CompTIA Network+ Network Security Hardening Questions and Answers 1 — Questions and Answers
Question 1: A network administrator is hardening a switch in a public-facing area. They want to ensure that only a specific, pre-approved laptop can connect to a particular Ethernet wall jack. If any other device is plugged in, the port should shut down immediately. Which switch feature should be configured to achieve this?
- VLAN tagging
- Port security (Correct answer)
- Spanning Tree Protocol (STP)
- DHCP snooping
Correct answer: Port security
Port security is a Layer 2 feature that allows an administrator to restrict a switch port's ingress traffic by limiting the MAC addresses allowed on the port. By configuring it to allow only one specific MAC address and setting the violation mode to 'shutdown', the port will be disabled if any unauthorized device connects. [13, 20]
Question 2: An organization's security policy prohibits the use of insecure remote management protocols. Which of the following protocols should be disabled on network devices and replaced with its secure counterpart?
- HTTPS
- SNMPv3
- Telnet (Correct answer)
- SSH
Correct answer: Telnet
Telnet is an insecure protocol because it transmits all data, including usernames and passwords, in clear text. This makes it vulnerable to eavesdropping. SSH (Secure Shell) is the secure counterpart that provides an encrypted channel for remote management. [29, 30, 35]
Question 3: Which of the following is a critical first step when deploying a new router or switch to harden it against unauthorized access?
- Enabling jumbo frames
- Configuring an ACL to block all traffic
- Changing the default administrative credentials (Correct answer)
- Setting the duplex to half
Correct answer: Changing the default administrative credentials
Default usernames and passwords for network devices are widely known and are a common vector for unauthorized access. Changing them immediately upon deployment is a fundamental security best practice to prevent trivial takeovers of the device. [11, 25, 27]
Question 4: A security auditor notes that all switch ports in a company are active, even those in unused offices, and that services like HTTP are enabled on the switch's management interface. Which hardening principle has been primarily violated?
- Reducing the attack surface (Correct answer)
- Defense in depth
- Implementing the principle of least privilege
- Enforcing role-based access control
Correct answer: Reducing the attack surface
The attack surface is the total number of points or vectors through which an attacker can try to enter a system. By leaving unused ports active and unnecessary services running, the administrator has created more potential entry points for an attacker, thus failing to reduce the attack surface. [1, 2, 7]
Question 5: To mitigate the risk of a rogue device on the network impersonating a legitimate DHCP server, which security feature should a network administrator implement on the switches?
- Dynamic ARP Inspection (DAI)
- DHCP Snooping (Correct answer)
- 802.1X Port-Based Authentication
- Control Plane Policing (CoPP)
Correct answer: DHCP Snooping
DHCP snooping is a Layer 2 security feature that validates DHCP messages. It distinguishes between trusted ports (connected to legitimate DHCP servers) and untrusted ports. It drops DHCP server messages (like DHCPOFFER) received on untrusted ports, effectively preventing rogue DHCP servers from assigning malicious IP configurations to clients. [4, 5, 6]
Question 6: A network administrator needs to prevent hosts from the Guest network (192.168.100.0/24) from accessing the company's internal file server at 10.10.50.15. The Guest network must still be able to access the internet. Where is the MOST effective place to apply an Access Control List (ACL) to achieve this goal?
- Outbound on the file server's network interface
- Outbound on the router interface connected to the internet
- Inbound on the switch ports connected to the guest hosts
- Inbound on the router interface connected to the Guest network (Correct answer)
Correct answer: Inbound on the router interface connected to the Guest network
The most efficient place to apply an ACL is as close to the source of the traffic as possible. By placing an ACL inbound on the router interface that serves as the gateway for the Guest network, the router can drop the unwanted traffic immediately. This prevents the traffic from being processed and routed across the network, which saves resources.
