200-301 Question 180
Select 2A network administrator is configuring a new switch and notices that all ports are assigned to VLAN 1 by default. The administrator wants to ensure best practices for network security and segmentation. Which of the following actions should the administrator take regarding the default VLAN?
- A
Change the default VLAN from VLAN 1 to another unused VLAN.
- B
Move user-facing ports to a different VLAN instead of keeping them in VLAN 1.
- C
Delete VLAN 1 from the switch to prevent its use.
- D
Restrict VLAN 1 to only management traffic or disable it on unused ports.
- E
Assign all inter-switch trunk ports to VLAN 1 for consistency.
Show answer and explanation
Correct answers: B, D
Explanation
VLAN 1 is the default VLAN on Cisco switches, and it cannot be deleted or changed. However, keeping user-facing ports in VLAN 1 can lead to security vulnerabilities as VLAN 1 is often targeted in network attacks. To follow best practices, move user-facing ports to a different VLAN and restrict VLAN 1 to specific uses, such as management traffic, or disable it on unused ports.
- A. Incorrect.
Changing the default VLAN is not possible as VLAN 1 is hardcoded in Cisco switches and cannot be removed or changed.
- B. Correct.
Moving user-facing ports to a different VLAN ensures better network segmentation and reduces the risk of attacks targeting the default VLAN.
- C. Incorrect.
VLAN 1 cannot be deleted because it is a system-reserved VLAN on Cisco switches.
- D. Correct.
Restricting VLAN 1 to management traffic or disabling it on unused ports is a best practice to minimize its exposure to unauthorized access.
- E. Incorrect.
Assigning inter-switch trunk ports to VLAN 1 is not recommended as VLAN 1 should be avoided for trunking to reduce the risk of VLAN hopping attacks.