CCNA Network Services and Security Practice Question
Why is disabling unused services on network devices considered a sound security practice?
⚠ Common exam trap
Don't confuse the primary goal of security practices with secondary benefits like performance or compliance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Because it reduces unnecessary attack surface and exposure on the device.
It is considered sound because every enabled service is a potential attack surface or management exposure point. In practical terms, if a service is not needed, leaving it enabled creates unnecessary risk without business value. Reducing what is listening or available on a device helps limit opportunities for misuse or exploitation. Option B is incorrect because disabling unused services does not affect routing protocol convergence; that is a routing protocol function. Option C is wrong because no single security practice can guarantee the device cannot be misconfigured; misconfiguration remains possible through other means. Option D is nonsensical because disabling services does not turn the device into a controller.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Because it reduces unnecessary attack surface and exposure on the device.
Why this is correct
Every enabled network service (e.g., HTTP server, SNMP, Telnet, CDP) creates listening ports and daemons that can be probed or exploited. Disabling unused services eliminates those potential entry points, shrinking the attack surface and reducing the device's exposure to malicious traffic or reconnaissance. This aligns with the security principle of least privilege, where only essential functions remain active.
- ✗
Because it automatically improves routing convergence.
Why it's wrong here
Routing convergence is driven by routing protocol timers, link-state or distance-vector algorithms, and topology changes, not by the set of enabled network services. While disabling unused services may free some CPU and memory resources, it does not automatically recompute routes or speed up protocol convergence. Thus, service hardening and routing optimization are separate concerns.
When this WOULD be correct
In a question focused on optimizing network performance or improving routing protocols, an option stating that disabling unused services improves routing convergence could be correct if it implies that reducing unnecessary processes allows for faster protocol updates. For example, if the question asked how to enhance routing efficiency by minimizing resource usage, this option could apply.
- ✗
Because it guarantees the device cannot be misconfigured.
Why it's wrong here
Though disabling unused services reduces the number of configuration interfaces available, it does not guarantee immunity from misconfiguration. Human error can still occur in security settings, ACLs, SNMP communities, or other active features, and operational mistakes like incorrect route statements remain possible. Hardening is a mitigation measure, not a foolproof prevention mechanism; robust change management and validation are still required.
When this WOULD be correct
In a question focused on best practices for device configuration management, where the emphasis is on ensuring devices are locked down to prevent any configuration errors, this option could be correct if it stated that disabling services helps prevent misconfigurations by limiting available options.
- ✗
Because it converts the device into a controller.
Why it's wrong here
Disabling services does not alter the device's role or forwarding architecture; a switch or router remains a network device, not a controller. A controller in SDN architectures is a separate server that programs flow tables, and simply turning off local services cannot transform the device into one. Therefore, this option misidentifies the purpose of service hardening.
When this WOULD be correct
In a question asking about the benefits of enabling specific services on a network device to enhance its role as a controller, option D could be correct. For instance, if the question specifies that enabling certain services is necessary for the device to function as a controller in a network management scenario, then this option would apply.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Because it reduces unnecessary attack surface and exposure on the device.Correct answer▾
Why this is correct
Every enabled network service (e.g., HTTP server, SNMP, Telnet, CDP) creates listening ports and daemons that can be probed or exploited. Disabling unused services eliminates those potential entry points, shrinking the attack surface and reducing the device's exposure to malicious traffic or reconnaissance. This aligns with the security principle of least privilege, where only essential functions remain active.
✗Because it automatically improves routing convergence.Wrong answer — click to see why▾
Why this is wrong here
Disabling unused services does not affect routing convergence, which depends on routing protocols and network topology. Service hardening and routing optimization are separate concerns.
★ When this WOULD be the correct answer
In a question focused on optimizing network performance or improving routing protocols, an option stating that disabling unused services improves routing convergence could be correct if it implies that reducing unnecessary processes allows for faster protocol updates. For example, if the question asked how to enhance routing efficiency by minimizing resource usage, this option could apply.
Why candidates choose this
Students might think that reducing services frees up CPU or memory, potentially improving routing performance, but convergence is not directly impacted by disabling unused services.
✗Because it guarantees the device cannot be misconfigured.Wrong answer — click to see why▾
Why this is wrong here
Disabling services reduces risk but does not guarantee prevention of misconfiguration; human error can still occur in other settings. Security hardening is a layered approach, not a silver bullet.
★ When this WOULD be the correct answer
In a question focused on best practices for device configuration management, where the emphasis is on ensuring devices are locked down to prevent any configuration errors, this option could be correct if it stated that disabling services helps prevent misconfigurations by limiting available options.
Why candidates choose this
The word 'guarantees' might mislead students into thinking that disabling services eliminates all configuration errors, but it only reduces the attack surface.
✗Because it converts the device into a controller.Wrong answer — click to see why▾
Why this is wrong here
Disabling services does not change a device's role; a router remains a router, and a switch remains a switch. Converting a device to a controller requires specific software and configuration changes.
★ When this WOULD be the correct answer
In a question asking about the benefits of enabling specific services on a network device to enhance its role as a controller, option D could be correct. For instance, if the question specifies that enabling certain services is necessary for the device to function as a controller in a network management scenario, then this option would apply.
Why candidates choose this
Students might confuse 'disabling services' with 'enabling controller functions' in SDN environments, but these are distinct actions.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
Routing Protocol Comparison
| Protocol | Metric | Max Hops | Algorithm | Type |
|---|---|---|---|---|
| RIP v2 | Hop count | 15 | Bellman-Ford | Distance vector |
| OSPF | Cost (bandwidth) | Unlimited | Dijkstra (SPF) | Link state |
| EIGRP | Composite metric | Unlimited | DUAL | Hybrid |
| IS-IS | Cost | Unlimited | Dijkstra | Link state |
| BGP | Policy / attributes | Unlimited | Path vector | Path vector |
RIP's 15-hop limit makes it unsuitable for large networks. OSPF and EIGRP dominate modern enterprise deployments.
Go deeper
Related to this question
Learn chapter
Device File Management with SFTP and SCP
Key term
OSPF
OSPF is a link-state routing protocol used to find the best path for data packets to travel across IP networks, like a smart GPS that recalculates routes when traffic changes.
Key term
CAN
A CAN (Controller Area Network) is a robust vehicle bus standard designed to allow microcontrollers and devices to communicate with each other without a host computer.
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.