An emergency-management office must harden VTY access the same way on every Catalyst access stack before a weekend cutover. Which practice best delivers consistent management-plane access without turning each stack into a full AAA redesign?
Select an answer to reveal the explanation.
Short Explanation
Think of VTY lines like the office’s locked side door—every building should use the same lock pattern. A shared management ACL plus SSH-only access keeps the door usable for ops but closed to random visitors. Doing that once as a template beats reinventing AAA on every stack the night before cutover.
Full Explanation
Consistent Catalyst management hardening for an emergency-management office starts with identical VTY policy on every access stack: restrict source networks with a shared management ACL, prefer SSH over cleartext Telnet, and keep local or enable authentication adequate for the cutover window. Template-driven uniformity reduces one-off drift so every closet answers management traffic the same way. That delivers consistent management-plane access without forcing a weekend identity-server redesign; full TACACS+/RADIUS AAA remains valuable later, but this item targets switch-administration hygiene that can be pushed from the same configuration set used for the stacks.
Leaving default VTY lines open to any source and relying only on a strong enable secret expands the management-plane attack surface: any host that can reach TCP 22/23 can attempt authentication, and enable-secret strength does not replace source restriction or transport hardening. Disabling all remote management and requiring physical console for every change fails operational reality during a multi-stack cutover—console-only access does not scale across dispersed civic closets and invites delayed incident response. Enabling Telnet with local passwords so field techs can still connect reintroduces cleartext credentials on the wire and teaches the wrong temporary exception; cutover urgency is not a license for weaker transport.
Exam caveat: a management ACL and SSH-only VTY template harden how operators reach the device; they do not by themselves authenticate who the operator is at enterprise AAA scale, nor do they replace control-plane policing or OOB design. Operational check: from an unauthorized subnet, confirm SSH and Telnet are denied by the VTY ACL; from the management jump host, confirm SSH succeeds, Telnet is refused, and the same template shows identical line vty and access-class settings across stacks before the weekend cutover.