A public health clinic left unused switch ports in VLAN 1 and wants safer default-VLAN hygiene. What practice best addresses that risk?
Select an answer to reveal the explanation.
Short Explanation
Leaving empty jacks in VLAN 1 is like leaving spare keys under the default doormat. Park unused ports in a quiet unused VLAN and stop treating VLAN 1 like the staff lounge. Default VLAN hygiene is boring—and that is the point.
Full Explanation
Safer default-VLAN hygiene for the public health clinic starts by treating VLAN 1 as infrastructure leftover, not as a convenient parking lot for unused wall jacks. Moving unused ports into an unused or quarantine VLAN removes easy attachment points from the default broadcast domain and avoids relying on VLAN 1 for user access, which reduces accidental bridging into management-adjacent segments and shrinks the attack surface of open ports in exam rooms and hallways. Operational practice pairs that move with shut/unused port discipline and clear documentation of which VLAN is truly unused. The goal is intentional membership, not factory defaults left in production. Advertising VLAN 1 as the only allowed VLAN on every uplink trunk permanently concentrates risk onto the default VLAN and blocks legitimate departmental segmentation the clinic needs. Moving the native VLAN on all trunks to VLAN 1 exclusively and never changing it preserves a well-known untagged lane attackers and mispatches target; modern guidance prefers a dedicated, unused native VLAN that matches on both ends. Enabling Telnet-only management so VLAN 1 becomes unreachable from the LAN does not remediate unused access ports and weakens management security rather than fixing VLAN hygiene. Exam caveat: “unused/quarantine VLAN” is about port membership—do not confuse it with simply renaming VLAN 1 while leaving user ports there. Operational check: inventory ports still in VLAN 1, reassign idle ports to the quarantine VLAN and shut them if policy requires, confirm user access VLANs are non-default, and verify trunks do not needlessly allow VLAN 1 to every closet.