Cisco CCNA 200-301 Exam — Questions and Answers

Question 1: Which statement correctly describes encapsulation in the OSI model?

Each layer removes header information added by the layer above it
Data flows upward through the layers on the sending host
The Application layer adds headers last before transmission
Each layer adds its own header (and sometimes trailer) to data received from the layer above (Correct answer)

Correct answer: Each layer adds its own header (and sometimes trailer) to data received from the layer above

During encapsulation, each OSI layer on the sending host adds its own header (and trailer at Layer 2) to the data passed down from the layer above.

Question 2: Which type of NAT maps one private IP address to one public IP address?

Static NAT (Correct answer)
Dynamic NAT
NAT overload
PAT

Correct answer: Static NAT

Static NAT creates a permanent one-to-one mapping between a private IP address and a public IP address.

Question 3: What is the maximum number of subnets created when borrowing 4 bits from the host portion of a classful Class C network?

14
30
8
16 (Correct answer)

Correct answer: 16

Borrowing 4 bits provides 2^4 = 16 subnets (all 16 are usable with classless/CIDR addressing).

Question 4: In a REST API response, which HTTP status code indicates that a new resource was successfully created?

202 Accepted
200 OK
201 Created (Correct answer)
204 No Content

Correct answer: 201 Created

HTTP 201 Created is the standard response when a POST request successfully creates a new resource.

Question 5: Which command enables 802.1Q trunking on a Catalyst switch interface and statically sets the encapsulation?

switchport mode trunk dot1q
trunk encapsulation 802.1q
encapsulation dot1q trunk
switchport trunk encapsulation dot1q (Correct answer)

Correct answer: switchport trunk encapsulation dot1q

On switches that support both ISL and 802.1Q, `switchport trunk encapsulation dot1q` must be issued before enabling trunk mode.

Question 6: In a Cisco WLC high availability (HA) pair, what is the role of the 'secondary' WLC when the primary is active?

The secondary actively serves half the APs to distribute load
The secondary operates independently as a separate cluster member
The secondary handles only guest WLAN traffic
The secondary maintains a warm standby, ready to take over all APs if the primary fails (Correct answer)

Correct answer: The secondary maintains a warm standby, ready to take over all APs if the primary fails

In Cisco WLC HA, the secondary controller stays in a warm standby state, synchronizing state with the primary and ready to assume all AP connections upon primary failure.

Question 7: Which version control system is most commonly used to store Ansible playbooks and network automation scripts?

Mercurial
SVN (Subversion)
Git (Correct answer)
CVS

Correct answer: Git

Git is the dominant version control system used for storing automation code, playbooks, and configurations.

Question 8: Which STP feature automatically sets a port to the Forwarding state when connected to an end device, bypassing the Listening and Learning states?

BPDU Guard
Loop Guard
PortFast (Correct answer)
Root Guard

Correct answer: PortFast

PortFast allows a port to transition directly to Forwarding, skipping Listening and Learning, and is intended for ports connected to end hosts.

Question 9: Which statement about RIPv1 versus RIPv2 is accurate?

RIPv2 sends updates as multicast to 224.0.0.9 and includes subnet mask information, unlike RIPv1 (Correct answer)
RIPv1 supports VLSM and CIDR while RIPv2 does not
RIPv2 uses Dijkstra's algorithm while RIPv1 uses Bellman-Ford
Both versions use the same maximum hop count of 15 and identical update intervals

Correct answer: RIPv2 sends updates as multicast to 224.0.0.9 and includes subnet mask information, unlike RIPv1

RIPv2 improves on RIPv1 by using multicast (224.0.0.9) for updates and including subnet mask information, enabling support for VLSM and CIDR.

Question 10: Which NTP stratum number indicates that a device is directly connected to a reference clock (e.g., GPS)?

Stratum 2
Stratum 15
Stratum 1 (Correct answer)
Stratum 0

Correct answer: Stratum 1

Stratum 1 NTP servers are directly connected to a stratum 0 reference clock source such as GPS or atomic clocks.

Question 11: Which two PAgP modes will successfully form an EtherChannel when configured on opposite ends of a link?

Auto – Passive
Desirable – Auto (Correct answer)
Auto – Auto
On – Desirable

Correct answer: Desirable – Auto

PAgP requires at least one side in 'desirable' mode; 'desirable–auto' works because desirable actively initiates and auto responds, while 'auto–auto' never initiates and 'on' uses no protocol.

Question 12: Which field in an IP packet header is decremented by one at each router hop?

Checksum
TTL (Correct answer)
Protocol
TOS

Correct answer: TTL

The Time to Live (TTL) field is decremented by 1 at each router hop; when it reaches 0, the packet is discarded.

Question 13: Which command displays the currently configured EtherChannel load-balancing method on a Cisco switch?

show etherchannel load-balance (Correct answer)
show port-channel load-balance
show interfaces port-channel 1
show lacp counters

Correct answer: show etherchannel load-balance

'show etherchannel load-balance' displays the global load-balancing policy currently applied to all EtherChannel bundles on the switch.

Question 14: What is a characteristic of a full-mesh WAN topology?

Sites connect in a ring pattern
Each site connects only to a central hub
Every site has a direct connection to every other site (Correct answer)
Only two sites are directly connected

Correct answer: Every site has a direct connection to every other site

In a full-mesh topology, every site has a direct point-to-point connection to every other site, providing maximum redundancy.

Question 15: What STP port cost is assigned to a 100 Mbps Fast Ethernet link using the original IEEE 802.1D-1998 cost table?

4
19 (Correct answer)
100
10

Correct answer: 19

The original 802.1D-1998 standard assigns a cost of 19 to 100 Mbps links; this is the default cost Cisco switches use.

