CCNA Network Services and Security Practice Question
Which two statements accurately describe why least privilege and source restriction work well together for administrative access?
⚠ Common exam trap
A common exam trap is believing that either least privilege or source restriction alone fully secures administrative access. Candidates may incorrectly think that limiting user permissions removes the need to restrict source IPs, or vice versa. This mistake overlooks that least privilege controls what actions a user can perform after access, but does not prevent unauthorized access attempts from untrusted locations. Similarly, source restriction limits where access can originate but does not limit what an authenticated user can do. The exam tests understanding that both controls are necessary and complementary for robust administrative security.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Least privilege reduces the scope of actions an authenticated user can perform.
Least privilege and source restriction work well together because they reduce risk in different ways. In practical terms, least privilege limits what a user can do after access is granted, while source restriction reduces where an administrative session is even allowed to originate. Together they reduce both exposure and potential impact. This is a layered management-security concept and a strong exam-style reasoning item.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Least privilege reduces the scope of actions an authenticated user can perform.
Why this is correct
Least privilege ensures that an authenticated administrator can only execute the specific commands and configuration changes required for their job role. By limiting authorization to a minimal set of actions, it reduces the potential impact of mistakes, compromised credentials, or insider misuse, and enforces separation of duties. This is a core principle of Role-Based Access Control (RBAC).
- ✓
Source restriction reduces the network locations from which administrative access is permitted.
Why this is correct
Source restriction confines administrative access to predefined IP addresses or subnets by using traffic filtering such as ACLs or firewall rules on the device itself. By controlling exactly which network locations can initiate management sessions, it prevents unknown or untrusted hosts from reaching SSH, HTTPS, or console services. This narrows the trust boundary for control-plane traffic.
- ✗
Either one by itself removes the need for logging.
Why it's wrong here
Least privilege and source restriction limit the attack surface, but they do not make logging unnecessary. Even with tightly scoped roles and restricted source addresses, administrative actions must be recorded to detect anomalous behavior, support forensic analysis, and satisfy compliance requirements. Without logs, there is no accountability for what a privileged user actually did.
When this WOULD be correct
In a different exam scenario focused on the benefits of implementing security measures in a low-risk environment, a question might state that certain security practices can minimize the need for logging due to reduced risk exposure. In this context, the statement could be interpreted as correct.
- ✗
Both exist only for wireless guest access policies.
Why it's wrong here
These are universal security design concepts, not wireless-guest-specific policies. Least privilege and source restriction apply to all administrative access, including router/switch management, server administration, and wired infrastructure, as well as guest network controls. They are implemented through AAA frameworks, RBAC, and management ACLs across the entire enterprise.
When this WOULD be correct
If the exam question specifically asked about access control measures that only apply to wireless guest networks, then this option could be correct. For instance, a question might focus on security policies that limit guest access to a network, making this statement relevant.
- ✗
They require all administrative traffic to use PPP encapsulation.
Why it's wrong here
PPP (Point-to-Point Protocol) is a data-link layer encapsulation used on serial WAN links, not a security control. Least privilege and source restriction are management-plane design principles that govern authorization and network-level access, not the Layer 2 protocol used for administrative traffic. Secure administrative access typically uses SSH, HTTPS, or IPsec VPNs, not PPP.
When this WOULD be correct
In a question specifically about network protocols, if it asked which encapsulation method is required for secure administrative traffic in a legacy system, PPP encapsulation could be the correct answer due to its historical use in point-to-point connections.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Least privilege reduces the scope of actions an authenticated user can perform.Correct answer▾
Why this is correct
Least privilege ensures that an authenticated administrator can only execute the specific commands and configuration changes required for their job role. By limiting authorization to a minimal set of actions, it reduces the potential impact of mistakes, compromised credentials, or insider misuse, and enforces separation of duties. This is a core principle of Role-Based Access Control (RBAC).
✗Either one by itself removes the need for logging.Wrong answer — click to see why▾
Why this is wrong here
Logging is essential for auditing and monitoring administrative actions, regardless of least privilege or source restriction. These controls reduce risk but do not eliminate the need for accountability and incident detection through logs.
★ When this WOULD be the correct answer
In a different exam scenario focused on the benefits of implementing security measures in a low-risk environment, a question might state that certain security practices can minimize the need for logging due to reduced risk exposure. In this context, the statement could be interpreted as correct.
Why candidates choose this
A test-taker might think that if access is tightly controlled, logging becomes redundant, but in reality, logging provides visibility into any actions taken, including those by authorized users.
✗Both exist only for wireless guest access policies.Wrong answer — click to see why▾
Why this is wrong here
Least privilege and source restriction are fundamental security principles applied broadly across all network devices and services, not just wireless guest access. They are used for administrative access to routers, switches, firewalls, and servers.
★ When this WOULD be the correct answer
If the exam question specifically asked about access control measures that only apply to wireless guest networks, then this option could be correct. For instance, a question might focus on security policies that limit guest access to a network, making this statement relevant.
Why candidates choose this
Students may associate source restriction with guest networks because guest access often uses source-based ACLs, but this is a narrow view; these principles are universal.
✗They require all administrative traffic to use PPP encapsulation.Wrong answer — click to see why▾
Why this is wrong here
PPP encapsulation is a Layer 2 protocol used for point-to-point links, such as serial connections, and is unrelated to the security principles of least privilege or source restriction. These principles are implemented through authorization policies and network access controls, not encapsulation methods.
★ When this WOULD be the correct answer
In a question specifically about network protocols, if it asked which encapsulation method is required for secure administrative traffic in a legacy system, PPP encapsulation could be the correct answer due to its historical use in point-to-point connections.
Why candidates choose this
Students might confuse PPP with other security mechanisms like PAP/CHAP authentication, which can be used for access control, but PPP itself does not enforce least privilege or source restriction.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.