SY0-701 Question 162
Single answerNetwork infrastructureA company is replacing several unmanaged switches with managed switches in a shared office building. Employees, contractors, and visitors all connect to wall jacks in conference rooms and open workspaces. The security team is concerned that an attacker could unplug a company device and connect a rogue laptop to gain internal network access. The company wants a control that can be enforced on the switch itself to reduce this risk without requiring users to manually start a VPN connection. Which solution best meets this requirement?
- A
Enable 802.1X port-based network access control on the switch ports
- B
Configure a site-to-site VPN between the office and headquarters
- C
Implement a network-based IDS to monitor conference room traffic
- D
Deploy DNSSEC on the internal DNS servers
Show answer and explanation
Correct answer: A
Explanation
The best answer is 802.1X port-based network access control because it is specifically designed to control access at the network edge, usually on managed switch ports or wireless access points. In a real enterprise environment, 802.1X is often paired with RADIUS and certificate-based or credential-based authentication to ensure only authorized users and devices receive normal network access. This aligns with common network access control best practices and the Security+ objective of applying infrastructure security controls to limit unauthorized access. By contrast, site-to-site VPNs protect traffic between networks, IDS provides monitoring rather than admission control, and DNSSEC protects DNS integrity rather than switch port access. Relevant guidance includes IEEE 802.1X for port-based access control and NIST network access control best practices, which emphasize authenticating devices and users before granting access to internal resources.
- A. Correct.
Correct. IEEE 802.1X provides port-based network access control and is commonly used on managed switches to authenticate devices or users before granting network access. In this scenario, it directly addresses the risk of someone plugging an unauthorized device into a wall jack. With 802.1X, the switch can place unauthenticated devices into a restricted VLAN or deny access entirely until authentication succeeds through an authentication server such as RADIUS. This is a practical infrastructure control enforced at the switch port.
- B. Incorrect.
Incorrect. A site-to-site VPN secures traffic between networks, such as between a branch office and headquarters, but it does not control whether a rogue device can plug into an internal switch port and gain local network access. It protects traffic in transit across untrusted networks, not endpoint admission at a wall jack.
- C. Incorrect.
Incorrect. A network-based IDS may detect suspicious activity after a rogue device connects, but it does not prevent the connection itself. The requirement is to reduce the risk by enforcing a control on the switch, and IDS is primarily a detective control rather than a preventive port access control mechanism.
- D. Incorrect.
Incorrect. DNSSEC helps validate the authenticity and integrity of DNS responses to reduce DNS spoofing or cache poisoning. It does not authenticate devices connecting to switch ports and is unrelated to preventing unauthorized physical network access through office wall jacks.