CCNA Network Services and Security Practice Question
Which four of the following are best practices for securing network services and devices? (Choose four.)
⚠ Common exam trap
Cisco often tests the misconception that Telnet is acceptable for management in a secure environment because it is easier to configure, but the exam expects you to recognize that SSH is the mandatory secure alternative.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Disable unused ports and services on routers and switches.
Disabling unused ports, implementing role-based access control (RBAC), enabling logging, and keeping firmware updated are all critical security best practices: they reduce the attack surface, limit user permissions, detect threats, and patch known vulnerabilities. Using Telnet is insecure because it transmits data in cleartext, unlike SSH. Placing all devices on the same VLAN undermines network segmentation and allows lateral movement by attackers.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Disable unused ports and services on routers and switches.
Why this is correct
Disabling unused switch ports and router services narrows the attack surface by removing potential entry points. Use the shutdown command on interfaces and disable unneeded protocols such as CDP, LLDP, and the HTTP server, which can otherwise be probed or exploited. This is a foundational hardening step that prevents unauthorized physical or logical access.
- ✗
Use Telnet for remote management because it is simpler to configure than SSH.
Why it's wrong here
Telnet transmits passwords and configuration data in clear text, allowing any attacker on the path to capture credentials with a simple packet capture. SSH provides encrypted sessions, public-key authentication, and modern cipher suites, making it the standard for secure remote management. Simple configuration does not justify the massive risk of credential exposure.
- ✓
Implement role-based access control (RBAC) to limit user privileges.
Why this is correct
RBAC, often implemented through AAA frameworks like TACACS+ or RADIUS, assigns users only the permissions necessary for their duties. This enforces least privilege, so an operator who only monitors cannot alter running configs, and a junior engineer cannot change routing protocols. Limiting privileges contains the blast radius of a compromised account and simplifies audit trails.
- ✗
Place all network devices on the same VLAN to simplify security policy enforcement.
Why it's wrong here
Placing all network devices on one VLAN creates a flat Layer 2 domain, expanding the broadcast domain and making every device reachable from every other device. Segmentation with VLANs and firewall policies forces traffic through controlled inspection points and blocks lateral movement. A breach in one segment can then be contained, rather than giving attackers direct access to all infrastructure.
- ✓
Enable logging and monitor logs for suspicious activity.
Why this is correct
Enabling logging with accurate timestamps and sending syslog messages to a central collector allows administrators to correlate events, identify brute-force attempts, and trace configuration changes. Without monitoring, attacks often go unnoticed for weeks, especially on infrastructure devices that lack user interaction. Regularly reviewing logs or feeding them into a SIEM is an essential detective control.
- ✓
Keep device firmware and operating systems up to date with security patches.
Why this is correct
Vendors continually release patches and firmware updates that fix known vulnerabilities, including those disclosed publicly and already exploited in the wild. An unpatched router or switch becomes an easy target because attackers use automated scanners to find devices with outdated software. Establishing a patch cycle that tests and deploys updates in a timely manner is critical to preventing known-exploit intrusions.
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Network Topology Types
Key term
VLAN
A VLAN (Virtual Local Area Network) is a logical grouping of network devices that behave as if they are on the same physical network segment, regardless of their actual physical location.
Key term
Network segmentation
Network segmentation is the practice of dividing a computer network into smaller, isolated parts to improve performance, contain security threats, and simplify management.
About these practice questions
This 200-301 question is part of Courseiva's 1,389-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.