Examkin

Question

Difficulty: MediumNetwork Device Hardening Best Practices

A network technician is hardening an access switch installed in a publicly accessible building lobby. A vulnerability audit indicates that the switch port connected to the lobby Ethernet jack is transmitting detailed hardware specifications, system capabilities, and native device hostnames to connected client devices. Which of the following configuration changes should the technician implement on this interface to resolve the information disclosure vulnerability?

  1. Disable Layer 2 discovery protocols (such as CDP or LLDP) on the untrusted interface.Answer
  2. B
    Assign the port to a dedicated isolated VLAN to block broadcast frame propagation.
  3. C
    Reconfigure the access interface as an 802.1Q trunk and change the native VLAN ID.
  4. D
    Disable Telnet on port 23 and enable HTTP on port 80 to encrypt outgoing management advertisements.

Answer

Disable Layer 2 discovery protocols (such as CDP or LLDP) on the untrusted interface.
Disabling Layer 2 discovery protocols (CDP/LLDP) on untrusted access ports is a core device hardening best practice. CDP and LLDP continuously broadcast system details—such as device capabilities, platform specifications, native VLAN IDs, and switch port identifiers—in plain text. Turn off these protocols on public-facing or user-accessible interfaces to prevent malicious reconnaissance.

Step-by-Step Solution

1
Analyze the reported security vulnerability.
The device is emitting broadcast messages containing internal switch characteristics (hostname, hardware model, OS version, and capability flags) out a public-facing port.
Layer 2 discovery protocols like Cisco Discovery Protocol (CDP) or Link Layer Discovery Protocol (LLDP) transmit periodic unencrypted advertisements by default.
2
Evaluate network device hardening best practices for untrusted access ports.
Identify that discovery protocols should be globally disabled or turned off specifically on edge ports facing untrusted/public areas to mitigate reconnaissance attacks.
Attackers can intercept CDP/LLDP frames to map out internal network infrastructure without authenticating.
3
Select the correct interface hardening control.
Disabling CDP/LLDP on the public interface stops outbound advertisements while maintaining normal network connectivity for legitimate connected devices.
This directly eliminates the information disclosure vector at Layer 2.

Key Concept

Disabling Layer 2 Discovery Protocols on Untrusted Ports
Estimated Time:1m 0s
Rate this question

Topics

Network Device Hardening Best Practices

More questions from this topic