Security practice questions

The switch port has experienced a hardware failure.

Why it fails: A hardware failure would typically show the interface as 'down/down' or 'administratively down' rather than 'secure-shutdown'. The 'Port Security: Enabled' line combined with the 'Last Source Addr' strongly suggests that a policy violation occurred rather than a physical cable or hardware issue with the switch or the device.

An administrator manually disabled the port with the 'shutdown' command.

Why it fails: If an administrator had manually disabled the port using the 'shutdown' command, the status would be 'administratively down'. In this exhibit, the status is 'secure-shutdown', which is a specific state triggered by the port security feature. Manual shutdowns do not display a 'Last Source Addr' in this context.

The port is experiencing a duplex mismatch with the connected host.

Why it fails: A duplex mismatch usually results in poor performance, late collisions, or CRC errors, but it does not cause port security to shut down an interface. Port security is concerned with Layer 2 MAC addresses, whereas duplex settings relate to the physical signaling on the wire. These are two distinct issues.

An access control list (ACL) applied to the outbound interface

Why it fails: An outbound ACL filters traffic leaving the router, but it would not prevent internal users from initiating connections to the malicious website. The traffic would still be allowed to leave the internal network and reach the destination. To block access to a specific external IP, the ACL should be applied inbound on the interface facing the internal network.

Port security on the switch port connected to the router

Why it fails: Port security is used on switch ports to restrict which MAC addresses can connect, preventing unauthorized devices. It does not filter traffic based on IP addresses or block access to specific websites. Therefore, it is not suitable for this requirement.

A VLAN access map (VACL) on the router

Why it fails: VACLs are used on switches to filter traffic within VLANs, not on routers. Routers use ACLs for traffic filtering. While VACLs can be used on some multilayer switches, the scenario specifies a Cisco router, making this option incorrect.

violation protect with errdisable recovery cause psecure-violation

Why it fails: Protect mode silently drops offending frames and does not generate a syslog message, so it fails the requirement to log the violation. Additionally, protect mode does not err-disable the port, so configuring errdisable recovery for psecure-violation has no effect because the port never enters the err-disabled state.

violation shutdown with errdisable recovery cause psecure-violation

Why it fails: Shutdown mode err-disables the port and, with errdisable recovery enabled, will recover automatically. However, shutdown mode is more disruptive than necessary here because it takes the port fully offline, whereas restrict mode already satisfies the logging and automatic recovery requirements with less impact on legitimate traffic.

violation shutdown with no errdisable recovery configured

Why it fails: Shutdown mode does err-disable the port and can log the event, but without errdisable recovery configured the port remains disabled until an administrator manually shuts and no-shuts it. That violates the requirement that the port recover automatically without manual intervention.

DHCP Snooping

Why it fails: DHCP Snooping is designed to prevent rogue DHCP servers and validate IP-to-MAC bindings, rather than controlling physical port access based on the device's MAC address. It acts as a security filter for DHCP traffic specifically, not as a primary mechanism for general physical port-level device authentication and locking.

BPDU Guard

Why it fails: BPDU Guard is a Spanning Tree Protocol security feature that shuts down a port if it receives a BPDU. It is meant to prevent loops caused by unauthorized switches or bridges, not to authenticate or limit which specific client devices are allowed to connect to a switch port.

Dynamic ARP Inspection

Why it fails: Dynamic ARP Inspection (DAI) prevents ARP poisoning and man-in-the-middle attacks by validating ARP packets in the network. While it relies on the DHCP snooping database, it is not the primary tool used for controlling physical port access based on MAC address identification for individual user devices.

Encrypting sensitive data traffic

Why it fails: ACLs are purely filtering mechanisms and do not perform any form of data encryption. Encryption requires services like IPsec, SSL, or TLS, which handle the transformation of plaintext data into ciphertext. ACLs only decide whether to permit or drop a packet based on defined criteria.

Automatically updating firmware

Why it fails: Access Control Lists have absolutely no capability to manage or deploy firmware updates. Firmware management is a separate administrative task performed via TFTP, SCP, or management platforms. ACLs deal exclusively with packet filtering and traffic flow regulation, not the maintenance or lifecycle of device software.

