CCNA 200-301 v2 (200-301) — Questions 1276–1350

CAPWAP tunnels require the AP to have an IP address; the statement is false.

CAPWAP operates over IP using UDP ports, not PPP.

The controller may have an AP capacity limit, but with only one AP failing and no evidence that the limit is 14, this is not the strongest explanation.

TACACS+ encrypts only the password and is designed for device administration, not for 802.1X authentication which requires EAP support—RADIUS is the correct choice.

The global command 'aaa new-model' enables the AAA architecture but does not automatically enable 802.1X on interfaces; additional commands like 'dot1x system-auth-control' and per-interface 'authentication port-control auto' are needed.

802.1X requires the switch port to be in access mode, not trunk mode; trunk ports do not support 802.1X because multiple VLANs would conflict with the authentication process.

A common misconception is that any down state is an admin shutdown, but Cisco IOS distinguishes 'Secure-shutdown' for port-security errdisable from 'administratively down'.

Some candidates misread the output and assume sticky is off, but the presence of a sticky MAC count proves it is active.

It is tempting to assume any violation with maximum 1 is due to exceeding the limit, but in this case the secure MAC is the original sticky address, and the violation is from a different unauthorized MAC, which still respects the limit count but fails the authorization check.

Option C is incorrect because JSON does not require closing tags like XML; it uses braces and brackets to delimit data structures, making this statement false.

Option D is incorrect as JSON supports a variety of data types beyond numeric values, including strings, booleans, arrays, objects, and null, so it is not limited to numbers.

The route 172.16.0.0/16 matches the destination IP but is the least specific route with a /16 mask. Since more specific routes exist, the router will not select this route.

The route 172.16.20.0/24 also matches the destination but is less specific than the /25 static route. The router prefers the longer prefix match, so this route is not chosen.

The default route is only used when no other routes match the destination IP. Since multiple specific routes exist, the default route is not used in this case.

The specific factual error is that OSPFv3 uses interface-level configuration, not network statements under the OSPF process.

The specific factual error is that setting a router ID alone does not activate OSPFv3 on an interface; OSPFv3 must be explicitly enabled on the interface.

The specific factual error is that 'passive-interface default' would actually prevent adjacency, not help form it.

Different hostnames do not affect OSPF adjacency since hostnames are used only for identification and management, not neighbor formation.

Different loopback addresses used for management do not influence OSPF adjacency on Ethernet interfaces, so they do not block neighbor relationships.

One router using SSH version 2 is unrelated to OSPF adjacency because SSH is a management protocol and does not impact routing protocol neighbor formation.

Candidates may think network type mismatch when they see no adjacency, but the exhibit does not indicate a mismatch and explicitly shows the passive state.

Timer mismatch is a classic troubleshooting trap, but the 'No Hellos (Passive interface)' message overrides any timer considerations.

Candidates may guess area mismatch as a cause, but the exhibit provides no evidence of it, while the passive-interface message is a direct cause.

This option is incorrect because ARP is used for local subnet communication and does not depend on the presence of a default gateway. The host can still use ARP to communicate locally.

This option is wrong because a host does not automatically become part of every remote subnet without a gateway. The subnet mask defines the local subnet boundaries, and gateway absence does not change this.

This option is unrelated to the problem. Converting an access port to a trunk port affects VLAN tagging on switches but does not impact a host’s ability to have or use a default gateway.

A priority of 255 is the highest possible value, ensuring the router becomes the DR or BDR, not excluding it.

Priority 1 is the default and allows the router to be elected if it has the highest priority or Router ID.

Loopback interfaces are not used for DR/BDR elections; they are logical interfaces. The priority must be set on the physical interfaces connecting to other routers.

This option is wrong because the ACL only permits TCP traffic on port 443 and ICMP traffic, so an HTTP packet (port 80) from the specified source would be denied by the implicit deny rule at the end of the ACL.

This option is wrong because NAT does not occur before ACL evaluation; the ACL is applied directly to the packet as it arrives at the interface. Therefore, the HTTP packet is evaluated against the ACL without any translation taking place.

This option is wrong because the ACL does not automatically convert HTTP traffic to HTTPS; it only permits or denies traffic based on the defined rules. The packet from 10.10.10.25 is not permitted by the ACL since it is not targeting port 443.

The static NAT command syntax is 'ip nat inside source static [inside-local] [inside-global]'. Here, the inside local (private) should be 172.16.1.100 and inside global (public) should be 10.0.0.3. Also, the inside interface is the one facing the internal network (G0/1) and outside is facing the ISP (G0/0).

