CCNA Network Services and Security Practice Question
An engineer wants remote administrative access to remain available but also wants session contents protected in transit. Which management choice best supports that goal?
⚠ Common exam trap
A common exam trap is selecting Telnet because it allows remote access, ignoring that it transmits data in clear text. This mistake overlooks the critical security requirement to protect session contents during transit. Another trap is choosing options unrelated to encryption, such as native VLAN or open wireless access, which do not address secure remote management. Candidates must focus on protocols that provide confidentiality and integrity for administrative sessions, not just connectivity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SSH
The best choice is SSH because it provides encrypted remote administrative access. In plain language, the engineer wants administrators to keep managing devices remotely, but without exposing credentials or session contents in clear text. SSH solves that by protecting the traffic in transit, which is why it is preferred over older plaintext protocols such as Telnet. This is a core management-plane security principle. The goal is not to remove remote administration, but to perform it safely. The correct answer is the one that aligns with secure remote access rather than convenience at the expense of protection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
SSH
Why this is correct
SSH (Secure Shell) is the correct choice because it provisions an encrypted tunnel for remote administrative sessions, typically on TCP port 22. It validates the server's identity via host keys, encrypts all authentication material and subsequent command output, and provides integrity checking. This protects credentials and configuration changes from being observed or tampered with en route, making it the only listed option that offers secure remote administration.
- ✗
Telnet
Why it's wrong here
Telnet is wrong because it sends every byte, including usernames, passwords, and entered commands, as plaintext across the network. An attacker with packet capture capabilities can trivially read the entire administrative session and replay or modify data, as Telnet has no encryption or integrity verification. While functional, it explicitly fails the security requirement for remote device management.
When this WOULD be correct
If the exam question asked for a method of remote access that prioritizes speed and simplicity over security, and the context was a controlled environment where security risks are minimal, Telnet could be considered acceptable.
- ✗
Open wireless access
Why it's wrong here
Open wireless access is a Layer 1/2 security flaw where a WLAN has no authentication or data encryption, letting any client within range join the network and sniff traffic. However, the question addresses the protocol used for remote administration, not the security posture of the underlying access medium. A secure tunneling protocol like SSH could still run over an open wireless network, so its absence is not the reason administrative access would be insecure.
When this WOULD be correct
If the question were about providing remote access to a public network where encryption is not a concern, and the focus was solely on ease of access rather than security, then open wireless access could be considered a valid option.
- ✗
Native VLAN 1
Why it's wrong here
Configuring or leaving the native VLAN as 1 concerns how untagged frames are handled on an 802.1Q trunk and is a factor in Layer 2 attacks such as VLAN hopping or double-tagging. Yet this is completely orthogonal to remote administrative access: whether a switch is managed by Telnet, SSH, or another protocol has no dependency on which VLAN carries management traffic. Therefore, native VLAN selection cannot satisfy or negate the requirement for encrypted remote administration.
When this WOULD be correct
If the question asked about configuring a network switch for management access without any security requirements, or if it specifically focused on VLAN configurations for untagged traffic, then selecting Native VLAN 1 could be correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓SSHCorrect answer▾
Why this is correct
SSH (Secure Shell) is the correct choice because it provisions an encrypted tunnel for remote administrative sessions, typically on TCP port 22. It validates the server's identity via host keys, encrypts all authentication material and subsequent command output, and provides integrity checking. This protects credentials and configuration changes from being observed or tampered with en route, making it the only listed option that offers secure remote administration.
✗TelnetWrong answer — click to see why▾
Why this is wrong here
Telnet is incorrect because it transmits data, including passwords, in plaintext, making it insecure for remote administrative access where session content protection is required.
★ When this WOULD be the correct answer
If the exam question asked for a method of remote access that prioritizes speed and simplicity over security, and the context was a controlled environment where security risks are minimal, Telnet could be considered acceptable.
Why candidates choose this
Candidates may choose Telnet due to its historical use in networking and familiarity, mistakenly believing that it is still a viable option for remote access without recognizing the security implications.
✗Open wireless accessWrong answer — click to see why▾
Why this is wrong here
Open wireless access does not provide any encryption or security for data transmitted over the network, making it unsuitable for protecting session contents in transit during remote administrative access.
★ When this WOULD be the correct answer
If the question were about providing remote access to a public network where encryption is not a concern, and the focus was solely on ease of access rather than security, then open wireless access could be considered a valid option.
Why candidates choose this
Candidates may choose this option due to a misunderstanding of wireless security, believing that open access is sufficient for remote management without recognizing the risks of unencrypted data transmission.
✗Native VLAN 1Wrong answer — click to see why▾
Why this is wrong here
Native VLAN 1 is primarily used for untagged traffic on a switch and does not provide any encryption or secure access for remote administration. It is not suitable for protecting session contents in transit.
★ When this WOULD be the correct answer
If the question asked about configuring a network switch for management access without any security requirements, or if it specifically focused on VLAN configurations for untagged traffic, then selecting Native VLAN 1 could be correct.
Why candidates choose this
Candidates may be tempted by this option because they recognize VLANs as a fundamental networking concept and might mistakenly associate Native VLAN 1 with management access without considering the security implications.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Device File Management with SFTP and SCP
Key term
Telnet
Telnet is a network protocol that provides a bidirectional, interactive text-based communication session between two machines over a network, typically used for remote access and management of network devices.
Key term
SSH
SSH (Secure Shell) is a cryptographic network protocol that provides secure, encrypted communication and remote administration between two devices over an unsecured network.
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.