200-301 Exam Questions and Answers

10.24.7.159

The /27 CIDR notation indicates a subnet mask of 255.255.255.224, leaving 5 host bits. This defines subnet blocks of 32 addresses each. For the fourth octet, the given IP address 158 falls within the subnet range starting at 128 (10.24.7.128) and ending at 159 (10.24.7.159). The broadcast address is always the last address in a subnet, where all host bits are set to one. Therefore, 10.24.7.159 correctly identifies the broadcast address for the 10.24.7.158/27 interface.

TCP provides connection-oriented transport

TCP establishes a reliable, connection-oriented session by utilising a three-way handshake before any data transmission commences. This fundamental mechanism ensures a logical connection is set up and maintained between the communicating hosts, providing statefulness and ordered delivery. This precise characteristic directly contrasts with UDP's connectionless nature, making it an accurate comparison between the two protocols and satisfying the question's requirement for a distinguishing statement.

UDP has lower overhead than TCP

UDP has lower overhead than TCP because its fixed header is only 8 bytes, whereas TCP's header is at least 20 bytes and includes sequence numbers, acknowledgment numbers, and window fields. Additionally, UDP performs no three-way handshake or session state tracking, eliminating the extra control-message traffic and state-management resources that TCP must consume. This makes UDP a lighter protocol per datagram, though at the cost of reliability.

Fiber optic cable

Fiber-optic cable is the standard medium for 10G uplinks because it supports both 10GBASE-SR (multimode, 850 nm VCSELs, up to 300 m on OM3/OM4) and 10GBASE-LR (single-mode, 1310 nm, up to 10 km), providing reach and bandwidth far beyond copper twisted pair. It is immune to electromagnetic interference, has extremely low signal attenuation, and offers the full-duplex symmetric bandwidth required for switch uplinks. Enterprise switches therefore ship with SFP+ slots where fiber transceivers are the default choice for interconnecting access-layer switches to distribution or core switches.

Layer 3

Routers make forwarding decisions at OSI Layer 3, the network layer, by inspecting the destination IPv4 or IPv6 address in the packet header. They consult their routing table and apply the longest-prefix-match rule to select the next hop toward the destination network. This logical addressing allows routing across different broadcast domains.

ipv6 unicast-routing

The global configuration command 'ipv6 unicast-routing' is the correct and required command to enable IPv6 routing on a Cisco router. It enables IPv6 packet forwarding on all interfaces and allows the router to route IPv6 traffic between networks. Without this command, the router will not forward IPv6 packets but will still process traffic explicitly addressed to itself.

The MAC address of the local default gateway

The host's routing table indicates that the destination IP is not on the local subnet, so the packet must be sent to the default gateway. The destination MAC in the Ethernet frame is therefore the gateway's interface MAC, resolved via ARP, while the destination IP address remains that of the web server. The gateway then strips the frame and forwards the packet toward the remote subnet, changing the frame headers at each hop while preserving the IP addresses.

Listening

The Listening state follows the Blocking state and precedes the Learning state in STP convergence. During Listening, the port actively listens for BPDUs to determine the root bridge and its port role, and it does not learn MAC addresses or forward user traffic. This is the state that matches the question's description, as it is the phase specifically designated for BPDU listening to build the STP topology.

All member interfaces must use matching speed, duplex, and trunk/access settings

All member interfaces must have matching physical and logical characteristics to be eligible for EtherChannel bundling. This includes identical speed and duplex settings, because protocols like LACP and PAgP verify these parameters during negotiation and will not form a bundle if they differ. Additionally, each interface must be configured with the same operational mode—either access or trunk—with consistent native and allowed VLANs, so that the aggregated link behaves as a single port.

Subinterfaces with 802.1Q encapsulation for each routed VLAN

In a router-on-a-stick, the physical Ethernet interface is configured as an 802.1Q trunk, and subinterfaces are created for each routed VLAN. Each subinterface is assigned an IP address from that VLAN's subnet and uses encapsulation dot1Q with the matching VLAN ID, allowing the router to receive and forward VLAN-tagged frames. This logical separation enables inter-VLAN routing over a single physical link, which is the core of this design.

