incident-response-trainer
Incident response training · Rule-based scoring
DemoCatalogDiagnosticHistoryDashboardCoach Notes
Attempt report

New intern's PC is on the production-server VLAN by mistake

Network EngineeringVLAN MisconfigDifficulty · Easy

Attempt 1 of 1 · cmq8jaxlv001d0i5lmj6opwqc

← All attempts↻ Retry this scenarioNew scenario
Progress vs previous attempt

This is your first attempt for this scenario. Retry the scenario to generate a side-by-side comparison against your previous response.

Progression · Keep practicing

Stay on Easy · Network Engineering

4 signals are blocking advancement to Medium. Keep practicing at Easy until those areas stabilize. (Track: Network Engineering)

Track · Network Engineering
Easy
Sample · 5 recent attempts2 positive4 blocking

Signals helping

  • Dangerous action frequency. None in recent attempts
  • Recent retry improvement trend. Score is improving (+29.2 pts on later attempts)

Signals blocking advancement

  • Recent average score. 33 / 100 (need ≥ 75)
  • Recent pass rate. 0 of 5 passed (need ≥ 66%)
  • Rubric category coverage. 35% average (need ≥ 55%)
  • Consistently weak rubric areas. Recovery, Change record / log retention, Mitigation
Submission · what was sent and how you responded
VLAN MisconfigDifficulty · easyHigh asset
[POSSIBLE INCIDENT] Marketing intern PC seeing prod servers in ARP
From
Senior Security Analyst <soc-l2@acme-corp.com>
To
netops@acme-corp.com
Date
2026-04-19 09:55 UTC
On a routine onboarding check, a new marketing intern reported that their laptop is "showing weird hostnames" — they ran arp on their first day and saw production server names (db-prod-01, web-prod-02) on their local subnet. Their PC is plugged into ACCESS-SW-12 port Gi1/0/24 in the marketing area. Marketing should be on VLAN 200 (office), not VLAN 100 (prod-servers). The switch port log says the wrong access-VLAN was applied on Apr 18 18:12 UTC, so the port has been bridged into the prod-servers segment for roughly 16 hours by the time we noticed — please bound the exposure window before doing anything destructive. Please confirm and remediate. Treat as access-control / segmentation violation while you investigate, not just a typo. Critically, before you remediate: did the intern's workstation actually reach any production resource (db-prod-01 / web-prod-02 SSH / SMB / HTTP), or is this only L2 visibility? We need that answered from logs, not assumed. A plea from the on-call: do not "fix" this by converting the marketing access ports to trunk, do not delete VLAN 100 to "make the leak go away", and do not clear the switch's MAC address-table before evidence is preserved. Move the port, scope the exposure, then harden. — SOC L2
Evidence
ACCESS-SW-12 port + VLAN view
ACCESS-SW-12#show interfaces Gi1/0/24 switchport
Name: Gi1/0/24
Switchport: Enabled
Administrative Mode: static access
Operational Mode: static access
Access Mode VLAN: 100 (prod-servers)        <-- wrong, should be 200 (office)
Trunking Native Mode VLAN: 1 (default)
Voice VLAN: none

ACCESS-SW-12#show vlan brief | include 100|200
100  prod-servers      active    Gi1/0/24
200  office            active    Gi1/0/1, Gi1/0/2, ..., Gi1/0/23, Gi1/0/25

# Switch port log (last 24h)
Apr 18 18:12:03 ACCESS-SW-12 %CONFIG: configure terminal — user: cli-noc-jr
Apr 18 18:12:18  interface Gi1/0/24
Apr 18 18:12:31    switchport access vlan 100   <-- assignment moment
Apr 18 18:12:35  end
Apr 18 18:12:38 ACCESS-SW-12 %CONFIG: write memory — user: cli-noc-jr

# show mac address-table on the affected port
ACCESS-SW-12#show mac address-table interface Gi1/0/24
   100   bcd1.7f00.55aa   DYNAMIC   Gi1/0/24       <-- intern PC, learned in prod VLAN

# Intern's PC ARP (sample)
Internet  10.0.100.5    0  bcd1.7f00.0102  ARPA  Vlan100
Internet  10.0.100.18   0  bcd1.7f00.018a  ARPA  Vlan100
Internet  10.0.100.1    0  bcd1.7f00.5500  ARPA  Vlan100   <-- prod VLAN gateway