NAT requires that the interface facing the internal network be marked as 'ip nat inside' and the interface facing the external network be marked as 'ip nat outside'. Here, G0/0 connects to the ISP (outside) and G0/1 connects to the internal network (inside).

The command 'ip nat outside source static' translates the source address of packets arriving on the outside interface. For translating internal host addresses to a public IP, 'ip nat inside source static' must be used.

Administrative distance is only compared when two routes have the same prefix length. Here, the /32 route has a longer prefix, so it is chosen first.

Load balancing requires routes with identical prefix lengths and metrics. The /32 and /24 routes are treated as different destinations.

AD is only compared when routes have the exact same prefix length. The routing table can hold multiple overlapping routes as long as they differ in prefix length.

Incorrect because OSPF can handle multiple equal-cost routes and does not discard them; it uses all equal-cost paths to improve traffic distribution.

Incorrect since OSPF does not keep only the first learned route when multiple equal-cost paths exist; it installs all such routes for load balancing.

Incorrect because OSPF does not replace multiple valid equal-cost routes with a default route; default routes are used only when no specific routes exist.

Candidates may focus on Hits: 0 and Misses: 15042 as typical of an ACL issue, but the explicit interface binding in the dynamic mapping is the direct evidence of misconfiguration.

The high CEF Punted count mirrors the misses, leading some to believe CEF is the problem, but the exhibit does not indicate CEF is disabled.

Candidates might assume that a high miss count reflects a full translation table, but the total active translations show 0.

The command 'show ip ospf neighbor' is used to display OSPF neighbor relationships, which is not directly related to verifying the operational status of a port-channel. This command would not provide information about the port-channel configuration or status.

The command 'show ip route' is used to display the routing table of a device, which does not provide information about the operational status of a port-channel after configuration changes.

The command 'show access-lists' is not relevant for verifying the operational status of a port-channel; it focuses on access control lists rather than link aggregation status.

Option A is incorrect because a 301 status code indicates that the requested resource has been moved permanently to a new URL, not an authentication issue. Confusing 301 with 401 can lead to misdiagnosing API errors.

Option B is incorrect since a 204 status code means the request was successful but no content was returned. It does not indicate any authentication problem, unlike 401 which specifically relates to authorization failures.

Option D is incorrect because a server's inability to parse JSON usually results in a 400 Bad Request error, not a 401 Unauthorized. The 401 code is strictly about authentication, not parsing or syntax errors.

Option A incorrectly states that the backup route is never considered because of its higher administrative distance. In reality, the higher AD is intentional to make it a floating static route that only activates when the primary route is removed.

Option C is incorrect because floating static routes do not require dynamic routing protocols to work. They are static routes with adjusted administrative distance and can function independently.

Option D is wrong because backup routes typically use a different next hop to provide true redundancy. Using the same next hop would not protect against next-hop failure.

The destination is local to the same /26 subnet, so it does not need to go through the default gateway.

The subnet directed broadcast is 172.16.50.191 (the last address in the .128/26 range), not .190.

The source address 172.16.50.130 is a usable host address, not the network address of the subnet.

Single-mode fiber supports much longer distances (up to 10 km or more) than multimode fiber (typically up to 550 m for 10 Gbps).

SFP is limited to 1 Gbps; for 10 Gbps, SFP+ is required.

This describes single-mode fiber, not multimode.

A /27 subnet provides only 30 usable host addresses (32 total minus 2 for network and broadcast), which does not meet the requirement of at least 62 usable addresses.

Option C: /25 provides 126 usable host addresses, which exceeds the requirement of at least 62 usable addresses. However, it is not the smallest prefix that meets the requirement, as /26 suffices with 62 usable addresses.

Option D: /24 provides 256 total addresses, with 254 usable, which exceeds the requirement of at least 62 usable addresses. However, it is not the smallest prefix that meets the requirement.

Duplicate IP conflicts typically result in a warning but do not cause the system to assign a 169.254.x.x address.

DNS issues do not affect IP address assignment via DHCP.

The subnet mask is correct for the APIPA range; the problem is the lack of a DHCP server response.

The specific factual error is that LACP modes must be compatible (active-active or active-passive), but the question states both sides are active, so mode is not the issue.

The specific factual error is that VLAN settings are irrelevant to the physical bundling of ports in an EtherChannel.

The specific factual error is that interface mode is a Layer 2 property unrelated to the physical bundling process.

Incorrect because if the server were in the wrong VLAN, users would not be able to reach it by IP address. Successful IP access proves VLAN membership is correct.

