A police department closet accidentally trunks a user-facing port after a cable move, and investigators blame dynamic trunk negotiation. What is the best hardening practice for those user ports?
Select an answer to reveal the explanation.
Short Explanation
User ports should be boring on purpose: access mode, correct VLAN, DTP off. Auto-trunking on a desk jack is how a patch cable turns into a VLAN highway you never meant to build.
Full Explanation
User-facing ports in a police department closet should never become trunks. The correct hardening practice is to configure those interfaces as static access ports in the appropriate user VLAN and disable dynamic trunking negotiation. That combination stops DTP from forming an 802.1Q trunk after a cable move or misplug, which otherwise can extend VLANs to an unauthorized device and create investigative and security exposure on what should be a simple endpoint port.
Setting every user port to dynamic desirable so trunks form “only when needed” is the anti-pattern: desirable actively seeks trunk formation and is what enables the accidental trunk after a cable move. Enabling Root Guard on all PC-facing ports instead of fixing switchport mode misapplies Root Guard; host ports need access mode and typically BPDU Guard/PortFast, not root-placement guard as the primary fix for DTP. Forcing native VLAN 1 tagging off while leaving DTP enabled ignores the core issue—dynamic trunk negotiation—and does not prevent the port from becoming a trunk.
Exam caveat: access mode plus nonegotiate (or equivalent DTP disable) should be paired with an explicit access VLAN, and often with PortFast and BPDU Guard for host ports. Do not confuse this edge hardening with uplink trunks, which should be static trunks with DTP disabled for the opposite reason (predictable multi-VLAN carry).
Operational check: audit PC-facing interfaces for switchport mode access, switchport access vlan <user>, and DTP disabled; attempt DTP negotiation from a test switch and confirm the police user port refuses trunking; log and remediate any remaining dynamic or trunk modes on endpoint ports.