New access-layer switches arrive with default credentials and many unused services enabled. Which baseline hardening steps should operations apply before production use?
Select an answer to reveal the explanation.
Short Explanation
Factory defaults are a welcome mat for attackers. Change the passwords and shut the unused doors—ports, protocols, and junk services—before those switches ever see city traffic.
Full Explanation
Baseline device hardening for new access-layer switches starts with changing default credentials and disabling unused ports, protocols, and services before production use. Factory defaults are publicly known, and unused services expand the attack surface for anyone who can reach management or data planes. Civic closets are not magical safe zones—physical access and VLAN mistakes still occur inside city buildings.
Keeping factory defaults so vendor support can guess the password quickly preserves the most common credential-attack shortcut against network gear. Enabling every management protocol including cleartext ones for convenience exposes switch administration to eavesdropping and insecure remote control. Skipping hardening because switches are already “inside” the civic building ignores insider threats, contractor access, and the reality that perimeter breach often leads to internal discovery scans.
Exam caveat: “change defaults and disable unused services” is foundational hardening language across SY0-701 device questions. Physical location inside a municipal building is not a substitute for credential and service hygiene.
Operational check: replace default passwords with unique vaulted credentials, disable unused Ethernet ports or place them in quarantined VLANs, turn off cleartext management (telnet, open HTTP), restrict management to OOB or secured VRFs, and capture a documented hardening baseline for each switch model before deployment.