SY0-701 Question 327
Single answerImplementation of secure protocols: Protocol selection , Port selection , Transport methodA security administrator is replacing several legacy remote administration services used by network engineers. The new solution must provide encrypted command-line access to routers and switches across the internal network, support strong authentication, and avoid sending credentials in cleartext. The firewall team also wants to allow only the minimum required port through internal segmentation firewalls. Which protocol should the administrator select?
- A
SSH over TCP port 22
- B
Telnet over TCP port 23
- C
SNMPv2c over UDP port 161
- D
TFTP over UDP port 69
Show answer and explanation
Correct answer: A
Explanation
The best choice is SSH over TCP port 22 because the scenario requires secure remote administration with encrypted command-line access and protection of credentials in transit. SSH is the industry-standard protocol for this use case and is specifically designed for secure remote login and command execution. TCP is the correct transport because SSH depends on reliable, stateful communication for an interactive session. By contrast, Telnet over TCP 23 is legacy and insecure because it sends data in plaintext. SNMPv2c over UDP 161 is for monitoring and limited management operations, not interactive shell access, and it lacks modern security protections. TFTP over UDP 69 is for lightweight file transfer and is also insecure for administrative access. Best practices from vendors such as Cisco, Juniper, and major operating system providers consistently recommend disabling Telnet and using SSH for device and server administration.
- A. Correct.
Correct. SSH provides encrypted remote command-line administration, protects credentials and session data in transit, and commonly uses TCP port 22. It is the standard secure replacement for Telnet for administrative access to network devices and servers. TCP is appropriate because SSH requires reliable, connection-oriented delivery for an interactive management session.
- B. Incorrect.
Incorrect. Telnet uses TCP port 23 and does provide remote command-line access, but it transmits credentials and session traffic in cleartext. That makes it unsuitable for secure administration on modern networks. A candidate might choose this option because the scenario involves command-line access, but the requirement for encryption and strong authentication rules it out.
- C. Incorrect.
Incorrect. SNMPv2c commonly uses UDP port 161 for management queries, but it is not intended for interactive command-line administration. In addition, SNMPv2c relies on community strings rather than modern secure authentication and encryption. Someone might select this because it is used to manage network devices, but it does not meet the remote shell requirement.
- D. Incorrect.
Incorrect. TFTP uses UDP port 69 and is designed for simple file transfers, such as moving configuration files or boot images. It does not provide interactive administrative sessions, and it lacks built-in encryption and robust authentication. This distractor is plausible because network engineers often use TFTP with network equipment, but it does not satisfy the scenario's requirements.