CCNA 200-301 v2 (200-301) — Questions 676–750

Candidates might think that starting the capture is the first step, similar to enabling a debug, but EPC requires configuration first.

Candidates may think exporting is just copying a buffer that can be done anytime, but the capture must be stopped to finalize the file.

Candidates might assume that since the router has the capture, it can also analyze it, but IOS-XE lacks a full packet analyzer.

10.20.30.31 is the broadcast address of the previous /27 subnet (10.20.30.0/27), not the subnet containing 10.20.30.44. The host 10.20.30.44 belongs to the 10.20.30.32/27 subnet, so its broadcast is 10.20.30.63.

10.20.30.32 is the network address (subnet ID) of the subnet 10.20.30.32/27, not the broadcast address. The network address is the first address in the subnet and is used to identify the subnet itself.

10.20.30.64 is the network address of the next /27 subnet (10.20.30.64/27), not the broadcast of the current subnet. The broadcast address for 10.20.30.32/27 is 10.20.30.63.

This option would be correct if the question asked for the directed broadcast address of the subnet containing 10.20.30.44 with a /26 mask (block size 64), where the subnet would be 10.20.30.0/26 and the broadcast would be 10.20.30.63.

If the question asked for the network address of the subnet containing 10.20.30.44/27, then 10.20.30.32 would be correct. For example: 'Which address is the network address for the subnet of 10.20.30.44/27?'

If the question asked for the network address of the next subnet after 10.20.30.32/27, then 10.20.30.64 would be correct. For example: 'What is the network address of the subnet following 10.20.30.32/27?'

Students often miscalculate the subnet boundaries or confuse the broadcast address with the network address. The number 31 might appear as a common broadcast address in smaller subnets, but here it is incorrect.

Some students mistakenly think the network address or the first usable address is the broadcast address. The network address is often confused with the broadcast because both are special addresses within the subnet.

Students may incorrectly add the subnet size (32) to the network address to get the broadcast, but the broadcast is one less than the next network address. 10.20.30.64 is the next subnet boundary, not the broadcast.

Option C is incorrect because subnet masks are related to IP addressing and have no connection to SDN or NFV concepts, which focus on network control and virtualization.

Option D is wrong since SDN and NFV do not eliminate routing protocols; routing remains necessary for path determination and packet forwarding in networks.

Option E is incorrect because SDN and NFV are broad network architecture concepts and do not exclusively refer to wireless client roaming or mobility management.

In a question that asks about basic networking terminology and definitions, if the context was specifically about how modern networking concepts are merely rebranding of traditional terms, then stating that SDN and NFV are just new names for subnet masks could be correct if the question was misleadingly framed to suggest that all networking terms evolve in this manner.

If the exam question asked whether SDN and NFV can operate in environments where traditional routing protocols are not necessary, such as in certain isolated or specialized networks, then this option could be correct, as it might focus on specific scenarios where alternative methods are used.

If the exam question specifically asked about technologies that enhance wireless networks or focused solely on wireless client management, this option could be correct, as it would then align with the context of wireless roaming capabilities.

Students may confuse the term 'virtualization' in NFV with virtual LANs (VLANs) or subnetting, leading them to incorrectly associate these concepts with subnet masks.

The centralized control in SDN might suggest that routing logic is entirely moved to the controller, but in practice, routing protocols often still run on devices or are integrated with the SDN controller.

The term 'network virtualization' might be mistakenly associated with virtual wireless networks or SSIDs, leading students to think these concepts only apply to wireless roaming.

The ACL only permits TCP traffic from 10.10.10.0/24 to host 192.0.2.10 on port 443. ICMP is not TCP, so even though the destination matches, the protocol does not match, and the packet is not permitted.

Although the source IP matches the ACE's source network, the ACE only permits TCP traffic; ICMP is a different protocol, so the packet is denied by the implicit deny.

ICMP does not use TCP ports; it uses ICMP type and code. The ACL entry specifies TCP port 443, which is irrelevant for ICMP traffic. Even if the source port were 443, ICMP packets do not have TCP ports.

In a different exam scenario where an ACL permits ICMP traffic from a specific source to a specific destination, such as 'permit icmp 10.10.10.0/24 host 192.0.2.10', this option would be correct as the ICMP echo request would match the permit statement.

In a different scenario where an ACL permits both TCP and ICMP traffic, a question might ask about the behavior of an ICMP packet under those conditions. If the ACL included rules for ICMP, then translating ICMP to TCP could be a valid consideration.

In a different scenario, if the ACL specified a rule that allowed ICMP traffic from any source to a specific destination, and the question asked about ICMP traffic, then this option could be correct if the source port was relevant to the rule being applied.

Students might think that matching the destination IP address is sufficient for permit, but ACLs require matching all specified fields (protocol, source, destination, and port).

Some students may confuse ACLs with NAT or other features that can modify packets, but ACLs only filter based on existing packet headers.

Students might think that matching the source port 443 could permit the traffic, but they overlook that the protocol must also match TCP.

RF channel issues cause connectivity or performance problems, not authentication failures after a successful association.

Hiding the SSID does not affect the 802.1X authentication process; the failure is likely due to RADIUS communication.

Voice VLAN assignment is unrelated to client authentication; clients do not need a voice VLAN to authenticate.

In a different scenario, if a question asks why clients are unable to connect to an SSID despite being in range, and mentions issues like poor signal strength or interference, then stating that the AP is using the wrong RF channel could be a valid explanation for connectivity problems.

In a scenario where a question states that clients are unable to connect to the network because the SSID is not visible, and the context involves a security policy requiring hidden SSIDs for enterprise authentication, this option would be correct.

In a different scenario where the question states that clients are required to connect to a voice VLAN for specific services, and they fail to authenticate until they are assigned to that VLAN, this option would be correct. For instance, if the question specifies that voice traffic must be prioritized and VLANs are configured accordingly, then this option would be valid.

Students often associate wireless problems with RF interference or channel overlap, but authentication failures point to higher-layer issues like RADIUS or credentials.

Some believe hiding the SSID adds security, but it is unrelated to authentication success and can actually cause client connectivity issues.

Students may confuse VLAN assignment with authentication, thinking a specific VLAN is required before authentication, but VLANs are applied after successful authentication.

NTP is a protocol for clock synchronization, not for IP address assignment. IP addresses are assigned via DHCP or static configuration, and NTP operates at the application layer to synchronize time over the network. Therefore, NTP does not assign IP addresses to any device, including Syslog servers.

NTP does not provide encryption for Syslog messages or any other data. NTP is solely responsible for time synchronization and does not include security features like encryption. Syslog messages are typically sent in clear text unless additional security measures like TLS or SSH are implemented.

In a different question asking about the initial setup of a Syslog server, an option stating that NTP assigns an IP address could be correct if the question is framed around the need for devices to communicate with the Syslog server, implying that IP assignment is part of the configuration process.

In a question asking about the role of NTP in a network where logging is handled entirely by a different protocol or system that does not require a Syslog server, this option could be correct. For example, if the question states that all logging is done locally on devices without centralization, then NTP could be seen as sufficient without a Syslog server.

If the exam question asked about a protocol that provides both time synchronization and encryption for log messages, such as TLS (Transport Layer Security) applied to Syslog, then this option could be correct.

Students might confuse NTP with DHCP or other protocols that provide network configuration parameters. Since NTP involves network communication, some may incorrectly assume it also handles IP addressing, especially when they see NTP configured with server IP addresses.

A test-taker with partial knowledge might think that because NTP helps with log correlation, it somehow eliminates the need for a separate Syslog server. This confusion arises from misunderstanding the distinct roles of network services.

Students may associate NTP with security because accurate time is important for security logs and protocols like Kerberos. However, NTP itself does not encrypt traffic; it only provides time accuracy. The temptation comes from conflating time synchronization with security functions.

Allowing anonymous administrative login means no authentication is required, which completely bypasses access control. This violates the principle of least privilege and exposes the device to unauthorized configuration changes.

VLAN 1 is the default VLAN and is often targeted in VLAN hopping attacks. Using VLAN 1 for all traffic violates the security best practice of segregating traffic and using dedicated VLANs for management, user data, and voice.

Removing authentication from VTY lines means anyone can connect to the device via Telnet or SSH without a password. This is a critical security flaw that allows unauthorized remote access.

In a hypothetical exam question focused on legacy systems or specific environments where security policies are relaxed for testing purposes, allowing anonymous administrative login could be deemed acceptable for quick access or troubleshooting without strict security protocols.

In a question focused on simplifying network management for a small, non-critical environment where security is not a primary concern, placing all traffic in VLAN 1 might be considered acceptable for ease of configuration and maintenance.

In a hypothetical exam scenario focused on a legacy system with strict internal access controls where the question specifies that the system is isolated from external networks, removing authentication from VTY lines might be considered acceptable for ease of access by trusted internal personnel.

Students might think convenience is a valid trade-off for security, especially in small or lab environments. However, in any production network, anonymous access is never acceptable.

VLAN 1 is the default and easiest to configure, so students may assume it is safe or simpler. However, security guidelines explicitly recommend not using VLAN 1 for user traffic.

Students might confuse 'no authentication' with 'no password required' for convenience, or they may think that physical security alone is sufficient. However, remote management must always be authenticated.

The output shows R2 is Active in its own group (20); priority only affects role election within the same group. The real problem is separate group numbers.

With mismatched authentication, the state would not be Active. The exhibit clearly shows Active on both routers, so authentication is not the cause.

Version mismatch would not change the displayed group number; the group number discrepancy is the direct evidence shown in the exhibit.

