Question

Difficulty: MediumNetwork Device Hardening Best Practices

A network administrator is securing a newly deployed Layer 3 access switch prior to production deployment. The security policy mandates encrypted remote monitoring, protection against unauthorized network infrastructure footprinting, and secure management protocol usage. Which of the following hardening configurations should the administrator apply to meet these security requirements? (Select TWO.)

  1. Configure SNMPv3 with authPriv security level to enforce user-based authentication and payload encryption.Answer
  2. Disable link-layer discovery protocols such as CDP and LLDP on interfaces connected to untrusted user devices.Answer
  3. C
    Enable Telnet on virtual terminal (VTY) lines and rely on a standard IPv4 Access Control List for session protection.
  4. D
    Configure SNMPv2c using default community strings to facilitate lightweight network management polling.
  5. E
    Assign all active access ports to the unconfigured default native VLAN without applying port security controls.

Answer

The administrator should configure SNMPv3 with authPriv for encrypted monitoring and disable discovery protocols (CDP/LLDP) on untrusted interfaces to reduce infrastructure exposure.
Configuring SNMPv3 authPriv secures network monitoring with cryptographic authentication and encryption. Disabling discovery protocols (CDP/LLDP) on untrusted ports prevents external reconnaissance and unauthorized network topology discovery.

Step-by-Step Solution

1
Identify the management monitoring requirement.
Selecting SNMPv3 authPriv satisfies the mandate for encrypted telemetry and authenticated access.
Legacy protocols like SNMPv1/v2c send community strings in cleartext and lack privacy protections.
2
Identify the infrastructure footprinting prevention requirement.
Disabling CDP/LLDP on user-facing edge ports blocks neighbor information broadcast.
Discovery protocols share detailed network device capabilities, system names, and IP addresses with connected endpoints.

Key Concept

Device Hardening & Management Plane Security
Rate this question