200-901 Network Fundamentals — 30 Questions

Question 1

A network engineer is troubleshooting slow connectivity between two sites connected via a WAN link. The engineer suspects packet loss due to collisions. Which interface counter should be examined to confirm this?

Accepted Answer

CRC errors. CRC (Cyclic Redundancy Check) errors indicate that frames received on an interface have failed the integrity check, which is often caused by physical-layer issues such as collisions, faulty cabling, or signal degradation. In the context of a WAN link, collisions are not typical (since full-duplex is standard), but if the link is misconfigured as half-duplex, collisions can occur and will manifest as CRC errors. Thus, examining the CRC errors counter is the correct way to confirm packet loss due to collisions.

Answer

Runts

Answer

Output errors

Answer

Giants

Question 2

A DevOps team is deploying a containerized application across multiple hosts. They need to ensure that traffic between containers on the same host is isolated from other tenants. Which network implementation best meets this requirement?

Accepted Answer

VXLAN overlays with a distributed virtual switch. VXLAN overlays with a distributed virtual switch provide Layer 2 isolation across multiple hosts by encapsulating Ethernet frames in UDP packets (RFC 7348). This creates independent virtual networks (VXLAN segments) that can span hosts, ensuring traffic between containers on the same host is isolated from other tenants without relying on physical network topology.

Answer

Linux bridge with ebtables rules

Answer

NAT with port forwarding

Answer

802.1Q VLANs on the host switch

Question 3

An engineer notices that a switch port configured as an access port in VLAN 10 is not forwarding traffic. The switch shows the port is up/up. What is the most likely cause?

Accepted Answer

The connected device is sending 802.1Q tagged frames. An access port expects to receive and send only untagged frames, as it belongs to a single VLAN (VLAN 10). If the connected device sends 802.1Q tagged frames, the switch will drop them because the access port does not process VLAN tags. This explains why the port is up/up but not forwarding traffic.

Answer

Spanning Tree Protocol blocking the port

Answer

Speed/duplex mismatch

Answer

VLAN 10 does not exist in the VLAN database

Question 4

A network administrator is configuring SNMPv3 on a router for secure monitoring. Which combination of parameters is required to ensure authentication and encryption?

Accepted Answer

SNMPv3 with authPriv. SNMPv3 with authPriv is the correct combination because it enables both authentication (via HMAC-MD5 or HMAC-SHA) and encryption (via DES or AES) to ensure secure monitoring. The authPriv security level provides message integrity, origin authentication, and data confidentiality, meeting the requirement for both authentication and encryption.

Answer

SNMPv3 with noAuthNoPriv

Answer

SNMPv3 with authNoPriv

Answer

SNMPv2c with a complex community string

Question 5

During a network migration, an engineer needs to replace a legacy core switch with a new one without disrupting the existing STP topology. The new switch supports RSTP and will be connected via two trunk links. Which configuration should be applied to the new switch to prevent it from becoming the root bridge?

Accepted Answer

Configure the bridge priority to 61440. Option B is correct because setting the bridge priority to 61440 (which is a valid priority value in increments of 4096) ensures the new switch has a higher numerical priority than the current root bridge, preventing it from becoming the root. In STP/RSTP, the switch with the lowest bridge priority becomes the root bridge; by configuring a high priority, the new switch will not disrupt the existing topology.

Answer

Enable root guard on the trunk ports

Answer

Enable BPDU guard on the trunk ports

Answer

Set the bridge priority to 0

Question 6

A technician needs to verify the IP address of a remote server using DNS. Which command should be used on a Cisco IOS device?

Accepted Answer

nslookup server.example.com. The `nslookup` command is used to query DNS servers to resolve a hostname to an IP address. On a Cisco IOS device, `nslookup` sends a DNS query for the specified hostname and returns the corresponding IP address, making it the correct tool for verifying a remote server's IP via DNS.

Answer

traceroute server.example.com

Answer

show hosts server.example.com

Answer

ping server.example.com

Question 7

A network engineer is designing a data center network with leaf-spine topology. The requirement is to minimize latency and maximize bandwidth for east-west traffic. Which type of links should be used between leaf and spine switches?

Accepted Answer

Multiple parallel links with ECMP routing. In a leaf-spine topology, east-west traffic (server-to-server) must traverse the spine switches. Using multiple parallel links with Equal-Cost Multi-Path (ECMP) routing allows all links to be active simultaneously, maximizing bandwidth and minimizing latency by load-balancing traffic across all available paths. ECMP leverages Layer 3 routing (e.g., OSPF or BGP) to forward packets over multiple equal-cost paths, which is ideal for the non-blocking, high-throughput design of leaf-spine architectures.