ARP is incorrect because it only resolves IPv4 addresses to MAC addresses on the local network segment and does not translate hostnames to IP addresses.

NTP is incorrect since it is used for synchronizing time between devices and does not perform any form of hostname or IP address resolution.

CDP is incorrect because it is a Cisco proprietary protocol used for discovering directly connected Cisco devices, not for resolving hostnames to IP addresses.

If the question asked about determining the MAC address of a device given its IP address within a local network, ARP would be the correct answer. For example, 'Which protocol is used to resolve an IP address to a MAC address on a local network?' would make ARP the right choice.

If the exam question asked which service is responsible for synchronizing the time on a networked device, then NTP would be the correct answer. For example, a question could state, 'Which protocol ensures accurate timekeeping across devices in a network?'

In a question asking about the identification of neighboring Cisco devices on a network, such as 'Which protocol allows a router to discover information about directly connected devices?', CDP would be the correct answer as it is specifically designed for that purpose.

Students may confuse ARP with DNS because both involve address resolution. However, ARP resolves IP to MAC, not hostname to IP, and is limited to local network communication.

The acronym NTP might be confused with DNS due to both being network services, but their functions are entirely different. Students with partial knowledge might think NTP involves some form of lookup or resolution.

CDP's ability to provide IP addresses of neighboring devices might lead students to incorrectly assume it can resolve hostnames. However, CDP is a discovery protocol, not a name resolution service like DNS.

Incorrect. Static default routes can coexist with OSPF routes. The router uses administrative distance to determine which route to install, so static routes are not automatically ignored when OSPF is enabled.

Incorrect. A default route must use the destination 0.0.0.0 with a mask of 0.0.0.0. Using a /24 mask is invalid for a default route and would not solve the issue of route selection.

Incorrect. Floating static routes do not require the next hop to be a loopback address. The next hop can be any reachable IP address, so this is not the reason the route is not installed.

In a different exam scenario, if the question stated that static routes are not allowed in a specific routing protocol configuration or that the router is configured to only use OSPF for routing, then this option could be correct.

In a different question setup where the exam asks about the configuration of static routes specifically requiring a subnet mask, this option could be correct if the question states that a static default route must use a specific subnet mask instead of the default 0.0.0.0.

In a different exam scenario, if the question specified that a floating static route could only be configured with a next hop that is a loopback interface, then this option would be correct. For example, if the question stated that the router's configuration only allows loopback addresses for floating routes, this would validate option D.

Students may mistakenly think that enabling a dynamic routing protocol like OSPF disables all static routes, confusing the concept of route preference with protocol exclusivity.

Students may confuse the mask for a default route with the mask for a network route, thinking that a default route must have a non-zero mask to be valid.

Some students might recall that loopback interfaces are often used for stability in routing protocols, leading them to incorrectly assume that floating static routes also require loopback next hops.

Candidates often confuse the order of tie-breakers, thinking metric is more important because it is a direct measure of path cost.

Candidates may confuse routing table lookup with ACL processing, where the first matching entry is used.

Candidates might think that 'higher' is better due to other contexts (e.g., higher bandwidth is better), but for AD, lower is better.

A trunk port is designed to carry traffic for multiple VLANs using 802.1Q tagging, which is not expected from a standard PC. Using a trunk port for a PC would cause the switch to expect tagged frames, leading to communication failures.

A routed port is a Layer 3 interface used for routing between VLANs or connecting to routers, not for connecting end-user PCs. It does not operate as a Layer 2 switchport and would not handle VLAN tagging as required.

A port-channel interface is a logical bundling of multiple physical links for increased bandwidth and redundancy, not a single connection to an end-user PC. It is used between switches or to servers, not for typical PC access.

If the exam question specified a scenario where multiple VLANs need to be transmitted between switches or to a router, and the focus was on inter-switch communication rather than end-user devices, then a trunk port would be the correct answer.

In a scenario where the question asks for the appropriate interface type for connecting two routers or Layer 3 devices that need to communicate without VLAN tagging, a routed port would be the correct answer, as it allows for direct IP communication between devices.

If the exam question asked about configuring a switch to connect multiple access ports for redundancy and load balancing, where VLAN tagging is not required, then a port-channel interface would be the correct answer. The question would need to focus on link aggregation rather than VLAN handling.

Students might confuse trunk ports with the ability to carry multiple VLANs, but they forget that end devices typically do not send or understand VLAN tags.

Some may think a routed port can be used for any connection, but it lacks the Layer 2 switching functionality needed for a PC access connection.

Students might associate port-channels with any type of connection, but they are not appropriate for a simple PC connection where no link aggregation is needed.

Option B is incorrect because OSPF does not compare its metric directly against EIGRP metrics. Metrics are protocol-specific and only administrative distance is used to compare routes across different protocols.

Option D is incorrect because OSPF process IDs are locally significant and do not need to match between neighboring routers. Adjacency forms based on matching parameters like area ID and authentication, not process ID.

Option E is incorrect because OSPF supports equal-cost multipath (ECMP) routing, allowing multiple routes with the same cost to be installed and used simultaneously for load balancing.

If the exam question asked about inter-protocol route selection or the behavior of routing protocols in a mixed environment, where OSPF and EIGRP metrics were being compared for route selection, then this option could be correct.

In a different context, a question could ask about OSPF configuration requirements for establishing neighbor relationships. If it specified that process IDs must match for a specific feature or scenario, then this option could be correct.

In a question specifically asking about OSPF's limitations in a scenario where only a single path is allowed due to configuration constraints or specific network designs, this option could be correct. For example, if the question states that OSPF is configured to not allow ECMP due to a specific policy.

Students might think that since both are routing protocols, their metrics can be compared directly, but they are calculated differently and are not interchangeable.

Students often confuse OSPF process IDs with EIGRP autonomous system numbers, which must match between neighbors. This leads to the incorrect assumption that OSPF process IDs must also match.

Some students may think OSPF only uses a single best path because they are familiar with the SPF algorithm's loop-free property, but ECMP is a standard feature in OSPF.

The specific factual error is confusing Root Guard with BPDU Guard. Root Guard is used to enforce the root bridge position, not to protect against BPDUs.

The specific factual error is that BPDU Filter silently drops BPDUs instead of taking action, which can allow loops to form if an unauthorized switch is connected.

The specific factual error is using the global configuration command on an interface. The global command enables BPDU Guard on all PortFast-enabled ports, but the question asks to configure it on a specific port.

Candidates pick this because both features are STP enhancement mechanisms, and 'guard' sounds similar to 'BPDU Guard'.

Candidates pick this because both BPDU Guard and BPDU Filter deal with BPDUs, and 'filter' might seem like a way to prevent BPDU issues.

Candidates pick this because 'default' might be misinterpreted as enabling the feature, and they may not remember the exact syntax for interface-level configuration.

Incorrect because roaming works on 5 GHz and is often preferred there; restricting SSID to 2.4 GHz is unnecessary and unrelated to the problem.

Incorrect because WPA2 supports roaming; encryption type does not cause clients to disconnect when roaming between APs.

Incorrect because DHCP scopes are shared in controller-based WLANs; separate DHCP scopes per AP are not required for roaming functionality.

In a different scenario where a question specifies that a WLAN is configured to only operate on the 2.4 GHz band and clients are experiencing roaming issues, then stating that the SSID must use 2.4 GHz only for roaming would be correct, as it would imply that the configuration limits roaming capabilities.

In a different question setup where the focus is on a legacy network using WEP or an outdated protocol that does not support roaming, stating that WPA2 cannot support roaming would be correct. For example, if the question specified a network using WEP and asked about roaming capabilities, this option could be valid.

In a different scenario where the question specifies that each AP is on a separate subnet and requires distinct DHCP scopes for clients to connect, this option would be correct. For example, if the question described a network with multiple VLANs and DHCP servers, then having different DHCP scopes would be necessary for proper client assignment.

Students might think that 2.4 GHz has better range and thus might be better for roaming, but roaming is about handoff between APs, not range. The 5 GHz band supports roaming just as effectively.

Some might confuse WPA2 with older security methods that had roaming limitations, or think that encryption keys need to be renegotiated causing delays, but WPA2 handles this efficiently.

Students might think that each AP needs its own subnet for clients to roam, but in a controller-based WLAN, clients typically stay on the same subnet across APs, and DHCP is handled centrally.

Changing encapsulation is unnecessary because the subinterfaces already use the correct dot1Q encapsulation for VLANs 10 and 20.

The 'ip routing' command is already enabled by default on routers, and global routing is not the problem here.

Subinterfaces do not support a 'no shutdown' command; their operational state is determined solely by the physical interface.

Candidates might think that each subinterface should match its VLAN's native status, but the native VLAN is a trunk property, not per-VLAN.

Candidates often assume that inter-VLAN routing requires explicitly enabling IP routing, but it is on by default.

Candidates might think subinterfaces can be independently enabled/disabled, but they are logical interfaces that depend on the physical interface.

BPDU Guard is a security feature that err-disables a port upon receiving BPDUs; it does not accelerate root election. Root election speed is influenced by STP timers and bridge priorities, not BPDU Guard.

BPDU Guard does not disable STP permanently; it only reacts to BPDU reception by err-disabling the port. STP remains active on other ports, and the port can be re-enabled after the violation is resolved.

Limiting MAC addresses on a port is the function of port security, not BPDU Guard. BPDU Guard specifically monitors for BPDU frames and takes action if any are received.

