CCNA 200-301 v2 (200-301) — Questions 526–600

The specific factual error: SNMPv3 user is configured with MD5 and DES instead of SHA and AES 128; community strings are missing RO/RW keywords.

The specific factual error: The v2c trap host uses 'private' instead of 'public' community string.

The specific factual error: NetFlow export version is set to 5 instead of 9.

LACP passive/passive is the pairing that fails to form an EtherChannel because both sides wait for the other to initiate negotiation, resulting in no LACP PDUs being sent. Active/active is a valid and functional combination.

LACP operates at Layer 2 and does not change the interface type; the EtherChannel remains a Layer 2 port-channel unless explicitly configured with 'no switchport' or an IP address. The question does not mention any Layer 3 configuration.

EtherChannel formation does not alter VLAN tagging; if the interfaces are trunk ports, VLAN tags remain intact. The bundle simply aggregates bandwidth while preserving existing VLAN configurations.

Option B incorrectly permits UDP traffic on port 22, but SSH uses TCP, not UDP, so this rule would not allow SSH connections and is therefore invalid.

Option C permits TCP traffic from any source to the destination host on port 22, which is too broad because it does not restrict access to the specific source host 10.10.10.50 as required.

Option D permits all IP traffic from the source host to the destination host without restricting to TCP or port 22, allowing all protocols and ports, which is not limited to SSH and is too permissive.

The ACL must match the inside network; permitting a different subnet will not translate traffic from the correct LAN.

The NAT inside/outside designation is based on the direction of traffic; the interface facing the public network must be outside.

Without 'overload', the router will not use port numbers to multiplex multiple inside hosts to a single public IP.

PortFast is used to bypass the listening and learning states on access ports, but it does not resolve the root bridge election issue. The port is blocking due to STP topology inconsistency, not because of slow convergence.

BPDU Guard is used to protect against unauthorized switches by disabling a port if a BPDU is received, but it does not fix the root bridge election issue. The port is blocking due to STP, not due to BPDU violations.

Both PVST+ and Rapid PVST+ use the same bridge ID election process. Changing the mode would not resolve the priority misconfiguration; the root bridge election is based on bridge priority and MAC address, not the STP variant.

NTP (Network Time Protocol) synchronizes clocks across network devices but does not impact the ability to resolve domain names or browse websites. Time synchronization issues rarely cause name resolution failures, so NTP is not the failing component here.

Syslog collects and stores system logs for monitoring and troubleshooting but does not affect DNS resolution or web browsing. A syslog failure would not prevent browsing by hostname, so it is not the cause.

CDP (Cisco Discovery Protocol) is used for discovering directly connected Cisco devices and does not play any role in DNS or web name resolution. CDP failure would not cause inability to browse websites by name.

The specific factual error: The trap level is set too low (informational instead of notifications), and the source interface is incorrect.

The specific factual error: The logging host command is missing the 'host' keyword, and the timestamps command is incomplete.

The specific factual error: The timestamps command applies to debug messages instead of log messages, and the source interface is wrong.

The client receives an address from the guest network, indicating that the DHCP server or VLAN assignment is incorrect. A manually configured wrong subnet mask would not cause the client to obtain an IP from a different network; it would simply prevent proper communication within the assigned subnet. The issue is at the network assignment level, not a host configuration error.

PPP encapsulation is used on serial WAN links, not in wireless LAN environments. Wireless clients connect via 802.11, and APs use Ethernet or CAPWAP to connect to the network. PPP has no role in VLAN assignment or DHCP for wireless clients.

STP root election determines the root bridge in a switched network to prevent loops, but it does not affect VLAN assignment for wireless clients. Even if STP root election failed, it would not cause a client to receive an IP from the wrong network; it would more likely cause network instability or loops.

Configuring an access port as a trunk would cause the switch to expect 802.1Q tagging on all frames, but the PC behind the phone typically sends untagged frames. This would break connectivity for the PC unless the phone is configured to tag PC traffic, which is not standard.

The channel-group command is used to create an EtherChannel, which bundles multiple physical links into a single logical link. This is not relevant for a single access port connecting to an IP phone and PC, as there is only one physical link.

The spanning-tree cost command manually sets the STP path cost for a port, which is used for loop prevention. It does not affect VLAN assignment or voice/data separation, so it does not address the requirement of carrying voice and data correctly.

The group level 'auth' does not permit encryption; 'priv' is required for AES-128 encryption.

The encryption algorithm specified is DES (56-bit) instead of AES-128.

NetFlow export version is 5, not 9 as required.

OSPF neighbor formation does not depend on hostnames; it relies on matching parameters such as area ID, authentication, hello/dead intervals, and network type. Hostnames are only used for local identification and do not affect OSPF adjacency.

OSPF can operate over any VLAN or routed interface; there is no requirement to use VLAN 1. The adjacency issue is unrelated to VLAN numbering, and OSPF works independently of VLAN assignments on routed ports.

OSPF is designed to run on routed interfaces (Layer 3 interfaces) and does not require trunking. Trunk ports are used for carrying multiple VLANs between switches, not for OSPF adjacency between routers.

Troubleshooting at Layer 3 (IP) before verifying Layer 2 (VLAN) connectivity skips a fundamental step in the OSI model.

Confuses a Layer 1 problem with a Layer 2/3 problem. The client’s association proves the RF link is functional.

This investigates a condition that has already been ruled out (authentication succeeded) and does not address the IP assignment failure.

This statement is incorrect because CLIs remain essential for tasks that require human judgment, such as debugging complex issues, interactive configuration, and learning device behavior. APIs complement but do not replace CLIs, as many operational scenarios benefit from direct human interaction.

