CCNA Network Services and Security Practice Question
Why is SSH preferred over Telnet for remote device administration?
⚠ Common exam trap
Don't confuse ease of configuration or bandwidth usage with security features. Focus on the encryption aspect of SSH.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SSH encrypts management traffic, while Telnet sends data in clear text
SSH protects credentials and management traffic by encrypting the session. Telnet does not provide encryption, so usernames, passwords, and commands can be exposed in transit.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SSH uses less bandwidth because it removes the TCP header
Why it's wrong here
SSH does not remove TCP headers; it runs on top of TCP (port 22) just like Telnet, so the transport layer overhead remains unchanged. In fact, SSH adds cryptographic overhead, including encryption header data and the handshake process, which can slightly increase bandwidth consumption. The claim that SSH reduces bandwidth by eliminating TCP headers is factually impossible.
When this WOULD be correct
In a different context, a question might ask which protocol is more efficient for low-bandwidth environments without considering security. If the question specifically states that SSH's bandwidth efficiency is being compared in a scenario where TCP header removal is a factor, then this option could be correct.
- ✓
SSH encrypts management traffic, while Telnet sends data in clear text
Why this is correct
SSH encrypts the entire management session using protocols like AES, ensuring that usernames, passwords, and configuration commands are transmitted in ciphertext. Telnet, by contrast, sends all data in plaintext over TCP port 23, so anyone with a packet sniffer can read sensitive credentials and device output. This confidentiality makes SSH the standard for secure remote administration.
- ✗
SSH works only on console ports, which are more secure
Why it's wrong here
SSH is an IP-based application that operates over any routable interface, typically accessed through virtual terminal (vty) lines on a switch or router. Console ports are separate physical serial ports used for out-of-band management and do not use SSH. While console access is considered more secure due to physical access requirements, SSH is a network management protocol, not a console-only feature.
When this WOULD be correct
In a question that specifically asks about the security of console port access methods, stating that SSH works only on console ports could be correct if the context implies that SSH is the preferred method for console access due to its encryption capabilities, while Telnet is not secure.
- ✗
SSH does not require user authentication
Why it's wrong here
SSH mandates authentication before any remote session is established, using either passwords or cryptographic key pairs for identity verification. Without valid credentials or a recognized private key, the server refuses the connection, and the client also verifies the server's host key. This mutual authentication is a core security feature of SSH and is required by default.
When this WOULD be correct
In a different exam scenario, if the question asked about protocols that do not require user authentication for remote access, then this option could be correct. For example, a question about unsecured protocols might highlight that Telnet allows access without authentication, making it a valid point in that context.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓SSH encrypts management traffic, while Telnet sends data in clear textCorrect answer▾
Why this is correct
SSH encrypts the entire management session using protocols like AES, ensuring that usernames, passwords, and configuration commands are transmitted in ciphertext. Telnet, by contrast, sends all data in plaintext over TCP port 23, so anyone with a packet sniffer can read sensitive credentials and device output. This confidentiality makes SSH the standard for secure remote administration.
✗SSH uses less bandwidth because it removes the TCP headerWrong answer — click to see why▾
Why this is wrong here
This option is incorrect because SSH does not inherently use less bandwidth than Telnet; both protocols utilize TCP, and SSH's encryption actually adds overhead, potentially increasing bandwidth usage.
★ When this WOULD be the correct answer
In a different context, a question might ask which protocol is more efficient for low-bandwidth environments without considering security. If the question specifically states that SSH's bandwidth efficiency is being compared in a scenario where TCP header removal is a factor, then this option could be correct.
Why candidates choose this
Candidates may find this option appealing due to a misunderstanding of how SSH operates, mistakenly believing that its design inherently optimizes bandwidth usage compared to Telnet, especially if they focus on performance over security.
✗SSH works only on console ports, which are more secureWrong answer — click to see why▾
Why this is wrong here
This option is incorrect because SSH can operate over various types of connections, including console ports, but it is not limited to them. Telnet can also be used over console ports, making this statement misleading.
★ When this WOULD be the correct answer
In a question that specifically asks about the security of console port access methods, stating that SSH works only on console ports could be correct if the context implies that SSH is the preferred method for console access due to its encryption capabilities, while Telnet is not secure.
Why candidates choose this
Candidates may be drawn to this option because they associate SSH with enhanced security and may mistakenly believe that its use is restricted to more secure environments like console ports, leading to confusion about its actual operational scope.
✗SSH does not require user authenticationWrong answer — click to see why▾
Why this is wrong here
This option is incorrect because SSH does require user authentication, typically through passwords or public key authentication, which is essential for secure access. In contrast, Telnet does not enforce strong authentication mechanisms.
★ When this WOULD be the correct answer
In a different exam scenario, if the question asked about protocols that do not require user authentication for remote access, then this option could be correct. For example, a question about unsecured protocols might highlight that Telnet allows access without authentication, making it a valid point in that context.
Why candidates choose this
Candidates may find this option tempting due to a misunderstanding of SSH's authentication mechanisms, confusing it with other protocols that might not require authentication, leading to the assumption that SSH operates similarly.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Device File Management with SFTP and SCP
Key term
CAN
A CAN (Controller Area Network) is a robust vehicle bus standard designed to allow microcontrollers and devices to communicate with each other without a host computer.
Key term
Encryption
Encryption is the process of converting readable data into a secret code to prevent unauthorized access.
About these practice questions
This 200-301 question is part of Courseiva's 1,389-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.