Question 1mediummultiple choice
Full question →mediummultiple choiceObjective-mapped
Which statement best describes why a management network should prefer SSH over Telnet?
Answer choices
Why each option matters
Good practice is not just finding the correct option. The wrong answers often show the exact trap the exam wants you to fall into.
A
Best answer
SSH encrypts remote management traffic, while Telnet does not.
This is correct because encryption is the main security advantage of SSH over Telnet.
B
Distractor review
Telnet is preferred because it is simpler to sniff and verify.
This is wrong because the ease of sniffing is actually part of Telnet’s weakness.
C
Distractor review
SSH works only on wireless networks.
This is wrong because SSH is not limited to wireless networks.
D
Distractor review
Telnet is required for AAA authorization to work.
This is wrong because AAA can work with secure management protocols such as SSH.
Common exam trap
Common exam trap: answer the scenario, not the keyword
A frequent exam trap is the misconception that Telnet is required for AAA authorization or that SSH is limited to wireless networks. Candidates might incorrectly believe Telnet’s simplicity makes it preferable or that SSH’s encryption is unnecessary. This misunderstanding leads to choosing Telnet despite its security weaknesses. The trap exploits confusion about protocol capabilities and AAA integration. Remember, AAA works with both SSH and Telnet, but SSH’s encryption makes it the secure and recommended choice for remote management in Cisco environments.
Technical deep dive
How to think about this question
Secure Shell (SSH) is a network protocol that provides encrypted communication for remote device management. It ensures that all data exchanged between the administrator and the network device, such as Cisco routers or switches, is encrypted, protecting sensitive information like usernames, passwords, and configuration commands from eavesdropping. Telnet, in contrast, sends all data in plaintext, making it vulnerable to interception by attackers using packet sniffers. When configuring remote management on Cisco devices, SSH is preferred because it aligns with security best practices by encrypting traffic. This encryption prevents attackers from capturing login credentials or session data, which could lead to unauthorized access or network compromise. Cisco IOS supports SSH natively, and enabling SSH involves generating cryptographic keys and configuring user authentication. AAA services can be integrated with SSH to provide robust authentication and authorization, but AAA itself does not require Telnet or SSH specifically. A common exam trap is assuming Telnet is necessary for AAA authorization or that SSH only works on certain network types like wireless. In reality, AAA works with both protocols, and SSH is universally supported on IP networks regardless of the physical medium. Understanding the security implications of using Telnet versus SSH is critical for Cisco network security and is frequently tested in the CCNA exam. Practically, network administrators should disable Telnet on management interfaces to enforce encrypted remote access and reduce attack surfaces.
KKey Concepts to Remember
- SSH encrypts all remote management traffic, including usernames, passwords, and session data, preventing interception and unauthorized access.
- Telnet transmits management traffic in clear text, exposing sensitive credentials and commands to network sniffing and attacks.
- Cisco devices prefer SSH over Telnet for secure remote administration to comply with security best practices and protect network integrity.
- AAA (Authentication, Authorization, and Accounting) services function independently of the remote management protocol and support both SSH and Telnet.
- Management networks should always use encrypted protocols like SSH to ensure confidentiality and integrity of administrative sessions.
- Using SSH reduces the risk of credential compromise during remote device management compared to Telnet.
- Network security policies in Cisco environments mandate encrypted remote access methods to prevent unauthorized device control.
- SSH operates over TCP port 22 and supports strong cryptographic algorithms, while Telnet uses TCP port 23 without encryption.
TExam Day Tips
- Watch for words such as best, first, most likely and least administrative effort.
- Review why wrong options are wrong, not only why the correct option is correct.
Related practice questions
Related 200-301 practice-question pages
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
CCNA subnetting practice questions
Practise IPv4 subnetting, CIDR, masks, host ranges and subnet selection.
CCNA OSPF practice questions
Practise OSPF neighbours, router IDs, metrics, areas and routing-table interpretation.
CCNA VLAN practice questions
Practise VLANs, access ports, trunks, allowed VLANs and switching scenarios.
CCNA STP practice questions
Practise spanning tree, root bridge election, port roles and STP troubleshooting.
CCNA EtherChannel practice questions
Practise LACP, PAgP, port-channel behaviour and bundle requirements.
CCNA ACL practice questions
Practise standard and extended ACLs, permit/deny logic and traffic filtering.
CCNA NAT practice questions
Practise static NAT, dynamic NAT, PAT and inside/outside address translation.
CCNA DHCP practice questions
Practise DHCP scopes, relay, leases and troubleshooting.
CCNA show ip route practice questions
Practise routing-table output, longest-prefix match, AD and route selection.
CCNA show interfaces trunk practice questions
Practise trunk verification and VLAN forwarding across switches.
CCNA wireless security practice questions
Practise WLAN security, authentication and wireless architecture concepts.
CCNA IPv6 practice questions
Practise IPv6 addressing, routes, neighbour discovery and common IPv6 exam traps.
More questions from this exam
Keep practising from the same exam bank, or move into a focused topic page if this question exposed a weak area.
Question 1
A router learns the same prefix from both OSPF and EIGRP. Which route is installed by default?
Question 2
A router shows this output: R1#show ip ospf neighbor Neighbor ID Pri State Dead Time Address Interface 10.1.1.2 1 FULL/DR 00:00:34 192.168.12.2 GigabitEthernet0/0 10.1.1.3 1 2WAY/DROTHER 00:00:39 192.168.12.3 GigabitEthernet0/0 Which statement is correct?
Question 3
What is the OSPF metric called?
Question 4
A non-root switch has two uplinks toward the root bridge. One path has a lower total STP cost than the other. What role will the lower-cost uplink have?
Question 5
A router interface applies this ACL inbound: 10 deny tcp any any eq 80 20 permit ip any any A user reports that web browsing to a server by IP address fails, but ping works. Which statement best explains the behavior?
Question 6
A router learns route 198.51.100.0/24 from OSPF with AD 110 and also has a static route to the same prefix configured with AD 150. Which route is installed?
FAQ
Questions learners often ask
What does this 200-301 question test?
SSH encrypts all remote management traffic, including usernames, passwords, and session data, preventing interception and unauthorized access.
What is the correct answer to this question?
The correct answer is: SSH encrypts remote management traffic, while Telnet does not. — SSH is preferred because it protects remote administrative traffic with encryption. In plain language, that means usernames, passwords, and session contents are not exposed in clear text as they cross the network. Telnet does not offer that protection, which is why it is considered much weaker from a security perspective. This is one of the most basic management-security choices in networking. The issue is not whether remote administration should exist. It is whether that administration should happen in a way that protects credentials and commands. That is exactly why SSH is the stronger choice.
What should I do if I get this 200-301 question wrong?
Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.
Discussion
Loading comments…
Sign in to join the discussion.