incident-response-trainer
Incident response training · Rule-based scoring
DemoCatalogDiagnosticHistoryDashboardCoach Notes
Attempt report

Office VLAN bridged to prod-mgmt — SNMP communities and SMBv1 broadcasts visible

Cyber × Network FusionVLAN Leak + Cred ExposureDifficulty · Easy

Attempt 1 of 1 · cmqrhr98g00020kx9v8716oa7

← All attempts↻ Retry this scenarioNew scenario
Progress vs previous attempt

This is your first attempt for this scenario. Retry the scenario to generate a side-by-side comparison against your previous response.

Progression · Keep practicing

Stay on Easy · Cyber × Network Fusion

4 signals are blocking advancement to Medium. Keep practicing at Easy until those areas stabilize. (Track: Cyber × Network Fusion)

Track · Cyber × Network Fusion
Easy
Sample · 4 recent attempts2 positive4 blocking

Signals helping

  • Dangerous action frequency. None in recent attempts
  • Recent retry improvement trend. Score is improving (+57.5 pts on later attempts)

Signals blocking advancement

  • Recent average score. 31 / 100 (need ≥ 75)
  • Recent pass rate. 0 of 4 passed (need ≥ 66%)
  • Rubric category coverage. 32% average (need ≥ 55%)
  • Consistently weak rubric areas. Evidence & change record, Investigation & diagnosis, Recovery
Submission · what was sent and how you responded
VLAN Leak + Cred ExposureDifficulty · easyHigh asset
[POSSIBLE INCIDENT] Office VLAN seeing prod-mgmt SNMP/SMB broadcasts
From
SOC L2 <soc-l2@acme-corp.com>
To
netops@acme-corp.com
Date
2026-04-22 09:32 UTC
An office workstation reported "weird ARP entries" — naming convention matched prod-mgmt servers. We did a quick capture from a sample office desk and saw: - SNMPv1/v2c GETs with community="public" and "acme-mgmt" toward prod-mgmt routers - SMBv1 broadcast browsing announcements from prod-mgmt jumphost - ARP for 10.0.99.1 (prod-mgmt gateway) appearing on office segment A trunk allowed-VLAN list change went into DIST-A 4 days ago for a "fix". It looks like prod-mgmt VLAN 99 was added to the office trunk by mistake. Treat as both a segmentation violation and a credential exposure (those SNMP communities are now exposed on a less-trusted segment). — SOC L2
Evidence
Trunk config diff + tcpdump from office desk
# DIST-A trunk config (current)
interface Po2
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,99   <-- vlan 99 added 4d ago

# DIST-A trunk config (4d ago, pre-change)
interface Po2
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30      <-- vlan 99 NOT present

# tcpdump on an office workstation (sample, 60s)
09:18:04  10.0.99.5 -> 10.0.99.255  SNMP v2c  community="public"   (RouterOS get)
09:18:09  10.0.99.5 -> 10.0.99.255  SNMP v2c  community="acme-mgmt"
09:18:15  10.0.99.7 -> 10.0.99.255  SMBv1 BROWSE  Announcement: PROD-MGMT-JUMP01
09:18:23  10.0.99.5 -> 10.0.99.1    SNMP v2c  community="acme-mgmt"  set request

# ARP on office workstation
Internet 10.0.99.1   0  bcd1.7f00.001a  ARPA  Vlan10
Internet 10.0.99.5   0  001e.7d00.0099  ARPA  Vlan10
Affected asset
Name
DIST-A Po2 + prod-mgmt SNMP credentials
Type
L2 trunk misconfig + cleartext credential exposure
Owner
Network Operations · Core Distribution
Level
High
Your submitted response
2 words
don't know
Final score
0/ 100
2 words submitted
Verdict · Fail

The response is missing several critical incident response steps. Review the rubric and try again. Score: 0/100. Strongest area: Clarity & structure (3%). Weakest area: Attack & fault understanding (0%) — expand this next time. The response is quite short; aim for a more structured, step-by-step plan.

Category breakdown

Where points came from

coverage × weight = points
  • Attack & fault understanding0/3 · 0.0 / 15
  • Topology & asset impact0/3 · 0.0 / 10
  • Prioritization0/2 · 0.0 / 10
  • & mitigation0/4 · 0.0 / 20
  • Investigation & diagnosis0/4 · 0.0 / 15
  • Recovery0/4 · 0.0 / 10
  • Evidence & change record0/3 · 0.0 / 10
  • Clarity & structure0/2 · 0.3 / 10

Strengths

No category reached 70% coverage.

Missing / weak

  • Attack & fault understanding
  • Topology & asset impact
  • Prioritization
  • & mitigation
  • Investigation & diagnosis
  • Recovery
  • Evidence & change record
  • Clarity & structure

Dangerous actions detected

None detected in your response.

