CCNA 200-301 v2 (200-301) — Questions 751–825

The problem is Layer 1/2, not VLAN tagging. A trunk is used when multiple VLANs need to traverse the link, but the line protocol down indicates a physical or data link issue.

The switch's SVI (VLAN interface) is used for management, not for routing user traffic. The problem is at Layer 1/2, not Layer 3.

CDP requires the line protocol to be up to exchange information. Enabling CDP does not resolve speed/duplex mismatches.

This is not a difference; both RSTP and STP require a root bridge with a lower bridge priority than all other switches.

Both RSTP and STP use the same three timers (Hello, Max Age, Forward Delay); RSTP does not reduce or eliminate them.

RSTP still uses BPDUs—it does not eliminate them; it enhances BPDUs with new flags for faster convergence.

The Network layer provides logical addressing and routing, not end-to-end segmentation or port numbers.

The Data Link layer handles local frame delivery and error detection, not end-to-end reliability or port numbers.

The Session layer manages dialog control and synchronization, not segmentation, port numbers, or reliability acknowledgments.

Many believe SNMP requires an additional global command to start; on Cisco IOS, a community string entry enables the agent.

Polling failures are often attributed to community string errors, but when the string matches, an ACL restriction produces identical symptoms.

Candidates may assume the agent must be bound to an interface, but Cisco IOS SNMP agents respond on any interface unless limited by an ACL or VRF.

Option C is incorrect because JSON arrays are data structures for organizing information, whereas OSPF areas are routing domains; they are unrelated concepts in networking and automation.

Option D is incorrect because JSON arrays can contain any number of items, including zero or many, not just exactly one item; this flexibility is important in API responses and configurations.

Option E is incorrect because arrays do not replace keys; keys are used in JSON objects to define named values, while arrays represent ordered collections without keys.

DHCP dynamically assigns IP addresses and STP prevents loops in Layer 2 networks; neither provides centralized logging or time synchronization. Without NTP, timestamps from different devices would not align, making log correlation impossible.

PAT (a form of NAT) translates private IP addresses to public ones, and EtherChannel bundles multiple links for redundancy and bandwidth; neither offers centralized logging or time synchronization. These technologies are unrelated to the goal.

ARP resolves IP addresses to MAC addresses, and CDP discovers directly connected Cisco devices; neither provides centralized logging or time synchronization. These protocols are for neighbor discovery and Layer 2 resolution, not for log management.

The specific factual error is that /24 masks are too large for point-to-point links and do not match the expected subnets for R2 and MLS1.

The specific factual error is that the IPv6 address should be configured with the EUI-64 keyword, not a static address.

The specific factual error is that the prefix length must be /64 as specified in the question; a /32 prefix is incorrect for this scenario.

This is incorrect because OSPF operates normally on /30 subnets commonly used for point-to-point links. Subnet mask size does not prevent OSPF adjacency.

This is incorrect because OSPF process IDs are locally significant identifiers and do not need to match between routers to form neighbors.

This is incorrect because OSPF runs over routed interfaces and does not require interfaces to be configured as switch trunks, which are used for VLAN tagging.

OSPF is a Layer 3 routing protocol used for exchanging routes between routers, not for resolving Layer 2 switchport mismatches. This issue is purely about trunk/access configuration, which is unrelated to OSPF.

While native VLAN mismatch can cause issues on a trunk link, the primary problem here is that one side is configured as access, not trunk. Even if native VLAN is set to 1 on both sides, the access port will still not process tagged frames correctly.

Hostnames are purely for identification and have no impact on switchport operation or VLAN tagging. The trunk/access mismatch is a Layer 2 configuration issue independent of hostnames.

VLAN tagging on trunks is a Layer 2 function that deals with VLAN identification using 802.1Q tags. Duplex mismatch is a physical-layer issue affecting how data is sent and received (simultaneous vs. one direction at a time) and has no impact on VLAN tagging.

OSPF area mismatch errors are Layer 3 routing protocol issues that prevent OSPF neighbors from forming. Duplex mismatch is a Layer 1/2 problem that affects frame delivery and collision detection, not routing protocol adjacency.

A change in subnet mask is a Layer 3 IP configuration change that affects network/host identification. Duplex mismatch is a physical-layer issue and does not alter IP addressing or subnet masks.

