GSEC Defensible Network Architecture Practice Question
A security architect is hardening an organization's network infrastructure against reconnaissance and layer-2 attacks. Which TWO actions should the engineering team take to mitigate common switch-based vulnerabilities? (Choose TWO)
⚠ Common exam trap
Candidates frequently select generic port security or spanning-tree options instead of focusing on the specific layer-2 mechanisms like DTP and native VLAN mismatches targeted by the question.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Disabling dynamic trunking protocol on all user-facing access layer switch ports.
Mitigating layer-2 vulnerabilities requires disabling dynamic trunking protocol auto-negotiation and explicitly setting native VLAN identifiers to unused, isolated values. Disabling dynamic trunk negotiation stops rogue switches from forming trunk links, while changing the native VLAN prevents VLAN hopping attacks that exploit un-tagged traffic handling on trunk links.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Disabling dynamic trunking protocol on all user-facing access layer switch ports.
Why this is correct
Dynamic trunking protocol allows switches to automatically negotiate trunk links with connected devices. Disabling this feature on user-facing access ports prevents malicious actors from injecting crafted DTP frames to force a port into a trunking state and bypass VLAN boundaries.
- ✗
Enabling dynamic ARP inspection across all core routing interfaces without configuring DHCP snooping bindings.
Why it's wrong here
Dynamic ARP inspection relies heavily on valid DHCP snooping binding tables to validate ARP packets. Enabling DAI without a functional DHCP snooping database causes the switch to drop all legitimate ARP traffic, leading to widespread network disruption.
- ✓
Configuring the native VLAN on all trunk ports to use a dedicated, unused VLAN ID rather than the default VLAN 1.
Why this is correct
Using default VLAN 1 as the native VLAN on trunk links leaves the network vulnerable to double-tagging VLAN hopping attacks. Changing the native VLAN to an isolated, non-functional ID ensures that injected frames cannot traverse unauthorized VLANs.
- ✗
Routing all broadcast domain traffic through unmanaged Layer-1 repeating hubs to obscure physical topology.
Why it's wrong here
Unmanaged Layer-1 hubs flood all traffic to every port, enabling passive sniffing and destroying segmentation, which worsens reconnaissance exposure. They appeal as cheap topology obscurity. Mitigation requires managed switches with port security, DHCP snooping and dynamic ARP inspection on access ports.
- ✗
Installing public-facing web servers directly into the native management VLAN of the core enterprise switches.
Why it's wrong here
Placing public-facing web servers in the native management VLAN exposes switch management interfaces to untrusted traffic, enabling reconnaissance and VLAN-hopping attacks. It is tempting to simplify cabling. Hardening instead requires a dedicated out-of-band management VLAN isolated from production and user-facing hosts.
Visual reference
About these practice questions
This GSEC question is part of Courseiva's 351-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GSEC practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GSEC exam.