CCNA Network Services and Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Administratively shut down unused switch ports

  Why this is correct

  Administratively shutting down unused switch ports places the interface in an administratively disabled state (shutdown), which prevents the port from sending or receiving any frames and precludes any dynamic negotiation such as DTP or CDP. This reduces the attack surface by ensuring no rogue device connected to a wall jack or patch panel can gain Layer 2 connectivity, and it is a fundamental hardening measure prescribed by Cisco and industry frameworks like CIS Controls. For maximum effect, use the 'interface range' command to apply shutdown consistently across all unused ports.

• ✗

  Convert all unused ports into trunk ports

  Why it's wrong here

  Converting unused ports into trunk ports is dangerous because an 802.1Q trunk carries multiple VLANs and is typically reserved for switch-to-switch links. An unused port left in trunking mode—especially if DTP (Dynamic Trunking Protocol) is active—can form a trunk with an attacker's device, allowing unauthorized VLAN hopping and potential access to all VLANs on the switch. This increases both complexity of the network configuration and exposure to Layer 2 attacks, unlike simply disabling the port.

  When this WOULD be correct

  If the question were about optimizing network performance and ensuring that multiple VLANs can communicate over unused ports, converting them to trunk ports would be appropriate. This would apply in a scenario where the company is looking to utilize all switch ports efficiently rather than securing them.

• ✗

  Enable Telnet on all unused ports

  Why it's wrong here

  Enabling Telnet on unused ports misidentifies the threat: Telnet is a Layer 3/VTY remote-management protocol used to access the switch's CLI, not a physical-port security feature. It transmits usernames and passwords in plaintext across the network, so an attacker sniffing the traffic could easily capture credentials. Even if Telnet were enabled, the unused switch port itself would remain in its default forwarding state, meaning it would still provide a vulnerable path for a device that plugs into it, so this action in no way reduces physical port exploitation risks.

  When this WOULD be correct

  If the exam question asked about enabling remote management on specific ports for monitoring purposes, and if those ports were secured and actively monitored, then enabling Telnet could be considered appropriate in that context.

• ✗

  Advertise every unused port into OSPF

  Why it's wrong here

  Advertising unused ports into OSPF is incorrect because OSPF is a Layer 3 link-state routing protocol that advertises IP prefixes from interfaces with IP addressing, not individual physical switch ports. To run OSPF on a port, that port would need to be configured as a routed port or belong to an SVI, which is cumbersome and nonsensical for access ports intended to be unused. Moreover, advertising such ports would only consume routing-processing power and could leak routing information to a rogue device, while leaving the port itself enabled and still vulnerable to direct Layer 2 exploitation.

  When this WOULD be correct

  In a scenario where the question asks how to ensure that all network interfaces, including unused ones, are included in OSPF for monitoring purposes, advertising unused ports could be correct. This would be relevant in a context where visibility into all interfaces is prioritized over security concerns.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”