CCNA 200-301 v2 (200-301) — Questions 901–975

Attributing the issue to a native VLAN mismatch overlooks the root election change and the BPDU Guard-triggered err-disable state.

This answer ignores the root election shift and the BPDU Guard events; PortFast misconfiguration alone would not cause these symptoms.

This fails to account for the selective err-disable of only access ports and the concurrent root bridge change, which points to a targeted misconfiguration rather than a blanket global setting.

Incorrect because a default route is the least specific route and does not make routes more specific; it serves as a catch-all for unknown destinations.

Incorrect because interface addressing is mandatory for routing to function properly; a default route does not replace the need for IP addresses on interfaces.

Incorrect because default routes influence packet forwarding decisions and have no impact on VLAN assignments, which are Layer 2 configurations.

The interface status shows 'up, line protocol is down', which indicates a Layer 2 issue, not a physical cable fault. Additionally, no CRC, runts, giants, or collisions are reported, so the cable is likely not faulty.

The interface status is 'up, line protocol is down', not 'err-disabled'. The err-disabled state would show 'err-disabled' in the interface status, and a shutdown/no shutdown would be appropriate only for err-disabled recovery.

The interface status is 'up', not 'administratively down'. An administratively down interface would show 'administratively down, line protocol is down'. VLAN configuration issues typically cause the interface to be up/up but unable to forward traffic, not up/down.

The specific factual error is that the subinterface would still show as up/up (though traffic would not be forwarded) if the encapsulation were wrong; the problem is the physical interface being down.

The specific factual error is that the switch trunk configuration is given as correct; the problem is on the router side, not the switch.

The specific factual error is that subinterfaces do not have an independent administrative state; they rely on the physical interface being up.

The command 'ip nat inside source list ... interface ... overload' uses the interface's IP address for translation, not the pool address 203.0.113.1. The requirement specifies using the public IP 203.0.113.1, which is assigned to the interface but may not be the interface's primary IP if multiple IPs are configured.

Without 'overload', the router will attempt to allocate a unique public IP for each internal session, but the pool has only one IP, so only one translation can exist at a time. PAT (overload) is required to allow multiple internal hosts to share the single public IP.

The 'ip nat inside' command should be on the LAN interface (GigabitEthernet0/1) and 'ip nat outside' on the internet-facing interface (GigabitEthernet0/0). Reversing them causes NAT to fail because the router does not know which traffic is internal.

The specific factual error is that an AD of 90 does not make the static route less preferred than EIGRP; it creates equal preference.

The specific factual error is that a lower AD makes the route more preferred, so the static route would override EIGRP.

The specific factual error is that AD 255 means the route is not trusted and is effectively ignored.

192.168.50.127 is the broadcast address for the lower /25 subnet (192.168.50.0/25), not the subnet containing 192.168.50.130. Since the host IP is in the upper subnet, this option is incorrect.

192.168.50.128 is the network address of the upper /25 subnet (192.168.50.128/25), not the broadcast address. Network addresses cannot be assigned to hosts or used as broadcast addresses, so this option is incorrect.

192.168.50.254 is a valid usable host address within the upper /25 subnet. It is not the broadcast address, so this option is incorrect.

JSON is a lightweight data-interchange format, not a transport protocol. HTTPS is a secure version of HTTP used for communication, and JSON does not replace it; instead, JSON data is often transmitted over HTTPS.

JSON is a platform-independent data format used by many APIs and services, not just Cisco DNA Center. It is supported by virtually all programming languages and is a standard for web APIs across different vendors.

JSON does not use XML tags; it uses a syntax of curly braces, colons, and commas to define objects and arrays. XML uses angle brackets for tags, which is a different markup language.

WPA2 and WPA3 are security protocols, not radio frequencies. 802.11 radio frequencies refer to bands like 2.4 GHz and 5 GHz, which are unrelated to security standards.

Trunk ports are a concept in switched networks for carrying multiple VLANs, typically using 802.1Q tagging. WPA2 and WPA3 have nothing to do with switch port configuration.

WPA3 does not eliminate the need for SSIDs; SSIDs are still required to identify and differentiate wireless networks. WPA3 focuses on authentication and encryption, not network identification.

The specific factual error is that IP routing is not enabled by default; it requires the 'ip routing' global command.

