300-430 Question 304
Select 3An enterprise wireless network administrator is tasked with enhancing the security of wireless LAN controllers (WLCs). Which of the following actions should the administrator take to harden the WLC against unauthorized access and potential attacks?
- A
Disable unused management interfaces such as HTTP and Telnet.
- B
Enable SNMPv1 for easy monitoring of the WLC.
- C
Configure role-based access control (RBAC) for administrative access.
- D
Change the default administrative credentials for the WLC.
- E
Enable 802.1x on the management access interface for added security.
Show answer and explanation
Correct answers: A, C, D
Explanation
Device hardening involves implementing best practices to reduce security vulnerabilities. Disabling unused interfaces like Telnet and HTTP, configuring role-based access control, and changing default credentials are key steps to protect Cisco WLCs from unauthorized access and attacks. SNMPv1 and misapplied security protocols like 802.1x do not contribute to improving the security of WLC management access.
- A. Correct.
Disabling unused management interfaces such as HTTP and Telnet reduces the attack surface and prevents unauthorized access via unsecure protocols. This is a recommended best practice for device hardening.
- B. Incorrect.
SNMPv1 is an older protocol that is inherently insecure due to its plaintext community strings, making it a poor choice for monitoring in a secure environment. SNMPv3 should be used instead for secure monitoring.
- C. Correct.
Role-based access control (RBAC) ensures that only authorized personnel with defined roles can perform specific administrative tasks. This is a key element in securing access to the WLC.
- D. Correct.
Default administrative credentials are widely known and can be exploited by attackers. Changing them is a fundamental step in securing the WLC.
- E. Incorrect.
While 802.1x is a secure access protocol for end-user authentication, it is not typically used for securing the management access interface of a WLC. Other methods, such as using SSH or HTTPS, are more appropriate.