Examkin

Soru

Zorluk: OrtaNetwork Device Hardening Best Practices

A network administrator is performing baseline security hardening on a newly installed Layer 3 switch before introducing it to the production network. Place the administrative hardening tasks into the correct sequential order from first step to last step.

  1. 1Configure local administrative accounts with encrypted credentials and set an enable secret password.
  2. 2Generate asymmetric RSA key pairs and enable SSH version 2 for encrypted remote administration.
  3. 3Implement centralized AAA authentication referencing external TACACS+ servers with local account fallback.
  4. 4Apply an inbound Access Control List (ACL) to virtual terminal (VTY) lines to restrict access to authorized management subnets.
  5. 5Disable legacy unencrypted protocols (Telnet/HTTP) and administratively shut down all unused physical switch ports.

Cevap

The correct administrative sequence begins with setting encrypted local credentials, generating RSA keys to enable SSH v2, configuring centralized TACACS+ AAA authentication with local fallback, restricting VTY line access to authorized management subnets using an ACL, and finally deactivating unencrypted services and unused ports.
Device hardening follows an orderly sequence: securing local fallback access, enabling encrypted management transport, binding centralized AAA authentication, restricting management source IPs via ACLs, and closing legacy protocols/unused ports to minimize exposure.

Adım Adım Çözüm

1
Set up encrypted local admin accounts and enable secret.
Initial local access is secured against lockout during remote AAA or network transport changes.
Administrative control must be established locally before modifying network management transport protocols.
2
Generate RSA keys and enable SSH v2.
The switch generates public/private key pairs necessary for encrypted remote terminal sessions.
Secure remote shell access requires cryptographic key material to encrypt session data.
3
Configure AAA authentication using TACACS+ with local fallback.
Centralized identity control and session logging are bound to management login attempts.
Enterprise policy mandates centralized authentication while retaining local credentials as a fallback mechanism.
4
Attach restrictive ACLs to VTY lines.
Network management connections are limited strictly to designated administrative IP subnets.
Restricting source IP addresses prevents unauthorized internal network devices from probing management ports.
5
Disable Telnet/HTTP and administratively shut down unused ports.
Plaintext management daemons are closed, and unused physical ports are assigned to an inactive state.
Deactivating unnecessary protocols and ports removes vulnerabilities and physical intrusion vectors as a final surface reduction measure.

Anahtar Kavram

Management Plane Hardening Lifecycle
Bu soruyu puanla

Konular

Network Device Hardening Best Practices

Bu konudan daha fazla soru