Only hosts in the 10.10.50.0/24 administrator subnet should be able to open SSH sessions to an IOS XE router, but today any internal host can reach the login prompt. Which configuration enforces this?
Select an answer to reveal the explanation.
Short Explanation
Think of the VTY lines as the front door to the router's brain. An access-class ACL is the bouncer standing right at that door, checking the source address before anyone sees a login prompt. Strong passwords and timeouts are good habits, but they don't stop the wrong people from knocking on the door you're guarding.
Full Explanation
Remote management sessions terminate on virtual terminal lines. Applying an ACL to those lines with the access-class command filters connection attempts by source address before the login prompt is offered, regardless of which interface the packet arrived on. A standard ACL permitting the administrator subnet, with the implicit deny catching everything else, therefore limits SSH to that subnet exactly. Applying the same ACL outbound on LAN interfaces filters transit traffic leaving those interfaces, not traffic destined to the router itself, and it would also break normal forwarding for other users. Local usernames with strong secrets improve authentication strength, but every internal host could still reach the prompt and attempt to guess or reuse credentials, which is what the requirement forbids. An exec timeout limits how long an idle session stays open; it is a useful hardening step but has no effect on who can connect. Exam caveat: on many platforms a management-plane or control-plane policy can add further protection, but the VTY access-class remains the direct, expected answer for source restriction. Operational check: apply the ACL inbound on all VTY lines, attempt SSH from a host outside the administrator subnet and confirm it is refused, connect from inside the subnet to confirm access, and review ACL hit counts.