CCNA Network Services and Security Practice Question
This 200-301 practice question tests your understanding of network services and security. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. A key principle to apply: an Access Control List (ACL) filters traffic by source IP, destination IP, and protocol to enforce security policies on Cisco routers.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A security policy requires that only one management subnet be able to initiate SSH to a router. Which approach most directly supports that requirement?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use an ACL to permit SSH access only from the approved management subnet.
The most direct approach is to use an ACL that restricts which source subnet is permitted to reach SSH management access on the router. In practical terms, SSH can remain enabled as the secure protocol, but access to it should still be limited to trusted management sources. That is a classic example of combining secure protocol choice with source restriction. Options B and C are incorrect because PortFast is a spanning-tree feature unrelated to access control, and disabling logging does not restrict who can initiate SSH. Option D is wrong because Telnet does not filter by subnet and is less secure than SSH.
Key principle: An Access Control List (ACL) filters traffic by source IP, destination IP, and protocol to enforce security policies on Cisco routers.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
Use an ACL to permit SSH access only from the approved management subnet.
Why this is correct
This is correct because the policy is specifically about restricting management access by source subnet.
Related concept
An Access Control List (ACL) filters traffic by source IP, destination IP, and protocol to enforce security policies on Cisco routers.
✗
Enable PortFast on the router interfaces.
Why it's wrong here
This is wrong because PortFast is a switch feature, not a router management-access control.
When this WOULD be correct
If the question were about optimizing the time it takes for a switch port to transition to an active state after being connected, then enabling PortFast would be the correct answer. This would be relevant in a scenario focused on reducing network downtime during device connections.
✗
Disable all logging on the router.
Why it's wrong here
This is wrong because disabling logging weakens visibility and does not restrict management access.
When this WOULD be correct
In a question where the goal is to minimize resource usage or enhance performance by reducing log entries, disabling logging could be the correct answer. For example, if the question specifies that logging is causing performance issues and needs to be turned off to maintain system efficiency, this option would be valid.
✗
Replace SSH with Telnet for easier filtering.
Why it's wrong here
This is wrong because Telnet is less secure than SSH.
When this WOULD be correct
If the exam question asked for a method to simplify access control for a legacy system that only supports Telnet, and the requirement was to allow access from a specific subnet, then replacing SSH with Telnet could be considered correct in that context.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Use an ACL to permit SSH access only from the approved management subnet.Correct answer▾
Why this is correct
This is correct because the policy is specifically about restricting management access by source subnet.
✗Enable PortFast on the router interfaces.Wrong answer — click to see why▾
Why this is wrong here
PortFast is a Cisco switch feature used to immediately transition a port from blocking to forwarding state, bypassing Spanning Tree Protocol convergence. It is not applicable to router interfaces and does not control management access or SSH filtering.
★ When this WOULD be the correct answer
If the question were about optimizing the time it takes for a switch port to transition to an active state after being connected, then enabling PortFast would be the correct answer. This would be relevant in a scenario focused on reducing network downtime during device connections.
Why candidates choose this
Students might confuse PortFast with a security feature because it is often used on ports connected to end devices to speed up connectivity, but it has no role in restricting management access.
✗Disable all logging on the router.Wrong answer — click to see why▾
Why this is wrong here
Disabling logging removes the ability to monitor and audit router events, including failed login attempts, which is contrary to security best practices. It does not restrict which subnets can initiate SSH sessions.
★ When this WOULD be the correct answer
In a question where the goal is to minimize resource usage or enhance performance by reducing log entries, disabling logging could be the correct answer. For example, if the question specifies that logging is causing performance issues and needs to be turned off to maintain system efficiency, this option would be valid.
Why candidates choose this
Some might think that disabling logging reduces the attack surface or hides the router's activity, but it does not prevent unauthorized access attempts from non-management subnets.
✗Replace SSH with Telnet for easier filtering.Wrong answer — click to see why▾
Why this is wrong here
Telnet transmits data, including credentials, in plaintext, making it highly insecure. Replacing SSH with Telnet would violate the security policy's intent to protect management access, and Telnet does not inherently provide easier filtering than SSH.
