CCNA 200-301 v2 (200-301) — Questions 676–750

The native VLAN is used for untagged traffic on a trunk and is typically VLAN 1 by default. It has no bearing on whether a specific tagged VLAN like VLAN 30 is carried; the allowed VLAN list controls that.

PortFast is a feature that speeds up the transition of an access port to the forwarding state, bypassing STP listening/learning. It does not affect trunk operation or whether a VLAN is carried on a trunk.

The commands `switchport voice vlan 150` and `switchport access vlan 20` are used on a Layer 2 switch port, not a routed interface. A routed WAN interface would require `no switchport` and an IP address configuration, which is not present here.

CAPWAP (Control and Provisioning of Wireless Access Points) is a protocol used for wireless LAN controller and access point communication, not for voice VLAN configuration. The voice VLAN feature is unrelated to CAPWAP.

The `switchport voice vlan` command only affects the specific access port where it is configured, not all trunk ports. The native VLAN on trunks is configured separately with `switchport trunk native vlan`.

Denying the inside subnet in the ACL would prevent any NAT translation from occurring, which would block all inside hosts from reaching the internet, not just limit access to one at a time.

Reversing inside and outside interface roles typically stops NAT from functioning entirely rather than allowing only one host at a time. The symptom points more directly to missing overload.

NAT is specifically designed to translate RFC1918 private IP addresses to public IP addresses. Saying NAT cannot be used with RFC1918 addresses is incorrect and contradicts common practice.

This option is incorrect because the next-hop IP address does not influence route preference. Cisco routers do not consider the numeric value of the next-hop IP when selecting routes.

This option is incorrect because the router does not prefer routes based on the order they were configured. Route selection depends on administrative distance and metrics, not configuration sequence.

This option is incorrect because route names or descriptions are only for human readability and do not enforce policy-based routing. Policy-based routing requires explicit configuration beyond naming.

Assigning an IP to the physical interface would prevent subinterfaces from working, and 'switchport mode trunk' is invalid on a router interface.

The problem is specifically that R1 cannot route between VLANs due to missing 'ip routing', not a trunk pruning issue.

Subinterfaces cannot be individually shut down; the physical interface controls the link state.

Option A states that the port goes err-disabled immediately, which matches the shutdown violation mode behavior, not restrict mode. Since the question specifies restrict mode, this option is incorrect.

Option C suggests that the switch instantly ages out the first learned MAC address to learn the third one, which is incorrect. Port security does not age out addresses immediately upon violation; the maximum limit is strictly enforced.

Option D claims that all traffic from the port is flooded to the VLAN for analysis, which is not how port security functions. Port security drops unauthorized traffic rather than flooding it, making this option invalid.

The specific factual error is that the permit statement does not exclude ports 80 and 443. It allows all TCP ports, which is too permissive.

The specific factual error is that the permit statements allow the very ports that should be denied for VLAN 20. This misinterprets the requirement.

The specific factual error is that the permit statement is too broad and overrides the deny statements. The correct approach is to permit only non-HTTP/HTTPS ports, not all ports.

The specific factual error is that the SVI IP must match the default gateway configured on the client; changing it to a different address would not fix the issue.

The specific factual error is confusing DHCP relay with routing; 'ip helper-address' does not affect the default gateway's ability to forward traffic.

The specific factual error is that an administratively down interface would cause complete loss of connectivity, not just internet access, and reloading is not a standard troubleshooting step for configuration issues.

The priority value 4096 is not used by the root primary command; it sets priority to 24576. Additionally, errdisable recovery does not immediately recover the port; it requires a timer.

Root secondary makes the switch a secondary root, not primary. An err-disabled port requires a shutdown before no shutdown to clear the error state.

BPDU filter does not trigger err-disable on BPDU reception; it silently drops BPDUs. BPDU Guard is needed to protect edge ports.

Severity levels are a fundamental part of the syslog protocol and are not limited to or used only by NTP.

Syslog defines eight severity levels (0 through 7), not four.

