CompTIA SY0-701 Bundle

DHCP snooping rejects unauthorized DHCP server replies on untrusted switch ports and can build bindings used by other security features. It does not authenticate the laptop's user or evaluate endpoint posture before granting the normal VLAN. An attacker can acquire an address from the legitimate DHCP server while remaining unmanaged.

MAC-address allowlisting may filter devices by layer-2 addresses, but those identifiers can often be spoofed and do not prove user identity or device health. The policy explicitly requires authentication and posture-based VLAN placement. MAC controls alone cannot meet either requirement reliably for guest laptops.

Permanently disabling all campus access ports would prevent normal managed devices from connecting as well as guests. It eliminates the service rather than selectively admitting authorized endpoints based on trust level. Network admission should differentiate compliant users and devices from unknown or noncompliant ones without removing legitimate connectivity.

WPA3-Personal with SAE protects wireless sessions using a shared password-based authentication model. Even though SAE improves resistance to offline password guessing compared with older PSK approaches, it does not authenticate each managed laptop using its own client certificate through RADIUS EAP. The requirement is for enterprise certificate identities, not a group secret.

WPA2-Personal uses a pre-shared password and cannot satisfy a requirement for client certificate validation via RADIUS EAP-TLS. MAC filtering may add an administrative restriction, but hardware addresses can be spoofed and do not establish cryptographic device identity. The scenario already provides unique certificates, so a shared PSK would discard the required authentication design.

An open SSID with a captive portal may be appropriate for guest access where users agree to terms or authenticate after wireless association. It does not deliver the required protected enterprise wireless association with EAP-TLS certificate-based admission. Traffic before portal login may also be unprotected at the link layer, conflicting with the specified WPA3 protection.

DHCP snooping can reject unauthorized DHCP server messages on untrusted switch interfaces and protect clients against rogue DHCP infrastructure. It does not make an unused Ethernet jack electrically or logically unavailable: a connected device can still establish link and possibly access other local services. The requirement is to disable the unused port until a documented work order authorizes its use.

Dynamic ARP Inspection checks certain ARP announcements against trusted IP-to-MAC bindings to reduce spoofing within a VLAN. It presumes the port is active and does not stop a new device from linking. ARP validation is useful on operational access ports but does not directly implement administrative shutdown for a jack with no approved endpoint.

Monitoring access-port traffic provides useful after-the-fact evidence and might reveal an unauthorized device that tried to use the jack. Leaving the interface active nevertheless permits connections before a weekly review, which conflicts with the explicit no-availability requirement. Shut it down first and use monitoring for authorized ports that remain in operation.

Port security can limit learned source MAC addresses, and shutting unused switch ports removes needless physical access points. Neither feature reliably distinguishes a legitimate DHCP server response from a rogue laptop advertising a malicious default gateway on an active employee VLAN. The case needs protection of DHCP control messages rather than simple endpoint-count restrictions.

A reverse proxy intermediates application-layer client requests and can hide protected HTTP origins or terminate TLS. It has no role in filtering DHCP offers from access-switch ports, because DHCP address assignment happens before application proxying. A web proxy cannot authenticate an authorized network DHCP server on a campus VLAN.

802.1X/NAC authenticates devices before admitting them to a normal access VLAN and can prevent unknown laptops from participating. That is valuable complementary protection, but it does not specifically validate DHCP-server messages from already-connected or admitted ports. DHCP snooping is the direct safeguard against the rogue DHCP advertisements described.

DHCP snooping establishes trusted address-allocation information and may maintain the IP-to-MAC binding table used by other protections. On its own, however, it does not compare each ARP sender claim against that table or block spoofed ARP responses. The switches already have DHCP bindings, so the missing function is explicit inspection and validation of ARP traffic.

External BGP prefix filtering restricts which routing prefixes can be advertised or accepted at a routing session. ARP spoofing is a local layer-2 address-resolution problem on a campus VLAN, not the advertisement of external routes. BGP policy cannot determine whether a finance server’s IP was falsely associated with an attacker MAC in an ARP message.

A port-security MAC limit can restrict how many source MAC addresses a switch learns on one interface. It does not necessarily verify that an ARP packet’s claimed sender IP corresponds to the allowed MAC binding. An attacker can send forged IP-to-MAC assertions while staying within an address-count limit. The case needs binding-aware ARP validation.