Giants are frames exceeding the maximum size (typically 1518 bytes) and are caused by MTU misconfiguration, faulty NICs, or software errors, not by duplex mismatch. Duplex mismatch does not affect frame size; it causes collisions and CRC errors.

Input errors is a broad counter that includes runts, CRC errors, frame errors, and others. While duplex mismatch can contribute to some input errors, it is not a specific error type. The question asks for 'interface errors' most likely caused by duplex mismatch, and input errors is too generic.

Output errors include collisions, late collisions, and underruns. While collisions can occur due to duplex mismatch, output errors are not exclusively caused by duplex mismatch; they can result from other issues like cable faults or interface congestion. The question asks for errors 'most likely' caused by duplex mismatch, and runts and CRC errors are more directly linked.

Flaps refer to an interface repeatedly going up and down, typically due to physical layer issues like loose cables, faulty transceivers, or power fluctuations. Duplex mismatch does not cause interface flaps; it causes errors on the link but the interface remains up.

A larger wildcard mask does not override the passive-interface setting; adjacency still fails.

Adjacency depends on area and authentication, not on the router-local process ID; passive-interface is the real issue.

The root cause is a configuration that blocks hellos, not a transient state; the reset is ineffective.

The traceroute shows the first hop (gateway) responds, indicating the gateway is reachable and routing is functioning. If the gateway lacked a route to 10.1.1.0/24, it would typically send an ICMP Destination Unreachable (Network Unreachable) message, not cause intermittent timeouts. The issue is more specific to ARP confusion at the local subnet.

The ipconfig /all output shows the correct subnet mask (255.255.255.0) and gateway (192.168.1.1). The PC can ping the gateway and other local hosts, confirming the subnet mask is correct. An incorrect subnet mask would prevent communication with the gateway or local hosts, not just the remote server.

If the web server were powered off or had a faulty NIC, the traceroute would likely show no response from any hop beyond the gateway, and the ARP cache would not show an entry for 192.168.1.100. The presence of an ARP entry for that IP indicates that a device is responding to ARP requests, contradicting a complete hardware failure.

BPDU Guard does not prevent loops by disabling a trunk port; it is typically used on access ports with PortFast and disables the port upon receiving any BPDU.

Root Guard places the port into root-inconsistent state, not errdisable; errdisable is the state used by BPDU Guard.

Neither Root Guard nor BPDU Guard filters BPDUs; they both process received BPDUs and then take action (root-inconsistent for Root Guard, errdisable for BPDU Guard).

'ipv6 router ospf <process-id>' is a global configuration command, not an interface command; enabling OSPFv3 on an interface requires the 'ipv6 ospf <process-id> area <area-id>' command.

'show ipv6 ospf neighbor' displays OSPFv3 neighbor adjacencies, not the link-state database; to view the LSDB, use 'show ipv6 ospf database'.

The specific factual error is that the question implies the correct configuration should use speed 1000 and duplex full, not downgrade to 100/half. Also, LACP requires identical settings, but the goal is to match the higher speed.

The specific factual error is that auto-negotiation does not guarantee matching settings when one side is manually configured. The mismatch would persist.

The specific factual error is that the question explicitly states a speed/duplex mismatch prevents the channel from forming, and this option does not correct that mismatch.

The specific factual error is using trunk mode for an IP phone port instead of access mode with voice VLAN.

The specific factual error is reversing the VLAN assignments: the access VLAN should be data, and the voice VLAN should be voice.

The specific factual error is swapping the PoE priority values: the phone should be critical, the AP high.

Candidates focus on the matching priority numbers and overlook the missing root port that indicates a complete loss of BPDUs.

Candidates may assume no BPDUs means STP is off, but the intended root designation suggests STP is on and a physical disconnect is the primary suspect.

Candidates recall that BPDU guard can block ports, but they fail to differentiate between a missing port due to err-disable and a missing port due to a physically down link, which looks identical in this output.

The specific factual error is that 'ip domain-lookup' is a global command that enables DNS resolution; if it were disabled, no names would resolve.

The specific factual error is that the DNS server is functioning for other records; the problem is specific to one hostname, not the server address.

The specific factual error is that static entries bypass DNS but do not address the root cause; the DNS server should have the record for all clients.

