AP Networking 4.5: From the Inside Out: Monitoring and Defending a Large Network

A managed network is not defended by one firewall at the edge. It takes layered controls, a morning habit of reading the IDS log, and boundaries drawn inside the network itself. Learn to spot the three threats behind the perimeter, match each alert to the control that limits its impact, and configure a VLAN from plan to proof.

Earlier units guarded a single boundary. Topic 4.5 hands you a grocery store's managed network, registers to freezer sensors, and asks the harder question: what happens when the threat is already inside? The answers map to learning objectives 4.5.A through 4.5.D.

• What threatens a managed network from the inside
• Layered controls: policy, physical, technical
• IDS vs IPS: who alerts, who acts
• Reading the log: threat or performance problem?
• A worked triage: three alert lines
• VLANs: boundaries drawn on the switch
• Configuring a VLAN step by step
• Practice: Alert Analyst
• Using AI on an alert queue, safely
• Key terms
• Frequently asked questions

What threatens a managed network from the inside

Three threat shapes cause most internal incidents. None needs to break through the perimeter firewall.

Threat	How it happens	Impact if it lands
User misuse (EK 4.5.A.1)	Accidental or intentional: access beyond a role, mishandled data, skipped secure procedures	Unauthorized access, data exposure, disrupted services
Physical access (EK 4.5.A.2)	Tailgating or piggybacking through a controlled door; theft of laptops or servers	Direct device access, data theft, equipment tampering
Lateral movement (EK 4.5.A.3)	An adversary or malware spreads from the first compromised device to its neighbors	Widespread compromise, outages, loss of administrative control

Lateral movement deserves special respect. A cheap, unpatched freezer sensor looks worthless to an attacker, until a network with no internal boundaries gives it a path to the registers and the server.

Layered controls: policy, physical, technical

No single control answers all three threats, so organizations layer them, weighing each threat's likelihood against its impact and picking what is cost-effective and scalable (EK 4.5.B.1). The skill AP Networking tests is matching the control to the threat in front of you.

Layer	Controls	What it answers
Policies (EK 4.5.B.2)	Acceptable use policies, password and access control policies, data handling guidelines	User misuse
Physical (EK 4.5.B.3)	Fencing, cameras, on-site security, card readers, access control vestibules, locked rooms and cabinets, cable locks, social engineering training	Tailgating, theft, tampering
Technical (EK 4.5.B.4)	Strong passwords with account lockout, least privilege, segmentation, firewalls, network monitoring and alerts	Unauthorized access and lateral movement

IDS vs IPS: who alerts, who acts

An intrusion detection system (IDS) and an intrusion prevention system (IPS) both analyze network traffic for signs of suspicious or malicious behavior. The difference is what happens next: an IDS generates an alert and a human responds; an IPS inspects traffic inline and can take immediate action to block it (EK 4.5.C.2). Think smoke detector versus sprinkler system.

The logs only help if someone reads them. Regular review catches unusual activity early, speeds response, and over time refines policies and reduces false alerts (EK 4.5.C.1). The store intern reads the log every morning before the doors open.

Reading the log: threat or performance problem?

Log lines fall into two families, and telling them apart is the analyst's first skill: threat indicators suggest unauthorized access or malicious activity (EK 4.5.C.3), while performance indicators point at technical trouble with no adversary at all (EK 4.5.C.4).

Security-threat indicators	Performance / configuration indicators
Repeated failed login attempts	Sudden increases in traffic volume or packet rates
Access attempts outside business hours	Frequent packet drops or timeout errors
Connections to known malicious IP addresses	Misused protocols or unexpected service behavior
Malware signature or suspicious file alerts	Repeated failed connections or service disruptions
Unauthorized network scans

Context decides close calls: a traffic spike at 3 a.m. in a closed store is suspicious; the same spike in the Saturday rush is capacity. Indicators stack, too. One failed login is a typo; hundreds in minutes is an attack.

A worked triage: three alert lines

One morning's store review, read the way an analyst reads it.

02:13:09 ALERT auth-fail ssh 214 attempts in 9 min src 203.0.113.77 dst 10.50.10.5:22 acct=manager

Threat. Three indicators stack: repeated failed logins, after hours, from an external address, aimed at one account. The matching control: account lockout plus the password policy.

14:22:51 ALERT threat-intel pos-07 10.50.20.17 -> 198.51.100.9:443 dst on known-malicious list

Threat. A register initiating a connection to a known malicious address is likely compromised right now. Block the destination at the firewall and investigate the register. What does not fix this: a stronger password policy, which answers the first alert, not this one.

17:48:10 WARN uplink-1 queue full, 3.1 pct packet drops, 940 Mbps sustained since 17:20

Performance. Saturday rush, every register busy, no auth or scan alerts anywhere. A capacity question for the uplink, not an incident. It still matters: this line explains slow card payments before a customer complains.

VLANs: boundaries drawn on the switch

Lateral movement gets its structural answer here. A VLAN (virtual LAN) logically separates devices into isolated groups, by department, role, or device type, without pulling a single new cable. Different VLANs cannot communicate unless routing is enabled, and VLANs also limit broadcast traffic and cut congestion: the boundary that contains an attacker speeds up the network (EK 4.5.D.1).

