SY0-301 · Question #624
Which of the following is a best practice when securing a switch from physical access?
The correct answer is D. Disable unused ports. Disabling unused physical switch ports prevents unauthorized devices from plugging in and gaining network access when an attacker has physical proximity to the switch.
Question
Which of the following is a best practice when securing a switch from physical access?
Options
- ADisable unnecessary accounts
- BPrint baseline configuration
- CEnable access lists
- DDisable unused ports
How the community answered
(26 responses)- B4% (1)
- C8% (2)
- D88% (23)
Why each option
Disabling unused physical switch ports prevents unauthorized devices from plugging in and gaining network access when an attacker has physical proximity to the switch.
Disabling unnecessary accounts is a logical access control that addresses credential-based attacks, not physical port access.
Printing a baseline configuration is a documentation and recovery practice and provides no protection against physical access.
Enabling access lists is a logical network control and does not prevent someone from physically connecting a device to an active port.
Unused switch ports that remain enabled are open network entry points for anyone with physical access to the wiring closet or patch panel. Administratively shutting down every port that has no legitimate device connected eliminates this attack surface without affecting normal network operations.
Concept tested: Switch hardening by disabling unused physical ports
Source: https://www.cisco.com/c/en/us/support/docs/lan-switching/8021x/212688-8021x-port-security-configuration-exampl.html
Topics
Community Discussion
No community discussion yet for this question.