How Do You Stop a Visitor Laptop From Using a Lobby Jack?

SY0-701 By islever Editorial Last updated

Given a scenario, select mitigation techniques or controls to secure an enterprise environment. Given a scenario, apply security principles to secure enterprise infrastructure.

Short answer

A Configure port security on the existing switch ports to restrict which MAC addresses may connect and block the visitor's laptop.

Question

A visitor plugs a laptop into a network jack in the lobby and is able to connect to the company's network. Which of the following should be configured on the existing network infrastructure to best prevent this activity?
  1. Port security Correct Answer
  2. Web application firewall
  3. Transport layer security
  4. Virtual private network

Key Takeaways

This question tests mitigation controls for unauthorized wired network access, and the common trap is choosing an encryption or remote-access technology that cannot restrict which physical switch port a device uses.

A visitor connecting a laptop to a lobby network jack is an unauthorized physical access attempt that switch port security is designed to stop. This page establishes port security (A) as the correct SY0-701 answer, with analysis of why TLS, VPN, and WAF are not the right controls.

Common mistake: The most common wrong answer is transport layer security (C), because candidates associate 802.1X/EAP-TLS with network access control; however, plain TLS is only a cryptographic protocol and does not enable or disable switch ports by itself.

Expert Analysis

Why the Answer Is Correct

Port security is a switch feature that lets an administrator limit which source MAC addresses can send traffic through each physical interface, so an unknown visitor laptop on a lobby jack can be blocked, shut down, or moved to a quarantine VLAN. This directly matches the scenario because the visitor is abusing an existing network jack rather than exploiting a web app or remote-access path. As dbrowndiver explains, port security works by "by restricting which devices can connect to each network port based on their MAC address". The community consensus backs this up: 83 of 100 votes chose A, including Shaman73 who simply wrote "A. Port security" and MAKOhunter33333333 who grouped "Port security / 802.1x / NAC" as the answer family.

Why the Other Options Are Wrong

A web application firewall (B) protects HTTP traffic to web applications and has no visibility into whether a laptop is plugged into a lobby Ethernet jack. Transport layer security (C) encrypts data in transit and is used inside protocols like EAP-TLS, but plain TLS does not authenticate a switch port or stop an unauthorized device from linking at Layer 2. Andrewyounan's comment shows the trap: he leaned toward C because EAP-TLS can be part of 802.1X/NAC authentication, but that requires an authentication framework beyond "TLS" alone. A virtual private network (D) encrypts remote traffic and may restrict access after authentication, yet it does not prevent the visitor from physically connecting to the lobby jack in the first place.

Community Comment Notes

The community heavily favored A, with comments from dbrowndiver, 41c27e6, Shaman73, and MAKOhunter33333333 all pointing to port security or the port security/802.1X/NAC family. 41c27e6 notes that port security is "a feature that can be configured on network switches to limit which devices can connect to specific ports". Andrewyounan was the notable dissenter, choosing TLS/EAP-TLS with 802.1X on NAC and even quipping "Maybe I'm over-thinking". That is a useful reminder that 802.1X/NAC is a valid stronger solution, but the question asks what to configure on the existing network infrastructure, and port security is the direct switch-based control.

Exam Strategy

Read the physical scenario carefully: a visitor at a lobby jack means Layer 2 switch access. Eliminate security tools that operate at higher layers, such as a WAF at Layer 7 or TLS/VPN for encryption, and choose the switch feature that filters MAC addresses per port. On SY0-701, "best prevent" usually favors the control closest to the threat vector.

Frequently Asked Questions

Why is a web application firewall not the right control for a lobby network jack?

A WAF inspects HTTP(S) traffic to protect web applications and has no ability to block a device from connecting to a physical switch port.

Does port security replace 802.1X or NAC?

No, port security is a Layer 2 switch feature that limits MAC addresses per port; 802.1X/NAC adds identity-based authentication and can be layered with it.

More SY0-701 FAQ →

Community Votes

A
83%
C
17%

83% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

  1. dbrowndiver 👍 6 Answered A
    Port security is a feature available on network switches that helps secure access to the physical network by restricting which devices can connect to each network port based on their MAC address. Port Security: This is a network security feature that restricts input to an interface by limiting and identifying MAC addresses of the devices allowed to access the port. It can be configured to block devices that do not match the allowed list. -Control Over Physical Access: By enabling port security on the network jacks, the organization can ensure that only authorized devices with specific MAC addresses are allowed to connect. Any unauthorized devices, such as a visitor's laptop, would be blocked from accessing the network. -Dynamic or Static Configuration: Port security can dynamically learn and store allowed MAC addresses or use a predefined list, providing flexibility in securing physical network ports. This why it is the best answer: Port security directly addresses the issue of unauthorized access through physical network connections by controlling which devices can use the network ports. It prevents unauthorized devices from gaining network access, making it the most appropriate solution for this scenario.
  2. Andrewyounan 👍 3 Answered C
    I go more for TLS which is part of EAP-TLS used with 802.1X on the NAC to authenticate. On the other hand, Port Sec. you'll need to either identify the MAC address or Sticky MAC address, so it makes sense to go with C. ### Maybe I'm over-thinking ### :D
  3. 41c27e6 👍 1 Answered A
    Port security is a feature that can be configured on network switches to limit which devices can connect to specific ports
  4. MAKOhunter33333333 👍 4 Answered A
    Port security / 802.1x / NAC
  5. Shaman73 👍 4 Answered A
    A. Port security

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

CCTV and Surveillance Signs as Security Controls

S-grade

When Should an Engineer Decommission a Network Device?

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

Which Zero Trust Component Belongs to the Data Plane?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide