Examkin

Question

Difficulty: MediumNetwork Device Hardening Best Practices

A network security administrator is configuring a newly installed enterprise edge router to establish a hardened management baseline. Place the administrative hardening tasks into the correct execution sequence, from initial authentication setup to physical port containment.

  1. 1Change default administrative credentials and configure local user accounts with strong password hashing.
  2. 2Generate asymmetric RSA host keys required for transport layer encryption.
  3. 3Configure VTY lines to restrict inbound transport strictly to SSH while disabling clear-text protocols like Telnet.
  4. 4Apply an Access Control List (ACL) to VTY lines to limit remote connections to authorized administrative subnets.
  5. 5Administratively shut down unused physical interfaces and reassign them to an unrouted blackhole VLAN.

Answer

The correct sequence for establishing a secure management baseline is: First, change default credentials and configure local administrative accounts. Second, generate RSA host keys. Third, enforce SSH transport on VTY lines while disabling unencrypted services. Fourth, apply a management ACL to VTY lines restricting access to trusted subnets. Fifth, administratively shut down unused physical ports and place them into an unrouted VLAN.
The standard device hardening workflow initiates with credential remediation, followed by host key generation, SSH enforcement over VTY lines, network-level management ACL filtering, and physical port containment.

Step-by-Step Solution

1
Establish administrative identity controls.
Vendor default passwords are eliminated and encrypted local user credentials are created.
Prevents unauthorized access via default credentials prior to exposing management interfaces to the network.
2
Generate asymmetric encryption keys.
An RSA key pair is generated and stored on the device.
SSH protocol initialization depends directly on existing RSA/ECDSA host keys for session negotiation.
3
Enforce secure management plane protocols.
VTY lines accept only SSH connections, blocking unencrypted Telnet sessions.
Protects administrative session payloads and credentials from interception over the network.
4
Implement network-level management access boundaries.
An access control list is bound to VTY lines permitting only authorized management IP addresses.
Reduces exposure by rejecting connection requests originating outside designated administrative subnets.
5
Harden unused physical access points.
Inactive switch ports are placed in a shutdown state and assigned to an isolated non-routable VLAN.
Prevents unauthorized physical attachment and lateral movement within the infrastructure.

Key Concept

Device Hardening Execution Workflow for Secure Management and Control Planes
Estimated Time:1m 30s
Rate this question

Topics

Network Device Hardening Best Practices

More questions from this topic