200-301 Question 393
Select 3You are tasked with configuring SSH on a Cisco router to allow secure remote access. After setting a hostname and domain name, you generate an RSA key and configure the VTY lines. Which of the following steps are necessary to complete the configuration and ensure only SSH access is allowed?
- A
Create a local username and password for authentication.
- B
Enable the 'transport input ssh' command on the VTY lines.
- C
Assign an IP address to the router's management interface.
- D
Use the command 'enable secret' to configure a privileged EXEC mode password.
- E
Generate a DSA key in addition to the RSA key for enhanced security.
Show answer and explanation
Correct answers: A, B, C
Explanation
To configure SSH for secure remote access, you must create a local username and password, enable SSH-only access on the VTY lines, and assign an IP address to the router's management interface for connectivity. These steps ensure secure and functional SSH access. The 'enable secret' command and DSA key generation are unrelated or unnecessary for SSH configuration.
- A. Correct.
Correct. A local username and password must be created to authenticate SSH users unless an external authentication method is used.
- B. Correct.
Correct. The 'transport input ssh' command ensures that only SSH, not Telnet, is allowed on the VTY lines.
- C. Correct.
Correct. An IP address is required on the management interface (e.g., a Loopback or physical interface) to allow remote SSH connections.
- D. Incorrect.
Incorrect. While the 'enable secret' command secures privileged EXEC mode, it is not directly related to configuring SSH.
- E. Incorrect.
Incorrect. Only an RSA key is required for SSH configuration. Generating a DSA key is unnecessary and irrelevant in this context.