CCNA 200-301 v2 (200-301) — Questions 1351–1425

Incorrect. OSPFv3 forms adjacencies using IPv6 link-local addresses, so global unicast addresses are not mandatory for adjacency formation or neighbor discovery.

Incorrect. Router IDs must be unique identifiers for OSPF routers. Identical router IDs cause adjacency failure, but they do not need to be identical to form adjacency.

Incorrect. IPv6 link-local addresses are automatically configured on interfaces and do not require DHCPv6. OSPFv3 uses these link-local addresses for neighbor communication.

A speed mismatch would show 'up, line protocol down' and possibly increased input errors, but the interface here is 'administratively down'—manually disabled.

A duplex mismatch would cause late collisions or CRC errors, not an 'administratively down' status, which indicates a shutdown state.

Disabling keepalives has no effect on 'administratively down' because the interface is disabled at the administrative level, not because of a keepalive failure.

OSPFv3 requires the link interface to be enabled to form neighbors; loopback-only configuration results in no neighbor relationship.

OSPFv3 must be enabled on the loopback interfaces to advertise their prefixes; otherwise, they remain unknown to the neighbor.

Both routers must have OSPFv3 enabled on the link interface to form an adjacency, and both loopbacks must be enabled to advertise their prefixes.

This option is wrong because a port configured with PortFast and BPDU Guard will not automatically become the root port when it receives BPDUs; instead, it will be error-disabled due to BPDU Guard's protective mechanism.

This option is incorrect because a port configured with PortFast and BPDU Guard does not convert to a trunk when receiving BPDUs; instead, BPDU Guard will disable the port to prevent potential loops.

This option is incorrect because PortFast does not disable Spanning Tree Protocol (STP) entirely; it only allows the port to transition to the forwarding state immediately without waiting for STP convergence. BPDU Guard will still take effect if BPDUs are received on a PortFast-enabled port.

The address 10.1.1.31 is incorrect as a broadcast address for the subnet 10.1.1.34/30; the correct broadcast address is 10.1.1.35, derived from the subnet mask which allows for only 4 IP addresses (10.1.1.34 to 10.1.1.37).

The address 10.1.1.32 is not the broadcast address for the subnet 10.1.1.34/30; instead, it is the network address for the subnet, which is 10.1.1.32 to 10.1.1.35.

The address 10.1.1.36 is incorrect because it exceeds the valid range for a /30 subnet, which only allows for four IP addresses (two usable hosts, one network, and one broadcast). The broadcast address for the subnet 10.1.1.34/30 is 10.1.1.35.

The symptom is err-disabled, not a speed or duplex mismatch; cable type is not the issue.

The port is a built-in copper port, not an SFP-based interface; distance is not the issue.

The err-disabled state is due to BPDU guard, not speed/duplex mismatch; manual settings would not fix the root cause.

The exhibit confirms consistent speed and duplex settings.

The modules are correctly identified and match the fiber type.

There is no evidence of the cable length in the exhibit, and the low power is more indicative of a physical fault rather than simply exceeding distance limits.

The specific factual error: Disabling PMF entirely is not necessary; PMF can be set to Optional to allow both PMF-capable and non-PMF clients.

The specific factual error: Disabling PMF alone does not allow a WPA2-only client to associate with a WPA3-only WLAN; the WLAN must also support WPA2.

The specific factual error: PMF Required is only supported with WPA3; WPA2 only supports PMF Optional. Additionally, this configuration would not support WPA3 clients.

A single cable fault is only one of many possibilities; more testing is needed before concluding physical layer failure.

Timed-out hops in tracert do not directly prove the router is down; it may simply not be generating ICMP Time Exceeded messages.

These commands do not guarantee a lease; the DHCP server must be operational and reachable.

This option is incorrect because NTP does not replace Syslog; Syslog is responsible for logging events, while NTP only synchronizes time.

This option is incorrect because IP address assignment is handled by DHCP, not NTP, which only manages time synchronization.

This option is incorrect because NTP has no role in providing WLAN encryption; encryption is managed by wireless security protocols like WPA2 or WPA3.

This statement is false because SFP slots are designed for modular, replaceable transceivers.

Laser transmitters are used in single-mode fiber for longer distances; multimode uses LED/VCSEL.

Single-mode fiber has a smaller core, not larger. The smaller core reduces dispersion and allows longer reach.

The specific factual error: The incorrect static route remains in the routing table, causing recursive routing failure. The router will still try to resolve the next-hop 10.0.0.1, which is its own interface, leading to a loop.

