mediumMultiple SelectObjective-mapped
CISSP Practice Question: Which TWO are common techniques to defend against…
Which TWO are common techniques to defend against VLAN hopping attacks? (Choose two.)
⚠ Common exam trap
ISC2 often tests the distinction between DTP-related defenses (disabling DTP, setting static access) and other Layer 2 security features like BPDU Guard or Port Security, leading candidates to confuse STP or MAC-based protections with VLAN hopping countermeasures.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Disable DTP
Disabling Dynamic Trunking Protocol (DTP) on all switch ports prevents interfaces from automatically negotiating trunk links, which is the primary vector for VLAN hopping attacks. By setting ports to 'switchport mode access' and disabling DTP with 'switchport nonegotiate', an attacker cannot trick the switch into forming a trunk and gain access to traffic from multiple VLANs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Disable DTP
Why this is correct
DTP can be exploited to negotiate a trunk, enabling hopping.
- ✗
Enable BPDU Guard
Why it's wrong here
BPDU Guard protects against STP attacks, not VLAN hopping.
- ✗
Use Private VLANs
Why it's wrong here
Private VLANs limit traffic within a broadcast domain but don't prevent trunk attacks.
- ✗
Enable Port Security
Why it's wrong here
Port security limits MAC addresses but does not prevent VLAN hopping.
- ✓
Set access ports as static VLAN
Why this is correct
Static access ports do not negotiate trunks, reducing hopping risk.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.