CCNA Network Services and Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Source restriction narrows the allowed origin space for administrative sessions.

  Why this is correct

  Source restriction applies network-layer filtering, such as ACLs or management access lists, to administrative protocols (SSH, HTTPS, SNMP) so only traffic from explicitly permitted source IP addresses or subnets reaches the device's management plane. This shrinks the attack surface by blocking unauthorized origins before they can attempt authentication or exploit a service.

• ✓

  Logging improves visibility and accountability for what happened during administrative access.

  Why this is correct

  Logging records successful and failed administrative sessions, including timestamps, source addresses, and executed commands, creating an audit trail that supports accountability and forensic review. Without logs, an administrator would have no objective evidence of who did what, making incident response and compliance verification significantly harder.

• ✗

  Logging removes the need for authentication.

  Why it's wrong here

  Logging is a passive, post-hoc mechanism that merely captures events for review; it does not enforce identity verification or authorization at access time. Authentication remains mandatory because logs cannot prevent an attacker from gaining access or distinguish a legitimate user from an imposter once credentials are compromised.

  When this WOULD be correct

  In a scenario where the question asks about the role of logging in a system that uses a single sign-on (SSO) mechanism, one might argue that logging can reduce the need for repeated authentication prompts, thereby streamlining user access while still maintaining a record of actions.

• ✗

  Source restriction works only when Syslog is disabled.

  Why it's wrong here

  Source restriction works independently of whether Syslog is enabled; it is enforced by the device's data path or management plane filtering regardless of logging state. Syslog merely determines whether events are sent to a remote server for retention, while source restriction actively blocks or permits traffic before any logging decision matters.

  When this WOULD be correct

  In a different question context focused on Syslog configurations, if the question asked about the limitations of source restriction in environments where Syslog is disabled, option D could be correct, indicating that source restriction would not function properly without logging enabled.

• ✗

  Both controls exist only for guest wireless networks.

  Why it's wrong here

  These controls are foundational management-plane security measures recommended for all network infrastructure, not just guest wireless networks. Guest wireless deployments may use such controls, but source restriction and logging apply equally to routers, switches, firewalls, and other devices to protect administrative access from external threats.

  When this WOULD be correct

  In a different exam scenario focusing on security measures specifically for guest wireless networks, a question might ask about controls that are particularly relevant to that context. If the question specified that logging and source restriction are primarily implemented for guest networks, then option E could be correct.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”