These are the questions most candidates get wrong. They require connecting multiple concepts, reading tricky output, or knowing edge-case behaviour that isn't on most study cards. Practising them trains you to operate under uncertainty — a necessary skill on the real exam.
Start Scenario PracticeA network engineer notices that internal hosts (192.168.1.0/24) can reach external servers on the internet, but replies from external servers never reach the internal hosts. The router R1 is configured with dynamic NAT to translate the internal subnet to a pool of public IPs (203.0.113.10-203.0.113.20). The engineer runs 'show ip nat translations' and sees only a few stale translations. What is the most likely cause of the issue?
Explanation: The 'ip nat outside' command must be applied to the interface facing the external network (GigabitEthernet0/0) for the router to translate return traffic. Without it, the router does not perform NAT on packets arriving on that interface, so replies from external servers are forwarded without translation back to the inside local IPs, which are not routable on the internet. The stale translations indicate that outbound translations were created but never used for return traffic, confirming the missing outside interface command.
A network administrator is troubleshooting a wireless connectivity issue in a large office. Users on the 5 GHz band report intermittent disconnections and slow performance, while 2.4 GHz clients are unaffected. The office uses a Cisco 9800 WLC with APs that support 802.11ac Wave 2. The administrator checks the WLC's RF profile and notices a high number of channel utilization reports on channel 36. What is the most likely cause of the problem?
Explanation: Channel 36 is a 20 MHz channel in the 5 GHz band. When many APs use the same channel (channel 36), they share the same medium, leading to co-channel interference (CCI). This causes intermittent disconnections and slow performance for 5 GHz clients because they must contend for airtime. Spreading APs across non-overlapping channels like 40, 44, or 48 reduces CCI and improves performance.
A network administrator is troubleshooting an IPv6 connectivity issue on a newly deployed router. The router's G0/0/0 interface is configured with an IPv6 address using EUI-64, but hosts on that subnet cannot reach the router's link-local address. The administrator runs 'show ipv6 interface g0/0/0' and sees that the interface is up/up but the IPv6 address is not in the expected format. What is the most likely cause of the problem?
Explanation: The router's G0/0/0 interface is up/up, but the IPv6 address is not in the expected EUI-64 format. This indicates that the 'ipv6 address' command was likely omitted entirely, because if it were simply misconfigured (e.g., without the `eui-64` keyword), the router would still automatically generate a link-local address, and hosts would be able to reach it. Since hosts cannot reach the link-local address, IPv6 is not enabled on the interface at all. The correct configuration requires the `ipv6 address` command with the appropriate prefix and the `eui-64` keyword.
What action should be taken to resolve the err-disabled state?
Explanation: The distribution switch interface entered err-disabled because it received a BPDU while BPDU Guard was enabled. BPDU Guard is not automatically enabled with PortFast; it must be explicitly turned on, and the scenario assumes it is active. When a BPDU arrives on a BPDU Guard–enabled port, the switch err-disables it to prevent loops. Disabling BPDU Guard on that interface resolves the condition. Disabling Root Guard (option A) would not stop the BPDU Guard trigger; removing PortFast (option C) would not disable the already-enabled BPDU Guard; and changing the port to access mode (option D) is irrelevant to BPDU Guard behavior.
A network administrator is troubleshooting connectivity issues in a switched network. Users on VLAN 10 report intermittent connectivity to the server farm. The network uses Rapid PVST+ as the spanning-tree protocol. The administrator examines the switch that is the root bridge for VLAN 10 and notices that one of the uplink interfaces to an access switch is in a blocking state. What is the most likely cause of this issue?
Explanation: In Rapid PVST+, the root bridge for a VLAN should have all its ports in a forwarding state. If an uplink interface on the root bridge is blocking, it indicates that another switch is being elected as the root bridge for VLAN 10, likely because it has a lower spanning-tree priority. By checking and adjusting the priority on other switches, the administrator can ensure the intended switch becomes the root bridge, resolving the intermittent connectivity caused by suboptimal path selection.
+15 more scenario questions available
Practice all Hard Difficulty QuestionsThese are the questions most candidates get wrong. They require connecting multiple concepts, reading tricky output, or knowing edge-case behaviour that isn't on most study cards. Practising them trains you to operate under uncertainty — a necessary skill on the real exam. These appear throughout the 200-301 and require you to apply your knowledge, not just recall facts.
Cisco doesn't publish an exact breakdown, but scenario-based questions (especially exhibit and command-output formats) make up a significant portion of the 200-301. Practicing each scenario type ensures you're ready for any format.
Yes. Courseiva provides free 200-301 scenario practice across all official exam domains. The platform includes scenario-based questions, command-output interpretation, topic-based practice, mock exams, and readiness tracking — no account required.
Launch a full Hard Difficulty Questions session with instant scoring and detailed explanations.
Start Scenario Practice →