A hardening review of branch routers finds the HTTP server, Telnet and several unused services enabled. The team is applying benchmark-style guidance to the routers. What is the recommended action for these findings?
Select an answer to reveal the explanation.
Short Explanation
Every service you leave running is a door, and hardening means bricking up the ones nobody uses. Telnet and plain HTTP also pass passwords in the clear. Watch for answers that hide the door or put a guard in front of it instead of closing it.
Full Explanation
Configuration benchmarks for network devices consistently recommend reducing the attack surface: disable services that are not required, and replace cleartext management protocols with encrypted ones. Telnet and the plain HTTP server transmit credentials and session data without encryption, so they should be disabled in favor of SSH and, where web management is required, HTTPS. Unused services should be turned off because each listening service can expose vulnerabilities or be misused, for example for reconnaissance or amplification. Moving services to nonstandard ports is security through obscurity; port scans find them quickly and the protocols remain cleartext and vulnerable. Keeping Telnet with an access class narrows who can connect, but credentials still cross the network unencrypted, and benchmark guidance is to permit only SSH for remote terminal access. Relying on the edge firewall ignores internal threats and misconfigurations; defense in depth calls for hardening the device itself, since an attacker or malware already inside can reach those services. Exam caveat: some services, such as HTTPS for a management tool, may be legitimately needed; keep them but restrict access and document the reason. Operational check: review the running configuration and the device's listening ports, confirm Telnet and the HTTP server are disabled, VTY lines accept only SSH, and a rescan shows no unexpected open services.