An attacker on an access port in VLAN 1 sends frames carrying two 802.1Q tags, the outer tag matching the trunk's native VLAN 1 and the inner tag VLAN 20, to reach a server in VLAN 20. Which mitigation directly defeats this technique?
Select an answer to reveal the explanation.
Short Explanation
Double tagging is a letter inside an envelope: the first switch tears off the outer envelope because it's addressed to the native VLAN, and the next switch delivers the inner letter to VLAN 20. If you take the native VLAN away from users, or tag it, there's no envelope to tear off. Don't confuse this with switch spoofing, where DTP is the fix.
Full Explanation
Double-tagging VLAN hopping relies on how a trunk handles its native VLAN. The attacker's access port belongs to the same VLAN as the trunk's native VLAN. The first switch receives the double-tagged frame, removes the outer tag that matches the native VLAN, and forwards it across the trunk untagged, because native VLAN traffic is sent without a tag. The next switch reads the remaining inner tag and delivers the frame into VLAN 20. The attack is one-way, but it can deliver packets to a target. Assigning the native VLAN to an unused VLAN that contains no access ports means no attacker can source frames in it, and tagging the native VLAN on trunks means the outer tag is never stripped this way. Disabling DTP prevents switch spoofing, in which an attacker negotiates a trunk; it is good hardening but does not stop double tagging, which needs no trunk on the attacker's port. BPDU guard reacts to spanning-tree BPDUs, not to tagged data frames. DHCP snooping protects address assignment and has no effect on how tags are processed. Exam caveat: also avoid VLAN 1 for user access ports, since it is the default native VLAN. Operational check: confirm each trunk's native VLAN is an unused VLAN or that native VLAN tagging is enabled, and that no access port is assigned to it.