A junior engineer wants R1 to accept inbound SSH version 2 sessions on its VTY lines. R1 currently has its factory hostname, no domain name, no crypto keys, and no local users. Which set of steps brings SSH up so that an administrator can log in with a local account?
Router> show running-config | include hostname
hostname Router
Router> show ip ssh
SSH Disabled - version 1.99
%Please create RSA keys to enable SSH.- AGenerate an RSA key of at least 768 bits and apply transport input ssh on the VTY lines, leaving the default hostname and skipping the domain name and local user
- BSet a hostname and ip domain-name, create a local username, then apply login local and transport input telnet on the VTY lines without generating any key
- CSet a hostname and ip domain-name, generate a 256-bit RSA key, create a local username, then apply login local and transport input ssh on the VTY lines
- DSet a hostname and ip domain-name, generate an RSA key of at least 768 bits, create a local username, then apply login local and transport input ssh on the VTY lines Correct
Why A is wrong: crypto key generate rsa fails while the hostname is the default Router and no ip domain-name is set, because the key label is built from both; without a local user and login local an administrator also has no credentials to present.
Why B is wrong: transport input telnet permits Telnet rather than SSH, and with no RSA key generated SSH cannot start at all, so this configuration leaves the device reachable only by clear-text Telnet.
Why C is wrong: Every other step here is right, but a 256-bit modulus is below the 768-bit minimum that SSH version 2 needs, so IOS will not bring SSH version 2 up on a key that small.
Why D is correct: The RSA key needs a non-default hostname and a domain name to form its label, the key must be at least 768 bits for SSH version 2, and the VTY lines need login local with transport input ssh so local credentials are checked and only SSH is accepted.