CCNA Network Services and Security Practice Question
A network administrator wants to secure remote CLI access to a Cisco router, moving beyond simple username/password authentication. Which approach best achieves this goal?
⚠ Common exam trap
A common trap is thinking that limiting access with an ACL (option C) satisfies the goal, but ACLs restrict source addresses, not strengthen the authentication process. Another trap is confusing stronger authentication with simpler troubleshooting (B) or location-based trust (D).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use stronger or additional authentication controls to improve remote administrative access security
The goal is to strengthen authentication beyond a simple password. Cisco AAA (Authentication, Authorization, and Accounting) using TACACS+ or RADIUS provides stronger, centralized authentication. Secure Shell (SSH) with key-based or two-factor authentication also enhances security. Option A correctly describes this concept, while the other options either weaken security (B, D) or address access control via ACLs, which does not improve the authentication factor itself (C).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use stronger or additional authentication controls to improve remote administrative access security
Why this is correct
Implementing stronger or additional authentication controls—such as multi-factor authentication, AAA with TACACS+/RADIUS, or per-user credentials—directly addresses the security of the management plane. A static password alone is vulnerable to password guessing, credential theft, or replay. Strong authentication ensures that even if one factor is compromised, an attacker cannot complete the login process, protecting the device from unauthorized remote configuration.
- ✗
Replace SSH with Telnet to simplify troubleshooting
Why it's wrong here
Replacing SSH with Telnet would downgrade the remote-management session to plaintext, exposing usernames, passwords, and executed commands to any observer on the network path. Telnet lacks encryption and integrity protection, making the administrative session vulnerable to eavesdropping and session hijacking, whereas SSH provides robust encryption and strong authentication. This swap would weaken, not simplify, management security.
When this WOULD be correct
This option could be correct in a scenario where the question asks about troubleshooting network connectivity issues and emphasizes ease of access for administrators. If the focus were on simplifying access for troubleshooting rather than security, replacing SSH with Telnet might be considered appropriate.
- ✗
Configure an extended ACL to limit remote access to specific source IP addresses
Why it's wrong here
This answer is wrong because it is not an authentication control; it merely restricts source IP addresses. If authentication remains weak, an attacker can simply originate from an allowed source (e.g., by spoofing) or compromise that host, effectively bypassing the ACL. Substituting an ACL for proper authentication leaves the device with a weaker security posture, undermining secure remote administrative access.
When this WOULD be correct
In a hypothetical exam scenario where the question asks about a system that requires immediate access without any credentials for emergency situations, disabling authentication could be considered correct to prevent lockouts during critical failures.
- ✗
Disable password authentication and rely solely on device location in the network
Why it's wrong here
Disabling password authentication and relying only on network location is fundamentally unsafe because location is not an identity factor. An attacker can spoof a trusted IP address or compromise a device inside the trusted segment, gaining access without proving authorization. Additionally, this proposal has no connection to switch trunking, which concerns VLAN propagation over inter-switch links and does not strengthen remote-administration authentication in any way.
When this WOULD be correct
In a question focused on network design where the goal is to optimize bandwidth and support multiple VLANs on a single connection, selecting trunk ports could be the correct answer. For instance, if the question asks how to efficiently manage VLAN traffic in a switched network environment, trunking would be appropriate.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Use stronger or additional authentication controls to improve remote administrative access securityCorrect answer▾
Why this is correct
Implementing stronger or additional authentication controls—such as multi-factor authentication, AAA with TACACS+/RADIUS, or per-user credentials—directly addresses the security of the management plane. A static password alone is vulnerable to password guessing, credential theft, or replay. Strong authentication ensures that even if one factor is compromised, an attacker cannot complete the login process, protecting the device from unauthorized remote configuration.
✗Replace SSH with Telnet to simplify troubleshootingWrong answer — click to see why▾
Why this is wrong here
Telnet transmits credentials in plaintext, making it less secure than SSH and opposite to the goal of stronger authentication.
★ When this WOULD be the correct answer
This option could be correct in a scenario where the question asks about troubleshooting network connectivity issues and emphasizes ease of access for administrators. If the focus were on simplifying access for troubleshooting rather than security, replacing SSH with Telnet might be considered appropriate.
Why candidates choose this
Candidates may choose this option due to a misunderstanding of the trade-offs between security and ease of access, believing that simpler protocols like Telnet could facilitate quicker troubleshooting without recognizing the security implications.
✗Configure an extended ACL to limit remote access to specific source IP addressesWrong answer — click to see why▾
Why this is wrong here
While ACLs can limit which hosts can connect, they do not strengthen the authentication mechanism itself; they only restrict source addresses.
★ When this WOULD be the correct answer
In a hypothetical exam scenario where the question asks about a system that requires immediate access without any credentials for emergency situations, disabling authentication could be considered correct to prevent lockouts during critical failures.
Why candidates choose this
Candidates might be tempted by the idea of avoiding lockouts, especially in high-pressure environments where quick access is crucial, leading them to overlook the severe security implications of disabling authentication.
✗Disable password authentication and rely solely on device location in the networkWrong answer — click to see why▾
Why this is wrong here
Relying solely on location removes all credential verification, making the device vulnerable to unauthorized access from allowed locations.
★ When this WOULD be the correct answer
In a question focused on network design where the goal is to optimize bandwidth and support multiple VLANs on a single connection, selecting trunk ports could be the correct answer. For instance, if the question asks how to efficiently manage VLAN traffic in a switched network environment, trunking would be appropriate.
Why candidates choose this
Candidates may be tempted by this option because they associate trunk ports with advanced network configurations, mistakenly believing that they enhance overall security by managing multiple VLANs, rather than focusing on authentication methods.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
Learn chapter
Configuring AAA with TACACS+ and RADIUS on IOS XE
Key term
AAA
AAA (Authentication, Authorization, and Accounting) is a security framework that controls who can access a network, what they are allowed to do, and tracks what they did.
Key term
RADIUS
RADIUS is a network protocol that provides centralized authentication, authorization, and accounting management for users who connect and use a network service.
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.