The specific factual error: The route does not have an administrative distance of 10, and using an exit interface instead of a next-hop IP is not the intended configuration. Also, the route would be installed with default AD 1, not 10.

The request uses unencoded slashes in the interface name and the configuration container `interfaces`, not `interfaces-state`, so it will not retrieve operational state.

RESTCONF uses GET for retrieval; POST is used to create new resources or invoke operations, not to read operational data.

This uses a Cisco-IOS-XE-specific module and unencoded slashes, while the task expects the standard ietf-interfaces operational state path.

A trunk port does not provide the voice VLAN advertisement mechanism to the phone; the PC would need to send tagged frames, which typical endpoint NICs do not do.

The phone requires access to VLAN 20 for voice services, and the PC must remain in VLAN 10 for data; this configuration does the opposite, failing to meet the requirement.

The phone still cannot learn the voice VLAN; port security does not provide a DHCP address or make the switch advertise VLAN 20 to the phone.

The root cause is a missing A record; a CNAME record would not resolve without an A record for the target.

PTR records are not used for forward name resolution; the issue is with the forward lookup zone.

The zone delegation is working (other records resolve), so NS records are not the cause.

The direction does not change the fact that the 'established' keyword only permits packets with ACK/RST flags, which excludes the initial SYN.

The problem is specifically with TCP connections and ICMP echo-replies, not DNS or UDP.

The wildcard mask is already appropriate; the problem lies in the 'established' keyword.

Candidates mistakenly equate BPDU Guard with any BPDU-induced blocking, but the state 'root-inconsistent' is specific to Root Guard.

Candidates may think that filtering BPDUs leads to port isolation, but BPDU Filter would not trigger a protective state like root-inconsistent.

Candidates often confuse Loop Guard and Root Guard because both can cause inconsistent states, but Loop Guard triggers loop-inconsistent, not root-inconsistent, and is triggered by BPDU loss, not receipt of superior BPDUs.

The switchport mode trunk setting is incorrect because a trunk port allows multiple VLANs to pass, while the question indicates that the PC should only receive broadcasts from VLAN 20. Therefore, the issue lies with the access VLAN configuration.

The speed setting of 1000 Mbps (1 Gbps) does not influence VLAN membership or broadcast traffic; it only affects the data transfer rate. Therefore, this option does not address the issue of the PC receiving broadcasts only from VLAN 1.

The duplex setting of the switch port does not influence VLAN membership or broadcast traffic. Therefore, a duplex configuration of 'full' does not affect the ability of a PC to receive broadcasts from VLAN 20.

Candidates often associate BPDU Guard exclusively with access ports and assume configuring it on a trunk is itself a misconfiguration, overlooking that PortFast is the real culprit.

Students may confuse root bridge placement with BPDU Guard operation, thinking that a BPDU from a superior switch might cause a port to be disabled, when in fact BPDU Guard is content-agnostic.

Candidates may think that because a link between switches should be a trunk, the access mode misconfiguration is the root cause. However, they miss the fact that BPDU Guard acts on the BPDU regardless of the port mode, and the real misconfiguration is PortFast.

Fa0/1 is connected to VLAN 10, and since the user in VLAN 20 cannot reach the distribution switch, checking this port would not address the issue, as it is not part of the user's VLAN.

Fa0/2 is connected to VLAN 10, which means it cannot facilitate communication for a user in VLAN 20. The issue lies with the trunk port, which is responsible for carrying multiple VLANs, including VLAN 20.

Option D is incorrect because it suggests checking any access port in VLAN 1, which is not relevant to the user's issue in VLAN 20. The problem lies with the trunk port not allowing VLAN 20 traffic, not with access ports in VLAN 1.

DNS resolves hostnames to IP addresses, enabling devices to locate servers and services by name. However, DNS does not synchronize device clocks or manage time, so it cannot ensure matching timestamps in logs.

TFTP is a simple protocol used for transferring files such as configurations and IOS images. It does not provide any time synchronization capabilities and cannot ensure matching timestamps in device logs.

NetFlow is a network protocol that collects and exports IP traffic flow information for analysis. It does not affect device clocks or time synchronization and thus cannot provide matching timestamps.

Root Guard prevents a port from becoming a root port if superior BPDUs are received, maintaining the root bridge position, but it does not err-disable the port upon BPDU receipt. Therefore, it does not fulfill the requirement to disable access ports that receive BPDUs.

Loop Guard protects against unidirectional link failures by preventing a port from transitioning to forwarding state if BPDUs stop arriving on non-designated ports. It does not disable ports upon receiving BPDUs, so it does not meet the behavior described in the question.

