CCNA Network Services and Security Practice Question
A router allows SSH management from anywhere on the internal network. A new policy requires that only the management subnet 10.50.50.0/24 be allowed to initiate SSH to the device. Which approach best enforces that requirement?
⚠ Common exam trap
A frequent exam trap is selecting an option that changes the management protocol, such as replacing SSH with Telnet, because it seems to simplify access control. However, Telnet is insecure as it transmits data in clear text, exposing credentials to interception. Another trap is choosing unrelated features like PortFast or syslog severity thresholds, which do not control access to management services. Candidates may also overlook the need to apply an ACL to restrict source IPs, mistakenly believing that enabling SSH alone enforces the policy. This misunderstanding leads to incomplete security configurations that fail the requirement to limit SSH access to the management subnet.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Restrict SSH access so only the 10.50.50.0/24 management subnet is permitted
The best approach is to use an access control mechanism that limits SSH access to the approved source subnet. In practical terms, SSH is the correct secure protocol, but protocol choice alone is not enough. The device should also restrict who is allowed to reach that management service. That usually means applying an ACL or equivalent source restriction focused on the management subnet. This is a common management-plane security pattern: use a secure protocol, then limit the set of trusted sources that are allowed to use it.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Restrict SSH access so only the 10.50.50.0/24 management subnet is permitted
Why this is correct
Restricting SSH access to only the 10.50.50.0/24 management subnet is the correct action because it applies a standard access control list (ACL) on the VTY lines or a control-plane ACL, limiting which source IP addresses can initiate SSH sessions. This directly addresses the router's exposure by shrinking the attack surface to a dedicated, trusted management network, while still allowing authorized engineers to administer the device securely. Other measures like changing protocols or enabling switch features do not constrain the SSH source in any way, so this is the only option that implements the stated policy of source-based restriction.
- ✗
Replace SSH with Telnet so the traffic is easier to identify
Why it's wrong here
Replacing SSH with Telnet would actually worsen security because Telnet transmits credentials and traffic in plaintext, allowing anyone on the internal network to capture sensitive data with a simple packet sniffer. While Telnet packets are indeed easier to inspect, that is not a valid justification for using it on a production network, and it does nothing to limit which hosts can reach the router's management interface. The correct approach is to keep SSH and enforce a source restriction, not to downgrade the protocol, as easier identification is far less important than confidentiality and integrity.
When this WOULD be correct
In a different scenario where the exam question asks about simplifying network traffic analysis for a legacy system that only supports Telnet, replacing SSH with Telnet could be considered correct if the focus is on identifying and monitoring traffic rather than security.
- ✗
Enable PortFast on all access switches
Why it's wrong here
Enabling PortFast on all access switches is unrelated to router management access because PortFast is a Spanning Tree Protocol (STP) feature that removes the listening/learning delay for end-user ports, allowing them to move directly to the forwarding state. It is designed to speed up host connectivity after a port transitions to up, and it has absolutely no effect on SSH, access lists, or which devices can connect to the router's VTY lines. Therefore, this network tweak would neither block nor grant SSH access from the management subnet, making it an irrelevant solution to the stated problem.
When this WOULD be correct
If the question asked about optimizing switch port performance during network convergence or reducing the time for devices to connect to the network, enabling PortFast could be the correct answer, as it helps improve efficiency in such scenarios.
- ✗
Raise the Syslog severity threshold
Why it's wrong here
Raising the Syslog severity threshold is a logging configuration that controls which messages are forwarded to a Syslog server, for example setting it to a higher level (like 'critical') to suppress informational messages. It has no bearing on authentication or authorization for SSH sessions because Syslog is a passive audit mechanism, not an access-control feature. This change would neither permit nor deny any source IP from reaching the router's SSH service, so it fails to satisfy the requirement of restricting management access to the 10.50.50.0/24 subnet.
When this WOULD be correct
If the question asked about improving log management and reducing the volume of log messages generated by SSH access attempts, raising the Syslog severity threshold could be the correct answer. This would be appropriate in a scenario focused on log management rather than access control.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Restrict SSH access so only the 10.50.50.0/24 management subnet is permittedCorrect answer▾
Why this is correct
Restricting SSH access to only the 10.50.50.0/24 management subnet is the correct action because it applies a standard access control list (ACL) on the VTY lines or a control-plane ACL, limiting which source IP addresses can initiate SSH sessions. This directly addresses the router's exposure by shrinking the attack surface to a dedicated, trusted management network, while still allowing authorized engineers to administer the device securely. Other measures like changing protocols or enabling switch features do not constrain the SSH source in any way, so this is the only option that implements the stated policy of source-based restriction.
✗Replace SSH with Telnet so the traffic is easier to identifyWrong answer — click to see why▾
Why this is wrong here
Telnet transmits data in plaintext, including passwords, making it highly insecure. Replacing SSH with Telnet would violate security policies and expose management traffic to eavesdropping, which is contrary to the goal of restricting access securely.
★ When this WOULD be the correct answer
In a different scenario where the exam question asks about simplifying network traffic analysis for a legacy system that only supports Telnet, replacing SSH with Telnet could be considered correct if the focus is on identifying and monitoring traffic rather than security.
Why candidates choose this
Students might think that Telnet is simpler to filter because it uses a well-known port (23), but they overlook the critical security disadvantage. The question focuses on restricting access, not on ease of identification.
✗Enable PortFast on all access switchesWrong answer — click to see why▾
Why this is wrong here
PortFast is a Spanning Tree Protocol feature used on switch ports connected to end devices to speed up convergence. It has no effect on router management access or SSH filtering, and applying it would not restrict SSH initiation.
★ When this WOULD be the correct answer
If the question asked about optimizing switch port performance during network convergence or reducing the time for devices to connect to the network, enabling PortFast could be the correct answer, as it helps improve efficiency in such scenarios.
Why candidates choose this
PortFast is a common Cisco feature that students learn about, and they might confuse it with security features like port security or access lists. The name 'PortFast' might be misassociated with 'fast access control'.
✗Raise the Syslog severity thresholdWrong answer — click to see why▾
Why this is wrong here
Syslog severity thresholds control which log messages are sent to a syslog server; they do not filter incoming traffic or restrict who can initiate SSH. Changing the threshold would not prevent unauthorized SSH attempts.
★ When this WOULD be the correct answer
If the question asked about improving log management and reducing the volume of log messages generated by SSH access attempts, raising the Syslog severity threshold could be the correct answer. This would be appropriate in a scenario focused on log management rather than access control.
Why candidates choose this
Students might think that raising the severity threshold reduces logging and thus 'hides' management traffic, but this does not enforce access control. They may confuse logging with access filtering.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Device File Management with SFTP and SCP
Key term
Router
A router is a networking device that connects different networks together and directs data traffic between them by choosing the best path for data to travel.
Key term
Access Control List
An Access Control List is a set of rules that decides which traffic is allowed or denied entry to a network or device.
About these practice questions
This 200-301 question is part of Courseiva's 1,389-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.