Comprehensive exam scenario synthesis, ISP primary/secondary link failovers, firewall perimeter defenses, and industrial infrastructure troubleshooting.
Part 1: Enterprise Network Architecture & ISP Failover
P4-Q01[15 Marks]
EXAM SCENARIO SYNTHESIS: A commercial bank headquarters operates a core datacenter with high-availability transaction servers. Evaluate why deploying a single high-speed fiber optic connection is insufficient for enterprise business continuity, and design an automated dual-ISP failover strategy. [15 Marks]
Official NUST Model Defense [15 Marks]:
Single Point of Failure (SPOF) Risk [4 Marks]: Fiber optic physical cables are vulnerable to accidental road excavation cuts, pole damages, or ISP central exchange power outages. A single link outage halts real-time banking transactions.
Primary vs. Secondary Provider Selection [4 Marks]:
• Primary WAN Link (Liquid Telecom Fiber): Low cost per GB, high speed (1 Gbps symmetric), carries 95% of routine operational traffic.
• Secondary WAN Link (TelOne / Dedicated Microwave): Higher cost per GB, lower capacity, used strictly as an active standby backup link.
Automated BGP / Static Floating Route Failover [4 Marks]: Configure two default static routes on the perimeter firewall using Administrative Distance (AD):
ip route 0.0.0.0 0.0.0.0 203.0.113.1 1 (Primary AD=1)
ip route 0.0.0.0 0.0.0.0 198.51.100.1 10 (Secondary Floating AD=10).
Physical Diversity [3 Marks]: Primary and secondary cables must enter the building via separate physical conduits to prevent simultaneous cable damage.
Part 2: Perimeter Security (Firewalls, IDS & IPS)
P4-Q02[10 Marks]
Compare Intrusion Detection Systems (IDS) against Intrusion Prevention Systems (IPS) in an enterprise corporate network. State where each should be positioned relative to the firewall.
Official NUST Marking Scheme [10 Marks]:
IDS Operation (Passive Monitoring) [4 Marks]: Inspects a copy of network traffic mirrored from a switch SPAN port. Generates alerts upon detecting signature anomalies, but does not drop packets inline.
IPS Operation (Inline Prevention) [4 Marks]: Positioned directly inline in the primary traffic path behind the firewall. Actively inspects live packets, resets malicious TCP connections, and drops malicious attack traffic in real time.