CCNA 200-301 v2 (200-301) — Questions 1201–1275

The issue is with the IP addresses, which are not handled at Layer 1.

The MAC addresses are correct, so the Data Link Layer is functioning properly.

IP addresses are not part of the Transport Layer header; they belong to the Network Layer.

Different VLANs must use different IP subnets for routing; using the same subnet would break Layer 3 separation.

Access ports remain as access ports; inter-VLAN routing requires SVIs with routing enabled, not trunk conversion of access ports.

The default gateway for each VLAN is the SVI IP address; a wireless controller is irrelevant to Layer 3 forwarding between wired VLANs.

Preempt is not already enabled—otherwise both routers would not show as active. Failing to enable preempt leaves the split‑brain condition unresolved.

The virtual IP 192.168.1.254 is correctly assigned to the HSRP group; changing it would replace the default gateway for all hosts, breaking connectivity.

Removing tracking from R2 is irrelevant; the problem is R1's missing preempt and low priority, not R2's configuration. Both routers showing active is not caused by tracking on R2.

Incorrect. DHCP exhaustion would prevent some clients from obtaining IP addresses, but it does not cause RF interference or a sharp drop in wireless throughput. Since users can connect, DHCP exhaustion is unlikely.

Incorrect. An authentication mismatch would prevent clients from connecting to the SSID. Since users can connect, authentication is working properly and is not the cause of performance degradation.

Incorrect. A missing default route on the wireless controller affects upstream network connectivity but does not cause local RF interference or throughput drops in the wireless environment.

The AP using the wrong channel width would not cause immediate authentication failures; it typically affects connectivity or performance rather than authentication processes. Since the guest wireless works, the channel width is likely not the issue.

A mismatched RADIUS shared secret would cause authentication failures, but guest wireless works on the same access point, indicating the AP itself is functional; the more likely cause is that the RADIUS server is completely unreachable, not just a shared secret mismatch.

Configuring the SSID as hidden would not cause immediate authentication failures; users would simply not see the SSID unless they manually entered it. The issue described involves users seeing the SSID but failing authentication, indicating a problem beyond SSID visibility.

Resetting OSPF process IDs does not address VLAN traffic issues over a trunk link, as OSPF is a routing protocol and unrelated to Layer 2 VLAN configurations.

Adding an ip helper-address is irrelevant to VLAN traffic issues across a trunk link, as this command is used for forwarding DHCP requests, not for resolving VLAN connectivity problems.

Disabling the MAC address table would not resolve VLAN traffic issues across a trunk link, as it pertains to Layer 2 forwarding and would disrupt normal switch operations, leading to further connectivity problems.

The SVI is operational, so this cannot be the root cause.

The router receives the ICMP requests, so an inbound ACL would have dropped them before they reached the capture buffer.

ICMP redirects do not prevent the router from responding to pings; they only send redirect messages when appropriate.

The specific factual error is that LACP requires all member ports to have identical configurations, and this option does not align with the existing Port-channel configuration.

The specific factual error is that the VLAN allowed list must match across all member ports and the Port-channel interface; omitting VLAN 30 will cause inconsistency.

The specific factual error is that LACP requires consistent switchport mode (access or trunk) across all member ports and the Port-channel interface.

The specific factual error is that 'clear spanning-tree detected-protocols' does not recover err-disabled ports; it only re-initiates STP negotiations.

The specific factual error is that disabling BPDUGuard does not automatically bring the port back up; the err-disable state must be cleared separately.

The specific factual error is that reloading is overkill and not the recommended recovery method; it disrupts all traffic unnecessarily.

Incorrect. The device key is enclosed in curly braces, making it a JSON object, not an array. It groups hostname and interfaces under one entity.

Incorrect. The status field is a string within each interface object, not an array. Each interface has its own status string indicating up or down.

Incorrect. The hostname is a string property directly inside the device object and is not nested inside the interfaces array or any other array.

Option A (192.0.2.80) is incorrect because the subnet mask /28 indicates a block size of 16, making the valid network addresses range from 192.0.2.96 to 192.0.2.111. The network address for this subnet is 192.0.2.96.

The address 192.0.2.111 is not a valid network address for the subnet defined by 192.0.2.97/28, as it falls outside the range of usable addresses for that subnet, which spans from 192.0.2.96 to 192.0.2.111.

Option D, 192.0.2.112, is wrong because it does not represent the network address for the subnet defined by the IP address 192.0.2.97/28. The correct network address is 192.0.2.96, which is the first address in the subnet range.

