CCNA Practice Question: PPP CHAP authentication requires matching…
Exhibit
R1# interface Serial0/0/0 encapsulation ppp ppp chap hostname Branch1 ppp chap password cisco123 R2# interface Serial0/0/0 encapsulation ppp ppp chap hostname Branch1 ppp chap password cisco321
Based on the exhibit, what is the most likely reason the PPP link is failing to authenticate?
⚠ Common exam trap
Be careful not to confuse physical link issues with authentication problems. Just because the link is up doesn't mean authentication is successful.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The PPP authentication credentials do not match between the two sides.
The most likely reason is a credentials mismatch between the two sides of the PPP authentication setup. In practical terms, PPP authentication requires the peers to agree on the relevant identity and secret information. If those values do not align, the link may come up physically but authentication fails and the logical connection does not establish properly. This is a very exam-relevant WAN troubleshooting scenario because it focuses on a realistic failure after the transport is already present.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The PPP authentication credentials do not match between the two sides.
Why this is correct
CHAP authentication relies on a shared secret that must be identical on both routers. The exhibit shows the CHAP password configured on one side is different from the other, so the hash computed during the challenge-response handshake will not match and the PPP link will fail authentication. Without matching credentials, the link cannot transition to the established state.
- ✗
The interfaces must use HDLC instead of PPP before authentication can work.
Why it's wrong here
HDLC is a Cisco-proprietary (or standard) encapsulation that does not include a built-in authentication mechanism, whereas PPP uses a Link Control Protocol to negotiate authentication methods such as PAP or CHAP. Replacing PPP with HDLC would eliminate the possibility of CHAP entirely, so it cannot be the fix for a credential mismatch. The problem shown in the exhibit is a difference in the CHAP password, not an encapsulation incompatibility.
When this WOULD be correct
In a different scenario where a question specifies that a network is configured to use HDLC for link-layer encapsulation and requires authentication, a candidate might be asked about the compatibility of HDLC with authentication methods, making this option correct.
- ✗
CHAP requires the routers to be in different IPv4 subnets.
Why it's wrong here
CHAP operates at the link layer and is completely independent of IP addressing or subnet topology; it authenticates the peer using a challenge and a one-way hash of the shared secret. Routers on the same or different subnets can successfully run CHAP, and there is no requirement that they be in different subnets. A subnet mismatch would affect IP connectivity after the link is up, but it would not cause the PPP authentication failure described here.
When this WOULD be correct
In a different exam scenario, a question might specify that CHAP authentication is being tested in a network where the routers are indeed in different IPv4 subnets, and the question could ask about the implications of such a configuration on CHAP's functionality. In this case, the option could be correct if it stated that subnet differences affect routing or connectivity, not CHAP itself.
- ✗
PPP authentication works only over GRE tunnels.
Why it's wrong here
PPP authentication is a feature of the PPP encapsulation itself and functions over any supported physical or logical interface, including point-to-point serial links, SONET, and PPPoE. GRE tunnels are merely one possible transport that can carry PPP frames, but they are not a prerequisite for CHAP or PAP. If GRE were required, standard serial PPP links would never authenticate, which is clearly not the case.
When this WOULD be correct
In a different question scenario where the context specifies that the authentication method is limited to GRE tunnels, and the question asks about the feasibility of PPP authentication in that specific setup, this option could be correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓The PPP authentication credentials do not match between the two sides.Correct answer▾
Why this is correct
CHAP authentication relies on a shared secret that must be identical on both routers. The exhibit shows the CHAP password configured on one side is different from the other, so the hash computed during the challenge-response handshake will not match and the PPP link will fail authentication. Without matching credentials, the link cannot transition to the established state.
✗The interfaces must use HDLC instead of PPP before authentication can work.Wrong answer — click to see why▾
Why this is wrong here
This option is incorrect because PPP (Point-to-Point Protocol) does not require HDLC (High-Level Data Link Control) for authentication; PPP can authenticate independently of the encapsulation method used.
★ When this WOULD be the correct answer
In a different scenario where a question specifies that a network is configured to use HDLC for link-layer encapsulation and requires authentication, a candidate might be asked about the compatibility of HDLC with authentication methods, making this option correct.
Why candidates choose this
Candidates may find this option tempting because they might confuse the encapsulation methods and assume that HDLC is a prerequisite for any authentication process, leading to the misconception that PPP cannot function without it.
✗CHAP requires the routers to be in different IPv4 subnets.Wrong answer — click to see why▾
Why this is wrong here
This option is incorrect because CHAP (Challenge Handshake Authentication Protocol) does not require routers to be in different IPv4 subnets for authentication to function. CHAP can authenticate devices regardless of their subnet configuration as long as they can reach each other over the network.
★ When this WOULD be the correct answer
In a different exam scenario, a question might specify that CHAP authentication is being tested in a network where the routers are indeed in different IPv4 subnets, and the question could ask about the implications of such a configuration on CHAP's functionality. In this case, the option could be correct if it stated that subnet differences affect routing or connectivity, not CHAP itself.
Why candidates choose this
Candidates may choose this option due to a misunderstanding of how network protocols interact with IP addressing, leading them to incorrectly associate subnetting with authentication requirements.
✗PPP authentication works only over GRE tunnels.Wrong answer — click to see why▾
Why this is wrong here
This option is incorrect because PPP (Point-to-Point Protocol) can operate independently of GRE (Generic Routing Encapsulation) tunnels; authentication can occur directly over a PPP link without requiring GRE.
★ When this WOULD be the correct answer
In a different question scenario where the context specifies that the authentication method is limited to GRE tunnels, and the question asks about the feasibility of PPP authentication in that specific setup, this option could be correct.
Why candidates choose this
Candidates may find this option tempting because they might confuse the functionalities of PPP and GRE, thinking that authentication mechanisms are tied to specific encapsulation methods, leading to misconceptions about their interoperability.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.