How to Enable Password-Only Console Authentication?
Refer to the exhibit. Which configuration enables password checking on the console line, using only a password? - 
Community Votes
100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question evaluates your ability to distinguish between basic line-level password prompting (login) and database-driven authentication (login local), specifically when securing physical console access.
This question tests the correct IOS command to enforce password-only authentication on a router's console line. The community unanimously confirms that applying the login command under line con 0 satisfies the requirement without invoking a username database.
Candidates frequently choose login local or configure line vty 0 4 instead. This happens because they overcomplicate console security by assuming all authentication requires user accounts, or they confuse remote management lines with the physical console port.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Understanding Line Authentication Commands
When securing a Cisco router's console line, administrators enter global configuration mode and select the interface usingline con 0. To activate password verification, the login command is applied. This directive instructs IOS to prompt users for the password previously defined with the password subcommand, fulfilling the "using only a password" requirement.Why Other Methods Fail Here
Usinglogin local shifts authentication away from the simple line password and forces the router to validate credentials against a locally configured username/password database or an external AAA server. Since the exhibit and question explicitly restrict the method to password-only, this option is incorrect. Similarly, selecting line vty 0 4 targets virtual terminal lines used for SSH or Telnet sessions, not the physical console port. As community members highlight, login relies solely on the line password, whereas login local demands additional account configuration, making it unsuitable for this specific scenario.Best Practices for Console Security
Always pair thelogin command with a strong console password. For advanced environments, consider enabling exec-timeout to prevent idle session hijacking. Remember that console access typically bypasses AAA by default unless explicitly configured otherwise, making the login command the most direct and appropriate choice for basic password enforcement. Official Reference
Exam Strategy
When an exam question specifies "password only" or "simple password," immediately look for the login command under the relevant line configuration. Reserve login local, aaa new-model, and RADIUS/TACACS+ configurations for scenarios that explicitly mention user databases, centralized authentication, or multi-factor requirements.
Related Analysis
Practice All 350-401 Questions
Access 218 questions with complete answers and detailed explanations.
View Full 350-401 Practice Test →