CCNA Network Services and Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Authentication

  Why it's wrong here

  Authentication is the process of verifying the user's identity, typically through a username and password, before they are allowed into the device. Since the engineer successfully logs in, authentication has already passed and is not the barrier. The failure arises later when attempting to use a command, which is a separate stage. Therefore, authentication is not the cause of the command being blocked.

  When this WOULD be correct

  In a different question, if it asked about the process that prevents a user from logging in altogether due to incorrect credentials, then authentication would be the correct answer. For example, if a user attempts to log in with a wrong username or password, authentication would fail.

• ✓

  Authorization

  Why this is correct

  Authorization is the AAA component that determines which commands a successfully authenticated user is permitted to execute. Even after a valid login, the router consults authorization rules, such as privilege levels or per-command permissions from a TACACS+ or RADIUS server, to decide whether to allow a specific command. If the user lacks the required privilege or is not explicitly authorized, the command is rejected. Thus, the engineer's inability to run the command is directly due to authorization failing.

• ✗

  Accounting

  Why it's wrong here

  Accounting in AAA is a tracking and auditing function that records what a user did, such as login, command executions, or network usage, for security review or billing. It does not grant or deny access to any command; it simply logs events after they occur. Because the engineer cannot even execute the command, accounting is not the reason—there is no action to log yet. The denial occurs at the authorization step, not due to missing accounting.

  When this WOULD be correct

  If the question were about monitoring user activities and resource usage on the router, such as tracking which commands were executed by users, then accounting would be the correct answer. For example, a question could ask about the function that logs user actions after they have been authenticated and authorized.

• ✗

  Encryption

  Why it's wrong here

  Encryption protects data confidentiality by encoding information so that it cannot be read by unauthorized parties, whether in transit over a network or in stored configuration. It does not control or restrict command execution on a router, and it is not one of the three core AAA services (authentication, authorization, and accounting). The command denial is a permission issue, not a data-protection one. Thus, encryption is irrelevant to why the command is unavailable.

  When this WOULD be correct

  If the question were about securing the communication between the router and a management station, asking which AAA function ensures that the data is encrypted during transmission, then encryption would be the correct answer.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question