CCNA Network Services and Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  It cannot cross routed networks

  Why it's wrong here

  Telnet operates at the application layer and, like other TCP-based protocols, relies on IP for routing; as long as the device has an IP address and a route back to the client, Telnet sessions can traverse multiple Layer 3 hops. It does not require a direct Layer 2 connection to the target. Therefore, the inability to cross routed networks is not a valid reason to avoid Telnet.

  When this WOULD be correct

  If an exam question asked about a specific network configuration where Telnet was being used in a scenario involving a single local subnet without routing, then this option could be correct. For example, a question might state that Telnet is being used exclusively for device management within a flat network topology.

• ✓

  It sends credentials and commands in clear text

  Why this is correct

  Telnet transmits all data, including login credentials and command traffic, without encryption over TCP port 23. An attacker with packet capture or on-path visibility can read usernames, passwords, and configuration commands in plaintext, enabling credential theft and device compromise. This lack of confidentiality is the primary security weakness that discourages its use on production or untrusted networks.

• ✗

  It supports only local usernames

  Why it's wrong here

  While Telnet access can be restricted to locally defined accounts, it can also integrate with AAA servers such as TACACS+ or RADIUS for centralized authentication and authorization. The actual concern is not where usernames are stored, but that both authentication and command exchange occur in cleartext, exposing credentials regardless of the user database source. Thus, supporting only local usernames is not the core security issue.

  When this WOULD be correct

  In a question that specifically asks about a network device that only allows local authentication methods and does not support external authentication protocols, option C would be correct. For example, if the question stated that a specific router model only permits local username authentication, then this option would apply.

• ✗

  It works only from the console port

  Why it's wrong here

  Telnet is a remote access protocol that connects over the network to virtual terminal (VTY) lines on the device, not the physical console port; the console port uses out-of-band serial access and is not used for Telnet sessions. You can initiate a Telnet session from any host with IP reachability to the device. Consequently, claiming that Telnet works only from the console port is factually incorrect.

  When this WOULD be correct

  If the exam question specifically asked about a protocol that is limited to console access only, such as a proprietary management interface, then option D would be correct. For example, a question might ask about a device management method that does not support remote access.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”