CCNA IP Routing Practice Question
A branch router uses PPP on a serial WAN link. Which additional PPP capability most directly improves access security on that link?
⚠ Common exam trap
A common exam trap is selecting options like STP root election or IPv6 loopback addressing as security features for PPP links. STP is a Layer 2 protocol that prevents loops in Ethernet networks and does not apply to serial WAN links or PPP authentication. Similarly, IPv6 loopback addresses are used for router management and diagnostics, not for authenticating peers on a WAN link. Candidates may also be tempted by unrelated wireless concepts like roaming, which have no bearing on PPP serial link security. Recognizing that PPP authentication specifically addresses peer verification on point-to-point links is essential to avoid these distractions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
PPP authentication
PPP authentication most directly improves access security on the link. In practical terms, authentication helps verify the identity of the peer rather than simply bringing up the point-to-point connection without validation. That makes PPP more useful than a bare unauthenticated link in environments where peer identity matters. At CCNA level, the important point is recognizing that PPP is associated with optional authentication capability on WAN links.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
PPP authentication
Why this is correct
PPP authentication is correct because the Point-to-Point Protocol includes native authentication mechanisms—PAP and CHAP—that let a branch router verify the identity of the remote peer on a serial WAN link. CHAP performs a three-way handshake with a challenge and a hashed response, while PAP sends the credentials in plaintext, so CHAP is the more secure choice. This peer-identity verification is an inherent PPP security capability that directly answers what additional functionality the router gains.
- ✗
STP root election
Why it's wrong here
STP root election is a mechanism in IEEE 802.1D/802.1w that runs on Ethernet switches to calculate a loop-free topology by selecting a root bridge and placing redundant ports in a blocking state. The serial WAN link on a branch router does not run Ethernet and does not carry BPDUs; PPP neither elects a root nor participates in STP. Root selection is therefore completely unrelated to the authentication feature of PPP.
When this WOULD be correct
If the question were about improving network stability in a switched environment, a question could ask which protocol helps prevent loops and manage traffic flow. In that context, STP root election would be the correct answer as it directly relates to maintaining a stable network topology.
- ✗
Wireless roaming
Why it's wrong here
Wireless roaming is a mobility feature of wireless LANs, such as 802.11k/v/r fast BSS transition, that lets a client disassociate from one access point and associate with another without interrupting the session. A serial PPP WAN link is a wired, point-to-point circuit, so there are no access points or radio frames to roam between. Consequently, wireless roaming has no role in PPP peer authentication on a branch router.
When this WOULD be correct
If the exam question asked about enhancing security for a wireless network environment, where users connect to access points and roam between them, then wireless roaming could be considered a correct answer due to its role in maintaining secure connections as users move.
- ✗
IPv6 loopback addressing
Why it's wrong here
An IPv6 loopback address, usually ::1 or a unique address assigned to a loopback interface, is used for management, testing, or router identification and has no authentication function. Configuring a loopback on the branch router does not affect PPP's peer verification because PAP/CHAP credentials are validated independently of any IP addressing scheme. Thus a loopback address cannot be the additional capability that authenticates a PPP peer.
When this WOULD be correct
In a question focused on IPv6 configuration, a scenario might ask about methods to verify connectivity or troubleshoot issues on an IPv6 network. In that context, selecting IPv6 loopback addressing would be appropriate as it allows for testing the local interface without involving external networks.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓PPP authenticationCorrect answer▾
Why this is correct
PPP authentication is correct because the Point-to-Point Protocol includes native authentication mechanisms—PAP and CHAP—that let a branch router verify the identity of the remote peer on a serial WAN link. CHAP performs a three-way handshake with a challenge and a hashed response, while PAP sends the credentials in plaintext, so CHAP is the more secure choice. This peer-identity verification is an inherent PPP security capability that directly answers what additional functionality the router gains.
✗STP root electionWrong answer — click to see why▾
Why this is wrong here
B is incorrect because STP (Spanning Tree Protocol) root election is related to loop prevention in Ethernet networks, not to securing WAN links using PPP. The question specifically asks about improving access security on a serial link, which STP does not address.
★ When this WOULD be the correct answer
If the question were about improving network stability in a switched environment, a question could ask which protocol helps prevent loops and manage traffic flow. In that context, STP root election would be the correct answer as it directly relates to maintaining a stable network topology.
Why candidates choose this
Candidates may be tempted by option B due to familiarity with STP in network design, mistakenly associating it with overall network security without recognizing the specific context of PPP and WAN links.
✗Wireless roamingWrong answer — click to see why▾
Why this is wrong here
Wireless roaming is not relevant to a PPP connection over a serial WAN link, as PPP operates over point-to-point connections and does not involve wireless technology or mobility features.
★ When this WOULD be the correct answer
If the exam question asked about enhancing security for a wireless network environment, where users connect to access points and roam between them, then wireless roaming could be considered a correct answer due to its role in maintaining secure connections as users move.
Why candidates choose this
Candidates may confuse wireless technologies with WAN connections, leading them to think that features like wireless roaming could somehow relate to improving security in a PPP context, especially if they have experience with wireless networks.
✗IPv6 loopback addressingWrong answer — click to see why▾
Why this is wrong here
IPv6 loopback addressing is not related to improving security on a PPP link; it is primarily used for testing and troubleshooting network interfaces rather than securing WAN connections.
★ When this WOULD be the correct answer
In a question focused on IPv6 configuration, a scenario might ask about methods to verify connectivity or troubleshoot issues on an IPv6 network. In that context, selecting IPv6 loopback addressing would be appropriate as it allows for testing the local interface without involving external networks.
Why candidates choose this
Candidates may confuse loopback addressing with security measures, thinking that any form of addressing could enhance security, especially if they are not fully aware of the specific roles of different addressing types in network security.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
OSI Model Reference
| Layer | Name | PDU | Key Protocols / Devices |
|---|---|---|---|
| 7 | Application | Data | HTTP, HTTPS, DNS, SMTP, FTP, SSH |
| 6 | Presentation | Data | TLS / SSL, JPEG, ASCII encoding |
| 5 | Session | Data | NetBIOS, RPC, SIP |
| 4 | Transport | Segment / Datagram | TCP, UDP |
| 3 | Network | Packet | IP, ICMP, OSPF — Routers |
| 2 | Data Link | Frame | Ethernet, Wi-Fi, PPP — Switches, Bridges |
| 1 | Physical | Bits | Cables, NICs, Hubs, Repeaters |
Go deeper
Related to this question
Learn chapter
OSPFv3 Single-Area Configuration for IPv6
Key term
WAN
A Wide Area Network (WAN) is a telecommunications network that connects multiple smaller networks, like local area networks, across large geographical distances.
Key term
Router
A router is a networking device that connects different networks together and directs data traffic between them by choosing the best path for data to travel.
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.