The SVI must have an IP address for routing, but the DHCP server can serve addresses from any pool regardless of the SVI's subnet. The issue is with the pool itself.

If DHCP snooping were blocking messages, the 'Malformed messages' counter might increase, but the server would still receive some messages. The zero count indicates no messages are reaching the server.

There is no 'vlan' command under a DHCP pool. The pool serves all hosts in the subnet regardless of VLAN association.

This option is incorrect because the default route is less specific and only used when no other matching routes exist. Here, a more specific static route is present.

This option is incorrect because routers do not load balance equally between a specific static route and a default route; they prefer the most specific route.

This option is incorrect because the static route to 10.20.20.0/24 clearly matches the destination, making it a valid route for forwarding traffic.

The router-id is used only for OSPF router identification and does not need to be reachable; adjacency uses interface IP addresses.

OSPF does not require a specific subnet mask; it uses the configured mask on the interface as the network type.

OSPF is enabled on R2's G0/0; the issue is on R1's side where the passive-interface prevents hellos.

Candidates often believe that a missing FIB adjacency is the root cause, but in this scenario both paths are reachable and installed; the issue lies in how CEF weights the paths, which is influenced by interface parameters.

Exam‑takers may confuse verifying the symptom with identifying the root cause. Seeing only one interface transmitting confirms the problem but offers no corrective insight.

A common reflex is to re‑verify the obvious; however, the question states the routes are present and next‑hops are reachable, so revisiting the RIB is redundant.

Option C is incorrect because summarization does not force routers to use only a default route; it aggregates routes but still allows routers to use more specific routes within the summary when available.

Option D is incorrect since route summarization is a routing optimization technique and is unrelated to PAT overload, which is a NAT function that translates multiple private IP addresses to a single public IP address with port differentiation.

Option E is incorrect because route summarization does not involve encryption of routing updates; encryption is a separate security feature not related to summarization.

Candidates may attribute arbitrary high metrics to a bandwidth calculation error, without noticing that only one LSA is affected.

A misunderstanding that filtering can somehow alter the metric rather than block the advertisement completely.

Confusion between external and inter-area route types leads candidates to think that metric-type manipulation could affect an internal summary LSA.

SNMP does not use YANG data models and typically operates over UDP, not SSH.

RESTCONF uses HTTP/HTTPS for transport, not SSH, so it does not meet the requirement of operating over SSH.

CLI scripting lacks a standardized data model like YANG and is not a protocol that operates over SSH in the same structured manner as NETCONF.

A hidden SSID would prevent the SSID from appearing, but the user reports the SSID is visible, so this does not match the symptom.

PPP encapsulation on an AP uplink concerns Layer 2 framing, not the post-authentication VLAN or policy assignment that causes quarantine.

OSPF designated router election occurs at Layer 3 within routing, while the issue is about client VLAN placement after authentication, which is a Layer 2 access-control function.

This option is incorrect because administratively shutting down unused switch ports does not enforce SSH for device management; it simply disables unused ports to enhance security.

This option is wrong because administratively shutting down unused switch ports does not convert remaining ports into trunk ports; it simply disables access ports to enhance security.

This option is wrong because administratively shutting down unused switch ports does not directly replace VLAN segmentation; rather, it focuses on reducing the number of active ports to mitigate security risks.

STP (Spanning Tree Protocol) is incorrect because it operates at Layer 2 to prevent network loops and does not handle hostname resolution or IP services.

PAT (Port Address Translation) is incorrect because it translates private IP addresses to public IPs for outbound traffic but does not affect DNS or hostname resolution.

Port security is incorrect because it controls access to switch ports based on MAC addresses and does not provide or affect hostname resolution services.

Incorrect. The ACL in NAT configurations is used to identify which inside addresses to translate, not to filter or deny traffic. Denying RFC1918 traffic in the ACL is unnecessary and unrelated to the NAT failure described.

Incorrect. Using the outside interface IP address for PAT overload is a standard and supported practice in Cisco NAT configurations. This option does not explain the return traffic failure.

Option C is incorrect because accounting only logs user activities and does not replace the need for local usernames or authentication sources on Cisco devices.

Option D is incorrect as AAA supports both RADIUS and TACACS+ protocols; it is not limited to RADIUS, and TACACS+ is commonly used for device administration.

Option A states 12 usable hosts, which is incorrect because a /28 subnet provides 16 total addresses. Subtracting the network and broadcast addresses leaves 14 usable hosts, not 12. This option underestimates the host capacity.

Option C claims 16 usable hosts, which is incorrect because 16 represents the total number of addresses in the subnet, including network and broadcast addresses. Usable hosts must exclude these two reserved addresses.

