300-440 Question 252
Select 4You are configuring a new Cisco router for remote and local access. To provide secure remote management and limit access to specific IP addresses, you configure the VTY lines. However, you also need to ensure local console access is available in case of remote access failure. Which of the following configurations should you implement?
- A
Configure an access-class on the VTY lines to restrict access by IP address.
- B
Set a password for the console line and enable login.
- C
Configure SSH on the router and disable Telnet on the VTY lines.
- D
Leave the console line without a password to allow emergency access.
- E
Use the 'exec-timeout' command to set a timeout for VTY sessions.
Show answer and explanation
Correct answers: A, B, C, E
Explanation
To securely configure console and VTY access, you need to implement measures such as access control for VTY lines, enabling SSH, and securing the console line with a password. Additionally, using the 'exec-timeout' command ensures inactive sessions are terminated. Leaving the console line without a password is a security risk and should be avoided.
- A. Correct.
Configuring an access-class on the VTY lines ensures access is restricted to specific IP addresses, which enhances security for remote management.
- B. Correct.
Setting a password on the console line and enabling login ensures that local access is protected, even if remote access fails.
- C. Correct.
SSH is a secure protocol for remote access, and disabling Telnet prevents the use of an insecure protocol, which is a best practice.
- D. Incorrect.
Leaving the console line without a password is a security risk, as it allows anyone with physical access to log in without authentication.
- E. Correct.
Using the 'exec-timeout' command for VTY sessions ensures inactive connections are terminated, which helps enhance security and optimize resource usage.