Cisco

200-301 · Question #244

Refer to the exhibit. What configuration on RTR-1 denies SSH access from PC-1 to any RTR-1 interface and allows all other traffic? A. B. C. D.

The correct answer is B. access-list 100 deny tcp host 172.16.1.33 any eq 22 access-list 100 permit ip any any line vty 0 15 access-class 100 in. Option B is correct because it uses port 22 (SSH) in the ACL to block PC-1's IP (172.16.1.33) from SSHing to any destination, and applies it with 'access-class 100 in' on the VTY lines (line vty 0 15). Applying the ACL to the VTY lines is the proper method to restrict management

Submitted by femi9· Mar 5, 2026Infrastructure Security / Network Access Control - configuring ACLs to restrict management plane access (SSH/Telnet) on Cisco routers using access-class on VTY lines

Question

Refer to the exhibit. What configuration on RTR-1 denies SSH access from PC-1 to any RTR-1 interface and allows all other traffic? A. B. C. D.

Exhibits

200-301 question #244 exhibit 1

200-301 question #244 exhibit 2

200-301 question #244 exhibit 3

200-301 question #244 exhibit 4

200-301 question #244 exhibit 5

200-301 question #244 exhibit 6

200-301 question #244 exhibit 7

200-301 question #244 exhibit 8

200-301 question #244 exhibit 9

200-301 question #244 exhibit 10

Options

Aaccess-list 100 deny tcp host 172.16.1.33 any eq 22 access-list 100 permit ip any any interface GigabitEthernet0/0 ip access-group 100 in
Baccess-list 100 deny tcp host 172.16.1.33 any eq 22 access-list 100 permit ip any any line vty 0 15 access-class 100 in
Caccess-list 100 deny tcp host 172.16.1.33 any eq 23 access-list 100 permit ip any any interface GigabitEthernet0/0 ip access-group 100 in
Daccess-list 100 deny tcp host 172.16.1.33 any eq 23 access-list 100 permit ip any any line vty 0 15 access-class 100 in

How the community answered

(30 responses)

A
20% (6)
B
70% (21)
C
7% (2)
D
3% (1)

Explanation

Option B is correct because it uses port 22 (SSH) in the ACL to block PC-1's IP (172.16.1.33) from SSHing to any destination, and applies it with 'access-class 100 in' on the VTY lines (line vty 0 15). Applying the ACL to the VTY lines is the proper method to restrict management access (SSH/Telnet) to the router itself, regardless of which interface the traffic arrives on - ensuring all RTR-1 interfaces are protected.

Topics

#Access Control Lists#SSH Security#VTY Lines#Router Management Access

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion

Full 200-301 Practice