hardMultiple Choice
200-201 Practice Question: A vendor security policy requires that all…
A vendor security policy requires that all third-party remote access be limited to specific IP addresses and use multi-factor authentication. During an audit, it is discovered that a vendor's entire office subnet is allowed instead of individual IPs. The vendor argues that the broader range is necessary for redundancy. What is the best way to handle this from a policy perspective?
⚠ Common exam trap
The trap here is choosing the 'pragmatic' answer that accepts the subnet with MFA, confusing authentication strength with network-level least privilege; the exam expects you to preserve the policy's intent while finding a compliant solution.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Work with the vendor to define a list of specific IPs that cover their redundancy needs while adhering to policy
The correct approach is to work with the vendor to define specific IPs that satisfy their redundancy needs while still complying with the policy's intent. This preserves the security control (limiting access to known, specific addresses) without simply weakening the policy or ignoring the violation. It balances operational flexibility with the vendor security requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Amend the policy to allow entire subnets for vendors with multi-factor authentication
Why it's wrong here
Amending the policy to permit whole subnets weakens the specific-IP control the audit exists to enforce, widening the attack surface beyond named hosts. Subnet-level allowances suit internal segmentation zones, not third-party access where individual address accountability is mandated.
- ✗
Accept the subnet as long as multi-factor authentication is used
Why it's wrong here
Accepting the subnet on multi-factor authentication alone leaves the address-scoping requirement unmet, so any host on that subnet can authenticate. MFA-only acceptance suits user-centric access where identity is the sole control, not vendor access requiring both IP restriction and MFA.
- ✗
Require the vendor to comply with the existing policy exactly as written
Why it's wrong here
Rigid enforcement ignores the vendor's legitimate redundancy requirement, likely pushing them toward shadow access paths that bypass controls entirely. Exact compliance suits static, single-homed vendors; dynamic or multi-site vendors need a documented exception process with compensating controls.
- ✓
Work with the vendor to define a list of specific IPs that cover their redundancy needs while adhering to policy
Why this is correct
Working with the vendor to enumerate specific IPs satisfies the policy's requirement for individual address restriction while preserving redundancy through multiple discrete entries rather than a whole subnet. This reconciles the vendor's operational need with the audit finding, since Microsoft Entra ID conditional access can then enforce named-location scoping and MFA per address.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 968 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.