Examkin

Question

Difficulty: EasyNetwork Device Hardening Best Practices

A network administrator is establishing a baseline hardening configuration on a newly deployed edge switch. Which of the following administrative practices should be implemented to secure the management plane of the device? (Select TWO.)

  1. Disable the Telnet daemon and configure SSH for encrypted command-line management.Answer
  2. Replace legacy SNMPv1/v2c configurations with SNMPv3 utilizing cryptographic authentication and privacy (authPriv).Answer
  3. C
    Assign all unused switch ports to the active native VLAN to simplify trunk management.
  4. D
    Enable HTTP management on port 80 to reduce CPU overhead associated with TLS session negotiation.
  5. E
    Leave unallocated switch ports active in default VLAN 1 to allow dynamic connection setup.

Answer

The administrator should disable Telnet in favor of SSH for encrypted CLI administration, and deploy SNMPv3 with authPriv instead of insecure legacy SNMP versions.
Disabling Telnet in favor of SSH secures CLI sessions by encrypting all traffic. Transitioning to SNMPv3 with authPriv ensures that network monitoring traffic is cryptographically authenticated and encrypted, preventing unauthorized device access and interception.

Step-by-Step Solution

1
Evaluate CLI management protocols.
Telnet uses cleartext traffic on port 23, while SSH uses encrypted sessions on port 22.
Hardening the management plane requires encrypting all interactive administrative access.
2
Evaluate monitoring protocols.
SNMPv1 and SNMPv2c transmit community strings in unencrypted text. SNMPv3 provides strong authentication and privacy (authPriv).
Cryptographic authentication and payload encryption are required for secure device monitoring.

Key Concept

Management Plane Hardening
Rate this question

Topics

Network Device Hardening Best Practices

More questions from this topic