Examkin

Question

Difficulty: MediumMitigation Strategies and Enterprise Hardening Practices

An enterprise security team is implementing enterprise hardening practices for out-of-band management interfaces on network switches to reduce the risk of unauthorized lateral movement. Which TWO of the following technical controls should the team implement? (Select TWO.)

  1. Isolate all switch management traffic to a dedicated out-of-band network segment and enforce 802.1X port-based access control.Answer
  2. Disable unencrypted management protocols such as Telnet and HTTP in favor of SSHv2 and HTTPS.Answer
  3. C
    Deploy deception honeypots directly inline on management VLANs to automatically block unauthorized TCP connection attempts.
  4. D
    Rely on perimeter edge firewalls to filter external traffic while allowing unrestricted internal subnet routing to management interfaces.

Answer

The correct controls are isolating management traffic to a dedicated out-of-band network segment with 802.1X access control, and disabling unencrypted management protocols such as Telnet and HTTP in favor of SSHv2 and HTTPS.
Hardening network management interfaces requires both physical/logical network isolation and transport security. Segregating management interfaces into a dedicated out-of-band network with port authentication prevents unauthorized internal hosts from communicating with switch consoles. Simultaneously, replacing unencrypted administrative protocols (Telnet/HTTP) with encrypted protocols (SSHv2/HTTPS) secures administrative credentials and sessions from eavesdropping.

Step-by-Step Solution

1
Analyze network management interface exposure and hardening objectives.
Identified the need for secure management access that mitigates lateral movement and prevents unauthorized access or credential sniffing.
Management interfaces are primary targets for adversaries attempting network wide privilege escalation.
2
Evaluate network isolation and access control mechanisms.
Dedicated out-of-band network segments combined with 802.1X access control restrict management access strictly to authorized administrators and endpoints.
Segmenting management interfaces prevents unauthorized hosts on the general corporate network from reaching administrative interfaces.
3
Evaluate protocol security requirements.
Replacing cleartext protocols (Telnet, HTTP) with encrypted alternatives (SSHv2, HTTPS) protects management sessions against packet sniffing.
Unencrypted protocols transmit administrative credentials in plain text across network links.

Key Concept

Out-of-Band Management Hardening and Protocol Security
Rate this question

Topics

Mitigation Strategies and Enterprise Hardening Practices

More questions from this topic