The specific factual error is that the native VLAN must match on both sides; changing R1's native VLAN to 1 does not match the switch's native VLAN 99.

The specific factual error is that the subinterface G0/0.20 is associated with VLAN 20, so its encapsulation must be dot1Q 20, not 10.

logging trap 4 sets the severity to warning (4), so it does not include notifications (5).

The missing source interface causes NTP to use an incorrect source address, likely resulting in unsynchronized status.

The NTP server address is incorrect and 'logging trap 7' sends all debug messages instead of limiting to notifications and above.

This option is incorrect because a directly connected route, even though it has a lower administrative distance, does not override a more specific OSPF route due to prefix length precedence.

This option is incorrect because routers do not use multiple routes equally when one route is a more specific match; only the best matching route is used for forwarding.

This option is incorrect because routers can compare and select routes from different sources; differing sources do not prevent route usage if one route is the best match.

Replacing a failed power supply is a physical hardware task that requires hands-on intervention, not a software-based or configuration task that network automation tools can perform.

Tracing a cable by hand is a physical, manual task that cannot be automated with network automation tools, which focus on software-based configuration and monitoring.

Listening for fan noise is a physical inspection task that relies on human senses and cannot be performed by network automation software, which deals with digital data and configurations.

NTP (Network Time Protocol) is responsible for synchronizing clocks across devices but does not handle hostname resolution or IP address translation, so it cannot cause hostname access failures.

QoS (Quality of Service) manages traffic prioritization and bandwidth allocation but does not perform any function related to hostname resolution or IP address translation.

HSRP (Hot Standby Router Protocol) provides gateway redundancy and failover but does not influence DNS or the ability to resolve hostnames to IP addresses.

This option is incorrect because bandwidth does not determine whether a route is a default route. Default routes are about specificity and fallback behavior, not link speed or bandwidth.

This option is incorrect because the default route is the least specific route, not more specific than others. It matches all destinations not covered by other routes, so it cannot be more specific.

This option is incorrect because default routes can be learned through various routing protocols such as OSPF, EIGRP, or configured statically. It is not exclusive to OSPF.

Confusing DTP trunk negotiation with the operational consequences of a native VLAN mismatch.

Assuming that a crossover cable is mandatory for switch-to-switch connections, ignoring auto-MDIX.

Mistaking the ability to forward traffic for a specific VLAN with the ability to negotiate a trunk.

The specific factual error: 192.0.2.2 is already used by R2, causing an IP conflict; static assignment on G0/1 does not guarantee uniqueness.

The specific factual error: /24 mask is too large and does not match the /30 subnet; EUI-64 cannot be applied alongside a static address—it replaces the interface ID.

The specific factual error: 192.0.2.2 is already assigned to R2, so R1 cannot use it; the correct fix is to adjust the mask, not the IP.

The native VLAN is used for untagged traffic on a trunk and does not affect the forwarding of tagged frames for other VLANs. Changing the native VLAN to 50 would not resolve the issue because VLAN 50 frames are still tagged and require inclusion in the allowed VLAN list.

An access port can only carry a single VLAN, so changing the trunk to an access port would prevent the link from carrying multiple VLANs, including VLAN 50. The link is intended to carry multiple VLANs, so a trunk is required.

PPP (Point-to-Point Protocol) is a WAN protocol used on serial links, not on Ethernet trunks. Ethernet trunks use 802.1Q or ISL encapsulation, and PPP has no relevance to VLAN trunking issues.

The specific factual error is that OSPF is a dynamic routing protocol that must be enabled on both ends of a link for adjacency to form; one-sided configuration does not work.

The specific factual error is confusing subnet masks with wildcard masks; OSPF uses inverse masks in network statements.

The specific factual error is using a host wildcard mask that does not cover the actual interface IPs; the correct wildcard mask must include the range of IPs on the link.

APIs are software interfaces that enable communication with the controller, but they do not replace forwarding devices like switches and routers. These devices still handle packet forwarding based on policies set via the controller; the controller does not eliminate the need for physical or virtual forwarding hardware.

APIs do not remove the need for authentication and authorization. In fact, secure API access typically requires credentials, tokens, or certificates to ensure only authorized users or systems can interact with the controller. Removing these controls would create severe security vulnerabilities.

