Examkin

Question

Difficulty: MediumSSH Secure Remote Access Configuration and Verification

A network administrator is configuring secure management access on a newly deployed access switch named SW-ACCESS-03. The switch already has a non-default hostname and an active IP domain name configured. The organization requires that all remote administrative sessions use SSH version 2 and that legacy Telnet connections are explicitly blocked. Which two CLI configuration steps are required to complete this task? (Select TWO.)

  1. Execute 'crypto key generate rsa modulus 2048' in global configuration mode.Answer
  2. Execute 'transport input ssh' under the VTY line configuration mode.Answer
  3. C
    Execute 'crypto key generate rsa modulus 512' in global configuration mode.
  4. D
    Execute 'transport input telnet' under the VTY line configuration mode.

Answer

The required steps are generating an RSA key pair with a modulus size of 2048 bits in global configuration mode and applying 'transport input ssh' under VTY line configuration mode.
Generating an RSA key with a 2048-bit modulus enables SSH version 2 on Cisco IOS, as SSH v2 requires a key size of at least 768 bits. Additionally, configuring 'transport input ssh' on the VTY lines enforces SSH as the sole inbound management protocol, effectively blocking insecure Telnet connections.

Step-by-Step Solution

1
Generate an RSA key pair required for SSH operational readiness.
Executing 'crypto key generate rsa modulus 2048' creates an encryption key pair. Because the modulus is greater than or equal to 768 bits, SSH version 2 capability is enabled.
Cisco IOS requires an RSA key pair to enable the SSH server daemon. Modulus sizes lower than 768 bits restrict the daemon to SSH v1.5.
2
Restrict incoming line vty protocols to SSH only.
Entering line vty configuration mode and running 'transport input ssh' restricts incoming management connections exclusively to encrypted SSH sessions.
By default, VTY lines may allow Telnet or all protocols. Setting transport input to SSH prevents cleartext management traffic.

Key Concept

SSHv2 Prerequisites and VTY Protocol Binding
Rate this question

Topics

SSH Secure Remote Access Configuration and Verification

More questions from this topic