Question

Difficulty: MediumKey Security Concepts, Threats, Vulnerabilities, and Mitigations

A network administrator is conducting a security baseline review for an enterprise network to distinguish key security concepts and apply suitable mitigation strategies. Which two statements accurately describe key security principles or valid mitigation practices? (Select two.)

  1. A vulnerability represents a weakness or flaw in system design, implementation, or configuration that could be exploited by a threat actor.Answer
  2. Implementing 802.1X Port-Based Network Access Control mitigates unauthorized network connectivity by authenticating endpoints before granting switch port access.Answer
  3. C
    TACACS+ encrypts only the user password field within the packet payload, leaving authorization details unencrypted during AAA communication.
  4. D
    Enabling switch port security with sticky MAC address learning dynamically saves learned addresses directly into the startup configuration file.

Answer

The correct statements define a vulnerability as a system flaw or weakness that can be exploited by a threat, and describe 802.1X Port-Based Network Access Control as a valid mitigation that authenticates devices before granting network switch port access.
A vulnerability is defined as an internal weakness or flaw in system design, software, or configuration that can be exploited by a threat actor. 802.1X Network Access Control serves as a robust mitigation mechanism by forcing endpoints to authenticate before granting access to the LAN switch port.

Step-by-Step Solution

1
Differentiate security baseline concepts such as threats, vulnerabilities, and mitigations.
Identify that a vulnerability is a weakness in code, design, or implementation that creates potential exposure.
Accurate conceptual taxonomy is necessary for risk assessment and system hardening.
2
Evaluate identity and access control mitigations for local network access.
Confirm that 802.1X enforces port-level security by restricting traffic until authentication succeeds.
Network access controls prevent unauthorized devices from attaching to switch ports.
3
Analyze distractors related to AAA protocols and switch security operations.
Recognize that TACACS+ encrypts the complete packet payload (unlike RADIUS) and that sticky MAC addresses reside in running-config until saved to NVRAM.
Misinterpreting protocol mechanics or configuration state persistence leads to invalid security assumptions.

Key Concept

Key Security Terminology and Network Access Mitigations
Rate this question