easyMultiple Choice
200-201 Practice Question: A security policy requires that all remote access…
A security policy requires that all remote access be through a VPN using strong authentication. A user calls the help desk saying they cannot connect to the VPN. The analyst checks and sees that the user's token is not synchronized. What should the analyst do?
⚠ Common exam trap
The trap is choosing an action that bypasses or weakens MFA (static password, no token) instead of the correct remediation of resetting and re-syncing the token.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Reset the user's token and have them re-sync.
A token that is out of sync produces invalid one-time passcodes, so the correct remediation is to reset the token and have the user re-synchronize it with the authentication server. This restores the user's ability to generate valid OTPs without weakening the strong-authentication policy. Resetting and re-syncing is the standard help-desk procedure for hardware or software token drift.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disable VPN access for the user.
Why it's wrong here
Disabling VPN access removes the user's remote connectivity entirely instead of restoring it, so it cannot resolve a token that is merely out of sync. Resynchronising the token is the corrective action. Disabling access is reserved for revoking a compromised or terminated account's privileges.
- ✗
Provide a temporary static password.
Why it's wrong here
Issuing a static password substitutes a weaker single factor for the required token-based authentication, breaching policy and creating a standing credential risk. Temporary static credentials suit environments without MFA mandates, not one requiring strong authentication for all remote access.
- ✓
Reset the user's token and have them re-sync.
Why this is correct
Resetting the token and re-syncing restores the time-based one-time password seed shared between the user's authenticator and Microsoft Entra ID, satisfying the policy's strong authentication requirement. An unsynchronised token generates invalid codes, so the VPN's RADIUS authentication rejects the connection until the seed realigns.
- ✗
Escalate to the security team.
Why it's wrong here
Escalation wastes time because an unsynchronised token is a routine help-desk fix, not a security incident. Security teams handle compromised credentials or policy breaches; resynchronising the token restores the strong authentication the VPN policy requires.
- ✗
Have the user connect without a token.
Why it's wrong here
Connecting without a token bypasses the strong authentication the VPN policy mandates, so the unsynchronised token remains unresolved and access stays non-compliant. It is tempting as a quick workaround, since tokenless access suits low-risk internal resources, but here the analyst must resynchronise the token to restore compliant VPN authentication.
Go deeper
Related to this question
About these practice questions
One of 968 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.