CCNA 200-301 v2 (200-301) — Questions 301–375

Neighbor Solicitation (NS) messages are used for address resolution (determining the link-layer address of a neighbor) and duplicate address detection, not for advertising default gateway or prefix information.

DHCPv6 Solicit messages are used in stateful DHCPv6 to request configuration parameters like addresses and DNS servers, but SLAAC does not use DHCPv6 for default gateway or prefix information; those are provided by RA messages.

ICMP Echo Reply messages are used for ping responses and do not carry any routing or prefix information; they are not involved in neighbor discovery or address autoconfiguration.

The subnet 10.10.40.48/28 includes addresses 10.10.40.48 through 10.10.40.63. The host address 10.10.40.78 is outside this range, so it does not belong to this subnet.

The subnet 10.10.40.72/28 is not a valid subnet because /28 subnets have boundaries that are multiples of 16. The valid subnet starting addresses for /28 are 0, 16, 32, 48, 64, 80, etc. 72 is not a multiple of 16, so this is not a valid network address.

The subnet 10.10.40.80/28 includes addresses 10.10.40.80 through 10.10.40.95. The host address 10.10.40.78 is below this range, so it does not belong to this subnet.

Syslog is a protocol used for logging and monitoring system events, not for delivering network configuration parameters. It collects and forwards log messages from network devices to a central server for analysis, but does not assign IP settings.

NTP (Network Time Protocol) is designed to synchronize clocks between devices over a network, ensuring accurate timekeeping. It does not provide IP address, subnet mask, default gateway, or DNS server information to hosts.

GRE (Generic Routing Encapsulation) is a tunneling protocol used to encapsulate packets of one protocol within another, typically for creating VPNs or connecting remote networks. It does not provide host configuration parameters like IP addresses or DNS servers.

Configuring 'ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0' specifies only the exit interface. On multiaccess Ethernet, this causes the router to ARP for every unknown destination, which is inefficient and less ideal.

Configuring 'ip route 255.255.255.255 255.255.255.255 198.51.100.1' creates a host route, which matches only one IP address, not all unknown destinations. Therefore, it is not a valid default route.

The statement that no static default route should ever be used on Ethernet is incorrect. Static default routes are valid and commonly used on Ethernet interfaces, especially for WAN links.

Standard ACLs are specifically designed to match source IP addresses, so this statement is factually incorrect. They can match source addresses using wildcard masks.

Named ACLs use wildcard masks just like numbered ACLs; the naming does not affect the functionality of wildcard masks. The statement is technically incorrect.

The 'deny any' line at the end of an ACL is implicit, so placing it before the permit would block all traffic, including the intended 192.168.30.0/24 subnet. The order of entries matters, but the issue here is not about the order of deny any.

This option is incorrect because static routes do not always beat dynamic routes; the static route must have a lower administrative distance to be preferred, which is not the case here due to the floating static’s higher AD.

This option is incorrect because routing protocols are compared first by administrative distance, not by their internal metrics; RIP’s metric does not override OSPF’s lower AD.

This option is incorrect because equal prefix length alone does not guarantee load balancing; routes must have matching attributes and equal administrative distances for equal-cost multipath (ECMP) to occur.

Converting unused ports into trunk ports is incorrect because it increases network exposure by allowing multiple VLANs on ports that should remain inactive, thereby expanding potential attack vectors.

Enabling Telnet on all unused ports is wrong as Telnet is an insecure management protocol that does not address physical port security and can expose the network to interception and unauthorized access.

Advertising every unused port into OSPF is irrelevant because OSPF is a Layer 3 routing protocol that does not manage or secure Layer 2 switch ports, so it does not reduce exploitation risk.

Common misconception: the warning message implies a VLAN is not allowed, but native VLAN mismatch means the trunk ports disagree on the native VLAN, not that a VLAN is missing from the allowed list.

Over‑reaction: candidates might think a trunk problem requires eliminating the trunk, but the correct approach is to correct the native VLAN parameter on the existing trunk.

Wrong feature: PortFast addresses access port convergence, not VLAN mismatches. Candidates may reach for any familiar command, but it targets the wrong layer and port type.

