CCNA 200-301 v2 (200-301) — Questions 1651–1725

Candidates may think that STP version incompatibility disrupts root election, but both versions use the same BPDU format and root election rules.

Candidates often associate Root Guard with preventing a switch from becoming the root. However, it does not cause another switch to become root; it just protects the network from unexpected superior BPDUs.

Candidates may confuse the symptom and think that a low priority on the new switch causes the problem, but this would make the new switch the root, not another switch.

The host's default gateway is correctly configured as 192.168.10.1, evident from the ARP requests being sent to that address.

An IP ACL on the SVI does not block ARP (it operates at Layer 2), so it would not prevent ARP replies.

The exhibit's show ip interface brief output confirms the SVI is in up/up state, proving it is not administratively down.

Candidates may confuse the access port configuration with a trunk, but the stem explicitly states the port shows 'up/up' in show ip interface brief, which does not indicate trunk status.

Native VLAN mismatch is a common troubleshooting issue, but it only affects untagged traffic on the native VLAN—not tagged VLANs like VLAN 10.

Candidates often assume the allowed VLAN list is the culprit, but default trunk behavior permits all VLANs unless explicitly pruned, and the stem gives no indication of pruning.

This option is incorrect because PPP (Point-to-Point Protocol) does not require HDLC (High-Level Data Link Control) for authentication; PPP can authenticate independently of the encapsulation method used.

This option is incorrect because CHAP (Challenge Handshake Authentication Protocol) does not require routers to be in different IPv4 subnets for authentication to function. CHAP can authenticate devices regardless of their subnet configuration as long as they can reach each other over the network.

This option is incorrect because PPP (Point-to-Point Protocol) can operate independently of GRE (Generic Routing Encapsulation) tunnels; authentication can occur directly over a PPP link without requiring GRE.

This option is wrong because the question already states that the client can join the secure SSID, indicating that the SSID is visible and accessible. Therefore, checking visibility is unnecessary.

While a misconfigured RADIUS server could cause this symptom, the question asks which area should be investigated first; checking the policy mapping applied after authentication is a more direct and likely cause.

This option is wrong because OSPF area 0 configuration pertains to routing protocols and network topology, which does not directly affect the client's access to the SSID or its traffic path after authentication.

The user can communicate with the default gateway and other local devices, so the subnet mask is correctly configured for the local network.

A powered-off server would cause timeouts only after the last router before the server, not immediately after the first hop.

Because the user is using the server's IP address, DNS is not involved in this connectivity test.

DHCP snooping is a security feature that prevents unauthorized DHCP servers by filtering DHCP messages. It does not forward DHCP broadcasts across VLANs, so it cannot enable clients on different VLANs to receive addresses.

Port security restricts the number and identity of MAC addresses on switch ports to enhance security. It does not affect DHCP broadcast forwarding or enable clients to receive addresses from servers on different VLANs.

NAT overload translates multiple private IP addresses to a single public IP address for outbound traffic. It does not address the issue of forwarding DHCP broadcasts between VLANs or enable DHCP clients to obtain addresses from remote servers.

The native VLAN setting only governs untagged traffic on the trunk, not the tagged frames of VLAN 30, so it cannot fix a missing allowed VLAN.

STP does not globally block all VLANs on a trunk; per‑VLAN spanning tree can block individual VLANs, but a single VLAN failure would not cause the trunk to block all traffic.

Changing the trunk to access mode would restrict the link to a single VLAN, breaking VLAN 10 connectivity as well, which contradicts the working state of VLAN 10.

This option incorrectly describes a northbound API as a cable type, which is a physical concept unrelated to the logical API direction in controller architectures.

This option confuses northbound APIs with routing protocols like link-state protocols, which are unrelated to the software interface role of northbound APIs.

This option falsely claims that northbound APIs remove the need for authentication, ignoring that security controls remain essential for API access.

VTP version 3 is not backward compatible with versions 1 and 2; it uses a different format and does not interop.

A VTP client switch cannot create local VLANs; it synchronizes its VLAN database from the VTP server.

VTP advertisements use the multicast MAC address 0100.0CCC.CCCC, not 0180.c200.0000 which is used for protocols like STP.