Answer

Multiple links with VSS

Answer

Single link with LACP

Answer

Single link with STP

Question 8

An organization uses Cisco ISE for network access control. A user reports inability to access the network. The switch port shows the authenticator state as 'connecting'. What does this indicate?

Accepted Answer

The client is in the process of 802.1X authentication. In Cisco ISE and 802.1X, the authenticator state 'connecting' indicates that the switch (authenticator) has detected a new client on the port and has initiated the 802.1X authentication process. This state means the port is actively sending EAP-Request/Identity frames and waiting for the client to respond, so the client is in the process of authentication, not yet authenticated or failed.

Answer

The client has successfully authenticated

Answer

The port is in a held state due to multiple failures

Answer

Authentication has failed

Question 9

Which TWO statements are true about VXLAN? (Choose two.)

Accepted Answer

VXLAN encapsulates Ethernet frames in UDP packets. Option B is correct because VXLAN (Virtual Extensible LAN) encapsulates the original Layer 2 Ethernet frame inside a UDP packet (typically UDP destination port 4789). This allows the Layer 2 frame to be transported over a Layer 3 IP network, enabling network virtualization and overlay networking without requiring changes to the physical underlay.

Answer

VXLAN requires MPLS in the underlay

Answer

VXLAN uses IP-in-IP encapsulation

Answer

VXLAN operates at Layer 2 only

Question 10

Which THREE factors influence the convergence time of OSPF in a large enterprise network? (Choose three.)

Accepted Answer

CPU processing power for SPF calculations. CPU processing power for SPF calculations directly affects convergence time because OSPF must run the Dijkstra algorithm to compute the shortest path tree after a topology change. In large networks with many routers and LSAs, a slower CPU increases the time to complete SPF, delaying route convergence.

Answer

Bidirectional Forwarding Detection (BFD) implementation

Answer

DUAL algorithm processing time

Question 11

Which TWO functions are performed by the data plane in a network device? (Choose two.)

Accepted Answer

Forwarding packets based on destination MAC address. The data plane is responsible for forwarding packets based on information in the forwarding table, such as destination MAC address for Layer 2 switching. Applying ACLs is also a data plane function because ACL rules are evaluated in hardware or software during packet forwarding to permit or deny traffic.

Answer

Building the routing table using OSPF

Answer

Maintaining ARP cache entries

Answer

Establishing OSPF neighbor adjacencies

Question 12

An engineer configures a trunk port as shown. A device connected to this port sends an untagged frame. Which VLAN will the switch associate the frame with?

Accepted Answer

VLAN 99. The switchport trunk native vlan 99 command configures VLAN 99 as the native VLAN for the trunk port. When an untagged frame arrives on a trunk port, the switch associates it with the native VLAN. Therefore, the frame is placed into VLAN 99.

Answer

VLAN 1

Answer

The frame is dropped

Answer

VLAN 10

Question 13

Based on the routing table, what type of OSPF route is the default route (0.0.0.0/0)?

Accepted Answer

OSPF external type 2 route. The default route (0.0.0.0/0) in OSPF is typically redistributed from another routing protocol or statically configured and then advertised into OSPF. When a default route is injected via the 'default-information originate' command, it is advertised as an OSPF external type 2 (E2) route by default, meaning the metric does not change as it traverses OSPF areas. This matches option D.

Answer

OSPF inter-area route

Answer

OSPF NSSA external type 1 route

Answer

OSPF intra-area route

Question 14

A company has a three-tier data center architecture with access, aggregation, and core layers. The network team is migrating to a leaf-spine architecture to support increasing east-west traffic. The current network uses STP for loop prevention, and the team wants to eliminate STP in the new design. They plan to use VXLAN overlays with BGP EVPN for control plane. During a pilot deployment, the team notices that some legacy servers that rely on traditional VLANs are not reachable across the new fabric. The servers are connected to access switches that are part of the leaf layer. The access switches are configured as VXLAN tunnel endpoints (VTEPs) but the legacy servers are still using traditional VLANs. The team needs to ensure connectivity between the legacy VLAN-based servers and the new VXLAN-based network. What is the best approach to integrate these legacy servers without changing their configuration?

Accepted Answer

Implement a Layer 2 gateway (L2GW) on the leaf switches to bridge VLANs to VXLAN using IRB. Option B is correct because an Integrated Routing and Bridging (IRB) interface on the leaf switch acts as a Layer 2 gateway (L2GW), bridging the legacy VLAN to a VXLAN segment. This allows the legacy server, which still uses traditional VLAN tagging, to communicate with the VXLAN-based fabric without any configuration changes on the server. The IRB interface performs the VLAN-to-VXLAN mapping and handles ARP suppression, enabling seamless integration.