In a scenario where the exam question asks about methods to optimize STP performance and mentions features that can enhance the speed of root bridge election, this option could be correct if it was framed around a hypothetical technology that accelerates STP processes.

In a different exam scenario, if the question asked about a feature that disables STP on access ports to prevent any STP-related traffic, this option could be correct. For example, a question could specify a configuration where STP is not needed due to a specific network design.

In a different exam scenario, if the question asked about the purpose of MAC address filtering on access ports, option D could be correct. For example, a question could state, 'What is the function of limiting MAC addresses on an access port?' where the correct answer would be to allow only one MAC address.

The name 'Guard' might suggest it protects or speeds up STP processes, but its purpose is purely protective, not performance-related.

Students may confuse BPDU Guard with disabling STP because it prevents BPDU processing on the port, but STP is still running globally and on other ports.

Both features are commonly applied to access ports for security, leading to confusion between BPDU Guard and port security's MAC address limiting.

192.168.14.207 is the broadcast address of the previous /28 subnet (192.168.14.192/28), not the subnet containing 192.168.14.222.

192.168.14.208 is the network address (subnet ID) of the /28 subnet containing .222, not the broadcast address.

192.168.14.224 is the network address of the next /28 subnet (192.168.14.224/28), not the broadcast of the current subnet.

If the question asked for the broadcast address of a different subnet, such as 192.168.14.192/28, then option A (192.168.14.207) would be correct, as it would be the broadcast address for that specific subnet.

If the question specified a subnet mask of /29 instead of /28, and the host address was 192.168.14.208, then option C would be the correct answer as the broadcast address would be 192.168.14.215 for that subnet.

If the question specified a subnet mask of /27 instead of /28, the address 192.168.14.224 would be the broadcast address for the subnet 192.168.14.192/27, which encompasses the range from 192.168.14.192 to 192.168.14.224.

A student might miscalculate the subnet boundaries or confuse the broadcast address with that of an adjacent subnet.

Students often confuse the network address with the broadcast address, especially when they know the subnet starts at .208.

A student might incorrectly add the block size (16) to the host address or think the broadcast is the next network address.

This ordering is used when configuring OSPF over NBMA networks such as Frame Relay or ATM, where the Attempt state is introduced.

Candidates may confuse the order of states after ExStart, thinking Loading follows immediately, or they may forget the Attempt state on NBMA.

Candidates might think Init (receiving Hello) comes before Attempt (sending Hello) because they consider receiving as the first step, but the state machine defines Attempt as the state after sending Hello.

PortFast is a spanning-tree feature for switch ports, not related to VTY line protocols.

DHCP snooping is a Layer 2 security feature against rogue DHCP servers, irrelevant to Telnet/SSH access.

Increasing the OSPF hello interval affects OSPF neighbor discovery, not remote access to the router.

If the question were about optimizing switch port configurations for rapid connectivity in a network where VTY lines are used for management, then enabling PortFast could be the correct answer. For example, a question might ask how to reduce the time it takes for a switch port to become active after being connected.

If the question were about securing a network against unauthorized DHCP servers affecting devices that connect to the router, then using DHCP snooping would be the correct answer. In that scenario, the focus would be on protecting the network's IP address assignment rather than access protocols like Telnet or SSH.

If the question asked about optimizing OSPF performance in a network where OSPF is being used, increasing the hello interval could be correct. For instance, a scenario might involve reducing OSPF traffic in a stable network environment.

A student might confuse PortFast with a feature that speeds up or secures connections, but it is unrelated to VTY line configuration and is only applicable to switch ports.

The term 'snooping' might imply monitoring or blocking, leading a student to think it could restrict Telnet, but DHCP snooping is specifically for DHCP traffic and not for management protocols.

A student might think that increasing the hello interval could slow down or block Telnet sessions, but OSPF timers are unrelated to VTY line configuration and do not affect management access.

A lower AD would make it preferred, defeating the purpose of a floating route.

The primary route is removed from the table when the interface goes down.

Track objects are optional enhancements for faster failover but not mandatory for floating static operation.

Incorrect DNS settings prevent name resolution but do not affect IP address assignment. The workstation would still receive a valid IP from DHCP, not an APIPA address.

If the DHCP pool were exhausted, all workstations would fail to obtain addresses and use APIPA. The scenario states other workstations are working correctly, so pool exhaustion is not the cause.

A misconfigured default gateway would prevent internet access but the workstation would still receive a valid IP from DHCP. APIPA addresses are only assigned when DHCP fails entirely.

Students often confuse DNS issues with DHCP issues because both can cause internet connectivity problems. However, DNS does not impact IP address acquisition.

Students may think DHCP pool exhaustion is a common cause of APIPA addresses, but they overlook that it would affect multiple clients, not just one.

Since the symptom is no internet access, students might jump to gateway misconfiguration. However, the APIPA address indicates a DHCP failure, not a routing issue.

The route 'ip route 0.0.0.0 255.255.255.255 192.0.2.1' incorrectly uses a subnet mask of 255.255.255.255, which matches only the single host 0.0.0.0, not all unknown destinations. Therefore, it does not serve as a default route.

The route 'ip route 255.255.255.255 0.0.0.0 192.0.2.1' reverses the destination and mask fields, creating an invalid route that does not function as a default route or any valid static route.

'ip default-gateway 192.0.2.1' sets the default gateway for devices that do not perform routing, such as Layer 2 switches. It does not create a routing entry on routers and therefore cannot be used to send unknown IPv4 destinations.

If the exam question asked for a specific route to a single host (e.g., 'Which static route on R1 sends traffic only for the IP address 0.0.0.0 to next-hop address 192.0.2.1?'), then option A would be correct as it defines a route for that specific host.

This option would be correct in a scenario where the question asks for a route that matches a specific broadcast address, such as directing traffic for all broadcast packets to a next-hop address, which would be relevant in certain network configurations.

If the exam question asked for the command to set a default gateway for a Layer 2 device like a switch, then 'ip default-gateway 192.0.2.1' would be the correct answer, as it would direct traffic to the specified gateway for devices that do not have a specific route.

Students may confuse the all-zeros network address with a default route, but the mask is critical. Using a /32 mask is a common mistake when trying to create a default route.

Some test-takers might think that using all ones in the network field represents 'all networks', but this is incorrect. The default route uses all zeros for both network and mask.

The term 'default-gateway' sounds similar to 'default route', leading students to believe it is the correct command for routers. However, routers use the 'ip route' command for static routing.

This would be correct in a question asking to match services to problems in a deliberately scrambled, non-standard scenario where each service is misassigned to a different problem type, such as a trick question testing attention to detail rather than actual knowledge.

If the question asked to match services to problems they solve in a reversed or scrambled order where the pairs are intentionally misaligned but each service is paired with a problem it actually solves (e.g., DNS - name resolution, DHCP - IP assignment, etc.), then this option would be correct if the pairings were correct. However, here the pairings are incorrect.

This option would be correct if the question asked to match services to problems they solve in a reversed or misaligned manner, such as 'Match each service to a problem it does NOT solve' or 'Match each service to a common misconception.'

Candidates may confuse the functions of similar protocols (e.g., RADIUS vs TACACS+) or misremember which service solves which problem, especially under time pressure or when relying on superficial similarities like 'access' or 'remote'.

Candidates may confuse the functions of services (e.g., thinking DNS provides encryption due to DNSSEC, or mixing up DHCP and FTP roles) or misread the matching pairs, leading to a plausible but incorrect assignment.

Candidates may confuse the functions of similar services (e.g., RADIUS vs. TACACS+) or misremember which service handles encryption, file transfers, or IP configuration, leading to swapped mappings.

A native VLAN mismatch does not cause all other VLANs to stop forwarding. The trunk continues to forward frames for all VLANs, but untagged frames (native VLAN) are miscommunicated.

A trunk port does not automatically convert to an access port due to a native VLAN mismatch. The trunk remains operational, but the native VLAN mismatch causes problems for untagged traffic.

STP continues to run normally on the trunk link despite a native VLAN mismatch. The mismatch does not disable STP; it only affects the handling of untagged frames.

In a different scenario, if the question stated that a switch was configured to drop all VLAN traffic except the native VLAN due to a specific security policy, then this option could be correct. This would imply a configuration that restricts forwarding based on VLAN settings.

In a different scenario where the question states that a trunk port is configured incorrectly and the switch is set to automatically convert misconfigured ports, option C could be correct. For example, if the exam asks what happens when a trunk port is misconfigured and the switch has a feature enabled that forces a trunk to revert to access mode, then this option would apply.

In a different scenario where the question specifies that a trunk link has been configured to disable STP for performance reasons, a native VLAN mismatch could lead to STP being disabled, making this option correct. The question would need to clarify that STP behavior is altered due to specific configurations.

Students might think that a misconfiguration on the native VLAN would disrupt all VLAN traffic, but in reality, only the native VLAN traffic is affected.

Some might confuse a native VLAN mismatch with other trunk misconfigurations that cause the port to revert to access mode, such as a VLAN mismatch on a DTP negotiation.

Students may think that any misconfiguration on a trunk would cause STP to shut down the port for safety, but STP only blocks ports to prevent loops, not due to native VLAN mismatches.

Subnet masks are used solely for IP addressing and routing purposes, not for name resolution. Hostname-to-IP-address resolution is performed by the Domain Name System (DNS), which is a completely different protocol and service.

Subnet masks do not provide any encryption or security functionality. Encryption of packets is performed by protocols such as IPsec, TLS, or other cryptographic mechanisms, which operate independently of subnet masking.