Question 16: Which data serialization format does NETCONF use natively?

JSON
YAML
XML (Correct answer)
CSV

Correct answer: XML

NETCONF uses XML as its native data encoding format for both configuration data and protocol messages.

Question 17: Which HTTP method is used to partially update an existing resource in a REST API?

PUT
PATCH (Correct answer)
POST
DELETE

Correct answer: PATCH

PATCH is used for partial updates to an existing resource, while PUT replaces the entire resource.

Question 18: What is a reflexive ACL primarily used for?

Filtering traffic based on time of day
Blocking all ICMP traffic
Allowing return traffic for sessions initiated from inside the network (Correct answer)
Locking out users after failed login attempts

Correct answer: Allowing return traffic for sessions initiated from inside the network

Reflexive ACLs dynamically permit return traffic for outbound sessions, providing stateful-like filtering.

Question 19: Which command configures BPDU Guard globally on all PortFast-enabled ports on a Cisco switch?

spanning-tree guard bpdu
spanning-tree portfast bpduguard default (Correct answer)
interface range fa0/1-24 spanning-tree bpduguard enable
spanning-tree bpduguard enable

Correct answer: spanning-tree portfast bpduguard default

The global command 'spanning-tree portfast bpduguard default' enables BPDU Guard on all ports that have PortFast configured.

Question 20: Which field in the Ethernet frame is used at the OSI Data Link layer to detect transmission errors?

Preamble
Frame Check Sequence (FCS) (Correct answer)
Type/EtherType
Start Frame Delimiter (SFD)

Correct answer: Frame Check Sequence (FCS)

The Frame Check Sequence (FCS) uses a CRC algorithm to detect bit errors in the Ethernet frame at the Data Link layer.

Question 21: Which command disables CDP on a specific Cisco router interface to prevent neighbor information disclosure?

ip cdp disable
no cdp run interface
cdp disable interface
no cdp enable (Correct answer)

Correct answer: no cdp enable

The interface-level command 'no cdp enable' disables CDP on that specific interface without affecting other interfaces.

Question 22: A static route is configured with an exit interface instead of a next-hop IP. What is a potential issue with this configuration on an Ethernet interface?

OSPF will not redistribute the route
The router will perform ARP for every destination matching that route, potentially flooding the ARP table (Correct answer)
IOS will reject the configuration entirely
The route will only work for directly connected networks

Correct answer: The router will perform ARP for every destination matching that route, potentially flooding the ARP table

On multi-access Ethernet interfaces, using an exit interface without a next-hop causes the router to ARP for every destination, which can cause excessive ARP entries.

Question 23: Which PAgP mode causes a port to actively send PAgP packets to initiate an EtherChannel?

Passive
On
Auto
Desirable (Correct answer)

Correct answer: Desirable

PAgP 'desirable' mode actively initiates EtherChannel negotiation by sending PAgP packets, similar to LACP 'active' mode.

Question 24: In a REST API, what does the endpoint '/api/v1/devices/{id}' with a DELETE method accomplish?

Retrieves a list of all devices
Updates all device attributes
Removes the device with the specified ID (Correct answer)
Creates a new device entry

Correct answer: Removes the device with the specified ID

A DELETE request to a resource URI with a specific ID removes that particular resource from the system.

Question 25: Which statement correctly describes a Mesh AP in a Cisco WLAN deployment?

It uses a wireless backhaul link to reach the wired network through a Root AP (Correct answer)
It connects to the WLC only via a wired Ethernet uplink
It operates exclusively in monitor mode scanning for rogue devices
It requires a separate CAPWAP tunnel for each client association

Correct answer: It uses a wireless backhaul link to reach the wired network through a Root AP

Mesh APs use a wireless backhaul (often on a separate radio) to connect back to a Root AP that has a wired uplink, extending coverage without cabling.

Question 26: What is the primary advantage of using NETCONF over SNMP for network management?

NETCONF requires no authentication
NETCONF uses UDP for faster delivery
NETCONF supports transactional configuration with rollback (Correct answer)
NETCONF is only used for monitoring, not configuration

Correct answer: NETCONF supports transactional configuration with rollback

NETCONF provides transactional configuration operations including commit and rollback capabilities, which SNMP lacks.

Question 27: To prevent double-tagging VLAN hopping attacks, which best practice should be applied?

Disable 802.1Q on all ports
Change the native VLAN to an unused VLAN ID (Correct answer)
Set all ports to dynamic auto
Enable VTP transparent mode

Correct answer: Change the native VLAN to an unused VLAN ID

Using an unused, non-default native VLAN prevents double-tagging attacks because the attacker cannot predict or match the native VLAN.

Question 28: What does a DHCP NACK message indicate to a client?

The client must renew its lease immediately
The server has accepted the client's request
The server is out of available addresses
The requested IP address is unavailable or invalid (Correct answer)

Correct answer: The requested IP address is unavailable or invalid

A DHCP NACK (Negative Acknowledgment) tells the client its requested IP address cannot be provided and it must restart the discovery process.

Question 29: Which NetFlow command on a Cisco router exports flow data to a collector at 10.0.0.50 on UDP port 9996?

netflow export 10.0.0.50 9996
ip flow destination 10.0.0.50 port 9996
ip flow-export destination 10.0.0.50 9996 (Correct answer)
ip netflow collector 10.0.0.50 9996

Correct answer: ip flow-export destination 10.0.0.50 9996

The command 'ip flow-export destination <ip> <port>' configures the router to send NetFlow records to the specified collector.

Question 30: What is the purpose of the `switchport trunk native vlan 99` command?

