Examkin

Question

Difficulty: HardDevice Access Control and Local Password Authentication

A network engineer applies the following local authentication and access configuration to a Cisco IOS XE router:

text
username opsuser privilege 7 secret OpsPass#2026
username auditor privilege 1 secret AuditPass#2026
enable secret EnablePass#2026
!
line vty 0 15
transport input ssh
login local

When `opsuser` successfully establishes an SSH session to the router using local database credentials, which initial operational state and privilege level behavior does the user experience?

  1. The user is placed directly into EXEC mode at privilege level 7 without needing to issue the enable command.Answer
  2. B
    The user is placed into user EXEC mode at privilege level 1 and must run 'enable 7' using the enable secret password to reach privilege level 7.
  3. C
    The user is automatically escalated to privilege level 15 because any non-default privilege level in the local database defaults to full administrative access.
  4. D
    The authentication attempt fails because VTY lines set to 'login local' reject user accounts that do not use scrypt password hashing.

Answer

The user is placed directly into EXEC mode at privilege level 7 without needing to issue the enable command.
When a local user account is created with an explicit privilege parameter (such as 'privilege 7'), Cisco IOS applies that privilege level immediately upon successful authentication via 'login local'. The user lands directly in EXEC mode at privilege level 7 with access to commands permitted at or below that level.

Step-by-Step Solution

1
Analyze local database user configuration
The user 'opsuser' is defined with explicit privilege level 7 using 'username opsuser privilege 7 secret OpsPass#2026'.
Explicit privilege level keywords in local user creation define the initial privilege level assigned to the session upon authentication.
2
Analyze line VTY access control settings
The VTY lines use 'login local' to authenticate inbound SSH sessions against the local user database.
'login local' instructs Cisco IOS to validate credentials against the local running configuration user database and apply associated user attributes.
3
Determine post-authentication session environment
Upon successful login, Cisco IOS grants the session privilege level 7 immediately with the CLI prompt showing 'opsuser#'.
Users with custom privilege levels defined in the local database bypass default user EXEC (level 1) restriction and enter directly at their configured level without requiring the 'enable' command.

Key Concept

Cisco IOS Local Database User Privilege Level Assignment and VTY Access Behavior
Estimated Time:2m 0s
Rate this question

Topics

Device Access Control and Local Password Authentication

More questions from this topic