Option C is incorrect because access points are still required to provide the actual wireless radio connectivity; the controller does not replace APs.

Option D is incorrect since DHCP or other IP configuration methods are still needed for client devices; the controller does not replace these network services.

Option E is incorrect because WPA3 is a wireless security standard and does not relate to the architectural concept of controller-based WLAN management.

Running scripts directly in production without validation bypasses all safety checks, increasing the likelihood of misconfigurations that can cause outages or security breaches. This practice directly contradicts the principle of minimizing risk during network changes.

Disabling backups removes the ability to restore the network to a known good state after a failed change, significantly increasing risk. Backups are a fundamental safety net, and disabling them for speed is never justified.

The specific factual error: The problem is a Layer 2/Layer 3 mismatch, not the LACP mode. Active mode is valid and commonly used.

The specific factual error: 'switchport nonegotiate' affects trunk negotiation, not EtherChannel bundling.

The specific factual error: The mode change does not fix the interface type mismatch; the port-channel must be Layer 2 to match the member ports.

This range uses a wildcard mask of 0.0.0.7, not 0.0.0.15.

The type of routing protocol (link-state vs. distance vector) does not determine route preference when comparing routes from different protocols. Route selection is based on administrative distance, not protocol characteristics.

Metrics are only comparable within the same routing protocol. Different protocols use different metrics (e.g., OSPF uses cost, EIGRP uses composite metric), so they cannot be directly compared. Administrative distance is used to choose between protocols.

By default, a router installs only the best route (lowest AD) for a given prefix into the routing table. Both routes are not installed unless features like equal-cost multipath or policy routing are configured, which is not the case here.

Incorrect because OSPF process IDs are locally significant and do not need to match between routers for adjacency or route exchange.

Incorrect because both routers' interfaces are in the same subnet 10.20.12.0/24, so subnet mismatch is not the cause of missing routes.

Incorrect because OSPF supports multiple link types including Ethernet; it is not limited to serial links only.

The router selects the route with the lower administrative distance, not higher. Administrative distance is a measure of trustworthiness; a lower value indicates a more reliable source. For example, a static route (AD 1) is preferred over an OSPF route (AD 110).

Directly connected routes have an administrative distance of 0, not 1. An AD of 0 is the most trustworthy and cannot be overridden by any dynamic route. The value 1 is used for static routes.

Directly connected routes have an AD of 0, which is lower than any dynamic routing protocol (e.g., OSPF AD 110, EIGRP AD 90). Therefore, directly connected routes are always preferred over dynamic routes, not the other way around.

A trunk port is used to carry multiple VLANs between switches, not to connect an end device like a PC. Configuring the switchport as trunk would break connectivity because the PC expects an access port.

Changing the PC's IP subnet would not resolve the issue because the PC would still need a default gateway on its new subnet. The root cause is the missing SVI on the switch, not the PC's IP address.

Recreating VLAN 10 and reassigning the port does not address the missing SVI. The VLAN already exists and the port is correctly assigned; the issue is at Layer 3, not Layer 2.

The router's interface is a routed port, not a switchport; access/trunk concepts apply to switch interfaces. Even if it were a switch interface, the issue is about ARP replies, which require Layer 3 addressing, not trunking.

ARP requests are Layer 2 broadcasts; if the router's interface is in the same VLAN as Host A, it will receive the request. The problem is that the router does not reply, indicating it lacks an IP in the destination subnet.

Duplex mismatch causes CRC errors and collisions, but ARP requests would still be received and could be replied to. The capture shows clean ARP requests with no replies, pointing to a Layer 3 issue, not physical layer.

Option B is incorrect because NTP does not assign IP addresses to syslog servers or any devices. IP addressing is handled by DHCP or manual configuration, not by NTP.

Option C is incorrect because syslog does not replace authentication mechanisms. NTP and syslog are unrelated to access control or authentication processes in Cisco networks.

Option D is incorrect because centralized logging improves visibility into network events but does not block unauthorized traffic. Traffic enforcement is managed by firewalls, ACLs, or other security features.

'switchport port-security maximum 1' limits MAC addresses but does not detect BPDUs or err-disable the port on switch connections, so it does not meet the requirement to immediately disable the port on switch attachment.