Providing hardware redundancy

Why it fails: Hardware redundancy is achieved through physical cabling, power supplies, or protocols like HSRP and VRRP. ACLs are configuration-based traffic policies and contribute nothing to the physical or logical availability of the network hardware itself. They are strictly for traffic filtering, not for maintaining system uptime.

The port will remain up and drop the traffic.

Why it fails: The 'shutdown' violation mode specifically dictates that the interface must be disabled upon a violation. Dropping traffic without changing the port status is characteristic of the 'protect' violation mode, which is not configured here. Therefore, the interface will not remain active if a violation occurs.

The port will alert the console but stay active.

Why it fails: The 'restrict' violation mode would alert the administrator via SNMP traps and log messages while keeping the port active and dropping traffic. Since 'shutdown' is configured, the port will not remain active; it will enter a disabled state to prevent any further communication from the unauthorized device.

The switch will replace the existing MAC.

Why it fails: Port security does not replace existing MAC addresses when a violation occurs. It enforces the maximum limit defined. Once the limit of one is reached, any new MAC address is considered a violation, and the port will respond according to the configured violation mode, which is shutdown.

Telnet

Why it fails: Telnet transmits all data, including usernames and passwords, in cleartext across the network. This makes it highly vulnerable to packet sniffing and session hijacking. It is considered an insecure protocol and should never be used for remote management when secure alternatives like SSH are available.

HTTP

Why it fails: HTTP is an unencrypted web protocol used for non-secure browser-based management. Like Telnet, it transmits information in plaintext, exposing authentication details to interception. HTTPS should be used instead for any web-based management interfaces to provide encryption and ensure the integrity of the administrative session.

SNMPv1

Why it fails: SNMPv1 is an legacy monitoring protocol that uses cleartext community strings for authentication. It is not designed for remote command-line management and lacks robust security features. It provides no encryption or strong authentication, making it inherently insecure for sensitive management tasks in a modern production environment.

ICMP

Why it fails: ICMP is a network layer protocol used for diagnostics and error reporting, such as ping and traceroute. It has no mechanism for user authentication, authorization, or accounting. Using it for security is impossible as it is designed for connectivity testing and status messaging, not user-level access control.

DHCP

Why it fails: DHCP is responsible for the dynamic assignment of IP addresses to network devices. While it is a necessary service for network operations, it does not provide user authentication or authorization capabilities. It operates independently of the AAA framework and cannot be used to verify user identities for access.

DNS

Why it fails: DNS is the protocol used to map domain names to IP addresses. It is critical for network functionality but performs no security or authentication functions. It is not involved in verifying user identities, authorizing access, or logging user sessions within an enterprise AAA security implementation.

Phishing

Why it fails: Phishing is a social engineering attack designed to deceive users into revealing sensitive information like usernames and passwords. It is not a network-level attack that targets the availability of services via traffic volume, but rather a deceptive practice targeting human behavior to compromise data integrity.

Man-in-the-Middle

Why it fails: A Man-in-the-Middle attack occurs when an attacker secretly intercepts and relays communications between two parties. The goal is to eavesdrop or modify data, not to crash or deny access to the service. It is a data-interception technique rather than an availability-exhaustion technique.

MAC Spoofing

Why it fails: MAC spoofing involves changing a device's hardware address to impersonate another device on the network. While this can be used for unauthorized access or bypassing security, it is not primarily focused on overwhelming a service to make it unavailable; it is a technique for masquerading identity.

Permits all traffic including HTTP.

Why it fails: The ACL explicitly contains a deny statement for all IP traffic after the permit statement. The implicit deny at the end of every ACL would also stop all other traffic, but the explicit statement ensures that even if the implicit rule were absent, non-HTTP traffic is dropped.

Permits all traffic except HTTP.

Why it fails: The logic is the inverse of the statement. The ACL permits HTTP traffic and blocks everything else. To permit all traffic except HTTP, the ACL would need a 'deny tcp any any eq 80' followed by a 'permit ip any any' rule to allow all other traffic types.

Allows all traffic by default.