Incorrect because a missing default gateway would prevent IP connectivity to the server if it were on a different subnet. Since IP access works, the default gateway is present and functional.

Incorrect because GRE tunnels are unrelated to hostname resolution. Hostname access depends on DNS, not tunneling protocols like GRE.

Misunderstanding of route preference: a higher AD value does not keep a floating static installed when a better OSPF route becomes available.

Troubleshooting should follow the OSI model bottom‑up; immediately resetting processes skips basic interface‑level verification.

It targets a different root cause (OSPF adjacency failure due to MTU) that would manifest constantly, not only after interface recovery.

A /24 subnet provides only 256 usable host addresses, which is insufficient for the requirement of at least 500 usable addresses. Therefore, it cannot be the correct answer.

Option C (/22) provides 1022 usable addresses, which exceeds the requirement of 500 usable addresses, but it is not the smallest prefix that meets the requirement. The correct answer is /23, which provides exactly 510 usable addresses.

Option D: /25 provides only 126 usable host addresses, which is insufficient for a requirement of at least 500 usable addresses in a single subnet.

Incorrect because the DF bit explicitly forbids fragmentation; the router cannot fragment the packet if DF is set.

Incorrect because routers do not clear the DF bit to fragment packets; they respect the DF bit as set by the source.

Incorrect because GRE encapsulation is unrelated to MTU handling and fragmentation behavior.

The helper-address must be the IP of the DHCP server, which is the SVI address 192.168.50.1, not the link address 10.0.0.1.

The helper-address misconfiguration prevents DHCP requests from being forwarded to the correct server, so fixing only the excluded range is insufficient.

The excluded range must be corrected to allow hosts to receive addresses from the pool; otherwise, the DHCP server will not assign addresses.

This option is incorrect because ARP is used for local Layer 2 address resolution and remains functional even if the default gateway is missing; the host can still resolve MAC addresses on the local subnet.

This option is incorrect because the host’s subnet membership is determined by its IP address and subnet mask, not by the presence or absence of a default gateway; it does not join other subnets automatically.

This option is incorrect because a host does not become a default gateway for other devices simply by lacking a configured gateway; routing and gateway roles require explicit configuration on routers.

An SSID misspelling would prevent all clients from seeing the SSID, but since clients on other floors connect successfully, this cannot be the issue.

BGP autonomous system mismatch is a routing protocol concept unrelated to wireless LAN performance issues and would not cause performance problems on a single floor.

IPv6 loopback addressing is a configuration detail that does not impact wireless client performance or connectivity in a local-area network context.

This option is incorrect because JSON objects do contain fields; they are collections of key-value pairs representing attributes of a single entity, so the claim that objects cannot contain fields is false.

This option is wrong because JSON arrays are a general data structure used for any list of items, not exclusively for IPv6 interfaces; interface type does not dictate JSON structure.

This option is incorrect because the choice of JSON data structure (array vs. object) does not affect API authentication or security; these are separate concerns unrelated to data formatting.

Option A (192.168.5.63) is incorrect because it does not fall within the subnet defined by the address 192.168.5.126/25, which has a valid range of 192.168.5.128 to 192.168.5.255 for host addresses.

The address 192.168.5.128 is incorrect because it falls outside the subnet defined by 192.168.5.126/25, which includes addresses from 192.168.5.0 to 192.168.5.127. The broadcast address for this subnet is 192.168.5.127.

Option D, 192.168.5.255, is incorrect because it is the broadcast address for the entire 192.168.5.0/24 subnet, not the /25 subnet specified in the question.

This option is wrong because the router ID is relevant for routing protocols, not for VLAN traffic issues on a trunk link. The problem specifically pertains to VLAN 40 traffic, which is not influenced by router IDs.

NetFlow is a network protocol used for collecting IP traffic information, but it does not directly affect VLAN traffic flow on a trunk link. Therefore, checking if NetFlow is enabled does not address the issue of VLAN 40 traffic failure.

NTP synchronization is not directly related to VLAN traffic issues on a trunk link; it primarily affects time-sensitive protocols. Therefore, checking NTP synchronization would not help diagnose why VLAN 40 traffic is failing.

This option is wrong because a static route with a lower administrative distance than OSPF would take precedence over OSPF routes, making it active even when OSPF is available, contrary to the requirement of using the static route only when the OSPF route is unavailable.

This option is wrong because a second OSPF route with a lower metric would not serve as a backup to the existing OSPF route; instead, it would be preferred over the static route, which contradicts the requirement for the static route to be used only if the OSPF route disappears.