APIs are software interfaces, not physical cabling standards. Ethernet cabling standards like Cat5e, Cat6, or fiber optics define physical layer specifications for wired network connections. Confusing APIs with cabling is a fundamental category error.

This option is incorrect because OSPF neighbor relationships do not depend on matching hostnames. Hostnames are administrative identifiers and do not affect OSPF protocol operations or LSA exchanges.

This option is incorrect because a /30 subnet is a standard subnet size for point-to-point links and does not prevent OSPF from operating or forming adjacencies. OSPF works normally over /30 subnets.

This option is incorrect because OSPF runs over routed interfaces and does not require interfaces to be configured as switch trunks. Trunking is related to VLAN tagging and switching, not OSPF adjacency.

Option B is incorrect because YANG does not replace IPv4 or IPv6 addressing schemes. IP addressing remains a core network function independent of data modeling languages.

Option C is wrong since YANG does not remove the need for routing protocols. Routing protocols like OSPF and EIGRP continue to operate and are configured using data models but are not replaced by them.

Option D is false because YANG’s scope is much broader than naming wireless SSIDs. It models a wide range of network configurations and operational data beyond wireless settings.

This action is too drastic and impacts all ports, whereas the issue is specific to access ports connected to end devices. PortFast is the standard, safe method for eliminating delay on edge ports.

Candidates might think that turning off STP on a single VLAN is a quick fix, but it removes the safety net against loops and is not a recommended network practice. PortFast provides the immediate-forwarding benefit while preserving STP loop protection.

Candidates often assume that Rapid PVST+ immediately forwards on all access ports, but the edge port behavior must be configured. The scenario explicitly mentions the port is an access port connected only to a PC; the immediate fix is to enable PortFast, not change the entire STP mode.

The specific factual error: The 'clock rate' command configures the clocking rate on a DCE serial interface, not the administrative state.

The specific factual error: The encapsulation command changes the Layer 2 protocol but does not affect the administrative state of the interface.

The specific factual error: The 'clear interface' command does not enable an administratively down interface; it only resets statistics.

Many candidates assume that a Layer 2 protocol down on a serial link is always caused by an encapsulation mismatch, overlooking the explicit clocking issue displayed in the output.

Novice engineers might misinterpret 'line protocol is down' as an indication that the interface is disabled, without reading the full status line.

The trap: candidates see 'line protocol is down' and immediately think of a physical problem, missing the clear distinction that the interface itself is 'up'.

This statement is incorrect because the phone and PC can operate on different VLANs on the same port. The phone uses the voice VLAN, while the PC uses the access (data) VLAN. They are not required to use the same VLAN, and misconfiguration of the access VLAN can cause the PC to fail while the phone works.

BGP (Border Gateway Protocol) is a routing protocol used between autonomous systems, not related to VLAN configuration on a switchport. The issue described is about Layer 2 VLAN assignment, not Layer 3 routing. BGP has no role in this scenario.

The access VLAN remains relevant even when a voice VLAN is configured. The access VLAN is used for the PC's data traffic, while the voice VLAN is used for the phone's traffic. If the access VLAN is incorrect, the PC will not be able to communicate on the correct data network.

The next-hop should be R3 (10.0.0.6), not R2 (10.0.0.2).

The AD must be higher than OSPF's 110 (e.g., 150) to act as a floating static route.

The destination network should be 203.0.113.0/24, not a default route.

Rapid PVST+ uses RSTP's rapid handshake process, not timer-based convergence like standard 802.1D.

Rapid PVST+ is based on the 802.1w standard (RSTP), not 802.1D.

Rapid PVST+ runs a separate instance per VLAN and does not use 802.1Q to consolidate instances.

PortFast is used to speed up the transition of a port to forwarding state in spanning tree, typically for end-user devices. It does not filter DHCP messages or prevent rogue DHCP servers; DHCP snooping is the correct mechanism.

ARP is essential for IP communication and disabling it would break network connectivity. DHCP snooping does not involve ARP; it operates at the DHCP protocol level to validate messages.

Setting every access port as trusted would allow any device connected to those ports to act as a DHCP server, defeating the purpose of DHCP snooping. Only ports connected to legitimate DHCP servers should be trusted.

