What is a potential drawback to leaving VLAN 1 as the native VLAN?
A.
It may be susceptible to a VLAN hopping attack.
B.
Gratuitous ARPs might be able to conduct a man-in-the-middle attack.
C.
The CAM might be overloaded, effectively turning the switch into a hub.
D.
VLAN 1 might be vulnerable to IP address spoofing.
Explanation:
BD
VLAN hopping is a computer security exploit, a method of attacking networked resources on a virtual LAN
(VLAN). The basic concept behind all VLAN hopping attacks is for an attacking host on a VLAN to gain access
to traffic on other VLANs that would normally not be accessible. There are two primary methods of VLAN
hopping: switch spoofing and double tagging.
+ In a switch spoofing attack, an attacking host imitates a trunking switch by speaking the tagging and
trunking protocols (e.g. Multiple VLAN Registration Protocol, IEEE 802.1Q, Dynamic Trunking Protocol) used in
maintaining a VLAN. Traffic for multiple VLANs is then accessible to the attacking host.
+ In a double tagging attack, an attacking host connected on a 802.1q interface prepends two VLAN tags to
packets that it transmits.
Double Tagging can only be exploited when switches use “Native VLANs”. Ports with a specific access VLAN
(the native VLAN) don’t apply a VLAN tag when sending frames, allowing the attacker’s fake VLAN tag to be
read by the next switch. Double Tagging can be mitigated by either one of the following actions:
+ Simply do not put any hosts on VLAN 1 (The default VLAN). i.e., assign an access VLAN other than VLAN
1 to every access port
+ Change the native VLAN on all trunk ports to an unused VLAN ID.
+ Explicit tagging of the native VLAN on all trunk ports. Must be configured on all switches in network
autonomy.
Source: https://en.wikipedia.org/wiki/VLAN_hopping