How to Secure Router VTY Lines with Password Authentication?

350-401 By islever Editorial Last updated

Short answer

B line vty 0 15

Question

A network engineer must configure the VTY lines on a router to achieve these results: • Remote access should be permitted only for secure protocols. • Only a password should be required for device authentication. • All idle EXEC sessions must be terminated in 60 minutes. Which configuration should be applied?
  1. line vty 0 15
  2. line vty 0 15 Correct Answer
  3. line vty 0 15
  4. line vty 0 15

Key Takeaways

The question traps candidates who assume the login keyword is enabled by default or redundant when a line password is configured, overlooking that Cisco IOS strictly requires it to enforce password prompts.

This question tests proper VTY line hardening using transport restrictions, explicit line password authentication, and session timeouts. The community consensus confirms that explicitly configuring the login keyword alongside a line password is mandatory, making option B the correct choice.

Common mistake: Candidates frequently select the option omitting the login command, mistakenly believing that setting a password automatically enforces authentication or that login forces username-based auth. In reality, without login, users bypass the line password entirely.

Expert Analysis

Core Configuration Requirements

To meet the stated objectives, three specific IOS commands must be applied under line vty 0 15:

  • transport input ssh: Restricts remote access exclusively to secure protocols, disabling legacy Telnet.
  • password <value> & login: Establishes line-level authentication. Contrary to popular belief, the login command is not enabled by default on VTY lines. If omitted, the router will accept connections without prompting for the configured line password.
  • exec-timeout 60 0: Terminates idle EXEC sessions after 60 minutes, enhancing security compliance.

Resolving the Community Debate

The voting split between A and B stems from a widespread misconception about Cisco IOS defaults. Several commenters argue that login is unnecessary or triggers username prompts. However, official Cisco documentation and lab testing confirm that login alone (without local or none) specifically enforces the line password set via the password command. As noted by experienced candidates, attempting to log in without the login keyword results in immediate shell access regardless of the configured password. Therefore, the configuration including both password and login accurately fulfills the password-only authentication requirement.

Why Other Options Fail

Options lacking transport input ssh violate the secure protocol mandate. Configurations using login local require TACACS+ or a local user database, contradicting the password-only rule. Omitting exec-timeout leaves sessions open indefinitely, failing the idle termination requirement. Only the complete combination satisfies all constraints.

Exam Strategy

Always verify the exact syntax and default behaviors of line security commands in your lab environment. Memorize that login is mandatory for line passwords, while login local shifts authentication to a user database, and never assume implicit defaults override explicit security requirements on VTY interfaces.

Community Votes

B
65%
A
35%

65% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 16 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 16

  1. AM17212 👍 10 Answered B
    Configuring Line Local Password Authentication To enable password authentication on a line, the following two commands are required under line configuration mode: ■ password password to configure the password ■ login to enable password checking at login
  2. AbdullahMohammad251 👍 4 Answered A
    If you try to issue the command "login" under a vty line before configuring a password on that line, an error message will be displayed "% Login disabled on line 2, until 'password' is set." We should first configure the password, and then we can use the command "login." Password checking is enabled by default.
  3. [Removed] 👍 3 Answered B
    B is correct If the command is simply "login" then it uses the password configured with the password command under the VTY configuration. If the command is "login local" then it asks for a username and password based on the local user database regardless of whether or not the password was used. https://notes.networklessons.com/security-authentication-on-vty-lines#:~:text=If%20the%20command,password%20was%20used.
  4. Eyad_Alotaibi 👍 3
    I have tried this in EVE-NG lab, and this result occured with me: If you set login keyword in line vty, the password will be required when you connect to the remote device. If you don't set login keyword, you will be able to connect to the remote device immediately with no password even you have already written a password in line vty. so B is the correct answer.
  5. chiacche 👍 2 Answered B
    login: Ensures that users are prompted for a password when they try to log in. password: Specifies the password that users must enter to gain access.
Show 11 more comments
  1. Mistwalker 👍 2 Answered A
    Login is enabled by default, and even if it needed to be set, entering it before a password has been configured produces an error (tested in CML).
  2. teems5uk 👍 2 Answered A
    Option A is the only correct answer here.
  3. Shri_Fcb10 👍 1 Answered A
    The login command prompts for username authentication in addition to the password. Since the requirement specifies that only a password should be required for device authentication, the login command is unnecessary and doesn't meet the specified criteria. Therefore, option B doesn't fulfill the requirement of allowing access only with a password.
  4. kldoyle97 👍 1
    Its between A and B, Leaning towards A since the question states that only a password is required. B specifies "login" under vty configuration. Doest that mean that it will prompt the user to enter a username and password? however there is no username configured
  5. jmarko80 👍 1 Answered B
    To enable password authentication on a line (con/vty/aux), the following two commands are required under line configuration mode: • password .....password to configure the password • login............ to enable password checking at login
  6. f490efc 👍 1 Answered A
    Seems login command is enabled by default. Both A and B looks okay
  7. slacker_at_work 👍 1 Answered A
    A is correct, "login" is not needed in this scenario
  8. Mizuchan 👍 1
    Leaning towards A... Both would work I think.
  9. Steve122 👍 3 Answered B
    Tested in LAB. 'B' works.
  10. bigyan_jhapaca4 👍 3 Answered B
    correct
  11. outnumber_gargle024 👍 1 Answered A
    provided answer is correct

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

What is a primary characteristic of traffic shaping?

S-grade

What is a Key Characteristic of Cisco vManage?

S-grade

What Is Achieved by This Python NETCONF XML Parsing Code?

S-grade

How to Configure VTY Lines for Idle Session Termination

S-grade

Practice All 350-401 Questions

Access 218 questions with complete answers and detailed explanations.

View Full 350-401 Practice Test →

← Back to 350-401 Study Guide