CCNA 200-301 v2 (200-301) — Questions 1051–1125

This option is incorrect because both sides do not need to be active. One side active and the other passive is sufficient for LACP negotiation and channel formation.

This option is incorrect because PAgP is a different, Cisco proprietary protocol and does not work alongside LACP. Enabling PAgP does not affect LACP negotiation.

This option is incorrect because configuring one side as active and the other as passive uses LACP negotiation, not a static Port-Channel. Static Port-Channels require manual configuration on both ends without negotiation.

This option is incorrect because OSPF process IDs are locally significant and do not need to match between routers. Different process IDs do not prevent adjacency formation.

This option is incorrect because the interfaces are in the same IPv4 subnet (10.1.50.0/24), which is a prerequisite for OSPF adjacency on broadcast networks.

This option is incorrect because OSPF commonly runs on Ethernet interfaces. Ethernet is a supported media type for OSPF neighbor discovery and adjacency formation.

Reordering the name servers works around the issue temporarily but leaves the faulty server in the configuration, which is not a permanent solution and violates best practice of removing misconfigured DNS servers.

DNS resolves domain names to IP addresses but does not assign IP addresses, default gateways, or DNS server settings to clients. It is not responsible for automatic IP configuration, so it is incorrect for this question.

NTP synchronizes time across network devices and does not provide IP addressing or network configuration parameters to clients, making it irrelevant for this question.

TACACS+ is an AAA protocol used for authentication, authorization, and accounting. It does not handle IP address assignment or network parameter distribution, so it is not the correct service here.

The exhibit shows the ports as suspended, not err-disabled. Spanning-tree loops typically cause err-disable, not suspension.

The port-channel is up (U), so it is not shutdown.

The scenario explicitly states that all interfaces are configured with the same VLAN, so this is not the cause.

The answer fails to include the verification step, which is a critical part of troubleshooting and ensuring the configuration is applied correctly.

The ACL must match the correct inside network; without fixing it, PAT will not apply to the intended traffic.

The 'overload' keyword is essential for PAT; omitting it means the router will perform dynamic NAT without port translation, which is insufficient for multiple hosts.

Option B uses 'root secondary', which sets the priority to 28672, making SW1 a backup root, not the primary root bridge.

Option C uses a static priority assignment of 4096, which would also make SW1 root, but the question expects the Cisco-recommended macro command 'root primary'.

Option D uses incomplete syntax 'spanning-tree vlan 10 root' without 'primary' or 'secondary', which is invalid.

Incorrect. The default route is less specific and only used when no matching connected or static route exists. Since a connected route matches, the default route is ignored.

Incorrect. The router does not load-balance equally between a connected route and a default route. It selects the single best route based on prefix length and administrative distance.

Incorrect. The router clearly has a matching connected route for the destination subnet, so it will use that route rather than discarding the traffic.

UplinkFast is not designed to detect or prevent unidirectional links; it only accelerates failover.

The protections are applied to the wrong ports: BPDU Guard should be on access ports, Root Guard on ports facing potential rogue switches, and Loop Guard on uplinks.

PortFast does not prevent BPDU reception; it only skips the listening and learning states. Without BPDU Guard, the port would still process BPDUs and could become a root port.

The violation mode 'protect' silently drops frames from unknown MACs without disabling the port, which contradicts the requirement to shut down the port.

The 'mac-address' command with a specific address statically assigns that MAC, which is not dynamic. Sticky learning uses the 'mac-address sticky' command to dynamically learn and save the first MAC.

The 'restrict' mode does not disable the port; it only drops offending frames and logs the violation. The requirement explicitly states to shut down the port, which requires the 'shutdown' violation mode.

The specific factual error: passive mode on both sides will not form an LACP EtherChannel because neither side initiates negotiation; at least one side must be active.

The specific factual error: 'desirable' is a PAgP mode; LACP uses 'active' or 'passive'. Using 'desirable' would not form an LACP EtherChannel.

The specific factual error: the requirement explicitly states 'active mode on both sides', so setting one side to passive violates the requirement, even though the channel might still form.

Candidates often confuse unsynchronized status with authentication issues, but authentication failures do not prevent reception of packets; they just discard them after arrival.

A common myth is that NTP cannot sync if the clocks are too far apart. While extreme offsets may delay sync, they do not prevent the router from hearing the server, so the reference clock field would still show the server’s IP or clock ID.

Some candidates mistakenly believe that a separate 'ntp enable' command is required. In IOS, configuring an ntp server automatically enables NTP, so the service is active.