A default route with no next hop would not serve as a backup for an OSPF route because it lacks specificity and cannot direct traffic to a specific network. It would be ineffective in scenarios where a specific static route is needed when OSPF fails.

Option B incorrectly identifies severity level 3 as Emergency; level 3 actually represents Error, which is serious but less critical than Emergency (0).

Option C incorrectly identifies severity level 5 as Emergency; level 5 is Notification, which indicates normal but significant conditions, not emergencies.

Option D incorrectly identifies severity level 7 as Emergency; level 7 is Debugging, the lowest severity level used for detailed troubleshooting information.

Incorrect because Spanning Tree Protocol (STP) root bridge election affects Layer 2 switching topology, not Layer 3 NAT translation or routing on the WAN interface.

Incorrect because voice VLAN configuration on branch access switches does not influence NAT translation or whether private IP addresses are translated on the WAN interface.

Incorrect because a loopback interface IP address does not affect PAT translation of inside user traffic; PAT depends on NAT ACLs and routing, not loopback IP addresses.

The DNS server option is not critical for basic connectivity to remote networks; it primarily affects name resolution. If a client can obtain an IP address but cannot reach remote networks, the issue is more likely related to the default gateway configuration.

The lease time option specifies how long a DHCP lease is valid, but it does not affect the ability to reach remote networks. Therefore, a missing or incorrect lease time would not directly cause connectivity issues.

The TFTP server option is not necessary for a client to reach remote networks, as it primarily facilitates file transfers and does not impact routing or network accessibility. Therefore, its absence would not directly cause connectivity issues to remote networks.

Option A is incorrect because the POST method is not used for retrieving resources; instead, it is intended for creating new resources or submitting data for processing in a RESTful API context.

The POST method is used to create or submit data, not to delete resources. Option C incorrectly describes the function of the DELETE method in RESTful APIs, which is responsible for removing resources.

Option D is incorrect because the POST method is not idempotent and does not replace an existing resource; it is primarily used to create new resources or submit data.

Converting unused ports into a trunk does not prevent unauthorized access; it actually allows multiple VLANs to be carried over a single link, potentially exposing sensitive data. This action could inadvertently grant access to unauthorized devices if they connect to these trunked ports.

Enabling Telnet on unused ports does not prevent unauthorized access; instead, it creates a potential security vulnerability by allowing remote access to those ports. This action could expose the network to unauthorized monitoring or control.

Removing VLAN assignments from active user ports does not prevent unauthorized devices from accessing the network; it could disrupt legitimate user access instead. The goal is to secure unused ports, not impact active ones.

This option is wrong because `switchport mode dynamic auto` does not force immediate trunking; it relies on negotiation, and if neither side actively negotiates, the link remains non-trunking.

This option is wrong because a switchport configured with `switchport mode dynamic auto` does not automatically convert to a routed Layer 3 link unless explicitly configured to do so. The default behavior is to remain in access mode unless trunking is negotiated.

Option D is incorrect because configuring `switchport mode dynamic auto` does not delete VLANs; it merely affects trunk negotiation. VLANs remain configured on the switches regardless of trunking status.

A common mistake is to try to explain zero matches by directional misapplication without first checking whether an ACL is actually present. The exhibit explicitly shows no ACL is bound.

Some candidates fixate on ACL configuration details instead of verifying interface assignment. The output confirms the interface has no ACL, not that an ACL is configured incorrectly.

Candidates sometimes misread interface status. This output clearly shows the interface is enabled and up, so a down state is not the issue.

This option is incorrect because shutting down unused switch ports does not directly increase available bandwidth; rather, it is a security measure to minimize potential vulnerabilities. Bandwidth on the switch backplane is determined by the overall switch architecture and the active ports' configurations, not by disabling unused ports.

This option is wrong because administratively shutting down unused switch ports does not enable 802.1Q trunking; trunking is a configuration that allows multiple VLANs to traverse a single physical link, which is unrelated to the status of unused ports.

This option is wrong because administratively shutting down unused switch ports does not automatically activate port security; it is a separate configuration that must be enabled explicitly on the switch.

The higher-cost uplink becomes an alternate (blocked) port, not the lower-cost one.

A designated port exists on the upstream switch toward this switch, not on the non-root switch.

A disabled port is administratively shut down, not a port with a lower STP cost.

The specific factual error is that the question asks about the error when the Content-Type header is wrong, not the URI path. The URI path error is a separate issue.

The specific factual error is that a wrong Content-Type header causes a rejection before any body parsing, so the request does not succeed.

