Examkin

Soru

Zorluk: OrtaNetwork Device Hardening Best Practices

A network administrator is configuring the management plane of an enterprise router to comply with baseline device hardening standards. The security policy mandates that all remote command-line management sessions use encrypted transport protocols, idle administrative sessions terminate automatically after 55 minutes of inactivity, and VTY access be restricted strictly to hosts within the internal management subnet (10.10.50.0/2410.10.50.0/24). Which set of configuration commands on the virtual terminal (VTY) lines correctly enforces this hardening policy?

  1. Configure `transport input ssh`, set `exec-timeout 5 0`, and apply an inbound IPv4 Access Control List restricting source addresses to `10.10.50.0/24`.Cevap
  2. B
    Configure `transport input telnet ssh`, set `exec-timeout 0 5`, and apply an outbound IPv4 Access Control List allowing `10.10.50.0/24`.
  3. C
    Configure `transport input ssh`, set `exec-timeout 0 0`, and assign an SNMPv2c read-write community string to filter VTY line traffic.
  4. D
    Configure `transport input all`, set `exec-timeout 500`, and rely on TACACS+ authentication without applying line access-class filtering.

Cevap

The configuration that sets `transport input ssh`, `exec-timeout 5 0`, and an inbound Access Control List for `10.10.50.0/24` correctly fulfills all baseline management plane hardening requirements.
The option specifying `transport input ssh`, `exec-timeout 5 0`, and an inbound IPv4 Access Control List for `10.10.50.0/24` correctly satisfies all policy controls: SSH ensures transport encryption, `exec-timeout 5 0` enforces a 5-minute idle limit, and the inbound ACL restricts access exclusively to the authorized management subnet.

Adım Adım Çözüm

1
Identify the required secure management protocol
Disabling Telnet (port 23) and explicitly enabling SSH (port 22) via `transport input ssh` prevents eavesdropping and credential theft across the management network.
Cleartext management protocols violate baseline security policies.
2
Determine the syntax for the 5-minute idle session timeout
`exec-timeout 5 0` specifies 5 minutes and 0 seconds of allowed idle time before automatically logging out the administrative session.
Using `0 5` specifies 5 seconds, while `0 0` disables the timeout entirely, leaving sessions exposed.
3
Apply source network access restriction on VTY lines
An inbound access class referencing an ACL for `10.10.50.0/2410.10.50.0/24` ensures only authorized administrative hosts can initiate VTY connections.
Inbound filtering stops unauthorized connection attempts at the network layer before authentication is attempted.

Anahtar Kavram

Management Plane Hardening via VTY Line Security Controls
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Network Device Hardening Best Practices

Bu konudan daha fazla soru