CCNA 200-301 v2 (200-301) — Questions 376–450

This statement incorrectly identifies the Transport layer PDU; it is actually a segment or datagram, while a frame is at Layer 2.

Bits are created at the Physical layer, not the Data Link layer; the Data Link layer creates frames.

This describes decapsulation, not encapsulation. Encapsulation occurs when moving down the OSI model stack.

Logical addressing and routing are Network layer (Layer 3) functions, not Transport layer responsibilities.

Converting data into electrical signals is the Physical layer (Layer 1) function, not Transport layer.

Encapsulation into frames with MAC addresses is a Data Link layer (Layer 2) function, not Transport layer.

The PDU at the Transport layer is a segment, not a frame. Frames are the PDU at the Data Link layer (Layer 2). Additionally, IP addresses are added at the Network layer (Layer 3), not the Data Link layer.

A packet is the PDU at the Network layer (Layer 3), not the Transport layer. The IP address is added at the Network layer, not the Transport layer. The Transport layer PDU is a segment (for TCP) or a datagram (for UDP).

A datagram is the PDU for UDP at the Transport layer, but the question specifies TCP segments. Even if it were UDP, the IP address is still added at the Network layer, not the Transport layer.

Assumes port security is the problem itself rather than its configuration, leading to a full removal of the feature.

Focuses on clearing the error state without addressing why the violation occurred, leading to a loop of repeated err-disabled events.

Mistakenly attributes the err-disabled condition to a Layer 2 loop-prevention feature instead of the explicitly configured Layer 2 security feature.

Root Guard blocks the port upon receiving a superior BPDU, not forwards. Loop Guard transitions to blocking only after BPDU loss, not while BPDUs are still received.

Root Guard results in a blocking state, not err-disable. BPDU Guard results in err-disable, not blocking.

Loop Guard does not immediately place the port in loop-inconsistent state; it only does so after BPDU loss. Here, BPDUs are still being received.

The statement incorrectly mandates Cat6a cabling, whereas Cat5e and Cat6 also support the full 100-meter distance for 1000BASE-T.

This mixes up part number naming conventions; GLC-T and SFP-GE-T always indicate copper transceivers, not fiber.

TDR relies on electrical signals and impedance changes; it cannot function on fiber optics.

The specific factual error is that IPv6 unicast-routing is disabled by default on Cisco routers.

The specific factual error is that the command without 'eui-64' assigns a static address, not an EUI-64 address.

The specific factual error is assuming the EUI-64 address ends with ::1, which is not guaranteed.

This describes direct device communication or southbound APIs, not the northbound API used by orchestration.

Northbound APIs are logical software interfaces, not physical cable standards or hardware.

The ip helper-address must be configured on the interface that receives the client broadcasts (VLAN 20), not the server's VLAN.

This command enables relay agent information insertion, not the actual forwarding of DHCP packets to a server.

The question states the DHCP server is at 192.168.10.100, so R1 should relay, not serve.

Incorrect because router IDs must be unique within the OSPF domain, not identical. Identical router IDs cause routing conflicts and prevent proper operation.

Incorrect because the OSPF process ID is locally significant to each router and does not need to match between neighbors for adjacency formation.

The 2-Way state is a normal OSPF neighbor state on broadcast multiaccess networks for non-DR/BDR routers (DROTHERs). It indicates that bidirectional communication has been established, but full adjacency is not required because they do not exchange LSAs directly. This is not a failure.

A duplicate router ID would cause OSPF neighbor state to oscillate or remain in EXSTART/EXCHANGE, not stabilize in 2-Way. The output shows a stable 2-Way state, which is normal for DROTHERs. Duplicate IDs would also generate error messages in the logs.

A passive interface in OSPF does not send Hello packets and therefore cannot form any neighbor adjacency. The output shows two neighbors in valid states (FULL and 2-Way), which proves the interface is active and sending Hellos.

On fiber optic links, speed and duplex are typically fixed (e.g., 1000 Mbps full duplex) and do not require manual configuration; auto-negotiation is standard for Gigabit Ethernet over fiber. Since the interface on SW1 is up/up, the settings are already compatible, so this change would not resolve the down/down state on SW2.

