How Do You Stop a Visitor Laptop From Using a Lobby Jack?

Given a scenario, select mitigation techniques or controls to secure an enterprise environment. Given a scenario, apply security principles to secure enterprise infrastructure.

A visitor plugs a laptop into a network jack in the lobby and is able to connect to the company's network. Which of the following should be configured on the existing network infrastructure to best prevent this activity?

Port security Correct Answer
Web application firewall
Transport layer security
Virtual private network

Answer Correct answer: A — Configure port security on the existing switch ports to restrict which MAC addresses may connect and block the visitor's laptop.

Community Votes

83%

17%

83% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

This question tests mitigation controls for unauthorized wired network access, and the common trap is choosing an encryption or remote-access technology that cannot restrict which physical switch port a device uses.

A visitor connecting a laptop to a lobby network jack is an unauthorized physical access attempt that switch port security is designed to stop. This page establishes port security (A) as the correct SY0-701 answer, with analysis of why TLS, VPN, and WAF are not the right controls.

The most common wrong answer is transport layer security (C), because candidates associate 802.1X/EAP-TLS with network access control; however, plain TLS is only a cryptographic protocol and does not enable or disable switch ports by itself.

Community Discussion (5 comments)

dbrowndiver 👍 6 Selected: A

Port security is a feature available on network switches that helps secure access to the physical network by restricting which devices can connect to each network port based on their MAC address. Port Security: This is a network security feature that restricts input to an interface by limiting and identifying MAC addresses of the devices allowed to access the port. It can be configured to block devices that do not match the allowed list. -Control Over Physical Access: By enabling port security on the network jacks, the organization can ensure that only authorized devices with specific MAC addresses are allowed to connect. Any unauthorized devices, such as a visitor's laptop, would be blocked from accessing the network. -Dynamic or Static Configuration: Port security can dynamically learn and store allowed MAC addresses or use a predefined list, providing flexibility in securing physical network ports. This why it is the best answer: Port security directly addresses the issue of unauthorized access through physical network connections by controlling which devices can use the network ports. It prevents unauthorized devices from gaining network access, making it the most appropriate solution for this scenario.

41c27e6 👍 1 Selected: A

Port security is a feature that can be configured on network switches to limit which devices can connect to specific ports

Andrewyounan 👍 3 Selected: C

I go more for TLS which is part of EAP-TLS used with 802.1X on the NAC to authenticate. On the other hand, Port Sec. you'll need to either identify the MAC address or Sticky MAC address, so it makes sense to go with C. ### Maybe I'm over-thinking ### :D

Shaman73 👍 4 Selected: A

A. Port security

MAKOhunter33333333 👍 4 Selected: A

Port security / 802.1x / NAC

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

Port security is a switch feature that lets an administrator limit which source MAC addresses can send traffic through each physical interface, so an unknown visitor laptop on a lobby jack can be blocked, shut down, or moved to a quarantine VLAN. This directly matches the scenario because the visitor is abusing an existing network jack rather than exploiting a web app or remote-access path. As dbrowndiver explains, port security works by "by restricting which devices can connect to each network port based on their MAC address". The community consensus backs this up: 83 of 100 votes chose A, including Shaman73 who simply wrote "A. Port security" and MAKOhunter33333333 who grouped "Port security / 802.1x / NAC" as the answer family.

Why the Other Options Are Wrong

A web application firewall (B) protects HTTP traffic to web applications and has no visibility into whether a laptop is plugged into a lobby Ethernet jack. Transport layer security (C) encrypts data in transit and is used inside protocols like EAP-TLS, but plain TLS does not authenticate a switch port or stop an unauthorized device from linking at Layer 2. Andrewyounan's comment shows the trap: he leaned toward C because EAP-TLS can be part of 802.1X/NAC authentication, but that requires an authentication framework beyond "TLS" alone. A virtual private network (D) encrypts remote traffic and may restrict access after authentication, yet it does not prevent the visitor from physically connecting to the lobby jack in the first place.

Community Comment Notes

The community heavily favored A, with comments from dbrowndiver, 41c27e6, Shaman73, and MAKOhunter33333333 all pointing to port security or the port security/802.1X/NAC family. 41c27e6 notes that port security is "a feature that can be configured on network switches to limit which devices can connect to specific ports". Andrewyounan was the notable dissenter, choosing TLS/EAP-TLS with 802.1X on NAC and even quipping "Maybe I'm over-thinking". That is a useful reminder that 802.1X/NAC is a valid stronger solution, but the question asks what to configure on the existing network infrastructure, and port security is the direct switch-based control.

Official Reference

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960/software/release/15-0_2-se/configuration/guide/scg/swportsec.html

Exam Strategy

Read the physical scenario carefully: a visitor at a lobby jack means Layer 2 switch access. Eliminate security tools that operate at higher layers, such as a WAF at Layer 7 or TLS/VPN for encryption, and choose the switch feature that filters MAC addresses per port. On SY0-701, "best prevent" usually favors the control closest to the threat vector.

Frequently Asked Questions

Why is a web application firewall not the right control for a lobby network jack?

A WAF inspects HTTP(S) traffic to protect web applications and has no ability to block a device from connecting to a physical switch port.

Does port security replace 802.1X or NAC?

No, port security is a Layer 2 switch feature that limits MAC addresses per port; 802.1X/NAC adds identity-based authentication and can be layered with it.

More SY0-701 FAQ →

Related Analysis

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide