CCNA Network Services and Security Practice Question
This 200-301 practice question tests your understanding of network services and security. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. A key principle to apply: sSH encrypts all remote management traffic, including usernames, passwords, and session data, preventing interception and unauthorized access.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Which statement best describes why a management network should prefer SSH over Telnet?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "best"
Why it matters: Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SSH encrypts remote management traffic, while Telnet does not.
SSH is preferred because it protects remote administrative traffic with encryption. In plain language, that means usernames, passwords, and session contents are not exposed in clear text as they cross the network. Telnet does not offer that protection, which is why it is considered much weaker from a security perspective.
This is one of the most basic management-security choices in networking. The issue is not whether remote administration should exist. It is whether that administration should happen in a way that protects credentials and commands. That is exactly why SSH is the stronger choice.
Key principle: SSH encrypts all remote management traffic, including usernames, passwords, and session data, preventing interception and unauthorized access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
SSH encrypts remote management traffic, while Telnet does not.
Why this is correct
This is correct because encryption is the main security advantage of SSH over Telnet.
Clue confirmation
The clue word "best" in the question point toward this answer.
Related concept
SSH encrypts all remote management traffic, including usernames, passwords, and session data, preventing interception and unauthorized access.
✗
Telnet is preferred because it is simpler to sniff and verify.
Why it's wrong here
This is wrong because the ease of sniffing is actually part of Telnet’s weakness.
When this WOULD be correct
In a different exam scenario where the question asks about network monitoring tools or techniques for analyzing traffic, a candidate might be asked to identify which protocol allows easier interception and analysis of data packets. In that context, Telnet could be considered simpler to sniff.
✗
SSH works only on wireless networks.
Why it's wrong here
This is wrong because SSH is not limited to wireless networks.
When this WOULD be correct
In a question that asks about the limitations of SSH, such as 'Which of the following protocols is limited to wireless networks for secure management?', option C could be correct if it were framed to imply that SSH is not suitable for wired networks, which is misleading but could be a plausible exam scenario.
✗
Telnet is required for AAA authorization to work.
Why it's wrong here
This is wrong because AAA can work with secure management protocols such as SSH.
When this WOULD be correct
In a question asking which protocols are necessary for implementing AAA in a legacy system, where the context specifies that Telnet is being used in conjunction with a specific AAA server that requires Telnet for compatibility, this option could be correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓SSH encrypts remote management traffic, while Telnet does not.Correct answer▾
Why this is correct
This is correct because encryption is the main security advantage of SSH over Telnet.
✗Telnet is preferred because it is simpler to sniff and verify.Wrong answer — click to see why▾
Why this is wrong here
This option is incorrect because Telnet is not preferred for sniffing and verification; rather, it is insecure and transmits data in plaintext, making it unsuitable for management networks.
★ When this WOULD be the correct answer
In a different exam scenario where the question asks about network monitoring tools or techniques for analyzing traffic, a candidate might be asked to identify which protocol allows easier interception and analysis of data packets. In that context, Telnet could be considered simpler to sniff.
Why candidates choose this
Candidates may choose this option due to a misunderstanding of network security principles, believing that the simplicity of Telnet's plaintext communication makes it easier to analyze, without recognizing the inherent security risks.
✗SSH works only on wireless networks.Wrong answer — click to see why▾
Why this is wrong here
This option is wrong because SSH is not limited to wireless networks; it operates over any IP-based network, providing secure communication regardless of the medium. Telnet, on the other hand, is inherently insecure due to its lack of encryption.
★ When this WOULD be the correct answer
In a question that asks about the limitations of SSH, such as 'Which of the following protocols is limited to wireless networks for secure management?', option C could be correct if it were framed to imply that SSH is not suitable for wired networks, which is misleading but could be a plausible exam scenario.
Why candidates choose this
Candidates may choose this option due to a misunderstanding of SSH's capabilities, mistakenly believing that it is only applicable in wireless contexts, possibly due to confusion with other protocols or security practices.
✗Telnet is required for AAA authorization to work.Wrong answer — click to see why▾
Why this is wrong here
This option is incorrect because Telnet does not inherently provide AAA (Authentication, Authorization, and Accounting) capabilities; it is simply a protocol for remote access without encryption. AAA can be implemented using other protocols, including those that work with SSH.
★ When this WOULD be the correct answer
In a question asking which protocols are necessary for implementing AAA in a legacy system, where the context specifies that Telnet is being used in conjunction with a specific AAA server that requires Telnet for compatibility, this option could be correct.
