Examkin

Question

Difficulty: MediumNetwork Device Hardening Best Practices

A network security engineer is configuring secure management plane controls on a newly installed distribution switch before introducing it to the enterprise network. In what sequence should the engineer execute the baseline hardening steps to properly establish and secure SSH administrative access?

  1. 1Configure an IP domain name and generate an RSA asymmetric key pair on the switch.
  2. 2Disable cleartext Telnet and restrict transport input on virtual terminal (VTY) lines to SSH only.
  3. 3Define a standard IPv4 access control list permitting management access exclusively from authorized administrator subnets.
  4. 4Apply the administrative access control list to the VTY line interfaces.

Answer

The correct sequence begins with setting the domain name and generating RSA keys, followed by enforcing SSH protocol transport on VTY lines, constructing an administrative access control list, and finally applying the access control list to the VTY lines.
Establishing secure administrative access requires generating cryptographic host keys as a prerequisite, restricting VTY protocols to SSH to prevent cleartext exposure, defining administrative IP filtering rules via an access control list, and lastly binding that list to the VTY interfaces.

Step-by-Step Solution

1
Initialize cryptographic host keys.
Domain name is configured and the RSA host key pair is created.
SSH protocol daemons require an RSA key pair for host identification and session encryption.
2
Enforce secure transport protocols.
VTY interfaces are set to accept only SSH connections.
Disabling insecure protocols like Telnet prevents cleartext credential interception over the network.
3
Construct management access filtering rules.
An access control list is created specifying permitted management source subnets.
Defines network layer boundaries specifying which administrative hosts are authorized to connect.
4
Bind filter rules to virtual terminal interfaces.
Access control list actively filters inbound connection attempts on VTY lines.
Enforces the defined IP address filtering policy on remote access sessions.

Key Concept

Secure Management Plane Baseline Hardening
Rate this question

Topics

Network Device Hardening Best Practices

More questions from this topic