CCNA Network Services and Security Practice Question
Which two statements accurately describe the value of source restriction on administrative access?
⚠ Common exam trap
A common exam trap is to believe that source restriction removes the need for secure transport protocols like SSH or makes logging unnecessary. Some candidates mistakenly think that limiting source IP addresses alone fully secures administrative access. However, source restriction only controls where connections can originate; it does not encrypt data or authenticate users. Ignoring secure protocols or logging can leave management sessions vulnerable to interception or unauthorized use. The exam tests understanding that source restriction is a complementary control, not a replacement for transport security or auditing.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It reduces the set of network locations from which administrative access is allowed.
Source restriction improves security by reducing the number of places from which administrative traffic is expected and permitted. In practical terms, this makes exposure smaller and monitoring clearer. It does not replace secure protocols or identity controls, but it strengthens the overall design. This is a layered-management-security question because it emphasizes how source restriction complements other controls.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
It reduces the set of network locations from which administrative access is allowed.
Why this is correct
Restricting administrative access by source address narrows the potential attack surface to only trusted IPs or subnets. This is a fundamental security control because it minimizes the number of network locations from which a malicious actor could even attempt to authenticate or exploit management protocols. Without such restrictions, the management plane is exposed to the entire reachable network, dramatically increasing the risk of unauthorized access.
- ✓
It can make access monitoring and filtering easier to manage.
Why this is correct
When only specific source addresses are permitted for administrative purposes, security monitoring and filtering become far more manageable because the volume of traffic to inspect is substantially reduced. Administrators can craft precise access control entries and security policies that focus exclusively on a small, known set of sources, making anomaly detection and forensic analysis simpler and more reliable. Centralized logging can then concentrate on deviations from this trusted ledger, instead of sifting through noise from arbitrary endpoints.
- ✗
It removes the need for SSH or other secure transports.
Why it's wrong here
Source-based restriction is an authorization control that limits who can reach the management plane; it does not provide confidentiality or data integrity. SSH, HTTPS, or other secure transports are still essential to protect administrative sessions from eavesdropping, session hijacking, or credential interception. Removing transport security would leave authenticated sessions vulnerable to packet inspection and replay attacks, even when the source IP is strictly controlled.
When this WOULD be correct
If the exam question asked about the benefits of implementing a network policy that allows access only from trusted devices, then this option could be correct, as it might imply that secure transports are not necessary when all access is from a secure, trusted source.
- ✗
It makes logging unnecessary.
Why it's wrong here
Even with source-address filtering, logging remains a critical security control because it provides auditability and enables detection of failed attempts, misconfigurations, or compromised trusted hosts. Without logs, an attacker who successfully originates from a permitted source could operate undetected, and administrators would have no evidence for incident response or compliance audits. Restriction reduces risk but does not eliminate the need for visibility into who or what is accessing the device.
When this WOULD be correct
In a hypothetical exam scenario where the question states that a specific system has implemented comprehensive real-time monitoring and alerting mechanisms that negate the need for logging, option D could be considered correct. This would imply that all actions are monitored live, making logging redundant.
- ✗
It can be used only for wireless management.
Why it's wrong here
Source-address restriction for administrative access is a general security practice applicable to any network device, including routers, switches, and firewalls, not just wireless management controllers. It is commonly implemented on wired infrastructure via management ACLs, VTY access-class filters, and control-plane policing. The technique is transport- and medium-agnostic, so it can safeguard both wired and wireless administrative planes alike.
When this WOULD be correct
If the exam question specifically asked about the management of wireless networks and stated that source restriction is a feature exclusive to wireless management systems, then option E could be correct. For example, a question might ask about security measures unique to wireless administrative access.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓It reduces the set of network locations from which administrative access is allowed.Correct answer▾
Why this is correct
Restricting administrative access by source address narrows the potential attack surface to only trusted IPs or subnets. This is a fundamental security control because it minimizes the number of network locations from which a malicious actor could even attempt to authenticate or exploit management protocols. Without such restrictions, the management plane is exposed to the entire reachable network, dramatically increasing the risk of unauthorized access.
✗It removes the need for SSH or other secure transports.Wrong answer — click to see why▾
Why this is wrong here
This option is incorrect because source restriction does not eliminate the need for secure transport protocols like SSH; it merely limits the locations from which access can be initiated. Secure transports are still essential for protecting data in transit.
★ When this WOULD be the correct answer
If the exam question asked about the benefits of implementing a network policy that allows access only from trusted devices, then this option could be correct, as it might imply that secure transports are not necessary when all access is from a secure, trusted source.
Why candidates choose this
Candidates may find this option tempting due to a misunderstanding of network security principles, believing that restricting access inherently negates the need for secure communication methods like SSH.
✗It makes logging unnecessary.Wrong answer — click to see why▾
Why this is wrong here
This option is wrong because logging is essential for tracking administrative access and actions taken on a system, regardless of source restrictions. Logging provides an audit trail that is critical for security and compliance.
★ When this WOULD be the correct answer
In a hypothetical exam scenario where the question states that a specific system has implemented comprehensive real-time monitoring and alerting mechanisms that negate the need for logging, option D could be considered correct. This would imply that all actions are monitored live, making logging redundant.
Why candidates choose this
Candidates may choose this option due to a misunderstanding of the role of logging in security practices, believing that source restrictions alone can suffice for security oversight without realizing the importance of maintaining logs for accountability.
✗It can be used only for wireless management.Wrong answer — click to see why▾
Why this is wrong here
Option E is incorrect because source restriction can be applied to both wired and wireless management, not limited to wireless environments. Administrative access can be restricted based on IP addresses regardless of the connection type.
★ When this WOULD be the correct answer
If the exam question specifically asked about the management of wireless networks and stated that source restriction is a feature exclusive to wireless management systems, then option E could be correct. For example, a question might ask about security measures unique to wireless administrative access.
Why candidates choose this
Candidates may find this option tempting due to the common association of security measures with wireless networks, leading them to mistakenly believe that source restriction is exclusively applicable to wireless management.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.