Campus routers exchange routing updates and device management using protocols with authentication disabled, allowing trivial spoofing of peers. Which action best hardens protocol selection and configuration?
Select an answer to reveal the explanation.
Short Explanation
Unauthenticated routing updates are like taking street signs from strangers. Turn on protocol authentication, shut what you don’t need, and stop managing gear with museum cleartext protocols.
Full Explanation
Unauthenticated routing and management-adjacent protocols allow trivial peer spoofing: an attacker who injects false updates or management traffic can redirect paths, create black holes, or reconfigure devices. Hardening protocol selection means enabling MD5 or stronger authentication where routing protocols support it, disabling services the campus does not need, and replacing obsolete cleartext management such as legacy TFTP or Telnet-style channels with SSH, secure file transfer, and authenticated management frameworks. Those steps raise the cost of spoofing and remove unnecessary listeners that expand the attack surface on campus routers.
The approach that prefers cleartext TFTP for all configurations because it is simpler to automate exposes configuration contents and write paths on the wire and invites unauthorized replacement of device configs. The proposal to disable all routing protocols and substitute hubs so spoofing becomes irrelevant abandons scalable, loop-controlled campus routing for a brittle collision domain that does not meet modern municipal network requirements and does not address management-protocol abuse. The action that allows anonymous SNMP write from the Internet for faster vendor support opens remote reconfiguration to the world—an extreme violation of least privilege and boundary control.
Exam caveat: CISSP protocol security favors authenticated routing, service minimization, and secure management channels. Extreme answers that remove routing entirely or open anonymous write access are distractors against practical hardening.
Operational check: enable routing authentication on campus IGP/EGP adjacencies; disable unused services and cleartext transfer methods; migrate device management to SSH/HTTPS with AAA; restrict SNMP to authenticated versions from management sources only; and probe for unauthenticated peers or anonymous write community remnants after changes.