Examkin

Question

Difficulty: MediumNetwork Device Hardening Best Practices

A security engineer is updating the baseline configuration of a remote branch router to comply with corporate security standards. The compliance mandate specifies two primary controls: preventing automated device discovery announcements from leaking network topology details to untrusted segments, and securing interactive management sessions against cleartext eavesdropping. Which set of configuration actions directly fulfills these security requirements?

  1. Disable CDP/LLDP on untrusted interfaces and restrict VTY lines to SSH transport.Answer
  2. B
    Enable Telnet over TCP port 22 and rely on TACACS+ to encrypt the management payload.
  3. C
    Deploy SNMPv2c configured with the authPriv security level for centralized monitoring.
  4. D
    Assign all unassigned router interfaces to the active 802.1Q trunk native VLAN.

Answer

Disabling CDP/LLDP on untrusted interfaces and restricting VTY lines to SSH transport directly addresses both device hardening requirements.
Hardening best practices require disabling unencrypted discovery mechanisms (CDP/LLDP) on public or untrusted interfaces to minimize intelligence leakage. Simultaneously, remote terminal management must enforce secure, encrypted channels using SSH instead of cleartext protocols like Telnet.

Step-by-Step Solution

1
Identify the protocol responsible for network topology discovery announcements.
CDP and LLDP broadcast device capabilities, system names, and IP addresses periodically.
Disabling CDP/LLDP on untrusted interfaces prevents unauthorized network reconnaissance.
2
Select the secure protocol for interactive remote management.
SSH encrypts session traffic over TCP port 22, whereas Telnet transmits data in cleartext.
Restricting virtual terminal (VTY) lines to accept SSH ensures encrypted management plane communication.

Key Concept

Management plane hardening via discovery protocol suppression and secure protocol enforcement
Rate this question

Topics

Network Device Hardening Best Practices

More questions from this topic