CompTIA Network+ Network+ Network Security Hardening 2

Question 1

A network administrator wants to prevent VLAN hopping attacks. Which action is the MOST effective countermeasure?

Accepted Answer

Disable DTP and set all unused ports to a non-default VLAN

Answer

Disabling DTP prevents dynamic trunk negotiation, and assigning unused ports to an isolated VLAN stops double-tagging VLAN hopping attacks.

Question 2

Which hardening technique involves replacing default credentials on network devices immediately after deployment?

Accepted Answer

Default credential remediation

Answer

Default credential remediation means changing manufacturer-set usernames and passwords before a device goes into production.

Question 3

An administrator enables 802.1X port-based authentication on all switch access ports. What does this primarily enforce?

Accepted Answer

Network access control requiring authentication before connectivity

Answer

802.1X requires endpoints to authenticate (typically via RADIUS) before the switch port transitions from an unauthorized to an authorized state.

Question 4

Which protocol should replace Telnet for remote router management to ensure confidentiality?

Accepted Answer

SSH

Answer

SSH encrypts the management session, whereas Telnet transmits all data including passwords in plaintext.

Question 5

A firewall rule base should follow which principle to reduce attack surface?

Accepted Answer

Implicit deny with explicit permits only for required traffic

Answer

Implicit deny (deny-all by default) ensures only explicitly approved traffic flows, minimizing exposure to unintended access.

CompTIA Practice Test