CCNA Access Control List (ACL) Practice Question
A security policy requires that only one management subnet be able to initiate SSH to a router. Which approach most directly supports that requirement?
⚠ Common exam trap
Don't confuse securing the protocol (SSH) with controlling access by source subnet. They are complementary but distinct actions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use an ACL to permit SSH access only from the approved management subnet.
The most direct approach is to use an ACL that restricts which source subnet is permitted to reach SSH management access on the router. In practical terms, SSH can remain enabled as the secure protocol, but access to it should still be limited to trusted management sources. That is a classic example of combining secure protocol choice with source restriction. Options B and C are incorrect because PortFast is a spanning-tree feature unrelated to access control, and disabling logging does not restrict who can initiate SSH. Option D is wrong because Telnet does not filter by subnet and is less secure than SSH.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use an ACL to permit SSH access only from the approved management subnet.
Why this is correct
This is correct because the policy is specifically about restricting management access by source subnet.
- ✗
Enable PortFast on the router interfaces.
Why it's wrong here
This is wrong because PortFast is a switch feature, not a router management-access control.
When this WOULD be correct
If the question were about optimizing the time it takes for a switch port to transition to an active state after being connected, then enabling PortFast would be the correct answer. This would be relevant in a scenario focused on reducing network downtime during device connections.
- ✗
Disable all logging on the router.
Why it's wrong here
This is wrong because disabling logging weakens visibility and does not restrict management access.
When this WOULD be correct
In a question where the goal is to minimize resource usage or enhance performance by reducing log entries, disabling logging could be the correct answer. For example, if the question specifies that logging is causing performance issues and needs to be turned off to maintain system efficiency, this option would be valid.
- ✗
Replace SSH with Telnet for easier filtering.
Why it's wrong here
This is wrong because Telnet is less secure than SSH.
When this WOULD be correct
If the exam question asked for a method to simplify access control for a legacy system that only supports Telnet, and the requirement was to allow access from a specific subnet, then replacing SSH with Telnet could be considered correct in that context.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Use an ACL to permit SSH access only from the approved management subnet.Correct answer▾
Why this is correct
This is correct because the policy is specifically about restricting management access by source subnet.
✗Enable PortFast on the router interfaces.Wrong answer — click to see why▾
Why this is wrong here
PortFast is a Cisco switch feature used to immediately transition a port from blocking to forwarding state, bypassing Spanning Tree Protocol convergence. It is not applicable to router interfaces and does not control management access or SSH filtering.
★ When this WOULD be the correct answer
If the question were about optimizing the time it takes for a switch port to transition to an active state after being connected, then enabling PortFast would be the correct answer. This would be relevant in a scenario focused on reducing network downtime during device connections.
Why candidates choose this
Students might confuse PortFast with a security feature because it is often used on ports connected to end devices to speed up connectivity, but it has no role in restricting management access.
✗Disable all logging on the router.Wrong answer — click to see why▾
Why this is wrong here
Disabling logging removes the ability to monitor and audit router events, including failed login attempts, which is contrary to security best practices. It does not restrict which subnets can initiate SSH sessions.
★ When this WOULD be the correct answer
In a question where the goal is to minimize resource usage or enhance performance by reducing log entries, disabling logging could be the correct answer. For example, if the question specifies that logging is causing performance issues and needs to be turned off to maintain system efficiency, this option would be valid.
Why candidates choose this
Some might think that disabling logging reduces the attack surface or hides the router's activity, but it does not prevent unauthorized access attempts from non-management subnets.
✗Replace SSH with Telnet for easier filtering.Wrong answer — click to see why▾
Why this is wrong here
Telnet transmits data, including credentials, in plaintext, making it highly insecure. Replacing SSH with Telnet would violate the security policy's intent to protect management access, and Telnet does not inherently provide easier filtering than SSH.
★ When this WOULD be the correct answer
If the exam question asked for a method to simplify access control for a legacy system that only supports Telnet, and the requirement was to allow access from a specific subnet, then replacing SSH with Telnet could be considered correct in that context.
Why candidates choose this
Students may recall that Telnet uses TCP port 23 and might think it is simpler to filter with ACLs, but SSH also uses a single TCP port (22) and is equally filterable. The core issue is that Telnet lacks encryption, making it unsuitable for secure management.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Device File Management with SFTP and SCP
Key term
Access Control List
An Access Control List is a set of rules that decides which traffic is allowed or denied entry to a network or device.
Key term
Subnet
A subnet is a logical subdivision of an IP network, created by partitioning a larger network address space using subnet masks.
About these practice questions
This 200-301 question is part of Courseiva's 1,389-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.