A /25 subnet provides 126 usable host addresses, which is insufficient for a requirement of 200 usable addresses. Therefore, it does not meet the specified needs of the question.

A /26 subnet provides only 62 usable host addresses (64 total minus 2 for network and broadcast), which is insufficient for the requirement of 200 usable addresses.

Option D: /27 provides only 30 usable host addresses (32 total addresses minus 2 for network and broadcast), which is insufficient for the requirement of 200 usable host addresses.

Integrity is incorrect because it focuses on protecting data from unauthorized changes, not on ensuring access or uptime of systems and data.

Accounting is incorrect as it is part of the AAA framework (Authentication, Authorization, Accounting) and not a component of the CIA triad, so it does not relate to system availability.

Confidentiality is incorrect because it deals with preventing unauthorized disclosure of information, not with ensuring that systems and data are accessible when required.

Trunk mode is used to carry multiple VLANs, but for a single access port with voice, the port remains in access mode and uses the voice VLAN feature.

The native VLAN is used for untagged traffic on a trunk, while the voice VLAN is a specific VLAN that carries tagged voice traffic from the phone.

They are separate VLANs and usually belong to different subnets for logical separation and management.

This would break the HSRP relationship entirely, not fix the priority issue.

Preemption is not the cause; it is actually desired to allow a higher-priority router to take over.

This does not address the priority mismatch and could worsen convergence time.

The specific factual error is that global commands affect all ports, not a single interface.

The specific factual error is confusing Root Guard with BPDU Guard; they serve different purposes.

The specific factual error is using the 'disable' keyword instead of 'enable' to activate BPDU Guard.

Missing the required SNMPv3 group and relies on the deprecated interface command 'ip flow export' instead of the modern flow monitor method.

Lacks the required global flow monitor definition block; the 'ip flow monitor' command on the interface refers to a nonexistent monitor.

Places the flow monitor definition commands inside the interface configuration context, where they would be rejected as invalid.

This is a less common and less specific cause; the symptom points directly to a misconfigured gateway address in a different subnet.

This option assumes a routing problem on the router, but the scenario indicates the PC cannot send packets to its gateway, which points to host configuration, not routing tables.

DNS misconfiguration would cause failures when using hostnames, but not for direct IP connectivity tests like pinging a remote IPv6 address.

Option B is incorrect because it includes the network address (10.10.20.128) and the broadcast address (10.10.20.191) for the subnet 10.10.20.128/26, which are not usable host addresses.

Option C is incorrect because the subnet mask /26 indicates a subnet range of 10.10.20.128 to 10.10.20.191, but the usable host addresses are from 10.10.20.129 to 10.10.20.190, excluding the network and broadcast addresses.

Option D is incorrect because the range 10.10.20.193 to 10.10.20.254 falls outside the subnet defined by 10.10.20.190/26, which only allows for usable addresses from 10.10.20.130 to 10.10.20.190.

Candidates might suspect a physical issue first, but the up/up status definitively rules out a cable or hardware problem.

Candidates commonly associate ‘cannot ping’ with duplex mismatches, forgetting that the fundamental issue here is the IP subnet mismatch.

The trap is thinking that a routing protocol is always needed for inter-subnet communication, overlooking that directly connected devices on the same broadcast domain must share a common subnet.

The subnet mask /30 does not match the /24 used on R2's G0/1, causing a subnet mismatch. Also, EUI-64 requires a global unicast prefix, not a link-local prefix.

A static route to a directly connected network is redundant and can cause routing issues. The IPv6 configuration must use EUI-64, not a manually assigned address.

The autoconfig command does not use EUI-64; it uses SLAAC to derive an address from router advertisements. Also, IPv6 unicast-routing is typically enabled by default.

The specific factual error is that 'decrement' is not a valid keyword in the standby track command. The decrement value is specified directly after the interface.

The specific factual error is that 'preempt delay' is not the correct way to configure tracking. Tracking is done with the 'standby track' command, and the decrement value must be specified.

The specific factual error is that 'priority' is not a valid keyword in the standby track command. The decrement value is specified directly after the interface.

It checks network reachability, not DHCP or DNS.

