nerdexam
CompTIA

CS0-003 · Question #104

A cyber-security analyst is implementing a new network configuration on an existing network access layer to prevent possible physical attacks. Which of the following BEST describes a solution that wou

The correct answer is A. Implement port security with one MAC address per network port of the switch.. To prevent physical attacks at the network access layer with minimal deployment issues, the analyst should implement port security.

Submitted by amina.ke· Mar 6, 2026Security Operations

Question

A cyber-security analyst is implementing a new network configuration on an existing network access layer to prevent possible physical attacks. Which of the following BEST describes a solution that would apply and cause fewer issues during the deployment phase?

Options

  • AImplement port security with one MAC address per network port of the switch.
  • BDeploy network address protection with DHCP and dynamic VLANs.
  • CConfigure 802.1X and EAPOL across the network
  • DImplement software-defined networking and security groups for isolation

How the community answered

(35 responses)
  • A
    80% (28)
  • B
    6% (2)
  • C
    11% (4)
  • D
    3% (1)

Why each option

To prevent physical attacks at the network access layer with minimal deployment issues, the analyst should implement port security.

AImplement port security with one MAC address per network port of the switch.Correct

Implementing port security with one MAC address per network port effectively prevents unauthorized devices from gaining network access when connected to a legitimate port. This solution is relatively simple to deploy on existing switches, causing fewer issues compared to broader network authentication or architectural changes.

BDeploy network address protection with DHCP and dynamic VLANs.

Deploying Network Access Protection (NAP) with DHCP and dynamic VLANs involves significant configuration of servers, clients, and network infrastructure, likely causing more deployment issues.

CConfigure 802.1X and EAPOL across the network

Configuring 802.1X and EAPOL requires a RADIUS server, client supplicants, and extensive network configuration, making it a more complex deployment than simple port security.

DImplement software-defined networking and security groups for isolation

Implementing Software-Defined Networking (SDN) and security groups represents a major network architectural overhaul, which is far more complex and disruptive for an existing access layer than port security.

Concept tested: Network access control and physical security

Source: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750/software/release/12-2_44_se/configuration/guide/scg/swethsec.html

Topics

#Port security#MAC address filtering#Physical security#Network access control

Community Discussion

No community discussion yet for this question.

Full CS0-003 Practice