Why it fails: Cisco ACLs do not allow all traffic by default when explicit rules are present, and there is always an implicit deny at the end. Since this ACL contains a 'deny ip any any' statement, it is impossible for all traffic to be permitted by this configuration.

Port Security

Why it fails: Port Security is intended for limiting physical access based on MAC addresses. While it restricts the number of MAC addresses on a port, it does not understand the DHCP protocol or track DHCP lease information, making it ineffective against starvation attacks that use a single MAC address.

IP Source Guard

Why it fails: IP Source Guard prevents IP spoofing by verifying the source IP address against a binding table populated by DHCP Snooping. While it relies on DHCP snooping, it is not the primary mechanism for preventing the exhaustion of the DHCP scope itself, but rather for enforcing source-IP validity.

Dynamic ARP Inspection

Why it fails: Dynamic ARP Inspection focuses on preventing ARP spoofing and poisoning by validating ARP packets. It does not regulate DHCP request rates or manage the allocation of IP addresses in a DHCP scope; its primary purpose is protecting the integrity of the ARP cache on switches.

Using Telnet for remote access

Why it fails: Telnet is insecure and transmits credentials in cleartext. It is a major security risk that should be replaced by SSH. Using Telnet violates modern hardening standards because it allows any eavesdropper on the network to easily capture administrative passwords and gain full control of the device.

Configuring SNMPv1 with 'public' string

Why it fails: Using SNMPv1 with the 'public' community string is a severe security vulnerability. SNMPv1 transmits data in cleartext, and 'public' is a widely known default that attackers target first. Hardening requires using SNMPv3, which offers encryption, message integrity, and stronger authentication mechanisms.

Port Security

Why it fails: Port Security limits physical access based on MAC addresses. It has no mechanism for filtering DHCP traffic based on the identity of the server. It cannot distinguish between a legitimate DHCP server and a rogue one, making it ineffective for preventing unauthorized address allocation on the network.

Dynamic ARP Inspection

Why it fails: DAI protects against ARP spoofing by validating ARP packets. It does not manage DHCP server discovery or enforce trust levels for DHCP services. While it uses the DHCP Snooping database for its own operation, it is not the feature responsible for identifying or blocking rogue DHCP servers.

IP Source Guard

Why it fails: IP Source Guard is designed to prevent IP address spoofing by verifying traffic against a source-binding database. It does not influence the DHCP server selection process or prevent rogue DHCP servers from offering addresses to clients, as its purpose is to validate the source IP of packets.

Encrypting all user traffic

Why it fails: Encryption of traffic is handled by protocols like IPsec, SSL, or TLS, not by the AAA framework. Accounting is responsible for recording activity and session logs, not for transforming or protecting the data payloads that users transmit across the network from interception or tampering.

Verifying user identities

Why it fails: Verifying user identities is the function of the 'Authentication' component of AAA. Accounting starts only after the user has been successfully authenticated and authorized. It focuses on logging what the user did, rather than confirming who the user is during the initial access phase.

Assigning permissions to users

Why it fails: Assigning permissions and defining what a user can do on the network is the role of the 'Authorization' component. Accounting does not dictate access rights; it merely provides an after-the-fact report on what occurred during the session after those permissions have already been applied.

DHCP Snooping

Why it fails: DHCP snooping blocks rogue DHCP servers and builds a binding table of each client's IP address, MAC address, VLAN and port. That table is what Dynamic ARP Inspection uses to check ARP packets, so snooping is a prerequisite, but by itself it never inspects ARP and cannot stop a host sending forged ARP replies. Enable both, with DAI providing the ARP protection.

Port Security

Why it fails: Port security limits which MAC addresses can send traffic on a port and how many. An attacker using a single, permitted MAC address can still send forged ARP replies claiming another device's IP address, because port security does not look at the IP-to-MAC claims inside ARP packets. Validating those claims is Dynamic ARP Inspection's job.

IP Source Guard

Why it fails: IP Source Guard uses the same binding table to filter IP traffic whose source IP or MAC address does not match what the port was assigned, preventing IP address spoofing. ARP packets are not IP packets, so it does not inspect them and cannot stop ARP cache poisoning. It complements Dynamic ARP Inspection, together with DHCP snooping, as part of first-hop security.

