CompTIA Network+ Network+ Network Security Hardening 2

Question 1

A network administrator wants to prevent VLAN hopping attacks. Which action is the MOST effective countermeasure?

Accepted Answer

Disable DTP and set all unused ports to a non-default VLAN

Answer

Enable spanning tree on all switches

Answer

Configure DHCP snooping on all VLANs

Answer

Apply ACLs to the native VLAN

Question 2

Which hardening technique involves replacing default credentials on network devices immediately after deployment?

Accepted Answer

Default credential remediation

Answer

Patch management

Answer

Credential rotation

Answer

Role-based access control

Question 3

An administrator enables 802.1X port-based authentication on all switch access ports. What does this primarily enforce?

Accepted Answer

Network access control requiring authentication before connectivity

Answer

Encryption of all LAN traffic

Answer

MAC address filtering only

Answer

VLAN segmentation by department

Question 4

Which protocol should replace Telnet for remote router management to ensure confidentiality?

Accepted Answer

SSH

Answer

SNMP v2c

Answer

HTTP

Answer

RDP

Question 5

A firewall rule base should follow which principle to reduce attack surface?

Accepted Answer

Implicit deny with explicit permits only for required traffic

Answer

Permit all, deny exceptions

Answer

Deny inbound only, permit all outbound

Answer

Permit based on source IP alone

Question 6

What is the purpose of network segmentation using DMZ architecture?

Accepted Answer

To isolate publicly accessible servers from the internal trusted network

Answer

To increase internal LAN throughput

Answer

To replace the need for a firewall

Answer

To assign DHCP addresses to guest users

Question 7

An administrator configures a switch to send only SNMPv3 traps with authentication and encryption. Which two SNMPv3 features provide this?

Accepted Answer

authPriv mode using MD5/SHA and DES/AES

Answer

Community strings and ACLs

Answer

authNoPriv and noAuthNoPriv

Answer

SNMP polling and read-only community