It shows the path taken, not DHCP or DNS status.

It shows Layer 2 address mappings, not DHCP or DNS.

This option is incorrect because static routes are preferred over dynamic routes in OSPF when both are present, regardless of when they were learned. The static route to 10.55.10.0/24 will be used due to its longer prefix match.

This option is incorrect because OSPF routes do not share equal preference with static routes; the static /24 route will be preferred due to its longer prefix length, making it the best match for the specific destination IP.

This option is incorrect because overlapping routes are valid in routing protocols like OSPF, and both routes can coexist in the routing table. The static route to 10.55.10.0/24 is valid and will be preferred due to its longer prefix length.

Verifying the IP address is redundant because the server is already reachable; the root cause is a mismatched shared key.

Enabling 802.1X globally will not fix a key mismatch and is not the reason for the port remaining unauthorized when RADIUS is reachable.

Using only local authentication removes the required RADIUS-first method and does not resolve the key issue.

This option is wrong because a switch interface configured as `dynamic desirable` and its peer as `dynamic auto` will negotiate a trunk link, not a routed port. Routed ports are typically configured explicitly and not through dynamic negotiation.

This option is wrong because configuring a switch interface as `dynamic desirable` and `dynamic auto` does not lead to the deletion of VLANs; it instead allows for trunk negotiation between the switches.

This option is wrong because a switch interface configured as `dynamic desirable` and its peer as `dynamic auto` will negotiate a trunk link, not a routed port. Routed ports are typically configured explicitly and do not involve dynamic negotiation.

The specific factual error is that BPDU Guard should remain enabled on PortFast ports, and changing root bridge priority does not address the Root Guard misapplication.

The specific factual error is that Root Guard is not appropriate for PortFast ports, and Loop Guard is already correctly placed on the uplink port.

The specific factual error is that Loop Guard is already correctly placed, and automatic recovery does not replace the need to investigate the unauthorized BPDU on Gi0/2.

SFP-10G-SR uses multimode fiber, not single-mode.

SFP-10G-LR requires single-mode fiber, not multimode.

SFP-10G-LR max is 10 km, not 40 km (ER is 40 km).

The port is not in an err-disabled state; BPDU Guard causes the port to be shut down, not to stay in listening.

Misunderstanding that PortFast bypasses timers completely on access ports; the high forward delay is irrelevant if PortFast were active.

The assumption that the server is sending BPDUs is contradicted by the output showing zero BPDUs received.

1000BASE-T SFPs (such as the GLC-T) have a maximum reach of 100 m, not 10 km. 10 km is typical for 1000BASE-LX/LH single-mode fiber SFPs.

Multi-mode fibers have larger cores to allow multiple light paths, while single-mode’s narrow core supports only one path. The 9-micron core is characteristic of single-mode.

Cisco IOS checks the SFP EEPROM for vendor coding. Third-party SFPs might not be recognized, causing an error or link failure until unsupported transceiver mode is enabled.

172.16.0.0/16 is the least specific route covering a large address range. Although it matches the destination IP, it is overridden by more specific routes with longer subnet masks, so it is not used.

172.16.20.0/24 is more specific than the /16 but less specific than the /25 route. Since the destination IP falls within the /25 subnet, the router prefers the /25 route over this /24.

The default route is only used when no other routes match the destination IP. Since multiple specific routes exist that match the destination, the default route is not selected.

Designated ports are selected for each LAN segment to forward traffic away from the root bridge, but they do not represent the best path back to the root bridge on a non-root switch. Therefore, this option is incorrect.

Alternate ports serve as backup paths and remain in a blocking state unless the root port fails. They do not identify the best path back to the root bridge, so this option is incorrect.

Disabled ports do not participate in STP forwarding or path selection and are not related to identifying the best path back to the root bridge, making this option incorrect.

This option is incorrect because the static default route is less specific (0.0.0.0/0) and only used when no other route matches the destination. Since a connected route exists, the default route is ignored.

This option is wrong because routing does not load balance between a directly connected route and a static default route. The router selects the single best route based on prefix length and administrative distance.

This option is incorrect because the router clearly has a matching directly connected route for 10.1.1.200. Therefore, it will use that route rather than discarding both or failing to forward.

