Examkin

Question

Difficulty: HardNetwork Device Hardening Best Practices

A network security administrator is deploying a core Layer 3 router into an enterprise environment. To establish secure administrative remote access, the administrator must configure the management plane from the local console port before exposing the device to the network. In what chronological order should the administrator perform the following hardening steps to correctly enable encrypted remote management?

  1. 1Configure a unique system hostname and IP domain name on the router.
  2. 2Generate persistent RSA asymmetric encryption key pairs with a minimum length of 2048 bits.
  3. 3Configure local administrative user credentials and enforce SSH transport on the virtual terminal (VTY) lines while disabling cleartext protocols.
  4. 4Apply an inbound access control list (ACL) to the VTY lines to restrict management access exclusively to authorized administration subnets.

Answer

The correct sequence for hardening remote management plane access is: 1) Configure a unique system hostname and IP domain name on the router, 2) Generate persistent RSA asymmetric encryption key pairs, 3) Configure local administrative user credentials and enforce SSH transport on the VTY lines while disabling cleartext protocols, 4) Apply an inbound access control list (ACL) to the VTY lines to restrict management access exclusively to authorized administration subnets.
Establishing secure administrative remote access on network hardware follows a strict dependency chain: the device identity (hostname and domain name) must exist first so that RSA host keys can be generated. Once keys exist, the SSH daemon can be enabled on VTY lines and Telnet disabled. Finally, access control lists are applied to the VTY lines to restrict inbound management traffic strictly to authorized management subnets.

Step-by-Step Solution

1
Define the system identity by assigning a hostname and domain name.
The device forms its Fully Qualified Domain Name (FQDN), which is required by key generation utilities.
Cryptographic key generation algorithms fail or use default temporary parameters if the device lacks a domain identity.
2
Execute the crypto key generation command to build asymmetric RSA host keys.
The router creates and stores public/private key pairs used for SSH transport encryption.
SSH protocol daemons cannot initialize or negotiate secure sessions without pre-generated host keys.
3
Configure local AAA/user authentication and set VTY line transport input to SSH only.
Unencrypted Telnet management access is disabled, and remote connections require encrypted SSH authentication.
Restricting transport lines to SSH ensures credentials and session data are protected against eavesdropping.
4
Create and bind an inbound IPv4/IPv6 ACL to the VTY lines.
Remote management attempts from unauthorized IP addresses or subnets are dropped at the interface level.
Restricting source IP addresses adds defense-in-depth, mitigating brute-force and unauthorized access attempts against the management plane.

Key Concept

Management Plane Hardening & SSH Infrastructure Deployment Sequence
Estimated Time:2m 0s
Rate this question

Topics

Network Device Hardening Best Practices

More questions from this topic