350-401 Question 237
Select 2A network administrator wants to restrict access to a Cisco device such that only users from a specific subnet (10.1.1.0/24) can access the device via SSH. Which of the following configurations should be applied to achieve this goal?
- A
Create an access control list (ACL) permitting 10.1.1.0/24, apply it to the VTY lines inbound.
- B
Enable SSH on the device and configure a local username and password for authentication.
- C
Configure an ACL permitting 10.1.1.0/24 and apply it globally to the device.
- D
Apply an ACL permitting 10.1.1.0/24 to the management interface of the device.
- E
Disable Telnet access and enable SSH-only access on VTY lines.
Show answer and explanation
Correct answers: A, E
Explanation
To restrict access to a Cisco device via SSH for a specific subnet, an ACL must be configured and applied to the VTY lines, which handle remote management access. Additionally, disabling Telnet ensures that only SSH, a secure protocol, is used for accessing the device. Configurations such as global ACLs or applying ACLs to the management interface do not achieve the desired restriction on SSH access to the specified subnet.
- A. Correct.
Correct: Applying an ACL to the VTY lines ensures that only traffic from the specified subnet can access the device via SSH.
- B. Incorrect.
Incorrect: While enabling SSH and configuring local authentication is necessary, it does not restrict access based on subnet.
- C. Incorrect.
Incorrect: Applying an ACL globally would affect all traffic passing through the device, not just management access via SSH.
- D. Incorrect.
Incorrect: Applying an ACL to the management interface does not restrict SSH traffic to the VTY lines, which is where SSH access is configured.
- E. Correct.
Correct: Disabling Telnet and enabling SSH-only access ensures secure remote access to the device.