Examkin

Question

Difficulty: MediumDevice Access Control and Local Password Authentication

A network engineer needs to configure secure SSH remote management on a Cisco IOS XE router using local database authentication. Place the CLI configuration steps in the correct logical and CLI dependency order from first to last.

  1. 1Configure the IP domain name in global configuration mode using `ip domain name enterprise.lab`.
  2. 2Generate the RSA key pair using `crypto key generate rsa general-keys modulus 2048`.
  3. 3Create a local administrative account using `username netadmin secret S3cur3!Pass2026`.
  4. 4Access virtual terminal line submode using `line vty 0 4`.
  5. 5Enforce local authentication and SSH transport using `login local` and `transport input ssh`.

Answer

The correct order of steps is: 1) Configure the IP domain name (`ip domain name enterprise.lab`), 2) Generate the RSA key pair (`crypto key generate rsa general-keys modulus 2048`), 3) Create a local user account with secret encryption (`username netadmin secret S3cur3!Pass2026`), 4) Enter VTY line configuration submode (`line vty 0 4`), and 5) Enforce local login and SSH protocol access (`login local` and `transport input ssh`).
To successfully enable SSH remote access authenticated by the local user database, CLI commands must follow specific mode hierarchy and operational dependencies. First, `ip domain name` must be configured in global configuration mode to form the system FQDN. Next, `crypto key generate rsa` creates the encryption keys required to initialize SSH server functionality. Third, a local user account is configured with `username secret`. Fourth, line configuration mode is entered via `line vty 0 4`. Finally, `login local` and `transport input ssh` are applied to enforce local database authentication and disallow unencrypted transport.

Step-by-Step Solution

1
Set the domain name in global configuration mode.
Defines the domain context required for cryptographic key creation.
Cisco IOS XE constructs the default RSA key pair name using host.domain syntax; without a domain name, SSH key generation fails or requests manual domain assignment.
2
Generate RSA keys for SSH encryption.
Activates the SSH server subsystem on the router.
SSH requires asymmetric key pairs to establish secure encrypted tunnels for remote sessions.
3
Define local database user credentials.
Adds an administrative username with a Type 5 or Type 8/9 secret hash to the local running configuration.
Local password authentication relies on pre-created accounts in the local device database.
4
Enter line VTY configuration submode (`line vty 0 4`).
Changes prompt context to line configuration mode.
Line-specific access controls must be executed within the target line context.
5
Apply `login local` and `transport input ssh` commands.
Enforces local database credential checking and blocks unencrypted protocols like Telnet.
`login local` instructs VTY lines to authenticate inbound connections against the local user database, while `transport input ssh` secures transport security.

Key Concept

Cisco IOS XE SSH configuration sequence and local database authentication dependencies
Estimated Time:1m 30s
Rate this question

Topics

Device Access Control and Local Password Authentication

More questions from this topic