CCNA Network Services and Security Practice Question
After securing a switch by running 'ip ssh version 2' and generating RSA keys with 'crypto key generate rsa modulus 1024', remote SSH connections fail with a 'key exchange error'. A check of the SSH client’s documentation reveals it requires a minimum 2048-bit RSA key for SSH version 2. What should the technician do next?
⚠ Common exam trap
Cisco often tests the misconception that any SSH connection failure is a connectivity or configuration issue, when in fact it is a cryptographic key length mismatch that requires regenerating the RSA key pair with a larger modulus.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Regenerate the RSA key pair on the switch with a 2048-bit modulus using the command 'crypto key generate rsa modulus 2048'.
The error is caused by the SSH client requiring a minimum 2048-bit RSA key for SSH version 2, but the switch was configured with a 1024-bit key. The correct solution is to regenerate the RSA key pair with a 2048-bit modulus using 'crypto key generate rsa modulus 2048', which satisfies the client's security requirement and allows SSH version 2 to establish a secure connection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Verify IP connectivity between the client and the switch by issuing a ping from the client to the switch.
Why it's wrong here
A ping test verifies only Layer 3 reachability via ICMP, not the SSH cryptographic handshake. Since the key-exchange error occurs after the TCP connection and SSH protocol version exchange, the client has already proven IP connectivity to the switch. Issuing a ping will likely succeed but will not alter or identify the switch's 1024-bit host key, which is the actual cause of the failure.
- ✗
Check the SSH client configuration on the host to ensure it accepts 1024-bit keys.
Why it's wrong here
Lowering the host's SSH client to accept 1024-bit keys would mean relaxing the client's security policy, and modern SSH clients often hard-code a minimum key size, refusing the setting entirely. The stated environment requirement is that the client demands 2048-bit keys, so the correct fix is to align the switch to that requirement, not to weaken the client. SSH clients do not negotiate key strength; they simply reject undersized keys, so this action cannot resolve the handshake failure.
- ✓
Regenerate the RSA key pair on the switch with a 2048-bit modulus using the command 'crypto key generate rsa modulus 2048'.
Why this is correct
Regenerating the key pair with a higher modulus directly resolves the key-strength mismatch. The switch will then present a 2048-bit key during the SSH handshake, fixing the key exchange error. The existing 'ip ssh version 2' setting remains active after rekeying.
- ✗
Disable SSH version 2 on the switch and revert to SSH version 1, which does not enforce key length restrictions.
Why it's wrong here
Reverting to SSH version 1 is a severe security regression because SSHv1 is deprecated and vulnerable to cryptographic flaws that can leak session data. More importantly, the client explicitly requires SSH version 2, so disabling version 2 on the switch would make the client refuse the connection outright over a protocol-version mismatch. The observed failure occurs during an SSHv2 key exchange when the server's RSA host key is only 1024 bits; changing the protocol version does not alter the host key's modulus length.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Regenerate the RSA key pair on the switch with a 2048-bit modulus using the command 'crypto key generate rsa modulus 2048'.Correct answer▾
Why this is correct
Regenerating the key pair with a higher modulus directly resolves the key-strength mismatch. The switch will then present a 2048-bit key during the SSH handshake, fixing the key exchange error. The existing 'ip ssh version 2' setting remains active after rekeying.
✗Verify IP connectivity between the client and the switch by issuing a ping from the client to the switch.Wrong answer — click to see why▾
Why this is wrong here
Assuming that a connection failure always starts at Layer 1 or 3, ignoring the specific error message that points to an application-layer mismatch.
✗Check the SSH client configuration on the host to ensure it accepts 1024-bit keys.Wrong answer — click to see why▾
Why this is wrong here
Misplaced troubleshooting – attempting to relax security instead of fixing the server’s key size to meet the documented standard.
✗Disable SSH version 2 on the switch and revert to SSH version 1, which does not enforce key length restrictions.Wrong answer — click to see why▾
Why this is wrong here
Drastic and insecure step that misdiagnoses the root cause; the issue is key size, not protocol version.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Asymmetric Encryption Algorithm Comparison
| Algorithm | Key Exchange | Signatures | Equivalent Security Key | Notes |
|---|---|---|---|---|
| RSA-3072 | Yes | Yes | 128-bit | Widely deployed; slow for bulk data |
| ECDSA P-256 | No | Yes | 128-bit | Fast signatures; standard TLS certs |
| ECDH / ECDHE | Yes | No | 128-bit | Perfect forward secrecy in TLS 1.3 |
| DH / DHE | Yes | No | 128-bit (3072-bit key) | Replaced by ECDHE in modern TLS |
| Ed25519 | No | Yes | ~128-bit | SSH keys, modern PKI |
Go deeper
Related to this question
Learn chapter
RA Guard — IPv6 First-Hop Security
Key term
Switch
A switch is a networking device that connects devices on a local area network and uses MAC addresses to forward data only to the intended recipient.
Key term
SSH
SSH (Secure Shell) is a cryptographic network protocol that provides secure, encrypted communication and remote administration between two devices over an unsecured network.
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.