Changing the port type to trunk does not affect spanning-tree root bridge election or port roles. The blocking state is determined by spanning-tree topology, not by trunk configuration.

Portfast is intended for access ports connected to end devices to bypass listening/learning states; it is not used on uplinks and does not resolve a blocking state caused by spanning-tree topology.

BPDU guard is used on access ports to protect against rogue switches by disabling the port if a BPDU is received. It does not affect root bridge election or port roles on uplinks.

Many candidates confuse conflict detection with a preventive mechanism, thinking that enabling it would stop the assignment of an already-used address.

Candidates may associate short leases with instability, but the root cause is the missing exclusion, not the lease timer.

Beginners often conflate the default gateway with the assigned IP address, believing a mistake in the default-router setting could cause an address conflict.

Anomaly detection identifies unusual patterns like latency spikes, but it does not include automatic corrective action. The scenario requires both detection and automated response, which anomaly detection alone cannot provide.

Predictive analytics forecasts future events (e.g., predicting when a link will fail), but it does not automatically take corrective action. The scenario involves detecting and correcting an existing anomaly, not predicting a future one.

Machine learning classification categorizes data (e.g., classifying traffic as normal or anomalous), but it does not inherently include automated corrective actions. The scenario requires a system that both detects and corrects.

The nslookup output shows the DNS server is returning an incorrect IP address (198.51.100.1) for www.example.com, not a local cache issue. Flushing the DNS cache would not resolve the problem because the host is querying the DNS server and receiving the wrong answer.

The host can successfully ping the web server at 192.0.2.10, which indicates that ICMP traffic is not blocked by the firewall. The problem is that the host is trying to reach the wrong IP address (198.51.100.1) due to DNS resolution, not that the correct IP is being blocked.

The nslookup response includes the server name 'dns.example.com', which indicates that the DNS server is authoritative for the example.com zone. If it were not authoritative, the response would typically show a non-authoritative answer or refer to another server. Delegation is not needed because the server is already authoritative.

The specific factual error is that an administratively down interface results in a hard failure, not intermittent connectivity.

The specific factual error is that a complete ARP entry indicates no Layer 2 problem, contradicting the symptom of intermittent connectivity.

The specific factual error is that a missing route results in consistent unreachability, not intermittent problems.

Incorrect because PAT does not depend on OSPF or any routing protocol to function; enabling OSPF on the WAN link is unrelated.

Incorrect because the ACL number does not have to be 100; standard ACLs like 1 are valid for NAT configurations.

Incorrect because GRE tunneling is not required for PAT; PAT operates independently of GRE.

192.168.88.32 is the network address of the previous /27 subnet (32-63). Since the host address 192.168.88.66 falls in the 64-95 range, the correct network address is 192.168.88.64, not 192.168.88.32.

192.168.88.95 is the broadcast address for the /27 subnet that starts at 192.168.88.64. The broadcast address is the last address in the subnet, used to send packets to all hosts in that subnet, not the network address.

192.168.88.96 is the network address of the next /27 subnet (96-127). The host 192.168.88.66 is not in that range; it belongs to the subnet starting at 192.168.88.64.

The specific factual error: RESTCONF mandates the use of application/yang-data+json for Accept and Content-Type headers; application/json is not supported. Also, the JSON body must follow the YANG data structure.

The specific factual error: The question explicitly requires the ietf-interfaces YANG model, not the Cisco-native model. Using the wrong model will not retrieve or modify the intended data.

The specific factual error: The question context indicates JSON is the target format (since it mentions Accept: application/json would fail). Using XML is a different format and would require different media types.

This option is incorrect because the ISP-facing interface is correctly configured as ip nat outside. The problem is not with the interface NAT designation but with the ACL mismatch. Changing the inside interface designation would not fix the translation issue.

This option is incorrect because NAT overload commonly uses the IP address of the outside interface as the translated source address. This is standard Cisco NAT behavior and not a cause of failure in this scenario.

This option is incorrect because NAT does not depend on routing protocols like OSPF to function. NAT translation is independent of routing protocols, so running OSPF is not required for NAT overload to work.

Incorrect connection type 'ssh' and uses CIDR notation /24 instead of subnet mask.

Uses 'shutdown' command, which disables the interface instead of enabling it.

