The answer is that the hostname and domain name are not configured. This is correct because SSH relies on a fully qualified domain name (FQDN) to properly bind the RSA keys to the router’s identity; without the `hostname` and `ip domain-name` commands, the `crypto key generate rsa modulus 2048` command may appear to succeed but actually creates default keys that are not associated with a unique FQDN, causing the SSH server to refuse connections. On the Cisco CCNP ENARSI 300-410 exam, this scenario tests your understanding of SSH prerequisites and is a common trap—engineers often assume key generation alone is sufficient, overlooking the mandatory hostname and domain configuration. A reliable memory tip is “No name, no fame”—without a hostname and domain, your RSA keys have no identity, and SSH will refuse the connection.
300-410 Device Access Control Practice Question
This 300-410 practice question tests your understanding of device access control. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
An engineer configures a Cisco router for SSH access. The router has an IP address on interface GigabitEthernet0/0, and the engineer generates RSA keys using the command 'crypto key generate rsa modulus 2048'. However, SSH connections fail with 'Connection refused'. What is the most likely cause?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "most likely"
Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
Correct because SSH uses the hostname and domain name to generate the RSA key pair; without them, the SSH server may not function.
B
The VTY lines are not configured with 'transport input ssh'.
Why wrong: Incorrect because even without 'transport input ssh', SSH would still attempt to connect; the refusal indicates the SSH server is not running.
C
The RSA key modulus is too small.
Why wrong: Incorrect because a modulus of 2048 is sufficient and supported.
D
The IP address on GigabitEthernet0/0 is not in the same subnet as the client.
Why wrong: Incorrect because the scenario does not mention connectivity issues; the refusal is at the application layer.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The hostname and domain name are not configured.
SSH requires a fully qualified domain name (FQDN) to generate RSA keys. Without a configured hostname and domain name, the 'crypto key generate rsa' command may appear to succeed but actually generates default keys that are not bound to the router's identity, causing SSH to refuse connections. The 'ip domain-name' and 'hostname' commands are prerequisites for proper RSA key generation and SSH operation.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
The hostname and domain name are not configured.
Why this is correct
Correct because SSH uses the hostname and domain name to generate the RSA key pair; without them, the SSH server may not function.
Clue confirmation
The clue word "most likely" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
The VTY lines are not configured with 'transport input ssh'.
Why it's wrong here
Incorrect because even without 'transport input ssh', SSH would still attempt to connect; the refusal indicates the SSH server is not running.
✗
The RSA key modulus is too small.
Why it's wrong here
Incorrect because a modulus of 2048 is sufficient and supported.
✗
The IP address on GigabitEthernet0/0 is not in the same subnet as the client.
Why it's wrong here
Incorrect because the scenario does not mention connectivity issues; the refusal is at the application layer.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Cisco often tests the prerequisite order for SSH configuration, trapping candidates who focus on VTY transport settings or key modulus size instead of the fundamental requirement of a domain name for RSA key generation.
Trap categories for this question
Scenario analysis trap
Incorrect because the scenario does not mention connectivity issues; the refusal is at the application layer.
Detailed technical explanation
How to think about this question
When generating RSA keys, Cisco IOS uses the hostname and domain name to create the key label (e.g., 'router.cisco.com'), which is required for SSH server identification. Without these, the router may generate a key with a default label that does not match the expected identity, causing the SSH server to fail to start or bind to the correct context. In real-world deployments, this is a common misconfiguration after initial setup, where engineers forget to configure 'ip domain-name' before key generation.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A network engineer segments a warehouse floor into three subnets: 20 scanners, 5 printers, and 2 management hosts. Picking the wrong mask wastes addresses or leaves too few usable hosts. Exam questions test whether you can apply CIDR notation, calculate block size, and identify the correct usable-host range for a given prefix.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this 300-410 question in full detail.
Device Access Control — This question tests Device Access Control — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: The hostname and domain name are not configured. — SSH requires a fully qualified domain name (FQDN) to generate RSA keys. Without a configured hostname and domain name, the 'crypto key generate rsa' command may appear to succeed but actually generates default keys that are not bound to the router's identity, causing SSH to refuse connections. The 'ip domain-name' and 'hostname' commands are prerequisites for proper RSA key generation and SSH operation.
What should I do if I get this 300-410 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "most likely". Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.