Soru

Zorluk: Çok zorNetwork Device Hardening Best Practices

A principal network security architect is evaluating the control and management plane hardening profile for a cluster of core Layer 3 switches deployed in a zero-trust enterprise architecture. To comprehensively secure management communications against eavesdropping and protect inter-switch trunk connections from unauthorized traffic manipulation and VLAN exploitation, which of the following configuration practices must be implemented? (Select TWO.)

  1. Enforce SNMPv3 using the authPriv security level configured with SHA-based authentication and AES payload encryption, paired with restrictive infrastructure management ACLs.Cevap
  2. B
    Deploy SNMPv2c using randomized community strings while depending on edge firewall rules to block UDP port 161 traffic at the perimeter.
  3. Reassign the 802.1Q native VLAN on all inter-switch trunk links from default VLAN 1 to an unused, dedicated non-default VLAN ID that carries no user or management traffic.Cevap
  4. D
    Retain default VLAN 1 as the native VLAN across all trunks while disabling 802.1Q tagging on management interfaces to lower control-plane CPU overhead.
  5. E
    Enable Telnet on TCP port 23 alongside SSH on TCP port 22 to serve as an unencrypted secondary fallback access method during public-key authentication failures.

Cevap

The validated hardening controls require enforcing SNMPv3 with authPriv (SHA/AES) protected by access control lists, and reassigning the 802.1Q native VLAN on trunk ports away from default VLAN 1 to a dedicated, unused non-default VLAN.
Hardening switch infrastructure requires securing both management access protocols and Layer 2 trunking behaviors. Utilizing SNMPv3 at the authPriv security level ensures SHA authentication hashing and AES symmetric encryption for management communications. Simultaneously, reassigning the 802.1Q native VLAN from default VLAN 1 to an isolated, unused VLAN ID stops un-tagged frame leakage and mitigates VLAN hopping attacks.

Adım Adım Çözüm

1
Analyze management plane security requirements
Identified that cleartext management protocols (SNMPv2c, Telnet) expose credentials and monitoring data to eavesdropping.
SNMPv3 with authPriv is the only SNMP standard providing full cryptographic integrity, authentication, and payload confidentiality.
2
Analyze Layer 2 infrastructure security requirements
Identified that default native VLAN 1 on 802.1Q trunks enables attack vectors like VLAN hopping and double-tagging.
Configuring an unused non-default VLAN as native neutralizes un-tagged frame injection and VLAN hopping vulnerabilities.
3
Validate complete baseline solution
Selected the combination of encrypted SNMPv3 authPriv management and non-default native VLAN trunk isolation.
Both measures directly harden the control/management plane against active and passive network threats.

Anahtar Kavram

Management Plane Hardening & Trunk Isolation
Bu soruyu puanla