Option D suggests 30 usable hosts, which corresponds to a /27 subnet mask (255.255.255.224), not /28. This overestimates the host count for the given subnet mask and is therefore incorrect.

A floating static route with a higher AD is installed when the lower AD route is removed because of interface failure.

Floating static routes do not distinguish between physical and administrative interface down events; the primary route is removed in both cases.

The immediate cause is the missing exit interface; neighbor discovery configuration does not make an incomplete static route valid.

The IPv6 next-hop 2001:db8:0:1::2 is not reachable via a directly connected network; the router cannot resolve it.

The administrative distance must be set to a higher value (e.g., 200) to make it a floating route.

The IPv6 route fails due to recursive lookup failure; adding AD does not fix the next-hop issue.

The specific factual error is that the authentication list must include 'group radius' to use RADIUS; 'local' alone bypasses RADIUS.

The specific factual error is omitting 'local' from the authentication list, which violates the requirement for fallback.

The specific factual error is confusing 'aaa authentication login' with 'aaa authentication dot1x'. They serve different purposes.

Requires agents and is pull‑based, failing both the agentless and push requirements.

Agents are mandatory, and the pull mechanism contradicts the push requirement.

Lacks built‑in push‑based orchestration, idempotency, and agentless design without significant custom development, making it less suitable than a purpose‑built tool.

Candidates often assume OSPF is not working at all when a default route is missing, ignoring other OSPF routes in the table.

Candidates may assume any connectivity failure means an interface is disabled, but the routing table would show no connected network if the interface were shut down.

Candidates might think a misconfigured static route would cause the problem, but they overlook that the route would still appear in the table, just with a different next-hop.

SYN flood is a Layer 4 TCP attack that is blocked by flood guards, not by DAI.

Route summarization error is a routing protocol misconfiguration and is unrelated to ARP packet validation.

Rogue DHCP relay is mitigated by DHCP snooping, not by Dynamic ARP Inspection.

Swapping the encapsulation would map VLAN 10 to the wrong VLAN ID, breaking connectivity.

The physical interface is already up; adding 'no shutdown' is redundant and does not resolve the missing routing capability.

The native VLAN on the trunk is not the cause of the problem, and the subinterface for VLAN 1 is not required for inter-VLAN routing.

Candidates assume that any missing traffic must be explicitly permitted, but this ignores the need for stateful inspection and leads to an overly permissive rule.

Candidates mistakenly think that moving the ACL to inbound direction will inherently permit return traffic because it inspects packets entering the interface, but the ACL still processes each packet individually without keeping state.

Candidates may think that only a stateful firewall can handle return traffic, overlooking the established keyword's capability to emulate stateful behavior for TCP traffic on an ACL.

The DELETE method is used to remove a resource from the server, which directly modifies the state of the device's configuration. Since the question specifies that the script must retrieve the configuration without making any modifications, DELETE is not appropriate.

The PUT method is used to update or replace a resource on a server, which contradicts the requirement of retrieving the current configuration state without making any modifications.

The POST method is used to send data to a server to create or update a resource, which contradicts the requirement of retrieving the current configuration state without modifying anything.

While a faulty cable could cause CRC errors, it would likely produce other error types and might not exhibit the specific pattern of only runts and CRC errors with no collisions. This pattern strongly points to a duplex mismatch.

A speed mismatch would generally cause the link to fail entirely; you wouldn't see interface errors because there would be no connectivity. The scenario describes connectivity with errors, so this is unlikely.

Outdated drivers may cause performance problems, but they do not produce the specific interface error counters on the switch. The recorded runts and CRC errors point to a physical or data-link layer issue, not a driver problem.

This option is incorrect because PAT overload uses a different command syntax involving 'overload' and allows many internal hosts to share one public IP, which is not the case here.

This option is wrong since static NAT does not inherently block inbound access; instead, it enables external hosts to reach the inside host via the mapped public IP.

This option is incorrect because NAT translation does not modify the subnet mask of the inside host; it only changes the IP address seen externally.

The 'restrict' mode allows frames from unauthorized MAC addresses to be dropped while sending SNMP traps and syslog messages, which contradicts the requirement of keeping the interface up without notifications.

The 'shutdown' mode disables the interface when a violation occurs, which is contrary to the requirement of keeping the interface up. It also does not align with the need to drop frames without sending SNMP traps or syslog messages.

The 'shutdown vlan' mode disables the entire VLAN when a violation occurs, which is not aligned with the requirement to keep the interface up. This option also typically sends SNMP traps or syslog messages, which contradicts the question's criteria.

