312-50 Question 204
Single answer▪ Sniffing CountermeasuresA security team discovers that employees on the same office floor can capture unencrypted application credentials and internal web traffic by plugging a laptop into any open wall port and running a packet sniffer. The environment uses managed switches, but most access ports are configured in a default state and users share the same VLAN. The team wants the most effective control to reduce the risk of unauthorized packet capture from a rogue endpoint connected to the LAN without redesigning the entire network. Which countermeasure should they implement first?
- A
Enable port security on access switch ports to limit connections to authorized MAC addresses and shut down or restrict ports when violations occur
- B
Disable ARP on all client systems so hosts cannot resolve local IP addresses to MAC addresses
- C
Increase the switch uplink bandwidth so sniffed traffic is less likely to be dropped during congestion
- D
Configure all internal DNS records to use short TTL values so clients refresh network paths more often
Show answer and explanation
Correct answer: A
Explanation
The best first countermeasure is to harden the switch access layer with port security because the scenario specifically involves unauthorized devices connecting to open wall ports on a managed switched network. In switched environments, casual sniffing is already reduced compared with hubs, but a rogue host can still capture broadcast traffic, its own traffic, and potentially additional traffic through attacks such as ARP spoofing if the network is not hardened. Port security helps prevent unauthorized endpoints from connecting in the first place.
Additional best practices for sniffing countermeasures include using 802.1X for network access control, VLAN segmentation, DHCP snooping, Dynamic ARP Inspection, encrypted protocols such as SSH/TLS/IPsec instead of Telnet/HTTP, and disabling unused ports. Vendor guidance from major switch manufacturers commonly recommends port security, 802.1X, and ARP protection features as Layer 2 defenses, while security best practices from NIST and enterprise hardening guides emphasize encryption and network access control to limit the impact of sniffing.
- A. Correct.
Correct. In this scenario, the immediate problem is that an unauthorized device can be plugged into any open access port and begin capturing traffic. On managed switches, port security is a practical first-line countermeasure because it restricts which devices can use a port, typically by limiting learned MAC addresses, using sticky MAC, or shutting down a port on violation. This does not eliminate all sniffing risks, but it directly reduces the ability of a rogue laptop to join the network from an unused wall jack. It is a well-established Layer 2 control for limiting unauthorized access on switched networks.
- B. Incorrect.
Incorrect. ARP is required for normal IPv4 communication on a local network segment. Hosts cannot simply disable ARP and still function on standard Ethernet networks. The misconception is that because ARP spoofing is associated with sniffing, removing ARP would solve the problem. In practice, the proper mitigation is to use protections such as Dynamic ARP Inspection, DHCP snooping, static ARP in limited cases, segmentation, and encryption where appropriate, not disabling ARP entirely.
- C. Incorrect.
Incorrect. Increasing uplink bandwidth has no meaningful effect on preventing packet sniffing by a rogue endpoint on an access port. Sniffing countermeasures focus on access control, segmentation, switch security features, and encryption. This distractor reflects a misunderstanding between performance tuning and security controls.
- D. Incorrect.
Incorrect. DNS TTL settings affect how long clients cache DNS answers; they do not prevent local packet capture or stop a rogue host from joining the LAN and sniffing traffic. Someone might choose this option if they confuse name resolution behavior with traffic confidentiality, but TTL values are unrelated to mitigating switched-network sniffing.