The /26 subnet mask has a block size of 64, not 32. The network addresses for /26 are 0, 64, 128, and 192. 192.168.60.32 is not a valid network address because it is not a multiple of 64.

192.168.60.64 is the network address of the next /26 subnet (64–127). The host address 192.168.60.33 belongs to the 0–63 range, not the 64–127 range.

192.168.60.63 is the broadcast address of the 192.168.60.0/26 subnet, not the network address. The network address is always the first address in the subnet (all host bits set to 0).

ARP operates at Layer 2 (Data Link layer) and is used to resolve IP addresses to MAC addresses. A lack of ARP replies indicates a Layer 2 connectivity issue, such as a misconfigured VLAN, incorrect cabling, or a switch port problem, not a Layer 3 routing issue.

ICMP echo requests without replies typically indicate a Layer 3 issue, such as no route back to the source, or a firewall blocking the replies. Layer 2 loops cause broadcast storms, duplicate frames, and MAC address flapping, not a simple lack of ICMP replies.

TCP SYN packets without SYN-ACK replies often indicate a firewall blocking the connection, a service not listening on the destination port, or a Layer 4-7 issue. Layer 1 physical issues would typically result in no packets being received at all, not just missing SYN-ACKs.

The administrative distance should be higher than the primary route's AD (1) to make it less preferred. Setting it to 1 makes it equal, not a backup.

The question explicitly states 'with an administrative distance of 150'. Using 250 is not what was asked, though it would be technically valid.

The default AD is 1, which equals the primary route's AD. This does not create a floating route; both routes are equally preferred.

Hiding the SSID is already satisfied; changing broadcast settings would make the SSID visible, contradicting the requirement.

WPA3 is already enabled on the WLAN, so there is no need to configure security. The client associates successfully, proving security is not the issue.

The WLAN is enabled because the client can see the SSID and associates; enabling it again would not fix the VLAN mismatch.

The specific factual error is that the adjacency is stuck due to timer mismatch, not network type mismatch.

The specific factual error is that the configuration should be applied to R1, not R2, as per the question context.

The specific factual error is that both hello and dead intervals must match; changing only one leaves a mismatch.

SLAAC does not require NAT because IPv6 has a vast address space, eliminating the need for address translation. NAT is a workaround for IPv4 address exhaustion and is not used in native IPv6 networks. SLAAC relies on router advertisements to provide prefix information, and hosts generate their own addresses without any translation.

DHCPv6 does not replace router advertisements; in fact, router advertisements are still required for hosts to determine the default gateway and other network parameters. Even when DHCPv6 is used, hosts rely on RAs to learn the on-link prefix and to decide whether to use stateful or stateless configuration.

Both SLAAC and DHCPv6 can provide addressing information to hosts. SLAAC allows hosts to form their own addresses from prefix information in RAs, while DHCPv6 can assign addresses and other configuration parameters. Therefore, the statement that neither can provide addressing information is false.

WEP is deprecated and insecure because it uses weak RC4 encryption with static keys, which attackers can easily crack, making it unsuitable for modern enterprise WLANs.

WPA improves on WEP by introducing TKIP but still uses weaker encryption than WPA2 with AES, so it is not the strongest choice for enterprise wireless security.

Open authentication provides no encryption or authentication, leaving wireless traffic exposed to interception and unauthorized access, so it is not a secure method.

The specific factual error is that the existing ACL contains a permit ip any any statement that would override any specific denies, allowing all traffic.

The specific factual error is that ACLs should be applied inbound on the interface where the traffic enters the router, not on the outbound interface towards the destination.

The specific factual error is that outbound ACLs filter traffic exiting the interface, but the traffic from LAN to server enters the router via GigabitEthernet0/0 and exits via another interface (e.g., WAN). An outbound ACL on GigabitEthernet0/0 would not affect traffic going to the server.

10.10.10.31 is the broadcast address of the previous /27 subnet (10.10.10.0–10.10.10.31), not the subnet containing .33.

10.10.10.32 is the network address (subnet ID) of the subnet containing .33, not the broadcast address. The network address is the first address in the block.