Sets VLAN 99 as the untagged VLAN on the trunk (Correct answer)
Allows only VLAN 99 on the trunk
Makes VLAN 99 the management VLAN
Removes all other VLANs from the trunk

Correct answer: Sets VLAN 99 as the untagged VLAN on the trunk

This command changes the native VLAN on the trunk to VLAN 99, so untagged frames are associated with VLAN 99.

Question 31: Which command configures OSPF to advertise a default route to all OSPF neighbors, even if no default route exists in the local routing table?

redistribute static subnets
default-information originate
default-information originate always (Correct answer)
ip route 0.0.0.0 0.0.0.0 null0

Correct answer: default-information originate always

The 'default-information originate always' command forces an OSPF router to advertise a Type 5 external default route regardless of whether one exists locally.

Question 32: A router receives a packet destined for a remote network. At which OSI layer does it make the forwarding decision?

Layer 3 (Correct answer)
Layer 2
Layer 1
Layer 4

Correct answer: Layer 3

Routers operate at Layer 3 (Network) and use the destination IP address in the packet header to make forwarding decisions.

Question 33: What is the multicast address used by OSPFv2 to send Hello packets to all OSPF routers?

224.0.0.9
255.255.255.255
224.0.0.6
224.0.0.5 (Correct answer)

Correct answer: 224.0.0.5

OSPFv2 uses 224.0.0.5 (AllSPFRouters) to send Hello packets and LSAs to all OSPF-enabled routers.

Question 34: What is the primary role of a WLAN Distribution System (DS)?

To interconnect multiple BSSs to form an ESS via a wired backbone (Correct answer)
To encrypt traffic between APs and clients
To manage IP address assignment for wireless clients
To provide wireless connectivity between client devices

Correct answer: To interconnect multiple BSSs to form an ESS via a wired backbone

The Distribution System interconnects multiple access points (BSSs) using a wired backbone, forming an Extended Service Set (ESS) for seamless roaming.

Question 35: A VLAN ACL (VACL) differs from a routed ACL because it can filter traffic that is:

Only routed between VLANs
Only destined for the router CPU
Only inbound on Layer 3 interfaces
Both routed and bridged within the same VLAN (Correct answer)

Correct answer: Both routed and bridged within the same VLAN

VACLs apply to all traffic within a VLAN, including Layer 2 bridged traffic that never passes through a routed interface.

Question 36: How many bits make up an IPv6 address?

64
256
32
128 (Correct answer)

Correct answer: 128

IPv6 addresses are 128 bits long, expressed as eight groups of four hexadecimal digits.

Question 37: A network administrator wants to restrict Telnet and SSH access to a router's virtual terminal (VTY) lines, allowing access only from the management workstation with the IP address 10.0.0.99. Which set of commands correctly accomplishes this?

router(config)# access-list 1 permit any router(config)# line vty 0 15 router(config-line)# access-class 10.0.0.99 in
router(config)# access-list 1 permit host 10.0.0.99 router(config)# interface vty 0 15 router(config-if)# ip access-group 1 in
router(config)# access-list 101 permit ip host 10.0.0.99 any router(config)# line vty 0 15 router(config-line)# ip access-group 101 in
router(config)# access-list 1 permit host 10.0.0.99 router(config)# line vty 0 15 router(config-line)# access-class 1 in (Correct answer)

Correct answer: router(config)# access-list 1 permit host 10.0.0.99 router(config)# line vty 0 15 router(config-line)# access-class 1 in

To apply an access control list to VTY lines to filter management access (like Telnet or SSH), the `access-class` command must be used under `line vty` configuration mode. The `ip access-group` command is used for applying ACLs to physical or logical Layer 3 interfaces, not VTY lines.

Question 38: Which command configures a Cisco router as a DHCP server and excludes the first 10 addresses of the 192.168.1.0/24 pool?

ip dhcp pool exclude 192.168.1.1 192.168.1.10
ip dhcp excluded-address 192.168.1.1 192.168.1.10 (Correct answer)
ip dhcp no-assign 192.168.1.1 192.168.1.10
no ip dhcp address 192.168.1.1 192.168.1.10

Correct answer: ip dhcp excluded-address 192.168.1.1 192.168.1.10

The 'ip dhcp excluded-address' command prevents specified IP addresses from being assigned by the DHCP server.

Question 39: What is the function of the LACP system priority in EtherChannel negotiation?

It determines which switch becomes the root bridge in STP
It determines which switch controls which ports become active when more than 8 links are configured (Correct answer)
It controls the load-balancing algorithm used across the bundle
It sets the administrative distance for routes learned over the EtherChannel

Correct answer: It determines which switch controls which ports become active when more than 8 links are configured

The LACP system priority determines which switch is the 'master' when more than 8 links are bundled; the master chooses which 8 links are active and which are hot-standby.

Question 40: What is the size of a MAC address?

128 bits
64 bits
48 bits (Correct answer)
32 bits

Correct answer: 48 bits

MAC addresses are 48 bits (6 bytes) long, typically expressed as 12 hexadecimal digits.

Question 41: Which IP SLA probe type can measure round-trip time (RTT) to a remote Cisco device using ICMP echo?

tcp-connect
icmp-echo (Correct answer)
http
udp-jitter

Correct answer: icmp-echo

IP SLA icmp-echo probes send ICMP echo requests to a target IP and measure round-trip time for availability monitoring.

Question 42: A network administrator is concerned about network latency and wants to ensure frames with errors are not propagated through the network. Which switching method should be used?