Uses the 'parents' argument, which is explicitly prohibited by the requirement.

Routers do not modify packet payloads to add hostnames during normal forwarding. Traceroute relies on ICMP Time Exceeded messages generated by routers when TTL expires, not on payload modifications. Adding hostnames would violate IP packet integrity and is not a standard function.

ARP (Address Resolution Protocol) operates only within a local network segment to map IP addresses to MAC addresses. It is not used for path discovery across multiple routed hops. Traceroute uses TTL expiry to trigger ICMP responses, not ARP replies.

Switches operate at Layer 2 and do not decrement TTL or generate ICMP Time Exceeded messages for traceroute. Syslog is a logging protocol used for network device event reporting, not for hop-by-hop path discovery. Traceroute relies on ICMP or UDP/TCP probes, not syslog messages.

RADIUS only encrypts the password attribute in the access-request packet; the rest of the packet, including other attributes like username and authorization data, is sent in clear text. This is a key security limitation of RADIUS compared to TACACS+.

TACACS+ uses TCP (port 49) as its transport protocol, while RADIUS uses UDP (ports 1812/1813). This is a fundamental difference: TCP provides reliable, connection-oriented delivery, whereas UDP is connectionless and faster but less reliable.

In 802.1X, the switch acts as an authenticator (passing EAP messages between the client and the authentication server), not as the authentication server itself. The authentication server is typically a RADIUS server that validates client credentials.

HTTPS adds encryption overhead, which can reduce throughput compared to HTTP, not improve it.

HTTPS provides transport-layer encryption but does not replace authentication. API access still requires authentication mechanisms such as API keys, OAuth tokens, or certificates to verify the identity of the client.

JSON is a data format that can be carried over any transport protocol, including HTTP, HTTPS, or even raw TCP. HTTPS is not required for JSON; it is used to secure the transport, not to enable a specific data format.

The command 'switchport trunk allowed vlan 10' is used on a trunk port to specify which VLANs are allowed to traverse the trunk link. It does not change the port mode to access; instead, it assumes the port is already a trunk. Therefore, it is incorrect for placing a switch port into access mode.

The command 'switchport mode dynamic desirable' enables Dynamic Trunking Protocol (DTP) to actively negotiate trunking with the connected device. This does not directly place the port into access mode; instead, it allows the port to become a trunk if the neighbor agrees. The port remains in a dynamic state until negotiation completes.

The command 'no switchport' converts a Layer 2 switch port into a Layer 3 routed port, which is used for routing between VLANs or connecting to routers. This removes all Layer 2 switching functionality, including VLAN assignment, and is the opposite of placing the port into access mode.

Option C is incorrect because JSON is not a protocol like HTTPS. HTTPS is a secure transport protocol, whereas JSON is a data format used within protocols or APIs for data representation, not for transport or security.

Option D is wrong since JSON is not tied to IPv6 networks or any specific IP version. JSON is a general-purpose data format used across various network environments and protocols, independent of IP addressing schemes.

Option E is incorrect because JSON has no relation to spanning-tree modes or any Layer 2 network protocol functions. JSON is purely a data format and does not influence or configure network protocols like STP.

The native VLAN does not have to be VLAN 1; it can be any VLAN as long as both sides of the trunk agree. The requirement for EtherChannel is that the native VLAN must match on both sides, but it does not have to be VLAN 1.

STP priority values do not affect EtherChannel formation; STP operates on the logical port-channel interface after the bundle is formed. EtherChannel requirements focus on physical and protocol compatibility, not spanning-tree parameters.

The specific factual error: The name-server address must match the actual DNS server; using 10.0.0.2 will not resolve the hostname.

The specific factual error: The 'ip host' command creates a static mapping, not a DNS resolution. The question requires DNS resolution to work, not a static override.

The specific factual error: The 'ip dns server' command enables DNS server services on the router, but the router is not meant to be a DNS server in this scenario. The fix is to point to the existing DNS server.

Administrative distance of 1 matches the default AD of a static route, so the floating route would not be less preferred; it needs a higher AD (e.g., 200) to act as a backup.

Using R1's own interface IPv6 address as next-hop would create a route pointing to itself, not to R2, and would not reach the loopback network.

