A network switch has a wall-jack port in a public lobby that is no longer actively used. Which is the BEST practice for that port?
- A.Assign it to a guest VLAN and enable DHCP snooping
- B.Leave the port enabled but remove the patch cable at the patch panel
- C.Administratively shut down (disable) the port in the switch configuration
- D.Enable port security with a maximum of one MAC address
Why C is correct
Administratively disabling unused switch ports in software (e.g., 'interface shutdown' in Cisco IOS) is the most definitive control - an attacker cannot get network access even if they plug into the wall jack. Removing a patch cable is a physical-only measure that is easily reversible by plugging into a different patch panel port. Assigning to a guest VLAN still grants network access and creates an attack surface. Port security with max 1 MAC allows the first connecting device - which could be an unauthorized laptop. Defense-in-depth recommends both disabling the port AND placing unused ports in a black-hole VLAN, but the primary control is the administrative shutdown.
Know someone studying for Network Fundamentals? Send them this one.