CCNA Switching and Network Access Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Guest access should normally be isolated from internal corporate resources.

  Why this is correct

  Guest access should normally be isolated from internal corporate resources because guests are untrusted endpoints. In a proper design, guest traffic is placed in a separate VLAN or VRF, and a firewall or access control list (ACL) restricts it to internet-only connectivity, blocking any reachability to internal subnets, servers, or employee devices. This segmentation prevents compromised or malicious guest devices from pivoting into the corporate network.

• ✓

  Guest access policies should usually reflect lower trust than employee access.

  Why this is correct

  Guest access policies should usually reflect lower trust than employee access because guest devices are unmanaged, unauthenticated, and possibly infected. Employees are provisioned through enterprise identity management and device compliance, so they merit broader access, while guests should receive minimal rights: typically only HTTPS/HTTP and DNS, with strict egress controls. Applying the principle of least privilege ensures that guests can do only what is necessary, reducing the attack surface without degrading their basic internet needs.

• ✗

  Guest WLANs should avoid all security to make access easier.

  Why it's wrong here

  Guest WLANs should not avoid all security because an open, unencrypted network is a high-risk vector for credential theft, malware distribution, and unauthorized eavesdropping. Even guest networks require at least WPA2/WPA3 with a captive portal or preshared key for accountability, plus client isolation to prevent peer-to-peer attacks. Security is not about making access harder; it is about applying appropriate controls so that ease of use does not come at the cost of safety.

  When this WOULD be correct

  In a scenario where the exam question focuses on a specific type of public Wi-Fi network, such as an open access point in a coffee shop, where the primary goal is to provide easy access for customers without any security measures. Here, the context would justify the option as correct.

• ✗

  Guest WLANs should automatically use the same permissions as internal employee WLANs.

  Why it's wrong here

  Guest WLANs should not automatically use the same permissions as internal employee WLANs because that would let unauthenticated visitors reach corporate assets such as file shares, printers, and management interfaces, completely negating segmentation. Employees are vetted and given role-based access, whereas guests have no such standing, so their traffic must be mapped to a restricted access profile. Uniform permissions would violate the core design principle of least privilege and expose the internal network to unacceptable risk.

  When this WOULD be correct

  In a scenario where the exam question asks about a network design for a small business with minimal security concerns and a fully trusted environment, it could be appropriate for guest WLANs to share permissions with internal employee WLANs, assuming all users are known and vetted.

• ✗

  Guest access means the AP no longer needs controller coordination.

  Why it's wrong here

  Guest access does not mean the AP no longer needs controller coordination; the controller still provides critical functions like CRL, authentication, radio resource management, and enforcement of the guest VLAN and policy. Even with guest traffic offloaded or tunneled, the AP relies on the controller or a centralized WLC for onboarding, roaming, and applying ACLs. The guest network is simply a logical configuration under the same management architecture, not an independent network that bypasses controller oversight.

  When this WOULD be correct

  In a question focused on a specific type of wireless network architecture where lightweight access points operate independently without a controller, option E could be correct. For example, if the question specifies a scenario with a fully autonomous network setup designed for temporary events, where centralized control is not feasible.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question