nerdexam
Cisco

350-701 · Question #626

Refer to the exhibit. An engineer must enable secure SSH protocols and enters this configuration. What are two results of running this set of commands on a Cisco router? (Choose two.)

The correct answer is A. generates RSA key pairs on the router D. labels the key pairs to be used for SSH. The configuration to enable secure SSH protocols on a Cisco router, including commands like crypto key generate rsa, results in the generation of RSA key pairs and their labeling for use by SSH.

Submitted by dimitri_ru· Mar 30, 2026Network Security

Question

Refer to the exhibit. An engineer must enable secure SSH protocols and enters this configuration. What are two results of running this set of commands on a Cisco router? (Choose two.)

Exhibit

350-701 question #626 exhibit

Options

  • Agenerates RSA key pairs on the router
  • Benables SSHv1 on the router
  • Cuses the FQDN with the label command
  • Dlabels the key pairs to be used for SSH
  • Egenerates AES key pairs on the router

How the community answered

(53 responses)
  • A
    75% (40)
  • B
    4% (2)
  • C
    15% (8)
  • E
    6% (3)

Why each option

The configuration to enable secure SSH protocols on a Cisco router, including commands like `crypto key generate rsa`, results in the generation of RSA key pairs and their labeling for use by SSH.

Agenerates RSA key pairs on the routerCorrect

The `crypto key generate rsa` command is explicitly used to generate a Rivest-Shamir-Adleman (RSA) key pair on the router, which is a fundamental requirement for enabling secure protocols like SSH.

Benables SSHv1 on the router

Enabling SSHv2 (`ip ssh version 2`) explicitly disables SSHv1 due to security vulnerabilities; therefore, SSHv1 would not be enabled.

Cuses the FQDN with the label command

While the FQDN is often used to *label* the key pairs by default, the command itself doesn't *use* the FQDN in its syntax unless it's explicitly part of a `label` argument; rather, the FQDN might become the *name* of the generated key.

Dlabels the key pairs to be used for SSHCorrect

When `crypto key generate rsa` is executed, the generated key pair is labeled, either implicitly by the router's fully qualified domain name (FQDN) or explicitly if the `label` keyword is used, making it available for applications like SSH.

Egenerates AES key pairs on the router

AES is a symmetric encryption algorithm, not a key generation algorithm; RSA is the asymmetric algorithm used for key generation and exchange for SSH.

Concept tested: SSH key generation and labeling

Source: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/d1/sec-d1-cr-book/sec-cr-a1.html

Topics

#Cisco SSH config#RSA key generation#Key labeling#Router security

Community Discussion

No community discussion yet for this question.

Full 350-701 Practice