hardMultiple ChoiceObjective-mapped
CISSP Practice Question: During a security assessment, a penetration…
During a security assessment, a penetration tester successfully performed a VLAN hopping attack from a host in VLAN 10 to a host in VLAN 20. The switches are configured with IEEE 802.1Q trunking. Which misconfiguration likely allowed this attack?
⚠ Common exam trap
ISC2 often tests the distinction between the two types of VLAN hopping (switch spoofing vs. double-tagging), and the trap here is that candidates confuse disabling STP or port security as relevant mitigations, when the core issue is DTP-enabled access ports allowing trunk negotiation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Dynamic Trunking Protocol (DTP) is enabled on access ports
D is correct because VLAN hopping attacks exploit Dynamic Trunking Protocol (DTP) to negotiate a trunk link between an attacker's host and a switch port. If DTP is enabled on an access port, the attacker can spoof DTP messages to form a trunk, gaining access to traffic from multiple VLANs, including VLAN 20 from VLAN 10.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The native VLAN is not used on any trunk ports
Why it's wrong here
Not utilizing a native VLAN on trunk ports actually enhances security by mitigating the risk of double tagging attacks, a common VLAN hopping technique. In a double tagging scenario, an attacker leverages the native VLAN to embed a second, malicious tag, which is then processed by the destination switch after the first tag is stripped. Therefore, the absence of a native VLAN on trunks removes this specific vulnerability vector, making it a preventative measure rather than an enabler of VLAN hopping. This configuration would not facilitate the penetration tester's success in a VLAN hopping attack.
- ✗
Spanning Tree Protocol is disabled
Why it's wrong here
Spanning Tree Protocol (STP) is a Layer 2 protocol designed to prevent network loops by intelligently blocking redundant paths in a switched network topology. While disabling STP can lead to broadcast storms and network instability, it does not directly enable or facilitate VLAN hopping attacks. VLAN hopping exploits vulnerabilities in VLAN tagging or trunk negotiation, which are distinct from the loop prevention mechanisms managed by STP. Therefore, STP's operational status is unrelated to the specific methods used for VLAN hopping.
- ✗
Port security is disabled on all ports
Why it's wrong here
Port security is a Layer 2 control feature that restricts input to an interface by limiting the number of valid MAC addresses allowed on a port and controlling which MAC addresses are learned. While effective against MAC spoofing or unauthorized device connections, port security does not prevent VLAN hopping attacks. These attacks, such as Dynamic Trunking Protocol (DTP) exploitation or double tagging, manipulate VLAN tags or trunking states, which are not directly addressed by MAC address limitations. Consequently, disabling port security would not be the direct cause of a successful VLAN hopping attempt.
- ✓
Dynamic Trunking Protocol (DTP) is enabled on access ports
Why this is correct
When Dynamic Trunking Protocol (DTP) is enabled on an access port, it allows the port to actively negotiate its trunking status with a connected device. An attacker can leverage this by sending DTP frames from their connected machine, tricking the switch port into establishing a trunk link. Once a trunk is formed, the attacker can then send specially crafted 802.1Q tagged frames, allowing them to access and communicate with any VLAN configured on that trunk, thereby successfully performing a VLAN hopping attack. This misconfiguration directly enables the vulnerability.
Visual reference
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Access port
An access port is a switch port that connects to a single end device, like a computer or printer, and carries traffic for only one VLAN.
Key term
Security assessment
A security assessment is a systematic evaluation of an organization’s systems, networks, and applications to identify vulnerabilities, threats, and risks, and to recommend improvements.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.