CND (312-38) Network Defense Simulation

Expert Analysis

1. What is happening in the network

The logs indicate a client workstation is communicating with a server via port 135, which is associated with the Microsoft Remote Procedure Call (MSRPC) service. The handshake and subsequent "RPC Bind Request" signify the establishment of a logical session between two software components.

2. Identify attack or behavior

This is standard administrative or application behavior. However, defenders monitor RPC because attackers often use it for lateral movement (e.g., via WMI or scheduled tasks) or to enumerate services on a target host.

3. Why correct answer is correct

RPC (Remote Procedure Call) is the correct answer. In the OSI model, RPC operates primarily at the Session Layer (Layer 5). It provides a mechanism for processes to communicate and manage sessions across a network, abstracting the underlying transport details (Layer 4) from the application (Layer 7).

4. Why others are wrong

• SLP (Service Location Protocol): While it aids in discovery, it is generally considered an Application Layer protocol (Layer 7).
• RDP (Remote Desktop Protocol): Operates at the Application Layer (Layer 7), though it utilizes lower-layer protocols for data transport and session management.
• ICMP (Internet Control Message Protocol): Operates at the Network Layer (Layer 3). It is used for diagnostics and error reporting (e.g., Ping, Traceroute), not session management.

5. Defensive Action

Defenders should restrict RPC traffic to known administrative segments. Using host-based firewalls to block port 135 and dynamic RPC ports from untrusted zones prevents unauthorized lateral movement and enumeration. Monitoring for "null sessions" or excessive RPC binds from unusual sources is a key detection strategy.