PortFast is a feature that allows ports to transition quickly to forwarding state, bypassing the usual STP listening and learning states. It does not disable ports upon receiving BPDUs and therefore does not provide the behavior described.

The Data Link layer encapsulates packets into frames, not bits; bits are the PDU of the Physical layer.

The Session layer handles session management and does not perform encapsulation into 'sessions'; encapsulation at this layer is not defined.

The Physical layer transmits frames as bits but does not encapsulate frames into bits; encapsulation ends at Layer 2.

The specific factual error is that the static NAT inside address is already correct; altering it is unnecessary and incorrect.

The specific factual error is that static NAT is required for inbound access; PAT alone cannot provide a fixed public-to-private mapping.

The specific factual error is that interface NAT direction is fundamental; if inside/outside are reversed, NAT translations will not be applied correctly.

Incorrect. Allowing a VLAN on a trunk does not disable it; this option contradicts how VLANs and trunks operate in Cisco switches.

Incorrect. Port Address Translation (PAT) is unrelated to VLAN trunking. VLANs do not require PAT to cross trunks.

Incorrect. VLAN 99 does not have to be the native VLAN to function on a trunk. The native VLAN is independent of VLAN allowance and operation.

The specific factual error is using an incorrect subnet mask and omitting the next-hop IP in the directly connected static route. The mask should match the point-to-point link (typically /30 or /31), and the next-hop must be specified to ensure the route is directly connected.

The specific factual error is using a /32 mask instead of the subnet mask of the link. A /32 route to the next-hop IP is a valid workaround but is not the standard practice; the question expects a directly connected route to the network containing the next-hop, not a host route.

The specific factual error is using the floating route's next-hop as the next-hop for the directly connected route. The directly connected route must be to the network containing 192.0.2.2, not to the backup next-hop.

Named standard ACLs filter traffic only by source IP address and cannot filter by destination IP or specific TCP ports like 80 or 443, making them unsuitable for permitting HTTP and HTTPS to a specific server.

Prefix lists are used to filter routes based on IP prefixes in routing protocols and cannot filter traffic by protocol or port, so they cannot meet the requirement to permit HTTP and HTTPS traffic specifically.

MAC access-lists filter traffic based on Layer 2 MAC addresses and cannot filter by Layer 3 IP addresses or Layer 4 ports, so they cannot selectively permit HTTP and HTTPS traffic to a specific IP address.

The helper-address must point to the DHCP server, not the default gateway. The excluded-address range should include the gateway to prevent conflicts.

The excluded-address range must be limited to reserved addresses only, not the entire usable range. The helper-address must be corrected to 10.0.0.1.

DHCP snooping requires the port connected to the legitimate DHCP server to be explicitly trusted; otherwise, all DHCP server messages are discarded.

Option B incorrectly includes the network address (172.16.20.128) and broadcast address (172.16.20.191) as usable hosts, which are reserved and cannot be assigned to devices, making this option invalid.

Option C excludes the first usable host address (172.16.20.129) and incorrectly includes the broadcast address (172.16.20.191), which is not assignable to hosts, thus making it an incorrect range.

Option D lists a range starting at 172.16.20.193, which belongs to the next subnet block (192–255) and does not include the IP 172.16.20.190, so it is unrelated and incorrect for this question.

The specific factual error is that BPDU Guard should not be disabled on a port that is supposed to be an edge port with BPDU Guard enabled.

The specific factual error is that simply re-enabling the same features does not prevent recurrence; the source of BPDUs must be removed or the port must be reconfigured as a non-edge port.

The specific factual error is that Root Guard and BPDU Guard serve different purposes; Root Guard does not stop BPDU Guard from disabling the port.

The specific factual error is that 'ip domain lookup' enables DNS client functionality but does not specify which DNS server to use. The command is already present, so reconfiguring it does not fix the missing server IP.

The specific factual error is that the domain name is already configured correctly; changing it would not address the empty name-server list.

The specific factual error is that debugging is a diagnostic tool, not a corrective action. The question asks to 'fix' the issue, not just diagnose it.

This option is wrong because the OSPF route to 10.60.4.0/24 does not directly match the destination 10.60.4.17, which falls under the static route to 10.60.4.16/28. OSPF would not be preferred if a more specific static route exists.

The EIGRP route to 10.60.0.0/16 is not used for the destination 10.60.4.17 because it does not match the more specific subnet of 10.60.4.16/28, which is preferred in routing decisions.

This option is wrong because there is a valid static route to the destination 10.60.4.17 via the static route to 10.60.4.16/28, making it reachable. Therefore, stating 'no route at all' is incorrect in this context.

