CCNA 200-301 v2 (200-301) — Questions 976–1050

Removing the default gateway from the DHCP scope is incorrect because the default gateway is essential for routing traffic outside the local VLAN. Its presence does not cause hostname resolution failures.

The suggestion that clients must use PPP before DNS works is incorrect because PPP is unrelated to DNS resolution in a typical VLAN and DHCP environment. DNS operates independently of PPP.

Converting the VLAN to the native VLAN on all trunks does not affect DNS resolution. This option addresses Layer 2 trunking issues, which are unrelated to the hostname resolution problem described.

The OSPF /16 route is less specific than the static /24 route. Although OSPF is a dynamic routing protocol, the router prefers the route with the longer prefix length, so this option is incorrect.

The default route is only used when no specific matching route exists. Since both OSPF and static routes cover the destination, the default route is not used here, so this option is incorrect.

Overlapping prefixes are normal in routing tables and do not prevent route selection. The router resolves overlaps using longest-prefix match, so this option is incorrect.

The specific factual error is that a host route does not provide general internet access; it only covers the specified destination.

The specific factual error is that the next-hop must be a different device (upstream router), not the router's own interface IP.

The specific factual error is that on Ethernet interfaces, a next-hop IP is required to avoid potential ARP resolution problems; using only the exit interface is not the standard practice.

PAT overload is incorrect because it allows multiple internal hosts to share a single public IP for outbound traffic but does not provide a stable public IP for inbound connections to a specific server.

No NAT is incorrect because private IP addresses are not routable on the Internet, so the internal server would not be reachable from outside without address translation.

DHCP relay is unrelated to NAT or external reachability; it only forwards DHCP requests between clients and servers across subnets and does not affect how the server is accessed externally.

The track command is missing the decrement value; without it, the router will not adjust its priority when the interface fails.

The preempt command is missing; without preempt, a router with higher priority cannot take over the active role.

The track command uses a decrement of 10 instead of the required 20, so the priority drop is incorrect.

Single-mode fiber has a smaller core diameter (typically 9 microns) than multimode (50 or 62.5 microns), so this reverses the relationship.

Multimode fiber’s larger core introduces modal dispersion, limiting it to shorter distances; long-distance links use single-mode fiber.

IEEE 1000BASE-LX specifies a maximum distance of 5 km over single-mode fiber; 10 km is beyond the standard CCNA curriculum.

Option B is incorrect because JSON is a data format and does not provide encryption. Encryption is handled by protocols like TLS or HTTPS, not by JSON itself, so this option confuses data formatting with security.

Option C is wrong since JSON does not replace authentication. Authentication and access control are separate concerns managed by security protocols or API gateways, not by the data format used in responses.

Option D is false because JSON is a data format, whereas HTTPS is a transport and security protocol. They serve different purposes and are not interchangeable concepts.

Channel width affects all clients on the AP, not just a single client.

Hiding the SSID only prevents the SSID from being broadcast; it does not impact network access after association.

WPA2 does not require NTP for client authentication; NTP is for time synchronization, not client access control.

This option is incorrect because the route via 10.2.2.2 has a higher administrative distance (AD 5), making it a floating static route that only becomes active if the primary route fails.

This option is incorrect because the default route via 10.3.3.2 is less specific than the /24 static routes and will not be installed when a more specific route exists.

This option is incorrect because load balancing requires routes to have equal administrative distances and metrics. Since the static routes have different ADs, the router does not load-balance between them.

The specific factual error is that the voice VLAN is set to VLAN 10 instead of VLAN 20, which contradicts the requirement that voice traffic uses VLAN 20.

The specific factual error is the failure to enable PoE on the interfaces, which is required for both the AP and IP phones to operate.

The specific factual error is the omission of the 'switchport voice vlan 20' command on the phone ports, leaving them without voice VLAN assignment.

The router-ID is derived from the highest IP address on a loopback or physical interface, never from a MAC address.

A router-id change does not take effect immediately; you must clear the OSPF process or reload the router.

Router-IDs must be unique per router, not identical across all routers in the area.

The output shows individual port statuses (s) and (I), which indicate LACP negotiation states, not speed/duplex mismatches. While speed/duplex mismatches can cause EtherChannel issues, the specific flags in the exhibit point to a bundling problem, not a mismatch.

A Layer 3 port-channel can function correctly if configured properly. The output does not indicate any Layer 2 vs Layer 3 mismatch; the problem is that the member interfaces are not successfully bundling into the logical channel, as shown by the (s) and (I) status flags.

