350-501 · Question #305
A network engineer is testing an automation platform that interacts with Cisco networking devices via NETCONF over SSH. In accordance with internal security requirements: - NETCONF sessions are…
The correct answer is D. configure terminal. To meet security requirements, NETCONF over SSH must be restricted to a specific subnet while CLI SSH is permitted from any source. This requires applying an access-list specifically to the NETCONF service, rather than broadly to VTY lines.
Question
A network engineer is testing an automation platform that interacts with Cisco networking devices via NETCONF over SSH. In accordance with internal security requirements:
- NETCONF sessions are permitted only from trusted sources in the
172.16.20.0/24 subnet.
- CLI SSH access is permitted from any source.
Which configuration must the engineer apply on R1?
Options
- Aconfigure terminal
- Bconfigure terminal
- Cconfigure terminal
- Dconfigure terminal
How the community answered
(25 responses)- A16% (4)
- B4% (1)
- C4% (1)
- D76% (19)
Why each option
To meet security requirements, NETCONF over SSH must be restricted to a specific subnet while CLI SSH is permitted from any source. This requires applying an access-list specifically to the NETCONF service, rather than broadly to VTY lines.
This option is just "configure terminal" and provides no specific technical action or relevant configuration snippet to evaluate against the requirements of restricting NETCONF access selectively while allowing general SSH.
This option is just "configure terminal" and provides no specific technical action or relevant configuration snippet to evaluate against the requirements of restricting NETCONF access selectively while allowing general SSH.
This option is just "configure terminal" and provides no specific technical action or relevant configuration snippet to evaluate against the requirements of restricting NETCONF access selectively while allowing general SSH.
The `netconf-yang cnf-protocol ssh access-list <ACL_NAME>` command specifically applies an access-list to filter incoming NETCONF SSH sessions, allowing granular control for NETCONF while leaving general CLI SSH access (which typically operates on VTY lines) open to other sources. This configuration ensures that only traffic from the 172.16.20.0/24 subnet can initiate NETCONF over SSH connections (port 830), satisfying the security requirement.
Concept tested: NETCONF SSH access control, management plane security
Source: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/netconf/configuration/xe-3s/nc-xe-3s-book/nc-access-control.html
Topics
Community Discussion
No community discussion yet for this question.