★ When this WOULD be the correct answer
If the exam question asked for a method to simplify access control for a legacy system that only supports Telnet, and the requirement was to allow access from a specific subnet, then replacing SSH with Telnet could be considered correct in that context.
Why candidates choose this
Students may recall that Telnet uses TCP port 23 and might think it is simpler to filter with ACLs, but SSH also uses a single TCP port (22) and is equally filterable. The core issue is that Telnet lacks encryption, making it unsuitable for secure management.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Common exam traps
Common exam trap: answer the scenario, not the keyword
Don't confuse securing the protocol (SSH) with controlling access by source subnet. They are complementary but distinct actions.
Detailed technical explanation
How to think about this question
Access Control Lists (ACLs) are fundamental security tools in Cisco networking that filter traffic based on defined criteria such as source IP addresses, destination IP addresses, and protocols. In the context of router management, ACLs can be applied to control which subnets or hosts are permitted to initiate management sessions like SSH. This selective filtering ensures that only authorized management subnets can access the router’s command-line interface, enhancing security by limiting exposure to trusted sources.
When a security policy mandates that only one management subnet can initiate SSH sessions, the network administrator must configure an ACL that explicitly permits SSH traffic (TCP port 22) from that approved subnet while denying all other sources. This ACL is then applied inbound on the router’s interface that receives management traffic. The router continues to run SSH as the secure management protocol, but the ACL enforces the source-based restriction, effectively combining protocol security with access control.
A common exam trap is confusing protocol security with access control. While SSH encrypts management sessions, it does not restrict which hosts can connect. Some candidates mistakenly believe enabling SSH alone satisfies the policy. However, without an ACL restricting source IPs, any host can attempt SSH connections. Practically, combining SSH with ACLs is standard practice to both secure and limit management access, reflecting real-world Cisco network security design.
KKey Concepts to Remember
An Access Control List (ACL) filters traffic by source IP, destination IP, and protocol to enforce security policies on Cisco routers.
Applying an ACL inbound on a router interface restricts which source subnets can initiate management protocols like SSH.
SSH encrypts management sessions but does not inherently restrict which hosts can initiate connections to the router.
Combining SSH with ACLs provides both secure communication and controlled access from trusted management subnets.
PortFast is a switch feature that affects Spanning Tree Protocol convergence and does not control router management access.
Disabling logging reduces visibility into network events and does not restrict or enhance management access security.
Replacing SSH with Telnet reduces security because Telnet transmits data in clear text and does not support source filtering inherently.
Security policies requiring subnet-based restrictions on management access are best implemented using ACLs to permit only approved sources.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
An Access Control List (ACL) filters traffic by source IP, destination IP, and protocol to enforce security policies on Cisco routers.
Real-world example
How this comes up in practice
A security administrator must allow nursing staff to reach a patient records server while blocking access from the guest Wi-Fi VLAN. After applying an extended ACL, traffic is still blocked from nursing workstations. The ACL was applied outbound instead of inbound on the wrong interface. Questions like this test ACL direction and placement rules.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this 200-301 question in full detail.
Review an Access Control List (ACL) filters traffic by source IP, destination IP, and protocol to enforce security policies on Cisco routers., then practise related 200-301 questions on the same topic to reinforce the concept.
Network Services and Security — This question tests Network Services and Security — An Access Control List (ACL) filters traffic by source IP, destination IP, and protocol to enforce security policies on Cisco routers..
What is the correct answer to this question?
The correct answer is: Use an ACL to permit SSH access only from the approved management subnet. — The most direct approach is to use an ACL that restricts which source subnet is permitted to reach SSH management access on the router. In practical terms, SSH can remain enabled as the secure protocol, but access to it should still be limited to trusted management sources. That is a classic example of combining secure protocol choice with source restriction. Options B and C are incorrect because PortFast is a spanning-tree feature unrelated to access control, and disabling logging does not restrict who can initiate SSH. Option D is wrong because Telnet does not filter by subnet and is less secure than SSH.
What should I do if I get this 200-301 question wrong?
Review an Access Control List (ACL) filters traffic by source IP, destination IP, and protocol to enforce security policies on Cisco routers., then practise related 200-301 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
An Access Control List (ACL) filters traffic by source IP, destination IP, and protocol to enforce security policies on Cisco routers.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.