Allowing all traffic via ACL on management interfaces

Why it fails: Allowing all traffic to management interfaces is a major security flaw. Management interfaces should be restricted using ACLs to permit access only from known, secure administrative subnets. This limits the potential for unauthorized access from untrusted sources, which is a fundamental principle of network hardening.

Enabling the HTTP server

Why it fails: Enabling the HTTP server exposes the device to unencrypted web-based management, which is a security risk. If web management is required, HTTPS must be used instead. Leaving HTTP enabled, especially in a production environment, makes the device vulnerable to session interception and credential theft by malicious actors.

Sharing a single admin password for all devices

Why it fails: Sharing a single password across all devices is a dangerous practice that leads to widespread compromise if that password is leaked. Each device or group should have unique, strong credentials, or better yet, authenticate against a central AAA server to ensure that access can be revoked individually.

To increase the network bandwidth

Why it fails: Firewalls are security devices, not performance-enhancing devices. They inspect traffic, which often introduces latency rather than increasing bandwidth. Their primary purpose is traffic control and security enforcement, not optimization of data transmission speeds or network throughput for the connected devices.

To provide automatic physical layer redundancy

Why it fails: Firewalls do not provide physical layer redundancy like switches or routers might with redundant links. While some firewalls can be deployed in high-availability pairs, their core function is traffic inspection and policy enforcement, not managing physical link failover or cable connectivity.

To automatically patch all internal servers

Why it fails: Firewalls have no capability to perform system patching or software management on internal servers. Patching is an endpoint or server-level management responsibility handled by tools like WSUS or configuration management systems. The firewall only filters the data that enters or leaves the network.

It forces the port to drop all DHCP traffic.

Why it fails: The 'trust' command is the exact opposite of blocking traffic. It explicitly tells the switch that this interface is connected to an authorized DHCP server, allowing the server to communicate with clients through this port. Ports not marked as trusted would block these server responses.

It enables port security on the interface.

Why it fails: DHCP Snooping and Port Security are two distinct features. Marking an interface as a trusted DHCP port does not activate MAC-address-based port security. Port security requires independent configuration commands and serves a completely different purpose related to physical device identification and access restriction.

It prevents ARP spoofing on the port.

Why it fails: Trusting an interface for DHCP snooping has no direct effect on ARP packet validation. ARP spoofing protection is provided by Dynamic ARP Inspection (DAI), which requires its own specific configuration and uses the DHCP snooping database, but is not enabled simply by trusting the interface.

Integrity

Why it fails: Integrity focuses on ensuring that data has not been tampered with or altered by unauthorized parties during storage or transit. While important for financial records, the specific goal of limiting who can view the files is a matter of confidentiality rather than data accuracy or consistency.

Availability

Why it fails: Availability ensures that systems and data are consistently accessible to authorized users when needed. High availability involves redundancy and disaster recovery planning. Restricting access to management personnel does not directly address the uptime of the server or the accessibility of the files for those users.

Accounting

Why it fails: Accounting is the process of tracking user activities and resource usage on a network, often used for auditing purposes. While it helps identify who accessed a file after the fact, it does not prevent unauthorized viewing in the same way that confidentiality controls like encryption do.

Protect

Why it fails: Protect mode drops packets from unknown source MAC addresses until enough secure MAC addresses are removed or the maximum limit is increased. While it blocks unauthorized traffic, it does not send a syslog message or increment the violation counter, making it the least informative mode for an administrator.

Sticky

Why it fails: Sticky mode is not a violation action but a method for learning MAC addresses on a port. It allows the switch to dynamically learn addresses and save them to the running configuration. Using sticky addresses simplifies administration by avoiding manual entry of every device MAC address while providing port-level control.

Shutdown

Why it fails: Shutdown mode is the default behavior when a violation occurs on a secure port. It immediately transitions the interface to the error-disabled state, effectively turning it off. This requires manual intervention by an administrator to re-enable the port, providing the highest level of security against unauthorized hardware connections.