CCNA Network Services and Security Practice Question
Which two statements accurately describe good management-plane security practice on network devices?
⚠ Common exam trap
A common exam trap is selecting only one security measure, such as using SSH, and ignoring the importance of restricting management access sources. Candidates might assume that encrypted protocols alone provide complete security, but without source filtering, attackers can still attempt unauthorized connections. Another trap is choosing options that suggest disabling logging or using shared admin accounts, which weaken security by reducing accountability and visibility. The exam tests understanding that management-plane security is multi-layered, requiring both secure protocols and access restrictions to effectively protect network devices.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use secure management protocols such as SSH instead of less secure remote-access methods.
Good management-plane security combines multiple layers of control. In practical terms, using secure protocols such as SSH is important, but so is restricting which sources may connect, controlling who is authorized, and maintaining visibility into administrative activity. Strong management security is not usually one setting by itself. This is a layered-control question rather than a single-technology question.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use secure management protocols such as SSH instead of less secure remote-access methods.
Why this is correct
Secure management protocols like SSH provide encrypted transport and strong authentication for administrative sessions, preventing credential theft and session hijacking over the network. In contrast, protocols such as Telnet or HTTP transmit passwords and configuration data in plaintext, which attackers can easily intercept. Protecting the management plane with encryption is a foundational best practice for network device security.
- ✓
Restrict management access to trusted source networks where possible.
Why this is correct
Restricting management access to trusted source networks, typically via access control lists (ACLs) or firewall rules, limits the devices that can even attempt to reach the management interfaces. By allowing only known admin subnets or jump hosts, you dramatically reduce the attack surface and the risk of brute-force or exploit attempts from the broader internet. This defense-in-depth measure complements protocol encryption by blocking unauthorized sources at the network layer.
- ✗
Prefer shared generic admin accounts for convenience.
Why it's wrong here
Shared generic admin accounts are discouraged because they eliminate individual accountability; when multiple administrators use the same credentials, audit logs cannot identify which person made a critical change or caused an outage. This also makes credential revocation difficult when an employee leaves or is compromised, requiring a disruptive password change for everyone. Unique per-user accounts enable fine-grained authorization and non-repudiation, making shared accounts a security anti-pattern.
When this WOULD be correct
If an exam question asked about user management practices in a small, isolated environment where convenience is prioritized over security, and where user accountability is not a concern, then preferring shared generic admin accounts could be considered acceptable.
- ✗
Disable all logging to reduce device workload.
Why it's wrong here
Disabling all logging to reduce device workload is counterproductive because logs are crucial for detecting security incidents, troubleshooting network faults, and meeting compliance requirements. Without logs, an administrator would have no forensic evidence to trace an attack or a configuration error, and would remain unaware of anomalous activity. Modern logging can be rate-limited and filtered to manage overhead while still retaining essential audit data, so eliminating it entirely weakens the security posture.
When this WOULD be correct
In a question focused on optimizing performance for low-resource devices in a controlled environment, where logging is deemed unnecessary due to limited access and oversight, disabling logging could be considered acceptable.
- ✗
Rely only on SSID names to protect router management.
Why it's wrong here
SSID names are wireless network identifiers used to distinguish one 802.11 WLAN from another; they are broadcast in beacons and offer no authentication or encryption for management-plane access. Even hiding an SSID provides only obscurity, as it can be easily discovered by passive scanning tools. Router management security depends on secure remote-access protocols, strong authentication, and access restrictions, none of which are related to the SSID.
When this WOULD be correct
In a question focused on basic home network security practices where the context is about minimizing complexity for non-technical users, an option suggesting that SSID names can serve as a layer of obscurity might be considered acceptable.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Use secure management protocols such as SSH instead of less secure remote-access methods.Correct answer▾
Why this is correct
Secure management protocols like SSH provide encrypted transport and strong authentication for administrative sessions, preventing credential theft and session hijacking over the network. In contrast, protocols such as Telnet or HTTP transmit passwords and configuration data in plaintext, which attackers can easily intercept. Protecting the management plane with encryption is a foundational best practice for network device security.
✗Prefer shared generic admin accounts for convenience.Wrong answer — click to see why▾
Why this is wrong here
Using shared generic admin accounts compromises accountability and traceability, making it difficult to identify who performed specific actions on the network device. Good management-plane security practices emphasize the use of unique accounts for each user to enhance security and auditing.
★ When this WOULD be the correct answer
If an exam question asked about user management practices in a small, isolated environment where convenience is prioritized over security, and where user accountability is not a concern, then preferring shared generic admin accounts could be considered acceptable.
Why candidates choose this
Candidates may choose this option due to a misunderstanding of the balance between convenience and security, believing that shared accounts simplify management without recognizing the security risks involved.
✗Disable all logging to reduce device workload.Wrong answer — click to see why▾
Why this is wrong here
Disabling all logging is detrimental to security management as it prevents the monitoring of unauthorized access and troubleshooting issues, which are critical for maintaining device integrity.
★ When this WOULD be the correct answer
In a question focused on optimizing performance for low-resource devices in a controlled environment, where logging is deemed unnecessary due to limited access and oversight, disabling logging could be considered acceptable.
Why candidates choose this
Candidates may choose this option believing that reducing logging will enhance device performance and reduce resource consumption, especially if they have encountered scenarios where excessive logging was an issue.
✗Rely only on SSID names to protect router management.Wrong answer — click to see why▾
Why this is wrong here
Relying solely on SSID names for router management security is inadequate, as SSIDs can be easily discovered by anyone within range, providing no real protection against unauthorized access.
★ When this WOULD be the correct answer
In a question focused on basic home network security practices where the context is about minimizing complexity for non-technical users, an option suggesting that SSID names can serve as a layer of obscurity might be considered acceptable.
Why candidates choose this
Candidates may mistakenly believe that SSID names provide a level of security by obscurity, especially if they lack understanding of more robust security measures like encryption and proper access controls.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.