Examkin

Soru

Zorluk: ZorNetwork Device Hardening Best Practices

A network security engineer is tasked with hardening the management plane of a newly installed enterprise edge router to ensure administrative traffic and network telemetry are fully protected against unauthorized access and packet inspection. Which set of configuration actions represents the best practice for hardening the device?

  1. Implement SNMPv3 with authPriv for encrypted telemetry, disable Telnet and HTTP daemons in favor of SSH and HTTPS, and reassign the native VLAN on 802.1Q trunks from VLAN 1 to an unused VLAN ID.Cevap
  2. B
    Configure SNMPv2c using a complex 32-character community string for read-only monitoring, restrict Telnet access to specific management IP addresses, and assign all unassigned ports to VLAN 1.
  3. C
    Enable Telnet bound strictly to TCP port 22 to secure administrative command-line sessions, disable HTTP in favor of HTTPS, and shut down all unused switch interfaces.
  4. D
    Deploy SNMPv3 with the noAuthNoPriv security level for system monitoring, retain VLAN 1 as the untagged native VLAN across trunk links to ensure management compatibility, and disable unused interfaces.

Cevap

Implement SNMPv3 with authPriv for encrypted telemetry, disable Telnet and HTTP daemons in favor of SSH and HTTPS, and reassign the native VLAN on 802.1Q trunks from VLAN 1 to an unused VLAN ID.
The correct configuration establishes a complete hardening baseline by encrypting management traffic (SSH and HTTPS), securing telemetry with strong authentication and payload encryption (SNMPv3 authPriv), and isolating trunking vulnerabilities by reassigning the untagged native VLAN away from default VLAN 1.

Adım Adım Çözüm

1
Analyze administrative transport protocol security
Identify plaintext daemons (Telnet, HTTP) and replace them with encrypted protocols (SSH, HTTPS).
Plaintext management protocols transmit credentials and session data unencrypted across the network.
2
Select the appropriate SNMP version and security mode
Configure SNMPv3 with the authPriv security level.
authPriv provides both HMAC-based authentication and symmetric encryption for SNMP telemetry payloads.
3
Review Layer 2 trunk baseline hardening requirements
Change the default 802.1Q native VLAN away from VLAN 1 to a dedicated, unused VLAN ID.
Using default VLAN 1 for untagged trunk traffic exposes the switch infrastructure to double-tagging (VLAN hopping) vectors.

Anahtar Kavram

Network Device Baseline Hardening
Bu soruyu puanla

Konular

Network Device Hardening Best Practices

Bu konudan daha fazla soru