CCNP Infrastructure Practice Question
A network administrator is configuring a Cisco IOS router to authenticate OSPF neighbors using MD5. The router must use key 1 with the password 'Cisco123' on interface GigabitEthernet0/0. Which configuration is correct?
⚠ Common exam trap
A common mix-up: candidates confuse area-wide authentication with interface-level key configuration, leading to placing the key under the OSPF process instead of the interface.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
interface GigabitEthernet0/0 ip ospf authentication message-digest ip ospf message-digest-key 1 md5 Cisco123
To enable OSPF MD5 authentication on a specific interface, you must enter interface configuration mode, enable MD5 authentication with 'ip ospf authentication message-digest', and define the key with 'ip ospf message-digest-key 1 md5 Cisco123'. This ensures that OSPF packets on that interface are authenticated using MD5, meeting the security requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
interface GigabitEthernet0/0 ip ospf authentication-key Cisco123 ip ospf authentication
Why it's wrong here
This configuration uses plaintext authentication, not MD5. The 'ip ospf authentication-key' command sets a plaintext password, and 'ip ospf authentication' enables simple password authentication. While it would authenticate OSPF neighbors, it does not meet the requirement for MD5 authentication, which provides stronger security through hashing and is required in this scenario.
- ✗
router ospf 1 area 0 authentication message-digest ip ospf message-digest-key 1 md5 Cisco123
Why it's wrong here
The 'area 0 authentication message-digest' command enables MD5 authentication for the entire OSPF area, but the key must still be configured on the interface, not under the router OSPF process. Placing 'ip ospf message-digest-key' under router ospf is invalid syntax; it belongs in interface configuration mode. This option would not achieve the desired per-interface authentication and would likely cause a configuration error.
- ✓
interface GigabitEthernet0/0 ip ospf authentication message-digest ip ospf message-digest-key 1 md5 Cisco123
Why this is correct
This configuration enables OSPF MD5 authentication on the interface and defines the key with ID 1 and password 'Cisco123'. The 'ip ospf authentication message-digest' command activates MD5 authentication for OSPF on that interface, and the 'ip ospf message-digest-key' command specifies the key. This is the correct method to configure MD5 authentication on a per-interface basis in Cisco IOS.
- ✗
router ospf 1 authentication message-digest message-digest-key 1 md5 Cisco123
Why it's wrong here
This configuration attempts to enable MD5 authentication under the OSPF process, but the correct command is 'area 0 authentication message-digest' for area-wide authentication, and the key must be configured on the interface. The commands shown are not valid in router OSPF configuration mode. Therefore, this option is incorrect and would not enable MD5 authentication as required.
Visual reference
Quick reference
Routing Protocol Comparison
| Protocol | Metric | Max Hops | Algorithm | Type |
|---|---|---|---|---|
| RIP v2 | Hop count | 15 | Bellman-Ford | Distance vector |
| OSPF | Cost (bandwidth) | Unlimited | Dijkstra (SPF) | Link state |
| EIGRP | Composite metric | Unlimited | DUAL | Hybrid |
| IS-IS | Cost | Unlimited | Dijkstra | Link state |
| BGP | Policy / attributes | Unlimited | Path vector | Path vector |
RIP's 15-hop limit makes it unsuitable for large networks. OSPF and EIGRP dominate modern enterprise deployments.
About these practice questions
This 350-401 question is part of Courseiva's 1,923-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.