200-301 Question 391
Select 3A network administrator is tasked with configuring a Cisco router for remote management using SSH. The administrator has already set the hostname to 'Router1' and the domain name to 'example.com'. What additional steps must the administrator take to ensure secure SSH access?
- A
Generate an RSA key pair using the 'crypto key generate rsa' command
- B
Create a local user account with a username and password
- C
Enable the Telnet protocol on the router using the 'line vty' configuration
- D
Configure the 'transport input ssh' command under the VTY lines
- E
Disable the 'service password-encryption' command to simplify password management
Show answer and explanation
Correct answers: A, B, D
Explanation
To configure a Cisco router for secure remote access using SSH, the administrator must generate an RSA key pair for encryption, create local user accounts for authentication, and restrict the VTY lines to only accept SSH connections. These steps ensure secure communication and prevent unauthorized access via insecure protocols such as Telnet.
- A. Correct.
Correct: Generating an RSA key pair is necessary to enable SSH on the router because SSH requires encryption keys for secure communication.
- B. Correct.
Correct: Creating a local user account is required for SSH authentication, as it provides credentials for users to log into the router securely.
- C. Incorrect.
Incorrect: The Telnet protocol is insecure and is not required for SSH configuration. SSH should be used instead to ensure secure remote access.
- D. Correct.
Correct: Configuring 'transport input ssh' under the VTY lines ensures that only SSH connections are accepted, preventing insecure Telnet access.
- E. Incorrect.
Incorrect: Disabling the 'service password-encryption' command makes passwords visible in the router's configuration, which is a security risk and not required for SSH setup.