The store's segmentation plan groups devices by function and security level (EK 4.5.D.2):

VLAN ID	Name	Switch ports	Devices
10	OFFICE	1-4	Back-office server, manager workstation
20	POS	5-12	Registers and card readers
30	IOT	13-16	Freezer sensors, price displays, cameras
40	GUEST	Wi-Fi	Customer phones, internet only

Two port roles make the plan work: an access port connects one device to a single VLAN, while a trunk port carries traffic for multiple VLANs between switches or to a router (EK 4.5.D.3). In the store, ports 1-16 are access ports and port 24 is the trunk linking the two switches and the router.

Configuring a VLAN step by step

On the switch, by CLI or GUI, the build is a short, ordered sequence (EK 4.5.D.4-5):

1. Plan the groups. Decide which users or devices belong together by function or security level. The thinking step; everything after is typing.
2. Create the VLAN. Give it its unique VLAN ID and a clear name: VLAN 20, POS.
3. Assign the ports. Configure the designated switch ports with the VLAN ID. Devices plugged into those ports join automatically.
4. Trunk where VLANs span switches. Configure the switch-to-switch link as a trunk so all VLANs cross on one cable.
5. Verify both directions. Run show vlan brief to confirm the VLAN and its ports. Then ping: same-VLAN devices reach each other; cross-VLAN pings fail unless routing was configured on purpose.

Practice: Alert Analyst

Warm up with three sample questions, then run the morning review yourself in Alert Analyst.

Three free sample questions

1. An IDS line shows 214 failed SSH logins to the office server in 9 minutes, from an external address, at 02:13 in a closed store. What does it indicate?

Show answer

Attempted unauthorized access: failed logins, off-hours access, and an external source are threat indicators, stacked (EK 4.5.C.3).

2. Which tool can block suspicious traffic on its own: an IDS or an IPS?

Show answer

The IPS: it inspects traffic inline and acts immediately. An IDS alerts, and a human responds (EK 4.5.C.2).

3. Registers on VLAN 20 ping each other but cannot reach the server on VLAN 10. What is missing?

Show answer

Routing between the VLANs; the isolation is working as designed (EK 4.5.D.1, 4.5.D.5).

Now the full case set, shuffled every run.

Using AI on an alert queue, safely

Pasting the morning log into an AI assistant is a good first move: it groups lines fast and drafts responses. Then audit it, asking of every recommendation: does this control limit the impact of THIS alert? An assistant that sees failed logins and a malicious-IP connection in the same queue will happily recommend a password policy for both, and for the compromised register that answer is decoration. Verify the categories too: a Saturday traffic spike is not an attack. AI drafts the triage; the analyst matches controls to indicators and signs the briefing.

Key terms

Tailgating / piggybacking

Following an authorized person through a controlled door to bypass access controls.

Lateral movement

An intruder or malware spreading from a compromised device to others it can reach.

Least privilege

Each account gets only the access its role requires.

Acceptable use policy (AUP)

Defines how an organization's network resources may be used.

IDS (intrusion detection system)

Monitors traffic and generates alerts for humans to act on.

IPS (intrusion prevention system)

Inspects traffic inline and can block it immediately.

VLAN (virtual LAN)

A logical device group isolated at the switch; separate VLANs need routing to communicate.

Access port

Connects one device to a single VLAN.

Trunk port

Carries traffic for multiple VLANs between switches or routers.

show vlan brief

Lists each VLAN, its status, and its assigned ports.

Frequently asked questions

What is the difference between an IDS and an IPS?

Both monitor traffic for suspicious behavior. An IDS detects and alerts a human; an IPS inspects traffic inline and can immediately block it.

What indicators in IDS logs suggest an attack?

Repeated failed logins, access attempts outside business hours, connections to known malicious IP addresses, malware signature alerts, and unauthorized network scans.

Can an IDS alert mean something other than an attack?

Yes. Traffic spikes, packet drops, timeout errors, protocol misuse, and failing services are performance or configuration indicators: availability trouble with no adversary, fixed with technical work rather than incident response.

Why review IDS logs regularly if the tool alerts anyway?

Regular review catches unusual activity early, speeds response, and refines policies over time, which reduces false alerts.

What is lateral movement?

An adversary or malware spreading from the first compromised device to others it can reach. Without internal boundaries or monitoring, one hacked device becomes an organization-wide incident.

What is tailgating?

Following an authorized person through a secured door without badging in. It bypasses physical access controls, so the answers are physical: vestibules, card readers, and staff trained to challenge it.

What does a VLAN actually do?

It logically separates devices into isolated groups on the switch. VLANs restrict access to sensitive systems, limit broadcast traffic, and cut congestion, with no new cabling.

Can devices on different VLANs communicate?

Only if routing between the VLANs is configured. Without routing the isolation is total, and that is usually the point.

What is the difference between an access port and a trunk port?

An access port connects one device to a single VLAN. A trunk port carries multiple VLANs between switches or to a router.

How do I verify a VLAN configuration?

Run show vlan brief to confirm the VLAN and its ports, then ping: same-VLAN devices should communicate, and cross-VLAN pings should fail unless routing was enabled on purpose.

AP is a trademark of the College Board, which was not involved in the production of, and does not endorse, this resource.