The correct answer is D.
To meet the requirement, the configuration must do two things:
Allow only a secure remote access protocol, which is SSH
The correct Cisco IOS configuration is:
access-list 23 permit 10.10.10.0 0.0.0.255
line vty 0 15
access-class 23 in
transport input ssh
access-list 23 permit 10.10.10.0 0.0.0.255 This correctly matches the subnet 10.10.10.0/24 using the proper wildcard mask 0.0.0.255.
line vty 0 15 This applies the restriction to all VTY lines, not only a subset.
access-class 23 in This filters incoming remote access connections to the router.
transport input ssh This allows only SSH, which is encrypted and secure, and prevents Telnet or other clear-text remote access protocols.
access-class 23 out filters outbound connections from the VTY lines, not inbound management access.
transport input all allows insecure protocols such as Telnet.
B is incorrect because:
255.255.255.0 is a subnet mask, not a wildcard mask, so the ACL syntax is wrong for a standard ACL entry.
C is incorrect because:
It applies only to VTY 0 4, while the router also has VTY 5 15 configured.
This leaves other VTY lines unrestricted, which does not fully meet the requirement.
For secure remote management on Cisco devices:
Use access-class < ACL > in on VTY lines to restrict who can connect
Use the correct wildcard mask for the subnet
For 10.10.10.0/24, the wildcard mask is:
0.0.0.255
So the complete secure solution is:
restrict inbound VTY access + allow only SSH + apply to all VTY lines