LACP does not require exactly four links; it can form bundles with 2 to 8 active links (and up to 16 total with standby). The exhibit shows only two member ports, which is perfectly valid for an EtherChannel.

192.168.1.7 is the broadcast address for the /29 block 0–7, which does not contain host .14. The host .14 is in the block 8–15, so its broadcast is .15.

192.168.1.14 is the host address itself, not the broadcast address. The broadcast address is always the last address in the subnet, which is .15 for the block 8–15.

192.168.1.16 is the network address of the next /29 block (16–23), not the broadcast address for the block containing .14. The broadcast address must be the last address in the same block as the host.

An STP root bridge ID is irrelevant to host IP reachability because it pertains to Layer 2 spanning tree topology and does not affect IP routing or DHCP configuration for hosts.

A voice VLAN value is specific to voice traffic segmentation on switches and does not influence a host’s ability to route IP packets to remote networks, making it unrelated to the connectivity issue.

A router ID is a concept used in routing protocols like OSPF and does not apply to DHCP or host IP configuration, so it cannot cause the described connectivity problem.

The specific factual error is that WPA3-only security may not be supported by the client, and changing the management interface IP does not resolve the client VLAN assignment issue.

The specific factual errors are: WPA3 may not be compatible, disabling SSID broadcast hides the network, and DHCP scope must be on the same VLAN as the client (VLAN 100).

The specific factual errors are: SSID broadcast must be enabled for client discovery, and the WLAN interface must be mapped to VLAN 100, not VLAN 1.

The subnet mask 255.255.255.0 is correct for a /24 network, so it is not the cause of the problem.

The default gateway is correctly set to 192.168.1.1, and the host can ping it, so the gateway is not missing or incorrect.

The IPv4 address is 192.168.1.100, which is a valid private address, not an APIPA address (169.254.x.x). APIPA addresses are used when DHCP fails, but here the host has a proper address.

Incorrect because tokens do not replace HTTPS; transport security remains necessary to protect data and tokens during transmission.

Incorrect as token usage is unrelated to IP address assignment, which is managed by protocols like DHCP or static configuration, not authentication tokens.

Incorrect because tokens do not convert API data into VLAN tags; VLAN tagging is a Layer 2 network function unrelated to API authentication mechanisms.

The specific factual error is that changing G0/1 to access VLAN 10 would not resolve the mismatch if the intended configuration is trunking. It would only create a different mismatch if the other side expects trunking.

The specific factual error is that dynamic desirable mode does not ensure trunking; it relies on DTP negotiation, which may fail if the other side is set to trunk. Additionally, the VLAN mismatch (access vs trunk) would still prevent EtherChannel formation.

The specific factual error is that the protocol does not affect the requirement for consistent interface configurations. Both LACP and PAgP require identical VLAN and trunk settings on all member ports.

Replacing the cable does not solve a duplex/speed mismatch because the errors are caused by configuration, not physical layer damage.

Disabling autonegotiation alone does not guarantee the interface will use the correct speed and duplex; it still requires manual configuration of the correct values.

Increasing the MTU addresses fragmentation issues, not CRC errors resulting from duplex or speed mismatches.

DNS (Domain Name System) resolves hostnames to IP addresses and has no role in time synchronization. DNS does not provide timestamp information or clock setting capabilities. Verifying DNS would not help ensure consistent timestamps in logs.

SNMP (Simple Network Management Protocol) is used for monitoring and managing network devices, not for time synchronization. While SNMP can retrieve device uptime or timestamps from MIBs, it does not set or synchronize clocks. Relying on SNMP for time consistency would not correct clock drift.

CDP (Cisco Discovery Protocol) is a Layer 2 protocol used to discover neighboring Cisco devices and their capabilities. It does not provide time synchronization or affect timestamps in logs. CDP is irrelevant for ensuring consistent timestamps.

The specific factual error is that the U/L bit was not flipped. The EUI-64 process requires flipping the seventh bit of the first byte of the MAC address.

The specific factual error is that FF:FE was not inserted between the first and second halves of the MAC address. The EUI-64 format requires the insertion of FF:FE.

The specific factual error is that the question asks for the resulting IPv6 address, not the configuration command. The command 'ipv6 address ... eui-64' is used to enable EUI-64, but the answer should be the actual address.

SNMPv2c uses community strings transmitted in plain text, lacking encryption and authentication. Polling every 30 seconds is low-frequency and cannot provide high-frequency, low-latency data collection required for real-time monitoring.

NetFlow v9 is export-based and not a real-time push mechanism; it typically sends data in batches, introducing latency. SNMPv3 encryption does not apply to NetFlow data, so the combination does not provide secure, high-frequency streaming.