The OSPF route (AD 110) has a lower metric but a higher administrative distance than EIGRP, so it loses.

The RIP route (AD 120) has the highest administrative distance and loses regardless of its hop count metric.

The static route with AD 95 loses to the EIGRP internal route (AD 90) because a lower AD is preferred.

This option is wrong because the STP root bridge ID does not directly affect the formation of an EtherChannel; EtherChannel requires matching port configurations, not spanning tree parameters.

The interface description does not affect the formation of an EtherChannel, as it is merely a label for identification purposes and does not influence Layer 2 connectivity or protocol negotiation.

The ARP timeout value does not affect the formation of a Layer 2 EtherChannel, as EtherChannel operates at Layer 2 and is concerned with port configurations, not Layer 3 settings like ARP.

The technician sees raw bits before framing, so this is not the Data Link layer.

The Network layer deals with logical addressing and routing, not the physical transmission of bits.

The Transport layer is above the Physical layer and does not deal with bit-level transmission.

Area mismatch is a valid cause but not supported by the given data; the IP addresses are on different subnets, which logically precedes area negotiation.

MTU is not shown; candidates may recall that mismatched MTU can cause OSPF problems but the scenario explicitly reveals an IP addressing inconsistency.

Authentication issues are common OSPF traps, but they are not indicated here; the IP address difference is explicitly observed.

This option is incorrect because controllers do not eliminate the need for switches and routers; these devices still perform the actual packet forwarding in the network.

This option is incorrect since controllers are highly relevant to automation, providing APIs and centralized control that enable automated network management workflows.

This option is incorrect because controller communication is not universally based on Telnet; modern controllers use secure protocols and APIs rather than relying solely on Telnet.

The specific factual error is that RESTCONF requires the media type application/yang-data+json for YANG data, not generic application/json.

The specific factual error is that the duplex setting is defined in the ietf-interfaces YANG model, not in Cisco-IOS-XE-native. The URI path must match the data model.

The specific factual errors are: (1) The PATCH body must be structured as {"ietf-interfaces:interface":{"duplex":"full"}} to match the YANG data tree; (2) The success response for PATCH is 204 No Content, not 200 OK.

16 would be the total addresses for a /28 mask (4 host bits), not the /27 mask specified.

30 is the number of usable host addresses (total addresses minus network and broadcast), not the total addresses.

64 would be the total addresses for a /26 mask (6 host bits), not the /27 mask specified.

This statement reverses the technologies: 802.11ac uses OFDM, and 802.11ax uses OFDMA.

802.11ax adds 2.4 GHz support for backward compatibility and better range.

TWT is a feature of 802.11ax, not 802.11ac.

This describes the capability of extended ACLs, not standard ACLs.

Protocol filtering is a feature of extended ACLs, not standard ACLs.

Both inbound and outbound application are possible, though placement depends on the filtering strategy.

STP (Spanning Tree Protocol) is a network protocol used for preventing loops in Ethernet networks, and it is not a data format used with REST APIs. Therefore, it does not represent objects, arrays, or key-value pairs.

EIGRP (Enhanced Interior Gateway Routing Protocol) is a routing protocol used for exchanging routing information within an autonomous system, not a data format for representing objects or key-value pairs in APIs.

802.1Q is a networking standard used for VLAN tagging in Ethernet frames, not a data format for representing objects or key-value pairs in APIs. It does not relate to REST API data representation.

Candidates may confuse security inspection with NAT translation, assuming that a protocol‑specific inspection is needed for HTTP.

Tempting because an ACL could selectively block TCP; however, the question provides context about the renumbering, which directly points to the NAT configuration.

Candidates may assume that different protocols might take different paths, but a single default route applies uniformly to all IP traffic.

Option B is incorrect because an alternate port does not forward traffic while the root port is active; it serves as a backup path and only becomes active if the root port fails.

This option is wrong because the alternate port does not participate in the election process for the root bridge; it only serves as a backup path to the root bridge once it is established.

Option D is incorrect because an alternate port is not a routed port; it operates at Layer 2 and is part of the Spanning Tree Protocol, which does not involve routing functionalities for inter-VLAN communication.

This option is incorrect because IPv6 gateways do not have to be global unicast; link-local addresses are valid for routing within the local network segment. The host can use the link-local address of the router as the next hop for packets destined to other networks.

This option is incorrect because a host with a link-local next hop can still reach global unicast addresses, as link-local addresses are used only for communication within the same local network segment.

