Examkin

Question

Difficulty: Very hardNetwork Device Hardening Best Practices

A network security engineer is establishing a hardened configuration baseline for a core switch cluster to mitigate internal eavesdropping and unauthorized access risks. A security audit highlights that device telemetry monitoring traffic exposes system OIDs and interface statistics in cleartext across the network, while unassigned access ports and default trunking settings present physical and logical intrusion risks. Which set of device hardening configurations correctly addresses all of these identified vulnerabilities according to industry best practices?

  1. Implement SNMPv3 with the authPriv security level specifying SHA for authentication and AES for encryption, disable all unassigned physical switch ports while assigning them to an unused blackhole VLAN, and change the 802.1Q native VLAN from default VLAN 1 to an unused VLAN ID.Answer
  2. B
    Implement SNMPv2c using complex randomized community strings, shutdown all unassigned physical ports, and maintain the 802.1Q native VLAN as VLAN 1 to ensure untagged management traffic routes without encapsulation overhead.
  3. C
    Implement SNMPv3 with the authNoPriv security level using MD5 authentication, leave unassigned switch ports active in VLAN 1 with sticky MAC address port security enabled, and align the native VLAN with the active user data VLAN.
  4. D
    Implement SNMPv3 with noAuthNoPriv running over TCP port 22, enforce SSHv2 for VTY line access, and assign the 802.1Q native VLAN to an active access VLAN across all trunk links.

Answer

Implement SNMPv3 with the authPriv security level specifying SHA for authentication and AES for encryption, disable all unassigned physical switch ports while assigning them to an unused blackhole VLAN, and change the 802.1Q native VLAN from default VLAN 1 to an unused VLAN ID.
The correct response comprehensively addresses all management plane and Layer 2 hardening requirements. Configuring SNMPv3 with authPriv guarantees both origin authentication and packet confidentiality using SHA and AES encryption, preventing cleartext telemetry interception. Administratively disabling unused ports and assigning them to an isolated blackhole VLAN prevents unauthorized local physical access. Finally, changing the 802.1Q native VLAN from default VLAN 1 to an unused, dedicated VLAN ID prevents VLAN hopping exploits.

Step-by-Step Solution

1
Evaluate management protocol security levels for SNMP monitoring telemetry.
SNMPv3 using the authPriv security level is required to provide both cryptographic authentication (SHA) and privacy via payload encryption (AES).
SNMPv1/v2c transmit community strings in cleartext, and SNMPv3 authNoPriv only authenticates without encrypting the monitored data payload.
2
Assess physical switch port hardening for unassigned access ports.
Unused switch ports must be administratively shut down (`shutdown`) and assigned to a non-routed, inactive VLAN (blackhole VLAN).
Leaving unused ports active in default VLAN 1 allows unauthorized devices to gain immediate Layer 2 access upon physical connection.
3
Analyze trunk line security and native VLAN isolation best practices.
The 802.1Q native VLAN must be changed from default VLAN 1 to an unused VLAN ID that carries no active user or management traffic.
Default VLAN 1 is a well-known target for VLAN hopping attacks (such as double-tagging), and isolating untagged trunk frames prevents unauthorized Layer 2 traversal.

Key Concept

Management Plane and Layer 2 Switch Hardening Best Practices
Estimated Time:2m 0s
Rate this question

Topics

Network Device Hardening Best Practices

More questions from this topic