350-701 · Question #715
A networking team must harden an organization's network from VLAN hopping attacks. The team disables Dynamic Trunking Protocol and puts any unused ports in an unused VLAN. A trunk port is used as a…
The correct answer is A. dedicated VLAN ID for all trunk ports. To further harden a network against VLAN hopping attacks after disabling DTP and isolating unused ports, a dedicated VLAN ID should be configured as the native VLAN for all trunk ports.
Question
A networking team must harden an organization's network from VLAN hopping attacks. The team disables Dynamic Trunking Protocol and puts any unused ports in an unused VLAN. A trunk port is used as a trunk link. What must the team configure next to harden the network against VLAN hopping attacks?
Options
- Adedicated VLAN ID for all trunk ports
- Bdisable STP on the network devices
- CDHCP snooping on all the switches
- Denable port-based network access control
How the community answered
(23 responses)- A83% (19)
- B4% (1)
- C4% (1)
- D9% (2)
Why each option
To further harden a network against VLAN hopping attacks after disabling DTP and isolating unused ports, a dedicated VLAN ID should be configured as the native VLAN for all trunk ports.
Configuring a dedicated, unused VLAN ID (not VLAN 1) as the native VLAN for all trunk ports prevents VLAN hopping attacks that exploit traffic on the default native VLAN. This isolates native VLAN traffic from user data and mitigates risks from attacks like switch spoofing or double tagging.
Disabling STP would remove a crucial loop prevention mechanism, potentially causing network outages, and does not directly prevent VLAN hopping.
DHCP snooping prevents rogue DHCP servers and IP spoofing, which is a different security concern than VLAN hopping.
Port-based network access control (e.g., 802.1X) authenticates devices connected to ports but does not specifically address the native VLAN vulnerability on trunk links.
Concept tested: VLAN hopping prevention (native VLAN)
Source: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3850/software/release/3se/security/configuration_guide/b_sec_3se_3850_cg/b_sec_3se_3850_cg_chapter_0100.html
Topics
Community Discussion
No community discussion yet for this question.