CCNA Network Services and Security Practice Question
A network technician is troubleshooting a router that cannot be accessed via SSH. The router responds to Telnet but SSH attempts return 'connection refused'. The technician confirmed that 'ip ssh version 2' is configured and 'show ip ssh' indicates SSH is enabled. The output of 'show line vty 0 4' shows 'transport input telnet'. What should the technician do next?
⚠ Common exam trap
Generating a new RSA key pair is a common but incorrect next step because SSH is already enabled and operational; the 'connection refused' message stems from the VTY transport configuration, not from missing or corrupted keys.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add the 'transport input ssh' command to the VTY lines.
The VTY lines are configured with 'transport input telnet', which explicitly allows only Telnet sessions. SSH is enabled globally, but because it is not listed in the VTY transport input, the router rejects SSH connection attempts. Adding 'transport input ssh' (or 'transport input all') under the VTY lines permits SSH connections without disrupting Telnet, solving the mismatch at the application layer.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Generate a new RSA key pair and restart the SSH service.
Why it's wrong here
Generating a new RSA key pair and restarting the SSH service is unrelated to the actual failure. The 'connection refused' occurs at the TCP/VTY layer because the VTY lines only permit Telnet ('transport input telnet'), so the router rejects the SSH handshake before any key-based authentication or encryption is negotiated. Even if the key pair is absent or stale, SSH would fail differently (e.g., 'no host key' or authentication errors), not with a transport-level refusal; regenerating keys does not modify the line's transport input policy.
- ✓
Add the 'transport input ssh' command to the VTY lines.
Why this is correct
The show line vty output indicates only Telnet is permitted. Adding 'transport input ssh' (or 'transport input all') modifies the VTY configuration to accept both Telnet and SSH, directly fixing the protocol restriction causing the connection refused.
- ✗
Configure 'ip ssh version 1' to enable backward compatibility.
Why it's wrong here
The router already runs SSH version 2, and version 1 is less secure and not required for compatibility. Changing the version does not override the VTY transport input restriction, so SSH connections will still be refused.
- ✗
Configure AAA authentication on the VTY lines.
Why it's wrong here
AAA authentication is not required for SSH to function; the router is already using local authentication (implied by the working Telnet). The refusal occurs before authentication, at the transport protocol layer, so adding AAA would not resolve the issue.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Add the 'transport input ssh' command to the VTY lines.Correct answer▾
Why this is correct
The show line vty output indicates only Telnet is permitted. Adding 'transport input ssh' (or 'transport input all') modifies the VTY configuration to accept both Telnet and SSH, directly fixing the protocol restriction causing the connection refused.
✗Generate a new RSA key pair and restart the SSH service.Wrong answer — click to see why▾
Why this is wrong here
Administrators often mistake 'connection refused' for a key issue, but the VTY lines restrict the allowed protocols, not the validity of the keys.
✗Configure 'ip ssh version 1' to enable backward compatibility.Wrong answer — click to see why▾
Why this is wrong here
Candidates may think a version mismatch causes the refusal, but the VTY transport setting is the actual filter; downgrading security is unnecessary and ineffective.
✗Configure AAA authentication on the VTY lines.Wrong answer — click to see why▾
Why this is wrong here
Some technicians equate 'connection refused' with authentication failure and jump to AAA, but in this case the VTY lines never allow the SSH session to reach the authentication stage.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
OSI Model Reference
| Layer | Name | PDU | Key Protocols / Devices |
|---|---|---|---|
| 7 | Application | Data | HTTP, HTTPS, DNS, SMTP, FTP, SSH |
| 6 | Presentation | Data | TLS / SSL, JPEG, ASCII encoding |
| 5 | Session | Data | NetBIOS, RPC, SIP |
| 4 | Transport | Segment / Datagram | TCP, UDP |
| 3 | Network | Packet | IP, ICMP, OSPF — Routers |
| 2 | Data Link | Frame | Ethernet, Wi-Fi, PPP — Switches, Bridges |
| 1 | Physical | Bits | Cables, NICs, Hubs, Repeaters |
Go deeper
Related to this question
Learn chapter
Configuring AAA with TACACS+ and RADIUS on IOS XE
Key term
Telnet
Telnet is a network protocol that provides a bidirectional, interactive text-based communication session between two machines over a network, typically used for remote access and management of network devices.
Key term
Router
A router is a networking device that connects different networks together and directs data traffic between them by choosing the best path for data to travel.
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.