IPFIX over UDP lacks built-in encryption, making data vulnerable to interception. MD5 hashing provides integrity but not encryption or authentication for the entire data stream, failing to meet the security requirements.

This option is incorrect because it describes PAT behavior, where multiple inside users share a public IP via port overload. Static NAT does not share the public address among users.

This option is incorrect because the internal server still requires a valid IP address on the internal network for routing and communication; static NAT does not remove this requirement.

This option is incorrect because NAT translates addresses but does not eliminate the need for routing. Proper routing is still necessary to deliver packets to the internal server.

DHCP Discover is always broadcast (destination FF:FF:FF:FF:FF:FF), not unicast, because the client does not know the DHCP server's MAC address.

A TCP SYN-ACK indicates the server received the SYN and is willing to establish the connection; it is part of a successful three-way handshake, not a failure.

The TTL in a captured packet is the value after decrementing at each hop; the original TTL is set by the source but is not preserved in the packet header.

Candidates may confuse administratively excluded addresses with dynamically detected conflicts.

The misconception is that aggressive ping settings create false conflicts, when in fact a conflict entry proves a reply was received.

Candidates might think that conflicts represent stale entries, but a conflict is a permanent record of a detected collision, not a lease state.

This option is incorrect because the root bridge ID shown in the STP details differs from SW2's local bridge ID, indicating SW2 is not the root bridge for VLAN 10.

This option is wrong since a non-root switch does not have all ports as designated ports; it must have one root port and may have other ports as designated or blocked.

This is incorrect because equal priorities do not disable STP; the protocol uses the MAC address portion of the bridge ID to break ties and continue operation.

The specific factual error: 'spanning-tree guard root' is a root guard feature, not BPDU guard. Also, manually setting priority to 4096 may not guarantee root if another switch has lower priority.

The specific factual error: 'root secondary' is for backup root, not primary. It sets priority to 28672, which is higher than the default priority of 32768 but not low enough to become root if another switch has a lower priority.

The specific factual error: priority 32768 is default and does not change root status. BPDU filter is not a security feature against BPDU attacks; it suppresses BPDUs entirely.

The specific factual error: 'interface reset' is not a real command; the correct command to reset counters is 'clear counters'.

The specific factual error: speed mismatch causes line protocol issues but not administrative down state.

The specific factual error: 'no keepalive' affects line protocol detection but does not change administrative state.

This option is incorrect because NTP only synchronizes time and does not replace the need for event logging, which is handled by Syslog or other logging mechanisms.

This option is incorrect because Syslog does not configure NTP server addresses or manage time synchronization; these are separate configuration tasks.

This option is incorrect because both NTP and Syslog are widely used on various network devices, including routers and switches, not limited to routers alone.

The ip default-gateway command configures the default gateway for a Layer 2 switch’s management interface and does not forward DHCP broadcasts. Since the question involves DHCP relay across routed VLANs, this command is irrelevant.

The switchport trunk allowed vlan 20 command controls VLAN traffic allowed on a trunk link but does not influence DHCP relay or routing between VLANs. The issue is DHCP relay, not VLAN trunk configuration.

The spanning-tree portfast default command enables PortFast on switch ports to speed up STP convergence and does not affect DHCP relay or routing. It is unrelated to the problem of clients not receiving DHCP addresses.

It does not show the transceiver type or diagnostic information.

It only shows the interface is err-disabled due to link-flap, not the root cause.

It indicates a problem but does not provide the specific transceiver details.

Candidates may assume the ACL is not applied correctly, but without interface details this conclusion cannot be drawn from the given output.

Candidates might blame the server configuration rather than the network ACL, but the question stem provides the server state to rule this out.

This is a common misconception: the explicit deny is not the root cause; the missing permit is the real issue. Removing the deny without adding a permit for HTTPS would still result in the traffic being blocked by the implicit deny.

This option is wrong because denying all IP traffic to the destination subnet would block all traffic to that subnet, not just the specific web server, which contradicts the requirement to allow access to other web destinations.

Using a standard ACL ignores the importance of destination details, which are crucial for selectively denying access to one specific web server while allowing others. This approach would lead to broader access restrictions than intended.

Placing the ACL only where no routing exists is incorrect because it does not address the requirement of selectively blocking traffic to a specific web server while allowing access to others. ACLs must be strategically placed to control traffic flow effectively based on routing paths.

The router does not discard the OSPF route; it installs both /16 and /24 entries because they represent different network-specific entries.

