Examkin

Question

Difficulty: MediumNetwork Device Hardening Best Practices

A network technician is configuring an out-of-the-box managed network switch to establish a secure management baseline prior to production deployment. Arrange the implementation steps in the correct chronological order from first to last to properly configure hardened remote access.

  1. 1Change default administrative credentials and create unique local administrator accounts.
  2. 2Generate cryptographic asymmetric host keys (RSA/ECDSA) on the switch.
  3. 3Configure VTY line transport to enforce SSH exclusively and disable unencrypted protocols like Telnet.
  4. 4Apply an Access Control List (ACL) to the VTY lines restricting management access to designated subnets.
  5. 5Configure aggressive session exec-timeouts and unauthorized access login banners on administrative lines.

Answer

The correct operational sequence is: 1) Change default administrative credentials, 2) Generate cryptographic asymmetric host keys, 3) Configure VTY line transport to enforce SSH exclusively, 4) Apply an Access Control List (ACL) to the VTY lines, 5) Configure aggressive session exec-timeouts and unauthorized access login banners.
Establishing a hardened management baseline requires a logical, sequential workflow: credentials must first be secured to remove vendor defaults. Next, asymmetric host keys must be generated because SSH cannot operate without active encryption keys. Once keys exist, VTY transport can be set exclusively to SSH while disabling Telnet. VTY Access Control Lists (ACLs) are then applied to restrict remote connections to authorized management subnets, and finally, operational controls such as idle session exec-timeouts and login banners are configured to prevent unattended session hijacking.

Step-by-Step Solution

1
Eliminate administrative default credentials.
Default passwords are replaced with secure, unique administrator accounts.
Default credentials present the immediate primary vector of exposure on factory-reset hardware.
2
Generate device asymmetric key pairs.
An RSA/ECDSA key pair is stored in device flash memory.
Secure Shell (SSH) cannot run or accept connections until local host encryption keys exist.
3
Enforce secure management protocols on virtual terminal (VTY) lines.
Telnet and HTTP transport are blocked; SSH is required.
Enforcing SSH prevents plaintext transmission of management data across the network.
4
Restrict VTY line access using an IPv4/IPv6 ACL.
Only management workstation subnets can initiate VTY connections.
Network-level access control filters reduce exposure by dropping unauthorized connection attempts at the VTY interface.
5
Apply operational safety controls (exec-timeout and security banners).
Inactive sessions terminate automatically and access policies are displayed prior to authentication.
Session timeouts prevent hijacking of unattended administrative terminals, completing the baseline workflow.

Key Concept

Device Management Plane Baseline Hardening Workflow
Rate this question

Topics

Network Device Hardening Best Practices

More questions from this topic