How to Stop ASA Console Configuration Access at a Remote Site?
A network administrator is shipping a Cisco ASA to a remote retail site. The administrator wants to ensure that the device configuration cannot be accessed by someone at the site with physical access and a console cable. Which command must be used to mitigate this risk?
Community Insight
The exam tests the ASA physical-hardening difference between console authentication and ROMMON password-recovery protection; the trap is assuming aaa authentication console blocks an attacker who can interrupt boot.
The Cisco ASA no service password-recovery command hardens the appliance against console-based password recovery, ensuring a person at a remote retail site cannot use ROMMON to access the saved configuration. This page confirms option C and explains why console AAA, config-register, and reset-button options do not close that physical-access gap.
Most candidates choose A, aaa authentication console, because it sounds like console security; in reality it only adds a login prompt after boot and does not prevent ROMMON password recovery from bypassing console authentication.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The question asks how to stop a person with physical access and a console cable from reaching the saved ASA configuration.no service password-recovery disables the ROMMON password-recovery path that would otherwise let someone reset the password and enter the configuration or force a Flash erase prompt. With this command, the ASA cannot be brought into ROMMON with the existing configuration intact, so the remote-site attacker cannot read the startup configuration through the console. That directly addresses the threat model in the scenario: physical console access at an untrusted retail site. It is also the ASA hardening control commonly recommended for devices deployed outside a protected wiring closet.Why the Other Options Are Wrong
aaa authentication console (A) only controls who can log in at the console after the ASA has booted; it does not prevent an attacker from interrupting boot, entering ROMMON, and using password recovery to bypass the console AAA prompt. config-register 0x00000041 (B) changes the configuration register boot behavior and does not protect the saved config; in fact, some register settings can bypass the saved configuration or alter boot. no service sw-reset-button (D) disables the external reset button, which is a physical reset control but has nothing to do with console or ROMMON password recovery. Therefore none of A, B, or D stop the specific console-cable recovery path.Community Comment Notes
Surfside92's comment tracks the correct rationale: the command "prevents a user from entering ROMMON mode with the configuration intact." XBfoundX adds that ROMMON forces an erase prompt and reload if the user declines erasure, which is the operational consequence of the hardening control. klu16 simply confirms option C, consistent with the community reading. No commenter provides a credible argument for A, B, or D.Exam Strategy
When hardening a device that will sit in an untrusted physical location, look for commands that block recovery or boot bypass, not just login prompts. On ASA, no service password-recovery is the relevant control, but document that a lost password will require wiping the configuration.
Frequently Asked Questions
Does aaa authentication console prevent ASA ROMMON password recovery?
No. It only adds console login authentication after boot; an attacker can still use ROMMON password recovery unless no service password-recovery is configured.
What is the risk of enabling no service password-recovery on a remote ASA?
If the administrator forgets the password, the ASA cannot enter ROMMON with the configuration intact; recovery usually requires erasing Flash and losing the saved configuration, so backups matter.