The traffic matches the /24 route, not the /16, so it would be forwarded via the EIGRP next-hop.

The /24 is a subset; traffic outside 172.16.10.0/24 matches only the /16 OSPF route.

The specific factual error is that interfaces-state is an operational data node, not configurable. RESTCONF requires the /data path for configuration and /operations for RPCs.

The specific factual error is that RESTCONF requires the media type application/yang-data+json for JSON encoding of YANG data, not generic application/json.

The specific factual error is that in RESTCONF, when modifying data from a specific YANG module, the JSON key must include the module prefix to avoid ambiguity.

'ip helper-address 10.10.10.50' is incorrect because it is used to relay broadcast traffic like DHCP requests, not for syslog or time synchronization.

'snmp-server host 10.10.10.60' is incorrect because SNMP manages network monitoring and traps, but does not synchronize device time or configure syslog destinations.

'service timestamps local' is insufficient alone because it adds timestamps but does not synchronize time across devices, so timestamps may remain inconsistent without NTP.

This option is incorrect because losing routing information after login does not selectively deny commands. Routing issues affect packet forwarding, not user command permissions, so it does not explain the selective command denial.

This option is invalid because an incorrect subnet mask on the user's workstation would affect network connectivity, not command access on the device after successful login. It does not relate to authorization or command restrictions.

This option is wrong since Syslog is a logging mechanism that records events but does not block or restrict user commands. It provides visibility but does not enforce command authorization or deny access.

Switches do not operate at Layer 1; hubs and repeaters do.

While some multilayer switches can route, the basic switch in this scenario operates at Layer 2.

Segments are used by transport layer protocols, not by switches.

0.0.0.0/0 is the IPv4 default route; the correct IPv6 default prefix is ::/0.

A floating static route must have a higher AD, not lower, so that it is less preferred and only installed when the primary (lower AD) route is lost.

Cisco IOS requires the next-hop to be reachable, but it does not have to be directly connected. As long as a route exists to reach that next-hop (even recursively), the static route can be installed.

BPDU guard is incorrect because it disables a port upon receiving any BPDU, which is suitable for edge ports but does not control root path roles or topology changes.

Port security is unrelated to STP root path control; it manages MAC address access on a port and does not affect BPDU processing or root bridge election.

DHCP snooping protects against rogue DHCP servers by filtering DHCP messages and does not interact with STP or root bridge election mechanisms.

Syslog severity 7 refers to debug-level logging detail but does not trigger unsolicited alerts; syslog messages require polling or log monitoring and are not part of SNMP's event-driven notification.

DHCP relay is a mechanism to forward DHCP requests across networks and has no role in SNMP or event-driven notifications, making it irrelevant to the question.

NetFlow exporters provide detailed traffic flow information for analysis but do not send immediate event notifications; they are unrelated to SNMP traps or polling mechanisms.

Candidates sometimes associate packet loss with duplex mismatches, but a duplex mismatch would also show collisions and typically input errors, both of which are zero here.

Zero input errors means no physical-layer receiving problems; the candidate may misinterpret the absence of errors as a sign of some other problem, which is logically incorrect.

Increasing the queue size is a common workaround that masks the real problem, but the underlying mismatch in forwarding rates remains. CCNA candidates may incorrectly focus on the queue size rather than the relationship between the 100 Mb/s interface speed and a faster upstream sender.

The specific factual error is that the switch port is manually set to half duplex, not full duplex. Also, runts and FCS errors are not the primary indicators of a duplex mismatch.

The specific factual error is that a duplex mismatch requires different duplex settings; both half duplex would not cause a mismatch. Faulty cables are a different issue.

The specific factual error is that auto-negotiation would likely result in half duplex on both sides, avoiding a mismatch. The scenario states the switch port is manually set to half duplex, not auto.

It skips the more targeted hypothesis that an access control list is selectively blocking R1. The candidate mistakenly assumes that a unidirectional reachability problem is always caused by a missing return route.

This option investigates a Layer 3 adjacency that the successful R2-to-R3 ping has already validated. Candidates often default to checking neighbor state without considering the evidence that rules it out.

Candidates may recall MTU as a cause of intermittent connectivity issues, but here the symptom is a total failure from one source, making MTU a low-probability next step.

The 'protect' mode does not disable the port when the secure MAC address limit is exceeded; instead, it drops packets from unknown MAC addresses without generating a notification. This behavior does not match the requirement of the question.

The 'restrict' mode allows traffic to pass but drops packets from unknown MAC addresses, without disabling the port. This does not meet the requirement of automatically disabling the port when the MAC address limit is exceeded.

