100-160 Question 66
Select 3A network administrator is tasked with securing a corporate network. They notice that several devices on the network are using public IP addresses instead of private IP addresses. Why might this pose a security risk, and what action should the administrator take to address it?
- A
Public IP addresses expose devices directly to the internet, increasing the attack surface.
- B
Private IP addresses cannot be routed on the internet, reducing the chances of external attacks.
- C
Using public IP addresses on internal devices enables faster communication and improves security.
- D
The administrator should configure NAT (Network Address Translation) to mask internal private IP addresses.
- E
The administrator should disable all public IP addresses and use only private IP addresses within the internal network.
Show answer and explanation
Correct answers: A, B, D
Explanation
Using public IP addresses on internal devices increases the attack surface by exposing them directly to the internet. Private IP addresses, in contrast, are non-routable on the internet, providing additional security. Network Address Translation (NAT) is a common method to bridge internal private IPs with external networks securely. The administrator should implement NAT and ensure that public IPs are only assigned when absolutely necessary to minimize security risks.
- A. Correct.
Public IP addresses expose devices directly to the internet, making them more vulnerable to attacks such as unauthorized access or exploitation by malicious actors.
- B. Correct.
Private IP addresses are not directly accessible from the internet, which inherently provides an additional layer of security for internal devices.
- C. Incorrect.
This statement is incorrect because using public IP addresses does not improve security. In fact, it increases the risk of exposure to potential threats.
- D. Correct.
Configuring NAT (Network Address Translation) allows private IP addresses to communicate with the internet securely while hiding the internal device IPs from external networks.
- E. Incorrect.
Disabling all public IP addresses is not always feasible as some applications or services may require internet-facing addresses. A combination of NAT and network segmentation is a more practical solution.