A default gateway is still required for any traffic destined to a different subnet. The subnet mask only defines the local network boundary; it does not provide routing to other networks. Without a default gateway, a host cannot send packets off its subnet.

If the exam question were to ask about the functions of DNS or the process of hostname resolution, then option C would be correct. For example, a question might ask, 'What is the primary function of a DNS server in a network?'

If the exam question asked about the functions of network security protocols or methods for securing data transmission over IP networks, then option D could be correct. For instance, a question might ask which methods encrypt packets before transmission, where encryption is a key focus.

In a question that asks about network configurations in a scenario where all devices are on the same subnet and no external routing is required, one might argue that a default gateway is unnecessary, making this option seem correct.

Students often confuse the roles of different network layer functions. Since subnet masks are involved in IP addressing, they might mistakenly think they also handle name resolution, especially when studying both topics in the same context.

The term 'mask' might be misinterpreted as something that hides or protects data, leading some students to incorrectly associate it with encryption or security features.

Some students might think that if a subnet mask defines the local network, then all destinations within that mask are reachable directly, and they might overlook the need for a gateway to reach external networks.

Candidates might think starting the capture first is intuitive, but the capture point must be defined beforehand.

Candidates might think exporting can be done at any time, but the capture must be stopped to ensure data integrity.

Candidates may confuse the order, thinking start/stop can be done before configuration, but the capture point must be set first.

Separate WLANs do not eliminate the need for wireless security; both employee and guest WLANs require encryption (e.g., WPA2/WPA3) and authentication mechanisms to protect data in transit and prevent unauthorized access.

Roaming problems, such as handoff delays or authentication re-requirements, are not automatically resolved by having separate WLANs; they depend on factors like controller configuration, AP placement, and roaming protocols (e.g., 802.11r).

Separate WLANs do not replace the need for VLANs or policy controls; in fact, they often rely on VLANs to segregate traffic and on additional policies (e.g., ACLs, firewall rules) to enforce access restrictions between the WLANs and the network.

In a question that asks about the benefits of a completely unmanaged wireless environment, where security measures are not a concern, this option could be correct if it implies that security is not needed due to the nature of the network.

In a question focused on the benefits of advanced wireless technologies, such as a new protocol that inherently resolves roaming issues, this option could be correct if the context is about a specific feature that eliminates roaming problems.

In a question focused on network architecture where the context is about simplifying network management by using WLANs instead of VLANs, option E could be correct. For instance, if the question states that WLANs inherently manage segmentation without additional configurations, this option would apply.

A student might think that because guests are isolated, security is less critical, but in reality, guest WLANs still need security to prevent eavesdropping and misuse.

Students may confuse the concept of separate SSIDs with improved roaming, but roaming issues are related to mobility and network design, not just SSID separation.

A test-taker might assume that separate WLANs inherently provide full segmentation, but VLANs and policies are still required for Layer 2/3 separation and granular control.

192.168.50.159 is the broadcast address for the 192.168.50.128/27 subnet, not the network address. The broadcast address is used to send packets to all hosts in the subnet and cannot be assigned to a host.

192.168.50.160 is the network address of the next /27 subnet (160-191), not the subnet containing 158. The /27 mask creates subnets with a block size of 32, so the subnet boundaries are multiples of 32.

192.168.50.96 is the network address of the 96-127 /27 subnet, which is an earlier subnet. The address 158 falls in the 128-159 range, not the 96-127 range.

If the question asked for the last usable host address in the subnet 192.168.50.128/27, then 192.168.50.159 would be the correct answer, as it is the highest address before the broadcast address.

In a different question where the subnet mask is /26 and the host address is 192.168.50.158, the network address would be 192.168.50.128, making 192.168.50.160 a valid host address within that subnet.

If the question asked for a network address within a different subnet using a /25 mask, such as 192.168.50.96/25, then option D would be correct as it would represent the network address for that subnet.

Students might confuse the last usable host address (158) with the broadcast address (159) or think that the network address is the highest number in the range.

A student might miscalculate the subnet boundaries by using a block size of 32 but starting from 0 incorrectly, or they might think 158 is closer to 160 than to 128.

Students might incorrectly calculate the subnet by using a block size of 32 but starting from 96 instead of 128, or they might confuse the subnet mask and think the network address is 96.

SSH is more secure than Telnet, so this option incorrectly suggests it is less secure and requires compensation.

Logs record activity but do not automatically enforce ACL policy; enforcement is a separate function.

Source IP restriction limits allowed hosts but does not replace the need for user authentication.

In a different exam scenario where the question states that SSH is being used in an environment with known vulnerabilities or outdated configurations, the statement could be correct if it emphasized the need for additional security measures due to perceived weaknesses in SSH implementation.

If the exam question stated that logging was an active mechanism for enforcing security policies, such as in a scenario where logs trigger automated responses to unauthorized access attempts, then this option could be correct.

In a different scenario where the question states that a network is entirely secured through IP whitelisting, and no other authentication methods are in place, then the option could be correct. For example, if the question specifies a legacy system that only allows access based on IP addresses without user credentials, then source IP restriction could be seen as a replacement for authentication.

A student might confuse the relative security of protocols or think that because additional controls are needed, SSH must be weak. However, the need for layered security does not imply SSH is inferior to Telnet.

A test-taker might think that logging can automatically trigger actions (like blocking), but standard logs are passive. Some systems can correlate logs with automated responses, but that is not inherent to logging.

A student might think that if only certain IPs are allowed, then anyone from those IPs is trusted, ignoring the need for user-level authentication. This is a common misconception about network access control.

Manually configuring a link-local address with the eui-64 keyword is invalid; link-local addresses are automatically generated.

This option does not include the required ipv6 enable command, so it does not satisfy the explicit scenario requirement.

Uses a static host address (::1/64) instead of the eui-64 keyword, so the interface ID will not be generated from the MAC address.

Candidates might think they need to explicitly configure the link-local address with EUI-64, similar to the global unicast address.

Candidates might assume that configuring a global unicast address automatically enables IPv6 and generates a link-local address, but that is not the case.

Candidates might think that manually specifying the interface ID is acceptable, but the question explicitly requires EUI-64.

DHCP does not translate private addresses to public; that is the function of NAT.

DHCP does not replace the need for subnet masks and default gateways; it actually provides them automatically.

DNS and DHCP operate at the Application Layer (Layer 7), not Layer 1.

If the exam question asked about protocols that manage address translation in a network, specifically focusing on how private IP addresses are converted to public addresses for internet access, then this option would be correct in that context.

In a question that asks about technologies that eliminate the need for traditional network configuration methods, such as static IP addressing, this option could be correct if it implies that DHCP automates configuration, thus reducing manual entry of subnet masks and gateways.

In a question that asks which technologies operate at Layer 1, if the context is expanded to include only Layer 1 devices or protocols, one might mistakenly categorize DHCP and DNS as Layer 1 technologies due to their reliance on physical network infrastructure for communication.

Students may confuse DHCP with NAT because both involve IP address management and are often used together in networks. The term 'translate' might be loosely associated with DHCP's role in assigning addresses, leading to this misconception.

Because DHCP automates the assignment of these parameters, some may incorrectly think it eliminates the need for them altogether. However, the parameters are still essential for network communication; DHCP just delivers them dynamically.

Students might mistakenly think that because DNS and DHCP are fundamental network services, they belong to lower layers. Additionally, the term 'Layer 1' might be confused with 'Layer 2' or 'Layer 3' due to incomplete understanding of the OSI model.

BPDU Guard results in err-disable, which is not reflected in the show spanning-tree inconsistentports output. The exhibit clearly shows Root Inconsistent, indicating Root Guard, not BPDU Guard.

Loop Guard creates a loop-inconsistent listing, not root-inconsistent. The command output explicitly indicates Root Inconsistent, ruling out Loop Guard.

Without BPDU Guard, PortFast does not react to BPDUs with a blocking state. The exhibit's root-inconsistent inconsistency is specific to Root Guard, not PortFast or BPDU Guard.

The route 192.168.0.0/16 is less specific (larger subnet) than the matching /24 route. In longest prefix match routing, the more specific route (192.168.50.0/24) is always preferred for the destination 192.168.50.99.

A default route (0.0.0.0/0) is only used when no more specific route matches the destination. Since both 192.168.0.0/16 and 192.168.50.0/24 match 192.168.50.99, the default route is not considered.

Routers do not load balance between routes of different prefix lengths for the same destination. The longest prefix match rule selects a single best route. Both routes are not used equally; the /24 route is chosen.

In a different scenario where the router has only the route 192.168.0.0/16 and no more specific routes for 192.168.50.0/24, traffic to 192.168.50.99 would use the 192.168.0.0/16 route, making this option correct.

In a scenario where the router only has a default route configured and no specific routes for the 192.168.50.0/24 network, a question asking which route would be used for traffic to 192.168.50.99 would correctly identify the default route as the answer.

In a different scenario, if the question stated that both routes had equal administrative distances and were configured in a way that allowed for load balancing, then both routes could be used simultaneously for traffic to 192.168.50.99, making this option correct.

Students may think that because 192.168.50.99 falls within the 192.168.0.0/16 range, this route would be used. However, they overlook the principle of longest prefix match, which prioritizes the route with the longer subnet mask.

Students might think that if a default route exists, it could be used as a catch-all. However, the default route has the lowest priority and is only used when no other matching route exists.

Students may confuse this with equal-cost multipath (ECMP) where multiple routes with the same prefix length and metric are used. Here, the prefix lengths differ, so ECMP does not apply.

