Examkin

Soru

Zorluk: Çok zorNetwork Device Hardening Best Practices

A network administrator is conducting a post-audit baseline security hardening on an enterprise edge router. The audit report specifies three critical remediation goals: secure the administrative management plane, mitigate unauthorized VLAN hopping attacks across 802.1Q trunk links, and establish cryptographically secured remote device telemetry. Which of the following baseline configuration sets fully satisfies all three audit requirements?

  1. Configure SSHv2 on TCP port 22 while disabling Telnet, reassign the 802.1Q native VLAN to an unused non-default VLAN ID on trunk ports, and deploy SNMPv3 using the authPriv security level.Cevap
  2. B
    Configure SSHv2 on TCP port 23 while disabling Telnet, reassign the 802.1Q native VLAN to an unused non-default VLAN ID on trunk ports, and deploy SNMPv3 using the authPriv security level.
  3. C
    Configure SSHv2 on TCP port 22 while disabling Telnet, maintain VLAN 1 as the active native VLAN across all 802.1Q trunks, and deploy SNMPv3 using the authPriv security level.
  4. D
    Configure SSHv2 on TCP port 22 while disabling Telnet, reassign the 802.1Q native VLAN to an unused non-default VLAN ID on trunk ports, and deploy SNMPv2c using read-only community strings.

Cevap

The baseline configuration that configures SSHv2 on TCP port 22, reassigns the 802.1Q native VLAN to an unused non-default VLAN ID, and deploys SNMPv3 with authPriv.
The correct response combines essential device hardening practices: disabling unencrypted management protocols in favor of SSHv2 on TCP port 22, changing the 802.1Q trunk native VLAN from default VLAN 1 to an unused VLAN ID to mitigate VLAN hopping, and enforcing SNMPv3 with authPriv (authentication and privacy encryption) for secure telemetry.

Adım Adım Çözüm

1
Evaluate management plane remote administration security.
SSHv2 operating on standard TCP port 22 encrypts administrative control traffic, whereas Telnet and incorrect port mappings leave access exposed or misconfigured.
Telnet communicates in plaintext over TCP port 23, so migrating to SSHv2 over port 22 is essential for baseline management plane hardening.
2
Evaluate trunk interface configuration for VLAN security.
Reassigning the native VLAN from default VLAN 1 to a dedicated, unused VLAN ID isolates untagged frame processing.
Default VLAN 1 usage on 802.1Q trunks creates exploitation vectors for double-tagging and VLAN hopping.
3
Evaluate network telemetry protocol security.
SNMPv3 with authPriv provides cryptographic user authentication (HMAC-SHA/MD5) and data encryption (AES/DES).
SNMPv1 and SNMPv2c rely on cleartext community strings, which exposes device statistics and management data to interception.

Anahtar Kavram

Device Baseline Hardening: Management Plane Protocols, Native VLAN Isolation, and SNMPv3 Security
Bu soruyu puanla

Konular

Network Device Hardening Best Practices

Bu konudan daha fazla soru