Scenario Congratulations! You have been hired as a junior network administrator for the United States Cyber Command. You are a part of the National Mission Team, and that team has been requested for a critical assignment. Soon, your team will deploy to help cyber forces operating out of an undisclosed location. All you know now is that there are issues with the network, and the teams on site need help with troubleshooting. The team is depending on your advice and guidance. Read the email from the chief of operations to get started. Email TO: Junior Network Administrators FROM: Chief of Operations, National Mission Team, USCC SUBJECT: New Cyber Forces Site – Networking Problems We arrived on site one week ago to prepare for persistent cyber engagement and to defend forward. Two days before the start of our operations, we noticed problems with the network. We must be operational within the next 48 hours, and we need your help. 1. On Day 2 of full operational capability (FOC), our connection to the internet was becoming intermittent. We could establish connections to our globally hosted servers some of the time. The connection would drop at seemingly random periods and we don’t know why. We have experienced this day and night, and it has been consistent for the past three days. 2. When our connection to the internet is working, we seemingly cannot reach out to our globally dispersed servers from our hosts. We use the globally dispersed servers for command and control and must be able to connect to them. We need a method to determine where the packets are going and why they are not reaching their destination. Because these servers are globally distributed, we can’t just pick up and deploy to them. 3. Our internal network servers are also spotty. Sometimes they are up, and sometimes they are down. For example, the DHCP server appears to provide IP addresses to hosts that are turned on sometimes, but other times when the host is turned on, it receives an Automatic Private IP Address (APIPA). These hosts can communicate with our networked hosts locally, but they can’t reach out to our global servers. These hosts enable our persistent engagement capability, so they must be functional, and we need to determine the problem ASAP! 4. We have a team that can troubleshoot from afar, but they are located 25 miles west of this location. We have one of their tech support personnel deployed on site, but there are just too many issues for one person. The support team that is 25 miles west is centrally located to support multiple operational outfits. That team has a virtual private network (VPN) and secure access to our internal servers. At times, support team members need to determine which of our hosts are functioning. We use both Microsoft Windows and Linux operating systems, but we don’t know what tool will help determine host functionality from afar. 5. This next part is classified, but I need your help, and I need it fast. Bottom line, we believe there may be an insider threat. At times, we have reason to believe a nonapproved device is connecting to the network and reaching out to the internet. We need a method to determine what devices exist on the same subnet of our network. What can help us do that? 6. When we begin operations in 72 hours, it will be of utmost importance for us to know what device name is associated with what IP address. This will allow us to know what exists internally and what we need to defend should the adversary begin operations against us. We need to understand what options exist to achieve this task. 7. When we first arrived and established our connection to the internet, we noticed inbound connection requests. What tool can we use to determine if any adversary is reaching into our systems through a particular port or protocol? 3/24/2021 Project 2: Troubleshooting and Tool Report – CMIT 265 6981 Fundamentals of Networking (2212) CMIT 265 6981 Fundamentals of Networking (2212) NK Project 2: Troubleshooting and Tool Report Instructions Select one of the seven network problems and develop a troubleshooting and tool report that details the solution. 1. On Day 2 of full operational capability (FOC), our connection to the internet was becoming intermittent. We could establish connections to our globally hosted servers some of the time. The connection would drop at seemingly random periods and we don’t know why. We have experienced this day and night, and it has been consistent for the past three days. 2. When our connection to the internet is working, we seemingly cannot reach out to our globally dispersed servers from our hosts. We use the globally dispersed servers for command and control and must be able to connect to them. We need a method to determine where the packets are going and why they are not reaching their destination. Because these servers are globally distributed, we can’t just pick up and deploy to them. 3. Our internal network servers are also spotty. Sometimes they are up, and sometimes they are down. For example, the DHCP server appears to provide IP addresses to hosts that are turned on sometimes, but other times when the host is turned on, it receives an Automatic Private IP Address (APIPA). These hosts can communicate with our networked hosts locally, but they can’t reach out to our global servers. These hosts enable our persistent engagement capability, so they must be functional, and we need to determine the problem ASAP! 4. We have a team that can troubleshoot from afar, but the members are located 25 miles west of this location. We have one of the tech support personnel deployed on site, but there are just too many issues for one person. The support team that is 25 miles west is centrally located to support multiple operational outfits. That team has a virtual private network (VPN) and secure access to our internal