350-401 Question 239
Select 4A network administrator needs to restrict access to a Cisco router to certain administrative users. The administrator has been instructed to configure device access control using local authentication and encrypted passwords. Which configuration steps should the administrator take to achieve this?
- A
Enable the 'enable secret' command with a secure password
- B
Configure a local user database with usernames and passwords
- C
Enable 'login local' on the console and vty lines
- D
Set the 'service password-encryption' command
- E
Apply an ACL to allow access only from specific IP ranges
Show answer and explanation
Correct answers: A, B, C, D
Explanation
To configure and verify device access control using local authentication and encrypted passwords, the administrator needs to define a secure enable secret password, create a local user database, and configure the device to use that database by enabling 'login local' on access lines. Additionally, the 'service password-encryption' command ensures all passwords in the configuration are encrypted. Applying an ACL is an additional security measure but not mandatory for this specific scenario.
- A. Correct.
Correct: The 'enable secret' command encrypts the privileged EXEC mode password, providing secure access to the router.
- B. Correct.
Correct: A local user database is required to authenticate users attempting to log into the router.
- C. Correct.
Correct: The 'login local' command ensures the router uses the local user database for authentication on the console and vty lines.
- D. Correct.
Correct: The 'service password-encryption' command ensures that all plain-text passwords in the configuration file are encrypted.
- E. Incorrect.
Incorrect: While applying an ACL to restrict access by IP is a good security practice, it is not explicitly required to implement local authentication and encrypted passwords.