SY0-701 Security Architecture Practice Question
Exhibit
Device management config: line vty 0 4 transport input telnet ssh login local SNMP community: public RO Management IP: 198.51.100.14/32 reachable from WAN Requirement: administrators must manage the device remotely without exposing credentials in transit.
Based on the exhibit, which change should be made first to secure remote administration of the network device?
⚠ Common exam trap
Many candidates think enabling a protocol like FTP with 'secure' in its name is sufficient, or they may overlook that Telnet's lack of encryption is the most critical vulnerability to address first, not password complexity or shared accounts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Disable Telnet and allow SSHv2 only for remote administration.
Telnet transmits all data, including credentials, in cleartext, making it vulnerable to interception. SSHv2 provides encrypted remote administration and is the secure replacement for Telnet. Disabling Telnet and enabling only SSHv2 is the immediate and necessary first step to secure remote device management.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable FTP so administrators can upload and download configuration files securely.
Why it's wrong here
FTP is an inherently insecure file-transfer protocol: it transmits usernames, passwords, and configuration data in cleartext over ports 20/21, allowing anyone with packet-capture access to recover administrative credentials and inspect or tamper with device files. It also provides no integrity checking or encryption, so it cannot fulfill a requirement to upload or download configurations securely. Secure file transfer should use SFTP, SCP, or TFTP over an encrypted VPN, not plain FTP.
- ✓
Disable Telnet and allow SSHv2 only for remote administration.
Why this is correct
Telnet sends all management traffic, including login credentials and command output, as unencrypted text over TCP port 23, making it trivial for an attacker on the network path to intercept the session and obtain privileged access. SSHv2, by contrast, provides confidentiality, integrity, and server authentication via cryptographic key exchange, and it can enforce strong cipher and MAC algorithms for the management session. Disabling Telnet and enabling only SSHv2 for remote administration is the correct first hardening step for the management plane.
- ✗
Open the management interface to any internet host as long as the password is complex.
Why it's wrong here
Exposing the management interface to the entire internet expands the attack surface to every hostile host on the planet, and a complex password alone cannot mitigate threats such as brute-force attacks, protocol vulnerabilities, or zero-day exploits in the management service. It also allows attackers to attempt credential-stuffing or device-fingerprinting reconnaissance at scale. Secure management access should be restricted to specific trusted IP addresses or routed through a VPN or jump host, never opened to any internet host.
- ✗
Use one shared local administrator account for all network engineers.
Why it's wrong here
Using one shared local administrator account for all network engineers eliminates individual accountability and makes it impossible to attribute configuration changes or security incidents to a specific user. It also creates a single point of credential exposure: if the shared password leaks, every engineer must be coordinated to rotate it, and the leaked credential grants identical access to all. Proper practice is to give each engineer a unique account authenticated through AAA/TACACS+ or RADIUS, enabling per-user auditing, RBAC, and accountability.
Go deeper
Related to this question
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.