CS0-003 · Question #104
A cyber-security analyst is implementing a new network configuration on an existing network access layer to prevent possible physical attacks. Which of the following BEST describes a solution that wou
The correct answer is A. Implement port security with one MAC address per network port of the switch.. To prevent physical attacks at the network access layer with minimal deployment issues, the analyst should implement port security.
Question
A cyber-security analyst is implementing a new network configuration on an existing network access layer to prevent possible physical attacks. Which of the following BEST describes a solution that would apply and cause fewer issues during the deployment phase?
Options
- AImplement port security with one MAC address per network port of the switch.
- BDeploy network address protection with DHCP and dynamic VLANs.
- CConfigure 802.1X and EAPOL across the network
- DImplement software-defined networking and security groups for isolation
How the community answered
(35 responses)- A80% (28)
- B6% (2)
- C11% (4)
- D3% (1)
Why each option
To prevent physical attacks at the network access layer with minimal deployment issues, the analyst should implement port security.
Implementing port security with one MAC address per network port effectively prevents unauthorized devices from gaining network access when connected to a legitimate port. This solution is relatively simple to deploy on existing switches, causing fewer issues compared to broader network authentication or architectural changes.
Deploying Network Access Protection (NAP) with DHCP and dynamic VLANs involves significant configuration of servers, clients, and network infrastructure, likely causing more deployment issues.
Configuring 802.1X and EAPOL requires a RADIUS server, client supplicants, and extensive network configuration, making it a more complex deployment than simple port security.
Implementing Software-Defined Networking (SDN) and security groups represents a major network architectural overhaul, which is far more complex and disruptive for an existing access layer than port security.
Concept tested: Network access control and physical security
Source: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750/software/release/12-2_44_se/configuration/guide/scg/swethsec.html
Topics
Community Discussion
No community discussion yet for this question.