Pass Your Cisco 350-401 Exam Easy!

Setting the required hostname/domain and generating supported SSH host keys would not configure supported login security controls such as quiet-mode thresholds and login block-for on the appropriate IOS release.

Bind an appropriate standard access-class to VTY management connections from the approved source subnet would not configure supported login security controls such as quiet-mode thresholds and login block-for on the appropriate IOS release.

Creating local administrator usernames with appropriately protected secrets and making the VTY lines use local login under SSH would not configure supported login security controls such as quiet-mode thresholds and login block-for on the appropriate IOS release.

This test measures a different behavior: Inspect SSH server version/key status and complete a secure login from an authorized station. It does not establish the target outcome. For the documented fault, the direct acceptance test is: generate controlled failed logins and confirm a temporary lockout with useful audit events.

This test measures a different behavior: Inspect VTY authentication settings and verify a named account succeeds while an unknown account is rejected. It does not establish the target outcome. For the documented fault, the direct acceptance test is: generate controlled failed logins and confirm a temporary lockout with useful audit events.

This test measures a different behavior: Attempt SSH from an allowed jump host and a disallowed user subnet without disturbing data-plane traffic. It does not establish the target outcome. For the documented fault, the direct acceptance test is: generate controlled failed logins and confirm a temporary lockout with useful audit events.

That diagnosis is supported by a different symptom: SSH cannot start even though a local account and VTY login method exist. Here the recorded observation is: an external host attempts unlimited SSH passwords without temporary throttling. The applicable cause is: login attack mitigation thresholds and enforcement were not configured for the VTY service.

That diagnosis is supported by a different symptom: A workstation from an untrusted user VLAN can open the switch SSH login prompt. Here the recorded observation is: an external host attempts unlimited SSH passwords without temporary throttling. The applicable cause is: login attack mitigation thresholds and enforcement were not configured for the VTY service.

That diagnosis is supported by a different symptom: An operator logs in with a shared line password without any user-specific accountability. Here the recorded observation is: an external host attempts unlimited SSH passwords without temporary throttling. The applicable cause is: login attack mitigation thresholds and enforcement were not configured for the VTY service.

That control reduces a separate risk: The SSH server lacks required host key material or device identity prerequisites. For the described design, the recurring risk arises from: login attack mitigation thresholds and enforcement were not configured for the VTY service. The specific required safeguard is: tune login blocking to preserve approved emergency access and monitor lockout alerts.

That control reduces a separate risk: No effective source ACL is applied to VTY management access. For the described design, the recurring risk arises from: login attack mitigation thresholds and enforcement were not configured for the VTY service. The specific required safeguard is: tune login blocking to preserve approved emergency access and monitor lockout alerts.

That control reduces a separate risk: The VTY lines use line password login rather than `login local` against named accounts. For the described design, the recurring risk arises from: login attack mitigation thresholds and enforcement were not configured for the VTY service. The specific required safeguard is: tune login blocking to preserve approved emergency access and monitor lockout alerts.

Creating local administrator usernames with appropriately protected secrets and making the VTY lines use local login under SSH would not enable supported accounting/command logging for authenticated administrative sessions.

Enabling SSH version 2 with appropriate local/domain keys and restricting VTY transport input to SSH would not enable supported accounting/command logging for authenticated administrative sessions.

The needed correction is to enable supported accounting/command logging for authenticated administrative sessions.

This test measures a different behavior: Inspect VTY authentication settings and verify a named account succeeds while an unknown account is rejected. It does not establish the target outcome. For the documented fault, the direct acceptance test is: make a benign configuration change and correlate the command event with the named operator.

This test measures a different behavior: Test privileged configuration mode as both an authorized admin and a low-privilege operator. It does not establish the target outcome. For the documented fault, the direct acceptance test is: make a benign configuration change and correlate the command event with the named operator.

This test measures a different behavior: Attempt Telnet and SSH connections from an approved host and confirm only encrypted SSH is accepted. It does not establish the target outcome. For the documented fault, the direct acceptance test is: make a benign configuration change and correlate the command event with the named operator.

That diagnosis is supported by a different symptom: The router still accepts plaintext Telnet sessions after the administrator creates an RSA key. Here the recorded observation is: a configuration change is logged only as a device commit with no associated user command identity. The applicable cause is: the environment has login records but not privileged command accounting.

That diagnosis is supported by a different symptom: A read-only operations user can enter configuration mode without authorization. Here the recorded observation is: a configuration change is logged only as a device commit with no associated user command identity. The applicable cause is: the environment has login records but not privileged command accounting.

That diagnosis is supported by a different symptom: An operator logs in with a shared line password without any user-specific accountability. Here the recorded observation is: a configuration change is logged only as a device commit with no associated user command identity. The applicable cause is: the environment has login records but not privileged command accounting.

Enable secrets and authorization boundaries restrict commands; they do not record which named administrator executed each configuration command.

SSH access through local accounts identifies users at login, but login records alone are not a command-by-command audit trail.

That control reduces a separate risk: VTY transport input still permits Telnet despite SSH being configured. For the described design, the recurring risk arises from: the environment has login records but not privileged command accounting. The specific required safeguard is: keep time synchronization and off-box retention of privileged command audit records.

Enabling AAA command accounting to an appropriate TACACS+ server with required privilege levels would not create an AAA login method list with TACACS+ first and local fallback for server error cases.

Configuring a supported AAA server group with reachable primary and secondary TACACS+ server definitions would not create an AAA login method list with TACACS+ first and local fallback for server error cases.

Respect the AAA method's explicit deny would not create an AAA login method list with TACACS+ first and local fallback for server error cases.

This test measures a different behavior: Inspect each line's method-list binding and verify SSH login uses the centralized identity. It does not establish the target outcome. For the documented fault, the direct acceptance test is: simulate server unreachability and verify local break-glass login; then test explicit TACACS+ reject behavior.

This test measures a different behavior: Inspect server accounting logs to find operator, command and timestamp for a test configuration change. It does not establish the target outcome. For the documented fault, the direct acceptance test is: simulate server unreachability and verify local break-glass login; then test explicit TACACS+ reject behavior.

This test measures a different behavior: Disable the primary in a lab and confirm the device authenticates against the secondary server. It does not establish the target outcome. For the documented fault, the direct acceptance test is: simulate server unreachability and verify local break-glass login; then test explicit TACACS+ reject behavior.

That diagnosis is supported by a different symptom: Remote SSH ignores TACACS+ authentication while console login correctly uses it. Here the recorded observation is: all router administration fails when the TACACS+ server becomes unreachable. The applicable cause is: the AAA method list provides no valid local fallback for AAA server errors.

That diagnosis is supported by a different symptom: The rejected engineer remains denied despite valid local credentials configured on the router. Here the recorded observation is: all router administration fails when the TACACS+ server becomes unreachable. The applicable cause is: the AAA method list provides no valid local fallback for AAA server errors.

That diagnosis is supported by a different symptom: Remote administration fails whenever the first configured TACACS+ server is unavailable. Here the recorded observation is: all router administration fails when the TACACS+ server becomes unreachable. The applicable cause is: the AAA method list provides no valid local fallback for AAA server errors.