Changing the native VLAN to 30 would not resolve the issue because the native VLAN is used for untagged traffic on a trunk, and the problem is that VLAN 30 traffic is not being allowed at all. Additionally, native VLAN mismatch can cause connectivity issues, but it does not specifically prevent only VLAN 30 from reaching other VLANs.

Configuring the uplink as an access port would place it in a single VLAN, preventing traffic from multiple VLANs (including VLAN 30) from traversing the link. Since the switch needs to carry traffic for multiple VLANs, the uplink must remain a trunk port.

Disabling STP on VLAN 30 would be dangerous as it could cause bridging loops and network instability. Moreover, STP does not control whether a VLAN is allowed on a trunk; it only prevents loops. The issue is a missing VLAN in the trunk allowed list, not a spanning-tree problem.

In a different scenario where a network administrator is troubleshooting a switch that has been configured with a native VLAN of 30, and the requirement is to ensure that untagged traffic is handled correctly, changing the native VLAN to 30 would be appropriate if the design specifies that all untagged traffic should belong to VLAN 30.

In a different question context where the prompt indicates that a switch port must connect to a single VLAN and no inter-VLAN routing is required, stating that the uplink should be configured as an access port would be correct. For example, if the question specifies that all devices on the same VLAN need to communicate without routing, this option would be valid.

In a scenario where a question states that VLAN 30 is experiencing broadcast storms or loops, and the exam asks for a method to stabilize the network, disabling STP on VLAN 30 could be considered correct to allow for immediate traffic flow, assuming there are no other VLANs affected.

Students might confuse native VLAN with the VLAN that is allowed on the trunk, or think that setting the native VLAN to 30 would automatically permit VLAN 30 traffic.

Students might think that using an access port simplifies configuration, but they overlook the need to carry multiple VLANs between switches.

Students might associate STP with VLAN issues because STP operates per VLAN, but they incorrectly assume that disabling STP can fix connectivity problems caused by trunk misconfiguration.

Incorrect. The command switchport mode trunk is a Layer 2 switchport configuration and cannot be applied to an SVI, which is a Layer 3 interface. This does not affect DHCP relay.

Incorrect. The ip default-gateway command sets the default gateway for management traffic on a Layer 2 device and does not relay DHCP broadcasts. It does not restore DHCP service for clients.

Incorrect. The spanning-tree portfast command is used on physical Layer 2 switchports to speed up port transitions and has no effect on DHCP relay or SVIs.

In a different scenario where the question asks about configuring a switch port to allow multiple VLANs to pass through, 'switchport mode trunk' would be the correct answer. For example, if the question specified that VLAN 30 needs to communicate with other VLANs via a trunk link, this option would be appropriate.

In a scenario where the question asks for configuring a Layer 2 switch to communicate with a router for routing purposes, 'ip default-gateway 10.99.99.20' would be the correct answer if the switch needs to reach the DHCP server for clients on a different VLAN.

In a different scenario where the question asks about optimizing switch port configurations for end devices connected to VLAN 30, 'spanning-tree portfast' would be correct to reduce the time it takes for ports to transition to the forwarding state, improving connectivity for clients.

Students may confuse SVIs with physical switch ports and think that trunking is needed to carry VLAN 30 traffic, but SVIs are already associated with a VLAN and do not require trunk configuration.

The term 'default-gateway' might be associated with routing, and a student might think it helps forward DHCP requests, but it does not perform DHCP relay.

PortFast is a common feature that students learn, and they might incorrectly assume it helps with DHCP by reducing delays, but it does not address the need to forward DHCP broadcasts across subnets.

Candidates mistakenly think any non-FULL state implies a timer mismatch, overlooking that timer issues prevent even reaching 2WAY.

Some candidates assume any DR/BDR-related issue indicates a network type mismatch, but the exhibit clearly shows successful DR/BDR formation, ruling out this option.

Candidates may confuse LSA reachability with neighbor adjacency requirements. The 2WAY state proves basic connectivity is intact.

PortFast is a feature that allows a port to transition immediately to the forwarding state, bypassing the usual spanning-tree listening and learning phases. It does not cause a port to shut down or enter an err-disabled state; it only speeds up convergence for end-user devices.

Assigning an access VLAN (VLAN 30) simply places the port into a specific broadcast domain for user traffic. It has no mechanism to detect or react to BPDUs, and it does not cause a port to enter an err-disabled state. The port would remain operational regardless of the VLAN assignment.

Configuring a port as an access port is a standard practice for connecting end devices. It does not inherently cause any shutdown or err-disabled condition. The port remains up and forwarding traffic unless another feature, such as BPDU Guard, triggers a protective action.

In a different scenario, if the question asked about a port configured for PortFast that is connected to a device that sends BPDUs, the port could go into an err-disabled state due to BPDU Guard being enabled. In this case, PortFast would be the correct answer if the focus was on the immediate transition to forwarding.

In a different scenario, if the question asked about a switch port configured to allow only specific VLANs and a device that sends traffic on a VLAN not permitted on that port is connected, the Access VLAN assignment could lead to issues. In such a case, the port might be disabled due to VLAN mismatches or misconfigurations.

In a different scenario where an exam question asks about the effects of configuring a switch port in access mode with specific VLAN assignments and other settings, a candidate might be asked to identify the potential issues caused by misconfigurations that could lead to err-disabled states. In such a case, if the question specified that the access mode was incorrectly configured for a trunking scenario, this option could be correct.

Students often confuse PortFast with BPDU Guard because they are commonly configured together on edge ports. Since PortFast is involved in the scenario, it is tempting to think it is responsible for the shutdown, but the actual disabling action is performed by BPDU Guard.

A test-taker might think that the VLAN assignment could cause a conflict or misconfiguration leading to a shutdown, but VLAN assignment alone does not trigger any protective action. The confusion may arise from scenarios where VLAN mismatches cause issues, but those do not result in err-disabled state.

Some students may think that access mode is restrictive and could cause issues when connecting a switch, but access mode simply disables trunking. The actual cause of the shutdown is the reception of a BPDU, which is detected by BPDU Guard, not by the access mode configuration.

Believing that a static route is removed from the routing table when a better route exists, rather than understanding it remains but is inactive.

Assuming that a static route's next-hop must be directly attached, ignoring that recursive routing via another routing protocol or static route is allowed.

Thinking that recursive static routes are prone to loop suppression, rather than understanding that the route is simply withdrawn when the next-hop is no longer reachable.

Named accounts provide identification and authentication, but authorization (what actions an account can perform) is a separate control typically enforced via privilege levels, role-based access control (RBAC), or command authorization (e.g., using TACACS+). Replacing authorization with identity alone would violate the principle of least privilege.

Named accounts are protocol-agnostic and work with any management protocol, including SSH, HTTPS, and SNMPv3. Telnet is insecure and rarely used in modern networks; named accounts are actually more important with secure protocols to maintain accountability without compromising security.

Named administrative accounts are used across all network device administration, including routers, switches, firewalls, and wireless controllers. Wireless guest administration typically uses separate guest accounts or captive portal authentication, not administrative accounts.

In a scenario where a question asks if named administrative accounts can function independently without any authorization mechanisms, option C could be correct if it specifies that named accounts can be used in a context where no other access controls are enforced, such as in a poorly configured legacy system.

In a question that specifically asks about the limitations of administrative account usage in legacy systems or protocols, stating that named administrative accounts are only applicable to Telnet could be correct if the context is focused on outdated practices where SSH was not implemented.

If the exam question specifically asked about the purpose of administrative accounts in the context of managing wireless guest access, then this option could be correct. For example, a question could state, 'What is a primary function of named administrative accounts in wireless guest networks?'

Students may confuse authentication (who you are) with authorization (what you can do), thinking that a named account inherently defines permissions. In reality, authorization must be explicitly configured, often through AAA or local privilege levels.

A test-taker might associate named accounts with older protocols like Telnet because both are commonly discussed in the context of legacy network management. However, named accounts are a best practice regardless of protocol, and SSH is the standard for secure remote access.

The phrase 'guest administration' might lead a student to think of guest wireless networks, but administrative accounts are for managing the network infrastructure itself, not for guest access. The term 'administration' here refers to device management, not user services.

Candidates might fixate on the up/down status and assume encapsulation mismatch without considering the explicitly stated troubleshooting steps.

Students often associate up/down with missing clock rate, but the question precludes this by confirming correct configuration.

Some learners confuse Layer 3 problems (IP issues) with the line protocol status that reflects Layer 2 health.

Using 'ip ospf cost 65535' on the LAN interface only changes the OSPF metric for that interface. It does not prevent the router from sending or receiving OSPF Hello packets, so neighbor adjacencies can still form, which is not the desired behavior.

Disabling OSPF globally and redistributing connected routes is an overly complex and unnecessary approach. It does not selectively stop Hello packets on the LAN interface and can introduce routing complexity and instability.

Converting the LAN interface to a loopback interface changes the interface type entirely and is not a standard or practical solution for suppressing OSPF Hellos on a LAN. Loopbacks are logical interfaces used for router IDs and testing, not for controlling OSPF Hello behavior.

In a scenario where the question asks for a method to influence OSPF path selection without needing to suppress Hello packets, setting the OSPF cost to 65535 could be correct. For example, if the question specifies that the goal is to manipulate OSPF metrics for routing decisions without affecting neighbor relationships.

If a question asked how to completely eliminate OSPF from a router while still allowing connected routes to be advertised through another routing protocol, then disabling OSPF globally would be the correct approach.

If the question asked for a method to isolate OSPF routing from a specific segment of the network while still allowing the interface to function normally for other purposes, converting the LAN interface to a loopback could be a valid solution, as loopbacks are often used for management or routing purposes without direct user connectivity.

