Examkin

Question

Difficulty: MediumNetwork Device Hardening Best Practices

A network administrator is performing baseline security hardening on a newly installed Layer 3 switch before introducing it to the production network. Place the administrative hardening tasks into the correct sequential order from first step to last step.

  1. 1Configure local administrative accounts with encrypted credentials and set an enable secret password.
  2. 2Generate asymmetric RSA key pairs and enable SSH version 2 for encrypted remote administration.
  3. 3Implement centralized AAA authentication referencing external TACACS+ servers with local account fallback.
  4. 4Apply an inbound Access Control List (ACL) to virtual terminal (VTY) lines to restrict access to authorized management subnets.
  5. 5Disable legacy unencrypted protocols (Telnet/HTTP) and administratively shut down all unused physical switch ports.

Answer

The correct administrative sequence begins with setting encrypted local credentials, generating RSA keys to enable SSH v2, configuring centralized TACACS+ AAA authentication with local fallback, restricting VTY line access to authorized management subnets using an ACL, and finally deactivating unencrypted services and unused ports.
Device hardening follows an orderly sequence: securing local fallback access, enabling encrypted management transport, binding centralized AAA authentication, restricting management source IPs via ACLs, and closing legacy protocols/unused ports to minimize exposure.

Step-by-Step Solution

1
Set up encrypted local admin accounts and enable secret.
Initial local access is secured against lockout during remote AAA or network transport changes.
Administrative control must be established locally before modifying network management transport protocols.
2
Generate RSA keys and enable SSH v2.
The switch generates public/private key pairs necessary for encrypted remote terminal sessions.
Secure remote shell access requires cryptographic key material to encrypt session data.
3
Configure AAA authentication using TACACS+ with local fallback.
Centralized identity control and session logging are bound to management login attempts.
Enterprise policy mandates centralized authentication while retaining local credentials as a fallback mechanism.
4
Attach restrictive ACLs to VTY lines.
Network management connections are limited strictly to designated administrative IP subnets.
Restricting source IP addresses prevents unauthorized internal network devices from probing management ports.
5
Disable Telnet/HTTP and administratively shut down unused ports.
Plaintext management daemons are closed, and unused physical ports are assigned to an inactive state.
Deactivating unnecessary protocols and ports removes vulnerabilities and physical intrusion vectors as a final surface reduction measure.

Key Concept

Management Plane Hardening Lifecycle
Rate this question

Topics

Network Device Hardening Best Practices

More questions from this topic