CompTIA Network+ Network+ Network Security Hardening 2 — Questions and Answers
Question 1: A network administrator wants to prevent VLAN hopping attacks. Which action is the MOST effective countermeasure?
- Disable DTP and set all unused ports to a non-default VLAN (Correct answer)
- Enable spanning tree on all switches
- Configure DHCP snooping on all VLANs
- Apply ACLs to the native VLAN
Correct answer: Disable DTP and set all unused ports to a non-default VLAN
Disabling DTP prevents dynamic trunk negotiation, and assigning unused ports to an isolated VLAN stops double-tagging VLAN hopping attacks.
Question 2: Which hardening technique involves replacing default credentials on network devices immediately after deployment?
- Patch management
- Credential rotation
- Default credential remediation (Correct answer)
- Role-based access control
Correct answer: Default credential remediation
Default credential remediation means changing manufacturer-set usernames and passwords before a device goes into production.
Question 3: An administrator enables 802.1X port-based authentication on all switch access ports. What does this primarily enforce?
- Encryption of all LAN traffic
- Network access control requiring authentication before connectivity (Correct answer)
- MAC address filtering only
- VLAN segmentation by department
Correct answer: Network access control requiring authentication before connectivity
802.1X requires endpoints to authenticate (typically via RADIUS) before the switch port transitions from an unauthorized to an authorized state.
Question 4: Which protocol should replace Telnet for remote router management to ensure confidentiality?
- SNMP v2c
- SSH (Correct answer)
- HTTP
- RDP
Correct answer: SSH
SSH encrypts the management session, whereas Telnet transmits all data including passwords in plaintext.
Question 5: A firewall rule base should follow which principle to reduce attack surface?
- Permit all, deny exceptions
- Implicit deny with explicit permits only for required traffic (Correct answer)
- Deny inbound only, permit all outbound
- Permit based on source IP alone
Correct answer: Implicit deny with explicit permits only for required traffic
Implicit deny (deny-all by default) ensures only explicitly approved traffic flows, minimizing exposure to unintended access.
Question 6: What is the purpose of network segmentation using DMZ architecture?
- To increase internal LAN throughput
- To isolate publicly accessible servers from the internal trusted network (Correct answer)
- To replace the need for a firewall
- To assign DHCP addresses to guest users
Correct answer: To isolate publicly accessible servers from the internal trusted network
A DMZ places internet-facing services in a separate zone so that a compromised server cannot directly reach internal resources.
Question 7: An administrator configures a switch to send only SNMPv3 traps with authentication and encryption. Which two SNMPv3 features provide this?
- Community strings and ACLs
- authNoPriv and noAuthNoPriv
- authPriv mode using MD5/SHA and DES/AES (Correct answer)
- SNMP polling and read-only community
Correct answer: authPriv mode using MD5/SHA and DES/AES
SNMPv3 authPriv mode enables both message authentication (MD5 or SHA) and privacy encryption (DES or AES) for trap messages.
CompTIA Network+ Network+ Network Security Hardening 2
A network administrator wants to prevent VLAN hopping attacks.
Which action is the MOST effective countermeasure?