Fast-Forward
Store-and-Forward (Correct answer)
Cut-Through
Fragment-Free

Correct answer: Store-and-Forward

The store-and-forward switching method receives the entire frame before making a forwarding decision. This allows the switch to check the Frame Check Sequence (FCS) at the end of the frame for errors. If an error is detected, the frame is dropped. Cut-through methods, like fast-forward and fragment-free, begin forwarding before the entire frame is received and therefore cannot check for all errors.

Question 43: Which IOS command defines a NAT pool named MYPOOL with addresses 198.51.100.1 through 198.51.100.10 and a /28 mask?

ip nat pool MYPOOL 198.51.100.1-198.51.100.10 /28
nat pool MYPOOL 198.51.100.1 198.51.100.10 prefix-length 28
ip nat pool MYPOOL 198.51.100.1 198.51.100.10 netmask 255.255.255.240 (Correct answer)
ip nat inside pool MYPOOL 198.51.100.1 198.51.100.10 mask 255.255.255.240

Correct answer: ip nat pool MYPOOL 198.51.100.1 198.51.100.10 netmask 255.255.255.240

The correct syntax is 'ip nat pool [name] [start-ip] [end-ip] netmask [mask]' — prefix-length is an alternative but 'netmask' is the traditional keyword.

Question 44: Which of the following correctly describes a VLAN hopping attack using double tagging?

An attacker sends a frame with two 802.1Q tags to reach a different VLAN (Correct answer)
An attacker spoofs VTP advertisements to add VLANs
An attacker floods the CAM table to force traffic to all VLANs
An attacker uses DTP to negotiate a trunk and access all VLANs

Correct answer: An attacker sends a frame with two 802.1Q tags to reach a different VLAN

Double tagging embeds an inner VLAN tag so the frame is forwarded to a target VLAN after the outer tag is stripped at the first switch.

Question 45: What is the minimum RSA key size recommended when generating SSH keys on a Cisco IOS device for SSHv2?

768 bits
2048 bits (Correct answer)
512 bits
1024 bits

Correct answer: 2048 bits

SSHv2 requires a minimum RSA key modulus of 768 bits, but Cisco and industry best practices recommend at least 2048 bits for current deployments.

Question 46: Which TCP/IP model layer corresponds to both the OSI Session and Presentation layers?

Network Access
Transport
Application (Correct answer)
Internet

Correct answer: Application

The TCP/IP Application layer combines the functions of OSI layers 5 (Session), 6 (Presentation), and 7 (Application).

Question 47: Which command on a Cisco switch sends Syslog messages to a remote server at 10.1.1.100?

logging host 10.1.1.100 (Correct answer)
logging 10.1.1.100 remote
ip syslog 10.1.1.100
syslog server 10.1.1.100

Correct answer: logging host 10.1.1.100

The global configuration command 'logging host <ip>' directs Syslog output to the specified remote Syslog server.

Question 48: A network interface card has the MAC address A8:BB:C1:12:34:56. If this interface autoconfigures its IPv6 interface ID using the EUI-64 process, what will the resulting interface ID be?

AABB:C1FF:FE12:3456 (Correct answer)
AABB:C112:34FF:FE56
A8BB:C1FE:FF12:3456
A8BB:C1FF:FE12:3456

Correct answer: AABB:C1FF:FE12:3456

The EUI-64 process converts a 48-bit MAC address into a 64-bit interface ID. First, 'FFFE' is inserted in the middle of the MAC address (A8BB:C1FF:FE12:3456). Second, the seventh bit (the Universal/Local or U/L bit) of the first byte is flipped. The first byte A8 is '10101000' in binary. Flipping the seventh bit results in '10101010', which is 'AA' in hexadecimal. This yields the final interface ID of AABB:C1FF:FE12:3456.

Question 49: An administrator needs to insert a new rule into an existing, numbered standard ACL (access-list 10). The new rule must permit a specific host (192.168.5.5) and should be evaluated before any other existing rules in the ACL. Which of the following methods should be used to achieve this?

Use a sequence number to insert the new permit statement at the beginning of the ACL. (Correct answer)
Use a text editor to copy the ACL, insert the new line at the top, delete the old ACL, and paste the new version.
Re-enter the entire ACL from the CLI, typing the new permit statement first.
Add the new permit statement to the end of the ACL and use the `ip access-list resequence` command.

Correct answer: Use a sequence number to insert the new permit statement at the beginning of the ACL.

Modern Cisco IOS allows for editing both numbered and named ACLs using sequence numbers. To insert a rule at the beginning, an administrator can enter the specific ACL configuration mode (`ip access-list standard 10`) and then specify a low sequence number (e.g., `5 permit host 192.168.5.5`) to place it before the default sequence numbers, which start at 10 and increment by 10.

Question 50: Which protocol does a DHCP client use to initially discover a DHCP server on the network?

DHCP Offer (unicast)
DHCP Inform (multicast)
DHCP Discover (broadcast) (Correct answer)
DHCP Request (unicast)

Correct answer: DHCP Discover (broadcast)

A DHCP client sends a DHCP Discover message as a broadcast to find available DHCP servers on the local network.

Question 51: Which DNS record type maps a fully qualified domain name (FQDN) to an IPv4 address?

A record (Correct answer)
AAAA record
CNAME record
PTR record

Correct answer: A record

An A (Address) record maps a hostname to a 32-bit IPv4 address in the DNS namespace.

Question 52: What happens when a packet matches a permit statement in an ACL?

The packet is dropped and logged
The remaining ACL entries are still checked
The packet is sent to the CPU for inspection
The packet is forwarded and no further ACL entries are checked (Correct answer)

Correct answer: The packet is forwarded and no further ACL entries are checked

Once a packet matches any ACL statement (permit or deny), processing stops and the action is taken immediately.

