A transit authority security review flags public kiosk ports that still send discovery advertisements. What hardening step addresses that risk?
Select an answer to reveal the explanation.
Short Explanation
Discovery protocols are helpful in the closet and chatty on a public kiosk—like broadcasting the building directory in the lobby. Shut CDP/LLDP off on those untrusted edge ports and keep the map inside.
Full Explanation
Transit-authority public kiosks are untrusted edge ports: anyone at the kiosk can see frames on that link. CDP and LLDP advertisements can expose device model, software version, and topology hints that aid reconnaissance. The hardening step that matches the risk is to selectively disable CDP and/or LLDP on those kiosk-facing ports while leaving discovery enabled on trusted closet uplinks where operators still need neighbor maps. That is access-layer information hygiene, complementary to—but not a substitute for—port security, ACLs, and segmentation.
Flooding CDP and LLDP on every kiosk port increases leakage rather than reducing it. Moving Spanning Tree root priority to kiosk switches is unrelated to discovery advertisement risk and would be a harmful STP design change. Converting every kiosk port into a routed Layer 3 EtherChannel member is an inappropriate redesign for public edge ports and does not address discovery leakage on those interfaces.
Exam caveat: disabling discovery on the edge is not the same as disabling it globally. Interswitch and distribution links often still need CDP/LLDP for operations. Also distinguish this control from BPDU guard, which protects STP—not discovery privacy.
Operational check: identify public and untrusted edge interfaces, disable CDP/LLDP there per policy, verify trusted uplinks still show expected neighbors, and include discovery state in the security baseline so future port templates keep kiosk ports quiet.