CCNP Security Practice Question
A network administrator must secure management access to a Cisco Catalyst 9300 switch so that only encrypted sessions are accepted and any Telnet attempt is refused. The administrator wants to enforce this with the fewest configuration lines on the VTY lines. Which configuration accomplishes this?
⚠ Common exam trap
Test-takers frequently confuse transport input with transport output, which control opposite directions of the management session.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
line vty 0 15 followed by transport input ssh
Restricting inbound VTY access to SSH is done by entering line configuration mode and issuing transport input ssh, which permits only SSH and denies Telnet by default. Because Telnet is implicitly excluded, no ACL is needed, making this the most concise and reliable way to enforce encrypted-only management access on the switch.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
line vty 0 15 followed by transport output ssh
Why it's wrong here
The transport output command controls which protocols an outgoing session from this device may use, not which protocols a remote client may use to reach the VTY lines. It has no effect on inbound Telnet attempts, so an administrator could still Telnet into the switch. This option addresses the wrong direction of traffic.
- ✗
line vty 0 15 followed by login local and transport input telnet ssh
Why it's wrong here
Including telnet in the transport input list explicitly re-enables Telnet, which contradicts the stated requirement to refuse Telnet. Although login local enforces local username authentication, it does not encrypt the session. Telnet traffic remains cleartext, so this configuration fails the encryption and protocol restriction goals.
- ✗
line vty 0 15 followed by transport input all then access-class 10 in with an ACL denying TCP port 23
Why it's wrong here
This approach allows all transports on the VTY lines and then depends on a separate ACL to block Telnet. It uses more configuration than necessary, and the ACL must be correctly written and applied, adding failure points. The simpler transport input ssh directly restricts inbound protocols without an auxiliary ACL.
- ✓
line vty 0 15 followed by transport input ssh
Why this is correct
The transport input ssh command on the VTY lines permits only SSH and implicitly rejects Telnet, so no additional access-class or ACL is required. This satisfies the requirement with a single line inside line configuration mode, assuming the device already has a hostname, domain name, and RSA key pair generated for SSH to function.
Visual reference
About these practice questions
One of 1,923 original 350-401 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.