MDIX (Medium Dependent Interface Crossover) is a feature for copper Ethernet cables to automatically correct for straight-through vs. crossover cable issues. Fiber optic connections do not use MDIX because they use separate transmit and receive fibers, so enabling MDIX has no effect on fiber links.

A VLAN mismatch would cause the interface to be up/up but not forward traffic (Layer 2 issue), not the down/down state observed. The down/down state indicates a Layer 1 problem, such as a physical or optical incompatibility.

A /27 prefix provides only 32 total addresses (2^(32-27)=32), with 30 usable hosts after subtracting network and broadcast addresses. This is insufficient for the requirement of at least 62 usable hosts.

A /25 prefix provides 128 total addresses and 126 usable hosts, which is more than required. While it meets the requirement, it is not the smallest prefix, leading to wasted IP addresses in a subnet.

A /24 prefix provides 256 total addresses and 254 usable hosts, far exceeding the requirement of 62 usable hosts. This is not the smallest prefix and results in significant waste of IP address space.

Capacity forecasting using ML is not listed as a core application in objective 5.1; it is a more advanced AIOps use case.

Automatically generating configs via NLP is not a core application in objective 5.1; it is not covered at CCNA level.

Reinforcement learning for routing optimization is not a core AI/ML application described in objective 5.1; it is beyond scope.

The default-router option (option 3) provides the gateway for off-subnet traffic. While a missing gateway would prevent access to external networks, the scenario states users receive correct subnet addresses and can likely reach local resources. The inability to browse by hostname points to a DNS issue, not a routing problem.

The lease time option (option 51) determines how long a client can use an assigned IP address before renewing. It does not affect DNS resolution or hostname browsing. A missing or incorrect lease time would cause IP address expiration issues, not name resolution failures.

The TFTP server option (option 66) is used for booting devices like IP phones or diskless workstations to download configuration files or operating systems. It is not involved in hostname resolution. A missing TFTP server would not affect DNS lookups.

Misattributes the 'packet' PDU to the Transport layer – packets are created at the Network layer (Layer 3).

Reverses encapsulation logic: each layer adds its own overhead, increasing the size.

Incorrectly assigns flow control to the Session layer and misrepresents its placement in the TCP/IP model.

The specific factual error: The port-channel interface must match the Layer2 configuration of member ports; using no switchport creates a Layer3 interface that cannot trunk VLANs. Additionally, passive mode requires an active partner to form the channel.

The specific factual error: Speed and duplex should be consistent across all member links, but the correct resolution is to correct the misconfigured interface (Gi0/2) to match the working one (Gi0/1), not vice versa.

The specific factual error: Access mode cannot carry multiple VLANs; trunk mode is required for VLAN 10. Additionally, desirable is a PAgP keyword, not LACP. LACP uses active or passive.

Tokens are used for authentication and authorization in API requests, not for converting HTTP requests into SNMP traps. SNMP traps are asynchronous notifications sent by network devices, and token-based APIs operate at a different layer and protocol.

Token-based authentication is unrelated to controller cluster election. Cluster election typically uses protocols like VRRP, HSRP, or proprietary mechanisms to determine an active controller, not API tokens.

Token inclusion in API requests serves authentication and authorization, not data compression. JSON payload compression is typically handled by content-encoding headers (e.g., gzip) and is independent of token usage.

A default static route is used as a gateway of last resort for any destination not in the routing table, regardless of whether dynamic routing protocols are configured. It is not dependent on the absence of dynamic routing.

A floating static route is designed to be a backup; therefore, it must have a higher AD than the primary route so that the primary route is preferred.

IPv6 static routes require an IPv6 next-hop address. Using an IPv4 address would be invalid because the router would not be able to resolve it in the IPv6 routing table.

The specific factual error is that 'cdp run' enables CDP globally, but global CDP is already enabled.

The specific factual error is that LLDP is a different protocol and does not affect CDP operation.

The specific factual error is that physical issues would likely cause the interface to be down, but the question does not indicate any physical problem.

A higher OSPF metric indicates a less desirable path, as OSPF uses cost as its metric where lower cost is preferred. Selecting a higher metric path would contradict the fundamental routing principle of choosing the best path based on lowest metric.

Equal administrative distance does not imply equal preference when metrics differ. The router compares metrics within the same routing protocol; if metrics are different, the lower metric path is chosen, not both.

