Question 850 - 350-401 discussion

Option B is the correct command set to update the existing configuration to achieve the desired results.The configuration steps are as follows12:

Define a standard access list that permits only the administrators from the 192.168.1.0/24 subnet to access the vty lines. In this case, the access list is namedADMINand it allows any host with an IP address in the range of 192.168.1.1 to 192.168.1.254 to access the vty lines:ip access-list standard ADMINandpermit 192.168.1.0 0.0.0.255.

Apply the access list to the vty lines using theaccess-classcommand. This command restricts incoming and outgoing connections between a particular vty and the addresses in the access list. In this case, the access listADMINis applied to the vty lines 0 to 15 in the inbound direction, which means that only the hosts that match the access list can initiate a connection to the vty lines:line vty 0 15andaccess-class ADMIN in.

Disable the clear-text protocols such as Telnet for the vty lines using thetransport inputcommand. This command specifies which protocols are allowed for incoming connections. In this case, only SSH is allowed for the vty lines, which is a secure protocol that encrypts the data between the client and the server:transport input ssh.

Option A is incorrect because it does not apply the access list to the vty lines, which is required to restrict the access to the administrators from the 192.168.1.0/24 subnet.Without theaccess-classcommand, any host can attempt to connect to the vty lines12.

Option C is incorrect because it does not disable the clear-text protocols for the vty lines, which is required to prohibit the access to the vty lines using unsecure protocols.Without thetransport input sshcommand, both Telnet and SSH are allowed for the vty lines by default12.

Option D is incorrect because it uses an extended access list instead of a standard access list, which is not recommended for controlling access to the vty lines. An extended access list requires more configuration and processing than a standard access list, and it cannot be applied directly to the vty lines.It has to be applied to each interface that can be used to access the vty lines, which increases the complexity and the possibility of errors12.Reference:1:Controlling Access to a Virtual Terminal Line,2:Configuring Secure Shell