Question

A service provider security engineer is hardening the management plane of an IOS XE PE router. Remote administrators must reach the device only via SSH from the 10.50.0.0/24 NOC subnet, and all Telnet access must be refused. The engineer configures an access-class on the VTY lines and disables Telnet as a transport. Which combination of configuration steps correctly enforces this management plane security requirement?

Accepted Answer

Apply an inbound ACL permitting 10.50.0.0/24 with 'access-class NOC in' under line vty, and set 'transport input ssh'

Answer

Apply the ACL to the physical management interface with 'ip access-group NOC in', and set 'transport input all' under line vty

Answer

Configure 'access-class NOC out' under line vty and set 'transport input telnet ssh' to allow fallback

Answer

Enable 'login local' only, since local authentication automatically blocks Telnet and restricts source subnets