CAS-002 · Question #183
The security administrator is responsible for the confidentiality of all corporate data. The company's servers are located in a datacenter run by a different vendor. The vendor datacenter hosts…
The correct answer is A. Apply port security to all switches, switch to SCP, and implement IPSec tunnels between. Port security on switches, SCP for file transfers, and IPSec tunnels together counter physical-access-enabled network attacks by restricting device connectivity, encrypting transfers, and protecting data in transit.
Question
The security administrator is responsible for the confidentiality of all corporate data. The company's servers are located in a datacenter run by a different vendor. The vendor datacenter hosts servers for many different clients, all of whom have access to the datacenter. None of the racks are physically secured. Recently, the company has been the victim of several attacks involving data injection and exfiltatration. The security administrator suspects these attacks are due to several new network based attacks facilitated by having physical access to a system. Which of the following BEST describes how to adapt to the threat?
Options
- AApply port security to all switches, switch to SCP, and implement IPSec tunnels between
- BApply two factor authentication, require point to point VPNs, and enable log auditing on all
- CApply port security to all routers, switch to telnet, and implement point to point VPNs on all
- DApply three factor authentication, implement IPSec, and enable SNMP.
How the community answered
(24 responses)- A46% (11)
- B17% (4)
- C29% (7)
- D8% (2)
Why each option
Port security on switches, SCP for file transfers, and IPSec tunnels together counter physical-access-enabled network attacks by restricting device connectivity, encrypting transfers, and protecting data in transit.
Port security applied to switches restricts which MAC addresses can communicate on each port, directly preventing an attacker with physical access from plugging in a rogue device to intercept or inject traffic. SCP replaces insecure file transfer protocols with encrypted alternatives, and IPSec tunnel mode encrypts all traffic between endpoints to prevent exfiltration even if the physical medium is compromised.
Two-factor authentication and VPNs improve access control but do not address switch-level port security, which is the primary control needed when an attacker has physical network access.
Port security belongs on switches not routers for this threat model, and switching to telnet introduces cleartext credential exposure making security worse rather than better.
Three-factor authentication and SNMP do not address the physical network access vector or the data injection and exfiltration threat described; SNMP can itself be an attack surface if not properly secured.
Concept tested: Physical network access security with port security and IPSec
Source: https://csrc.nist.gov/publications/detail/sp/800-77/rev-1/final
Topics
Community Discussion
No community discussion yet for this question.