A community college district is retiring cleartext device management. Which change best replaces insecure protocols for civic network device access and file transfer?
Select an answer to reveal the explanation.
Short Explanation
Telnet and friends are like mailing the master key on a postcard. SSH locks the interactive session, and SCP (or similar secure copy) keeps images and configs off the clear. Turn off Telnet and standardize on encrypted management paths.
Full Explanation
Community college device management must retire cleartext protocols that expose credentials and file contents on civic management networks. Requiring SSH for interactive CLI and SCP (or equivalent secure copy) for images and configs replaces Telnet and insecure file transfer with encrypted channels. Disabling Telnet while standardizing secure shell and secure copy is the practical hardening step for IOS XE management planes.
Keeping Telnet for CLI and FTP for image copies preserves cleartext exposure even if ACLs exist; firewalling does not encrypt the session. Allowing HTTP without TLS for GUI management and TFTP for upgrades likewise leaves credentials and binaries unprotected. Moving all management to SNMPv2c SET operations does not provide a secure interactive CLI and still uses weak community-string security.
Exam caveat: HTTPS for GUI and SNMPv3 authPriv complement SSH/SCP but do not replace the need to eliminate Telnet/FTP/TFTP for the scenarios those insecure protocols historically covered. Operational check: disable Telnet/FTP/TFTP transport features, enforce SSH and SCP in templates, verify management VRF ACLs, and confirm a lab image copy and CLI login succeed only over the secure methods before district-wide cutover.