Domain 4 capstone — secure the network you built

capstone · 150 min · Objective 4.3

Task

Take the network from the domain 2 and 3 capstones and apply the full defensive stack from this domain, then prove each control by running the matching attack from the attacks lesson against it. The deliverable is a hardened network plus a control-to-attack table where every row has been demonstrated, not asserted.

Steps

  1. Change default credentials and disable unused services. On every device, replace default passwords, turn off Telnet and plain HTTP in favour of SSH and HTTPS, and administratively shut every switch port not in use, placing it in an unused VLAN. Record before-and-after.
  2. Key management. Generate SSH host keys and an admin keypair on the device that uses them so the private key never travels, disable password login for administration, and note an expiry and rotation date for each.
  3. ACLs between zones. Apply the deny-by-default policy and the screened subnet from the two applied labs. Confirm the internal, screened and guest zones enforce least privilege in both directions.
  4. Port security against MAC flooding. Limit MAC addresses per access port. Then run the attack: flood the port with random MACs from a lab VM and confirm the port shuts or restricts rather than the switch failing open.
  5. DHCP snooping against the rogue server. Mark the real server's port trusted and re-run the rogue-DHCP lab; confirm clients now never receive the rogue offer.
  6. Dynamic ARP inspection against poisoning. Enable it, re-run the ARP poisoning lab, and confirm the forged replies are dropped and the victim's cache stays correct.
  7. Build the table. For each control, record the attack, the symptom before the control, and the observed result after. A row with no observed result is not finished.

Verify

sudo iptables -L FORWARD -n -v | grep -c ACCEPT
sudo ss -tlnp | grep -E ":23|:80 " && echo "INSECURE MGMT STILL LISTENING" || echo "telnet/http off"
ip neigh show | awk '{print $5}' | sort | uniq -d; echo "duplicate-mac exit $?"
sudo nmap --script broadcast-dhcp-discover -e eth0 | grep -c "Server Identifier"
diff <(sort /tmp/controls-expected.txt) <(sort /tmp/controls-observed.txt); echo "table complete exit $?"

The insecure-management test must report the ports off; the duplicate-MAC scan must come back empty while a poisoning attempt is running, which is inspection doing its job; and the DHCP discover must report a single server. The final diff proves every control in your table has a matching observed result — an empty diff is the capstone's real pass condition.

Notes

Three findings this capstone reliably produces, all of them exam-relevant.

A control you configured did not actually engage. Port security limits that were set but never triggered, DAI enabled on the wrong VLAN, an ACL applied in the wrong direction — configuring a control and testing it are different acts, and the gap between them is where real breaches live. This exercise exists to close that gap by attacking your own defences.

The order of the ACL mattered more than its contents. Almost everyone shadows a rule at least once. The match counters from the short lab are how you find it; carry that habit into every firewall you touch.

Defence in depth is why no single failure is fatal. No control here is perfect — MAC filtering is spoofable, port security is bypassable, an ACL can be misordered. The point is that an attacker must defeat several, and each one you add raises the cost. Keep the hardened snapshot and the control table; the domain 5 capstone troubleshoots this same network and assumes it exists.