A principal network security architect is evaluating the control and management plane hardening profile for a cluster of core Layer 3 switches deployed in a zero-trust enterprise architecture. To comprehensively secure management communications against eavesdropping and protect inter-switch trunk connections from unauthorized traffic manipulation and VLAN exploitation, which of the following configuration practices must be implemented? (Select TWO.)
- Enforce SNMPv3 using the authPriv security level configured with SHA-based authentication and AES payload encryption, paired with restrictive infrastructure management ACLs.Cevap
- BDeploy SNMPv2c using randomized community strings while depending on edge firewall rules to block UDP port 161 traffic at the perimeter.
- Reassign the 802.1Q native VLAN on all inter-switch trunk links from default VLAN 1 to an unused, dedicated non-default VLAN ID that carries no user or management traffic.Cevap
- DRetain default VLAN 1 as the native VLAN across all trunks while disabling 802.1Q tagging on management interfaces to lower control-plane CPU overhead.
- EEnable Telnet on TCP port 23 alongside SSH on TCP port 22 to serve as an unencrypted secondary fallback access method during public-key authentication failures.
Cevap
The validated hardening controls require enforcing SNMPv3 with authPriv (SHA/AES) protected by access control lists, and reassigning the 802.1Q native VLAN on trunk ports away from default VLAN 1 to a dedicated, unused non-default VLAN.
Hardening switch infrastructure requires securing both management access protocols and Layer 2 trunking behaviors. Utilizing SNMPv3 at the authPriv security level ensures SHA authentication hashing and AES symmetric encryption for management communications. Simultaneously, reassigning the 802.1Q native VLAN from default VLAN 1 to an isolated, unused VLAN ID stops un-tagged frame leakage and mitigates VLAN hopping attacks.
Adım Adım Çözüm
Anahtar Kavram
Management Plane Hardening & Trunk Isolation