Which protocol should be disabled on a Cisco switch to mitigate VLAN hopping attacks?STPVTPDTPCDP

Analyzing the Options

To answer the question regarding which protocol should be disabled on a Cisco switch to mitigate VLAN hopping attacks, let's briefly examine the protocols listed:

1. STP (Spanning Tree Protocol) - This protocol helps prevent loops in the network but cannot be directly associated with VLAN hopping.
2. VTP (VLAN Trunking Protocol) - This protocol can lead to potential security vulnerabilities if not secured properly, as it allows the propagation of VLAN information across switches. Disabling it can help to control VLAN configurations more tightly.
3. DTP (Dynamic Trunking Protocol) - DTP can be exploited by attackers to negotiate trunk links and access multiple VLANs. Disabling this can significantly reduce the risk of VLAN hopping.
4. CDP (Cisco Discovery Protocol) - This protocol is used for discovering Cisco devices and does not directly impact VLAN hopping.

Best Practice

To effectively mitigate VLAN hopping attacks, enabling strict port security and disabling unnecessary protocols is crucial. In this context, VTP and DTP are main concerns.

Final Answer

Based on the analysis, DTP (Dynamic Trunking Protocol) should be disabled on a Cisco switch to mitigate VLAN hopping attacks.