350-201 Question 83
Select 3Your company’s network infrastructure has recently been targeted with multiple unauthorized access attempts. As a Cisco cybersecurity engineer, you are tasked with implementing network controls to harden the network. Which of the following actions should you take to improve the security posture of the network?
- A
Enable port security on access switches to restrict the number of devices that can connect to each port.
- B
Disable unused ports on switches and routers to reduce the attack surface.
- C
Implement a flat network topology to simplify traffic monitoring and management.
- D
Use Access Control Lists (ACLs) to restrict access to critical network resources.
- E
Allow unrestricted outbound traffic to ensure uninterrupted user connectivity.
Show answer and explanation
Correct answers: A, B, D
Explanation
Network hardening focuses on reducing vulnerabilities and improving the security posture of the network. Actions such as enabling port security, disabling unused ports, and implementing ACLs directly address common attack vectors. A flat topology and unrestricted traffic, however, introduce vulnerabilities and should be avoided. By applying these network controls, you can significantly enhance the network's resilience against threats.
- A. Correct.
Enabling port security limits the number of MAC addresses that can connect to a specific port, helping to prevent unauthorized devices and mitigate potential attacks such as MAC flooding.
- B. Correct.
Disabling unused ports reduces the attack surface, as unused ports can otherwise be exploited by attackers to gain unauthorized network access.
- C. Incorrect.
A flat network topology lacks segmentation, making the network more vulnerable to lateral movement during an attack. This approach weakens network security rather than hardening it.
- D. Correct.
Access Control Lists (ACLs) are a critical network control that restricts access to sensitive resources based on IP addresses, protocols, or other criteria, enhancing network security.
- E. Incorrect.
Allowing unrestricted outbound traffic can expose the network to data exfiltration or command-and-control communications from compromised devices, which is a poor security practice.