# DHCP server (10.50.0.10) lease record for the intern's MAC
Apr 18 18:13:02  OFFER   bcd1.7f00.55aa  10.0.100.84  scope=PROD-SERVERS-100
Apr 18 18:13:02  ACK     bcd1.7f00.55aa  10.0.100.84  lease=8h, renewed twice since
                  -- the intern's PC pulled an IP from the prod-VLAN scope (L3 reachability into prod is real, not just L2 visibility)

# NAC / 802.1X session on Gi1/0/24
ACCESS-SW-12#show authentication sessions interface Gi1/0/24 details
   Interface              Gi1/0/24
   IIF-ID                 0x1ABCDEF
   MAC Address            bcd1.7f00.55aa
   IPv4 Address           10.0.100.84
   User-Name              <none>            <-- no 802.1X supplicant on intern's first-day laptop
   Status                 Authorized        <-- via MAB fallback (port profile MARKETING-PORT permits MAB)
   Method                 mab
                   -- 802.1X is not enforced on this port; MAB authorized the MAC into whatever
                      access VLAN the port was statically configured for (which was prod-100).

# Edge firewall hit log (10.50.30.5 INTERN-ACCESS rule, last 16h)
Apr 18 18:14:22  10.0.100.84:51022 -> 10.0.100.10 (db-prod-01):22   ALLOW   syn,ack,push  3 sessions
Apr 18 18:14:51  10.0.100.84:51188 -> 10.0.100.18 (web-prod-02):443  ALLOW  tls handshake completed, 220 KB transferred
Apr 18 19:02:09  10.0.100.84:51904 -> 10.0.100.10:445 (smb)         DENY   ACL "PROD-INTRA-ONLY" hit count: 4
                   -- the intern's host did reach db-prod-01 (SSH banner only, no auth attempt logged) and web-prod-02 (TLS established)
                      so this is no longer "only an L2 misconfig"; treat scope as confirmed exposure of two prod hosts.

# Controlled distractors (rule out wider faults so root cause stays at the access-VLAN assignment)
ACCESS-SW-12#show interface Gi1/0/24 | include line protocol|optic|errors|CRC
   Gi1/0/24 is up, line protocol is up   0 input errors  0 CRC  optic Rx -3.2 dBm (within spec)

DHCP server (10.50.0.10) status: healthy, all other VLAN scopes leasing normally
ACCESS-SW-12#show interface trunk | include Po1
   Po1   on   802.1q   trunking   1   <-- uplink to DIST-A clean; no native vlan mismatch
No DIST-* / CORE-* config change in the last 7 days.

# Edge firewall view of the marketing office VLAN (200)
   No drops, no anomalies on the legitimate office segment in the same window.
Affected asset
Name
ACCESS-SW-12 Gi1/0/24 + intern PC
Type
Marketing intern access port currently bridged into prod VLAN 100; intended VLAN 200 (office); reaches prod-VLAN gateway 10.0.100.1; downstream visibility into prod-servers segment (db-prod-01, web-prod-02); MAB-authorized via NAC profile MARKETING-PORT, no 802.1X supplicant on the laptop
Owner
Network Operations · Marketing wing
Level
High
Your submitted response
97 words
First, we need to investigate whether the intern has accessed any of the connections from VLAN 100

In order to do that, we have terminated all access of the MAC address that the intern had given, using arp.

Then, we would need to check all the access logs, specifically with ports 22, 80, 443, and SMB.

If everything is clean from the log, simply change the vlan for the intern's laptop.

To move the VLAN 100 to 200, access to ACCESS-SW-12, enable, conf t, int Gi1/0/24, then type "switchport access vlan 200", "no shutdown", "end", "write memory"
Final score
22/ 100
97 words submitted
Verdict · Fail

The response is missing several critical incident response steps. Review the rubric and try again. Score: 22/100. Strongest area: Clarity & structure (69%). Weakest area: Prioritization (0%) — expand this next time.

