220-1102 Question 361
Single answerPort securityA company is preparing a conference room for visiting contractors. The room has several unused Ethernet wall jacks connected to access switch ports. Security policy requires preventing unauthorized devices from gaining network access through those jacks, while still allowing approved devices to connect when IT enables a port for a scheduled event. Which action BEST meets this requirement?
- A
Disable unused switch ports and place them in an unused VLAN until they are needed
- B
Enable DHCP on all conference room ports so unknown devices receive limited network settings
- C
Configure the contractor laptops with static IP addresses before they arrive
- D
Label the wall jacks as "authorized users only" to deter unauthorized connections
Show answer and explanation
Correct answer: A
Explanation
The best answer is to disable unused switch ports and place them in an unused VLAN until they are required. In practice, physical network security on wired infrastructure starts at the switch. Unused active ports represent a common risk because any person with physical access to a live jack may be able to connect a laptop or rogue device. Standard network hardening guidance recommends shutting down unused ports and, in many environments, assigning them to an isolated or unused VLAN as an added safeguard. This aligns with common enterprise switch security best practices and with A+ Core 2 objectives related to port security and securing network access. DHCP, static IP settings, and warning labels do not provide actual enforcement of physical port access.
- A. Correct.
Correct. Disabling unused switch ports is a standard port security control that prevents devices from using inactive network connections. Assigning those ports to an unused VLAN adds another layer of protection in case a port is accidentally enabled or misconfigured. When IT needs a port for an approved event, the port can be re-enabled and assigned appropriately. This is a common best practice for physical network access control on wired networks.
- B. Incorrect.
Incorrect. DHCP does not provide port security. It only assigns IP configuration to devices that are already connected to the network. An unauthorized device could still receive an address and attempt network access. Some administrators confuse IP addressing controls with access controls, but DHCP is not designed to block physical access at the switch port.
- C. Incorrect.
Incorrect. Static IP addressing does not prevent unauthorized physical connections. An attacker or unauthorized user could still connect to the network and manually assign an IP address. This option addresses device configuration, not switch port access control. It is a plausible distractor because people sometimes assume controlling IP settings is the same as controlling network access.
- D. Incorrect.
Incorrect. Labels may support policy awareness, but they do not enforce security. Anyone can still plug into an active wall jack if the associated switch port is enabled. This is an administrative deterrent, not a technical port security measure.