Examkin

Question

Difficulty: HardSSH Secure Remote Access Configuration and Verification

A security review on an enterprise switch named Core-SW1 reveals that virtual terminal sessions allow plain-text remote management and bypass local account verification. To harden management access on Core-SW1, which TWO commands must be configured specifically under line VTY configuration mode (config-line) to enforce local account credentials and restrict incoming traffic exclusively to SSH?

  1. login localAnswer
  2. transport input sshAnswer
  3. C
    ip ssh version 2
  4. D
    crypto key generate rsa modulus 2048

Answer

The correct commands to configure under line VTY configuration mode are 'login local' and 'transport input ssh'.
Securing virtual terminal (VTY) lines requires configuration within line subconfiguration mode (config-line). The command 'login local' ensures that any user connecting via VTY lines must authenticate against locally configured username accounts. The command 'transport input ssh' locks down line access so that only encrypted SSH sessions are permitted, disabling clear-text protocols like Telnet.

Step-by-Step Solution

1
Identify the CLI context required for line-specific remote access security controls.
Line configuration mode (config-line) is accessed via the command 'line vty 0 15'.
VTY lines handle inbound network connection sessions.
2
Select the line command that requires local database credentials.
The 'login local' command binds line authentication to local user accounts created in global configuration mode.
Without 'login local', VTY lines either request a simple line password or permit unauthenticated access.
3
Select the line command that filters inbound remote management traffic protocols.
The 'transport input ssh' command restricts incoming protocol traffic exclusively to SSH.
By default, Cisco IOS line VTY sessions allow incoming Telnet connections unless restricted.

Key Concept

VTY Line Security Configuration for SSH Access
Rate this question

Topics

SSH Secure Remote Access Configuration and Verification

More questions from this topic