Auto-negotiation cannot match a hardcoded speed/duplex; 1000BASE-SX is for short distances (up to 550 m).

Gigabit Ethernet does not support half duplex; 1000BASE-LX maximum distance is 10 km.

Speed mismatch (100 vs 1000) will cause link failure; 1000BASE-EX is not an IEEE standard (ZX is used for extended reach).

Defense in depth refers to a layered security approach that employs multiple security measures to protect information. It does not specifically address the principle of granting users only the necessary permissions for their tasks.

Segmentation refers to dividing a network into segments to enhance security and manageability, rather than limiting user permissions. It does not directly address the concept of granting only necessary permissions to users.

Availability refers to ensuring that systems and data are accessible when needed, which does not relate to limiting user permissions for task completion. This option does not address the principle of restricting access based on necessity.

The specific factual error: WPA2-PSK is not compatible with clients expecting WPA3-Personal, and hiding the SSID prevents clients from seeing it.

The specific factual error: VLAN 1 is the default and often discouraged for management; the issue is not firmware-related but configuration-based.

The specific factual error: WPA3-Enterprise is not appropriate without a RADIUS server, and DHCP for management can lead to unreliable access.

This option is incorrect because LACP (Link Aggregation Control Protocol) does not require PAgP (Port Aggregation Protocol) as a backup; they are separate protocols. LACP can operate independently without needing PAgP on either side of the EtherChannel.

This option is incorrect because EtherChannel can indeed operate on switch trunks, allowing multiple VLANs to be carried over a single logical link. The issue in the question pertains to LACP configuration mismatches, not trunking capabilities.

This option is incorrect because Spanning Tree Protocol (STP) does not need to be disabled for EtherChannel to form; EtherChannel can operate alongside STP. Disabling STP can lead to network loops and is not a requirement for EtherChannel functionality.

When the next-hop IP is not directly connected, the router does recursively resolve the address to determine the outgoing interface.

This option is wrong because the selection of the root port is based on the lowest root path cost, not the local interface MAC address. The MAC address is not a factor in determining the root port in the Spanning Tree Protocol (STP) process.

This option is wrong because the selection of the root port in Spanning Tree Protocol (STP) is based on the lowest root path cost, not the duplex settings of the interfaces. Duplex settings do not influence the port selection process in STP.

The lowest configured VLAN number is not a factor in determining the root port in Spanning Tree Protocol (STP). The selection process prioritizes path cost, not VLAN configuration.

The 'network' command is for OSPFv2 and does not exist in OSPFv3; interface configuration is done via interface commands.

Setting the network type to point-to-point changes the OSPF link type; without matching configuration on R2, adjacency will fail.

Mismatched hello intervals prevent OSPF neighbor relationships from forming.

The static default route has an administrative distance of 200, which is higher than OSPF’s 110. Therefore, it is less preferred and will not be installed while the OSPF route is present, making this option incorrect.

Cisco routers do not perform per-packet load balancing between routes with different administrative distances. The route with the lowest AD is installed exclusively, so this option is incorrect.

Floating static routes do not suppress dynamic routes; instead, they serve as backups when dynamic routes are unavailable. Therefore, neither route is not installed is incorrect because the OSPF route will be installed.

Both routers are configured in area 0, so area mismatch is not the cause. Area mismatches prevent neighbor discovery, which would stop adjacency formation before ExStart.

If one interface is passive, OSPF hello packets are not sent, preventing neighbor formation altogether. This would stop adjacency formation earlier than ExStart.

The subnet mask is consistent on both sides, allowing neighbor discovery. Incorrect subnet masks would prevent neighbors from recognizing each other, blocking adjacency before ExStart.

The specific factual error is that WPA2-Personal with TKIP does not meet the WPA3-Personal requirement; WPA3 mandates AES-CCMP.

The specific factual error is that the radio policy must be set to 5 GHz only, not 'All', to restrict access to 5 GHz clients.

The specific factual error is that the WLAN remains disabled, so clients cannot associate even if other settings are correct.

The OSPF cost to the destination is not represented by the first number in brackets; it is the second number. Therefore, 110 cannot be the OSPF cost.

The number of hops is not indicated by the value 110. OSPF does not use hop count as its metric, so this option is incorrect.

The route age is shown separately after the next-hop IP address and interface, not inside the brackets. Thus, 110 does not represent route age.

This option is incorrect because NTP does not replace DNS. DNS resolves domain names to IP addresses, while NTP only synchronizes time across devices.