The specific factual error: The 'ntp server' command cannot specify a source interface; that is done with 'ntp source'. Additionally, 'warnings' (level 4) is more severe than 'notifications' (level 5), but the requirement is to send only notifications and above, which includes levels 0-5. 'warnings' includes levels 0-4, missing level 5 (notifications).

The specific factual error: 'logging trap debugging' sends all syslog messages (levels 0-7), which is the default and does not filter out lower-severity messages. The correct level for notifications and above is 'notifications' (level 5).

The specific factual error: The NTP client is not configured to source packets from Loopback0. The 'ntp server' command alone does not set the source interface; an additional 'ntp source' command is required.

PBR must be applied inbound on the interface receiving the traffic, not outbound on the exit interface.

PBR uses the access list to match traffic based on source, destination, or other criteria; here the requirement is to match source subnet.

A static route controls forwarding based on destination, not source. Policy-based routing is needed to forward based on source address.

This option is wrong because a switch MAC address table does not store Layer 3 routing information; it specifically maps Layer 2 MAC addresses to switch ports for local traffic forwarding.

Option D is incorrect because a switch MAC address table does not store OSPF authentication keys; it is designed to map MAC addresses to switch ports for forwarding decisions within a Layer 2 network.

This option is wrong because a switch MAC address table does not handle IP address assignments; it specifically deals with mapping MAC addresses to switch ports for local traffic forwarding.

Root Guard uses a specific 'root-inconsistent' state, not the generic 'blocking' state.

BPDU Guard triggers err-disable, not blocking. Blocking is an STP state, not an error state.

Root Guard and BPDU Guard have different effects: root-inconsistent vs. err-disable. Mixing them up is a common error.

This option is wrong because a subnet mask of 255.255.255.224 provides 30 usable host addresses, not 14. The calculation is based on the formula 2^(number of host bits) - 2, where the number of host bits is 5 for this subnet mask.

This option is wrong because a subnet mask of 255.255.255.224 allows for 32 total addresses, of which 30 are usable after subtracting the network and broadcast addresses. The calculation is 2^(32-27) - 2 = 30 usable addresses.

Option D is incorrect because a subnet mask of 255.255.255.224 allows for 30 usable host addresses, not 126. The calculation is based on the formula 2^(32 - subnet bits) - 2, where the subnet bits for this mask is 27.

Candidates mistakenly assume that OSPF process IDs must match globally for proper LSA exchange, but they are only locally significant.

Candidates may think that the network type influences the OSPF LSA type, but it only affects neighbor discovery and DR/BDR election, not the area origin of LSAs.

Candidates sometimes confuse the metric influence with the route type, thinking that OSPF converts routes when the cost exceeds a threshold.

Matching only one source subnet can be accomplished with a standard ACL, so this does not strongly indicate a need for an extended ACL.

Placing an ACL near the destination is a characteristic of standard ACLs, not a criterion that selects an extended ACL.

The scenario assumes both standard and extended ACLs are available; standard ACLs do not exist for IPv6, so this requirement does not apply to the IPv4 ACL choice.

This option is incorrect because OSPF neighbors must be in the same area to form adjacency. Using different areas on the same segment prevents adjacency, so this option contradicts OSPF area rules.

This option is incorrect because OSPF authentication, including message-digest (MD5), is supported on Ethernet interfaces, not just serial links. Authentication is not limited by interface type.

This option is incorrect because OSPF requires valid IP addressing on interfaces to operate. Removing IP addressing disables OSPF on that link, so adjacency cannot form without IP addresses.

Option A suggests changing the destination network mask from /24 to /16. While subnet masks must be correct for proper routing, an incorrect mask does not cause next-hop reachability issues or packet drops due to unreachable next-hop addresses. The problem here is related to next-hop reachability, not the destination mask.

Option C incorrectly states that static routes require an outbound access list. Static routes do not need ACLs to function; ACLs are used for traffic filtering and security policies, not for enabling or disabling static routes. This option is invalid.

Option D claims the route must use administrative distance 255. Administrative distance 255 actually makes a route unusable, so setting it to 255 would prevent the static route from working. The default administrative distance for static routes is 1, which is preferred over most dynamic routes.

