Pass Your Cisco 350-401 Exam Easy!

Bind an appropriate standard access-class to VTY management connections from the approved source subnet would not enable SSH version 2 with appropriate local/domain keys and restrict VTY transport input to SSH.

Setting the required hostname/domain and generating supported SSH host keys would not enable SSH version 2 with appropriate local/domain keys and restrict VTY transport input to SSH.

Creating local administrator usernames with appropriately protected secrets and making the VTY lines use local login under SSH would not enable SSH version 2 with appropriate local/domain keys and restrict VTY transport input to SSH.

This test measures a different behavior: Attempt SSH from an allowed jump host and a disallowed user subnet without disturbing data-plane traffic. It does not establish the target outcome. For the documented fault, the direct acceptance test is: attempt Telnet and SSH connections from an approved host and confirm only encrypted SSH is accepted.

This test measures a different behavior: Inspect VTY authentication settings and verify a named account succeeds while an unknown account is rejected. It does not establish the target outcome. For the documented fault, the direct acceptance test is: attempt Telnet and SSH connections from an approved host and confirm only encrypted SSH is accepted.

This test measures a different behavior: Inspect SSH server version/key status and complete a secure login from an authorized station. It does not establish the target outcome. For the documented fault, the direct acceptance test is: attempt Telnet and SSH connections from an approved host and confirm only encrypted SSH is accepted.

That diagnosis is supported by a different symptom: A workstation from an untrusted user VLAN can open the switch SSH login prompt. Here the recorded observation is: the router still accepts plaintext Telnet sessions after the administrator creates an RSA key. The applicable cause is: vTY transport input still permits Telnet despite SSH being configured.

That diagnosis is supported by a different symptom: SSH cannot start even though a local account and VTY login method exist. Here the recorded observation is: the router still accepts plaintext Telnet sessions after the administrator creates an RSA key. The applicable cause is: vTY transport input still permits Telnet despite SSH being configured.

That diagnosis is supported by a different symptom: An operator logs in with a shared line password without any user-specific accountability. Here the recorded observation is: the router still accepts plaintext Telnet sessions after the administrator creates an RSA key. The applicable cause is: vTY transport input still permits Telnet despite SSH being configured.

That control reduces a separate risk: The SSH server lacks required host key material or device identity prerequisites. For the described design, the recurring risk arises from: vTY transport input still permits Telnet despite SSH being configured. The specific required safeguard is: review transport-input policy and management-path encryption after image upgrades.

That control reduces a separate risk: No effective source ACL is applied to VTY management access. For the described design, the recurring risk arises from: vTY transport input still permits Telnet despite SSH being configured. The specific required safeguard is: review transport-input policy and management-path encryption after image upgrades.

That control reduces a separate risk: The VTY lines use line password login rather than `login local` against named accounts. For the described design, the recurring risk arises from: vTY transport input still permits Telnet despite SSH being configured. The specific required safeguard is: review transport-input policy and management-path encryption after image upgrades.

Enabling SSH version 2 with appropriate local/domain keys and restricting VTY transport input to SSH would not set the required hostname/domain and generate supported SSH host keys.

Bind an appropriate standard access-class to VTY management connections from the approved source subnet would not set the required hostname/domain and generate supported SSH host keys.

Configuring supported login security controls such as quiet-mode thresholds and login block-for on the appropriate IOS release would not set the required hostname/domain and generate supported SSH host keys.

This test measures a different behavior: Generate controlled failed logins and confirm a temporary lockout with useful audit events. It does not establish the target outcome. For the documented fault, the direct acceptance test is: inspect SSH server version/key status and complete a secure login from an authorized station.

This test measures a different behavior: Attempt SSH from an allowed jump host and a disallowed user subnet without disturbing data-plane traffic. It does not establish the target outcome. For the documented fault, the direct acceptance test is: inspect SSH server version/key status and complete a secure login from an authorized station.

This test measures a different behavior: Attempt Telnet and SSH connections from an approved host and confirm only encrypted SSH is accepted. It does not establish the target outcome. For the documented fault, the direct acceptance test is: inspect SSH server version/key status and complete a secure login from an authorized station.

That diagnosis is supported by a different symptom: The router still accepts plaintext Telnet sessions after the administrator creates an RSA key. Here the recorded observation is: sSH cannot start even though a local account and VTY login method exist. The applicable cause is: the SSH server lacks required host key material or device identity prerequisites.

That diagnosis is supported by a different symptom: An external host attempts unlimited SSH passwords without temporary throttling. Here the recorded observation is: sSH cannot start even though a local account and VTY login method exist. The applicable cause is: the SSH server lacks required host key material or device identity prerequisites.

That diagnosis is supported by a different symptom: A workstation from an untrusted user VLAN can open the switch SSH login prompt. Here the recorded observation is: sSH cannot start even though a local account and VTY login method exist. The applicable cause is: the SSH server lacks required host key material or device identity prerequisites.

That control reduces a separate risk: No effective source ACL is applied to VTY management access. For the described design, the recurring risk arises from: the SSH server lacks required host key material or device identity prerequisites. The specific required safeguard is: plan key regeneration and supported minimum key length during device replacement.

A local login account supports authenticated SSH management, but it does not supply the hostname and domain prerequisites for RSA host-key creation.

Enabling SSHv2 and limiting VTY transport does not fix the missing platform hostname/domain information that caused key generation to fail.

The environment has login records but not privileged command accounting. Privilege separation or enable-secret control is missing or overly permissive.

The VTY lines use line password login rather than `login local` against named accounts. Privilege separation or enable-secret control is missing or overly permissive.

No effective source ACL is applied to VTY management access. Privilege separation or enable-secret control is missing or overly permissive.

This test measures a different behavior: Make a benign configuration change and correlate the command event with the named operator. It does not establish the target outcome. For the documented fault, the direct acceptance test is: test privileged configuration mode as both an authorized admin and a low-privilege operator.

This test measures a different behavior: Inspect VTY authentication settings and verify a named account succeeds while an unknown account is rejected. It does not establish the target outcome. For the documented fault, the direct acceptance test is: test privileged configuration mode as both an authorized admin and a low-privilege operator.

This test measures a different behavior: Attempt SSH from an allowed jump host and a disallowed user subnet without disturbing data-plane traffic. It does not establish the target outcome. For the documented fault, the direct acceptance test is: test privileged configuration mode as both an authorized admin and a low-privilege operator.

That diagnosis is supported by a different symptom: A workstation from an untrusted user VLAN can open the switch SSH login prompt. Here the recorded observation is: a read-only operations user can enter configuration mode without authorization. The applicable cause is: privilege separation or enable-secret control is missing or overly permissive.

That diagnosis is supported by a different symptom: An operator logs in with a shared line password without any user-specific accountability. Here the recorded observation is: a read-only operations user can enter configuration mode without authorization. The applicable cause is: privilege separation or enable-secret control is missing or overly permissive.

That diagnosis is supported by a different symptom: A configuration change is logged only as a device commit with no associated user command identity. Here the recorded observation is: a read-only operations user can enter configuration mode without authorization. The applicable cause is: privilege separation or enable-secret control is missing or overly permissive.