Floods the frame out all ports in the same VLAN except the incoming port

When a switch receives a unicast frame whose destination MAC address is absent from its MAC address table (or has aged out), it treats the frame as an unknown unicast. Standard transparent bridging behavior is to flood the frame out every port that is a member of the same VLAN as the incoming port, but not the incoming port itself. This maximizes the chance that the intended recipient, which may be on any segment in that broadcast domain, receives the frame without any Layer 3 routing or address rewriting.

Lowest bridge ID, which begins with priority

In STP, the root bridge is elected by comparing the 8-byte bridge ID (BID), which is formed by a 2-byte priority value followed by the 6-byte MAC address. The lowest BID wins, and because priority occupies the most significant bytes, a switch with a lower priority always beats a switch with a higher priority. Only when priorities are identical does the MAC address become the tiebreaker within the same BID comparison. Thus the actual election value is the full bridge ID, beginning with priority.

Layer 2 switching loops

Spanning Tree Protocol (IEEE 802.1D) eliminates Layer 2 switching loops by placing redundant switch ports in a blocking state, leaving a single active loop-free path between hosts. Without STP, broadcast frames cycle endlessly, creating broadcast storms, MAC address flapping, and duplicated unicast frames that severely degrade the switching fabric. Redundant links remain available and are activated automatically if the primary path fails.

The OSPF route, because 110 is lower than 150

OSPF has a default administrative distance of 110, while the static route in this scenario has been configured with an AD of 150, making it a floating static route. Since the router selects the route with the lowest AD for the same destination prefix, the OSPF route wins. The lower AD indicates that OSPF is more trustworthy than the static route in this configuration.

The neighbor relationship is complete and the neighbor is the DR on that segment

In OSPF, the FULL neighbor state indicates that the two routers have completed database synchronization, exchanging Database Descriptors, Link-State Requests, Link-State Updates, and Link-State Acknowledgments. In a broadcast or NBMA segment, the DR designation is appended after the state, so this output means neighbor Router ID 10.1.1.1 is fully adjacent and is the Designated Router for that segment.

The EIGRP route, because its administrative distance is lower

Routers prioritise routes for the same destination using administrative distance (AD) before considering protocol metrics. EIGRP has a default administrative distance of 90, which is lower than OSPF's default of 110. Consequently, even though OSPF reports a numerically lower metric, the router will install the EIGRP route for 10.10.10.0/24 into its routing table because its superior administrative distance takes precedence.

This can be normal on a broadcast segment where DROTHER routers remain in 2-Way

On multiaccess broadcast networks, OSPF elects a DR and BDR. Other routers (DROTHERs) only form fully adjacent neighbors with the DR and BDR; between DROTHERs, they stop at the 2-Way state because they do not exchange LSAs directly. This reduces flooding and is expected behavior, not an error.

ipv6 route ::/0 2001:db8:1::1

The IOS global configuration command `ipv6 route` is the valid method to install a static IPv6 route, and the network prefix `::/0` is the IPv6 default route because it matches all destination addresses. Specifying `2001:db8:1::1` as the next hop tells the router to forward all unmatched IPv6 traffic to that neighbor. This is the exact syntax Cisco IOS uses for an IPv6 default route.

A connected network

The code 'C' in a Cisco IOS routing table represents a connected (directly attached) network. This entry is automatically generated when an interface has a valid IP address configured and is in the up/up state, and it carries an administrative distance of 0, meaning it is the most trustworthy source of routing information.

The ACL blocks HTTP but allows ICMP

HTTP traffic is encapsulated in TCP, so it matches the first ACE, deny tcp any any, and is immediately discarded because ACLs stop at the first match. ICMP, however, is not TCP; it is a separate Layer 3 protocol, and therefore bypasses line 10. It then matches the permit ip any any on line 20, allowing ping to succeed.

