CompTIA Network+ Network+ Network Security Hardening 3 — Questions and Answers
Question 1: Which type of ACL is applied closest to the traffic source to block unwanted packets as early as possible?
- Extended ACL applied outbound at the destination
- Standard ACL applied inbound at the source
- Extended ACL applied inbound at the source (Correct answer)
- Standard ACL applied outbound at the destination
Correct answer: Extended ACL applied inbound at the source
Extended ACLs match both source and destination so they are most efficient when applied inbound at the source router interface.
Question 2: A security engineer wants to detect and block rogue DHCP servers on a network. Which switch feature accomplishes this?
- Dynamic ARP Inspection
- DHCP snooping (Correct answer)
- IP Source Guard
- Port security
Correct answer: DHCP snooping
DHCP snooping marks ports as trusted or untrusted; DHCP offers from untrusted ports are dropped, preventing rogue servers.
Question 3: Which hardening action should be taken for unused switch ports to prevent unauthorized device connections?
- Set them to VLAN 1 and enable spanning tree
- Shut them down and assign them to an unused VLAN (Correct answer)
- Enable DHCP snooping only on those ports
- Configure them as trunk ports
Correct answer: Shut them down and assign them to an unused VLAN
Administratively shutting down unused ports and moving them to an isolated VLAN prevents any unauthorized device from gaining network access.
Question 4: A network team deploys a host-based firewall on every server in the data center. This is an example of which security principle?
- Single point of failure elimination
- Defense in depth (Correct answer)
- Zero-trust perimeter only
- Least functionality
Correct answer: Defense in depth
Defense in depth uses multiple overlapping security layers (perimeter firewall plus host firewall) so that bypassing one layer doesn't grant full access.
Question 5: What is the function of IP Source Guard on a switch port?
- Encrypts traffic between switch and router
- Prevents ARP spoofing by validating ARP replies
- Filters packets so only traffic matching the DHCP snooping binding table is forwarded (Correct answer)
- Limits the number of MAC addresses on a port
Correct answer: Filters packets so only traffic matching the DHCP snooping binding table is forwarded
IP Source Guard uses the DHCP snooping binding table to drop packets whose source IP or MAC doesn't match the recorded lease, stopping IP spoofing.
Question 6: Which management plane hardening measure limits which hosts can connect to a router's SSH service?
- Enabling SSH version 2
- Configuring an ACL referenced by the VTY lines (Correct answer)
- Setting an enable secret password
- Disabling the HTTP management interface
Correct answer: Configuring an ACL referenced by the VTY lines
An access-class ACL applied to VTY lines restricts SSH access to only specified management IP addresses.
Question 7: A company wants to ensure that a network device's operating system has not been tampered with during boot. Which feature provides this assurance?
- BIOS password
- Secure Boot / image signing verification (Correct answer)
- SNMP v3 encryption
- NTP authentication
Correct answer: Secure Boot / image signing verification
Secure Boot and cryptographic image signing verify that the firmware/OS binary matches a trusted hash before execution.
CompTIA Network+ Network+ Network Security Hardening 3
Which type of ACL is applied closest to the traffic source to block unwanted packets as early as possible?