This option is incorrect because NTP does not negotiate EtherChannel parameters. EtherChannel negotiation is handled by protocols like PAgP or LACP, unrelated to time synchronization.

Common misconception that metrics are compared across different routing protocols. In reality, AD is evaluated first, and only routes from the same protocol with equal AD are compared by metric.

Mistaking ECMP as the mechanism for selecting between two routes from different sources; in this scenario, the static route's AD disqualifies the OSPF route entirely.

Misunderstanding that IP addresses, not administrative distance or metrics, influence path selection.

The option 'device' is incorrect because it refers to the key in the JSON structure, not the value associated with the 'hostname' key. The question specifically asks for the value of 'hostname'.

Option B is incorrect because it simply repeats the key 'hostname' from the JSON structure without providing the actual value associated with it, which is what the question asks for.

This option is wrong because the question specifically asks for the value of 'hostname', which is defined as 'R1' in the JSON snippet. '192.0.2.10' is the value of 'mgmt_ip', not 'hostname'.

Cable issues would manifest as input errors or interface flapping, but the counters show zero errors.

No errors are reported, so the SFP is functioning correctly.

The 'show interface' output clearly shows the interface is up, so no shutdown is not needed.

This option is incorrect because standard ACLs are usually placed closer to the destination, not the source, to avoid blocking legitimate traffic from other sources.

This option is incorrect since extended ACLs can filter ICMP traffic by specifying the ICMP protocol in the ACL configuration.

This option is incorrect because both numbered and named ACLs are valid for standard and extended ACLs; named ACL syntax is not required.

Logging provides visibility but does not replace authentication; authentication is still required for access.

Source restriction operates independently of Syslog; it does not require Syslog to be disabled or enabled.

Source restriction and logging apply to all administrative access, not just guest wireless networks, which is too narrow of a context.

The specific factual error: IP phones connect to access ports with a voice VLAN, not trunk ports. The native VLAN concept is misapplied here.

The specific factual error: Changing the access VLAN to 20 would place the PC on the voice VLAN, which is wrong. The AP does not need a voice VLAN. PoE is per-interface.

The specific factual error: Disabling PoE on IP phone ports prevents them from powering on. The voice VLAN is applied to the wrong interfaces. Trunk mode is unnecessary for an AP.

Source port is a transport-layer field used by TCP/UDP to identify application endpoints and is not modified by routers during forwarding, so it cannot prevent forwarding loops.

Sequence number is part of the transport layer used for ordering segments in TCP and is not altered by routers, so it does not affect packet forwarding or loop prevention.

CRC in the Ethernet trailer is recalculated on each link to verify frame integrity but does not influence IP packet forwarding decisions or prevent routing loops.

The designated port is responsible for forwarding traffic to and from a network segment and does not receive the best BPDU toward the root bridge; instead, it sends BPDUs to other ports. Therefore, it cannot be the correct answer for identifying the port role that receives the best BPDU on a nonroot switch.

The alternate port does not receive the best BPDU toward the root bridge; instead, it serves as a backup path to the root bridge when the primary path fails. It is in a blocking state and does not forward traffic.

A Disabled port does not participate in the Spanning Tree Protocol (STP) and does not receive any BPDUs, making it incapable of receiving the best BPDU toward the root bridge.

Access mode carries only a single VLAN, so it would stop inter-VLAN routing entirely.

The native VLAN is for untagged frames; changing it does not add VLAN 20 to the allowed list.

The 'except' keyword excludes the specified VLAN, so it would prevent VLAN 20 from being carried.

Access ports cannot carry multiple VLANs; they are assigned to a single VLAN. The concept of secondary VLAN does not exist for access ports.

ISL encapsulation is deprecated in favor of 802.1Q, which is the industry standard. Allowing all VLANs violates the principle of least privilege.

Including VLAN 1 is unnecessary and can be a security concern. The allowed VLAN list should be restricted to only the VLANs that need to be routed.

Option A is incorrect because the ACL used for NAT must permit the inside local subnet (192.168.20.0/24) to allow translation. Denying this subnet would block NAT translation, but the question states the ACL permits it, so this is not the cause.

Option C is incorrect because a /30 WAN link is commonly used in point-to-point connections and does not prevent PAT from functioning. PAT works independently of the WAN subnet size.

Option D is incorrect because NAT overload can be configured using a standard ACL; a route-map is optional and not required. The absence of a route-map does not cause the connectivity issue described.

While reinforcement learning has been studied for routing optimization, it is not a mainstream, production‑grade AI/ML application in today's enterprise networks and is considered experimental.

