Examkin

Question

Difficulty: MediumNetwork Device Hardening Best Practices

A network administrator is performing a baseline security hardening audit on core enterprise switches. The security report reveals that idle administrative sessions on virtual terminal (VTY) lines remain active indefinitely when left unattended, and remote management traffic lacks centralized command authorization and traffic encryption. Which set of configuration controls should the administrator implement to best address these findings?

  1. Configure an exec-timeout on VTY lines, enforce SSH version 2, and integrate TACACS+ for centralized AAA authentication and command authorization.Answer
  2. B
    Migrate administrative sessions to use Telnet over port 23 and enable local privilege passwords without session timeouts.
  3. C
    Assign all VTY management interfaces directly to the untagged native VLAN across trunk links to isolate management sessions.
  4. D
    Place all virtual terminal lines into separate VLAN broadcast domains so that management traffic avoids Layer 3 routing requirements.

Answer

The administrator should configure an exec-timeout on VTY lines, enforce SSH version 2, and integrate TACACS+ for centralized AAA authentication and command authorization.
Hardening the management plane of network devices requires restricting session lifespans, encrypting management traffic in transit, and centralizing access control. Configuring an exec-timeout ensures that idle VTY sessions automatically close, preventing unauthorized local access to abandoned terminals. Utilizing SSH version 2 replaces insecure cleartext protocols such as Telnet. Incorporating TACACS+ provides centralized authentication, authorization, and accounting, ensuring every administrative command is explicitly authorized and audited.

Step-by-Step Solution

1
Identify session timeout requirements for virtual terminal lines.
Configuring an exec-timeout forces inactive management connections to terminate automatically after a specified period of inactivity.
This mitigates risks associated with unattended terminal sessions.
2
Select a secure, encrypted management protocol.
Enforcing SSH v2 disables insecure legacy protocols like Telnet and encrypts all session content including credentials.
Cleartext transmission of administrative credentials over the network must be prevented.
3
Implement centralized AAA for command accounting and authorization.
Integrating TACACS+ allows granular control over which commands individual administrators can execute, alongside centralized auditing.
TACACS+ decouples authentication, authorization, and accounting, encrypting the full payload of access control packets.

Key Concept

Management Plane Hardening and Secure Remote Access
Rate this question

Topics

Network Device Hardening Best Practices

More questions from this topic