servers. At times, support team members need to determine which of our hosts are functioning. We use both Microsoft Windows and Linux operating systems, but we don’t know what tool will help determine host functionality from afar. https://learn.umgc.edu/d2l/le/content/547369/viewContent/20167530/View 1/4 3/24/2021 Project 2: Troubleshooting and Tool Report – CMIT 265 6981 Fundamentals of Networking (2212) 5. This next part is classified, but I need your help, and I need it fast. Bottom line, we believe there may be an insider threat. At times, we have reason to believe a nonapproved device is connecting to the network and reaching out to the internet. We need a method to determine what devices exist on the same subnet of our network. What can help us do that? 6. When we begin operations in 72 hours, it will be of utmost importance for us to know what device name is associated with what IP address. This will allow us to know what exists internally and what we need to defend should the adversary begin operations against us. We need to understand what options exist to achieve this task. 7. When we first arrived and established our connection to the internet, we noticed inbound connection requests. What tool can we use to determine if any adversary is reaching into our systems through a particular port or protocol? Your report should be about a page in length and address the following: Choose and restate one of the problems identified as you understand it and explain why it is a problem. Describe how you would apply the steps in the Network+ troubleshooting model to this problem. Name and provide a brief overview of the tool that could solve this problem (refer to Lesson 17 in uCertify). Describe how the tool can be used to solve similar problems in the future. Provide a detailed overview of the tool’s functionality and options. Include a screenshot of your selected tool from the appropriate uCertify lab. The SITREP (Situation Report) Sample Report is provided so that you can understand what Cyber Command is expecting in your report. Your report will vary depending on the problem and tool selected. How Will My Work Be Evaluated? Troubleshooting refers to the process of identifying problems with a network through a rigorous and repeatable process and then solving those problems using testable methods. An important part of your duties in the networking field will be to troubleshoot and solve problems. In fact, most of your time will be spent with this focus to include optimizing performance. Networks are dynamic in implementation and are built to be resilient, but problems arise due to many unforeseen reasons. Developing the knowledge, skills, and experience to successfully troubleshoot and recommend solutions will show you are valueadded to the organization. For this assignment, you are asked to review a scenario, understand the problems, apply your knowledge and skills gained in this class, and propose a solution. Use the template provided https://learn.umgc.edu/d2l/le/content/547369/viewContent/20167530/View 2/4 3/24/2021 Project 2: Troubleshooting and Tool Report – CMIT 265 6981 Fundamentals of Networking (2212) and complete the assignment. An example solution is provided for you. The following evaluation criteria aligned to the competencies will be used to grade your assignment: 1.2.3: Explain specialized terms or concepts to facilitate audience comprehension. 1.3.5: Adhere to required attribution and citation standards. 1.4.1: Produce grammatically correct material in standard academic English that supports the communication. 2.1.1: Identify the issue or problem under consideration. 2.3.1: State conclusions or solutions clearly and precisely. 10.1.1: Identify the problem to be solved. 13.1.1: Create documentation appropriate to the stakeholder. If you haven’t already done so last week, download the Troubleshooting and Tools Report Template and use it to record your work. When you are finished, delete the instructional text from the template before you submit. Click “add a file” to upload your work, then click the Submit button. Submissions No submissions yet. Drag and drop to upload your assignment below. Drop files here, or click below! Upload Record Audio Choose Existing You can upload files up to a maximum of 1 GB. Activity Details https://learn.umgc.edu/d2l/le/content/547369/viewContent/20167530/View 3/4 3/24/2021 Project 2: Troubleshooting and Tool Report – CMIT 265 6981 Fundamentals of Networking (2212) Task: Submit to complete this assignment Assessment Project 2: Troubleshooting and Tool Report Last Visited Mar 24, 2021 9:17 PM https://learn.umgc.edu/d2l/le/content/547369/viewContent/20167530/View 4/4 3/24/2021 Project Work for Week 5: Begin Working on Project 2 – CMIT 265 6981 Fundamentals of Networking (2212) CMIT 265 6981 Fundamentals of Networking (2212) NK Project Work for Week 5: Begin Working on Project 2 For your next project, due in Week 6, you must select one of the seven network problems and develop a troubleshooting and tool report that details the solution. 