An irritating Networking question

danyzuko

I just wanted to run this question by you guys. I went with Extended but they put so much verbage, I can't tell if that's right nor what:

Lets say you work at an enterprise that has no centralized authentication system. You are asked to configure an ACL on all of the routers on your network in such a way as to prevent unauthenticated Telnet access, while still giving the network team access. You have no way of knowing the IP address that you and your co-workers might have when logging into the routers at any given time.

What kind of ACL do you use to achieve the goal outlined above?

a. Extended
b. Time-based
c. Predictive
d. Reflexive
e. Dynamic

YFZblu

I'll take a stab - I don't work in networking however...

A - Can't be right because you don't know what IP's you and your co-workers will be using
B - Time-based makes no sense, because attackers operate during business hours too
C - Predictive - I have no idea what this is, or if it's even a thing
D - Reflexive is the old way Cisco used to attempt to achieve stateful connection tracking, right? I'll say no to that.

Which leaves us with 'E' - This is my choice. Perform authentication on the router itself. Here is what I found on Dynamic ACL's:

This process describes the lock-and-key access operation.

1. A user opens a Telnet session to a border router configured for lock-and-key access.
2. The Cisco IOS software receives the Telnet packet. It performs a user authentication process. The user must pass authentication before access is allowed. The authentication process is done by the router or a central access server such as a TACACS+ or RADIUS server.

Lock-and-Key: Dynamic Access Lists - Cisco Systems


-EDIT- The more I think about this, the more I think I'm shaky about my answer. I don't think I'd pick any of the others though, so...E is my educated guess.