Fully autonomous AI that replaces all manual configuration is aspirational, not a current operational reality; network engineers still design, validate, and override AI suggestions.

Static threshold-based alerting uses fixed numerical triggers and does not employ machine learning algorithms, making it a legacy monitoring approach, not an AI/ML application.

The 'summary-address' command is not valid for OSPF; it is used in EIGRP and BGP.

The 'ip summary-address ospf' command is used for external route summarization, not for summarizing internal OSPF routes within an area.

The mask 255.255.255.0 is too specific and only covers a single /24 network, not the required range.

Uses outdated security algorithms MD5/DES for SNMPv3 and sets NetFlow version 5 instead of 9.

Omits the critical step of applying the NetFlow exporter to an interface, so flows are not captured.

Incorrectly uses 'show ip flow export' for verification; the correct command to view NetFlow cache is 'show ip cache flow'.

Root Guard does not shut down the port; it places the port in a root-inconsistent state, which effectively blocks traffic but does not disable the port. BPDU Guard, on the other hand, errdisables the port.

Loop Guard does not disable the port; it places the port into a loop-inconsistent state, blocking traffic on that port until BPDUs are received again. The port remains administratively up.

BPDU Guard errdisables the port, not just blocks it. Loop Guard uses a loop-inconsistent state, which is different from errdisable. BPDU Guard is a more severe reaction.

Misunderstanding ACL processing—assumes a simple subnet permit ACL would block port 22 by default, but the ACL entry permits all traffic from the subnet, not just specific ports.

Assumes port security is the first cause of connectivity failure when MAC limits are configured, but the symptom does not indicate a port security violation; the port would need to go into err-disabled, which is not mentioned.

AAA failures manifest as authentication errors or prompts that time out after attempting RADIUS, but they typically affect all attempts, not a single source, unless combined with ACLs that permit other hosts but block this one.

The specific factual error: RESTCONF requires 'application/yang-data+json', not 'application/json'.

The specific factual error: 415 relates to Content-Type, not Accept. Accept errors yield 406.

The specific factual error: RESTCONF does not silently fall back; it returns a 406 error.

This option is incorrect because the question specifies that LACP is being used, which is incompatible with PAgP. EtherChannel can operate with either LACP or PAgP, but not both simultaneously.

This option is wrong because EtherChannel can form with access ports or trunk ports, and there is no requirement for the interfaces to be routed ports for EtherChannel to function.

EtherChannel can function with as few as two member links; therefore, requiring three or more member links is not a valid reason for the bundle not forming in this scenario.

The specific factual error: EIGRP does not use 'network 0.0.0.0' to advertise a default route; default routes are typically redistributed or generated via 'ip default-network' or redistribution. Removing the EIGRP default route would break the intended primary path.

The specific factual error: Administrative distance is the primary factor for route selection between different routing protocols or sources. Changing the EIGRP metric does not affect the comparison with a static route.

The specific factual error: The 'ip route' command syntax is 'ip route prefix mask {next-hop | interface} [distance] [name] [permanent] [tag tag]'. There is no metric parameter. The correct way to make a static route less preferred is to set a higher administrative distance.

The Transport layer uses port numbers, not IP addresses. IP addresses are added during Network layer encapsulation.

MAC addresses are used for local delivery on a network segment and are part of Layer 2 encapsulation.

The Physical layer handles the actual transmission of raw bits over the network medium.

TACACS+ encrypts the entire packet, while RADIUS encrypts only the password – the opposite of what this option states.

TACACS+ supports command-level authorization, whereas RADIUS does not – this option reverses the capabilities.

802.1X port-based authentication uses RADIUS, not TACACS+, as specified by the IEEE 802.1X standard.

The direction of ACL application is correct; inbound on the interface where traffic enters the router is standard for filtering traffic from the LAN.

ACLs should be applied as close to the source as possible to deny traffic early. Applying on the serial interface would still work but is less efficient and not the best practice.

The permit ip any any allows all traffic, so HTTPS should be allowed. The problem says HTTPS is blocked, so the issue must be something else, like a missing explicit permit or a misordering.

DHCPv6 is not a protocol that replaces ARP; instead, it is used for assigning IP addresses and configuration information to IPv6 devices. ARP is replaced by the Neighbor Discovery Protocol in IPv6, which performs similar functions for address resolution.

EUI-64 is not a protocol but a method for generating IPv6 interface identifiers. It does not perform the function of resolving link-layer addresses like ARP does in IPv4.

