Question 1,150 of 1,389
CCNA Network Services and Security Practice Question
After hardening SSH by disabling password authentication and restricting access to an ACL permitting only the management subnet 10.1.10.0/24, configuring RADIUS AAA authentication, enabling port security with a maximum of two MAC addresses on all access ports, and implementing DHCP snooping and DAI on VLAN 10, the administrator finds that users in VLAN 10 obtain DHCP addresses and access the network normally, but SSH from the management workstation (10.1.10.20) to the switch fails with timeouts.
⚠ Common exam trap
Cisco often tests the interaction between security features like DAI and static IP hosts, where candidates overlook that DAI requires explicit static bindings for non-DHCP clients, leading to connectivity failures that appear as timeouts rather than explicit denials.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The management workstation’s IP-to-MAC binding is missing from the DHCP snooping binding table, causing DAI to drop its ARP traffic.
The management workstation (10.1.10.20) is on the same VLAN 10 where DHCP snooping and DAI are enabled. DAI validates ARP packets against the DHCP snooping binding table. Since the workstation uses a static IP address, its IP-to-MAC binding is not automatically added to the DHCP snooping database. DAI will drop the workstation's ARP replies, preventing the switch from learning its MAC address and causing SSH timeouts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The SSH ACL is misconfigured and denies port 22 from the management subnet.
Why it's wrong here
The ACL was explicitly set to permit 10.1.10.0/24, and no indication of misconfiguration is given. It would block SSH for the entire subnet, not just one host, but other management hosts would also be affected.
- ✓
The management workstation’s IP-to-MAC binding is missing from the DHCP snooping binding table, causing DAI to drop its ARP traffic.
Why this is correct
Dynamic ARP Inspection (DAI) validates ARP packets against the DHCP snooping binding table, which contains IP-to-MAC mappings learned from DHCP. Because the management workstation uses a static IP address, no DHCP binding is ever recorded, so the switch has no entry for that IP. As a result, DAI classifies the workstation's ARP replies as invalid and drops them, preventing L2 reachability. This matches the symptom precisely: only the statically configured host fails, while DHCP-assigned management hosts continue to work normally.
- ✗
Port security on the switch interface connected to the management workstation has learned two MAC addresses and shut down the port.
Why it's wrong here
The administrator’s workstation typically uses a single MAC address, and even with a second device like a VoIP phone, the maximum is set to 2. No violation would occur unless more than two MACs are seen, which is unlikely from a single admin PC.
- ✗
RADIUS AAA authentication is missing the shared secret on the switch, causing SSH login timeouts.
Why it's wrong here
A missing RADIUS secret would cause authentication to fail for all SSH attempts, not just from one workstation. The symptom shows only one specific host failing, while others might succeed, indicating network-level blockage rather than global AAA misconfiguration.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓The management workstation’s IP-to-MAC binding is missing from the DHCP snooping binding table, causing DAI to drop its ARP traffic.Correct answer▾
Why this is correct
Dynamic ARP Inspection (DAI) validates ARP packets against the DHCP snooping binding table, which contains IP-to-MAC mappings learned from DHCP. Because the management workstation uses a static IP address, no DHCP binding is ever recorded, so the switch has no entry for that IP. As a result, DAI classifies the workstation's ARP replies as invalid and drops them, preventing L2 reachability. This matches the symptom precisely: only the statically configured host fails, while DHCP-assigned management hosts continue to work normally.
✗The SSH ACL is misconfigured and denies port 22 from the management subnet.Wrong answer — click to see why▾
Why this is wrong here
Misunderstanding ACL processing—assumes a simple subnet permit ACL would block port 22 by default, but the ACL entry permits all traffic from the subnet, not just specific ports.
✗Port security on the switch interface connected to the management workstation has learned two MAC addresses and shut down the port.Wrong answer — click to see why▾
Why this is wrong here
Assumes port security is the first cause of connectivity failure when MAC limits are configured, but the symptom does not indicate a port security violation; the port would need to go into err-disabled, which is not mentioned.
✗RADIUS AAA authentication is missing the shared secret on the switch, causing SSH login timeouts.Wrong answer — click to see why▾
Why this is wrong here
AAA failures manifest as authentication errors or prompts that time out after attempting RADIUS, but they typically affect all attempts, not a single source, unless combined with ACLs that permit other hosts but block this one.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 25, 2026
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.