Examkin

Question

Difficulty: MediumNetwork Device Hardening Best Practices

During a post-incident audit at a branch office, a security analyst discovers that an unauthorized device successfully connected to the internal network by plugging into an unassigned Ethernet wall port. Further inspection reveals that all unassigned switchports remain administrative enabled in their default state on VLAN 1. Which of the following actions represents the best practice to harden these unassigned ports against unauthorized physical network access?

  1. Administratively shut down all unused interfaces and reassign them to an unroutable blackhole VLAN.Answer
  2. B
    Reassign the native VLAN on all trunk links back to VLAN 1 to isolate untagged frame traffic from access interfaces.
  3. C
    Apply an access control list to VLAN 1 containing permit rules for known internal host IP addresses.
  4. D
    Enable Telnet management on port 22 across the unused interfaces to capture unauthorized login attempts.

Answer

Administratively shut down all unused interfaces and reassign them to an unroutable blackhole VLAN.
The standard device hardening procedure for securing unused physical switch ports requires administratively disabling the interfaces (shutdown command) and moving them out of the default VLAN 1 into an unused, unroutable VLAN (often called a dummy or blackhole VLAN). This double layer of security prevents unauthorized devices from obtaining an IP address or communicating on the internal network.

Step-by-Step Solution

1
Identify vulnerabilities on unassigned access ports
Unused interfaces left in an active state on default VLAN 1 allow immediate Layer 2 access to any plugged-in device.
Default configurations on enterprise switches leave ports in an active state assigned to VLAN 1 unless explicitly hardened.
2
Apply interface state hardening
Disabling unused interfaces (shutdown) prevents physical link establishment.
Administratively shutting down inactive ports stops network traffic negotiation at Layer 1 and Layer 2.
3
Isolate port assignment to a blackhole VLAN
Assigning unused interfaces to an isolated VLAN with no Layer 3 routing interface ensures zero network access even if a port is accidentally re-enabled.
Segregating unused ports from active management and production VLANs ensures defense-in-depth.

Key Concept

Switch Port Security & Baseline Interface Hardening
Estimated Time:1m 15s
Rate this question

Topics

Network Device Hardening Best Practices

More questions from this topic