300-415 · Question #443
Refer to the exhibit. An engineer is enabling command line access via MPLS for in-band management. Which command completes the partial SD-WAN interface configuration with the highest degree of…
The correct answer is A. sdwan interface GigabitEthernet0/0/1 allow-service sshd. To enable secure command line access for in-band management on an SD-WAN interface, the allow-service sshd command should be used.
Question
Options
- Asdwan interface GigabitEthernet0/0/1 allow-service sshd
- Bsdwan interface GigabitEthernet0/0/1 allow-service https
- Csdwan interface GigabitEthernet0/0/1 allow-service icmp
- Dsdwan interface GigabitEthernet0/0/1 allow-service all
How the community answered
(31 responses)- A94% (29)
- B3% (1)
- D3% (1)
Why each option
To enable secure command line access for in-band management on an SD-WAN interface, the `allow-service sshd` command should be used.
The `allow-service sshd` command enables Secure Shell (SSH) access, which provides secure command-line management for the device over the specified interface and is considered the most secure option for command-line access.
`allow-service https` enables web-based graphical user interface (GUI) access, not command-line access.
`allow-service icmp` allows Internet Control Message Protocol (ICMP) for diagnostic purposes like ping, not for command-line management.
`allow-service all` enables all possible services, which significantly reduces the security posture by exposing unnecessary services and increasing the attack surface.
Concept tested: SD-WAN interface allow-service configuration for secure management
Source: https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/sdwan-xe-gs-cr-book/sdwan-interfaces.html
Topics
Community Discussion
No community discussion yet for this question.