FirstTry

Objective 2.8

200-301

Describe network device management access (Telnet, SSH, HTTP, HTTPS, console, TACACS+/RADIUS, and cloud managed).

Objective 2.8 sits in Network Access, which carries 20% of the CCNA exam. The questions below are original, written from the official objective title above, and each explanation cites the Cisco page it rests on.

Objective title verbatim from the official objectives. Cisco exam page ↗

A worked example

Shown solved, with the whole explanation open: this is what every question here carries.

2-8Network Access

A local account exists and the vty lines accept only encrypted sessions, yet remote logins are refused.

SW1# show ip sshSSH Disabled - version 2.0%Please create RSA keys to enable SSH. SW1# show running-config | include hostname|domain|username|transporthostname SW1username netadmin privilege 15 secret 9 $9$Nn1ZQ0f8mLpQ6. transport input ssh

What is still missing?

A transport output setting on the console lineTransport output governs sessions the switch itself opens outward, which is a different direction from the one failing here.
An enable secret and a login local statementThe privileged mode password gates what a user reaches after login. It has no part in bringing up the service.
An IP domain name and then an RSA key pairCorrect · your answerCorrect. The name has to be completed before the key pair can be generated.
A privilege level 15 password on the vty linesA line password would be relevant if the lines used line authentication, but a local account is already configured.

Correct.

Checked against cisco.com, August 2026

Concept

The encrypted management service will not start without a key pair, and a key pair cannot be generated until the switch has a fully qualified name to bind it to. That name comes from two separate settings, so the service depends on plain configuration that has nothing obviously to do with encryption.

Why C

The status line reports the service down and asks for keys, and the running configuration shows a host name with no domain to pair it with. Adding the domain and then generating the key pair completes the name, brings the service up, and the existing account and line setting then do their work.

Source

Step 4 ip domain name domain_name Example: Device(config)# ip domain name your_domain Configures a host domain for your device. Step 5 crypto key generate rsa Example: Device(config)# crypto key generate rsa Enables the SSH server for local and remote authentication on the device and generates an RSA key pair. Generating an RSA key pair for the device automatically enables SSH.

Cisco: Configuring Secure Shell (Catalyst 9300, IOS XE 17.3.x), checked August 2026
#ssh#device-management#rsa-keys

Now you: objective 2.8 questions

No account needed. The explanation opens when you answer.

Sample question 1 of 3

2-8Network Access

A technician types the string set by the enable password command at the console and is refused privileged EXEC mode.

SW1# show running-config | include enableenable password Cisco123enable secret 9 $9$avUxUt7pP1nSk.$mA8W3fVsQ2

Why is that string rejected?

Sample question 2 of 3

2-8Network AccessChoose 2

A switch authenticates administrators against a RADIUS server, and an analyst captures the exchange between them on the wire. Which two protections apply to that traffic? (Choose two.)

Sample question 3 of 3

2-8Network Access

Administrators must manage a wireless controller remotely over an untrusted network. Which properties make SSH the right choice?

That’s 3 of the full CCNA bank.

Keep going free: 10 questions per certification in bank practice, with no account.

Continue practicing

Read the sources

These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.

More objectives in Network Access