200-301: Cisco Certified Network AssociateDemo

By Cisco · Question Mode

QuestionQ654

Security Fundamentals

An engineer is configuring remote access to a router from IP subnet 10.139.58.0/28.

The domain name, crypto keys, and SSH have already been configured.

Which configuration enables the traffic on the destination router?

  • A line vty 0 15 access-class 120 in ! ip access-list extended 120 permit tcp 10.139.58.0 0.0.0.15 any eq 22
  • B interface FastEthernet0/0 ip address 10.122.49.1 255.255.255.252 ip access-group 10 in ! ip access-list standard 10 permit udp 10.139.58.0 0.0.0.7 host 10.122.49.1 eq 22
  • C interface FastEthernet0/0 ip address 10.122.49.1 255.255.255.252 ip access-group 110 in ! ip access-list standard 110 permit tcp 10.139.58.0 0.0.0.15 eq 22 host 10.122.49.1
  • D line vty 0 15 access-group 120 in ! ip access-list extended 120 permit tcp 10.139.58.0 0.0.0.15 any eq 22
Explanation

Cisco routers use access-class on VTY lines to control inbound Telnet/SSH management sessions. An extended ACL applied with access-class ... in can match both source address and destination TCP port. The configuration must permit the source subnet 10.139.58.0/28 (wildcard 0.0.0.15) to reach TCP port 22 (SSH). Interface-level access-group commands cannot be applied to VTY lines.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!