Category breakdown

Where points came from

coverage × weight = points
  • Fault understanding1/5 · 3.0 / 15
  • Topology / asset impact2/4 · 5.0 / 10
  • Prioritization0/2 · 0.0 / 10
  • Mitigation1/5 · 4.0 / 20
  • Diagnosis1/5 · 3.0 / 15
  • Recovery0/4 · 0.0 / 10
  • Change record / log retention0/4 · 0.0 / 10
  • Clarity & structure1/2 · 6.9 / 10

Strengths

No category reached 70% coverage.

Missing / weak

  • Fault understanding
  • Prioritization
  • Mitigation
  • Diagnosis
  • Recovery
  • Change record / log retention

Dangerous actions detected

None detected in your response.

Learning · Coaching

Learn from this attempt

Post-submission coaching for this scenario. Score and verdict are unchanged — these notes are for your next attempt.

Why points were deducted

  • Prioritization0% coverage

    Declare a P2 security incident and explain why scope must be bounded before remediation, instead of treating it as a low-priority typo.

  • Recovery0% coverage

    Harden the NAC profile so MAB cannot fall back into production VLANs and require peer-reviewed change tickets for any VLAN move.

  • Change record / log retention0% coverage

    Preserve the DHCP lease, NAC session, firewall hit log, MAC table, pre/post running-config, and the operator audit-log entry before remediating.

Model answer outline

From: Incident Response Lead (SOC on-call)To: IT Leadership · Affected Asset Owner · On-call SOCSubject: [SEV-3][INC-NET-E729B] New intern's PC is on the production-server VLAN by mistake — status update
Incident · INC-NET-E729B · SEV-3 / P3Status · Investigating — containment in progressNetwork Engineering · VLAN Misconfig · EasyACCESS-SW-12 Gi1/0/24 + intern PC · High criticalityDetected ~ 2026-04-19 09:55 UTC
Situation & summary

A marketing intern's access port (ACCESS-SW-12 Gi1/0/24) was assigned to the production-server VLAN 100 instead of the office VLAN 200. The misconfiguration sat live for ~16h, so this is a real segmentation-boundary violation, not a typo.

Severity & priority

Rated SEV-3 / P3. Treat as a P2 security incident, not a network typo.

Prioritization & impact
  • Treat as a P2 security incident, not a network typo.
  • Escalate to SOC and Network Operations together; loop in the marketing-wing manager.
  • Scope the actual exposure before remediating so the response matches reality.
Containment (actions taken / in progress)
  • Move Gi1/0/24 back to VLAN 200 with a change ticket; consider shutting the port until evidence is preserved.
  • Do not delete VLAN 100 or convert access ports to trunk to make the alert quiet.
  • Do not clear the MAC address-table or DHCP lease before the snapshots below are exported.
Investigation (in progress)
  • Read the switchport state and the config audit log; identify the operator and timestamp of the wrong access-VLAN assignment.
  • Distinguish L2 visibility from confirmed L3 access: cite the DHCP lease (intern's MAC pulled an IP from the prod scope) and the edge-firewall hit log.
  • Inspect the NAC / 802.1X session: MAB fallback authorized the laptop into the statically-configured VLAN because there is no supplicant.
  • Correlate firewall, NAC, DHCP, and MAC-table timestamps with the switch's config audit log to scope the exposure window.
Recovery & next steps
  • Enforce 802.1X / NAC dynamic VLAN assignment on user-area ports.
  • Block MAB fallback into production VLANs at the NAC profile level.
  • Adopt port-provisioning templates and require peer-reviewed change tickets for VLAN moves.
Evidence preservation
  • Snapshot the DHCP lease record, MAC address-table, NAC session log, and edge-firewall hit log.
  • Capture pre/post show running-config of Gi1/0/24 and the audit-log entry of the operator who applied the wrong VLAN.
  • Open a NOC ticket with the timeline and chain of custody so the same fact set is reviewable later.
Stakeholder communication
  • Brief SOC, NetOps, and the marketing-wing manager once the scope is bounded.
  • Engage HR / legal only if the evidence indicates more than misconfiguration.
  • Document the change, the root cause, and the prevention plan so future onboarding does not repeat it.
Do NOT
  • Do not convert all access ports to trunk as a 'fix'.
  • Do not delete VLAN 100 to remove the leak.
  • Do not switch VTP modes to refresh the VLAN database.
  • Do not dismiss the report as a typo.
  • Do not clear the MAC address-table or DHCP lease before evidence is preserved.

