What should be done to protect against the large sniffing attack surface?

• A. Implement a combination of measures at physical, administrative, and technical levels.
• B. Use encryption alone for all communications.
• C. Rely on user awareness alone.
• D. Disable all network sniffing defenses.

Answer: (A)

Sniffing risk is best mitigated with layered defenses that span physical, administrative, and technical controls. Physical measures protect the hardware and cabling from tampering or theft and limit who can access network devices, which helps prevent attackers from inserting or monitoring traffic at the source. Administrative controls establish policies, access rights, incident response, and ongoing monitoring so that suspicious sniffing activity is detected and properly handled. Technical controls implement protections directly in the network and in endpoints: encrypt data in transit with TLS or IPsec to render captured packets unreadable, use strong wireless security (like WPA3), segment networks and enforce 802.1X authentication, deploy authentication and access controls, and monitor traffic for anomalies with IDS/IPS. Relying on encryption alone is insufficient because not all data may be encrypted, keys can be compromised, and metadata or unencrypted management traffic can still be exposed. User awareness alone cannot prevent technical sniffing such as packet capture or rogue devices. And disabling defenses would remove protections across the stack. A comprehensive approach across all three areas gives the best protection against the broad sniffing attack surface.