300-410 Infrastructure Security Practice Question
A network engineer is configuring SSH access on a Cisco IOS router. The engineer wants to restrict SSH access to only the management subnet 192.168.1.0/24 and ensure that only SSH version 2 is used. Which set of commands accomplishes this?
⚠ Common exam trap
The trap here is misapplying the access-class direction; it must be 'in' to filter incoming SSH connections, not 'out', and ensuring 'transport input ssh' restricts to SSH only.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ip ssh version 2 access-list 10 permit 192.168.1.0 0.0.0.255 line vty 0 4 transport input ssh access-class 10 in
The correct configuration must set SSH version 2, create an ACL for the management subnet, apply the ACL inbound on the VTY lines, and restrict transport input to SSH only. The other options either allow other protocols, use SSH version 1, or apply the ACL in the wrong direction.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ip ssh version 2 access-list 10 permit 192.168.1.0 0.0.0.255 line vty 0 4 transport input ssh access-class 10 out
Why it's wrong here
This configuration sets SSH version 2 and restricts transport to SSH, but it applies the access-class in the outbound direction. The 'access-class' on VTY lines should be applied inbound to filter incoming connections. Outbound filtering would not restrict who can connect to the router.
- ✗
ip ssh version 2 access-list 10 permit 192.168.1.0 0.0.0.255 line vty 0 4 transport input all access-class 10 in
Why it's wrong here
This configuration sets SSH version 2 and applies the ACL, but it allows all transport protocols (Telnet, SSH, etc.) with 'transport input all'. The requirement is to restrict to SSH only, so this does not meet the requirement. The ACL restricts source IPs, but other protocols are still allowed.
- ✓
ip ssh version 2 access-list 10 permit 192.168.1.0 0.0.0.255 line vty 0 4 transport input ssh access-class 10 in
Why this is correct
This configuration sets SSH to version 2, creates an ACL permitting the management subnet, applies the ACL to inbound VTY lines, and restricts transport input to SSH only. This meets both requirements: restrict SSH access to the management subnet and use only SSH version 2.
- ✗
ip ssh version 1 access-list 10 permit 192.168.1.0 0.0.0.255 line vty 0 4 transport input ssh access-class 10 in
Why it's wrong here
This configuration restricts to SSH and applies the ACL, but it sets SSH version 1 instead of version 2. The requirement is to use only SSH version 2, so this fails. SSH version 1 has known vulnerabilities and is not recommended.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every 300-410 question from scratch — 1,401 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.