Learning · Coaching

Learn from this attempt

Post-submission coaching for this scenario. Score and verdict are unchanged — these notes are for your next attempt.

Why points were deducted

  • Containment & mitigation0% coverage

    Restore the allowed-VLAN list, scope SNMP via ACL, rotate communities, disable v2c — partial loses points.

  • Attack & fault understanding0% coverage

    Name both halves: a trunk allowed-VLAN edit (segmentation violation) AND cleartext SNMP community exposure on a less-trusted segment.

  • Investigation & diagnosis0% coverage

    Cite `show interfaces trunk`, the config-diff against the 4-day-old archive, and the office-VLAN pcap together.

Model answer outline

From: Incident Response Lead (SOC on-call)To: IT Leadership · Affected Asset Owner · On-call SOCSubject: [SEV-3][INC-FUS-E4A55] Office VLAN bridged to prod-mgmt — SNMP communities and SMBv1 broadcasts visible — status update
Incident · INC-FUS-E4A55 · SEV-3 / P3Status · Investigating — containment in progressCyber × Network Fusion · VLAN Leak + Cred Exposure · EasyDIST-A Po2 + prod-mgmt SNMP credentials · High criticalityDetected ~ 2026-04-22 09:32 UTC
Situation & summary

DIST-A Po2 had VLAN 99 (prod-mgmt) added to its 'allowed vlan' list four days ago, so the office floor is now seeing prod-mgmt SNMPv1/v2c GETs with community 'public' and 'acme-mgmt', SMBv1 browse announcements from PROD-MGMT-JUMP01, and ARP for 10.0.99.1 — every cleartext credential and every browse-list leak is reaching a less-trusted segment in real time.

Severity & priority

Rated SEV-3 / P3. Treat as a P2 segmentation violation AND a credential exposure: the SNMP community strings are now considered burned the moment they appear on the office VLAN.

Prioritization & impact
  • Treat as a P2 segmentation violation AND a credential exposure: the SNMP community strings are now considered burned the moment they appear on the office VLAN.
  • Run NetOps containment (allowed-VLAN list cleanup) and SOC containment (community rotation) in parallel.
  • Escalate to the change-review owner who made the 4-day-old trunk edit; the post-mortem is as important as the fix.
Containment (actions taken / in progress)
  • On DIST-A Po2, restore the allowed VLAN list to the pre-change shape (`switchport trunk allowed vlan 10,20,30`) so VLAN 99 stops crossing the trunk.
  • Rotate every SNMP community that was visible on the office VLAN (especially 'acme-mgmt' which had a write request) and move toward SNMPv3 with auth/priv.
  • Apply a vty / SNMP ACL on the prod-mgmt routers so SNMP only answers from the legitimate management subnet, not from the office segment.
  • Disable SNMPv1/v2c on the affected core routers once SNMPv3 is in place; do not leave v2c running with the same community.
Investigation (in progress)
  • Run `show interfaces trunk` and `show running-config interface Po2` and diff against the 4-day-old archive to prove the allowed-VLAN edit was the trigger.
  • Pull the office-VLAN pcap and confirm SNMPv2c GET/SET requests reached prod-mgmt addresses, not just broadcasts.
  • Use `show logging` and the change-management audit trail to identify the operator and ticket behind the edit.
  • Inventory which prod-mgmt devices answered SNMP from the office VLAN, so the credential-rotation list is exhaustive.
Recovery & next steps
  • Mandate SNMPv3 with auth/priv on the management plane, deprecate SNMPv1/v2c globally, and lock SNMP behind a vty ACL.
  • Disable SMBv1 and add browse suppression on prod-mgmt jumphosts so segmentation slips fail closed.
  • Add a 4-eye / peer-review gate for any allowed-VLAN edit on a distribution trunk, plus a config-archive drift check.
  • Add a quarterly segmentation audit (test packet from each user VLAN to prod-mgmt) so the next slip is caught before exposure.
Evidence preservation
  • Snapshot `show running-config interface Po2` pre and post fix and archive the 4-day-old baseline.
  • Preserve the office-VLAN pcap and the `show interfaces trunk` output before any rollback.
  • Open a NOC + SOC ticket pair recording the change ticket, the operator, and the rotated communities.
Stakeholder communication
  • Notify the prod-mgmt owners that all SNMP communities exposed on the office segment are being rotated and what the cutover window is.
  • Brief the change-management board so the trunk-edit policy is updated; document the RCA in the next change-review.
  • Update Helpdesk so users see only the planned SNMP outage window, not surprise router reauth.
Do NOT
  • Do not run `no vlan 99` to 'remove the leak' — that breaks the entire prod-mgmt segment, not just the leak.
  • Do not paste a permit-any-any ACL onto prod-mgmt to hide the segmentation violation.
  • Do not disable SNMP company-wide as a panic move; rotate + scope first, then deprecate v2c.
  • Do not skip the credential rotation just because 'it was only on the office VLAN for four days' — assume it was captured.

