A fleet garage security review wants CDP disabled on public-facing kiosk ports while still allowing LLDP for IP phones on trusted desk ports. Which approach matches that intent?
Select an answer to reveal the explanation.
Short Explanation
Discovery protocols are name tags—great on trusted desks, risky on public kiosks. Peel CDP off the untrusted ports; keep LLDP where phones still need it. Selective disable beats a campus-wide blackout that breaks handsets.
Full Explanation
Discovery protocols can be tuned per port. A fleet garage security review that wants CDP disabled on public-facing kiosk ports while still allowing LLDP for IP phones on trusted desk ports should disable CDP on the untrusted kiosk ports and leave LLDP enabled where phones still need standards-based discovery. That matches least-privilege advertisement: reduce Cisco-proprietary leakage on hostile-facing ports without starving trusted phones of LLDP TLVs.
Disabling both CDP and LLDP globally so no port can advertise anything overshoots and breaks phone onboarding that depends on LLDP (or CDP) for voice VLAN and power information. Replacing LLDP with UDLD on phone ports because UDLD carries voice VLAN TLVs confuses link-integrity detection with discovery—UDLD does not carry voice VLAN inventory TLVs. Enabling CDP only on kiosk ports and disabling LLDP campus-wide inverts the security intent and harms trusted desk phones.
Exam caveat: some Cisco phones historically preferred CDP; modern multi-vendor designs lean on LLDP-MED—validate phone behavior before stripping CDP everywhere. Operational check: on kiosk ports confirm CDP is off and neighbors are not advertised; on desk phone ports confirm LLDP neighbors and voice VLAN learning still work; document the per-port policy for auditors.