10.10.10.64 is the network address of the next /27 subnet (10.10.10.64–10.10.10.95), not the broadcast address of the subnet containing .33.

The specific factual error: Changing hello intervals is not the standard fix for a point-to-point link not forming adjacency; the network type is the primary issue.

The specific factual error: Setting priority to 0 does not eliminate the DR/BDR election process; it only ensures the router does not participate as DR/BDR.

The specific factual error: The broadcast network type is already the default on Ethernet; the command is redundant and does not address the need for a point-to-point network type.

STP (Spanning Tree Protocol) is unrelated to hostname resolution. It prevents Layer 2 switching loops and does not affect IP connectivity or DNS services, so it cannot cause hostname resolution failures.

PAT (Port Address Translation) manages IP address translation for outbound traffic but does not handle hostname-to-IP translation. If PAT were failing, IP connectivity itself would be affected, not just hostname resolution.

Port security controls access to switch ports by limiting which MAC addresses can connect. It does not perform or affect hostname resolution or IP address translation, so it is not related to the problem.

Disabling STP globally removes all loop protection, which is not desired because loop protection elsewhere is still needed.

Changing the trunk native VLAN does not affect STP port state transitions and is irrelevant for an access port.

Setting the port to half-duplex has no impact on STP listening/learning timers and would not speed up host access.

The subnet mask on R1 G0/0 should be /30 to match R2, not /24.

The default gateway must be the neighbor's IP address, and IPv6 subnets must match for direct communication.

The requirement states EUI-64 on R1 G0/1, so static is not allowed.

IPv6 extension headers are used for additional functionality in IPv6 packets, such as fragmentation or security, and are not involved in NAT overload (PAT) which operates at Layer 4 using port numbers.

Source MAC addresses are used for Layer 2 forwarding within a local network and are not preserved across a router's WAN interface; NAT operates at Layer 3 and above, not using MAC addresses for translation.

Routers do not maintain separate routing tables per client; routing tables are based on destination networks, not individual hosts. NAT overload uses a single routing table and relies on port numbers for translation.

A native VLAN mismatch does not convert tagged traffic into routed traffic. Tagged frames continue to be switched based on their VLAN tags, and the trunk remains a Layer 2 link. The mismatch only affects untagged frames on the native VLAN.

A native VLAN mismatch is a Layer 2 trunking issue and does not directly affect OSPF or any routing protocol. OSPF adjacency is a Layer 3 process and would only be impacted if the mismatch caused connectivity loss for the router interfaces, but the mismatch itself does not force OSPF adjacency resets.

A native VLAN mismatch does not prevent the trunk from carrying other tagged VLANs. Tagged frames for other VLANs are still forwarded correctly because they are not affected by the native VLAN configuration. The trunk can carry multiple VLANs, but the native VLAN traffic is misdirected.

The wildcard mask 255.255.255.0 would match only the exact host 192.168.10.0, not the entire /24 subnet. Cisco ACLs use wildcard masks where 0 means match and 1 means ignore; for a /24, the correct mask is 0.0.0.255.

Standard ACLs can only filter based on source IP address and cannot match specific protocols like Telnet (TCP port 23) or destination addresses. Extended ACLs are required to filter Telnet traffic from a specific source to a specific destination.

PAT (Port Address Translation) is unrelated to ACL filtering. ACLs operate independently of NAT/PAT; they filter traffic based on Layer 3 and Layer 4 information regardless of whether translation is configured.

Preemption is not needed because the current Active router already has the higher priority (110 vs 100). Preemption only becomes relevant when a higher-priority router recovers after a failure and needs to reclaim the Active role. The issue here is routing, not HSRP state stability.

The virtual MAC address is automatically derived from the HSRP group number and is the same for both routers when they are in the same group. R2's local virtual MAC is different because it is used only when R2 becomes Active. The mismatch in the output is normal and does not affect connectivity.

The hello and hold timers are consistent (3 sec hello, 10 sec hold) and are not causing any issues. Adjusting timers would not fix the routing problem. The root cause is the lack of a default route on the Active router.

