A network administrator is performing baseline security hardening on a newly deployed Layer 2 switch in a corporate network environment. To secure the device against unauthorized physical connection and Layer 2 traffic interception, which TWO of the following switch hardening practices should the administrator implement?
- Assign all unused physical switch ports to an isolated blackhole VLAN and set their operational status to administratively shutdown.Cevap
- Reassign the native VLAN on all 802.1Q trunk links from default VLAN 1 to an unused VLAN ID.Cevap
- CConfigure VTY lines to accept Telnet connections on TCP port 22 to establish secure remote management sessions.
- DDeploy SNMPv2c using default community strings to ensure encrypted monitoring of switch health metrics.
- EMaintain default VLAN 1 as the native VLAN across all user access ports to simplify broadcast domain management.
Cevap
The correct hardening steps are placing unused switch ports into an unrouted blackhole VLAN while administratively shutting them down, and changing the 802.1Q native VLAN on trunk links from default VLAN 1 to a dedicated unused VLAN ID.
Device hardening mandates minimizing the physical and logical attack surface. Disabling unused ports and binding them to an unused blackhole VLAN prevents unauthorized devices from obtaining link status or accessing the network. Furthermore, modifying the 802.1Q native VLAN away from default VLAN 1 protects against Layer 2 frame injection and VLAN hopping attacks.
Adım Adım Çözüm
Anahtar Kavram
Layer 2 Infrastructure and Device Hardening Controls