Only the admin PC
R1 already runs SSH (user admin, secret Adm1n!2026). Security wants only the admin PC (10.1.1.10) to be able to open a session to R1. Use standard ACL MGMT (a named ACL) on the vty lines. PC2 must be refused; R2 must also be refused when it tries to SSH to R1.
How it works: this is VulnTech NetLab, a network simulator running in your browser. Click a device in the diagram to open its console and type commands, just like on real equipment (? shows help, Tab finishes a word). Click a cable to inspect it. Tasks tick themselves off as you complete them; questions are answered in the box under each task. Your work is kept if you reload; Reset starts the network over.
Solution explanation
access-class only checks sessions to the router's own vty lines, so traffic passing through R1 isn't affected. The same ACL on an interface with ip access-group would have cut PC2 off from everything.
Show solution
[R1]
enable
configure terminal
ip access-list standard MGMT
permit host 10.1.1.10
exit
line vty 0 4
access-class MGMT in
end
[PC2]
ssh admin@10.1.1.1
ping -c 2 10.0.12.2
[ADMIN]
ssh -l admin 10.1.1.1
Adm1n!2026
exit