OSPF can learn the same prefix via multiple paths; this is normal. The router selects the best path based on metric, and the other paths are kept in the routing table as backup or for equal-cost load balancing if metrics are equal.

ARP operates at Layer 2 and is only concerned with resolving IP addresses to MAC addresses on the local link. Path selection between routers is performed by routing protocols (e.g., OSPF, EIGRP) and the routing table, which operate at Layer 3.

ARP requests are broadcast only within the local subnet and are not forwarded by routers. To reach a host on a different subnet, the source host must send the packet to its default gateway, which then uses its own ARP process to resolve the next-hop MAC.

ARP does not replace the default gateway; it only resolves the MAC address of the gateway or other local hosts. The default gateway is still required for routing traffic to other subnets, as ARP cannot provide Layer 3 forwarding.

The U/L bit was not flipped; the interface ID starts with 0011 instead of 0211.

The FFFE insertion is missing; the interface ID is just the MAC address written in IPv6 format.

FFFE is missing; only the U/L bit flip was applied.

Standard ACLs filter only on source IP, so placing them close to the source can block traffic destined to other networks that should be allowed. The correct placement is close to the destination to minimize unintended filtering.

Standard ACLs do not examine destination IP addresses; they only match on source IP addresses. Filtering by destination requires an extended ACL.

Standard ACLs operate at Layer 3 and cannot examine Layer 4 information such as TCP or UDP port numbers. Port-based filtering requires an extended ACL.

Predictive analytics forecasts future traffic volumes but does not establish a dynamic baseline for normal behavior; thus, it cannot adapt to daily variations and would not reduce false positives from current traffic patterns.

Intent-based networking automates policy deployment and verification based on business intent, but it does not analyze traffic patterns or adapt alert thresholds; therefore, it does not directly reduce false positive alerts from monitoring systems.

Deep packet inspection with static rules can detect known threats but cannot adapt to new or evolving traffic patterns; thus, it would not reduce false positives from normal traffic variations and may even increase them due to rigid rules.

Missing the 'login local' command on VTY lines, so local authentication will not work.

Lacks an IP domain name, which is necessary to generate RSA keys for SSH.

Configures VTY lines for Telnet ('transport input telnet'), not SSH, failing the remote management requirement.

Active mode sends LACP packets unconditionally; it does not require the peer to be active and will negotiate with a passive peer.

PAgP uses desirable and auto modes, not the LACP active/passive modes; these modes are specific to LACP.

The already-configured ACL permits all IP traffic, so explicitly allowing port 443 would not resolve a server not listening on that port. This step wastes time on a verified configuration.

Static NAT does not use dynamic overload entries. There are no conflicting entries because NAT overload is not configured, making this check irrelevant.

The fact that port 80 works shows the inside global IP is correct. Re-verifying it would not explain the port-specific failure, as the issue is not with the translation.

The ACL must match the source subnet of the inside hosts that need translation; using 192.168.2.0/24 does not match 192.168.1.0/24.

The 'overload' keyword is essential for PAT; omitting it means only one inside host can use the outside IP at a time.

NAT requires one interface to be 'inside' and the other 'outside'; having both as 'inside' prevents translation of outbound traffic.

This option focuses on a filtering issue, not the disabled routing engine, and would not cause the router’s own interface to lack a global unicast address.

NAT64 configuration would affect translation, but the root cause visible in the output is the lack of IPv6 routing capability on the router.

This shifts the blame to the host, but the router-side evidence (missing command and missing global unicast) clearly indicates a router configuration problem.

Standard ACLs filter only on source IP address, so placing them close to the source can block traffic that should be allowed to other destinations, causing unnecessary denial of service.

A wildcard mask of 255.255.255.255 means 'ignore all bits,' so it matches any IP address, equivalent to the 'any' keyword. It does not match all bits.

Extended ACLs are more effective when placed near the source to filter unwanted traffic early, not near the destination. Placing them near the destination allows unwanted traffic to traverse the network unnecessarily.

SNMPv3 provides significantly higher security than SNMPv2c by adding authentication and encryption, whereas SNMPv2c uses only community strings in clear text. Both versions support traps, so the statement incorrectly claims SNMPv3 has additional trap support, which is not a distinguishing feature.