The default route should use the default administrative distance (1) to remain the primary route; setting it to 200 would make it equal to the floating static route, causing unpredictable behavior.

Option A incorrectly states that SSH uses UDP and is therefore faster. SSH actually uses TCP to ensure reliable and secure delivery of encrypted data, so this option is false.

Option C incorrectly claims SSH works only on Layer 2 networks. SSH operates over IP (Layer 3) and can be used across routed networks, so this option is false.

Option D falsely asserts that SSH does not require user authentication. SSH requires authentication to establish a secure session, making this option incorrect.

Option B denies all IP traffic from the source subnet to the destination host, which is too broad and blocks all services, not just HTTP, violating the requirement to allow other traffic.

Option C denies UDP traffic on port 80, but HTTP uses TCP, so this entry would not block HTTP traffic and fails to meet the requirement.

Option D permits TCP traffic on port 80, which contradicts the requirement to block HTTP traffic from the source subnet to the web server.

Authentication mismatches prevent OSPF neighbors from reaching the 2-Way state by blocking bidirectional communication. Since the neighbors here have reached 2-Way, authentication mismatch is unlikely the cause.

Configuring the network type as point-to-point is not required on Ethernet segments and would change the adjacency formation behavior rather than explain the current normal 2-Way state with DROTHER routers.

Duplicate router IDs cause adjacency failures and routing problems but do not cause neighbors to remain in the 2-Way state with DROTHER routers. The output does not indicate a router ID conflict.

Spanning Tree Protocol (STP) operates at Layer 2 and has no mechanism to manage or allocate IP addresses; IP address exhaustion is addressed by protocols like DHCP or IPv6 transition technologies.

DNS lookups are application-layer processes that rely on IP connectivity and name resolution servers; STP does not influence DNS performance or resolution speed.

Wireless encryption is a security feature implemented at the data link layer (e.g., WPA2/3) and is unrelated to STP, which deals with physical topology loop prevention.

The static default route has an administrative distance of 200, which is higher than OSPF's default distance of 110. Therefore, OSPF's route is preferred, and the static route does not override it. Manual configuration does not bypass administrative distance; the router always prefers the lower distance.

Load balancing requires multiple routes with equal administrative distance and metric. Here, OSPF and the static route have different administrative distances (110 vs. 200), so they are not equal. The router will only use the best route (OSPF) and not load-balance.

Overlapping default routes are common and do not cause the router to ignore them. The router uses the route with the lowest administrative distance (OSPF) and ignores the static route unless OSPF fails. There is no conflict that would cause both to be ignored.

This option is incorrect because controller-based networking does not eliminate the need for physical network devices like switches and routers; these devices still forward traffic.

This option is incorrect since authentication and authorization remain necessary to secure access to the controller and protect network integrity.

This option is incorrect because controller-based networking applies to both wired and wireless networks and is not limited to wireless environments.

PortFast allows a port to transition to forwarding immediately upon link up, but it does not react to BPDU reception. BPDU Guard is a separate feature that disables the port upon receiving a BPDU, not accelerate forwarding.

Receiving a BPDU on a single edge port does not trigger a root bridge election. Root bridge election is based on bridge ID comparison across the entire spanning-tree domain, not on a single BPDU on a port.

BPDU Guard does not change the port mode; it only reacts to BPDU reception by disabling the port. Port mode (access or trunk) is configured separately and is not affected by STP protection features.

The specific factual error is that manually setting half-duplex does not resolve a mismatch; it may create a new mismatch or degrade performance further.

The specific factual error is that GigabitEthernet interfaces usually operate at 1000 Mbps; setting speed to 100 may cause the interface to not come up or to underperform.

The specific factual error is that clearing counters is a diagnostic step, not a fix. The root cause (duplex mismatch) remains unaddressed.

This option is incorrect because it assumes the router compares OSPF and EIGRP metrics directly. Metrics from different protocols are not comparable until administrative distance is considered, so the lower OSPF metric does not guarantee route installation.

This option is incorrect because load balancing occurs only when multiple equal-cost routes exist within the same routing protocol. Routes from different protocols are not automatically load-balanced simply because they reach the same destination.

This option is incorrect because the router automatically selects the best route using its decision process based on administrative distance and metric. Manual intervention is not required for route installation in this scenario.