Students might think that setting a very high cost could effectively suppress OSPF operations on the interface, but cost only affects route selection, not protocol behavior like Hello transmission.

A test-taker might consider this option because redistribution can advertise routes without running OSPF on the interface, but they overlook that disabling OSPF globally affects all interfaces and requires additional configuration to re-advertise routes.

Students might confuse the passive-interface concept with loopback interfaces, thinking that loopbacks do not send Hellos (which is true), but this approach is impractical and alters the network design unnecessarily.

Point-to-point links connect only two routers directly and do not require or perform DR/BDR elections because there is no need to reduce flooding on a single link. Selecting this option is incorrect for Ethernet interfaces that default to broadcast.

Point-to-multipoint nonbroadcast network type requires manual neighbor configuration and does not perform DR/BDR elections by default. This does not match the default behavior of Ethernet interfaces.

Loopback interfaces are virtual interfaces used for router identification and do not participate in OSPF DR/BDR elections because they are not multiaccess networks.

If the question were to ask about OSPF network types that do not require DR and BDR elections, such as in a scenario involving a direct link between two routers, then 'Point-to-point' would be the correct answer.

If the exam question asked which OSPF network type supports multiple connections to a central point without requiring a broadcast medium, or if it focused on scenarios involving non-broadcast multi-access (NBMA) networks, then point-to-multipoint nonbroadcast would be the correct answer.

If the question were to ask about the OSPF network type that is used for router identification or for creating a stable OSPF endpoint, then Loopback would be the correct answer. For example, a question could specify the importance of using Loopback interfaces for OSPF router IDs.

Students may confuse point-to-point with Ethernet because both can be used on point-to-point Ethernet links, but the default OSPF network type on Ethernet is broadcast, which triggers DR/BDR election.

The term 'nonbroadcast' might confuse students into thinking it applies to Ethernet when they consider scenarios without multicast, but Ethernet inherently supports broadcast, making this type incorrect.

Students might think loopback interfaces participate in OSPF elections because they can be advertised in OSPF, but they are not multi-access and thus do not require DR/BDR.

Option C is incorrect because NetFlow does not replace routing protocols; it is a monitoring technology that provides visibility into traffic flows but does not perform routing functions or influence path selection.

Option D is incorrect as NetFlow is unrelated to wireless encryption protocols. Wireless encryption standards like WPA2 or WPA3 handle security, whereas NetFlow focuses on traffic flow monitoring.

Option E is incorrect because NetFlow does not eliminate the usefulness of Syslog. Syslog provides event logging and system messages, which complement NetFlow’s traffic flow data for comprehensive network monitoring.

In a question asking about the benefits of using a comprehensive network monitoring solution that integrates multiple functionalities, including traffic analysis and routing management, this option could be correct if it states that a specific tool replaces the need for traditional routing protocols in a simplified network environment.

If the exam question asked about the primary functions of wireless security protocols or the best practices for securing guest access in a wireless network, then this option could be correct. In that context, identifying the main wireless encryption protocol would be relevant.

In a question asking about the advantages of using NetFlow over traditional logging methods, one might state that NetFlow eliminates the need for Syslog in certain scenarios, such as when only traffic flow data is required and no event logging is necessary.

Students might confuse NetFlow with routing protocols because both involve network traffic, but NetFlow is about monitoring existing traffic, not making forwarding decisions. The word 'flow' might be mistakenly associated with routing.

The term 'flow' might be confused with 'Wi-Fi' or 'wireless' in some contexts, and students may think NetFlow is related to wireless security because both are network-related. However, NetFlow has no role in encryption.

Students might think that since NetFlow provides detailed traffic information, it could replace Syslog for monitoring. However, Syslog captures different data (e.g., interface status changes, authentication failures) that NetFlow cannot provide.

A DHCP scope handles address assignment and has no role in traffic conversation visibility.

An STP priority manages spanning-tree topology and does not provide bandwidth usage details.

A larger OSPF metric affects routing path selection but does not reveal which conversations are using bandwidth.

In a scenario where the question asks about expanding IP address availability in a network with multiple subnets experiencing address exhaustion, adding another DHCP scope could be the correct answer to ensure devices can obtain IP addresses.

In a scenario where the question asks about optimizing network performance by adjusting STP settings to prevent loops or improve redundancy, selecting a new STP priority could be correct. For example, if the question focuses on reducing broadcast storms in a VLAN environment, adjusting STP priority could be the right answer.

In a scenario where the question asks about optimizing OSPF routing performance or managing traffic flow in a congested network, increasing the OSPF metric for certain routes could be the correct answer. This would prioritize other routes and potentially alleviate congestion.

Students might confuse DHCP with network monitoring tools because DHCP is involved in network configuration, but it has no capability to report on traffic conversations.

Students might think that STP priority affects traffic paths and thus could help identify conversations, but STP only controls the logical topology for loop prevention, not traffic monitoring.

Students might associate OSPF metrics with traffic engineering and assume they can help identify bandwidth hogs, but metrics only influence routing decisions, not monitoring.

LACP does not use 'auto' and 'desirable' modes; those are PAgP modes.

The 'show etherchannel summary' command does not display LACP system priority; that is shown via 'show lacp sys-id' or 'show etherchannel detail'.

An EtherChannel can be formed even if member ports use different LACP modes (e.g., active and passive), as long as at least one side is active.

Students often confuse LACP and PAgP modes because both protocols are used for link aggregation. Since 'auto' and 'desirable' are well-known PAgP modes, test-takers with partial knowledge may mistakenly associate them with LACP.

Test-takers might think that because 'show etherchannel summary' provides a high-level view of EtherChannel, it would include LACP system priority. However, that information is considered detailed and is only available in more specific commands.

Students might assume that all ports must use the same mode for consistency, similar to other configuration parameters like speed and duplex. However, LACP is designed to allow mixed modes as long as negotiation is possible.

Incorrect because a default route is the least specific route and does not make routes more specific; it serves as a catch-all for unknown destinations.

Incorrect because interface addressing is mandatory for routing to function properly; a default route does not replace the need for IP addresses on interfaces.

Incorrect because default routes influence packet forwarding decisions and have no impact on VLAN assignments, which are Layer 2 configurations.

In a scenario where a question asks about route summarization or optimization techniques in a complex network with multiple subnets, stating that a default route can make routes more specific could be correct if discussing how it simplifies routing decisions by summarizing multiple routes into one.

In a question about a router configuration where a network is entirely using a point-to-point link with no local subnets, and the question asks if a default route can eliminate the need for interface addressing, this option could be considered correct as the context implies a simplified setup.

In a different scenario, a question might ask about network segmentation strategies in a multi-VLAN environment where a network administrator needs to ensure all traffic from users is confined to a specific VLAN for security or management purposes. In that case, the option could be correct if the context involves forcing users into a designated VLAN.

Students might confuse the default route with route summarization or aggregation, which can make routes more specific by combining them. However, the default route is the opposite—it is the most general route.

Some learners might think that a default route can serve as a substitute for proper addressing because it directs all traffic to a single next hop, but addressing is still required for the router to function at Layer 3.

Test-takers might associate 'default' with a default VLAN (VLAN 1) or think that a default route somehow forces traffic into a single VLAN, but these are unrelated concepts.

The interface status shows 'up, line protocol is down', which indicates a Layer 2 issue, not a physical cable fault. Additionally, no CRC, runts, giants, or collisions are reported, so the cable is likely not faulty.

The interface status is 'up, line protocol is down', not 'err-disabled'. The err-disabled state would show 'err-disabled' in the interface status, and a shutdown/no shutdown would be appropriate only for err-disabled recovery.

The interface status is 'up', not 'administratively down'. An administratively down interface would show 'administratively down, line protocol is down'. VLAN configuration issues typically cause the interface to be up/up but unable to forward traffic, not up/down.

Students often assume that any connectivity problem is due to a bad cable, especially when the interface is up/down. However, the absence of physical layer errors suggests the cable is fine.

Students may confuse the 'up/down' state with an err-disabled state, as both can cause connectivity loss. However, err-disabled is a specific condition triggered by port security or other violations.

Students might think VLAN misconfiguration can cause the interface to go down, but VLAN issues usually affect Layer 3 connectivity, not the line protocol state of a trunk or access port.

192.168.50.127 is the broadcast address for the lower /25 subnet (192.168.50.0/25), not the subnet containing 192.168.50.130. Since the host IP is in the upper subnet, this option is incorrect.

192.168.50.128 is the network address of the upper /25 subnet (192.168.50.128/25), not the broadcast address. Network addresses cannot be assigned to hosts or used as broadcast addresses, so this option is incorrect.

192.168.50.254 is a valid usable host address within the upper /25 subnet. It is not the broadcast address, so this option is incorrect.

In a different scenario where the subnet mask is /25 and the network address is 192.168.50.0, the broadcast address for the subnet would be 192.168.50.127. A question could ask for the broadcast address of the subnet 192.168.50.0/25, making this option correct.

If the question specified a subnet mask of /25 for the address 192.168.50.128, then option B would be correct as the broadcast address for that subnet would be 192.168.50.255, and the first usable address would be 192.168.50.129.

If the question specified a subnet mask of /24 instead of /25, then 192.168.50.254 would be the broadcast address for the subnet 192.168.50.0/24, as it would cover the range from 192.168.50.0 to 192.168.50.255.

Students often confuse the broadcast address of the lower subnet with that of the upper subnet, especially when the host IP is close to the subnet boundary.