SNMPv2c supports GET, SET, and trap operations, just like SNMPv1 and SNMPv3. The statement is incorrect because it claims SNMPv2c does not support traps, which is false; traps are a key feature for asynchronous notifications in network monitoring.

SNMPv3 uses the User-based Security Model (USM) with usernames and authentication keys, not community strings. Community strings are a feature of SNMPv1 and SNMPv2c, which are transmitted in clear text and provide weak security.

Increasing the syslog severity threshold to debugging generates more log messages but does not address the root cause of time discrepancies. It can overwhelm storage and analysis without fixing the time synchronization issue.

Disabling console logging reduces output to the console but does not affect the timestamps on logs stored elsewhere. The underlying time synchronization issue remains unresolved.

Clearing the logging buffer removes existing log entries but does not prevent future timestamps from being incorrect. The time drift persists, so new logs will still have mismatched timestamps.

Candidates often confuse port-level issues with VLAN-level states. Port security violations would result in an err-disable status, which is not reflected in the VLAN status column; the VLAN would still show 'active' if it were enabled.

Candidates may mistake the VLAN shutdown for an SVI shutdown because both involve the 'shutdown' keyword. However, the SVI state would appear in 'show ip interface brief' or 'show interface vlan 30', not here.

Candidates often attribute connectivity loss to STP blocking, which is a common cause of forwarding issues. However, this exhibit’s specific clue is the 'act/lshut' flag, directing attention to the VLAN administrative state.

`ipconfig /all` shows only the local IP configuration, not whether the same IP is assigned to another host.

`nslookup` resolves domain names to IP addresses and is unrelated to local IP conflicts.

`ping` tests connectivity but cannot identify duplicate IPs, as a reply does not guarantee the IP is unique.

`tracert` traces the path to a remote host, irrelevant for detecting local subnet duplicate IPs.

A rollover cable is a specialized Cisco console cable used for out-of-band management access to a device's console port, not for network data traffic. It cannot carry 10G Ethernet signals and is physically incompatible with Ethernet interfaces.

Coaxial cable (e.g., RG-6) is primarily used for cable TV, broadband internet (DOCSIS), or legacy Ethernet (10BASE2/10BASE5), but it does not support 10G Ethernet speeds over the distances required between floors in a modern enterprise network. Fiber or twisted-pair copper (Cat6a/Cat7) are the standard 10G media.

A console cable (typically a rollover or USB-to-serial cable) is used for initial device configuration and management access, not for carrying network traffic. It cannot support 10G data rates and is not designed for switch-to-switch uplinks.

This option is incorrect because OSPF’s default administrative distance (110) is higher than EIGRP’s (90), making OSPF routes less preferred when both advertise the same prefix.

This option is incorrect because equal prefix length does not cause routers to install both routes equally; administrative distance determines which route is preferred and installed.

This option is incorrect because routers can receive and compare the same prefix from multiple routing protocols; they do not reject prefixes simply because they come from different sources.

STP does not use port number as the primary criterion; it is only a tie-breaker when path cost, bridge ID, and sender bridge ID are all equal. Here, the path costs differ, so port number is irrelevant.

STP is designed to select the path with the lowest total cost to the root bridge, not the highest. Choosing a higher-cost path would increase latency and waste bandwidth.

The root port is the forwarding port toward the root bridge, while the alternate port is a blocked backup. The alternate port is not chosen over the root port; it only becomes active if the root port fails.

This answer assumes STP is off entirely, but the presence of BPDU guard configuration indicates spanning tree is operational.

Candidates often assume that BPDU guard simply failed, overlooking the interaction with BPDU filter, which can neutralize guard by suppressing BPDUs.

Root guard is a different feature and not related to the suppression of BPDUs that would allow a loop to form undetected.

The `ip helper-address` command is configured on the client-facing interface, not the server-facing interface.

The command does not forward all UDP broadcasts; it only forwards specific UDP ports (DHCP, DNS, TFTP, etc.) by default.

The command does not validate source MAC addresses or prevent DHCP spoofing; it only relays DHCP messages.

CAPWAP is a control protocol for AP-WLC communication, not a client SSID—an SSID is the network name that clients see and associate with.