1. On Day 2 of full operational capability (FOC), our connection to the internet was becoming intermittent. We could establish connections to our globally hosted servers some of the time. The connection would drop at seemingly random periods and we don’t know why. We have experienced this day and night, and it has been consistent for the past three days. 2. When our connection to the internet is working, we seemingly cannot reach out to our globally dispersed servers from our hosts. We use the globally dispersed servers for command and control and must be able to connect to them. We need a method to determine where the packets are going and why they are not reaching their destination. Because these servers are globally distributed, we can’t just pick up and deploy to them. 3. Our internal network servers are also spotty. Sometimes they are up, and sometimes they are down. For example, the DHCP server appears to provide IP addresses to hosts that are turned on sometimes, but other times when the host is turned on, it receives an Automatic Private IP Address (APIPA). These hosts can communicate with our networked hosts locally, but they can’t reach out to our global servers. These hosts enable our persistent engagement capability, so they must be functional, and we need to determine the problem ASAP! 4. We have a team that can troubleshoot from afar, but the members are located 25 miles west of this location. We have one of the tech support https://learn.umgc.edu/d2l/le/content/547369/viewContent/20167490/View 1/2 3/24/2021 Project Work for Week 5: Begin Working on Project 2 – CMIT 265 6981 Fundamentals of Networking (2212) personnel deployed on site, but there are just too many issues for one person. The support team that is 25 miles west is centrally located to support multiple operational outfits. That team has a virtual private network (VPN) and secure access to our internal servers. At times, support team members need to determine which of our hosts are functioning. We use both Microsoft Windows and Linux operating systems, but we don’t know what tool will help determine host functionality from afar. 5. This next part is classified, but I need your help, and I need it fast. Bottom line, we believe there may be an insider threat. At times, we have reason to believe a nonapproved device is connecting to the network and reaching out to the internet. We need a method to determine what devices exist on the same subnet of our network. What can help us do that? 6. When we begin operations in 72 hours, it will be of utmost importance for us to know what device name is associated with what IP address. This will allow us to know what exists internally and what we need to defend should the adversary begin operations against us. We need to understand what options exist to achieve this task. 7. When we first arrived and established our connection to the internet, we Activity Details You have viewed this topic Last Visited Mar 24, 2021 9:12 PM https://learn.umgc.edu/d2l/le/content/547369/viewContent/20167490/View 2/2 Troubleshooting and Tool Recommendation: SITREP Sample Report Problem: Each of the networked 15 servers and 400 hosts are generating logs. Some of these logs are likely due to security issues. We only have 10 network security workers, and they don’t have the time to review each log that is generated across the network. This is a problem because the logs can identify security issues, host events, network optimization challenges, and errors. We need an automated method to collect, centrally store, and analyze the logs, only generating an alert when human intervention is needed. Troubleshooting Steps: [List the networking troubleshooting methodology] Tool and Description: To solve the problem identified, it is proposed that [Logstash] be implemented within the network. Logstash (a fictional tool) is a free and open server-side data processing pipeline that ingests data from varying sources, transforms it, and display the results. This tool allows for the collection of logs from virtually any source to include hosts, network devices, and servers. Most logs are in the format of their creator and therefore are not standardized across a network of systems. Logstash normalizes the logs by converting them into key fields and elements that are most important to network security and optimization. This allows users to program alerts on the Logstash server and automatically be alerted to only the most important log alerts. Logstash provides the ability to save time and human capital resources while ensuring network security and optimization capability. 1 Tool Operational Use Case: Logstash is being employed in our network to solve the log analysis problem identified above. Once implemented and properly configured, we expect Logstash to allow us to comply with internal security policies and outside regulations and audits, understand and respond to data breachers and other security incidents, troubleshoot systems, computer, and network devices, understand user behaviors, and conduct forensics in the event of an investigation. The deployment of Logstash will also save us valuable time and resources given we only have 10 personnel. The log alerts will enable network support personnel to respond only to the most crucial alerts, while ensuring nothing of critical importance is not known. Tool Functionality: Once installed on the server and Linux operating system, the command functionality includes multiple options: • Logstash start (this command starts the Logstash service) • Logstash –f (this command identifies the log file location) • Logstash –in (this command ingests the log files) • Logstash –c (this command sets the number of files to ingest before stopping) • Logstash –cs (this command sets the ingest to continuous) • Logstash –a (this command sets the parameters to analyze and alert) 2 Example Screenshot of the Windows Command Prompt 3 Troubleshooting and Tool Report [Insert name] Network Problem Selected Choose and restate one of the problems identified as you understand it and explain why it is a problem. Troubleshooting Steps List the steps in the Network+ troubleshooting methodology. Tool and Description Name and provide a brief overview of the tool that could solve this problem (Refer to Lesson 17 in uCertify) Tool Operational Use Case Describe how the tool can be used to solve similar problems in the future. Tool Functionality Provide a detailed overview of the tool’s functionality and options. Include a screenshot of your selected tool from the appropriate uCertify lab.
Purchase answer to see full attachment
