Match each security control or idea to its most accurate purpose.
Drag a concept onto its matching description — or click a concept then click the description.
Secures remote management sessions
Provides authentication, authorization, and accounting framework
Limits access to only what is necessary
Centralizes visibility into device events and messages
⚠ Common exam trap
Candidates often confuse the roles of firewalls, IDS, and IPS. Firewalls filter traffic based on rules but do not inherently detect or block intrusions; that is the job of IDS and IPS.
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Firewall: Filters traffic based on security rules
A firewall controls incoming and outgoing network traffic based on predetermined security rules, acting as a barrier between trusted and untrusted networks. Option A correctly describes this function. Option B, detecting and alerting on suspicious activity, is the role of an Intrusion Detection System (IDS). Option C, preventing and blocking intrusions in real time, is the function of an Intrusion Prevention System (IPS). Option D, authenticating users and managing access rights, pertains to AAA (Authentication, Authorization, and Accounting) frameworks.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Firewall: Filters traffic based on security rules
Why this is correct
Correct. A firewall filters traffic based on security rules.
Firewall: Detects and alerts on suspicious activity
Why it's wrong here
Incorrect. Detecting and alerting on suspicious activity is the function of an IDS, not a firewall.
When this WOULD be correct
This option would be correct if the question asked to match 'Intrusion Detection System (IDS)' or 'Network-based IDS' to its purpose, as IDS monitors network traffic for suspicious activity and generates alerts.
Firewall: Prevents and blocks intrusions in real time
Why it's wrong here
Incorrect. Preventing and blocking intrusions in real time is the function of an IPS, not a firewall.
When this WOULD be correct
If the question asked 'Match each security control to its most accurate purpose' and the option was 'Intrusion Prevention System (IPS): Prevents and blocks intrusions in real time', then this description would be correct.
Firewall: Authenticates users and manages access rights
Why it's wrong here
Incorrect. Authenticating users and managing access rights is part of the AAA framework, not a firewall.
When this WOULD be correct
In a question asking to match 'Authentication, Authorization, and Accounting (AAA)' or 'Identity and Access Management (IAM)' to its purpose, this option would be correct.
Option-by-option analysis
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
Why this is correct
Correct. A firewall filters traffic based on security rules.
Why this is wrong here
Firewalls filter traffic based on security rules; they do not detect or alert on suspicious activity. Detection and alerting are functions of intrusion detection systems (IDS), not firewalls.
★ When this WOULD be the correct answer
This option would be correct if the question asked to match 'Intrusion Detection System (IDS)' or 'Network-based IDS' to its purpose, as IDS monitors network traffic for suspicious activity and generates alerts.
Why candidates choose this
Candidates may confuse firewalls with IDS/IPS because both are security devices that inspect traffic, leading them to attribute detection capabilities to firewalls.
Why this is wrong here
Firewalls filter traffic based on rules but do not actively detect or block intrusions in real time; that is the role of an intrusion prevention system (IPS).
★ When this WOULD be the correct answer
If the question asked 'Match each security control to its most accurate purpose' and the option was 'Intrusion Prevention System (IPS): Prevents and blocks intrusions in real time', then this description would be correct.
Why candidates choose this
Candidates may confuse firewalls with next-generation firewalls (NGFW) or IPS, assuming firewalls provide real-time intrusion prevention, when in fact they primarily filter traffic based on static rules.
Why this is wrong here
Firewalls filter traffic based on security rules, not authenticate users or manage access rights; those functions belong to AAA servers or identity management systems.
★ When this WOULD be the correct answer
In a question asking to match 'Authentication, Authorization, and Accounting (AAA)' or 'Identity and Access Management (IAM)' to its purpose, this option would be correct.
Why candidates choose this
Candidates may confuse firewalls with access control systems because both enforce security policies, but firewalls control network traffic while AAA manages user permissions.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Learn chapter
RA Guard — IPv6 First-Hop Security
Key term
IPS
An Intrusion Prevention System (IPS) is a network security device that monitors traffic in real time and automatically blocks threats before they reach your systems.
Key term
IDS
An IDS is a security system that monitors network or system traffic for suspicious activity and alerts administrators to potential threats, but does not actively block them.
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.