You save $69.98
An IOS router has five VTY sessions numbered 0 through 4. Access should require local named user authentication, allow only SSH, and accept incoming VTY connections only from addresses matched by standard ACL 37. Which configuration applies that policy to every VTY line?
VTY range 0–4 covers all five lines. `login local` uses configured named users, `transport input ssh` disallows Telnet, and `access-class 37 in` filters incoming management origins.
This only applies to VTY line 4, leaving lines 0–3 outside the requested policy.
Telnet is unencrypted and disabling login undermines authentication.
Allowing all remote transports and removing source filtering violates both restrictions.
A Cisco router already has RSA keys and local user accounts. `show running-config` shows `line vty 0 4 ; login local ; transport input ssh`, but remote SSH connections from disallowed subnets remain possible. Standard ACL 26 correctly matches only the management sources. What is missing?
The VTY inbound access class restricts which source IPs may establish management sessions. SSH transport and local authentication alone do not restrict source subnets.
Outbound VTY filtering does not enforce the requested inbound-source policy.
Telnet weakens management confidentiality and does not restrict client source addresses.
A host default gateway does not replace the router-side access-class restriction.
A router is configured with SSH-only VTY access and a permitted-management-source ACL named ADMIN43. An audit finds the ACL applied with `access-class ADMIN43 out` rather than filtering who can connect. Which single change corrects directionality?
On VTY lines, `in` filters the incoming remote management hosts. The `out` direction is not the control for SSH client source addresses entering the device.
SSH encrypts sessions but does not itself limit management client source networks.
Telnet is unencrypted and does not correct ACL direction.
Spanning-tree configuration does not authenticate or restrict VTY management sessions.
At a field-service firm, the on-call technician must transfer a router startup configuration to a simple file server with minimal transport overhead on a trusted network. Which choice best addresses the stated requirement?
TFTP is a simple UDP-based file transfer without built-in authentication or encryption.
SNMP is management telemetry, not a standard image file transfer protocol.
TFTP lacks strong built-in secrecy and authentication.
FTP introduces credentials and data channels without encryption by default; for a simple trusted TFTP workflow, evaluate actual security and transport needs.
At a research campus, the branch support lead is migrating software images using a file protocol with authenticated session control when only FTP and TFTP are in scope. Which choice best addresses the stated requirement?
FTP has authentication and a session control channel; traditional FTP still sends data and credentials without TLS.
ICMP reachability is not an FTP file transfer.
TFTP is designed without standard login authentication.
Plain FTP is not encrypted without an additional secure variant.
At a hotel, the security and networking lead must troubleshoot why a TFTP backup worked on one local VLAN but failed across a firewall. Which choice best addresses the stated requirement?
TFTP begins on UDP port 69, then uses transfer identifiers/UDP flows; stateful firewalls must handle the exchanges.
RF power is unrelated to TFTP UDP handling.
TFTP commonly uses UDP/69 for initiation and then a negotiated server TID for data transfer; firewall rules must accommodate the flow.
TFTP is UDP-based and not TCP FTP port 21.
At a municipal utility, the site engineer is choosing between two legacy file transfer protocols on a sensitive network segment. Which choice best addresses the stated requirement?
Traditional FTP carries data without encryption, and TFTP has no built-in security; use secure alternatives where confidentiality is required.
Passive FTP changes which side initiates the data connection but does not add confidentiality to plain FTP.
Authentication credentials do not by themselves cipher the transport.
Reduced protocol overhead does not imply encryption.
At an insurance company, the on-call technician must transfer a router startup configuration to a simple file server with minimal transport overhead on a trusted network. During review, someone proposes: "Use TFTP on an untrusted public WAN assuming it encrypts credentials." Which technical explanation most directly shows why this proposal does not solve the requirement?
TFTP lacks strong built-in secrecy and authentication. The effective remedy is to use TFTP where its limitations and exposure are acceptable.
