Network Hardening Flashcards

What is the primary goal of network hardening?

Reduce the attack surface by removing weaknesses and applying security best practices

What should you do with default usernames and passwords on new devices?

Change them immediately

Why should unused ports and services be disabled?

To reduce the number of possible attack paths

Why is it important to regularly update firmware and software?

To patch known security vulnerabilities

What does the Principle of Least Privilege (PoLP) state?

Users should receive only the minimum permissions needed to perform their jobs.

What is Role-Based Access Control (RBAC)?

Permissions are assigned based on a user's job role.

What is Multi-Factor Authentication (MFA)?

Requiring more than one authentication factor to verify identity

Which of the following is "something you know" in MFA?

Password

What is the primary purpose of network segmentation?

Divide a network into smaller isolated sections to improve security

What is the most common technology used to implement network segmentation?

VLANs

Why should unnecessary protocols like Telnet be disabled?

They can introduce security risks because they are insecure or unused.

Which protocol should be used instead of Telnet because it encrypts the session?

SSH

What is the purpose of Port Security on a switch?

Limit which MAC addresses are allowed to connect to a switch port.

What does 802.1X provide?

Port-based Network Access Control (NAC) that requires authentication before network access is granted.

Which authentication server commonly works with 802.1X?

RADIUS

What is the purpose of DHCP Snooping?

Block unauthorized (rogue) DHCP servers from handing out IP addresses.

What attack does Dynamic ARP Inspection (DAI) help prevent?

ARP Spoofing (ARP Poisoning)

Which authentication protocol encrypts only the user's password?

RADIUS

Which authentication protocol encrypts the entire authentication session?

TACACS+

A company wants to prevent unauthorized devices from plugging into an unused switch port. Which security feature is the BEST choice?

Port Security

A company wants to reduce the damage that could occur if an employee's account is compromised. Which security principle should they implement?

Principle of Least Privilege (PoLP)

A switch only allows devices with approved MAC addresses to connect. Which security feature is being used?

Port Security

A company organizes permissions into groups such as HR, IT, and Accounting. What access control model is this?

Role-Based Access Control (RBAC)

An employee logs in using a password and then enters a code from their phone. What security feature is this?

Multi-Factor Authentication (MFA)

Which of the following is "something you have" in MFA?

Smartphone or security token

Which of the following is "something you are" in MFA?

Fingerprint

Why does network segmentation improve security?

It isolates parts of the network, limiting malware spread and reducing the attack surface.

Why is SSH preferred over Telnet?

SSH encrypts the entire session, while Telnet sends data in plaintext.

A network administrator wants to stop unauthorized DHCP servers from handing out IP addresses. Which feature should be enabled?

DHCP Snooping

A switch verifies ARP messages against trusted DHCP Snooping information before forwarding them. Which feature is being used?

Dynamic ARP Inspection (DAI)

What does AAA stand for?

Authentication, Authorization, and Accounting

What is the purpose of Authentication in AAA?

Verify a user's identity

What is the purpose of Authorization in AAA?

Determine what resources or actions a user is allowed to access

What is the purpose of Accounting in AAA?

Keep logs of user activity and resource usage

Which protocol is commonly used to provide centralized authentication for network devices?

RADIUS

Which protocol is commonly preferred for administrator access because it encrypts the entire authentication session?

TACACS+

Why should default usernames and passwords be changed immediately on new devices?

Attackers already know the default credentials and can exploit them.

Why is disabling unused services considered a security best practice?

It reduces the attack surface by removing unnecessary entry points.

Why should firmware and software be updated regularly?

To patch known vulnerabilities and improve security

Which of the following BEST describes network hardening?

Reducing vulnerabilities by securing systems and removing unnecessary risks ✅

A new employee only needs access to the accounting application. Which security principle ensures they receive only the permissions necessary for their job?

Principle of Least Privilege (PoLP)

A network administrator creates groups named HR, IT, and Sales, then assigns permissions to those groups. What access control model is being used?

Role-Based Access Control (RBAC)

A switch requires every device to authenticate with a username and password before it can access the network. Which technology is being used?

802.1X

A company only allows two approved MAC addresses on each switch port. Which security feature is this?

Port Security

A company wants to stop attackers from connecting a fake DHCP server to the network. Which feature should be enabled?

DHCP Snooping

Which feature relies on information learned by DHCP Snooping to prevent ARP spoofing attacks?

Dynamic ARP Inspection (DAI)

Which protocol is generally preferred for managing routers and switches because it encrypts the entire authentication session?

TACACS+

A company wants to divide its network into separate sections so malware cannot easily spread between departments. What should they implement?

Network Segmentation using VLANs

Which practice provides the greatest reduction in attack surface?

Disabling unused ports, services, and protocols

A new switch is installed. Which action should be performed FIRST to improve security?

Change the default usernames and passwords