An interzone firewall can allow selected database ports between application and data subnets, providing useful coarse trust boundaries. The question requires policy that follows individual app and database workloads even when their subnet addresses change. A static zone policy alone may lack that identity-aware, workload-level flexibility and require continual manual rule updates.

A default-deny approach blocks unspecified connections and permits only explicitly authorized flows, which is a sound security posture. It is a general policy principle rather than a mechanism for maintaining service-specific controls across changing workload locations. The requirement calls for applying that principle using workload identity or labels rather than subnet-only coordinates.

BGP prefix filtering controls which IP network routes are accepted or advertised between routing peers. It does not enforce per-application database port access based on workload identity. Even an accurately filtered route can carry unauthorized connections unless another policy restricts services. Routing hygiene and workload authorization solve different problems.

DNSSEC validates signed DNS data by checking cryptographic chains of trust for applicable zones. It can reduce forged DNS responses but does not govern which IP prefixes a BGP neighbor advertises. DNS integrity is separate from routing-policy containment at the partner peering session.

Workload-level zero-trust policies can limit communications among application identities and services. They do not prevent a BGP peer from exporting unrelated Internet routes into the enterprise routing table. Applying identity-aware application rules might constrain traffic after routing, but route-leak prevention requires prefix filtering at the BGP boundary.

A symmetric traffic path through a stateful firewall keeps forward and return packets visible to the same connection-tracking system. It is important when asymmetric paths break legitimate sessions but cannot restrict a partner’s BGP route advertisements. Route import/export policy must be enforced on the control-plane peer configuration.

DNS-layer domain blocking denies resolution of domains in threat lists or policies, reducing visits to known malicious services. It does not verify that an otherwise allowed DNS name returned an authentic DNS record rather than a forged answer. Attackers could poison accepted names, so filtering destinations is not equivalent to cryptographic authenticity validation.

Encrypted DNS transport, such as DoT or DoH, protects queries and responses between a client and its selected recursive resolver against passive interception or alteration on that hop. It does not prove that the resolver received authentic authoritative zone data. Forged records upstream can still be returned securely unless validation of signed DNS records occurs.

BGP prefix filtering controls IP route advertisements and can prevent some routing leaks. It cannot verify the contents or signatures of DNS resource records returned to a resolver. Routing controls and resolver security both matter, but authenticating signed DNS responses requires DNSSEC validation rather than BGP policy.

A private administration path and a restricted source allowlist reduce who can reach management interfaces. The issue here is plaintext DNS lookups from remote staff bypassing the VPN, not worldwide access to an admin panel. Even a safely restricted management network leaves ordinary DNS requests readable if their transport is unencrypted.

DNS-layer domain blocking can stop resolution to known malware and phishing destinations, improving user protection. A blocklist does not make the remaining allowed DNS queries confidential to observers on the remote network. The question asks to protect DNS transport on a route that bypasses the VPN, not to change which domains employees may visit.

DNSSEC validates signed DNS answers so clients or resolvers can detect certain forged records. It does not encrypt the DNS query name or response payload in transit. An observer on the bypassed VPN path could still read the plaintext DNS traffic even if the answer's signature validates.

SSH encrypts administrative sessions and authenticates the server when host-key validation is configured. Using it on a secured management network is preferable to Telnet, but encryption alone does not stop any Internet source from reaching a public management panel. The immediate problem is unrestricted source reachability, requiring a private administrative path and allowlisting.

A hardened bastion host provides a controlled, audited entry point for administrators and can help protect many internal systems. It is a suitable implementation element after making the panel privately reachable. On its own, deploying a bastion does not guarantee that the panel's existing public listener has been disabled or restricted.

Dedicated out-of-band management provides a separate control channel that remains available when the production network is impaired. That is valuable for recovering switches or routers, not necessarily the most direct solution for a public administrative web panel. The request is primarily to remove global Internet access through network restrictions.

Out-of-band management can provide a separate, resilient path to a switch when production interfaces or VLANs fail. It does not automatically encrypt Telnet if operators continue using plaintext on the shared network. For this stated credential-disclosure risk, disable Telnet and move to SSH; out-of-band separation can be an additional resilience control.

A private administration network and source allowlist reduce who can establish sessions to switches. They do not necessarily protect login credentials and commands against an observer with access to the shared link if Telnet remains enabled. Network separation complements, but cannot replace, encrypted remote management.

Load balancing distributes web or application traffic across healthy backends and may remove failed servers from service. It does not protect administrative credentials carried in Telnet sessions. The question concerns transport confidentiality for switch management, not availability of a multi-node web service.