Examkin

Question

Difficulty: HardNetwork Device Hardening Best Practices

A network engineer is conducting a security baseline hardening exercise on a branch office router. The audit reveals that administrative management sessions and remote telemetry are currently using unencrypted legacy protocols. The engineer must secure the management plane so that all administrative command access and monitoring data are protected against eavesdropping and unauthorized modification. Which TWO configuration actions should the network engineer implement to meet these hardening requirements?

  1. Disable Telnet and HTTP access, and enable SSHv2 alongside HTTPS for encrypted administrative sessions.Answer
  2. Migrate network monitoring services from SNMPv1/v2c to SNMPv3 configured with the authPriv security level.Answer
  3. C
    Assign all unused physical interfaces to the default VLAN (VLAN 1) and leave them administratively enabled for rapid host deployment.
  4. D
    Reassign the 802.1Q native VLAN on all trunk interfaces to VLAN 1 to isolate untagged traffic.
  5. E
    Reconfigure remote administration daemons to communicate over TCP port 23 to enable TLS encryption.

Answer

The correct hardening actions are to disable Telnet and HTTP in favor of SSHv2 and HTTPS, and to implement SNMPv3 with the authPriv security level for remote monitoring.
Hardening network device management planes requires encrypting all administrative and telemetry streams. Replacing cleartext Telnet and HTTP with SSHv2 and HTTPS protects command-line and web administration sessions. Furthermore, deploying SNMPv3 with authPriv ensures both authentication integrity and payload confidentiality for network monitoring traffic.

Step-by-Step Solution

1
Analyze management plane protocol requirements
Identify that plain-text administration (Telnet/HTTP) must be replaced with encrypted equivalents (SSHv2/HTTPS).
Plain-text protocols expose administrative credentials and session traffic to sniffing attacks.
2
Analyze remote telemetry and monitoring requirements
Select SNMPv3 using the authPriv security tier.
Unlike SNMPv1/v2c which transmit community strings in plain text without payload encryption, SNMPv3 authPriv enforces HMAC authentication and AES/DES encryption.
3
Evaluate distractor practices against device hardening baselines
Reject retaining default VLAN 1 assignments on unused interfaces or trunk native VLANs, as well as port 23 misconfigurations.
Unused ports should be shutdown and moved to a non-default blackhole VLAN, native VLAN 1 should be changed, and port 23 remains unencrypted Telnet.

Key Concept

Device Management Plane Hardening
Estimated Time:2m 0s
Rate this question

Topics

Network Device Hardening Best Practices

More questions from this topic