Dangerous actions to avoid

  • Do not run `no vlan 99` to 'remove the leak' — that breaks the entire prod-mgmt segment, not just the leak.
  • Do not paste a permit-any-any ACL onto prod-mgmt to hide the segmentation violation.
  • Do not disable SNMP company-wide as a panic move; rotate + scope first, then deprecate v2c.
  • Do not skip the credential rotation just because 'it was only on the office VLAN for four days' — assume it was captured.

How to improve next time

  • When a trunk edit changes who can see whom, treat it as both a network bug and a credential incident — the cleartext protocols crossing the boundary are the real risk.
  • SNMPv1/v2c communities are passwords in cleartext; once they appear on a less-trusted segment, treat them as burned.
  • Allowed-VLAN edits on distribution trunks deserve 4-eye review — they silently cross trust boundaries with no MAC/IP signal.
  • Pair SNMP rotation with v3 migration, otherwise the same exposure happens the next time a trunk is misedited.
  • Keep the diff against the 4-day-old archive as evidence — segmentation incidents are easier to prove with a pre/post config than with packet capture alone.
AI · Supplemental review

Request an AI review of this attempt

This AI review is supplemental coaching. It does not change your official score or verdict. The review is only kept for this page session and is not saved permanently.

Review language
AI Tutor · Explains your result

AI Tutor

This tutor explains your result. It does not change your score. Pick a question to see how the deterministic grading reached your verdict and where to focus next.

Generated deterministically from your graded result — no AI model was called.

Why did I get this score?

Your verdict was Fail at 0/100. That total is the sum of deterministic rubric points across 8 categories — each scores how much of its expected, ordered steps your answer covered, not an opinion about your writing. Your strongest coverage was Clarity & structure (3%). Points were held back mostly in Containment & mitigation (0%), Attack & fault understanding (0%), Investigation & diagnosis (0%).

Rubric focuscontainmentattackUnderstandinginvestigation
Next study step

Re-read the containment & mitigation expectations for this scenario and list the concrete steps you missed.

This tutor explains your existing result. It does not change your score, verdict, or grade. Generated deterministically from your graded result — no AI model was called.

What should I improve first?

Focus on Containment & mitigation first — it is your weakest rubric area at 0% coverage and carries weight 20. For this scenario: Restore the allowed-VLAN list, scope SNMP via ACL, rotate communities, disable v2c — partial containment loses points.

Rubric focuscontainment
Next study step

Rewrite your containment & mitigation section as a short numbered checklist before your next attempt.

This tutor explains your existing result. It does not change your score, verdict, or grade. Generated deterministically from your graded result — no AI model was called.

How does my answer compare to the model answer outline?

Compared with the model answer outline, the most useful sections to study are the ones matching your weak areas. Re-read the outline's containment & mitigation, attack & fault understanding, investigation & diagnosis guidance and check which listed points you did not cover. The outline is a high-level checklist of expected points — use it to find gaps, not to copy a finished answer.

Rubric focuscontainmentattackUnderstandinginvestigation
Next study step

Pick one model-answer section you missed and add its key points to your next response in your own words.

This tutor explains your existing result. It does not change your score, verdict, or grade. Generated deterministically from your graded result — no AI model was called.

Which rubric area mattered most here?

Containment & mitigation mattered most here: it carries the highest rubric weight (20), so coverage there moves your score the most. You covered 0% of it this time, worth 0 points.

Rubric focuscontainment
Next study step

Prioritise the highest-weight categories first; make sure containment & mitigation is fully addressed before lower-weight ones.

This tutor explains your existing result. It does not change your score, verdict, or grade. Generated deterministically from your graded result — no AI model was called.

What should I study next?

Based on this attempt, study containment & mitigation, attack & fault understanding, investigation & diagnosis next. Coaching tip for this scenario: When a trunk edit changes who can see whom, treat it as both a network bug and a credential incident — the cleartext protocols crossing the boundary are the real risk.

Rubric focuscontainmentattackUnderstandinginvestigation
Next study step

When a trunk edit changes who can see whom, treat it as both a network bug and a credential incident — the cleartext protocols crossing the boundary are the real risk.

This tutor explains your existing result. It does not change your score, verdict, or grade. Generated deterministically from your graded result — no AI model was called.

Coach Notes

Open full notebook →

Save study notes for this attempt. They also collect in your mistake notebook.

Loading notes…