CCNA Network Services and Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Disable unused services or interfaces where practical

  Why this is correct

  Unused services like the HTTP server, CDP, or unused physical interfaces remain active by default and can be exploited as attack vectors or leak sensitive network information. Disabling these services and shutting down unused ports reduces the device's attack surface and prevents unauthorized lateral movement. This is a basic hardening step that every network administrator should implement.

• ✓

  Use SSH instead of Telnet for remote management

  Why this is correct

  Telnet sends all data, including usernames and passwords, in plaintext across the network, making it trivial for an attacker with a packet capture tool to steal credentials. SSH (Secure Shell) encrypts the entire session, protecting both the authentication process and the configuration commands you send. Using SSH instead of Telnet is a foundational security measure for remote device management.

• ✗

  Allow anonymous administrative login for convenience

  Why it's wrong here

  Allowing anonymous administrative login means there is no user account tied to any configuration change, so you lose all accountability and audit trail. Without unique usernames, you cannot trace who executed critical commands or who misconfigured the device. This violates the fundamental security principle of least privilege and makes post-incident forensic analysis impossible.

  When this WOULD be correct

  In a hypothetical exam question focused on legacy systems or specific environments where security policies are relaxed for testing purposes, allowing anonymous administrative login could be deemed acceptable for quick access or troubleshooting without strict security protocols.

• ✗

  Place all traffic in VLAN 1 so it is easier to remember

  Why it's wrong here

  Using VLAN 1 for all traffic defeats the purpose of VLAN segmentation because every device ends up in the same broadcast domain, allowing broadcast storms and ARP spoofing to propagate everywhere. VLAN 1 is also not administratively pruned by default, making it a common target for trunk-based attacks. Best practice is to keep management traffic in a separate VLAN and never use VLAN 1 for user data.

  When this WOULD be correct

  In a question focused on simplifying network management for a small, non-critical environment where security is not a primary concern, placing all traffic in VLAN 1 might be considered acceptable for ease of configuration and maintenance.

• ✗

  Remove authentication from VTY lines

  Why it's wrong here

  Removing authentication from VTY lines means that anyone who can reach the device's virtual terminal ports could connect without providing any credentials. This would allow an unauthenticated user to enter user EXEC and potentially privileged EXEC mode, depending on the enable password setup. VTY lines must always be configured with login authentication, whether local usernames or a AAA server, to prevent unauthorized access.

  When this WOULD be correct

  In a hypothetical exam scenario focused on a legacy system with strict internal access controls where the question specifies that the system is isolated from external networks, removing authentication from VTY lines might be considered acceptable for ease of access by trusted internal personnel.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”