Dangerous actions to avoid

  • Do not convert all access ports to trunk as a 'fix'.
  • Do not delete VLAN 100 to remove the leak.
  • Do not switch VTP modes to refresh the VLAN database.
  • Do not dismiss the report as a typo.
  • Do not clear the MAC address-table or DHCP lease before evidence is preserved.

How to improve next time

  • Identify this as a segmentation-boundary violation, not a typo — the wording shapes how seriously the incident is treated.
  • Distinguish L2 visibility from confirmed L3 access — DHCP lease and firewall hits prove this is more than ARP discovery.
  • Cite specific evidence (DHCP lease, MAC table, NAC / MAB session, firewall hit log) when scoping the exposure window.
  • Preserve evidence before remediating — clearing the MAC table or deleting VLAN 100 to silence the alert is the wrong move.
  • Move the port to the correct VLAN safely; never widen trust or convert access ports to trunk as a shortcut.
AI · Supplemental review

Request an AI review of this attempt

This AI review is supplemental coaching. It does not change your official score or verdict. The review is only kept for this page session and is not saved permanently.

Review language
AI Tutor · Explains your result

AI Tutor

This tutor explains your result. It does not change your score. Pick a question to see how the deterministic grading reached your verdict and where to focus next.

Generated deterministically from your graded result — no AI model was called.

Why did I get this score?

Your verdict was Fail at 22/100. That total is the sum of deterministic rubric points across 8 categories — each scores how much of its expected, ordered steps your answer covered, not an opinion about your writing. Your strongest coverage was Clarity & structure (69%). Points were held back mostly in Prioritization (0%), Recovery (0%), Change record / log retention (0%).

Rubric focusprioritizationrecoveryevidencePreservation
Next study step

Re-read the prioritization expectations for this scenario and list the concrete steps you missed.

This tutor explains your existing result. It does not change your score, verdict, or grade. Generated deterministically from your graded result — no AI model was called.

What should I improve first?

Focus on Prioritization first — it is your weakest rubric area at 0% coverage and carries weight 10. For this scenario: Declare a P2 security incident and explain why scope must be bounded before remediation, instead of treating it as a low-priority typo.

Rubric focusprioritization
Next study step

Rewrite your prioritization section as a short numbered checklist before your next attempt.

This tutor explains your existing result. It does not change your score, verdict, or grade. Generated deterministically from your graded result — no AI model was called.

How does my answer compare to the model answer outline?

Compared with the model answer outline, the most useful sections to study are the ones matching your weak areas. Re-read the outline's prioritization, recovery, change record / log retention guidance and check which listed points you did not cover. The outline is a high-level checklist of expected points — use it to find gaps, not to copy a finished answer.

Rubric focusprioritizationrecoveryevidencePreservation
Next study step

Pick one model-answer section you missed and add its key points to your next response in your own words.

This tutor explains your existing result. It does not change your score, verdict, or grade. Generated deterministically from your graded result — no AI model was called.

Which rubric area mattered most here?

Mitigation mattered most here: it carries the highest rubric weight (20), so coverage there moves your score the most. You covered 20% of it this time, worth 4 points.

Rubric focuscontainment
Next study step

Prioritise the highest-weight categories first; make sure mitigation is fully addressed before lower-weight ones.

This tutor explains your existing result. It does not change your score, verdict, or grade. Generated deterministically from your graded result — no AI model was called.

What should I study next?

Based on this attempt, study prioritization, recovery, change record / log retention next. Coaching tip for this scenario: Identify this as a segmentation-boundary violation, not a typo — the wording shapes how seriously the incident is treated.

Rubric focusprioritizationrecoveryevidencePreservation
Next study step

Identify this as a segmentation-boundary violation, not a typo — the wording shapes how seriously the incident is treated.

This tutor explains your existing result. It does not change your score, verdict, or grade. Generated deterministically from your graded result — no AI model was called.

Coach Notes

Open full notebook →

Save study notes for this attempt. They also collect in your mistake notebook.

Loading notes…