The specific factual error: Priority 0 is not a valid STP priority value; valid values are 0-61440 in increments of 4096, but 0 is reserved and not used in Cisco IOS. Also, reloading is not the recommended recovery for err-disable.

The specific factual error: 'root primary' does not set a fixed priority; it adjusts dynamically. Global PortFast and BPDU Guard can cause issues on trunk ports. 'errdisable recovery cause all' only enables automatic recovery after a timeout, not immediate recovery.

The specific factual error: Priority 8192 does not guarantee root bridge status if another switch has a lower priority. BPDU Guard is required on edge ports. Cable reseating does not clear err-disable state.

Voice VLANs operate on access ports by tagging voice traffic while keeping PC traffic untagged in the data VLAN. A trunk is not required.

Native VLAN mismatches on trunks would affect both data and voice VLANs if both were allowed. The PC works, ruling out a general trunk issue.

The phone would work if it was sending voice traffic on the data VLAN (10), because VLAN 10 exists. The phone failing indicates a missing voice VLAN, not a misconfiguration on the phone.

Option B is incorrect because strong authentication and centralized logging serve distinct functions; authentication secures access while logging tracks and analyzes events, enhancing security and compliance.

This option is incorrect because centralized logging does not eliminate the need for authentication; both are essential for a comprehensive security posture. Authentication verifies user identity, while logging tracks access and actions for auditing and incident response.

This option is wrong because strong authentication does not eliminate the need for device event records; both are essential for comprehensive security management. Device event records provide critical insights into system activity, which strong authentication alone cannot address.

The specific factual error is that the helper-address should be the DHCP server's IP, not an excluded address.

The specific factual error is that the default-router must be the gateway address, not an excluded address.

The specific factual error is that the question states the configuration uses 192.168.100.254 for both, so this option does not match the given scenario.

Uses 'aaa authentication login' on the switch instead of 'aaa authentication dot1x', which does not enable RADIUS authentication for 802.1X.

On R1, the login authentication list omits 'local', so there is no fallback to the local database if the RADIUS server is unreachable.

Missing the 'dot1x pae authenticator' command under GigabitEthernet0/1, which is necessary for the switch to function as an 802.1X authenticator.

This option is incorrect because a VLAN is a Layer 2 segmentation method that isolates broadcast domains and does not relate to routing policies or autonomous systems in BGP.

This option is wrong since an OSPF area is a subdivision within a single routing domain to optimize routing, not an autonomous system representing separate administrative control.

This option is incorrect because an autonomous system is a routing domain concept, whereas a wireless access point is a physical device unrelated to BGP or routing domains.

10.100.12.63 is the broadcast address of the 0–63 subnet, not the one containing 94.

10.100.12.64 is the network address of the 64–127 subnet, not the broadcast.

10.100.12.128 is the network address of the 128–191 subnet, not the broadcast.

The forwarder is unreachable, so keeping it will cause forward lookups to fail. Also, reverse lookup requires a PTR record, which is missing.

Forward lookups require an A record mapping the hostname to an IP address; without it, forward queries return NXDOMAIN.

The scenario expects R1 to be a local DNS server for internal hosts; using an external forwarder for internal hostnames is not best practice and may not resolve internal names if the forwarder doesn't have the records.

Option B is incorrect because it denies all IP traffic from the specified source to the destination, which is broader than required and does not specifically target HTTP traffic on port 80.

Option C is incorrect because it permits HTTP traffic from the specified source to the web server, which is contrary to the requirement to block this traffic. The question specifically asks for a rule that denies HTTP access.

Option D is incorrect because it specifies 'deny udp', which does not block HTTP traffic, as HTTP uses TCP, not UDP. Therefore, it fails to meet the requirement of blocking HTTP from the specified source to the web server.

The specific factual error: The native VLAN does not need a subinterface; the router can still route traffic for other VLANs without it.

The specific factual error: ISL is not commonly used and would not fix the routing issue; the problem is IP routing disabled.

The specific factual error: Directly connected routes are automatically added; no static routes are required.

