The answer is to enable SSH on the VTY lines and use local or AAA authentication, while disabling Telnet. This is correct because SSH provides encrypted remote CLI access, securing credentials and data in transit, whereas Telnet transmits everything in plaintext, violating a security policy that requires blocking insecure remote access. On the CCNA 200-301 v2 exam, this tests your understanding of VTY line configuration and the transport input command; a common trap is forgetting that enabling SSH alone does not prevent Telnet—you must explicitly disable it with transport input ssh or remove Telnet from the allowed protocols. A reliable memory tip is “SSH secures, Telnet leaks,” so always pair the ssh transport keyword with authentication (local or AAA) to satisfy both security and access requirements.
CCNA Network Services and Security Practice Question
This 200-301 practice question tests your understanding of network services and security. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. A key principle to apply: sSH encrypts remote management sessions, preventing credential and data interception during CLI access to network devices.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A security policy requires administrators to permit SSH to network devices but block insecure remote CLI access. Which two actions support that goal?
SSH encrypts remote management sessions, preventing credential and data interception during CLI access to network devices.
✓
Disable Telnet access on the VTY lines
Why this is correct
Telnet sends credentials and session data in clear text and should be blocked.
Related concept
SSH encrypts remote management sessions, preventing credential and data interception during CLI access to network devices.
✗
Enable CDP globally
Why it's wrong here
CDP is a discovery protocol and does not secure management access.
✗
Configure the console line for transport input ssh
Why it's wrong here
SSH applies to remote VTY access, not the physical console port.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Enable SSH on the VTY lines and use local or AAA authenticationCorrect answer▾
Why this is correct
SSH provides encrypted remote management.
✗Enable CDP globallyWrong answer — click to see why▾
Why this is wrong here
CDP (Cisco Discovery Protocol) is a Layer 2 protocol used to discover neighboring Cisco devices and does not provide any remote CLI access or security. Enabling CDP globally does not affect SSH or Telnet access, so it does not support the goal of permitting secure remote access while blocking insecure access.
Why candidates choose this
Students might confuse CDP with a security feature because it is a Cisco proprietary protocol often discussed in CCNA. However, CDP is purely for device discovery and has no role in securing management access.
✗Configure the console line for transport input sshWrong answer — click to see why▾
Why this is wrong here
The console line is a physical port used for local management, not for remote access. Configuring 'transport input ssh' on the console line would prevent local serial access if SSH is not available, but it does not affect remote VTY access. The security policy focuses on remote CLI access, which is handled by VTY lines, not the console.
Why candidates choose this
Students may think that applying SSH to any line (including console) enhances security. However, the console is for local out-of-band management, and restricting it to SSH is impractical and does not address remote access security.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Common exam traps
Common exam trap: answer the scenario, not the keyword
A frequent exam trap is selecting options related to the console line or CDP when the question focuses on securing remote CLI access. The console line is for local physical access and does not support SSH, so configuring SSH there does not meet the requirement. Similarly, enabling CDP is unrelated to securing management access and does not block insecure protocols like Telnet. Another common mistake is assuming that enabling SSH alone is sufficient without disabling Telnet, which leaves an insecure access method open. Candidates must carefully distinguish between local and remote access methods and ensure insecure protocols are explicitly blocked on VTY lines.
Detailed technical explanation
How to think about this question
Secure remote management of Cisco network devices relies heavily on the use of SSH (Secure Shell). SSH encrypts all session data, including usernames and passwords, which protects against eavesdropping and man-in-the-middle attacks. Unlike Telnet, which sends data in plaintext, SSH ensures confidentiality and integrity of management traffic. Cisco devices use VTY (Virtual Teletype) lines to handle remote CLI sessions, and these lines can be configured to accept only SSH connections by specifying the allowed transport protocols.
To comply with security policies that require encrypted remote access, administrators must enable SSH on the VTY lines and configure authentication methods such as local user databases or AAA (Authentication, Authorization, and Accounting). This setup ensures that only authorized users can establish SSH sessions. Additionally, Telnet access must be explicitly disabled on the VTY lines to prevent insecure remote CLI access. This is done by removing Telnet from the allowed transport input protocols, effectively blocking any unencrypted remote management attempts.
A common exam trap is confusing the console line with VTY lines. The console line provides local physical access and does not support SSH; therefore, configuring SSH on the console line is ineffective. Another practical consideration is that enabling CDP (Cisco Discovery Protocol) globally does not affect remote management security and does not block insecure access. Understanding these distinctions helps avoid misconfigurations and ensures compliance with security policies that mandate encrypted remote CLI access via SSH only.
KKey Concepts to Remember
SSH encrypts remote management sessions, preventing credential and data interception during CLI access to network devices.
Telnet transmits data and credentials in clear text, which exposes devices to security risks and should be disabled on VTY lines.
VTY lines on Cisco devices control remote access protocols such as SSH and Telnet for CLI management.
Local or AAA authentication on VTY lines ensures that only authorized users can access network devices remotely via SSH.
Configuring transport input on VTY lines explicitly defines which protocols are allowed for remote CLI access.
The console line is a physical access method and does not support SSH; SSH applies only to remote VTY sessions.
Security policies requiring encrypted remote access must enable SSH and disable insecure protocols like Telnet on VTY lines.
Network devices must be configured to prevent insecure remote CLI access by blocking Telnet and permitting only SSH.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
SSH encrypts remote management sessions, preventing credential and data interception during CLI access to network devices.
Real-world example
How this comes up in practice
A security administrator must allow nursing staff to reach a patient records server while blocking access from the guest Wi-Fi VLAN. After applying an extended ACL, traffic is still blocked from nursing workstations. The ACL was applied outbound instead of inbound on the wrong interface. Questions like this test ACL direction and placement rules.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this 200-301 question in full detail.
Review sSH encrypts remote management sessions, preventing credential and data interception during CLI access to network devices., then practise related 200-301 questions on the same topic to reinforce the concept.
Network Services and Security — This question tests Network Services and Security — SSH encrypts remote management sessions, preventing credential and data interception during CLI access to network devices..
What is the correct answer to this question?
The correct answer is: Enable SSH on the VTY lines and use local or AAA authentication — To meet the requirement, the device should allow encrypted SSH access and explicitly avoid Telnet for remote management.
What should I do if I get this 200-301 question wrong?
Review sSH encrypts remote management sessions, preventing credential and data interception during CLI access to network devices., then practise related 200-301 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
SSH encrypts remote management sessions, preventing credential and data interception during CLI access to network devices.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.