CompTIA Network+ Network Security Hardening Questions and Answers

Question 1

A network administrator is hardening a switch in a public-facing area. They want to ensure that only a specific, pre-approved laptop can connect to a particular Ethernet wall jack. If any other device is plugged in, the port should shut down immediately. Which switch feature should be configured to achieve this?

Accepted Answer

Port security

Answer

Port security is a Layer 2 feature that allows an administrator to restrict a switch port's ingress traffic by limiting the MAC addresses allowed on the port. By configuring it to allow only one specific MAC address and setting the violation mode to 'shutdown', the port will be disabled if any unauthorized device connects. [13, 20]

Question 2

An organization's security policy prohibits the use of insecure remote management protocols. Which of the following protocols should be disabled on network devices and replaced with its secure counterpart?

Accepted Answer

Telnet

Answer

Telnet is an insecure protocol because it transmits all data, including usernames and passwords, in clear text. This makes it vulnerable to eavesdropping. SSH (Secure Shell) is the secure counterpart that provides an encrypted channel for remote management. [29, 30, 35]

Question 3

Which of the following is a critical first step when deploying a new router or switch to harden it against unauthorized access?

Accepted Answer

Changing the default administrative credentials

Answer

Default usernames and passwords for network devices are widely known and are a common vector for unauthorized access. Changing them immediately upon deployment is a fundamental security best practice to prevent trivial takeovers of the device. [11, 25, 27]

Question 4

A security auditor notes that all switch ports in a company are active, even those in unused offices, and that services like HTTP are enabled on the switch's management interface. Which hardening principle has been primarily violated?

Accepted Answer

Reducing the attack surface

Answer

The attack surface is the total number of points or vectors through which an attacker can try to enter a system. By leaving unused ports active and unnecessary services running, the administrator has created more potential entry points for an attacker, thus failing to reduce the attack surface. [1, 2, 7]

Question 5

To mitigate the risk of a rogue device on the network impersonating a legitimate DHCP server, which security feature should a network administrator implement on the switches?

Accepted Answer

DHCP Snooping

Answer

DHCP snooping is a Layer 2 security feature that validates DHCP messages. It distinguishes between trusted ports (connected to legitimate DHCP servers) and untrusted ports. It drops DHCP server messages (like DHCPOFFER) received on untrusted ports, effectively preventing rogue DHCP servers from assigning malicious IP configurations to clients. [4, 5, 6]

CompTIA Practice Test

CompTIA Practice Test

CompTIA Network+ Network Security Hardening Questions and Answers