This option is wrong because a router advertisement does not need to provide a MAC address for the next-hop link-local address to be valid; link-local addresses are inherently usable for local communication without MAC address specification.

HTTPS uses TCP, not UDP.

Standard ACLs cannot filter by port; extended ACLs are required.

Extended ACLs support host destinations; a wildcard subnet is not required for a specific host.

Candidates often think connectivity problems are caused by gateway misconfiguration, ignoring the subnet mask mismatch that actually prevents Layer 2 communication.

Candidates may glance at the output and assume an access list is blocking traffic, but the output clearly shows no ACL is applied.

A common troubleshooting mistake is to assume an interface is down, but the state is clearly shown as up in the exhibit.

WPA3 mandates AES encryption and does not include TKIP for any compatibility; TKIP was deprecated in WPA2.

WPA3-Personal uses SAE, not 802.1X/EAP; only WPA3-Enterprise relies on 802.1X.

GCMP-256 is only mandated in the optional WPA3-Enterprise 192-bit mode; standard WPA3 uses GCMP with 128-bit keys.

Protected Management Frames (PMF) are required, not optional, in WPA3 to mitigate management frame attacks.

This option is incorrect because the active route is determined by the administrative distance, not the metric. In this case, the EIGRP route has a lower administrative distance than the OSPF route, making it the active route.

This option is incorrect because only one route can be active for a given destination in a routing table, and having identical prefixes does not mean both routes can be active simultaneously. The router will select the route with the lower administrative distance, which is not addressed here.

This option is wrong because both routes are valid, and the router will select the route with the lower administrative distance, not the metric. The administrative distance of the EIGRP route is lower than that of the OSPF route, making it the active route.

This option is wrong because the question specifically addresses VLAN communication issues over a trunk link, which are unrelated to OSPF router ID configuration. OSPF router ID affects routing protocols, not VLAN traffic directly.

NTP source interface is unrelated to VLAN communication issues over a trunk link; it primarily affects time synchronization across devices. Since the question focuses on VLAN connectivity, this option does not address the core problem.

Lack of PAT overload on the WAN router is unrelated to VLAN communication issues between switches. This option pertains to address translation for outbound traffic, not VLAN trunking problems.

The specific factual error: Setting MLS1 priority to 0 makes it root, opposite of the requirement. Removing BPDU Guard does not recover the port; 'no shutdown' is needed.

The specific factual error: Reloading the switch is not the standard recovery for an err-disabled port; 'no shutdown' is the proper command.

The specific factual error: MLS1 should have a higher priority (e.g., 4096) and SW2 a lower priority (e.g., 0) to make SW2 root. The option does the opposite.

The specific factual error is that speed mismatch does not cause the high input error count without CRC errors; duplex mismatch does.

The specific factual error is that cable issues produce CRC errors, not just input errors; the absence of CRC errors rules out cable problems.

The specific factual error is that 'no shutdown' is used to enable an interface that is administratively down; here the interface is up and passing traffic.

The default gateway must be the IP address of the directly connected neighbor (R2's G0/0), which is 10.0.0.2, not 10.0.0.1.

The IP address 10.0.0.6/30 is in the same subnet as R2's G0/1 (10.0.0.5/30), so it does not resolve the duplicate address conflict. A different subnet must be used.

This option is incorrect because Cisco routers do not install multiple default routes with different administrative distances simultaneously; only the route with the lowest AD is installed and used.

This option is incorrect because the backup route is not ignored permanently; it becomes active when the primary default route toward ISP-A fails, ensuring continuous connectivity.

This option is incorrect because DHCP does not replace DNS. DNS is a separate service responsible for name resolution, while DHCP only provides IP configuration parameters including DNS server addresses.

This option is wrong because DHCP does not remove the need for default gateways. Hosts still require gateway information to communicate outside their subnet, and DHCP typically provides this information during configuration.

This option is incorrect because routing protocols do not depend on DHCP. Routing protocols function independently of IP address assignment methods and do not require DHCP to operate on user networks.

This option is incorrect because the native VLAN being set to 1 does not prevent VLAN 30 traffic from being transmitted across the trunk link. The issue lies in VLAN 30 not being allowed on the trunk, which is not addressed by the native VLAN setting.

This option is incorrect because VTP server mode is not required for VLANs to communicate across switches; VLAN configuration can be done independently on each switch. The issue in the question is related to trunking and VLAN allowance, not VTP mode.

Spanning Tree Protocol (STP) does not block all user VLANs by default; it only blocks specific ports to prevent loops. In this case, the issue is related to VLAN 30 not being allowed on the trunk, not STP blocking the VLAN.