Configuring different priorities (150 and 50) would force the router with priority 150 to become active regardless of IP address, contradicting the requirement to use the highest IPv4 address for election. HSRP uses priority as the primary criterion; only when priorities are equal does the highest IP address break the tie.

The command 'standby 1 priority 100' is already implied by setting priority 100; it does not enable preemption. With equal priority and no preempt, both routers will remain in standby state indefinitely because HSRP cannot determine an active router without a tiebreaker or preemption. The active router election requires either a priority difference or preempt to resolve the tie.

Configuring different priorities (100 and 50) would make the router with priority 100 active regardless of IP address, which violates the requirement to use the highest IPv4 address for election. The requirement explicitly states that priorities must remain equal so that the highest IP address determines the active router.

Fragmenting the packet despite the DF bit being set violates the sender's explicit instruction to avoid fragmentation. Routers must respect the DF bit and cannot fragment in this case.

Routers do not convert IPv4 packets to IPv6 to handle MTU or fragmentation issues. These are different protocols, and such conversion is not a standard router behavior.

Routers do not broadcast oversized packets to other routers for fragmentation. The forwarding decision and fragmentation handling are local to the router, so the packet is dropped if it cannot be forwarded.

This option is incorrect because metrics such as OSPF cost and RIP hop count are not compared across different routing protocols. Administrative distance is the primary factor in route selection between protocols.

This option is incorrect because the dynamic nature of BGP does not override the administrative distance rule. Static routes with AD 1 are always preferred over eBGP routes with AD 20.

This option is incorrect because simplicity of metric calculation (hop count) does not influence route preference. Administrative distance is the deciding factor, and RIP’s higher AD (120) makes it less preferred than OSPF (110).

The specific factual error: The 'native' keyword should only be applied to the subinterface that matches the native VLAN (usually VLAN 1 by default), not to all subinterfaces.

The specific factual error: Router-on-a-stick requires subinterfaces with VLAN encapsulation to handle multiple VLANs over a single trunk link. Assigning an IP to the physical interface only works for a single VLAN (usually the native VLAN).

The specific factual error: 'ip routing' is a global configuration command that enables Layer 3 forwarding on the entire router. It is not available under interface configuration mode.

OSPFv2 does not natively support IPv6; OSPFv3 is required for IPv6 routing.

Link-state advertisements (LSAs) are refreshed every 30 minutes by default, not every 30 seconds.

OSPF router IDs must be unique throughout the OSPF domain; routers in the same area can have different router IDs.

Spanning Tree Protocol (STP) can block a VLAN if there is a loop, but the output shows VLAN 40 is active in the management domain and not listed as blocked. The explicit absence of VLAN 40 from the allowed VLAN list is the direct cause, not STP.

The native VLAN is only for untagged traffic on an 802.1Q trunk. All other VLANs are tagged and can cross the trunk regardless of the native VLAN. VLAN 40 is not the native VLAN, but that does not prevent it from being carried if permitted.

802.1Q has no limit of three VLANs per trunk; it can support up to 4094 VLANs. The output shows only three VLANs allowed because of configuration, not a protocol limitation.

This option incorrectly states that static routes always override dynamic routes. In Cisco routing, static routes only override dynamic routes if their administrative distance is lower. Since the floating static route has a higher AD (150) than OSPF (110), it is not preferred here.

This option is incorrect because load balancing only occurs between routes with equal administrative distances and metrics. Here, the OSPF and floating static routes have different ADs, so only the route with the lower AD is active.

This option is false because OSPF can advertise and learn default routes using the 'default-information originate' command. Therefore, OSPF can carry a default route, making this statement incorrect.

The relay address 192.168.100.10 is correctly configured to point to the DHCP server on VLAN 100. The issue is not with the relay address being incorrect.

The DHCP server is on the same router (VLAN 100 interface) and is reachable; the relay configuration is correct. The server is not unreachable.

The exhibit shows 'ip helper-address 192.168.100.10' is configured on GigabitEthernet0/1, which is the VLAN 200 interface. The command is present.

