CCNA Network Services and Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  WEP

  Why it's wrong here

  WEP uses the RC4 stream cipher with a short, static key and a 24-bit initialization vector (IV), which leads to predictable keystream reuse when IVs eventually repeat. By capturing enough packets, an attacker can recover the key within minutes using readily available tools, so WEP provides only a false sense of security. Because it is fundamentally broken and deprecated, it offers far weaker protection than WPA2 with AES.

  When this WOULD be correct

  If the exam question asked for the wireless security method that was historically used in early WLANs or in legacy systems, WEP could be considered correct. For example, a question might specify 'Which wireless security method was commonly used before WPA and is still found in some older devices?'

• ✗

  WPA

  Why it's wrong here

  WPA was created as a temporary fix for WEP and uses TKIP, which retains the RC4 cipher but adds per-packet key mixing, a 48-bit IV sequence, and a Michael message integrity code. However, TKIP and Michael have known vulnerabilities that allow an attacker to recover the keystream or forge packets, especially with QoS enabled, and the reliance on RC4 remains a fundamental weakness. Thus WPA is only marginally better than WEP and is far less secure than the AES-CCMP used in WPA2.

  When this WOULD be correct

  In a scenario where the exam question asks for the best security method for a legacy system that only supports WPA, or if the question specifies a context where backward compatibility is prioritized over security, then WPA could be considered the correct answer.

• ✓

  WPA2 with AES

  Why this is correct

  WPA2 with AES is the strongest option because it employs AES-CCMP, a 128-bit block cipher operating in counter mode with CBC-MAC for integrity, which together provide robust confidentiality, data-origin authentication, and replay protection. The per-frame key derivation and the cryptanalytic resistance of AES make brute-force or keystream-reuse attacks infeasible, making it the only listed option that meets modern wireless security standards.

• ✗

  Open authentication

  Why it's wrong here

  Open authentication offers no security at all: any client can associate without proving identity, and all data is transmitted in plaintext. There is no encryption, integrity check, or access control on the wireless medium, so an attacker can trivially capture, modify, or inject frames. This is effectively a denial of any confidentiality, making it the weakest possible choice for protecting a WLAN.

  When this WOULD be correct

  If the exam question asked for the simplest method of connecting devices in a controlled environment where security is not a concern, such as a guest network for temporary access, then open authentication could be considered correct.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”