SNMP is limited to monitoring and basic sets, not suited for complex remediation workflows.

CLI scripting lacks structured programmability and is error-prone for automation.

Syslog is a logging protocol and cannot be used to push configuration changes.

The specific factual errors: MD5 and DES are not the required algorithms; 'priv' level requires encryption but the question specifies 'auth' level; NetFlow egress is not the default and not requested; version 5 is not version 9.

The specific factual error: The trap host command specifies 'priv' security level, which requires the user to have a privacy password and sends encrypted traps, but the requirement is for 'auth' only.

The specific factual error: NetFlow version 5 is an older version that does not support templates and is not the required version 9.

A user PC does not require EtherChannel to function; EtherChannel is a method for bundling multiple physical links into a single logical link, which is not necessary for standard PC connectivity.

Trunk mode does not disable MAC address learning; it actually allows the switch to learn MAC addresses from multiple VLANs. Therefore, a switch port configured as a trunk can still learn MAC addresses normally.

Trunk mode does not disable IP addressing; it allows multiple VLANs to be carried over a single link, and IP addressing is still applicable to the switch interfaces. Therefore, the user PC's inability to communicate is not due to trunk mode disabling IP addressing.

Option A (192.168.10.16/28) is incorrect because it represents a different subnet, specifically the range 192.168.10.16 to 192.168.10.31, which does not include the host 192.168.10.33.

Option C is wrong because the host IP 192.168.10.33/28 falls within the subnet range of 192.168.10.32 to 192.168.10.47, making 192.168.10.48/28 an entirely different subnet that does not include the host.

Option D (192.168.10.0/28) is incorrect because it represents a different subnet than the one containing the host 192.168.10.33. The subnet for 192.168.10.33/28 is 192.168.10.32/28, which includes IPs from 192.168.10.32 to 192.168.10.47.

It is a supporting feature for relay agents, not the primary command to forward DHCP broadcasts.

It is a prerequisite but not sufficient; the ip helper-address is still needed to direct the traffic.

The command does not exist; it is a fabrication.

Syslog is incorrect because it focuses on logging event messages and alerts rather than routinely polling device counters or CPU statistics, so it does not meet the periodic monitoring requirement.

NetFlow is incorrect because it provides detailed traffic flow analysis and visibility but does not poll general device statistics like CPU usage or interface counters, which are needed here.

Port security is incorrect because it is a Layer 2 feature that restricts MAC addresses on switch ports and does not provide any monitoring or polling capabilities for device statistics.

The specific factual error is that reapplying the same manual settings does not resolve a duplex mismatch; it may even perpetuate the mismatch if the remote side is set to auto-negotiation.

The specific factual error is that 'no shutdown' is used to enable an interface that is administratively down, but the interface is already up.

The specific factual error is that forcing half-duplex is unlikely to resolve the issue; it may worsen performance and still cause errors if the remote side is full-duplex.

Administrators often mistake 'connection refused' for a key issue, but the VTY lines restrict the allowed protocols, not the validity of the keys.

Candidates may think a version mismatch causes the refusal, but the VTY transport setting is the actual filter; downgrading security is unnecessary and ineffective.

Some technicians equate 'connection refused' with authentication failure and jump to AAA, but in this case the VTY lines never allow the SSH session to reach the authentication stage.

The NTP command syntax is incorrect; 'ntp server' does not accept a 'source' parameter. The correct approach is a separate 'ntp source' command.

The logging trap level 7 corresponds to debugging, which is the most verbose level. The requirement is for critical (severity 2) and higher, so this would send too many messages.

The commands listed are already configured and do not fix the synchronization issue or the syslog filtering. The NTP source interface is missing, and the logging trap level is still debugging.

STP uses path cost to determine the root port, where a lower path cost is more desirable and makes a port more likely to become the root port, not less.

In STP, blocked ports are alternate or backup ports, not designated ports. Designated ports are in forwarding state on each segment, while blocked ports are non-designated.

Option B is incorrect because the broadcast address for the subnet 192.168.30.0/26 is 192.168.30.63, not 192.168.30.64. The address 192.168.30.64 is actually the first address of the next subnet (192.168.30.64/26).

The address 192.168.30.255 is incorrect as the broadcast address for the subnet 192.168.30.0/26, which only spans IPs from 192.168.30.0 to 192.168.30.63. The broadcast address for this subnet is 192.168.30.63.

Option D, 192.168.30.31, is incorrect because it represents the last usable IP address in the subnet 192.168.30.0/26, not the broadcast address. The broadcast address for this subnet is 192.168.30.63.

