Examkin

Question

Difficulty: HardNetwork Device Hardening Best Practices

A network security administrator is tasked with baseline hardening for a newly installed Layer 3 enterprise switch before connecting it to the production network. Corporate security compliance mandates that the configuration must mitigate double-tagging VLAN hopping attacks on trunk connections, prevent unauthorized access on unassigned physical ports, and protect administrative sessions from eavesdropping and tampering. Which set of device hardening measures best meets these requirements?

  1. Change the native VLAN on all 802.1Q trunk links to an unused non-default VLAN ID, disable Dynamic Trunking Protocol (DTP) on trunk ports, shut down all unused physical switch ports and reassign them to an isolated blackhole VLAN, and enforce SSHv2 alongside SNMPv3 with authPriv for remote management.Answer
  2. B
    Retain VLAN 1 as the native VLAN across trunk links to ensure management traffic compatibility, disable DTP, place all unused switch ports into administratively down status while keeping them in VLAN 1, and restrict remote VTY line access strictly to Telnet bound to a management Access Control List (ACL).
  3. C
    Reassign the native VLAN on 802.1Q trunks to an unused non-default VLAN ID, enable DTP to dynamically negotiate trunk encapsulation with adjacent switches, assign unused physical ports to the native VLAN, and implement SNMPv2c using a complex, non-default community string.
  4. D
    Change the native VLAN on 802.1Q trunks to match the active user data VLAN, disable unused switch ports without modifying their VLAN assignments, and enable HTTP-based web management restricted to authorized subnet ranges.

Answer

Change the native VLAN on all 802.1Q trunk links to an unused non-default VLAN ID, disable Dynamic Trunking Protocol (DTP) on trunk ports, shut down all unused physical switch ports and reassign them to an isolated blackhole VLAN, and enforce SSHv2 alongside SNMPv3 with authPriv for remote management.
The correct response combines comprehensive Layer 2 and management plane hardening controls. Native VLAN reassignment to a dedicated, unused VLAN ID combined with disabling DTP prevents VLAN hopping via double-tagging and unauthorized trunk formation. Moving unused ports to a non-routed blackhole VLAN while disabling them prevents physical rogue access. Enforcing SSHv2 and SNMPv3 configured with authPriv guarantees both cryptographic authentication and strong payload encryption for remote management.

Step-by-Step Solution

1
Analyze layer 2 trunk hardening requirements.
Default VLAN 1 should never be used as the native VLAN on 802.1Q trunks because untagged frames could enable double-tagging attacks. Reassigning the native VLAN to a dummy/unused VLAN ID and explicitly disabling DTP prevents malicious trunk negotiation.
Eliminates potential VLAN hopping and untagged frame leakage vulnerabilities across trunk interfaces.
2
Analyze physical switch port security requirements.
Unused interfaces should be administratively disabled (`shutdown`) and assigned to an isolated blackhole VLAN that is not routed anywhere on the network.
Prevents unauthorized physical access to the internal network by plugging into inactive Ethernet ports.
3
Analyze management plane security requirements.
Legacy cleartext management protocols (Telnet, HTTP, SNMPv1/v2c) must be replaced with secure, encrypted alternatives (SSHv2, HTTPS, SNMPv3 with authentication and privacy/encryption).
Ensures administrative credentials and network monitoring telemetry are protected against eavesdropping and man-in-the-middle attacks.

Key Concept

Switch Baseline Hardening & Management Plane Security
Rate this question

Topics

Network Device Hardening Best Practices

More questions from this topic