Candidates often prematurely blame security features when DHCP fails, ignoring the pool statistics right in front of them.

A common mistake is assuming that conflicts always fill up a pool, but the zero value directly disproves this.

Misunderstanding subnet sizing often leads candidates to blame the mask, but the exhibit confirms the mask is appropriate for the pool size.

Incorrect. Providing dashboards to end users is a function related to northbound APIs or management applications, not southbound APIs that interface with network devices.

Incorrect. DNS name resolution is unrelated to southbound APIs, which focus on device communication and management rather than network services like DNS.

Incorrect. Synchronizing switch clocks with NTP is a network service function independent of southbound APIs, which do not handle time synchronization tasks.

Incorrect because OSPF does not always override static routes. Administrative distance matters only when prefix lengths are equal, and longest-prefix match takes precedence over route source.

Incorrect because the static route does not have an administrative distance of 255; it is valid and installed in the routing table. The issue is the static route’s broader prefix, not its administrative distance.

Incorrect because the destination IP 198.51.100.70 falls within both the /24 static route and the /26 OSPF route. The router chooses based on prefix specificity, not exclusion from the routes.

The 'I' flag in the show command output indicates the port is in stand-alone mode, not err-disabled. An err-disabled interface would show as 'err-disabled' or have a 'D' flag, and BPDU guard violation would cause the port to be in err-disabled state, not stand-alone.

The show command output shows the port-channel interface as 'SU' (Layer2, in use), meaning it is operational. If the port-channel were down, all member ports would be affected, not just one. The issue is isolated to a single member port.

EtherChannel does not have a MAC address limit; each physical port retains its own MAC address. LACP can bundle up to 16 ports (8 active) without any MAC address exhaustion issue. This is not a realistic failure scenario.

Option A incorrectly states that the ip helper-address converts DHCP unicast replies into broadcasts. The command actually relays client broadcast requests as unicast to the server, not the reverse. This reverses the direction of the relay function and misunderstands the broadcast boundary issue.

Option C incorrectly claims the command provides DNS resolution for DHCP clients before they receive an address. DNS resolution is unrelated to the ip helper-address function, which only relays UDP broadcasts like DHCP requests and does not perform name resolution.

Option D mistakenly suggests that the command creates a static route to the DHCP server. Routing and static routes are separate functions; the ip helper-address does not affect routing tables but only relays broadcast traffic as unicast.

Candidates may associate local buffer behavior with remote logging, but the buffer is just local storage, independent of trap forwarding.

A reachability problem would affect all severities equally, not selectively filter only informational and debug messages.

Candidates may confuse console and trap logging, but each destination has its own independent severity level.

Static NAT requires a one-to-one mapping between an inside local address and an inside global address, which would consume multiple public IPs if multiple hosts need internet access. It does not allow multiple inside hosts to share a single public IP.

Policy-based routing (PBR) is used to override the routing table based on policies (e.g., source/destination IP, protocol), not to perform address translation. It does not modify IP addresses or enable multiple hosts to share a single public IP.

Port security is a switchport security feature that restricts MAC addresses allowed on a port to prevent unauthorized access. It does not perform IP address translation or enable internet access for multiple hosts.

The specific factual error: The 'ntp server' command does not have a 'source' parameter; source is set globally. Also, 'logging trap warnings' does not meet the requirement to send informational messages.

The specific factual error: 'logging trap debugging' sends all messages, including debugging (severity 7), which is unnecessary and can cause excessive log traffic. The requirement is for informational and above, which is severity 6, not 7.

The specific factual error: The default trap level may not be 'informational'; it is often 'warnings' or 'debugging' depending on the IOS version. The requirement to send informational messages necessitates explicit configuration of 'logging trap informational'.

LACP priority is not required for basic negotiation and does not cause a failure to bundle.

Active/active LACP successfully negotiates, so this is not the cause.

Bouncing interfaces is not required to trigger LACP negotiation.

