CCNA Switching and Network Access Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Because guest and employee WLANs can intentionally have different trust levels and access policies.

  Why this is correct

  Guest and employee WLANs are intentionally configured with different trust levels and access policies. A guest WLAN is typically placed in a less-trusted network zone, with ACLs that permit only outbound internet traffic while blocking access to internal corporate resources. This design is a deliberate security choice, not a technical limitation, because the organization wants visitors to have basic connectivity without exposing sensitive assets.

• ✗

  Because guest WLANs cannot use IP routing at all.

  Why it's wrong here

  This statement is incorrect because guest WLANs absolutely use IP routing to reach the internet. The guest traffic is forwarded by the access point or wireless controller to a router or firewall, which then routes it out through the WAN interface. The guest network simply has firewall policies or ACLs that restrict its destination, but the routing process itself is fully functional.

  When this WOULD be correct

  In a scenario where a question asks about the technical limitations of guest WLANs in a highly restricted network environment, stating that guest WLANs cannot use IP routing might be correct if the context specifies a configuration that disables routing for security reasons. This would clarify that routing is not permitted for guests.

• ✗

  Because the guest WLAN is assigned to a different VLAN that uses a different IP subnet, and inter-VLAN routing is inherently disabled for security reasons.

  Why it's wrong here

  This option is wrong because inter-VLAN routing is not inherently disabled for security reasons; it is a standard function of Layer 3 switches and routers. Even if the guest WLAN is on a separate VLAN with a different IP subnet, inter-VLAN routing is still needed to reach the internet gateway unless the gateway is on the same subnet. Security is enforced through ACLs and firewall rules tied to the VLAN interface, not by globally disabling inter-VLAN routing.

  When this WOULD be correct

  In a different exam scenario where the question states that employees are using static IP addresses and predefined host files for name resolution, it could be correct to say that they do not need DHCP or DNS services.

• ✗

  Because the guest WLAN uses a different SSID that automatically triggers firewall rules that only permit HTTP/HTTPS traffic.

  Why it's wrong here

  An SSID does not automatically trigger firewall rules; rather, the SSID is mapped to a specific VLAN or dynamic interface, and the security policies applied to that interface determine permitted traffic. These policies typically allow more than just HTTP/HTTPS, such as DNS and DHCP, so the statement oversimplifies how guest WLAN restrictions are implemented. The configuration is manual, not automatic, and depends on the network administrator's design.

  When this WOULD be correct

  In a question that asks about how different SSIDs can influence routing decisions in a complex network with multiple routing protocols, one could argue that SSIDs can impact BGP policy if the question specifies that SSIDs are tied to different routing policies in a multi-tenant environment.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”