Standard ACLs are not limited to wireless networks; they can be applied to any interface on a router, including wired connections. This option misrepresents the applicability of standard ACLs.

This option is incorrect because Telnet and SSH use different destination ports; Telnet typically uses port 23, while SSH uses port 22, allowing for distinct filtering in ACLs.

This option is incorrect because SSH can indeed be filtered using ACLs, as they can match traffic based on IP addresses and protocols. Standard ACLs can be applied to control SSH traffic just like any other traffic type.

Both PoE and PoE+ use only two pairs for power delivery, not four; four-pair delivery is exclusive to 802.3bt (PoE++).

PoE+ requires Category 5e or better cabling, as Category 3 cannot safely support the higher current.

PoE does not disable power on a non-PoE device; detection prevents power from ever being applied to non-compliant devices.

Static NAT for every host is incorrect because it requires a unique public IP address per internal host, which is inefficient and unnecessary when only outbound access is needed without inbound server publishing.

No NAT is incorrect because private IPv4 addresses are not routable on the public Internet and must be translated to public addresses to communicate externally.

DHCP relay is incorrect because it only forwards DHCP messages between clients and servers and does not perform any IP address translation or NAT functions.

Reducing all AP transmit power to zero would completely disable the wireless network, making it impossible for users to connect or experience any performance, which does not address the issue of slow performance in a dense office environment.

Changing every AP to the same channel would lead to co-channel interference, exacerbating the slow wireless performance issue rather than resolving it. In a dense office environment, this configuration would reduce overall throughput and increase contention among devices.

Disabling WPA2 security would not address the issue of slow wireless performance in a dense office environment; instead, it would compromise network security and potentially allow unauthorized access, worsening the situation.

EtherChannel load balancing is configurable and can use source/destination IP, MAC, or Layer 4 port, not just MAC addresses.

Only 8 interfaces can be active in a single EtherChannel; the other 8 are in standby mode.

Spanning Tree Protocol runs on the logical port-channel interface, not on each individual physical link within the bundle.

Syslog and NTP are independent protocols; Syslog does not need to run before NTP can synchronize.

NTP works over any IP network; there is no requirement for a trunk port on the management VLAN.

DNS is only needed if the NTP server is referenced by hostname rather than IP address; many configurations use IP addresses directly.

Incorrect because user ports should be configured as access ports, not trunks. Configuring user ports as trunks is unnecessary and can cause security and connectivity issues.

Incorrect because the SVI for VLAN 30 must be active for inter-VLAN routing to function. Shutting down the SVI would prevent routing, not enable it.

Incorrect because changing the trunk native VLAN to VLAN 30 is unrelated to the problem. Native VLAN mismatches affect untagged traffic but do not block VLAN 30 tagged frames if the VLAN is allowed.

Candidates often confuse the lack of an IP address with a non-functional interface, believing it will be shown as down.

Students may think any IP misconfiguration could bring the interface down, but only the shutdown command causes 'administratively down'.

Because an ACL can stop traffic, candidates sometimes assume it would be reflected as a down state, but interface status is independent of ACLs.

Telnet is incorrect because it transmits data in clear text, exposing sensitive information to attackers and failing to protect session contents during transit.

Open wireless access is unrelated to secure remote management; it does not provide encryption or protect administrative sessions, making it irrelevant to the question.

Native VLAN 1 configuration does not affect encryption or security of remote management protocols, so it does not support the goal of protecting session contents.

Combines the NTP source directly in the server command, but the required configuration uses a separate 'ntp source Loopback0' command.

Sets logging trap to debugging (level 7), not the required notifications (level 5).

Missing the 'ntp source Loopback0' command, so NTP will not use the Loopback0 interface as source.

This option is incorrect because OSPF can still form adjacencies between routers in different areas, provided they are correctly configured to do so. The issue in this scenario is related to OSPF timers, not area mismatches.

This option is incorrect because OSPF can still exchange multicast packets even if the subnet mask is not configured correctly, as long as the interfaces are up and configured for OSPF. The failure to form an adjacency is more likely due to mismatched OSPF timers.

This option is wrong because OSPF process IDs do not need to match for routers to form an adjacency; they only need to be in the same area and have matching network statements.