Question 53: What are the ones that are used with NAT?

Inside global
All of the above (Correct answer)
Inside local
Outside local
Outside global

Correct answer: All of the above

NAT (Network Address Translation) uses several terms to describe IP addresses from different perspectives during translation. 'Inside local' is the private IP address of a host on the internal network. 'Inside global' is the public IP address used to represent the inside local address to the outside world. 'Outside local' is the private IP address of an outside host as seen by the inside network, and 'Outside global' is the public IP address of an outside host.

Question 54: What is the function of the 802.11 Probe Request frame?

Sent by a client to confirm successful association with an AP
Sent by a client to actively discover available wireless networks (Correct answer)
Sent by an AP to announce its presence on a channel
Sent by a WLC to verify AP connectivity

Correct answer: Sent by a client to actively discover available wireless networks

A Probe Request is sent by wireless clients to actively scan for available SSIDs, either broadcasting to find all networks or targeting a specific SSID.

Question 55: A network administrator needs to configure a static route on a router with a multi-access exit interface, such as Ethernet. To avoid potential recursive lookups and ambiguity, the administrator wants to specify both the exit interface and the next-hop IP address. What type of static route is this?

Recursive static route
Floating static route
Fully specified static route (Correct answer)
Directly attached static route

Correct answer: Fully specified static route

A fully specified static route is one where both the exit interface and the next-hop IP address are defined in the `ip route` command. This method is recommended for multi-access interfaces like Ethernet because it eliminates the need for a recursive lookup to find the exit interface and avoids potential issues with ARP resolution that can occur with directly attached static routes on these media types.

Question 56: In the context of network automation, what is a 'source of truth'?

A SNMP trap collector
The configuration currently running on a device
An authoritative system that holds the intended state of the network (Correct answer)
The oldest backup configuration file

Correct answer: An authoritative system that holds the intended state of the network

A source of truth (e.g., NetBox, CMDB) is the authoritative repository for the desired/intended network state used to drive automation.

Question 57: Two OSPF routers are connected via a FastEthernet link (100 Mbps) but are failing to form a full adjacency, remaining in the 2-WAY state. Both routers are on the same subnet (10.1.1.0/30) and in the same area (Area 0). Which of the following is a valid reason for this issue on a broadcast network type like Ethernet?

The OSPF process IDs do not match.
The OSPF priority on both routers is set to 0. (Correct answer)
The Hello and Dead timers are mismatched.
One router is a DR, and the other is a DROTHER.

Correct answer: The OSPF priority on both routers is set to 0.

On broadcast multi-access networks, OSPF elects a Designated Router (DR) and a Backup Designated Router (BDR). Routers that are not a DR or BDR (DROTHERs) will only form a FULL adjacency with the DR and BDR. DROTHER routers will remain in the 2-WAY state with other DROTHERs. If both routers have their OSPF interface priority set to 0, neither can be elected as DR or BDR, preventing them from moving past the 2-WAY state.

Question 58: A router has two routes to 192.168.10.0/24: one via OSPF with metric 20 and one via EIGRP with metric 100. Which route is installed in the routing table by default?

The OSPF route because OSPF has a lower administrative distance of 110
Neither route; the router requests manual configuration
Both routes are installed and traffic is load-balanced
The EIGRP route because EIGRP has a lower administrative distance of 90 (Correct answer)

Correct answer: The EIGRP route because EIGRP has a lower administrative distance of 90

EIGRP has an administrative distance of 90, which is lower than OSPF's 110, so the EIGRP route is preferred regardless of metric.

Question 59: On a Cisco switch, where is the VLAN database for normal-range VLANs stored?

nvram.dat in NVRAM
vlan.dat in flash memory (Correct answer)
startup-config in NVRAM
running-config in RAM

Correct answer: vlan.dat in flash memory

Normal-range VLAN configurations are stored in the vlan.dat file in flash memory, separate from the running or startup config.

Question 60: A company needs to deploy a wireless access point in a small, remote branch office with an unreliable WAN link to the central headquarters where the WLC is located. The goal is to allow wireless clients to continue accessing local resources even if the WAN link fails. Which AP mode should the administrator configure?

Local Mode
FlexConnect Mode (Correct answer)
Monitor Mode
Sniffer Mode

Correct answer: FlexConnect Mode

FlexConnect mode is specifically designed for remote/branch office deployments. In this mode, if the CAPWAP tunnel to the WLC is down, the AP can switch traffic locally between the wireless clients and the wired LAN, allowing access to local resources. [4, 20, 23] Local mode, the default, requires the CAPWAP tunnel to be active as it tunnels all traffic back to the WLC. [20, 25] Monitor and Sniffer modes are used for network monitoring and troubleshooting, not for serving clients. [4]

Question 61: On a Layer 3 switch, what is required for inter-VLAN routing using Switched Virtual Interfaces (SVIs)?

VLANs must be connected via a Layer 2 trunk to a router
A router-on-a-stick subinterface must be configured
Each VLAN must have a dedicated physical routed port
An SVI must be created for each VLAN and IP routing must be enabled (Correct answer)

Correct answer: An SVI must be created for each VLAN and IP routing must be enabled

Inter-VLAN routing via SVIs requires creating a VLAN interface (SVI) for each VLAN and enabling `ip routing` on the Layer 3 switch.

Question 62: What happens to EIGRP routes when the variance command is set to 2?