DHCP snooping is a security feature that filters DHCP messages and does not affect Layer 3 routing between VLANs. Disabling it would not enable inter-VLAN communication. The issue is routing, not DHCP.

Removing all VLAN assignments would break the network entirely, as hosts would lose their VLAN membership and connectivity. VLANs are essential for segmenting the network; removing them would not solve the routing issue.

The exhibit shows the static route is configured, so the issue is not that it is missing.

An administrative distance of 200 is appropriate for a floating static route to be less preferred than OSPF (AD 110) but still usable as a backup.

A default route (0.0.0.0/0) does not override a more specific route like 10.10.10.0/24; the longest prefix match rule ensures the specific route is preferred.

The specific factual error: 'spanning-tree portfast bpduguard default' enables BPDU guard, not recovery. Recovery requires 'errdisable recovery cause bpduguard'.

The specific factual error: Using 'cause all' is not the best practice; the question implies a specific cause. Also, the verification command is correct but the configuration is not precise.

The specific factual error: errdisable recovery is a global configuration command, not interface-specific.

PortFast does not filter BPDUs; it still processes them normally. If a BPDU is received on a PortFast port, the port will still participate in STP and may transition to a blocking state, defeating the purpose of PortFast. The statement incorrectly claims BPDUs pass through while the port remains forwarding, which is not true.

BPDU Guard does not affect STP election processes; it simply err-disables the port upon receiving any BPDU. It does not ignore superior BPDUs or prevent the port from becoming a root or designated port. That behavior is associated with Root Guard, not BPDU Guard.

BPDU Guard is intended for access ports with PortFast, not for trunk ports. Trunk ports between switches are expected to exchange BPDUs for normal STP operation; applying BPDU Guard on a trunk would cause the port to err-disable upon receiving legitimate BPDUs, disrupting the network.

This option is incorrect because advertising Layer 3 reachability is the role of routing protocols like OSPF or EIGRP, not NTP, which only synchronizes time.

This option is incorrect as NTP does not encrypt data traffic by default; it is a time synchronization protocol and does not provide encryption services.

The specific factual error: 'enable password' does not encrypt the password; 'login' without 'local' allows any password to work if set, but does not use local user database.

The specific factual error: 'login local' requires a local username database, but no username is configured; the VTY password is unnecessary and misleading.

The specific factual error: The question does not require creating a local username; adding one is extraneous and could be considered incorrect in a PBQ where only the specified steps are needed.

The specific factual error is that OSPFv3 uses interface-level configuration, not network statements like OSPFv2 for IPv4.

The specific factual error is that OSPFv3 must be enabled on all interfaces that should participate in the routing process, including loopback interfaces.

The specific factual error is that OSPF router-ids must be unique. Using the same router-id on both routers prevents proper neighbor formation.

The specific factual error: Duplex must match the switch (full), and 1000BASE-SX cannot reach 5 km.

The specific factual error: Speed must match the switch port's configured speed (100 Mbps), not auto-negotiate to 1000 Mbps.

The specific factual error: Auto-negotiation cannot match a manually configured port; both sides must be manually set or both use auto-negotiation.

A routed port (no switchport) is used for Layer 3 routing between switches or routers, not for connecting end devices like IP phones and PCs. It does not support VLAN assignment or the coexistence of multiple VLANs on a single port, making it unsuitable for this scenario.

EtherChannel is used to aggregate multiple physical links into a single logical link for increased bandwidth and redundancy. It does not provide any mechanism to separate voice and data traffic into different VLANs on a single port, and it is not relevant to the requirement of connecting an IP phone and PC.

Using a native VLAN only and disabling all tagging would place all traffic (voice and data) in the same VLAN, which contradicts the requirement to separate voice into VLAN 200 and data into VLAN 20. The native VLAN is used for untagged traffic on a trunk, but this design requires distinct VLANs with tagging for voice.

BPDU Guard is a protective feature that disables a port upon receiving a BPDU, not upon losing BPDUs. The symptom here is a loss of BPDUs, not a reception of unexpected BPDUs.

UDLD acts by shutting down the port or putting it in errdisable state, while the scenario explicitly shows the port in a loop-inconsistent state, indicating an STP-based protection mechanism.