TFTP is a simple UDP-based file transfer without built-in authentication or encryption. The statement addresses a different mechanism. Here the engineer specifically proposed use tftp on an untrusted public wan assuming it encrypts credentials; the decisive limitation is that tFTP lacks strong built-in secrecy and authentication.
OSPF exchanges routing state, not user file content. It concerns a different proposed change, not the change being evaluated.
SNMP is management telemetry, not a standard image file transfer protocol. That distinction is technically relevant elsewhere, but it does not identify the failure of the proposed use tftp on an untrusted public wan assuming it encrypts credentials. The actual issue is that tFTP lacks strong built-in secrecy and authentication.
At a clinic, the campus network lead is migrating software images using a file protocol with authenticated session control when only FTP and TFTP are in scope. During review, someone proposes: "Describe TFTP as having built-in username/password login." Which technical explanation most directly shows why this proposal does not solve the requirement?
TFTP is designed without standard login authentication. The effective remedy is to recognize FTP supports login and separate control/data sessions, but does not inherently encrypt them.
ICMP reachability is not an FTP file transfer. It concerns a different proposed change, not the change being evaluated.
Plain FTP is not encrypted without an additional secure variant. A true general network fact is not necessarily the direct diagnosis. The named change was describe tftp as having built-in username/password login, whose relevant defect is that tFTP is designed without standard login authentication.
FTP has authentication and a session control channel; traditional FTP still sends data and credentials without TLS. That distinction is technically relevant elsewhere, but it does not identify the failure of the proposed describe tftp as having built-in username/password login. The actual issue is that tFTP is designed without standard login authentication.
At a retail branch, the migration lead must troubleshoot why a TFTP backup worked on one local VLAN but failed across a firewall. During review, someone proposes: "Check only TCP/21 and assume TFTP uses FTP data control." Which technical explanation most directly shows why this proposal does not solve the requirement?
TFTP is UDP-based and not TCP FTP port 21. The effective remedy is to check UDP/69 initiation and negotiated UDP transfer flows allowed by the security policy.
Routing IDs do not directly authorize TFTP ports through a firewall. It concerns a different proposed change, not the change being evaluated.
TFTP begins on UDP port 69, then uses transfer identifiers/UDP flows; stateful firewalls must handle the exchanges. That distinction is technically relevant elsewhere, but it does not identify the failure of the proposed check only tcp/21 and assume tftp uses ftp data control. The actual issue is that tFTP is UDP-based and not TCP FTP port 21.
RF power is unrelated to TFTP UDP handling. This observation would apply to another device or feature, not the proposed check only tcp/21 and assume tftp uses ftp data control. For this scenario, tFTP is UDP-based and not TCP FTP port 21 is the direct cause.
At a bank branch, a network administrator is choosing between two legacy file transfer protocols on a sensitive network segment. During review, someone proposes: "Assume TFTP has stronger encryption because it is lightweight." Which technical explanation most directly shows why this proposal does not solve the requirement?
Reduced protocol overhead does not imply encryption. The effective remedy is to treat both plain FTP and TFTP as lacking confidentiality unless a secure transport is added.
DNS aliases do not encrypt file sessions. It concerns a different proposed change, not the change being evaluated.
Traditional FTP carries data without encryption, and TFTP has no built-in security; use secure alternatives where confidentiality is required. The statement addresses a different mechanism. Here the engineer specifically proposed assume tftp has stronger encryption because it is lightweight; the decisive limitation is that reduced protocol overhead does not imply encryption.
Authentication credentials do not by themselves cipher the transport. This observation would apply to another device or feature, not the proposed assume tftp has stronger encryption because it is lightweight. For this scenario, reduced protocol overhead does not imply encryption is the direct cause.
or Guarantee your success by buying the full version which covers the full latest pool of questions. (760 Questions, Last Updated on Nov 4, 2026)
Please check your mailbox for a message from support@examlabs.com and follow the directions.
