Examkin

Question

Difficulty: MediumDevice Access Control and Local Password Authentication

A network administrator is configuring initial administrative access security on a Cisco IOS XE router for remote management via SSH. Which TWO commands or configuration actions are required to enforce local database user authentication on the VTY lines and ensure local account passwords are saved using the scrypt (Type 9) hashing algorithm? (Select two.)

  1. Execute the username <name> algorithm-type scrypt secret <password> command in global configuration mode.Answer
  2. Execute the login local command under line vty configuration mode.Answer
  3. C
    Enable service password-encryption in global configuration mode to upgrade secret passwords to Type 9 scrypt hashes.
  4. D
    Configure enable password algorithm-type scrypt under line vty configuration mode.

Answer

The correct configuration requires executing 'username <name> algorithm-type scrypt secret <password>' in global configuration mode and executing 'login local' under line vty configuration mode.
To secure device access using local accounts with strong password storage, administrators must define local accounts using 'username <name> algorithm-type scrypt secret <password>' in global configuration mode. Furthermore, to instruct VTY lines to authenticate inbound SSH connections against these local accounts, the 'login local' command must be configured under line vty mode.

Step-by-Step Solution

1
Configure a local user account using scrypt encryption
Creating the user account with 'username <name> algorithm-type scrypt secret <password>' in global configuration mode stores the password as a Type 9 scrypt hash.
Type 9 scrypt hashing offers high resistance to brute-force attacks compared to older hashing types.
2
Enforce local database authentication on VTY lines
Entering line vty configuration mode (e.g., 'line vty 0 4') and applying 'login local' configures the virtual terminal lines to prompt for local credentials.
By default, VTY lines require explicit configuration to check credentials against the local username/password database.

Key Concept

Device Access Control and Local Password Hashing (Type 9 scrypt and VTY login local configuration)
Rate this question

Topics

Device Access Control and Local Password Authentication

More questions from this topic