Examkin

Question

Difficulty: MediumNetwork Device Hardening Best Practices

Following an infrastructure compliance audit, a network engineer must harden a Layer 2 access switch deployed in a branch office. The audit report identified two critical security findings: remote administration sessions transmit management credentials in cleartext, and unassigned physical switch ports remain active in the default VLAN. Which combination of hardening procedures should the engineer implement to remediate these specific vulnerabilities?

  1. Configure SSH for encrypted remote management, shut down all unassigned switch ports, and reassign those ports to an isolated blackhole VLAN.Answer
  2. B
    Configure Telnet over TCP port 22 for management sessions, and leave unassigned switch ports active in the native VLAN with dynamic port security enabled.
  3. C
    Configure SNMPv1 read-write community strings for encrypted device administration, and rely on default VLAN boundary controls for unused interfaces.
  4. D
    Configure HTTPS for web access while keeping unassigned ports active under the assumption that Layer 3 inter-VLAN routing will block unauthorized traffic.

Answer

The engineer should configure SSH to provide encrypted management traffic and shut down all unassigned switch ports while moving them into an isolated blackhole VLAN.
Baseline switch hardening requires securing both the management plane and data plane interface access. Replacing cleartext management protocols with SSH protects administrative credentials from network eavesdropping. Disabling unused physical ports and reassigning them to an isolated, non-routable blackhole VLAN ensures that unauthorized physical connections cannot gain network access or exploit default VLAN privileges.

Step-by-Step Solution

1
Identify secure management plane replacement protocols for cleartext session vulnerabilities.
SSH replaces Telnet/HTTP by enforcing symmetric and asymmetric encryption for administrative credential transmission and session data.
Cleartext protocols allow attackers on the local segment to sniff management passwords and session cookies.
2
Determine physical port security baseline hardening steps for unused interfaces.
Disable (shutdown) unassigned ports and assign them to a non-routed, unused VLAN (blackhole VLAN) separate from the native VLAN.
Unconfigured active ports in default VLANs allow rogue physical devices to gain immediate Layer 2 access to internal networks.

Key Concept

Network Device Hardening Best Practices
Estimated Time:1m 30s
Rate this question

Topics

Network Device Hardening Best Practices

More questions from this topic