Examkin

Question

Difficulty: MediumNetwork Device Hardening Best Practices

A network administrator is reviewing the management plane configuration of core campus switches during a security hardening initiative. The organization requires encrypted remote management and secure system monitoring. Which TWO configuration actions should the administrator implement to meet these hardening requirements?

  1. Migrate system monitoring from SNMPv2c to SNMPv3 using authPriv security modeAnswer
  2. Disable Telnet and enforce SSHv2 for all VTY remote access linesAnswer
  3. C
    Enable HTTP web management instead of HTTPS to reduce switch CPU cryptographic processing load
  4. D
    Use SNMPv1 with read-only community strings restricted by access control lists
  5. E
    Assign all unused access ports to the active native VLAN used by 802.1Q trunk links

Answer

The administrator should migrate system monitoring to SNMPv3 with authPriv security mode and disable Telnet in favor of SSHv2 on VTY access lines.
Device hardening guidelines require encrypting all administrative sessions and telemetry data. Enforcing SSHv2 secures remote command-line sessions, while deploying SNMPv3 using authPriv ensures both user authentication and payload encryption.

Step-by-Step Solution

1
Identify unencrypted management protocols running on network devices.
Telnet and older SNMP versions (SNMPv1/v2c) transmit credentials or monitoring data in clear text.
Hardening standards mandate replacing unencrypted protocols on the management plane.
2
Select secure protocol alternatives with cryptographic protection.
SSHv2 provides encrypted remote command-line access, and SNMPv3 authPriv supplies both authentication (HMAC) and privacy (encryption).
These protocols enforce confidentiality and integrity for device management.

Key Concept

Management Plane Hardening via Encrypted Protocols
Rate this question

Topics

Network Device Hardening Best Practices

More questions from this topic