350-201 Question 76
Select 4Your organization has recently deployed a Cisco Firepower Threat Defense (FTD) firewall in its network. During a security audit, it was noted that several unused services were enabled on the device, increasing the potential attack surface. Which services should you recommend disabling to improve the security posture, given that the organization does not use them?
- A
Telnet for device management
- B
SNMPv1/v2c for monitoring
- C
HTTP for administrative access
- D
NetFlow for traffic analysis
- E
SSH for secure device access
- F
FTP for file transfers
Show answer and explanation
Correct answers: A, B, C, F
Explanation
Disabling unnecessary or insecure services is critical to reducing the attack surface of a device. In this scenario, Telnet, SNMPv1/v2c, HTTP, and FTP are all protocols that are either insecure or not required by the organization. These should be disabled to enhance security. Secure alternatives, such as SSH, HTTPS, or SNMPv3, should be used if the functionalities are needed. NetFlow, on the other hand, is generally safe and useful for traffic analysis and does not need to be disabled.
- A. Correct.
Telnet is an insecure protocol that transmits data, including credentials, in plaintext. It is recommended to disable this service and use SSH for secure device management.
- B. Correct.
SNMPv1 and v2c are outdated and insecure protocols that can expose sensitive network information. SNMPv3 should be used instead if SNMP is required.
- C. Correct.
HTTP is an unencrypted protocol that can expose sensitive administrative sessions. HTTPS should be used instead for secure administrative access.
- D. Incorrect.
NetFlow is a widely used tool for traffic analysis and does not inherently pose a security risk when properly configured. It does not need to be disabled in this scenario.
- E. Incorrect.
SSH is a secure protocol for device access and should remain enabled for secure management of the device.
- F. Correct.
FTP is an insecure protocol that transmits data in plaintext, including credentials, and should be replaced with SFTP or another secure file transfer mechanism.