The err-disabled state requires a manual interface reset (shutdown followed by no shutdown) to recover; a single 'no shutdown' command is insufficient.

Saving the configuration preserves the settings but does not affect the current operational state of the interface; the port stays err-disabled.

The shutdown command disables the interface but does not automatically re-enable it; the err-disabled state is cleared only after a shutdown/no shutdown cycle.

Setting the floating route AD to 1 makes it equal to the primary route's AD, defeating the purpose of a floating static route.

The primary route must have a lower AD than the floating route to be preferred. Setting it to 200 makes it equal to the backup, causing ambiguity.

The question states 'IPv4 and IPv6 static routes, default routes' and specifies an IPv6 next-hop. Ignoring IPv6 is a direct violation of the requirements.

NetFlow export is related to network traffic analysis and monitoring, not directly to client movement or experience between access points in a WLAN. It does not address the seamless connectivity aspect of roaming.

DHCP snooping is a security feature that helps prevent unauthorized DHCP servers from distributing IP addresses on a network. It does not directly relate to the user experience of roaming between access points in a WLAN deployment.

Route summarization is a technique used in routing protocols to reduce the size of routing tables by aggregating multiple routes into a single route. It does not pertain to client movement or wireless connectivity between access points.

You might think that OSPF routes are more reliable, but directly connected routes are always preferred regardless of AD.

You might confuse metric with prefix length; metric only matters when prefix lengths are equal.

A default route is only used when no more specific route exists; here a specific route exists.

The specific factual error: Excluding 10 addresses does not exhaust the pool; the pool still has 244 addresses available.

The specific factual error: The pool configuration is already correct; modifying it does not address the disabled DHCP service.

The specific factual error: 'ip helper-address' is for DHCP relay across subnets; it is not needed when the server is local.

The specific factual error is that manually setting speed/duplex does not guarantee compatibility with the remote end and does not address the SFP distance limitation.

The specific factual error is that 1000BASE-SX is for multimode fiber and short distances, not single-mode fiber at 40 km.

The specific factual error is that the SFP distance limitation is not addressed; auto-negotiation alone does not change the physical layer capability.

RESTful APIs do not require SNMP traps; they use HTTP methods for communication, and SNMP traps are unrelated to REST API operations.

RESTful APIs are format-agnostic and commonly support both XML and JSON, with JSON being the more prevalent format due to its lightweight nature. The statement that RESTful APIs can only return XML is incorrect.

This option is incorrect because both routers are configured to use the same OSPF area 0, so area mismatch is not the cause of adjacency failure.

Hostnames do not influence OSPF neighbor relationships; routers form adjacencies based on protocol parameters, not device names, so this option is invalid.

A /24 subnet mask does not block OSPF multicast traffic; OSPF uses multicast addresses that function normally on standard subnet masks, so this option is incorrect.

HTTPS uses TCP, not UDP, so a UDP permit for port 443 would not match HTTPS traffic.

The ACL reverses source and destination; it denies Telnet from any to 10.1.50.0/24, not from 10.1.50.0/24 to any.

Permitting all IP traffic would allow Telnet, negating the required deny rule.

This option is incorrect because RIP can coexist with static routes in a routing table; static routes do not prevent RIP routes from being installed. Both routing protocols can be used simultaneously, and the routing decision is based on administrative distance.

This option is incorrect because RIP can coexist with static routes in a routing table; static routes do not prevent RIP routes from being installed. Both routing protocols can be used simultaneously in a network.

This option is wrong because static routes are not inherently more specific than RIP routes; both can have varying levels of specificity depending on the configuration. The preference of static routes over RIP is determined by administrative distance, not specificity.

The virtual IP address is wrong; it should be 192.168.100.1, not 192.168.100.254.

Priority must be higher than the default (100) to ensure R1 becomes the active router; 110 is required.

Preempt is required to allow R1 to reclaim the active role when its priority becomes higher again after a failure.

Candidates often assume that a route pointing to an interface requires that interface to be up, but Null0 is always available.

A misconception that the default route is special and cannot be used with Null0, but any valid IP prefix can be directed to Null0 to create a discard route.

Confusing Null0 routes with Ethernet interface routes, which require a next hop, leads to the incorrect belief that a next hop is mandatory for all static routes.

An empty NAT table indicates no translation is happening at all, which is not the expected outcome of simply reversing inside/outside roles—NAT still processes packets but incorrectly.

Complete internet unreachability is a generic connectivity symptom that could be caused by routing, firewall, or other NAT issues, but does not strongly signal a role reversal.

External hosts connecting to a private IP without translation is a typical sign of a missing static NAT or PAT rule, not of reversed interface direction assignments.