How to Configure VTY Lines for Idle Session Termination

A network engineer must configure the VTY lines on a router to achieve these results: • Remote access should be permitted for all feasible protocols. • Only a password should be required for device authentication. • All idle EXEC sessions must be terminated in 60 minutes. Which configuration should be applied?

  1. line vty 0 15
  2. line vty 0 15
  3. line vty 0 15 Source Reference Answer
  4. line vty 0 15

Community Votes

C
59%
B
41%

59% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

The question tests precise keyword interpretation: 'idle' mandates exec-timeout, while the login command ensures password-only authentication without requiring usernames.

This question evaluates Cisco IOS VTY line configuration, focusing on the critical distinction between exec-timeout and absolute-timeout for managing idle sessions. Community consensus confirms that exec-timeout is the only command that terminates idle sessions without disrupting active traffic.

Candidates frequently select the option with absolute-timeout because they overlook the word 'idle', mistakenly assuming any 60-minute cutoff applies universally to all sessions regardless of user activity.

Community Discussion (10 comments)

SPARNABUS 👍 1 Selected: A
I choose B. The conditions must be met one by one; firstly, the condition 'all feasible protocols' is met by both solution B and C; the second condition 'only a password' is only ensured by solution B. For solution C, although a password is configured, without the login command, this password will not be requested during the connection." "The third condition is literally met by solution C, but solution B also meets it. Because it is never specified 'idle exec' sessions only. Using absolute-timeout closes all sessions, active or inactive (meeting our third condition
NetworkJanitor 👍 1 Selected: C
B has "absolute-timeout". "All IDLE EXEC sessions must be terminated in 60 minutes." IDLE is Absolute kills All sessions idle or active. "The absolute-timeout command in Cisco IOS is used to set a fixed time interval after which a user session will be terminated, regardless of whether the connection is active or idle" hth
mikrep 👍 1 Selected: B
Should be B. it asks for "only a password is required". This is achieved by the login command. It's missing on C.
NoHombre 👍 1 Selected: C
As explained above, only the idle sessions should be terminated, so it's B
NetworkJanitor 👍 2
Can NOT be B. Requirement: "All idle EXEC" so, "idle" is the key word. "The absolute timeout terminates the EXEC session even if it is still active and is used during the set timeout period...Idle EXEC sessions are not terminated by default."
artilling 👍 2 Selected: C
Correct Answer: C 1.Only a password >> line vty 0 15 login OR line vty 0 15 password 2.EXEC sessions must be terminated in 60 minutes >> exec-timeout 60 0. Not absolute-timeout 60
ExamTaker1017 👍 1 Selected: B
It's B Login: Only requires a password Login local: Requires both a username and a password
A_Yahoo 👍 2 Selected: B
'login' is required
wemustpass 👍 3 Selected: C
The Cisco ‘exec-timeout‘ command sets a specific time to disconnect idle EXEC sessions. The default value for the EXEC timeout is 10 minutes. The absolute timeout terminates the EXEC session even if it is still active and is used during the set timeout period. For this reason I say the given answer is correct.
298a34e 👍 1 Selected: B
Answer is B

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Core Concept: VTY Line Authentication & Timeout Commands

Although the provided options appear truncated in the prompt, this classic Cisco exam scenario tests three distinct VTY configuration requirements: 1. Protocol Flexibility: transport input all permits all supported remote access methods (SSH, Telnet, etc.), satisfying the "all feasible protocols" requirement. 2. Authentication Method: The login command enables password verification for the VTY line. Combined with the password command, it ensures only a password is required. Using login local would incorrectly mandate a username-password pair via AAA, which community comment #7 correctly identifies as a common distractor. 3. Session Management: The critical differentiator lies between exec-timeout and absolute-timeout. - exec-timeout <minutes> <seconds> terminates an EXEC session only when it becomes idle. Setting this to 60 0 perfectly matches the requirement to drop idle sessions after one hour. - absolute-timeout <minutes> forcibly terminates a session after a fixed duration, regardless of whether the user is actively typing or transferring data. As highlighted in comments #2 and #5, this violates the specific "idle" constraint.

Why Option C is Correct

Option C correctly pairs transport input all, login, and exec-timeout 60 0. As noted by multiple community experts, exec-timeout is the precise tool for idle session management. The presence of login ensures the configured line password is actually prompted during connection attempts, addressing the authentication requirement cleanly.

Why Other Options Fail

  • Options using absolute-timeout violate the "idle" constraint. While they do disconnect sessions after 60 minutes, they punish active users performing long-running tasks, which is undesirable in production environments.
  • Options omitting login fail the authentication requirement because the line password is ignored unless the login directive is explicitly enabled under the VTY configuration, a point emphasized in comments #1 and #3.

Official Reference

  • Cisco IOS Configuration Fundamentals Command Reference: exec-timeout
  • Cisco IOS Configuration Fundamentals Command Reference: absolute-timeout
  • Cisco IOS Configuration Fundamentals Command Reference: transport input

Exam Strategy

When encountering timeout configuration questions, immediately underline keywords like idle, active, or fixed duration. "Idle" always points to exec-timeout, while "fixed/hard cutoff" points to absolute-timeout. Additionally, verify that login is present whenever a line password is configured; without it, the password is effectively disabled.

Related Analysis

Which network devices secure API platforms?

A-Grade

What is a characteristic of Layer 3 roaming?

S-Grade

Which function is handled by vManage in the Cisco SD-WAN fab

A-Grade

Practice All 350-401 Questions

Access 218 questions with complete answers and detailed explanations.

View Full 350-401 Practice Test →

← Back to 350-401 Study Guide