'storm-control broadcast level 5.00' limits broadcast traffic but does not err-disable the port upon detecting a switch or BPDUs, so it does not fulfill the requirement to disable the port immediately if a switch is plugged in.

The OSPF /24 route is less specific than the static /25 route. The longest prefix match rule dictates that the /25 route is preferred for destination 203.0.113.10, which falls within the /25 range.

Equal-cost load balancing only applies when multiple routes have the same prefix length and metric. Here, the prefix lengths differ (/24 vs /25), so the longest prefix match selects the /25 route exclusively.

Overlapping routes are common in routing tables and do not cause a problem. The router always selects the most specific match (longest prefix) for forwarding, so both routes can coexist.

This configuration makes the port a trunk port, which is used to carry multiple VLANs between switches, not for a single user PC. The 'switchport trunk native vlan 20' command sets the native VLAN for untagged traffic on the trunk, but the port still actively negotiates trunking via DTP, violating the requirement to not negotiate trunking.

The 'switchport mode dynamic desirable' command actively attempts to form a trunk with the connected device via DTP, which contradicts the requirement to not negotiate trunking. Additionally, 'switchport trunk allowed vlan 20' only restricts which VLANs are allowed on the trunk, but the port is still in trunking mode, not an access port.

The 'no switchport' command converts the Layer 2 switch port into a Layer 3 routed interface, which cannot be assigned to a VLAN. This configuration is used for routing between VLANs or connecting to routers, not for connecting a user PC to a specific VLAN.

The subnet 192.168.50.32/27 covers addresses 192.168.50.32 to 192.168.50.63. The host address 192.168.50.94 is outside this range, so it does not belong to this subnet.

The subnet 192.168.50.96/27 covers addresses 192.168.50.96 to 192.168.50.127. The host address 192.168.50.94 is below this range, so it does not belong to this subnet.

The subnet 192.168.50.0/27 covers addresses 192.168.50.0 to 192.168.50.31. The host address 192.168.50.94 is far above this range, so it does not belong to this subnet.

The trap host line uses 'version 3' and a community string ('public'), but SNMPv3 traps require a security name (the user) and an authentication level, not a community.

The SNMPv3 user is configured with MD5 and DES56, while the requirement is SHA authentication and AES 128‑bit encryption.

The NetFlow export version is set to 5 instead of the required version 9.

This reflects a common misunderstanding that AD is the sole tie-breaker between routes from different sources, ignoring prefix length priority.

Candidates might assume that if the OSPF route is not used, it must be inactive; however, the exhibit does not show this.

Candidates may mistake metric for the primary selection criterion, not realizing prefix length dominates all other route comparison steps.

Copper UTP cables have a maximum segment length of 100 meters for Ethernet, not 500 meters without a repeater.

Multi-mode fiber typically uses LED or VCSEL transmitters, not laser-based transmitters; lasers are used with single-mode fiber for long distances.

Fiber optic cabling is generally more expensive per meter than copper cabling, not less expensive.

PortFast is unsafe on trunk ports; it is intended only for edge access ports.

The root bridge is determined by the lowest bridge priority, not the highest.

The specific factual error is that the interface with the public IP (203.0.113.1) must be configured as 'ip nat outside', not 'ip nat inside'. Marking it as inside would cause asymmetric NAT behavior and break translation.

The specific factual error is that PAT requires the 'overload' keyword. Without it, the router performs dynamic NAT (one-to-one translation), which would not support multiple hosts sharing a single public IP.

The specific factual errors are: (1) the interface with the public IP must be 'ip nat outside', and (2) PAT requires the 'overload' keyword. Both are violated here.

An A record maps a hostname to an IPv4 address, not an IPv6 address. Since the question specifically asks about IPv6, this record type is incorrect.

A CNAME record creates an alias from one domain name to another, not a direct mapping to an IP address. It does not provide the IP address itself, so it cannot verify the mapping to an IPv6 address.

MX records specify mail exchange servers for a domain and are used for email routing, not for mapping domain names to IP addresses. They do not provide IPv6 address mappings.

NAT rules are not required for native IPv6 communication and would not be the first suspect when a host cannot reach remote IPv6 destinations.

A VLAN trunk on the host NIC relates to Layer 2 segmentation, not to providing a default route for off-link IPv6 traffic.

