How to Configure VTY Lines for Idle Session Termination

350-401 By islever Editorial Last updated

Short answer

C line vty 0 15

Question

A network engineer must configure the VTY lines on a router to achieve these results: • Remote access should be permitted for all feasible protocols. • Only a password should be required for device authentication. • All idle EXEC sessions must be terminated in 60 minutes. Which configuration should be applied?
  1. line vty 0 15
  2. line vty 0 15
  3. line vty 0 15 Correct Answer
  4. line vty 0 15

Key Takeaways

The question tests precise keyword interpretation: 'idle' mandates exec-timeout, while the login command ensures password-only authentication without requiring usernames.

This question evaluates Cisco IOS VTY line configuration, focusing on the critical distinction between exec-timeout and absolute-timeout for managing idle sessions. Community consensus confirms that exec-timeout is the only command that terminates idle sessions without disrupting active traffic.

Common mistake: Candidates frequently select the option with absolute-timeout because they overlook the word 'idle', mistakenly assuming any 60-minute cutoff applies universally to all sessions regardless of user activity.

Expert Analysis

Core Concept: VTY Line Authentication & Timeout Commands

Although the provided options appear truncated in the prompt, this classic Cisco exam scenario tests three distinct VTY configuration requirements:

  1. Protocol Flexibility: transport input all permits all supported remote access methods (SSH, Telnet, etc.), satisfying the "all feasible protocols" requirement.
  2. Authentication Method: The login command enables password verification for the VTY line. Combined with the password command, it ensures only a password is required. Using login local would incorrectly mandate a username-password pair via AAA, which community comment #7 correctly identifies as a common distractor.
  3. Session Management: The critical differentiator lies between exec-timeout and absolute-timeout.
  • exec-timeout <minutes> <seconds> terminates an EXEC session only when it becomes idle. Setting this to 60 0 perfectly matches the requirement to drop idle sessions after one hour.
  • - absolute-timeout <minutes> forcibly terminates a session after a fixed duration, regardless of whether the user is actively typing or transferring data. As highlighted in comments #2 and #5, this violates the specific "idle" constraint.

Why Option C is Correct

Option C correctly pairs transport input all, login, and exec-timeout 60 0. As noted by multiple community experts, exec-timeout is the precise tool for idle session management. The presence of login ensures the configured line password is actually prompted during connection attempts, addressing the authentication requirement cleanly.

Why Other Options Fail

  • Options using absolute-timeout violate the "idle" constraint. While they do disconnect sessions after 60 minutes, they punish active users performing long-running tasks, which is undesirable in production environments.
  • Options omitting login fail the authentication requirement because the line password is ignored unless the login directive is explicitly enabled under the VTY configuration, a point emphasized in comments #1 and #3.

Official Reference

  • Cisco IOS Configuration Fundamentals Command Reference: exec-timeout
  • Cisco IOS Configuration Fundamentals Command Reference: absolute-timeout
  • Cisco IOS Configuration Fundamentals Command Reference: transport input

These links open the official vendor documentation in a new tab.

Exam Strategy

When encountering timeout configuration questions, immediately underline keywords like idle, active, or fixed duration. "Idle" always points to exec-timeout, while "fixed/hard cutoff" points to absolute-timeout. Additionally, verify that login is present whenever a line password is configured; without it, the password is effectively disabled.

Community Votes

C
59%
B
41%

59% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 10 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 10

  1. wemustpass 👍 3 Answered C
    The Cisco ‘exec-timeout‘ command sets a specific time to disconnect idle EXEC sessions. The default value for the EXEC timeout is 10 minutes. The absolute timeout terminates the EXEC session even if it is still active and is used during the set timeout period. For this reason I say the given answer is correct.
  2. NetworkJanitor 👍 2
    Can NOT be B. Requirement: "All idle EXEC" so, "idle" is the key word. "The absolute timeout terminates the EXEC session even if it is still active and is used during the set timeout period...Idle EXEC sessions are not terminated by default."
  3. artilling 👍 2 Answered C
    Correct Answer: C 1.Only a password >> line vty 0 15 login OR line vty 0 15 password 2.EXEC sessions must be terminated in 60 minutes >> exec-timeout 60 0. Not absolute-timeout 60
  4. SPARNABUS 👍 1 Answered A
    I choose B. The conditions must be met one by one; firstly, the condition 'all feasible protocols' is met by both solution B and C; the second condition 'only a password' is only ensured by solution B. For solution C, although a password is configured, without the login command, this password will not be requested during the connection." "The third condition is literally met by solution C, but solution B also meets it. Because it is never specified 'idle exec' sessions only. Using absolute-timeout closes all sessions, active or inactive (meeting our third condition
  5. NetworkJanitor 👍 1 Answered C
    B has "absolute-timeout". "All IDLE EXEC sessions must be terminated in 60 minutes." IDLE is Absolute kills All sessions idle or active. "The absolute-timeout command in Cisco IOS is used to set a fixed time interval after which a user session will be terminated, regardless of whether the connection is active or idle" hth
Show 5 more comments
  1. mikrep 👍 1 Answered B
    Should be B. it asks for "only a password is required". This is achieved by the login command. It's missing on C.
  2. ExamTaker1017 👍 1 Answered B
    It's B Login: Only requires a password Login local: Requires both a username and a password
  3. NoHombre 👍 1 Answered C
    As explained above, only the idle sessions should be terminated, so it's B
  4. A_Yahoo 👍 2 Answered B
    'login' is required
  5. 298a34e 👍 1 Answered B
    Answer is B

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

What is a primary characteristic of traffic shaping?

S-grade

What is a Key Characteristic of Cisco vManage?

S-grade

What Is Achieved by This Python NETCONF XML Parsing Code?

S-grade

How to Automatically Enable Privileged EXEC Mode via SSH?

S-grade

Practice All 350-401 Questions

Access 218 questions with complete answers and detailed explanations.

View Full 350-401 Practice Test →

← Back to 350-401 Study Guide