The EIGRP hello interval is doubled
Only routes with a metric exactly twice the successor's FD are added to the routing table
Routes are redistributed into OSPF with a seed metric of 2
Routes with a metric up to twice the successor's FD are eligible for unequal-cost load balancing (Correct answer)

Correct answer: Routes with a metric up to twice the successor's FD are eligible for unequal-cost load balancing

Setting variance to 2 allows EIGRP to install feasible successor routes whose FD is up to 2x the successor's FD for unequal-cost load balancing.

Question 63: Which of the wireless protocols is the most reliable?

None of them
WPA
WPA3 (Correct answer)
WEP
WPA2

Correct answer: WPA3

WPA3 is the latest and most secure wireless security protocol, offering significant improvements over its predecessors like WPA2, WPA, and WEP. It provides enhanced encryption, stronger authentication, and protection against brute-force attacks. These advancements make WPA3 the most reliable choice for securing modern wireless networks.

Question 64: What is the purpose of the SNMP 'trap' message type compared to an SNMP 'inform'?

Informs are only used in SNMPv1
Traps require acknowledgment; informs are unacknowledged
Traps are unacknowledged; informs require acknowledgment from the manager (Correct answer)
Both are identical in function

Correct answer: Traps are unacknowledged; informs require acknowledgment from the manager

SNMP traps are sent once with no acknowledgment, while informs are retransmitted until the manager acknowledges receipt.

Question 65: A network technician is reviewing IP configurations on a local area network. Which of the following IP addresses is a valid RFC 1918 private address?

169.254.50.100
172.32.10.5
192.169.1.1
10.1.1.25 (Correct answer)

Correct answer: 10.1.1.25

RFC 1918 defines specific address ranges for use in private, non-routable networks. These ranges are 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. The address 10.1.1.25 falls within the 10.0.0.0/8 range. 169.254.50.100 is an APIPA address, while the other options are public IP addresses.

Question 66: A network engineer is writing a Python script to interact with a device's RESTCONF API. The script needs to retrieve the current state of all interfaces. Which HTTP method should be used in the API request for this read-only operation?

GET (Correct answer)
PUT
DELETE
POST

Correct answer: GET

The HTTP GET method is used to retrieve data from a specified resource. [1, 7] In the context of REST APIs, this corresponds to the 'Read' operation in CRUD (Create, Read, Update, Delete). [3, 15] POST is used to create a new resource, PUT is used to update or replace an existing resource, and DELETE is used to remove a resource. [7, 15] Since the engineer only wants to retrieve information without making changes, GET is the appropriate method.

Question 67: An administrator writes the following Access Control Entry (ACE): `access-list 10 permit 192.168.16.0 0.0.15.255`. Which range of IP addresses will be permitted by this statement?

192.168.0.0 to 192.168.31.255
192.168.16.0 to 192.168.16.255
192.168.16.0 to 192.168.32.255
192.168.16.0 to 192.168.31.255 (Correct answer)

Correct answer: 192.168.16.0 to 192.168.31.255

The wildcard mask `0.0.15.255` is used to determine which bits of the address must match. A '0' in the wildcard mask means the corresponding bit must match, while a '1' means the bit does not matter. The mask `0.0.15.255` in binary is `00000000.00000000.00001111.11111111`. This means the first 20 bits must match the address `192.168.16.0`. The last 12 bits (4 in the third octet, 8 in the fourth) can be anything, which creates a range of addresses from 192.168.16.0 to 192.168.31.255.

Question 68: On a Cisco switch, which command displays the MAC address table?

show ip arp
show cam table
show mac address-table (Correct answer)
show interfaces

Correct answer: show mac address-table

The 'show mac address-table' command displays all learned, static, and secure MAC address entries on a Cisco switch.

Question 69: Which command prevents the 'enable' password from being stored in plaintext in the Cisco IOS configuration?

enable password <password>
enable secret <password> (Correct answer)
service password-encryption
enable md5 <password>

Correct answer: enable secret <password>

'enable secret' stores the enable password as an MD5 (or stronger) hash, unlike 'enable password' which stores it in plaintext or weak Type 7.

Question 70: Which command verifies the STP role and state of all ports on a Cisco switch for VLAN 10?

show interface trunk
show spanning-tree detail
show spanning-tree vlan 10 (Correct answer)
show vlan brief

Correct answer: show spanning-tree vlan 10

The 'show spanning-tree vlan 10' command displays the root bridge, bridge priority, port roles, port states, and costs for VLAN 10.

Question 71: A network administrator notices that EIGRP is not forming a neighbor relationship between two directly connected routers. Which mismatch would NOT prevent adjacency?

Autonomous system number mismatch
Authentication key mismatch
Hello timer mismatch (Correct answer)
K-value mismatch

Correct answer: Hello timer mismatch

Unlike OSPF, EIGRP does not require Hello and Hold timers to match between neighbors to form an adjacency.

Question 72: A 'debug ip nat' output shows: 'NAT*: s=10.0.0.1->203.0.113.5, d=8.8.8.8'. What does the '->' indicate?

The packet was dropped by NAT
The source address is being translated from private to public (Correct answer)
The destination address is being translated
A static NAT entry was added

Correct answer: The source address is being translated from private to public

The '->' arrow in NAT debug output shows the original address on the left being translated to the address on the right; here the source 10.0.0.1 becomes 203.0.113.5.

Question 73: Which command verifies the status of all EtherChannel bundles on a Cisco switch?

show lacp neighbor
show port-channel detail
show interfaces trunk
show etherchannel summary (Correct answer)

Correct answer: show etherchannel summary

'show etherchannel summary' displays the port-channel group number, protocol, ports, and bundle state (SU = Layer 2 in use) in a compact format.

Question 74: A host has the IP address 10.4.8.77/21. What is the network address of this subnet?