The 'dynamic' option is incorrect because it does not refer to a specific port-security violation mode that disables the port when the MAC address limit is exceeded. Instead, it implies the dynamic learning of MAC addresses without enforcing a security limit.

The SSID broadcast setting does not directly impact the ability of users to connect to an internal application once they are authenticated and assigned an IP address. Since wired users can access the application, the issue is likely related to WLAN-specific configurations rather than SSID visibility.

The access point's hostname does not directly impact application access; it primarily affects network identification and management. Since the issue is specific to WLAN access and not present for wired users, the hostname is unlikely to be the cause.

This option is wrong because the issue pertains to application access over a specific WLAN, not the type of connection (PPP vs. Ethernet). The problem likely lies in WLAN configuration rather than the protocol used by the client device.

The trap level 'informational' captures messages of severity 6 and lower, but notifications are severity 5, which is higher and thus not included.

The NTP source interface must be explicitly set to ensure the server can reply to the correct IP; omitting it can lead to unsynchronized state.

The debugging level includes all severities, which is too broad; the requirement is to capture only notifications (level 5) and above, which requires 'notifications' level.

Option A (/28) is incorrect because a /28 subnet provides only 16 total addresses, which results in 14 usable host addresses after subtracting the network and broadcast addresses. This is insufficient to support 30 hosts.

Option C (/26) is incorrect because although it supports 62 usable hosts, it is larger than necessary for 30 hosts, leading to inefficient IP address allocation.

Option D (/25) is incorrect because it provides 126 usable host addresses, which is far more than required, resulting in significant address space waste.

Leaving the standard ACL inbound on the LAN interface is incorrect because standard ACLs filter only by source IP, which causes all traffic from that host, including local LAN traffic, to be blocked. This disrupts local communications and is not best practice.

Converting the ACL to a VTY access-class is irrelevant to the question because VTY access-classes control remote management access to the router, not general traffic filtering from a host to remote networks.

Applying the ACL inbound on all switch access ports is impractical and inefficient. It would block traffic at multiple points unnecessarily and does not address the specific need to filter traffic from the host to remote networks.

This option is incorrect because static routes do not inherently block traffic; they simply define paths for routing packets. A static route allows traffic to specific destinations, rather than blocking unknown ones.

This option is wrong because the static route configured does not limit routing to a single host; instead, it typically defines a broader range or a default route for multiple destinations.

This option is wrong because static routes do not inherently advertise routes into OSPF; they simply define a path to a specific destination. The question specifically asks about the function of a static route, which does not involve OSPF route advertisement.

This option is incorrect because authentication and logging serve different purposes; authentication controls access, while logging records events. They are not redundant but complementary.

This option is wrong because centralized logging only records events and does not prevent unauthorized access, so it cannot replace strong authentication.

This option is incorrect because even with strong authentication, event records remain essential for auditing, troubleshooting, and investigating security incidents.

The phone works but the PC cannot reach the data network, indicating the PC is not in the correct VLAN. 'switchport mode dynamic auto' sets the port to negotiate trunking via DTP, which does not assign a data VLAN to the PC.

The PC cannot reach the data network because the switchport is likely configured as a voice VLAN only, but the data VLAN (access VLAN) is missing. Option B configures the voice VLAN, which is correct for the phone, but does not set the access VLAN for the PC.

The issue is that the PC cannot reach the data network, which is typically configured via the access VLAN. Spanning-tree guard root is unrelated to VLAN assignment; it prevents a switch from becoming the root bridge, not connectivity issues on a specific VLAN.

Open wireless access does not provide any default encryption, so it is not secure.

A longer SSID does not strengthen WEP; WEP's vulnerability is due to its use of static keys and weak RC4 algorithm, not SSID length.

WPA2 is a wireless security standard (Wi-Fi Protected Access 2), unrelated to Ethernet duplex modes.

Incorrect. NTP configuration affects time synchronization but does not impact DNS resolution or hostname-based browsing, so it is unrelated to this issue.

Incorrect. Changing switch access ports to dynamic desirable affects VLAN trunk negotiation (DTP) but does not influence DNS resolution or hostname connectivity.

Incorrect because DNS failure does not imply the default gateway is missing. Routing and DNS are separate functions, and gateway issues are unrelated to DNS resolution.

Incorrect because DHCP and NTP are independent IP services. DNS failure does not cause these services to fail immediately or automatically.

Incorrect because DNS does not replace routing. DNS resolves names to IP addresses, while routing protocols determine packet forwarding between subnets.