CND (312-38) Network Defense Simulation

Network Scenario

You are a Network Security Analyst reviewing the deployment architecture of a highly restrictive, air-gapped network segment. Due to legacy industrial control software, this segment still utilizes Windows 2000 Active Directory and Windows XP endpoints. The administrator, Mark, is tasked with deploying an 802.11 WLAN for this specific environment.

The strict security policy dictates that the network must be invisible to casual wireless scanners, must automatically associate recognized client devices, and must explicitly reject any unauthorized computers at the Access Point (AP) layer before full network layer authentication can even occur. Because of legacy hardware constraints, the environment is limited to WEP (Wired Equivalent Privacy).

Traffic & Logs

Question

Hint: Consider what Layer 2 mechanisms are required to hide a network from casual view, how to explicitly allow only specific endpoint hardware, and what a client must do to find a "hidden" access point. Remember, you must select exactly 3 answers.

Expert Analysis

1. What is happening in the network

The Access Point is transmitting Beacon frames with a null (empty) SSID to prevent the network name from appearing in casual wireless scans. Simultaneously, the AP is strictly enforcing MAC Address filtering to whitelist the 100 authorized Windows XP machines, denying Layer 2 association to any unknown MAC address. Finally, authorized clients are sending active Probe Requests to seek out the hidden network.

2. Identify attack or behavior

We are observing attempts by unauthorized devices to associate with the AP, which are successfully being dropped due to MAC filter policies. We are also seeing a device fail authentication because it attempted to use "Open System" authentication rather than proving it held the WEP key via "Shared Key" authentication.

3. Why correct answers are correct

B, C, and F are correct.
(C) Disabling SSID broadcast fulfills the requirement that unauthorized users cannot easily "view" the network. Enabling MAC filtering ensures that unknown computers are explicitly blocked.
(B) Changing the authentication to "Shared Key" ensures that clients must prove they possess the WEP key before they are allowed to associate, providing a necessary (albeit legacy) layer of authentication.
(F) Because the AP is no longer broadcasting its SSID, the client computers will not find it passively. Adding the SSID as a "preferred network" forces the Windows clients to actively send out Probe Requests for that specific SSID, allowing them to automatically connect.

4. Why others are wrong

• A (Firewall on APs): Access Points function primarily at Layer 2. A host-based firewall on the AP does not manage 802.11 SSID broadcasting or wireless association states.
• D (Broadcast SSID): This directly violates the company policy that the network must not be viewable by unauthorized computers.
• E (Open System Auth): Open System allows any client to associate with the AP before any higher-level authentication occurs, which is contrary to the strict security policy requirements.

5. Defensive action

While the configuration described satisfies the legacy policy, a modern Network Defender knows that WEP, MAC Filtering, and Hidden SSIDs represent a fundamentally flawed "Security through Obscurity" approach. MAC addresses are transmitted in plain text and can easily be spoofed by attackers. Furthermore, when a client actively probes for a hidden network (Option F), it broadcasts the hidden SSID in plain text to anyone listening. The true defensive action today is to migrate off legacy hardware entirely and deploy WPA3 or WPA2-Enterprise (802.1X), relying on strong cryptographic authentication rather than obscured broadcasts and MAC lists.