A second global unicast address on the same interface does not supply the missing default route needed to reach off-link destinations.

The specific factual error: The management interface is for WLC management traffic, not client data. Client traffic should be on a separate user VLAN.

The specific factual error: Broadcast SSID must be enabled for the SSID to be visible. Disabling it hides the SSID, which contradicts the requirement to make it visible.

The specific factual error: HTTPS must be enabled for management access. Disabling it would block HTTPS connections to the WLC.

The subnet mask is used to determine the network portion of an IP address and the host portion, not the DNS server address. DNS server addresses are configured separately, either manually or via DHCP.

IPv6 hosts can obtain their IP address via Stateless Address Autoconfiguration (SLAAC), which does not require DHCPv6. DHCPv6 is optional and used for stateful configuration or to provide additional parameters.

The default gateway must be on the same subnet as the host's IP address; otherwise, the host cannot send Ethernet frames to it because the gateway's MAC address would not be reachable via ARP. An arbitrary IP address would not work.

LACP allows an active port to form a bundle with a passive port; the passive side simply waits for LACP packets from the active side. Therefore, both sides do not need to be active.

LACP mode does not change the Layer 2 or Layer 3 status of interfaces; it only controls the negotiation of EtherChannel bundling. Interfaces remain as switchports unless explicitly configured as routed ports.

LACP negotiation failure does not automatically delete the port-channel interface or its configuration. The port-channel remains, but the member ports will not bundle and will operate as individual ports.

An IPv6 default gateway must be on the same local link, not just any globally routable address.

The subnet mask identifies the network bits, not the host bits; the host portion is the inverse of the mask.

DNS resolves names to IPs; hosts on the same subnet can communicate with IP addressing alone, making DNS optional.

Root guard does not error-disable a port; instead, it places the port into a root-inconsistent state if a superior BPDU is received, preventing the port from becoming a root port. It is used to enforce the root bridge location, not to disable ports upon BPDU reception.

Port security restricts the number of MAC addresses learned on a port and can error-disable the port if a violation occurs (e.g., too many MAC addresses). It does not react to BPDUs; its focus is on MAC address learning, not spanning-tree BPDUs.

DHCP snooping is a security feature that filters DHCP messages and can error-disable a port if a DHCP violation occurs (e.g., rogue DHCP server). It does not inspect or react to BPDUs, which are layer 2 spanning-tree frames.

172.16.8.0 is incorrect because the /26 subnet blocks cover 0–63, 64–127, etc., and the host address 70 does not fall within the 0–63 range. Selecting this ignores the actual subnet boundaries defined by the mask.

172.16.8.70 is incorrect because this is the host address itself, not the network address. The network address must be the first address in the subnet block, not a host address within it.

172.16.8.128 is incorrect because this subnet block starts at 128, which is above the host address 70. The host does not belong to this subnet, so this cannot be the network address.

The router first uses the longest prefix match to select a route; metrics are only compared among routes from the same routing protocol or when administrative distance is equal. Comparing metrics across different protocols is not the first step.

Route age is not a primary selection criterion; routers use longest prefix match first, then administrative distance, then metric. Older routes are not preferred over newer ones in the selection process.

A default route is only used when no other route matches the destination; the router first checks for more specific matches using the longest prefix match. The default route is the least preferred.

The maximum limit of 10 MAC addresses is too high for the requirement of allowing only one learned MAC address. Additionally, protect mode drops frames from unknown MACs but does not shut down the port, so the port remains active even after a violation.

Restrict mode does not shut down the port; it only logs and drops frames from unknown MACs. The requirement explicitly states the port should shut down, which restrict does not achieve.

Setting the maximum to unlimited defeats the purpose of limiting MAC addresses to one. Even though violation mode is shutdown, the port will never trigger a violation because there is no limit, so it will never shut down due to port security.

The 192.168.100.0/24 route is less specific than the 192.168.100.128/25 route. Although it matches the destination IP, the router prefers the more specific /25 route, so this option is incorrect.

The default route is only used when no more specific routes match the destination IP. Since both /24 and /25 routes match, the default route is not used, making this option incorrect.

Although the prefixes overlap, this is a normal and expected behavior in routing. The router resolves overlapping prefixes using longest prefix match, so traffic is forwarded correctly. Therefore, this option is incorrect.