Root Guard would block a port if it received a BPDU with better root information, not when BPDUs stop arriving. It also does not produce a loop-inconsistent state.

Option A incorrectly identifies the inside global address as the private IP address assigned to the internal PC. This is actually the inside local address, which is the private IP used within the internal network and not visible externally.

Option C confuses the inside global address with outside local or outside global addresses, which refer to remote servers or external hosts from the internal perspective. The inside global address specifically represents the internal PC externally.

Option D incorrectly associates the inside global address with the MAC address of the outside interface. NAT translation deals with IP addresses and ports, not MAC addresses, so this option is invalid.

Trunk ports are not appropriate for end devices; they are designed for inter-switch links.

The question does not require creating or naming VLANs; it only asks to assign ports to existing VLANs.

The 'switchport mode access' command is required to explicitly set the port as an access port; otherwise, the port might negotiate trunking.

This option is incorrect because router hostnames do not affect OSPF neighbor relationships. OSPF adjacency depends on interface-level parameters, not device names, so identical hostnames are not required.

This option is incorrect because converting the link to a trunk is irrelevant for OSPF adjacency on routed interfaces. OSPF operates on Layer 3 interfaces, and trunking is a Layer 2 concept used for VLAN tagging, not required for OSPF neighbor formation.

This option is incorrect because static routes are not necessary for OSPF adjacency. OSPF dynamically discovers neighbors and exchanges routing information without requiring preconfigured static routes.

The specific factual error is that the security mode does not affect SSID visibility; the problem is the broadcast setting.

The specific factual error is that interface mapping controls VLAN assignment for traffic, not SSID broadcast.

The specific factual error is that radio band selection does not affect SSID broadcast; the hidden SSID prevents discovery on any band.

Misconception that speed mismatch produces specific error counters; in reality, incompatible speeds cause link failure, not runts and CRC errors.

Misconception that CRC errors alone point to a bad cable; duplex mismatch is one of the most common causes of runts and CRC errors on forced-full interfaces.

Misconception that a VLAN mismatch can trigger interface errors; these errors are purely physical/data-link layer phenomena unrelated to VLAN settings.

Telnet transmits credentials and data in plaintext, so it lacks confidentiality and is less secure than SSH.

SSH can be configured on routers, Layer 3 switches, and any device that supports IP connectivity, not just Layer 2 switches.

Blocking Telnet only disables unencrypted remote access; AAA functions (e.g., authentication, authorization, accounting) remain operational via SSH or other methods.

Predictive analytics forecasts future network conditions (e.g., link utilization trends) but does not automatically reconfigure devices; automation requires separate closed-loop systems like Cisco DNA Assurance with RMA (reactive, proactive, predictive) workflows. The statement incorrectly combines prediction with automatic reconfiguration.

ML models in network operations can be trained using both supervised learning (labeled data for known attacks) and unsupervised learning (unlabeled data to discover unknown patterns). The statement incorrectly claims exclusive use of labeled datasets, ignoring unsupervised anomaly detection which is critical for identifying novel threats.

Rule-based systems are static and cannot adapt to new, unknown patterns without manual rule updates. ML models, especially unsupervised learning, excel at detecting anomalies without predefined rules. The statement reverses the strengths of rule-based and ML approaches.

Private IPv4 addresses do not require OSPF or any specific routing protocol to function inside a LAN; they can operate with static routes or any dynamic routing protocol. OSPF is just one option and is not mandatory.

Public IPv4 addresses are specifically used on Internet-facing devices to enable global reachability. Without public addresses, devices would not be directly accessible from the Internet.

ARP (Address Resolution Protocol) resolves IP addresses to MAC addresses on a local network segment and does not perform any translation between private and public addresses. NAT (Network Address Translation) handles that translation.

Invalid syntax: the eui-64 keyword cannot be used with a full 128-bit address; it requires only a prefix.

Missing the eui-64 keyword, so the interface would be configured with a static address rather than deriving the interface ID from the MAC.

Invalid syntax: the eui-64 keyword does not accept an explicit MAC address as an argument.