Examkin

Question

Difficulty: MediumDevice Access Control and Local Password Authentication

A network administrator needs to harden administrative access on a Cisco IOS XE router. The requirement specifies that users connecting via SSH must authenticate against the local device user database, and privileged EXEC mode access must be protected using Type 9 (scrypt) password hashing. Which two CLI configuration tasks must be performed to meet these security requirements? (Select two.)

  1. Configure enable secret algorithm-type scrypt <password> in global configuration mode.Answer
  2. Execute the login local command under line vty configuration mode.Answer
  3. C
    Enable service password-encryption in global configuration mode to convert existing enable secret passwords into Type 9 hashes.
  4. D
    Configure the login command without additional parameters under line vty configuration mode to trigger local database lookup.

Answer

The two required CLI configuration tasks are configuring enable secret algorithm-type scrypt <password> in global configuration mode and executing login local under line vty configuration mode.
Configuring enable secret with the algorithm-type scrypt option enforces strong Type 9 hashing for privileged EXEC access, and issuing login local under line vty mode forces VTY remote access to validate credentials against local user database accounts.

Step-by-Step Solution

1
Identify the command required to enforce strong Type 9 privileged EXEC password protection.
Executing enable secret algorithm-type scrypt <password> creates a Type 9 password hash using the scrypt key derivation function for privileged EXEC mode.
Cisco IOS XE supports Type 9 scrypt encryption, which provides significantly stronger protection than standard Type 5 MD5 or Type 7 obfuscation.
2
Identify the line configuration command required for local user database authentication on VTY lines.
Navigating to line vty configuration mode and executing login local configures VTY sessions to authenticate incoming connections against accounts created in the local database.
Using the standalone login command checks only a line-level password, whereas login local directs authentication to the local username database.

Key Concept

Cisco IOS Local User Authentication and Password Hashing Types
Rate this question

Topics

Device Access Control and Local Password Authentication

More questions from this topic