Option B is incorrect because RIP routes can still be installed in the routing table even when OSPF is running; the router does not automatically suppress RIP routes.

Option C is wrong because both OSPF and RIP routes shown have the same prefix length (/16), so prefix length does not influence the choice here.

Option D is incorrect because cross-protocol route selection is based on administrative distance, not metric comparison; RIP's metric being lower does not make it preferred over OSPF.

The specific factual error is that hard-coding speed and duplex on one side while the other uses auto-negotiation prevents the link from coming up, and 1000BASE-SX cannot reach 5 km.

The specific factual error is that 1000BASE-SX is designed for short-range multimode fiber, not long distances.

The specific factual error is that GigabitEthernet interfaces can operate at 100 Mbps, but the SFP module requires 1000 Mbps; additionally, the speed/duplex mismatch prevents the link from coming up.

RIP supports both IPv4 and IPv6 (RIPng). The statement is factually incorrect because RIP has been used for IPv4 routing since its inception.

RIP is a routing protocol that runs on routers, not switches. While some multilayer switches can run routing protocols, RIP is not exclusive to switches.

RIP is a distance-vector protocol, not a link-state protocol. It uses hop count as its metric and exchanges entire routing tables, not link-state advertisements (LSAs) like OSPF.

The specific factual error: LACP passive mode does not initiate negotiation; it only responds. For the EtherChannel to form, at least one side must be active.

The specific factual error: The port-channel interface and physical interfaces must have consistent switchport mode configuration. Here, the port-channel is access while physical are trunk, causing a mismatch.

The specific factual error: 'channel-group mode on' creates a static EtherChannel without LACP. The question requires LACP, so this does not meet the requirement.

The DISCOVER message is used by the client to locate available DHCP servers, not to accept an offered address. It is the first step in the DORA process.

The OFFER message is sent by the DHCP server to propose an IP address to the client, not by the client to accept it. The client cannot send an OFFER.

The ACK message is sent by the DHCP server to confirm the lease after receiving the REQUEST, not by the client. The client does not send ACK.

The specific factual error is that the interface remains set to 'guest' (VLAN 20) instead of being changed to VLAN 30 as required.

The specific factual errors are using WPA2-PSK (clients expect WPA3-Personal) and assigning the wrong VLAN (20 instead of 30).

The specific factual error is that the SSID broadcast remains disabled, which means clients cannot see the SSID and will not attempt to associate.

Bandwidth is not a defining characteristic of a default route; the route is chosen based on prefix length and administrative distance, not bandwidth.

Default routes can be statically configured or learned from any routing protocol (including OSPF, EIGRP, RIP), so they are not OSPF-specific.

The default route (0.0.0.0/0) is the least specific route, not more specific; specificity is determined by the subnet mask length.

"Show vlan brief" shows VLAN status and port assignments but does not provide any information about routing or route failover, so it cannot verify if the floating static route is active.

"Show spanning-tree" displays Spanning Tree Protocol information related to Layer 2 loop prevention, which is unrelated to routing table contents or route failover verification.

"Show power inline" displays Power over Ethernet (PoE) status and power consumption on switch ports, which has no relevance to routing or verifying floating static route activation.

Candidates often attribute line protocol down to encapsulation issues, missing the clear indication that the switch port is shut down.

Duplex mismatch is a common cause of interface issues, so candidates may assume it without considering the explicitly stated admin-down condition.

Candidates may recall VLAN mismatch as a cause for line protocol down on trunk links, forgetting that the scenario gives a clear admin-down state.

The helper-address must be a unicast IP address of the DHCP server, not a broadcast address. Additionally, only ports connected to legitimate DHCP servers should be trusted; all other ports must be untrusted to block rogue servers.

The excluded-address range should only reserve a few addresses (e.g., for the gateway and static assignments), not the entire subnet. The port connected to the DHCP server must be trusted to allow DHCP server messages; untrusted ports block such messages.

DHCP snooping requires that ports connected to legitimate DHCP servers be configured as trusted. Untrusted ports are for client-facing ports where rogue servers might appear; they drop DHCP server messages.