CAPWAP is not a security replacement; WPA2 and WPA3 are wireless security standards, whereas CAPWAP tunnels traffic between AP and WLC.

CAPWAP supports both IPv4 and IPv6 transport; it is not limited to IPv4 ACL filtering.

Without a default gateway, the workstation cannot send packets to destinations outside its own subnet (10.10.10.0/24). The DNS server alone only provides name resolution, not routing to other subnets.

Changing the subnet mask to 255.255.0.0 would expand the broadcast domain and could cause routing problems, but it does not provide a path to other subnets. The workstation still needs a default gateway to communicate with devices outside its local network.

The default gateway 10.10.20.1 is not on the same subnet as the workstation (10.10.10.0/24). For a host to reach its default gateway, the gateway must be directly reachable on the local subnet. Since 10.10.20.1 is on a different subnet, the workstation cannot send traffic to it.

By default, frames belonging to the native VLAN (VLAN 1) traverse a trunk link without an 802.1Q tag.

Trunk ports differentiate frames from multiple VLANs using VLAN tags, permitting concurrent forwarding for all allowed VLANs.

Cisco switches allow administrators to assign any active VLAN as the native VLAN for a trunk port.

Root Guard is designed to block a port that receives superior BPDUs, which is exactly what happened. The configuration is correct and should not be removed.

BPDU Guard is correctly configured; the err-disable is expected behavior when a BPDU is received on a PortFast port. The solution is to re-enable the port and ensure the host is not a switch.

BPDU Filter is not a substitute for BPDU Guard; it prevents the port from sending or receiving BPDUs, which can cause bridging loops. The correct action is to re-enable the port, not change the protection mechanism.

Closed-loop remediation is defined by autonomous execution without manual approval for standard actions.

AI agents rely on continuous telemetry and machine learning, not solely static baseline configurations, to detect anomalies.

AI agents reduce but do not eliminate the need for human oversight, especially for policy exceptions and strategic decisions.

Bulk backup traffic is throughput-sensitive but not delay-sensitive. It can tolerate delays and jitter without impacting the backup process, so it is not typically prioritized by QoS in Cisco networks.

Email attachments are not time-sensitive and can tolerate delays and jitter. They do not require prioritization in QoS policies, making this option incorrect for delay-sensitive traffic.

Operating system updates involve large data transfers that are throughput-sensitive but not sensitive to delay or jitter. They are usually scheduled during off-peak times and are not prioritized by QoS.

The specific factual error is that 'desirable' is a PAgP mode, not LACP. LACP uses 'active' or 'passive'.

The specific factual error is that LACP requires both ends to be in compatible modes (active-active or active-passive), but on the same switch, both ports should use the same mode for the same channel group.

The specific factual error is that 'channel-group' is a physical interface command, not a port-channel interface command. The port-channel interface is used for logical configuration (e.g., trunking) after the channel is formed.

The specific factual error is assuming that LACP mode must match on both sides; active/passive is acceptable.

The specific factual error is that the solution should aim for optimal performance, not just consistency; using 100/half is technically possible but not the best practice.

The specific factual error is that trunking does not fix speed/duplex mismatches, and the native VLAN must be consistent.

Standard ACLs can only filter based on source IP address, not destination ports or protocols. They lack the granularity to distinguish between Telnet and SSH traffic.

Extended ACLs are not required for every router login policy; they are only needed when filtering must consider protocol or port information. Simple source-based filtering can use standard ACLs.

SSH uses TCP port 22, while Telnet uses TCP port 23. They are distinct ports, so an ACL can differentiate them based on destination port.

Candidates may incorrectly associate the blocked state with an administratively disabled interface.

Candidates often confuse error-disabled state (caused by features like BPDU guard) with the standard STP blocking state.

Candidates may misunderstand the root election process and assume a lower priority switch always becomes designated for all segments, ignoring the Altn role.

The server's acknowledgment is already included in the SYN-ACK segment; sending a separate ACK would be an extra step not defined in the TCP specification.

This option is incorrect because passive interfaces do not convert OSPF routes into static routes; OSPF routing remains dynamic and active elsewhere.

This option is incorrect because the passive-interface command does not affect the router ID selection, which is determined by other OSPF rules.

This option is incorrect because passive-interface affects only the specified interface unless configured globally; it does not disable OSPF on all interfaces.