When configuring a network switch in a data center environment, which of the following is a common practice to ensure security and manageability?

Implementing Virtual LANs (VLANs) is a fundamental best practice for network security and manageability. VLANs segment a physical network into multiple logical broadcast domains. This segmentation isolates traffic between different groups of users or servers, preventing unauthorized access and containing broadcast storms. From a manageability perspective, VLANs allow administrators to group devices logically (e.g., by department or function) regardless of their physical location, simplifying the application of policies, troubleshooting, and network administration. This logical organization is crucial in complex data center environments.

A. Use default passwords: This is a critical security vulnerability, as default credentials are publicly known and provide an easy entry point for attackers.
B. Disable spanning tree protocol: Disabling STP in a network with redundant links would cause broadcast storms and switching loops, leading to a complete network outage.
C. Disable port security: This removes a crucial access-layer security feature that prevents MAC address spoofing and limits the number of devices that can connect to a port.

1. HPE ArubaOS-CX 10.12 Layer 2 Bridging Guide, "Virtual LANs (VLANs)" chapter, Page 7: "VLANs provide a way of partitioning a physical network into separate broadcast domains. VLANs are a security feature that limits the broadcast domain and keeps hosts in one VLAN from communicating directly with hosts in another VLAN."

2. HPE ArubaOS-CX 10.12 Security Guide, "Securing management access" chapter, Page 11: This section strongly advises against using default credentials and outlines procedures for creating strong, unique passwords and user accounts, directly contradicting option A.

3. HPE ArubaOS-CX 10.12 Security Guide, "Port security" chapter, Page 101: "Port security is an access control feature. With port security, you can configure a port to allow traffic only from specific MAC addresses or to limit the number of MAC addresses that can send traffic into the port." This highlights why disabling it (Option C) is incorrect.

4. HPE ArubaOS-CX 10.12 Layer 2 Bridging Guide, "Spanning Tree Protocol (STP)" chapter, Page 113: "STP prevents bridge loops and the broadcast radiation that results from them." This confirms that disabling STP (Option B) is detrimental to network stability.