The specific factual error is that RESTCONF does accept JSON; the issue is the exact media type string, not the format.

This option is wrong because enabling DHCP snooping trust on VLAN 30 does not facilitate communication with the DHCP server in VLAN 99; it only protects against rogue DHCP servers.

Adding 'switchport mode trunk' under interface Vlan30 is incorrect because VLAN 30 is already configured as a Layer 3 interface, and trunking is not applicable to Layer 3 interfaces. This command is used for Layer 2 interfaces to allow multiple VLANs over a single link.

This option is wrong because the command 'ip default-gateway' is used to set a default gateway for a Layer 2 device, not for enabling DHCP relay on a Layer 3 interface. Clients in VLAN 30 need a helper address to reach the DHCP server in VLAN 99.

Creates a static route for a directly connected network that is already in the routing table, which is unnecessary.

On Ethernet interfaces, a static route must specify a next-hop IP address; specifying only an exit interface does not work for multi-access networks.

Creates a host route for the next-hop address itself, which is directly connected and already reachable, and does not provide a default route.

Option A (192.168.20.159) is incorrect because the broadcast address for the subnet 192.168.20.128/26 is 192.168.20.191, calculated as the highest address in the subnet range from 192.168.20.128 to 192.168.20.191.

The option C, 192.168.20.192, is incorrect because it falls outside the range of the subnet defined by 192.168.20.128/26, which has a valid broadcast address of 192.168.20.191.

The broadcast address for the subnet 192.168.20.128/26 is 192.168.20.191, not 192.168.20.255. The address 192.168.20.255 is the broadcast address for the entire 192.168.20.0/24 network, which is not relevant to the specified subnet.

Incorrect because the remote host’s MAC address is not known to the sender and cannot be resolved via ARP across subnets. The host must send to the gateway’s MAC instead.

Incorrect because broadcast MAC addresses are used only for ARP requests or broadcast traffic, not for normal unicast data frames to a specific remote IP.

Incorrect because a device’s own MAC address is used as the source MAC in frames it sends, never as the destination MAC.

The question says R3 advertises the network via OSPF; a missing network command would contradict that, so the failure must be in adjacency formation.

The presence of other OSPF routes on the same interface disproves a blanket multicast ACL; the issue is specific to R3’s adjacency.

A duplicate router ID could prevent adjacency, but the scenario’s focus on passive-interface default provides a more common and direct cause for a total lack of adjacency when OSPF is correctly configured on the network.

The assumption that a native VLAN mismatch can drop tagged VLAN traffic is a common misunderstanding.

Misreading the output may lead to believing the trunk is not in trunking mode.

Confusing spanning tree blocking with allowed VLAN filtering; the output shows no block state, only absence of the VLAN.

Trunk ports are used to carry multiple VLANs between switches, not to assign a single workstation to a specific VLAN.

Trunk ports are designed to carry multiple VLANs and are typically used between switches, not for end-user devices.

DTP modes control whether a port becomes a trunk or remains an access port; they do not change the access VLAN.

Candidates may misinterpret a failed ping as indicating no default route exists, overlooking that the route is present but unusable.

Candidates may think a higher AD is blocking the route, but the AD is standard and not the issue.

A common troubleshooting step is to verify ip routing, but the exhibit clearly shows an active routing table.

This option is incorrect because SSH does not inherently use less bandwidth than Telnet; both protocols utilize TCP, and SSH's encryption actually adds overhead, potentially increasing bandwidth usage.

This option is incorrect because SSH can operate over various types of connections, including console ports, but it is not limited to them. Telnet can also be used over console ports, making this statement misleading.

This option is incorrect because SSH does require user authentication, typically through passwords or public key authentication, which is essential for secure access. In contrast, Telnet does not enforce strong authentication mechanisms.

Incorrect. Standard ACLs cannot match TCP or UDP port numbers; this capability belongs to extended ACLs, which provide more granular filtering.

Incorrect. ACLs do not automatically create a 'permit any' at the end; instead, they have an implicit deny all statement that blocks any traffic not explicitly permitted.

A /27 subnet provides only 30 usable host addresses, which is insufficient for the requirement of 50 usable addresses. Therefore, it does not meet the needs of the branch LAN.

Option C: /25 provides 126 usable addresses, which exceeds the requirement of 50 usable addresses. However, it is not the smallest prefix that meets the requirement.

Option D, /24, provides 256 total addresses, which exceeds the requirement of 50 usable addresses. However, it is not the smallest prefix that meets the requirement, as /26 provides 64 addresses, which is sufficient and more efficient.