10.4.0.0 (Correct answer)
10.4.8.64
10.0.0.0
10.4.8.0

Correct answer: 10.4.0.0

A /21 mask covers the first 21 bits; the third octet's top 5 bits identify the subnet — 8 (00001000) ANDed with the mask gives 10.4.0.0.

Question 75: A network admin wants to change the OSPF reference bandwidth to accommodate Gigabit links. Which command accomplishes this?

ip ospf cost 1000 under each interface
auto-cost reference-bandwidth 1000 under router ospf (Correct answer)
ospf reference-bandwidth 1000 in global config
bandwidth 1000 under each interface

Correct answer: auto-cost reference-bandwidth 1000 under router ospf

The 'auto-cost reference-bandwidth 1000' command under 'router ospf' sets the reference to 1000 Mbps, giving GigE a cost of 1.

Question 76: A network consists of a single 24-port switch. All ports are operating in full-duplex mode. How many collision domains and broadcast domains exist in this network by default?

24 collision domains, 1 broadcast domain (Correct answer)
1 collision domain, 24 broadcast domains
24 collision domains, 24 broadcast domains
1 collision domain, 1 broadcast domain

Correct answer: 24 collision domains, 1 broadcast domain

Each port on a switch is a separate collision domain. Therefore, a 24-port switch has 24 collision domains. By default, all ports on a single switch are part of the same broadcast domain (typically VLAN 1). Broadcasts are forwarded out of all ports. Routers or VLANs are required to segment a network into multiple broadcast domains.

Question 77: What is the purpose of NAT overload (PAT) in a network?

To prioritize certain types of traffic
To encrypt traffic between networks
To allow multiple internal hosts to share a single public IP address using port numbers (Correct answer)
To load balance traffic across multiple servers

Correct answer: To allow multiple internal hosts to share a single public IP address using port numbers

PAT (Port Address Translation) maps multiple private IP addresses to a single public IP by tracking unique source port numbers.

Question 78: A network engineer configures a WLC to use local mode for APs in the headquarters building. What is a key characteristic of local mode?

Client traffic bypasses the WLC and goes directly to the router
Client traffic is switched locally at the AP without reaching the WLC
APs operate autonomously without any WLC dependency
All client data is tunneled through CAPWAP to the WLC for centralized switching (Correct answer)

Correct answer: All client data is tunneled through CAPWAP to the WLC for centralized switching

In local mode, all client data frames are encapsulated in CAPWAP tunnels and sent to the WLC, which then forwards them to the appropriate network.

Question 79: What does the 'I' stand for in the CRUD acronym used with REST APIs?

Integrate
Insert
CRUD does not contain an 'I' (Correct answer)
Index

Correct answer: CRUD does not contain an 'I'

CRUD stands for Create, Read, Update, Delete — there is no 'I' in the acronym.

Question 80: Which SNMP version introduced authentication and encryption for secure management communications?

SNMPv2c
SNMPv1
SNMPv2p
SNMPv3 (Correct answer)

Correct answer: SNMPv3

SNMPv3 added user-based security with MD5/SHA authentication and DES/AES encryption, replacing the community-string model.

Question 81: Which command correctly creates a named extended ACL called BLOCK-WEB?

access-list BLOCK-WEB extended permit
ip access-list extended BLOCK-WEB (Correct answer)
named access-list extended BLOCK-WEB
ip access-list BLOCK-WEB extended

Correct answer: ip access-list extended BLOCK-WEB

The correct syntax to create a named extended ACL is 'ip access-list extended <name>'.

Question 82: Which statement about numbered ACLs versus named ACLs is TRUE?

Both types allow individual entry deletion equally
Named ACLs cannot be used on router interfaces
Numbered ACLs allow deletion of individual entries; named ACLs do not
Named ACLs allow deletion of individual entries; numbered ACLs require deleting the entire ACL (Correct answer)

Correct answer: Named ACLs allow deletion of individual entries; numbered ACLs require deleting the entire ACL

Named ACLs support per-entry deletion using sequence numbers, while numbered ACLs require removing and re-entering the entire list.

Question 83: Which command hardens a Cisco IOS device by encrypting all plaintext passwords currently in the running configuration?

password encrypt all
service password-encryption (Correct answer)
crypto password enable
enable secret level 5

Correct answer: service password-encryption

'service password-encryption' applies a weak reversible Type 7 encryption to plaintext passwords in the configuration.

Question 84: To identify traffic bottlenecks between two sites, which router command is used?

Telnet
Ping
SSH
Trace (Correct answer)

Correct answer: Trace

The `traceroute` (or `trace` on Cisco devices, `tracert` on Windows) command is used to display the path and measure transit delays of packets across an IP network. By showing each router (hop) a packet traverses and the round-trip time to each hop, it helps identify where delays or bottlenecks might be occurring between two sites. This makes it ideal for diagnosing connectivity and performance issues.

Question 85: Which 802.11 band characteristic makes 5 GHz preferable to 2.4 GHz in dense environments?

5 GHz has more non-overlapping channels and typically less interference (Correct answer)
5 GHz is backward compatible with all 802.11b devices
5 GHz has greater range and penetrates walls better
5 GHz requires less transmit power for the same coverage area

Correct answer: 5 GHz has more non-overlapping channels and typically less interference

The 5 GHz band offers up to 24 non-overlapping channels (in the US) compared to only 3 in 2.4 GHz, reducing co-channel interference in dense deployments.

Question 86: How does RSTP achieve faster convergence compared to traditional 802.1D STP?