SLAAC (Stateless Address Autoconfiguration) is a method for automatically configuring IPv6 addresses but does not perform the function of resolving link-layer addresses like ARP does in IPv4. Therefore, it cannot replace ARP in IPv6.

Using 'root secondary' for VLAN 20 sets priority to 28672, leaving MLS1 as backup root, not the primary root.

Manually setting priority to 4096 is valid but not the recommended method; 'root primary' is simpler and ensures proper value.

Global portfast and bpduguard are not required because the interface is already configured with those features; this adds unnecessary commands.

The workstation likely has DHCP enabled, but the switch's SVI being down prevents DHCP discovery from reaching a server.

A VLAN mismatch would likely result in a different IP address or no connectivity, but the SVI being down is a more direct cause.

The absence of a DHCP server is a possible cause, but the exhibit clearly shows the SVI is administratively down, which is a more specific and immediate issue.

This option is incorrect because APIs typically require authentication to ensure secure access and prevent unauthorized use, which is a fundamental aspect of API design.

APIs are not related to Ethernet duplex settings; they are software interfaces that enable communication between different applications or systems. This option misrepresents the fundamental purpose of APIs in network automation.

APIs are not limited to devices running Telnet; they can be implemented on various platforms and protocols, including HTTP and REST, which are widely used in modern network automation.

The specific factual error is that the instruction limits changes to R1 only; modifying R2 is not allowed.

The specific factual error is that the dead interval is not automatically derived from the hello interval; it must be set separately.

The specific factual error is that the hello interval is not automatically derived from the dead interval; both must be set explicitly.

YANG is a modeling language used to define the structure and constraints of network data but does not represent the actual data payload format. The question describes data output starting with curly braces and name-value pairs, which is a data format, not a model, so YANG is incorrect.

Syslog is a protocol used for sending event messages and logs from network devices. Its message format does not use curly braces or name-value pairs as JSON does, so it does not match the described API output format.

SMTP is a protocol for sending email messages and does not relate to network device data formats or API outputs. It does not use curly braces or name-value pairs in its message structure, making it irrelevant to the question.

Floating static routes require a higher AD, not lower, to be less preferred than the primary route.

Both IPv4 and IPv6 static routes can be configured as floating routes by setting a higher AD.

You can have multiple default static routes with different ADs, making the higher AD one a floating backup.

Root Guard is only effective on designated ports; applying it to access ports does not prevent an external switch from becoming root via the uplink. BPDU Guard on an uplink would err-disable it unnecessarily.

Root Guard on an access port does not protect against superior BPDUs from an external switch on the uplink. Loop Guard on an access port is unnecessary as unidirectional links typically affect trunk links.

Root Guard on an access port does not prevent an external switch from becoming root via the uplink. Loop Guard on an access port is not standard practice. BPDU Guard on the uplink would cause unnecessary err-disable.

This option is incorrect because an access port does not automatically convert to a routed port when connected to a trunk port; it remains an access port and will not participate in Layer 3 routing.

This option is wrong because switchport settings do not automatically synchronize between devices; each port retains its configuration independently, leading to a mismatch in link roles.

This option is incorrect because the configuration mismatch between a trunk and an access port does not directly affect OSPF router IDs, which are determined by the OSPF process itself and not by switchport configurations.

The DNS server is reachable and responds, but with incorrect data. Simply changing the server may not fix the issue if the new server also lacks the correct record.

The command 'ip domain-lookup' enables DNS resolution, but it is enabled by default. The problem is the incorrect DNS record, not the feature being disabled.

The domain name is already being used in the query (ServerA.example.com). Configuring a different domain name would change the query but not fix the incorrect record for ServerA.

This option is wrong because if the default gateway on the PC were incorrect, the client would not be able to reach any external IP addresses, not just hostnames. The issue specifically pertains to DNS resolution, not routing.

NAT overload failing on the edge router would typically affect the ability to connect to the internet entirely, not just when using hostnames. Since clients can browse by IP, this indicates NAT is functioning correctly.

This option is wrong because the issue described pertains to DNS resolution, not layer 2 switching or routing. The problem is related to hostname resolution failures, which are not affected by the switchport type.

Incorrect. The interface facing the ISP is typically marked with ip nat outside, not ip nat inside, because it represents the public or external side of the NAT boundary.

Incorrect. Not every routed interface requires NAT configuration. Only interfaces that participate in NAT translation should be marked as inside or outside to define the translation boundaries.

Incorrect. NAT is not limited to loopback interfaces, and loopbacks are generally not used for NAT inside or outside designation since NAT operates on interfaces connected to real networks.