Examkin

Question

Difficulty: HardNetwork Device Hardening Best Practices

A network security engineer is performing baseline administrative hardening on a newly deployed edge router to secure its management plane before production deployment. In what correct operational sequence should the engineer execute the following administrative hardening steps to establish secure remote management and enforce network access controls?

  1. 1Define a device hostname and IP domain name, then generate a 2048-bit RSA host key pair.
  2. 2Create a local administrative account using password encryption and disable default vendor credentials.
  3. 3Configure Virtual Terminal (VTY) lines to permit transport input exclusively via SSH Version 2 and disable Telnet.
  4. 4Apply an Access Control List (ACL) to the VTY lines to restrict remote access strictly to the dedicated management subnet.
  5. 5Disable unneeded HTTP/HTTPS web services, administrative unassigned ports, and reassign the native VLAN to an unused non-default ID.

Answer

The correct operational sequence begins by defining the hostname, domain name, and generating 2048-bit RSA keys, followed by creating encrypted local admin credentials, configuring VTY lines for SSH Version 2 exclusively, applying a management subnet ACL to the VTY lines, and concluding with disabling unused services, unassigned ports, and default native VLAN reassignment.
The correct hardening sequence follows a logical dependency chain: crypto key generation relies on host/domain identifiers, administrative user accounts must exist before enabling SSH login on VTY lines, VTY access must be scoped to specific management subnets via ACLs, and general device surface reduction (disabling unused ports/services and native VLAN isolation) completes the hardening baseline.

Step-by-Step Solution

1
Generate cryptographic host keys after defining the hostname and IP domain name.
The device instantiates the RSA key pair required by the SSH daemon.
SSH key generation fails unless an explicit domain name and hostname are present in the router configuration.
2
Configure encrypted local AAA/local administrative credentials and remove default accounts.
Authentication database is populated with secure admin account details.
Local credentials must exist so that SSH login requests can be authenticated securely.
3
Enforce transport input ssh on VTY lines and disable legacy cleartext management daemons.
Cleartext protocols like Telnet are disabled on management lines.
Restricting transport options prevents eavesdropping and credential interception across administrative sessions.
4
Attach a restrictive IPv4/IPv6 ACL to the VTY line configuration.
Inbound connection attempts from unauthorized subnets are dropped at the management boundary.
VTY ACLs minimize exposure by limiting management plane access to designated out-of-band or admin subnets.
5
Disable unneeded web/management services, shut down unassigned physical interfaces, and isolate native VLAN 1.
Attack surface is minimized across physical ports, web planes, and Layer 2 broadcast domains.
Layer 2 hardening and service suppression prevent unauthorized physical connections, web vulnerabilities, and VLAN hopping exploits.

Key Concept

Management Plane Baseline Hardening Workflow
Estimated Time:2m 30s
Rate this question

Topics

Network Device Hardening Best Practices

More questions from this topic