RSTP uses shorter timer values only
RSTP eliminates the need for BPDUs entirely
RSTP uses a proposal/agreement handshake mechanism between neighboring switches (Correct answer)
RSTP elects multiple root bridges to distribute convergence

Correct answer: RSTP uses a proposal/agreement handshake mechanism between neighboring switches

RSTP's proposal/agreement mechanism allows ports to synchronize and transition to Forwarding without waiting for timers to expire.

Question 87: What is the purpose of the OSPF DR (Designated Router) on a broadcast network?

To perform route summarization for the area
To reduce LSA flooding by acting as a central point for LSDB synchronization (Correct answer)
To assign IP addresses to other routers
To authenticate all OSPF packets in the segment

Correct answer: To reduce LSA flooding by acting as a central point for LSDB synchronization

The DR reduces OSPF traffic on multi-access segments by collecting and distributing LSAs on behalf of all routers.

Question 88: A company needs 10 subnets from 192.168.1.0/24 with at least 10 hosts each. Which prefix length meets both requirements?

/28
/26
/27 (Correct answer)
/25

Correct answer: /27

A /27 provides 32 subnets (2^5) from a /24 and 30 usable hosts each (2^3 – 2), satisfying both requirements.

Question 89: What is the default aging time for dynamic MAC address entries on a Cisco switch?

300 seconds (Correct answer)
180 seconds
600 seconds
60 seconds

Correct answer: 300 seconds

Cisco switches default to a 300-second (5-minute) aging timer for dynamically learned MAC address table entries.

Question 90: Which protocol can cause a loop-free Layer 2 topology by blocking redundant paths?

CDP
EIGRP
Spanning Tree Protocol (STP) (Correct answer)
VLAN Trunking Protocol (VTP)

Correct answer: Spanning Tree Protocol (STP)

Spanning Tree Protocol (STP) prevents Layer 2 loops by placing redundant switch ports into a blocking state.

Question 91: Which tool uses an agentless architecture and communicates with network devices over SSH by default?

SaltStack
Ansible (Correct answer)
Chef
Puppet

Correct answer: Ansible

Ansible is agentless and uses SSH (or APIs) to communicate with managed devices, requiring no agent software on endpoints.

Question 92: A network engineer configures an EtherChannel but notices only some member ports are active. The switch shows flags 'I' on those ports. What does 'I' indicate?

The port is in an idle STP state
The port carries only inband management traffic
The port stands alone and is not part of any bundle due to a configuration incompatibility (Correct answer)
The port is in LACP independent mode waiting for a peer

Correct answer: The port stands alone and is not part of any bundle due to a configuration incompatibility

The 'I' (independent) flag in 'show etherchannel summary' means the port is not bundled, typically because its speed, duplex, or VLAN settings differ from the other member ports.

Question 93: What is the default sequence number increment when adding ACL entries without specifying a sequence number?

100
5
10 (Correct answer)
1

Correct answer: 10

Cisco IOS automatically assigns sequence numbers in increments of 10 (10, 20, 30…) for ACL entries.

Question 94: Which Rapid STP (802.1w) port role replaces the STP blocking state and provides an alternate path to the root bridge?

Alternate port (Correct answer)
Discarding port
Edge port
Backup port

Correct answer: Alternate port

In RSTP, the Alternate port is in the Discarding state and provides a redundant path to the root bridge if the root port fails.

Question 95: A PAT table has exhausted all available port numbers for a given public IP. What happens to new connection attempts?

The router automatically allocates a second public IP
The router queues them until ports free up
New translations fail and connections are dropped (Correct answer)
ICMP redirect messages are sent to hosts

Correct answer: New translations fail and connections are dropped

When all ~65,535 ports are in use for a PAT address, no new translations can be created and new connections from inside hosts are dropped.

Question 96: Which STP port state is equivalent to the RSTP 'Discarding' state?

Listening
Forwarding
Blocking (Correct answer)
Learning

Correct answer: Blocking

RSTP combines the STP Blocking and Listening states into a single Discarding state where neither forwarding nor MAC learning occurs.

Question 97: Which command clears all dynamic NAT translations from the translation table?

flush ip nat translations
clear ip nat translation * (Correct answer)
clear ip nat statistics
no ip nat translation

Correct answer: clear ip nat translation *

'clear ip nat translation *' removes all dynamic NAT entries; static translations must be removed by deleting their configuration.

Question 98: A time-based ACL uses which command to reference a defined time range?

time-range <name> (Correct answer)
schedule <name>
clock-range <name>
active-period <name>

Correct answer: time-range <name>

The 'time-range <name>' command defines a time window, which is then referenced in an ACL entry with 'time-range <name>'.

Question 99: Which statement correctly describes the difference between a routing protocol and a routed protocol?

Both terms describe the same function in modern networks
A routed protocol carries user data while a routing protocol builds and maintains the routing table (Correct answer)
A routing protocol carries user data; a routed protocol builds the routing table
A routed protocol is only used in IPv6 networks

Correct answer: A routed protocol carries user data while a routing protocol builds and maintains the routing table

Routed protocols like IP carry user traffic, while routing protocols like OSPF or EIGRP exchange routing information to populate the routing table.

Question 100: What command displays the hit count for each ACL entry?

show access-list statistics
show ip interface brief
show ip access-lists (Correct answer)
debug ip packet

Correct answer: show ip access-lists

'show ip access-lists' shows each ACL entry along with how many packets have matched it.

Cisco CCNA 200-301 Exam

The Cisco Certified Network Associate (CCNA 200-301) exam validates the ability to install, configure, operate, and troubleshoot medium-sized routed and switched networks, covering network fundamentals, access, IP connectivity, services, security, and automation.

100

Questions

120 min

Time Limit

83%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds