Examkin

Question

Difficulty: HardNetwork Device Hardening Best Practices

A network administrator is implementing hardening controls on an enterprise core switch following a security audit. The audit report flagged two primary vulnerabilities: administrative monitoring data and CLI sessions are being transmitted without payload encryption, and untagged management traffic is exposed to potential VLAN hopping attacks across 802.1Q trunk lines. Which set of device hardening configurations directly remediates both identified security risks?

  1. Migrate network monitoring to SNMPv3 using the authPriv security level, enforce SSH for CLI administration, and reassign the native VLAN on all 802.1Q trunks to an unused non-default VLAN ID.Answer
  2. B
    Configure SNMPv2c with restricted read-only community strings, enable Telnet over TCP port 22, and retain VLAN 1 as the native VLAN across all trunk connections.
  3. C
    Implement SNMPv3 configured with noAuthNoPriv security level, enforce SSH for remote access, and map the native VLAN on all trunk links to the active user access VLAN.
  4. D
    Enable HTTPS for web management, deploy SNMPv3 with authNoPriv security level, and prune VLAN 1 from all trunk allowed lists while leaving the native VLAN undefined.

Answer

Migrate network monitoring to SNMPv3 using the authPriv security level, enforce SSH for CLI administration, and reassign the native VLAN on all 802.1Q trunks to an unused non-default VLAN ID.
The correct configuration combines SNMPv3 at the authPriv security level (which provides cryptographic authentication and AES payload encryption) with SSH (which encrypts CLI management traffic). Additionally, reassigning the native VLAN on 802.1Q trunk links from default VLAN 1 to a dedicated, unused VLAN ID prevents untagged traffic leakage and mitigates double-tagging VLAN hopping attacks.

Step-by-Step Solution

1
Analyze transport security requirements for management plane protocols.
Identified that legacy protocols (Telnet, HTTP, SNMPv1/v2c) transmit data in cleartext. SSH and HTTPS provide encrypted transport for administration, while SNMPv3 with authPriv provides both authentication hashing (auth) and payload encryption (priv).
Resolves cleartext credential and health metric exposure over the local management domain.
2
Analyze trunk link vulnerability requirements.
Default VLAN 1 usage as the native VLAN on 802.1Q trunks exposes switches to double-tagging and untagged frame leakage. Changing the native VLAN to an unused ID (and disabling untagged traffic processing) mitigates VLAN hopping.
Isolates control plane/management traffic from untagged user frame processing.
3
Combine protocol and switchport hardening controls into a complete mitigation plan.
The correct configuration combines SNMPv3 (authPriv), SSH, and native VLAN reassignment to an unused VLAN ID.
Directly satisfies both encryption and layer 2 trunk isolation requirements.

Key Concept

Management Plane Hardening & Native VLAN Isolation
Estimated Time:2m 0s
Rate this question

Topics

Network Device Hardening Best Practices

More questions from this topic