuity Plan (BCP) is the correct answer because it is holistic. It covers the entire business operation, ensuring that critical functions can continue during and after a disaster. It includes manual workarounds, relocation plans, and communication strategies, not just technical recovery.

4. Why others are wrong

Disaster Recovery Plan (DRP): This is a subset of BCP. It focuses strictly on the technical restoration of IT systems (servers, networks, data).
Contingency Plan: A broader term for "Plan B," but in CND standards, BCP is the specific framework for business process resilience.
COOP: Often used in government/military contexts, similar to BCP, but BCP is the standard industry term for minimizing disruptive effects on a commercial company.

MINI LESSON: The Defender's View on Availability

As a CND professional, you must distinguish between MTTR (Mean Time To Repair) and the MTPD (Maximum Tolerable Period of Disruption). High availability via redundant ISPs or BGP multihoming is a technical control (DRP). However, if technical controls fail, the BCP ensures the organization survives until those controls are fixed.

Explore more CND simulations