Why candidates choose this
Candidates may choose this option due to a misunderstanding of how AAA works, believing that Telnet's simplicity and historical use in network management imply it is required for AAA, despite its lack of security features.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Common exam traps
Common exam trap: answer the scenario, not the keyword
A frequent exam trap is the misconception that Telnet is required for AAA authorization or that SSH is limited to wireless networks. Candidates might incorrectly believe Telnet’s simplicity makes it preferable or that SSH’s encryption is unnecessary. This misunderstanding leads to choosing Telnet despite its security weaknesses. The trap exploits confusion about protocol capabilities and AAA integration. Remember, AAA works with both SSH and Telnet, but SSH’s encryption makes it the secure and recommended choice for remote management in Cisco environments.
Detailed technical explanation
How to think about this question
Secure Shell (SSH) is a network protocol that provides encrypted communication for remote device management. It ensures that all data exchanged between the administrator and the network device, such as Cisco routers or switches, is encrypted, protecting sensitive information like usernames, passwords, and configuration commands from eavesdropping. Telnet, in contrast, sends all data in plaintext, making it vulnerable to interception by attackers using packet sniffers.
When configuring remote management on Cisco devices, SSH is preferred because it aligns with security best practices by encrypting traffic. This encryption prevents attackers from capturing login credentials or session data, which could lead to unauthorized access or network compromise. Cisco IOS supports SSH natively, and enabling SSH involves generating cryptographic keys and configuring user authentication. AAA services can be integrated with SSH to provide robust authentication and authorization, but AAA itself does not require Telnet or SSH specifically.
A common exam trap is assuming Telnet is necessary for AAA authorization or that SSH only works on certain network types like wireless. In reality, AAA works with both protocols, and SSH is universally supported on IP networks regardless of the physical medium. Understanding the security implications of using Telnet versus SSH is critical for Cisco network security and is frequently tested in the CCNA exam. Practically, network administrators should disable Telnet on management interfaces to enforce encrypted remote access and reduce attack surfaces.
KKey Concepts to Remember
SSH encrypts all remote management traffic, including usernames, passwords, and session data, preventing interception and unauthorized access.
Telnet transmits management traffic in clear text, exposing sensitive credentials and commands to network sniffing and attacks.
Cisco devices prefer SSH over Telnet for secure remote administration to comply with security best practices and protect network integrity.
AAA (Authentication, Authorization, and Accounting) services function independently of the remote management protocol and support both SSH and Telnet.
Management networks should always use encrypted protocols like SSH to ensure confidentiality and integrity of administrative sessions.
Using SSH reduces the risk of credential compromise during remote device management compared to Telnet.
Network security policies in Cisco environments mandate encrypted remote access methods to prevent unauthorized device control.
SSH operates over TCP port 22 and supports strong cryptographic algorithms, while Telnet uses TCP port 23 without encryption.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
SSH encrypts all remote management traffic, including usernames, passwords, and session data, preventing interception and unauthorized access.
Real-world example
How this comes up in practice
A junior network technician can log in to a core router but cannot reach the enable prompt or configuration mode. The AAA server is authenticating the login — but the authorisation policy only grants privilege level 1, not 15. Authentication (who you are) is working; authorisation (what you can do) is not.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this 200-301 question in full detail.
Review sSH encrypts all remote management traffic, including usernames, passwords, and session data, preventing interception and unauthorized access., then practise related 200-301 questions on the same topic to reinforce the concept.
Network Services and Security — This question tests Network Services and Security — SSH encrypts all remote management traffic, including usernames, passwords, and session data, preventing interception and unauthorized access..
What is the correct answer to this question?
The correct answer is: SSH encrypts remote management traffic, while Telnet does not. — SSH is preferred because it protects remote administrative traffic with encryption. In plain language, that means usernames, passwords, and session contents are not exposed in clear text as they cross the network. Telnet does not offer that protection, which is why it is considered much weaker from a security perspective.
This is one of the most basic management-security choices in networking. The issue is not whether remote administration should exist. It is whether that administration should happen in a way that protects credentials and commands. That is exactly why SSH is the stronger choice.
What should I do if I get this 200-301 question wrong?
Review sSH encrypts all remote management traffic, including usernames, passwords, and session data, preventing interception and unauthorized access., then practise related 200-301 questions on the same topic to reinforce the concept.
Are there clue words in this question I should notice?
Yes — watch for: "best". Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
What is the key concept behind this question?
SSH encrypts all remote management traffic, including usernames, passwords, and session data, preventing interception and unauthorized access.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.