Dynamic ARP Inspection

Dynamic ARP Inspection (DAI) is a security feature on switches that intercepts all ARP requests and replies on untrusted ports and validates them against the DHCP snooping binding table. If the IP-to-MAC mapping in an ARP packet does not match the binding table, DAI drops the packet, thereby preventing ARP poisoning attacks. Additionally, DAI can rate-limit ARP packets to mitigate ARP-based denial-of-service attacks, making it the precise solution for the user's IP-to-MAC issue.

SNMPv3 adds authentication and encryption features

SNMPv3's defining improvement over SNMPv1/v2c is its User-based Security Model (USM), providing message authentication via HMAC-MD5 or HMAC-SHA and encryption using DES or AES. Whereas earlier versions pass community strings in cleartext and offer no true authentication, SNMPv3 validates each message's integrity and origin and protects the payload from eavesdropping. This strong security is precisely why SNMPv3 is considered the primary differentiator for secure network management.

Authorization

In the AAA security model, the second 'A' stands for Authorization, which is the process of determining what actions or resources an authenticated user is permitted to access. After a user proves their identity via authentication, authorization enforces policies such as permit/deny rules, often based on roles or attributes, and is a distinct step from authentication and accounting. For example, in Cisco ISE, authorization may assign a VLAN or ACL after authentication succeeds.

Extended IPv4 ACL

Extended IPv4 ACLs, identified with a number in the range 100–199 or 2000–2699 (or by name), are designed to filter based on multiple criteria, including both the source and destination IP addresses. Additionally, they can match protocol (such as TCP, UDP, ICMP) and port numbers, providing granular traffic control. Thus, extended ACLs exactly satisfy the requirement of filtering using both source and destination IP.

WPA2 with AES

WPA2 with AES is the strongest option because it employs AES-CCMP, a 128-bit block cipher operating in counter mode with CBC-MAC for integrity, which together provide robust confidentiality, data-origin authentication, and replay protection. The per-frame key derivation and the cryptanalytic resistance of AES make brute-force or keystream-reuse attacks infeasible, making it the only listed option that meets modern wireless security standards.

The request was successful

HTTP 200 OK is the standard success status code for a GET request, confirming that the server found and returned the requested resource. For a valid GET, a 200 response includes the resource representation in the message body, satisfying the client's read operation. This is the definitive meaning of HTTP 200.

It tracks changes and allows rollback to earlier versions

Version control records every change to configuration files, allowing engineers to diff versions, identify who made specific modifications, and revert to a known-good state. This change tracking and rollback capability is foundational for network automation, supporting compliance audits and rapid incident recovery when a change causes issues.

It tracks changes and supports rollback and review

Version control records every commit as a snapshot, enabling network engineers to compare revisions, identify who changed what and why, and revert to a known-good previous state if a change causes outages or misconfigurations. It also facilitates peer review through merge or pull requests, which catches issues before deployment. These capabilities directly support operational reliability and audit compliance, making version control a foundational practice for automation.

It centralizes policy and can simplify network-wide changes

A controller provides a single point of management where network administrators can define security, QoS, and segmentation policies that are then pushed consistently across all devices. When a change is needed—such as updating an ACL or VLAN configuration—the controller propagates it automatically, eliminating the need for device-by-device CLI access. This centralized policy engine reduces human error, ensures consistency, and dramatically simplifies large-scale network operations.

An interface used by applications to communicate with the controller

Correct. A northbound API is the programmatic interface that applications use to communicate with the controller, allowing them to request network policies, retrieve telemetry, or adjust network behavior without dealing with underlying device specifics. This abstraction is what makes controller-based architectures agile for software-defined networking.

GET

The GET method is designed to retrieve a representation of a specified resource — it is safe, meaning it never changes server state, and idempotent, so multiple identical requests produce the same result. In RESTful APIs, GET is the standard operation for querying or fetching information, and it typically carries no request body, with all parameters in the URL query string.