Examkin

Soru

Zorluk: Çok zorDevice Access Control and Local Password Authentication

A network security architect is hardening a newly initialized Cisco IOS XE enterprise router. Arrange the following CLI configuration commands in the mandatory order required to establish local database authentication for remote management, ensuring that local privileged credentials using scrypt hashing are created prior to entering the line context, local authentication is bound to the VTY lines, and unencrypted management sessions are blocked.

  1. 1username netsec_admin privilege 15 algorithm-type scrypt secret C!sc0_Sec#2026
  2. 2line vty 0 4
  3. 3login local
  4. 4text transport input ssh

Cevap

The correct sequence of CLI operations begins in global configuration mode by defining the local administrative account with scrypt secret encryption ('username netsec_admin privilege 15 algorithm-type scrypt secret C!sc0_Sec#2026'). Next, enter line subconfiguration mode ('line vty 0 4'). Within the line context, enable local database lookup ('login local'), and finally restrict line access protocols strictly to SSH ('transport input ssh').
The proper administrative sequence requires creating the global local database account first using 'username netsec_admin privilege 15 algorithm-type scrypt secret C!sc0_Sec#2026'. Once the account exists, the administrator enters VTY line submode with 'line vty 0 4', binds line authentication to the local database using 'login local', and secures line transport by executing 'transport input ssh'.

Adım Adım Çözüm

1
Define local administrative credentials in global configuration mode.
The local database contains an administrative account with privilege level 15 secured with a high-strength Type 9 scrypt hash.
Creating the account first prevents administrator lockout when local line login enforcement is applied.
2
Navigate into line configuration context for remote VTY interfaces.
The terminal prompt changes to line configuration submode (config-line).
Subsequent line-specific authentication and transport parameters can only be applied inside the line subconfiguration context.
3
Configure VTY lines to enforce local database authentication.
Inbound connection attempts on VTY lines 0-4 now require authentication matching accounts defined in the local running-config database.
The 'login local' command replaces default password checking or unauthenticated line access with local username/password verification.
4
Enforce secure management transport protocols on VTY lines.
Telnet and all other unencrypted remote access protocols are prohibited; only encrypted SSH connections are accepted.
Restricting transport input guarantees remote login credentials and session data are protected against eavesdropping across the network.

Anahtar Kavram

Cisco IOS CLI hierarchy and local authentication dependency sequence
Bu soruyu puanla

Konular

Device Access Control and Local Password Authentication

Bu konudan daha fazla soru