CND (312-38) Network Defense Simulation

Network Scenario

You are a Network Security Analyst tasked with securing a newly provisioned internal network segment intended for the Finance department (Subnet: 10.20.10.0/24). Before physically or logically routing traffic to this VLAN, you deploy a Next-Generation Firewall (NGFW) at the gateway.

You implement an implicit "Deny All" rule at the bottom of the ACL and configure explicit ingress rules permitting only essential encrypted traffic (TLS 1.3 over port 443) from authorized management subnets. This infrastructure change is completed before any hosts are migrated to the segment.

Traffic & Logs

Immediately after the routing is established and hosts are brought online, the firewall begins processing traffic. A baseline review of the logs shows the rules actively denying unapproved protocols:

* The firewall is successfully filtering unauthorized internal traversal attempts before they reach the sensitive endpoints.

Question

Implementing access control mechanisms, such as a firewall, to protect the network is an example of which of the following network defense approach?

Expert Analysis

1. What is happening in the network

The engineering team is establishing a secure boundary around a sensitive network segment (Finance). By placing an NGFW and utilizing a "Deny All" default stance, they are restricting traffic flow strictly to what is business-justified.

2. Identify behavior

This is the application of fundamental Access Control and Network Segmentation. The logs demonstrate the firewall functioning autonomously to drop unauthorized RDP and SNMP traffic based on predefined policies.

3. Why the correct answer is correct (D. Preventive approach)

In network defense, controls are categorized by their function. A Preventive control is designed to stop a vulnerability from being exploited or an attack from succeeding. Because the firewall blocks unauthorized packets before they reach the target, it prevents the potential compromise.

4. Why the others are wrong

• A. Proactive: This implies human-driven actions that look for unknown threats (e.g., Threat Hunting). A firewall relies on established rules.
• B. Reactive: This describes actions taken after an event (e.g., Incident Response, isolating an endpoint).
• C. Retrospective: This refers to looking back at historical data to determine root cause (e.g., Forensics).

5. Defensive Action

Deploy stateful inspection or Next-Generation Firewalls at all logical network boundaries. Enforce the principle of least privilege using strict ingress/egress filtering and default-deny ACLs.