Some might think that the first address after the subnet boundary is the broadcast, but it is actually the network address. The broadcast is the last address in the range.

Students might assume that the last usable host address (.254) is the broadcast, but the broadcast is actually the very last address (.255) in the subnet.

JSON is a lightweight data-interchange format, not a transport protocol. HTTPS is a secure version of HTTP used for communication, and JSON does not replace it; instead, JSON data is often transmitted over HTTPS.

JSON is a platform-independent data format used by many APIs and services, not just Cisco DNA Center. It is supported by virtually all programming languages and is a standard for web APIs across different vendors.

JSON does not use XML tags; it uses a syntax of curly braces, colons, and commas to define objects and arrays. XML uses angle brackets for tags, which is a different markup language.

If the exam question stated that JSON is a protocol designed to facilitate data transfer over the internet, and it was framed in a context where JSON was being compared to other transport protocols, then option A could be considered correct.

If the question were framed to ask about a proprietary API that only supports JSON for data interchange within Cisco DNA Center, then this option could be considered correct in that specific context.

If the question were to ask about a data format that requires XML tags for structuring data, such as in a comparison between XML and JSON, then this option would be correct. For example, a question could ask, 'Which format requires tags to define objects?'

Students might confuse JSON with a protocol because it is commonly used in API communications, leading them to think it is a transport protocol rather than a data format.

A student might associate JSON with Cisco DNA Center because it is commonly used in Cisco's REST APIs, but this does not mean it is exclusive to that platform.

Students might confuse JSON with XML because both are used for data interchange, but they have distinct syntaxes. The mention of 'tags' is a clear indicator of XML, not JSON.

If the question asked 'Which HTTP method is used to retrieve a resource?' then 'GET - Retrieve a resource' would be correct. Alternatively, if the question was about a non-standard API that uses GET for creation (which violates REST principles), but this is not typical for the exam.

If the question asked 'Which method is used to submit data to create a new resource?', then POST would be correct.

In a question asking 'Which HTTP method is used to replace an entire resource?' or 'Which method is idempotent and updates a resource by sending a complete representation?', PUT would be correct.

Candidates may confuse GET with POST because they know both can send data, or they might think 'GET' can create resources if the server processes query parameters to create something, which is a common misconception.

Candidates may confuse POST with GET because both can send data, but they forget that POST is for creation/submission, not retrieval.

Candidates may confuse PUT with PATCH, or think 'update' broadly applies to PUT, overlooking the 'partial' distinction.

WPA2 and WPA3 are security protocols, not radio frequencies. 802.11 radio frequencies refer to bands like 2.4 GHz and 5 GHz, which are unrelated to security standards.

Trunk ports are a concept in switched networks for carrying multiple VLANs, typically using 802.1Q tagging. WPA2 and WPA3 have nothing to do with switch port configuration.

WPA3 does not eliminate the need for SSIDs; SSIDs are still required to identify and differentiate wireless networks. WPA3 focuses on authentication and encryption, not network identification.

If the exam question asked about the naming conventions of wireless standards and their association with specific frequency bands, then this option could be correct if it referred to a hypothetical scenario where WPA2 and WPA3 were misinterpreted as frequency designations.

If the exam question specifically asked about types of network configurations or VLAN implementations, a statement about WPA2 and WPA3 being types of trunk ports could be correct in a hypothetical context where the question mistakenly conflates wireless security with network topology.

If the exam question were to ask about a hypothetical future wireless security standard that integrates SSID-less connections, then this option could be correct. For example, a question might state, 'What advancements in wireless security protocols eliminate the need for SSIDs?'

Students might confuse the '802.11' in Wi-Fi standards with security protocols, or mistakenly think that WPA versions correspond to different frequency bands.

The term 'trunk' might be confused with 'wireless' due to similar-sounding terminology, or a student might incorrectly associate security with port types.

A student might think that newer security standards remove older concepts like SSIDs, or confuse SSID with security features like pre-shared keys.

The specific factual error is that IP routing is not enabled by default; it requires the 'ip routing' global command.

The specific factual error is that the native VLAN must match on both sides; changing R1's native VLAN to 1 does not match the switch's native VLAN 99.

The specific factual error is that the subinterface G0/0.20 is associated with VLAN 20, so its encapsulation must be dot1Q 20, not 10.

Candidates may assume that a router automatically routes between interfaces, but in Cisco IOS, routing must be enabled globally.

Candidates might think that native VLAN 1 is the default and acceptable, but the switch has been configured with native VLAN 99, so R1 must match that.

Candidates might confuse the VLAN IDs or think that correcting the native VLAN is sufficient, but the subinterface encapsulation must match the VLAN it serves.

logging trap 4 sets the severity to warning (4), so it does not include notifications (5).

The missing source interface causes NTP to use an incorrect source address, likely resulting in unsynchronized status.

The NTP server address is incorrect and 'logging trap 7' sends all debug messages instead of limiting to notifications and above.

Candidates might think that using the numeric value is acceptable, but the question explicitly mentions the keyword, so the answer using the keyword is more precise.

Candidates may forget to specify the source interface, especially if they assume the router will automatically use the loopback interface.

This option reflects the misconfigured state mentioned in the question, so candidates might think it is the correct fix, but it actually perpetuates the errors.

This option is incorrect because a directly connected route, even though it has a lower administrative distance, does not override a more specific OSPF route due to prefix length precedence.

This option is incorrect because routers do not use multiple routes equally when one route is a more specific match; only the best matching route is used for forwarding.

This option is incorrect because routers can compare and select routes from different sources; differing sources do not prevent route usage if one route is the best match.

In a scenario where the OSPF route is down or not available, and the question asks which route would be used for the destination, the directly connected broader route would then be the correct answer as it would be the only available route.

In a different question where both routes are equally preferred due to equal administrative distances or when using a routing policy that allows for load balancing, the exam could state that both routes are valid and can be used simultaneously for the destination prefix.

In a different scenario, if the question stated that both routes were from different routing protocols and the router was configured to not use OSPF routes due to administrative distance settings, then this option could be correct, indicating that neither route would be used.

Students might think that directly connected routes have a lower administrative distance (0) than OSPF (110), so they would be preferred. However, prefix length takes precedence over administrative distance in the route selection process.

Students may confuse this scenario with ECMP, where multiple routes to the same destination are used for load balancing. However, ECMP requires identical prefix lengths and metrics, not different prefix lengths.

Students might think that routes from different sources are incomparable or that administrative distance alone determines the winner. However, prefix length is the primary factor, and different sources are compared normally.

Replacing a failed power supply is a physical hardware task that requires hands-on intervention, not a software-based or configuration task that network automation tools can perform.

Tracing a cable by hand is a physical, manual task that cannot be automated with network automation tools, which focus on software-based configuration and monitoring.

Listening for fan noise is a physical inspection task that relies on human senses and cannot be performed by network automation software, which deals with digital data and configurations.

In a question asking about tasks that involve hardware maintenance or physical repairs in a network environment, such as 'Which tasks can be performed by on-site technicians?', option B would be correct as it directly relates to hardware replacement.

If the exam question asked for tasks that require physical interaction or manual troubleshooting in a network environment, then tracing a cable would be appropriate. For example, a question might ask for tasks that involve identifying physical connectivity issues in a data center.

If the exam question asked for tasks related to environmental monitoring or physical maintenance of network equipment, then listening for fan noise could be considered a valid task. For example, a question might ask which tasks can help ensure optimal hardware performance in a data center.

Students might think that any repetitive task in network operations is automatable, but automation primarily targets software-configurable tasks, not physical hardware replacements.

Students might confuse cable tracing with tasks like network discovery or topology mapping, which can be automated, but physical tracing remains a manual process.

Students might think that environmental monitoring (e.g., via sensors) is automatable, but the specific act of listening by ear is not a digital workflow.

NTP (Network Time Protocol) is responsible for synchronizing clocks across devices but does not handle hostname resolution or IP address translation, so it cannot cause hostname access failures.

QoS (Quality of Service) manages traffic prioritization and bandwidth allocation but does not perform any function related to hostname resolution or IP address translation.

HSRP (Hot Standby Router Protocol) provides gateway redundancy and failover but does not influence DNS or the ability to resolve hostnames to IP addresses.

If the exam question asked about issues related to time synchronization affecting application performance that relies on timestamps, NTP could be the correct answer. For example, if users are experiencing problems with logging or data integrity due to time discrepancies, NTP would be the service to check.

In a scenario where a question asks about troubleshooting network performance issues related to bandwidth allocation or latency, QoS would be the correct service to check first. For instance, if users report slow access to a server by both IP and hostname, indicating potential traffic shaping issues.

In a scenario where the question asks about ensuring high availability and failover for multiple routers in a network, HSRP would be the correct answer. For example, if users are unable to reach a server due to a router failure, checking HSRP configurations would be appropriate.

Students might confuse NTP with DNS because both are network services, or they might think time synchronization is needed for hostname resolution, but that is incorrect.

Students might think QoS could block or delay DNS traffic, but the symptom is specific to hostname resolution, not performance. QoS issues would typically cause poor performance, not complete failure to resolve.

Students might confuse HSRP with DNS because both involve redundancy or failover, but HSRP is unrelated to name resolution. The symptom of being able to reach by IP but not hostname points to DNS, not gateway redundancy.

This option is incorrect because bandwidth does not determine whether a route is a default route. Default routes are about specificity and fallback behavior, not link speed or bandwidth.

This option is incorrect because the default route is the least specific route, not more specific than others. It matches all destinations not covered by other routes, so it cannot be more specific.

