An audit finds that administrators still manage switches with Telnet and the HTTP web interface, exposing credentials on the network. Which change remediates the finding?
Select an answer to reveal the explanation.
Short Explanation
Telnet and HTTP shout your password across the room for anyone to hear. SSH and HTTPS whisper it inside an encrypted tunnel. The sneaky trap is leaving Telnet on as a backup; attackers love a backup door you forgot about.
Full Explanation
Telnet and HTTP transmit sessions, including usernames and passwords, in clear text, so any device on the path can capture them. The remediation is to replace both with encrypted equivalents: SSH for command-line access and HTTPS for web management. That requires generating an RSA or other key pair, enabling SSH version 2, enabling the secure HTTP server, and then restricting VTY transport input to SSH and disabling the plain HTTP server so the cleartext paths no longer exist. Stronger passwords do not help when they are sent in clear text; a long password captured on the wire is as compromised as a short one. Moving management out of band reduces exposure, but credentials still cross that network unencrypted, so an attacker or compromised host there captures them; segmentation complements encryption but does not replace it. Leaving Telnet enabled as a fallback keeps the vulnerable protocol reachable and fails the audit, because the finding is about the protocol being available at all. Exam caveat: CIS benchmarks for IOS XE call for SSH version 2 only and for disabling unneeded services such as the HTTP server. Operational check: show the VTY transport input settings, attempt a Telnet connection and confirm it is refused, confirm SSH version 2 is active, and verify the HTTP server is off while HTTPS answers.