200-301: Cisco Certified Network AssociateDemo

By Cisco · Question Mode

QuestionQ1189

Security Fundamentals

A network engineer is replacing the switches for a managed-services client with new Cisco Catalyst switches. The new switches will be configured to meet updated security standards, including:

  • replacing Telnet services with encrypted connections, and
  • doubling the modulus size from 1024.

Which two commands must the engineer configure on the new switches?

Choose two
  • A transport input ssh
  • B transport input all
  • C crypto key generate rsa modulus 2048
  • D crypto key generate rsa general-keys modulus 1024
  • E crypto key generate rsa usage-keys
Explanation

To replace Telnet with encrypted remote management, the switch must restrict VTY access to SSH by using transport input ssh. To increase the RSA key size from 1024 bits to 2048 bits, the switch must generate a new RSA key pair with crypto key generate rsa modulus 2048. Cisco documentation for SSH configuration states that transport input ssh limits inbound remote-access sessions to SSH, and Cisco guidance for current IOS XE platforms recommends RSA keys of at least 2048 bits for SSH.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!