How to Secure Router VTY Lines with Password Authentication?

A network engineer must configure the VTY lines on a router to achieve these results: • Remote access should be permitted only for secure protocols. • Only a password should be required for device authentication. • All idle EXEC sessions must be terminated in 60 minutes. Which configuration should be applied?

  1. line vty 0 15
  2. line vty 0 15 Source Reference Answer
  3. line vty 0 15
  4. line vty 0 15

Community Votes

B
65%
A
35%

65% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

The question traps candidates who assume the login keyword is enabled by default or redundant when a line password is configured, overlooking that Cisco IOS strictly requires it to enforce password prompts.

This question tests proper VTY line hardening using transport restrictions, explicit line password authentication, and session timeouts. The community consensus confirms that explicitly configuring the login keyword alongside a line password is mandatory, making option B the correct choice.

Candidates frequently select the option omitting the login command, mistakenly believing that setting a password automatically enforces authentication or that login forces username-based auth. In reality, without login, users bypass the line password entirely.

Community Discussion (16 comments)

AM17212 👍 10 Selected: B
Configuring Line Local Password Authentication To enable password authentication on a line, the following two commands are required under line configuration mode: ■ password password to configure the password ■ login to enable password checking at login
jmarko80 👍 1 Selected: B
To enable password authentication on a line (con/vty/aux), the following two commands are required under line configuration mode: • password .....password to configure the password • login............ to enable password checking at login
AbdullahMohammad251 👍 4 Selected: A
If you try to issue the command "login" under a vty line before configuring a password on that line, an error message will be displayed "% Login disabled on line 2, until 'password' is set." We should first configure the password, and then we can use the command "login." Password checking is enabled by default.
chiacche 👍 2 Selected: B
login: Ensures that users are prompted for a password when they try to log in. password: Specifies the password that users must enter to gain access.
Steve122 👍 3 Selected: B
Tested in LAB. 'B' works.
Eyad_Alotaibi 👍 3
I have tried this in EVE-NG lab, and this result occured with me: If you set login keyword in line vty, the password will be required when you connect to the remote device. If you don't set login keyword, you will be able to connect to the remote device immediately with no password even you have already written a password in line vty. so B is the correct answer.
[Removed] 👍 3 Selected: B
B is correct If the command is simply "login" then it uses the password configured with the password command under the VTY configuration. If the command is "login local" then it asks for a username and password based on the local user database regardless of whether or not the password was used. https://notes.networklessons.com/security-authentication-on-vty-lines#:~:text=If%20the%20command,password%20was%20used.
Shri_Fcb10 👍 1 Selected: A
The login command prompts for username authentication in addition to the password. Since the requirement specifies that only a password should be required for device authentication, the login command is unnecessary and doesn't meet the specified criteria. Therefore, option B doesn't fulfill the requirement of allowing access only with a password.
slacker_at_work 👍 1 Selected: A
A is correct, "login" is not needed in this scenario
outnumber_gargle024 👍 1 Selected: A
provided answer is correct
Mistwalker 👍 2 Selected: A
Login is enabled by default, and even if it needed to be set, entering it before a password has been configured produces an error (tested in CML).
Mizuchan 👍 1
Leaning towards A... Both would work I think.
bigyan_jhapaca4 👍 3 Selected: B
correct
teems5uk 👍 2 Selected: A
Option A is the only correct answer here.
f490efc 👍 1 Selected: A
Seems login command is enabled by default. Both A and B looks okay
kldoyle97 👍 1
Its between A and B, Leaning towards A since the question states that only a password is required. B specifies "login" under vty configuration. Doest that mean that it will prompt the user to enter a username and password? however there is no username configured

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Core Configuration Requirements

To meet the stated objectives, three specific IOS commands must be applied under line vty 0 15:
  • transport input ssh: Restricts remote access exclusively to secure protocols, disabling legacy Telnet.
  • password <value> & login: Establishes line-level authentication. Contrary to popular belief, the login command is not enabled by default on VTY lines. If omitted, the router will accept connections without prompting for the configured line password.
  • exec-timeout 60 0: Terminates idle EXEC sessions after 60 minutes, enhancing security compliance.

Resolving the Community Debate

The voting split between A and B stems from a widespread misconception about Cisco IOS defaults. Several commenters argue that login is unnecessary or triggers username prompts. However, official Cisco documentation and lab testing confirm that login alone (without local or none) specifically enforces the line password set via the password command. As noted by experienced candidates, attempting to log in without the login keyword results in immediate shell access regardless of the configured password. Therefore, the configuration including both password and login accurately fulfills the password-only authentication requirement.

Why Other Options Fail

Options lacking transport input ssh violate the secure protocol mandate. Configurations using login local require TACACS+ or a local user database, contradicting the password-only rule. Omitting exec-timeout leaves sessions open indefinitely, failing the idle termination requirement. Only the complete combination satisfies all constraints.

Official Reference

Exam Strategy

Always verify the exact syntax and default behaviors of line security commands in your lab environment. Memorize that login is mandatory for line passwords, while login local shifts authentication to a user database, and never assume implicit defaults override explicit security requirements on VTY interfaces.

Related Analysis

Refer to the exhibit. Which action must be taken to configur

A-Grade

Refer to the exhibit. An administrator writes a script to fe

A-Grade

Refer to the exhibit. What is the result of the NTP configur

S-Grade

Practice All 350-401 Questions

Access 218 questions with complete answers and detailed explanations.

View Full 350-401 Practice Test →

← Back to 350-401 Study Guide