The specific factual error: TKIP is deprecated and not used with WPA2-PSK; PMF must be disabled for WPA2-only clients; VLAN 100 is incorrect; SSID broadcast should be disabled; HTTPS access must also be restricted.

The specific factual error: WPA3-PSK requires PMF and is incompatible with WPA2-only clients; the allowed subnet for management is 192.168.1.0/24, not 10.10.10.0/24.

The specific factual error: PMF is not supported by all WPA2 clients and can cause association issues; SSID broadcast should be disabled to hide the SSID.

Misunderstanding of ACL direction leads candidates to think that the implicit deny blocks any traffic leaving the interface.

Confusing ACL filtering with routing functionality; ACLs do not prevent the router from routing between connected subnets unless they explicitly deny the traffic on the appropriate interface and direction.

Candidates often try to add a permit for the source subnet of the initiating traffic, neglecting the direction of the ACL. Because the ACL is inbound on the egress interface, outbound traffic is not filtered.

The specific factual error is that manually setting speed and duplex on one side while the other side is set to auto can lead to a mismatch; auto-negotiation is required for proper link establishment.

The specific factual error is that Auto-MDIX eliminates the need for crossover cables on modern interfaces; cable type is not the cause of the problem.

The specific factual error is that matching the incorrect settings does not achieve the desired speed and duplex; it only prevents errors at a lower performance level.

Displays VLAN port membership; irrelevant to OSPF verification.

Shows STP topology; does not provide OSPF neighbor status.

Displays the switch's MAC address table; no OSPF information.

Replacing the Ethernet cable between R1 and R2 is unnecessary because R1 can already ping 10.1.23.2, indicating that the physical link and Layer 3 connectivity to the next-hop router are functioning correctly.

Changing the OSPF router ID on R1 is irrelevant here because the problem is not related to router ID conflicts or OSPF neighbor relationships but to missing route advertisements for the remote LAN.

Disabling CEF (Cisco Express Forwarding) will not help because CEF does not prevent routes from being learned or advertised; it only affects packet forwarding efficiency, so this option does not address the root cause.

Option C is incorrect because the default route is the least specific and is only used when no other matching route exists, not preferred over specific routes.

Option D is incorrect as administrative distance is a separate concept used to select between routes from different protocols, not to replace longest-prefix match.

Option E is incorrect because a /16 is less specific than a /24; the longer the prefix length, the more specific the route.

This option describes traditional monitoring systems that only alert humans, not agentic AI which takes autonomous actions. Agentic AI agents do not just alert; they actively diagnose and remediate issues.

Closed-loop remediation implies full automation without manual approval; requiring human approval breaks the loop and defeats the purpose of autonomous remediation. The workflow is designed to act automatically.

Candidates may think the encapsulation numbers might be swapped, but the stem confirms they are correctly assigned to the respective VLAN IDs.

Many candidates jump to end-host configuration, assuming the router is fully reachable because interfaces are up/up, but the trunk is the prerequisite for any communication between VLANs.

Candidates might think any communication loss warrants a physical layer check, but here the symptoms point strongly toward a Layer 2 trunking issue.

The specific factual error: Administrative distance determines route preference; a lower AD is preferred. Setting the backup to AD 1 would make it the primary route, not a backup.

The specific factual error: The 'permanent' keyword prevents route removal when the interface goes down, which is not the solution here. The backup route needs to become active when the primary fails, not be forced to stay.

The specific factual error: The track command is used to conditionally remove a static route based on reachability, but it is not necessary if the primary route is correctly configured without 'permanent'. The existing backup route should work once the primary route is removed.

Incorrect because CAPWAP is a wireless protocol unrelated to serial link encapsulation. PPP does not require CAPWAP for operation on serial interfaces.

Incorrect because routing protocols like BGP are Layer 3 protocols and do not affect the Layer 2 establishment of a PPP link. The link must be up before routing protocols can run.

