* Port security is a feature that allows switches to limit the number of MAC addresses that can be learned on a switchport, and to take action if an unauthorized MAC address is detected12.
* Port security can prevent rogue devices from connecting to the network and potentially launching attacks such as MAC spoofing, ARP poisoning, or VLAN hopping13.
* Port security can be configured to either drop packets from unauthorized MAC addresses (protect or restrict mode), or to shut down the port completely (shutdown mode)12.
* Port security can also be configured to use sticky MAC addresses, which are dynamically learned and stored in the running configuration, or to use static MAC addresses, which are manually entered and stored in the startup configuration12.
* Port security is a best practice for securing switchports that provide end user access, especially in public or untrusted areas, where rogue devices can be easily plugged in13.
* Spanning Tree Protocol (STP) is a network protocol that prevents loops in a switched network by disabling redundant links and creating a loop-free logical topology45.
* STP is not a control that would address the risk of rogue devices connecting to the network, as it does not limit the MAC addresses or the VLANs that can be learned on a switchport45.
* Deactivating STP on network interfaces that are facing public areas would not only be ineffective, but also counterproductive, as it would create the possibility of loops and broadcast storms if multiple devices are connected to the same switchport45.
* Neighbor Resolution Protocol (NRP) is not a valid term in networking. The closest term is Neighbor Discovery Protocol (NDP), which is an IPv6 protocol that performs functions such as address resolution, router discovery, prefix discovery, and neighbor unreachability detection67.
* NDP is not a control that would address the risk of rogue devices connecting to the network, as it does not limit the MAC addresses or the VLANs that can be learned on a switchport67.
* Disabling NDP in the Layer 2 devices would not only be ineffective, but also detrimental, as it would impair the IPv6 communication and functionality on the network67.
* Port tagging is a technique that adds a VLAN identifier (VID) to an Ethernet frame, indicating which VLAN it belongs to89.
* Port tagging is used to allow multiple VLANs to share the same physical link, such as a trunk port between switches, or a link to a device that supports VLAN tagging, such as a router or a server89.
* Port tagging is not a control that would address the risk of rogue devices connecting to the network, as it does not limit the MAC addresses or the VLANs that can be learned on a switchport89.
* Ensuring port tagging is in place for network interfaces in guest areas would not only be ineffective, but also unnecessary, as guest devices usually do not support VLAN tagging, and would only need access to a single VLAN89.
References:
* Port Security in Computer Network
* Understanding VLAN tagging and untagging of ports
* Spanning Tree Protocol
* Spanning Tree Protocol - CompTIA Network+ N10-007 - 1.3
* Spanning Tree Protocol - N10-008 CompTIA Network+ : 2.3
* Neighbor Discovery Protocol - NDP Overview
* Neighbor Discovery Protocol (NDP) - what is it?
* CompTIA Network+ domain #2: network implementation [2022 update]
* CompTIA Network+ Certification Exam Objectives

* The question asks about the least amount of redundancy for a company's network that wants to add a local backup data center.
* The answer is not B, because a hot site is a fully operational data center that can take over the primary site's functions immediately in case of a disaster. It has the most amount of redundancy, as it replicates the primary site's data, applications, and hardware.
* The answer is not C, because a cloud site is a data center that is hosted by a third-party provider on the internet. It can provide a high level of redundancy, as it can scale up or down according to the demand and availability of resources. It also offers flexibility and cost-efficiency for the company.
* The answer is not D, because a warm site is a partially operational data center that can take over the primary site's functions within a short time in case of a disaster. It has a moderate amount of redundancy, as it has some of the primary site's data, applications, and hardware, but not all of them.
* The answer is A, because a cold site is a data center that is not operational and requires a lot of time and effort to set up and activate in case of a disaster. It has the least amount of redundancy, as it has none of the primary site's data, applications, or hardware. It only has the basic infrastructure, such as power, cooling, and network connectivity.
References:
* : CompTIA Network+ N10-008 Study Guide, Chapter 5: Network Management, Section 5.3: Network Disaster Recovery, p. 295
* : CompTIA Network+ N10-008 Study Guide, Chapter 5: Network Management, Section 5.3: Network Disaster Recovery, p. 296
* : CompTIA Network+ N10-008 Study Guide, Chapter 5: Network Management, Section 5.3: Network Disaster Recovery, p. 297
* : CompTIA Network+ N10-008 Study Guide, Chapter 5: Network Management, Section 5.3: Network Disaster Recovery, p. 298

The security principle of least privilege states that users or processes should only have the minimum level of access or permissions required to perform their tasks. This reduces the risk of unauthorized or malicious actions, as well as the impact of potential breaches. In this scenario, the systems operator is granted access to only the applications that are relevant to their role, and denied access to the applications that are not. This is an example of applying the least privilege principle. Reference:
CompTIA Network+ N10-008 Certification Study Guide, Chapter 7: Network Security Concepts and Tools, Section 7.1: Common Security Concepts, Subsection: Least Privilege1 Professor Messer's CompTIA N10-008 Network+ Course, Section 7.1: Common Security Concepts, Video: Least Privilege2