This option is incorrect because default routes can be learned through various routing protocols such as OSPF, EIGRP, or configured statically. It is not exclusive to OSPF.

In a question asking about the characteristics of routing protocols and their performance metrics, if it specified that the default route is always chosen when bandwidth is the primary consideration, this option could be correct. For example, if the question stated that the default route is selected based on bandwidth constraints in a specific network configuration.

In a different scenario, if the question asked about a routing protocol that uses a default route as a more specific option for certain traffic, such as a specialized routing setup in a lab environment, this option could be correct. For example, if a question stated that a specific routing protocol treats a default route as a specific route for certain traffic classes, option C could be valid.

If the question asked specifically about OSPF and its ability to learn routes, a scenario could involve discussing OSPF's limitations in certain configurations where a default route is only propagated through OSPF, making this option correct in that context.

Students may confuse the concept of 'last resort' with a route that has poor performance characteristics, such as low bandwidth, or they might mistakenly associate default routes with backup links that have lower bandwidth.

The phrase 'route of last resort' might be misinterpreted as 'most specific' because it is the final option, but in routing terminology, specificity refers to prefix length, not priority.

Students may recall that OSPF can generate a default route using the 'default-information originate' command, leading them to incorrectly assume that OSPF is the only way to learn a default route.

Confusing DTP trunk negotiation with the operational consequences of a native VLAN mismatch.

Assuming that a crossover cable is mandatory for switch-to-switch connections, ignoring auto-MDIX.

Mistaking the ability to forward traffic for a specific VLAN with the ability to negotiate a trunk.

The native VLAN is used for untagged traffic on a trunk and does not affect the forwarding of tagged frames for other VLANs. Changing the native VLAN to 50 would not resolve the issue because VLAN 50 frames are still tagged and require inclusion in the allowed VLAN list.

An access port can only carry a single VLAN, so changing the trunk to an access port would prevent the link from carrying multiple VLANs, including VLAN 50. The link is intended to carry multiple VLANs, so a trunk is required.

PPP (Point-to-Point Protocol) is a WAN protocol used on serial links, not on Ethernet trunks. Ethernet trunks use 802.1Q or ISL encapsulation, and PPP has no relevance to VLAN trunking issues.

In a different scenario where the question specifies that both switches are configured with VLAN 50 as the native VLAN and that there is a requirement for untagged traffic to be sent on VLAN 50, this option would be correct. The question could ask about the implications of having mismatched native VLANs causing connectivity issues.

In a different scenario where the question specifies that a switch is incorrectly configured to use an access port for a connection that should carry multiple VLANs, changing the trunk to an access port could be the correct answer if the goal is to isolate traffic to a single VLAN.

In a different scenario where the question specifies that the switches are connected via a serial link requiring PPP for communication, and the configuration is incorrectly set to Ethernet, this option would be correct. The question might ask about the necessary protocol for inter-switch communication in a non-Ethernet environment.

Students often confuse the native VLAN with the concept of a 'management VLAN' or think that setting the native VLAN to the desired VLAN will automatically allow that VLAN across the trunk, but the native VLAN only affects untagged frames.

Some test-takers might think that if a specific VLAN is not working, converting the link to an access port and assigning it to VLAN 50 could solve the problem, but this would break connectivity for other VLANs and is not a proper solution for inter-switch VLAN communication.

Students might recall that PPP can be used for authentication or encapsulation on point-to-point links and mistakenly think it could be applied to Ethernet trunks, but PPP is not used in Ethernet switching environments.

The specific factual error is that OSPF is a dynamic routing protocol that must be enabled on both ends of a link for adjacency to form; one-sided configuration does not work.

The specific factual error is confusing subnet masks with wildcard masks; OSPF uses inverse masks in network statements.

The specific factual error is using a host wildcard mask that does not cover the actual interface IPs; the correct wildcard mask must include the range of IPs on the link.

Candidates might think that because the link is directly connected, OSPF will automatically discover neighbors without explicit configuration on both sides.

Candidates often mistakenly use subnet masks instead of wildcard masks because they are more familiar with subnet masks from IP addressing.

Candidates might think that using a host mask (0.0.0.0) is sufficient because the network statement is for the network address, but OSPF matches the interface IP, not the network address.

APIs are software interfaces that enable communication with the controller, but they do not replace forwarding devices like switches and routers. These devices still handle packet forwarding based on policies set via the controller; the controller does not eliminate the need for physical or virtual forwarding hardware.

APIs do not remove the need for authentication and authorization. In fact, secure API access typically requires credentials, tokens, or certificates to ensure only authorized users or systems can interact with the controller. Removing these controls would create severe security vulnerabilities.

APIs are software interfaces, not physical cabling standards. Ethernet cabling standards like Cat5e, Cat6, or fiber optics define physical layer specifications for wired network connections. Confusing APIs with cabling is a fundamental category error.

In a question focused on the theoretical aspects of network architecture, where the context is about a fully virtualized environment that abstracts traditional hardware, this option could be correct if it states that APIs can eliminate the need for physical forwarding devices in such a scenario.

If the exam question were to focus on a hypothetical scenario where an API is designed for a fully trusted internal network with no security concerns, it could state that authentication and authorization are not necessary, making this option correct.

If the exam question asked about networking standards or protocols related to Ethernet technology, such as 'Which of the following are standards for Ethernet cabling?' then option E would be the correct answer, as it would accurately describe a category of networking specifications.

A student might think that because the controller centralizes control and uses APIs for automation, the forwarding devices become unnecessary. However, the controller only manages the control plane; the data plane still requires forwarding devices to actually move traffic.

Some might assume that because APIs are automated, security checks are bypassed. However, automation does not imply lack of security; APIs enforce authentication and authorization to protect network resources.

The term 'interface' in networking can refer to both physical ports and software APIs. A student with limited exposure might mistakenly associate 'interface' with physical cabling, especially if they have not yet learned about software-defined networking concepts.

This option is incorrect because OSPF neighbor relationships do not depend on matching hostnames. Hostnames are administrative identifiers and do not affect OSPF protocol operations or LSA exchanges.

This option is incorrect because a /30 subnet is a standard subnet size for point-to-point links and does not prevent OSPF from operating or forming adjacencies. OSPF works normally over /30 subnets.

This option is incorrect because OSPF runs over routed interfaces and does not require interfaces to be configured as switch trunks. Trunking is related to VLAN tagging and switching, not OSPF adjacency.

In a different scenario, if the question specified that the routers were configured to use OSPF with a custom authentication method that required matching hostnames for verification, then this option could be correct. For example, if the routers were part of a security policy that mandates hostname verification for OSPF neighbor relationships.

In a different scenario, if the question stated that OSPF requires a minimum of a /29 subnet for its operation due to specific network design constraints or if it involved a multi-access network setup, then this option could be correct.

In a different scenario where the question involves OSPF running on a switch with multiple VLANs, and the interfaces are configured as access ports instead of trunk ports, this option could be correct. If the routers were connected through a switch that required trunking for OSPF to function, then this would be a valid cause for neighbor issues.

Students may confuse the requirement for matching hostnames in other protocols (like EIGRP) or think that OSPF uses hostnames for neighbor authentication, but OSPF does not require hostname matching.

Some might think that OSPF requires a larger subnet (like /24) because they associate OSPF with broadcast networks, but OSPF works fine with /30 on point-to-point links.

Students may confuse OSPF with VLAN routing or think that trunking is needed for OSPF to carry multiple VLANs, but OSPF operates at Layer 3 and does not require trunk ports.

Option B is incorrect because YANG does not replace IPv4 or IPv6 addressing schemes. IP addressing remains a core network function independent of data modeling languages.

Option C is wrong since YANG does not remove the need for routing protocols. Routing protocols like OSPF and EIGRP continue to operate and are configured using data models but are not replaced by them.

Option D is false because YANG’s scope is much broader than naming wireless SSIDs. It models a wide range of network configurations and operational data beyond wireless settings.

If the exam question asked about the evolution of network protocols and their roles in addressing schemes, or if it specifically inquired about the future of IP addressing, then option B could be correct in a context discussing the transition from IPv4 to IPv6.

In a question asking about the impact of automation on network architecture, if it stated that automation frameworks can streamline or simplify routing processes, this option could be considered correct in the context of discussing how certain automation tools might reduce the complexity of routing protocol management.

If the exam question asked specifically about the use of YANG in a context limited to wireless networking, such as configuring wireless access points or SSIDs, then option D could be correct. For example, a question might ask, 'What is a specific application of YANG in managing wireless network configurations?'

A student might confuse YANG with a protocol that modifies network layer addressing, or think that automation models can eliminate the need for traditional addressing, but YANG only structures how addressing is represented.

A test-taker might assume that automation and data models can replace dynamic routing by hardcoding routes, but YANG is about representation, not replacing functionality.

A student with limited exposure to YANG might only have seen it used in wireless contexts, such as modeling SSID parameters, and incorrectly assume that is its sole purpose.

This action is too drastic and impacts all ports, whereas the issue is specific to access ports connected to end devices. PortFast is the standard, safe method for eliminating delay on edge ports.

Candidates might think that turning off STP on a single VLAN is a quick fix, but it removes the safety net against loops and is not a recommended network practice. PortFast provides the immediate-forwarding benefit while preserving STP loop protection.

Candidates often assume that Rapid PVST+ immediately forwards on all access ports, but the edge port behavior must be configured. The scenario explicitly mentions the port is an access port connected only to a PC; the immediate fix is to enable PortFast, not change the entire STP mode.