200-301 · Question #1520
An administrator is configuring a Cisco Catalyst switch so that it will accept management connections only from hosts in the 203.0.113.0/24 network. Other traffic passing through the switch must trans
The correct answer is B. line vty 0 15 C. ip access-list standard Management. To restrict management access to a Cisco Catalyst switch to hosts from a specific network, a standard IP access list must be defined and then applied to the virtual teletype (VTY) lines.
Question
An administrator is configuring a Cisco Catalyst switch so that it will accept management connections only from hosts in the 203.0.113.0/24 network. Other traffic passing through the switch must transit without interruption. Which two configurations must the engineer apply to the router? (Choose two.)
Options
- Ainterface range vlan 1 - 4094
- Bline vty 0 15
- Cip access-list standard Management
- Dip access-list standard Management
- Eip access-list extended Management
How the community answered
(46 responses)- A7% (3)
- B74% (34)
- D4% (2)
- E15% (7)
Why each option
To restrict management access to a Cisco Catalyst switch to hosts from a specific network, a standard IP access list must be defined and then applied to the virtual teletype (VTY) lines.
The `interface range vlan 1 - 4094` command is used to configure a range of VLAN interfaces, which is not directly related to restricting VTY access.
The `line vty 0 15` command enters configuration mode for the virtual teletype (VTY) lines, which are used for remote management access via Telnet or SSH, allowing an access list to be applied to control who can connect. (C) The `ip access-list standard Management` command is used to create a standard IP access list named "Management," which can then be configured to permit only the 203.0.113.0/24 network for management access while implicitly denying all other sources.
An `ip access-list extended Management` is generally used for more granular filtering based on source/destination IP, port numbers, or protocols, making it less appropriate than a standard ACL for simply source IP-based VTY access control.
Concept tested: Standard ACLs for VTY access
Source: https://www.cisco.com/c/en/us/td/docs/ios/security/security_management/configuration/guide/sec_cfg_acls_ps_gs_cbook.html#wp1063630
Topics
Community Discussion
No community discussion yet for this question.