CCNA VTY lines Practice Question
An administrator wants to block all Telnet access to a router’s VTY lines and allow only SSH. Which change most directly supports that goal?
⚠ Common exam trap
Avoid assuming that ACLs or global commands can replace specific VTY line configurations for protocol restriction.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the VTY lines to accept SSH and not Telnet.
The most direct change is to configure the VTY lines to accept only SSH, which removes Telnet as an accepted protocol. Option B (PortFast) is a spanning-tree feature that speeds up port transition on access ports and has nothing to do with VTY access. Option C (DHCP snooping) is a Layer 2 security feature to prevent rogue DHCP servers; it does not affect VTY line protocols. Option D (OSPF hello interval) is an OSPF timer adjustment, unrelated to remote access security. Therefore, only option A directly achieves the goal.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure the VTY lines to accept SSH and not Telnet.
Why this is correct
This is correct because it directly restricts the management protocol accepted on the router.
- ✗
Enable PortFast on the VTY lines.
Why it's wrong here
This is wrong because PortFast is a switching feature, not a router management-line control.
When this WOULD be correct
If the question were about optimizing switch port configurations for rapid connectivity in a network where VTY lines are used for management, then enabling PortFast could be the correct answer. For example, a question might ask how to reduce the time it takes for a switch port to become active after being connected.
- ✗
Use DHCP snooping to protect the VTY lines.
Why it's wrong here
This is wrong because DHCP snooping is unrelated to router management transport protocols.
When this WOULD be correct
If the question were about securing a network against unauthorized DHCP servers affecting devices that connect to the router, then using DHCP snooping would be the correct answer. In that scenario, the focus would be on protecting the network's IP address assignment rather than access protocols like Telnet or SSH.
- ✗
Increase the OSPF hello interval.
Why it's wrong here
This is wrong because OSPF timer changes do not secure VTY access.
When this WOULD be correct
If the question asked about optimizing OSPF performance in a network where OSPF is being used, increasing the hello interval could be correct. For instance, a scenario might involve reducing OSPF traffic in a stable network environment.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Configure the VTY lines to accept SSH and not Telnet.Correct answer▾
Why this is correct
This is correct because it directly restricts the management protocol accepted on the router.
✗Enable PortFast on the VTY lines.Wrong answer — click to see why▾
Why this is wrong here
PortFast is a Cisco switch feature used to immediately transition an access port to the forwarding state, bypassing Spanning Tree Protocol convergence. It has no relevance to router VTY lines or management access protocols.
★ When this WOULD be the correct answer
If the question were about optimizing switch port configurations for rapid connectivity in a network where VTY lines are used for management, then enabling PortFast could be the correct answer. For example, a question might ask how to reduce the time it takes for a switch port to become active after being connected.
Why candidates choose this
A student might confuse PortFast with a feature that speeds up or secures connections, but it is unrelated to VTY line configuration and is only applicable to switch ports.
✗Use DHCP snooping to protect the VTY lines.Wrong answer — click to see why▾
Why this is wrong here
DHCP snooping is a security feature on switches that filters untrusted DHCP messages to prevent rogue DHCP servers. It does not affect VTY line access or the transport protocols (Telnet/SSH) used for router management.
★ When this WOULD be the correct answer
If the question were about securing a network against unauthorized DHCP servers affecting devices that connect to the router, then using DHCP snooping would be the correct answer. In that scenario, the focus would be on protecting the network's IP address assignment rather than access protocols like Telnet or SSH.
Why candidates choose this
The term 'snooping' might imply monitoring or blocking, leading a student to think it could restrict Telnet, but DHCP snooping is specifically for DHCP traffic and not for management protocols.
✗Increase the OSPF hello interval.Wrong answer — click to see why▾
Why this is wrong here
The OSPF hello interval is a timer used in OSPF routing protocol to maintain neighbor relationships. Changing it has no impact on VTY line access or the ability to use Telnet versus SSH for management.
★ When this WOULD be the correct answer
If the question asked about optimizing OSPF performance in a network where OSPF is being used, increasing the hello interval could be correct. For instance, a scenario might involve reducing OSPF traffic in a stable network environment.
Why candidates choose this
A student might think that increasing the hello interval could slow down or block Telnet sessions, but OSPF timers are unrelated to VTY line configuration and do not affect management access.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
Routing Protocol Comparison
| Protocol | Metric | Max Hops | Algorithm | Type |
|---|---|---|---|---|
| RIP v2 | Hop count | 15 | Bellman-Ford | Distance vector |
| OSPF | Cost (bandwidth) | Unlimited | Dijkstra (SPF) | Link state |
| EIGRP | Composite metric | Unlimited | DUAL | Hybrid |
| IS-IS | Cost | Unlimited | Dijkstra | Link state |
| BGP | Policy / attributes | Unlimited | Path vector | Path vector |
RIP's 15-hop limit makes it unsuitable for large networks. OSPF and EIGRP dominate modern enterprise deployments.
Go deeper
Related to this question
Learn chapter
RA Guard — IPv6 First-Hop Security
Key term
VTY
VTY (Virtual Teletype) lines are virtual ports on a Cisco network device that allow remote administration via Telnet or SSH.
Key term
DHCP snooping
DHCP snooping is a network security feature that filters untrusted DHCP messages to prevent rogue DHCP servers from giving out false IP addresses.
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.