220-1102 Question 544
Single answerConfigure secure management accessA technician needs to remotely administer a Linux server at a branch office over the internet. The current setup uses Telnet, and the company security policy now requires encrypted remote management and support for key-based authentication. Which solution should the technician implement to BEST meet these requirements?
- A
Replace Telnet with SSH and disable password logins after validating key-based access
- B
Continue using Telnet, but change the default port and require a complex password
- C
Use FTP with local accounts because it can transfer configuration files securely
- D
Enable RDP on the Linux server and allow access through the firewall from any source
Show answer and explanation
Correct answer: A
Explanation
The best answer is to replace Telnet with SSH. For secure management access, best practice is to use encrypted protocols instead of legacy cleartext protocols such as Telnet and FTP. SSH provides confidentiality, integrity, and strong authentication options, including public/private key authentication, making it the standard choice for secure remote administration of Linux systems. A+ candidates should recognize that simply changing ports or strengthening passwords does not secure an inherently insecure protocol. This aligns with common security guidance from organizations such as NIST, which recommends using encrypted administrative protocols and minimizing exposure of management services.
- A. Correct.
Correct. SSH is the standard secure protocol for remote command-line administration on Linux and other systems. It encrypts management traffic in transit and supports public key authentication, which aligns with the requirement for encrypted access and key-based authentication. Disabling password logins after confirming key-based access further reduces the risk of brute-force and credential-based attacks.
- B. Incorrect.
Incorrect. Changing Telnet's port and using stronger passwords does not fix Telnet's core problem: it transmits credentials and session data in cleartext. This is a common misconception because port changes may reduce casual scanning, but they do not provide encryption or meaningful protection against interception.
- C. Incorrect.
Incorrect. FTP is not a remote management protocol and traditional FTP is not secure because credentials and data are sent unencrypted. Even if the goal included file transfer, secure alternatives such as SFTP or SCP would be more appropriate, but neither would replace SSH's interactive management capabilities by themselves in this scenario.
- D. Incorrect.
Incorrect. Standard RDP is associated with Windows remote desktop administration, not typical Linux command-line server management in this context. In addition, exposing remote management broadly through a firewall from any source is poor security practice. This option does not directly satisfy the stated requirement for key-based authentication.