Answer

Create a separate VRF for legacy VLANs and redistribute into BGP EVPN

Answer

Configure the same VLAN on all leaf switches and use VXLAN to stretch the VLAN across the fabric

Answer

Reconfigure the legacy servers to use VXLAN encapsulation

Question 15

A university campus network uses Cisco switches with 802.1X for wired authentication. Recently, users in a dormitory report intermittent connectivity: they can connect initially but are disconnected after a few minutes. The network team checks the switch logs and sees messages like 'Authentication failure for MAC address xxxx.xxxx.xxxx on port GigabitEthernet1/0/5' but the users claim they are using valid credentials. The same users can connect from other ports without issues. The port configuration for Gi1/0/5 is: switchport mode access, authentication port-control auto, dot1x pae authenticator, authentication periodic, authentication timer reauthenticate 3600. The team suspects a misconfiguration. What is the most likely cause of the intermittent disconnections?

Accepted Answer

The 'authentication periodic' command forces reauthentication every 3600 seconds, and the client fails to reauthenticate. The 'authentication periodic' command enables periodic reauthentication, and the 'authentication timer reauthenticate 3600' sets the interval to 3600 seconds (1 hour). However, the logs show authentication failures occurring much sooner than 3600 seconds, indicating that the client is failing reauthentication attempts triggered by other events (e.g., a new supplicant attempt or a reauthentication due to a port state change). The intermittent disconnections are caused by the client failing to reauthenticate when the switch initiates a new authentication exchange, likely due to a mismatch in EAP method or credential caching issues.

Answer

The port is a trunk port but configured as access, causing VLAN mismatch

Answer

The port is configured in multi-auth host mode, causing conflicts

Answer

The switch is using MAC authentication bypass (MAB) as a fallback, which fails for some devices

Question 16

A network engineer is troubleshooting an issue where hosts in VLAN 100 cannot reach a server at 10.1.1.100. The switch interfaces are configured as access ports in VLAN 100, and the default gateway is 10.1.1.1. The engineer checks the switch and finds that the ARP table does not contain the server's MAC address. Which two actions should the engineer take to resolve the issue? (Choose two.)

Accepted Answer

Check the ARP table on the default gateway router.. Option E is correct because if the switch port connected to the server is not in VLAN 100, the server will be in a different broadcast domain and will not receive ARP requests from hosts in VLAN 100. This would cause the ARP table on the switch to lack the server's MAC address, as the switch cannot learn it through normal Layer 2 flooding within the VLAN.

Answer

Ping the server's IP address from the switch management interface.

Answer

Ping the default gateway from a host in VLAN 100.

Answer

Check the MAC address table on the switch for the server's MAC.

Question 17

Refer to the exhibit. A switch is configured with the shown trunk port. After connecting the uplink, the switch logs show repeated 'errdisable' state transitions on this port. The core switch is configured with the same allowed VLAN list. Which configuration change is most likely to resolve the issue?

Accepted Answer

Remove the spanning-tree portfast trunk command from the interface.. The 'errdisable' state transitions on a trunk port are typically caused by a spanning-tree BPDU guard violation when PortFast is enabled. The 'spanning-tree portfast trunk' command enables PortFast on the trunk, which bypasses the normal listening/learning states and can cause the port to be placed into errdisable state if a BPDU is received from the core switch. Removing this command allows the trunk port to participate in standard spanning-tree convergence, preventing the repeated errdisable transitions.

Answer

Change the switchport mode to dynamic desirable.

Answer

Add VLAN 1 to the allowed VLAN list.

Answer

Add the spanning-tree bpduguard enable command to the interface.

Question 18

A network administrator is deploying a new application that requires high availability and load balancing across multiple servers. The servers are connected to a pair of switches that use StackWise virtual technology. The application team requests that the servers be configured with NIC teaming in active-active mode. Which two requirements must be met for this configuration to work correctly? (Choose two.)

Accepted Answer

The two switches must be part of a single stack or virtual switch fabric.. Option A is correct because StackWise virtual technology logically combines two physical switches into a single control plane, allowing NIC teaming in active-active mode to treat the pair as one logical switch. This ensures that both NIC team members can forward traffic simultaneously without loops, as the stack provides a unified Layer 2 topology and prevents MAC flapping between the two switches.

Answer

Spanning-tree PortFast must be enabled on the switch ports connected to the servers.

Answer

The NIC team must use LACP for load balancing.

Answer

Both NIC team members should connect to the same switch module for consistency.

Question 19

Drag and drop the steps to configure a Cisco switch for remote management (SSH) into the correct order.

Question 20

Match each Cisco platform to its primary use case.