Incorrect because serial links can use PPP encapsulation. Cisco routers default to HDLC, but PPP is a supported and common WAN encapsulation protocol.

Standard ACLs lack the ability to filter by protocol or port number, making them unsuitable for this requirement.

The source address in the permit statement is 'any', which allows SSH from all networks, including the ISP side, which is not desired.

Applying access-class outbound on VTY lines would filter traffic going out from the router to the user, which is not the intended direction for controlling who can connect to the router.

1000BASE-SX uses multimode fiber with a maximum 550 m distance, which is far shorter than 1000BASE-LX and would not resolve a distance issue.

The SFP is fixed at 1000 Mbps full-duplex; manually setting 'speed 100' and 'duplex full' would cause a speed mismatch and prevent the link from coming up.

Copper cabling (CAT6a) and a 1000BASE-T SFP are limited to 100 m and cannot solve a fiber distance problem.

Configuring 'aaa new-model' and a RADIUS server alone does not create an authentication method list; the AAA authentication default must explicitly reference the RADIUS server group.

PortFast is a feature that allows switch ports to bypass the usual STP listening and learning states to quickly transition to forwarding. It does not perform any ARP packet validation or security checks, so it cannot prevent ARP spoofing.

UDLD (Unidirectional Link Detection) is designed to detect and disable unidirectional links between switches to prevent network loops or blackholes. It does not inspect or validate ARP packets and thus does not stop ARP spoofing.

HSRP preemption is a feature related to first-hop redundancy protocols that allows a higher priority router to take over as the active gateway. It does not provide any ARP packet validation or protection against ARP spoofing.

The Network layer (Layer 3) encapsulates segments into packets and adds logical addressing (IP addresses) for routing across networks, but it does not perform the initial segmentation of data into segments.

The Data Link layer (Layer 2) encapsulates packets into frames and adds physical addressing (MAC addresses) for delivery on a local network segment, but it does not perform segmentation of data into segments.

The Application layer (Layer 7) provides the interface for applications to generate data, but it does not perform segmentation or encapsulation into segments. Segmentation occurs at the Transport layer.

RIP does not use bandwidth as a metric; it relies solely on hop count. Bandwidth is used by EIGRP in its composite metric calculation, not by RIP.

Cost is the metric used by OSPF, not RIP. RIP uses hop count as its sole metric, making cost an incorrect choice for this question.

Delay is not a metric used by RIP; RIP only considers hop count. Delay is a component in the EIGRP composite metric, but not in RIP.

Assumes the switch port configuration alone guarantees proper VLAN delivery to the PC, ignoring the phone's role as a transparent bridge.

Confuses the mechanism for voice VLAN assignment with the requirement for data passthrough; CDP's role is only for the phone's own voice VLAN, not for the PC's data VLAN.

Misapplies QoS as a potential cause for a connectivity issue; it is a quality-of-service feature and does not block DHCP or initial network access.

The native VLAN is untagged on the trunk, and R1 can handle it via the physical interface if needed, but a missing subinterface for native VLAN 1 is not the cause of the issue.

IP routing is already enabled; the issue is a configuration error on the subinterface, not a missing global command.

The trunk configuration is correct; the problem is the encapsulation mismatch on the router subinterface.

The subnet mask is still required for the host to determine whether a destination is local or remote. The default gateway only comes into play for remote destinations; without the subnet mask, the host cannot make that determination.

A DNS server resolves domain names to IP addresses, while a default gateway forwards packets to other networks. They are separate services; a host can have a default gateway without a DNS server and vice versa.

The default gateway is used for unicast traffic destined to other subnets, not just broadcast. Broadcast traffic is typically confined to the local subnet and does not require a gateway.

Applying the ACL outbound would not change the order of lines; the same logic applies—the first match still blocks all traffic.

Extended ACLs can match TCP port 23 using the keyword 'eq telnet' or 'eq 23'; this is not a limitation.

Telnet uses TCP, not UDP; referencing udp would never match Telnet traffic.