CISSP Communication and Network Security Practice Question
During a penetration test, the tester successfully performs a VLAN hopping attack by sending packets with a specific tag. Which mitigation technique is most effective at preventing double-tagging VLAN hopping?
⚠ Common exam trap
It's easy for candidates to confuse VLAN hopping with MAC flooding or ARP spoofing, or they assume that VACLs or port security can stop Layer 2 tagging attacks, when in fact the root cause is the untagged native VLAN behavior on trunk ports.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Disable the native VLAN and explicitly tag all VLANs
Double-tagging VLAN hopping exploits the native VLAN (typically VLAN 1) on a trunk link. By disabling the native VLAN and explicitly tagging all VLANs, including the native VLAN, the switch will not forward untagged frames or frames with a single 802.1Q tag that can be misinterpreted by the next switch, thus preventing the attacker from injecting frames into a different VLAN.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use VLAN access control lists (VACLs) only
Why it's wrong here
VLAN Access Control Lists (VACLs) filter traffic based on Layer 2/3 criteria within or between VLANs. However, the double-tagging attack exploits how a switch processes VLAN tags on a trunk port, specifically the untagged nature of the native VLAN. VACLs apply after the switch has already processed the outer tag and forwarded the frame based on the inner, malicious tag, making them ineffective at preventing the initial bypass mechanism.
- ✗
Implement port security with sticky MAC
Why it's wrong here
Port security with sticky MAC addresses limits the number of MAC addresses learned on an access port and saves them dynamically. While this prevents unauthorized devices from connecting or MAC spoofing, it does not address VLAN hopping attacks like double-tagging. These attacks exploit the VLAN tagging mechanism on trunk ports, not the MAC address limits on access ports, allowing frames to traverse to unintended VLANs.
- ✓
Disable the native VLAN and explicitly tag all VLANs
Why this is correct
The double-tagging attack relies on the switch stripping an outer, attacker-controlled tag when it matches the native VLAN of a trunk port, then forwarding the frame based on the inner, malicious tag. By disabling the native VLAN and explicitly tagging all traffic on trunk links, including the management VLAN, the switch will not strip any untagged frames. This ensures all frames are treated consistently with their explicit VLAN tags, preventing the outer tag from being silently removed and the inner malicious tag from being processed.
- ✗
Enable Dynamic Trunking Protocol (DTP) on all ports
Why it's wrong here
Dynamic Trunking Protocol (DTP) automatically negotiates trunking capabilities between connected switches. Enabling DTP on all ports, especially user-facing access ports, significantly increases the risk of VLAN hopping. An attacker can leverage DTP to trick a switch port into becoming a trunk port, thereby gaining access to multiple VLANs and facilitating various VLAN hopping attacks, including double-tagging, by sending specially crafted DTP frames.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.