Examkin

Question

Difficulty: HardDevice Access Control and Local Password Authentication

A network security architect is enforcing local authentication policies on a Cisco IOS XE router. The organization requires local user accounts to utilize scrypt key derivation hashing algorithms and mandates that remote management lines authenticate users against the local device database. Which TWO actions or configuration commands meet these requirements?

  1. Configure 'username admin algorithm-type scrypt secret P@ssw0rd123!' in global configuration mode.Answer
  2. B
    Configure 'service password-encryption' under global configuration mode.
  3. Execute 'login local' under the line vty configuration mode.Answer
  4. D
    Configure 'username admin password algorithm-type scrypt P@ssw0rd123!' in global configuration mode.

Answer

Configuring 'username admin algorithm-type scrypt secret P@ssw0rd123!' creates a local user account secured with Type 9 scrypt password hashing, and applying 'login local' under line vty forces virtual terminal connections to authenticate against the local user database.
Specifying 'username admin algorithm-type scrypt secret' creates a Type 9 hashed credential using the scrypt password-based key derivation function, satisfying the requirement for strong non-reversible local hashing. Applying 'login local' under VTY line configuration directs the router to authenticate VTY remote connections using the device's local user database.

Step-by-Step Solution

1
Identify the hashing algorithm requirement for local user database credentials.
Cisco IOS XE supports Type 9 password hashing using the scrypt algorithm by specifying 'username <name> algorithm-type scrypt secret <password>'.
Using the 'secret' command with 'algorithm-type scrypt' ensures passwords are stored using a strong, non-reversible key derivation function rather than legacy MD5 or reversible Type 7 algorithms.
2
Identify the requirement to authenticate remote management sessions against local accounts.
Entering line vty configuration mode and applying 'login local' enables local database lookup.
Without 'login local', VTY lines may default to password-only authentication ('login') or no authentication at all.

Key Concept

Cisco IOS Local Password Hashing Types and VTY Local Authentication
Rate this question

Topics

Device Access Control and Local Password Authentication

More questions from this topic