This is incorrect because CLIs are widely used for monitoring, troubleshooting, and ad-hoc inspection beyond initial configuration.

This statement is incorrect because structured data (e.g., JSON, XML) is commonly returned by both APIs and modern CLIs (e.g., via 'show' commands with formatting options) to facilitate machine parsing and automation. Returning structured data is a best practice for integrating network devices with management systems.

The NAT interface directions are reversed; the internal-facing interface must be 'ip nat inside' and the external-facing interface must be 'ip nat outside'.

Static NAT for services must include the protocol (tcp/udp) and port number to map specific services; otherwise, it maps the entire IP address, which is not desired here.

The 'ip nat outside source static' command is used for translating the source address of inbound packets (e.g., for load balancing), not for mapping a public IP to an internal server. For inbound access to servers, 'ip nat inside source static' is required.

Incorrect because route summarization is a routing concept and does not influence VLAN membership or force users into the same VLAN, which is a Layer 2 function.

Incorrect because route summarization does not provide encryption; encryption of routing protocols is a separate security feature unrelated to summarization.

Incorrect because summarization does not remove the need for IP addressing; routing depends on IP addresses to forward packets correctly.

The interface is not administratively down; 'no shutdown' would have no effect on a loop condition.

The problem is a loopback test, not a speed/duplex mismatch. Changing speed may cause additional problems.

Keepalives are used to detect link failures; disabling them would not resolve a loopback test and could mask real issues.

Incorrect because the static route has a higher administrative distance (200) than OSPF (110), making it less preferred and preventing it from being installed while the OSPF route is available.

Incorrect because routers do not install multiple routes with different administrative distances to the same prefix simultaneously; only the route with the lowest administrative distance is installed.

Incorrect because routers can and do choose one preferred route when multiple routes to the same prefix exist; conflicting routes do not cause both to be rejected.

Root Guard prevents a port from becoming a root port by placing it in a root-inconsistent state, not err-disabled. It does not cause link flaps or err-disable ports.

Loop Guard prevents alternate or root ports from becoming designated in the absence of BPDUs, but it does not err-disable ports. It places ports in a loop-inconsistent state, which is not err-disabled.

The global 'spanning-tree portfast bpduguard default' command only applies BPDU Guard to PortFast-enabled ports. If a port receives a BPDU and is not PortFast, it will not be err-disabled by this global command. The scenario states BPDU Guard was configured on all access ports, implying interface-level configuration.

/25 provides 126 usable hosts per subnet, which is more than enough for 50 hosts, but it only creates two subnets from a /24 network. Since four subnets are required, /25 is insufficient for subnet count.

/27 creates eight subnets from a /24, which is enough subnets, but each subnet only supports 30 usable hosts. This is less than the required 50 hosts, so /27 is not suitable.

/28 creates sixteen subnets but only supports 14 usable hosts per subnet, which is far below the 50-host requirement. Therefore, /28 is not a valid option.

Runts are frames smaller than 64 bytes, not larger than the maximum size.

Giants are frames larger than the maximum allowed size (typically 1518 bytes), not smaller than 64 bytes.

Flaps indicate an interface repeatedly transitioning between up and down states, not necessarily a physical disconnection.

The specific factual error is that the order of entries matters; a deny any any at the end would block all traffic, but here it is placed before the permit, so the deny is evaluated first.

The specific factual error is that standard ACLs lack the capability to filter by protocol or port; extended ACLs are required for such granularity.

The specific factual error is that the permit statement uses 'any' for source and destination, making it too permissive and not matching the specified networks.

Incorrect. Dynamic routes do not always override static routes; route preference depends on administrative distance, not just whether a route is dynamic or static.

Incorrect. Equal destination networks do not automatically cause load balancing if the routes have different administrative distances; only routes with equal AD and metrics are load-balanced.

Incorrect. Overlapping destinations from different sources are common and do not prevent route installation; the router uses administrative distance to choose the preferred route.

Ansible is the tool known for push-based orchestration; Puppet and Chef rely on agent-initiated pull cycles.

Mixing up the DSL/language associations: Ansible = YAML, Chef = Ruby, Puppet = Puppet DSL (declarative).

This error stems from confusing the agentless nature of Ansible with the agent-based architecture of Puppet/Chef.

192.168.0.0/16 is a less specific route covering a larger address range. Although it includes 192.168.100.77, it is not chosen because a more specific route exists. Selecting this ignores the longest-prefix match rule.

Both routes are not discarded because overlapping routes are common in routing tables. The router uses the longest-prefix match to select the best route, so discarding overlapping routes is incorrect.

The default route is only preferred if no specific matching route exists. Since both 192.168.0.0/16 and 192.168.100.0/24 match the destination, the router chooses the more specific /24 route, not the default.

Incorrect because NTP does not convert Syslog into a routing protocol; NTP’s function is strictly time synchronization, unrelated to routing protocols.

Incorrect because NTP does not create DHCP pools; DHCP pool creation is unrelated to time synchronization and is managed by DHCP services.

Incorrect because NTP does not eliminate the need for a Syslog server; it complements Syslog by providing accurate timestamps but does not replace log collection.

The client has already joined the correct SSID, authenticated, and received an IP address in the correct subnet, so the SSID broadcast setting is not the issue. The problem is specific to one application, not general connectivity.

The voice VLAN on the AP uplink is used for VoIP traffic, not for general data applications. Since the client can access other internal resources, the issue is not related to the AP uplink configuration.

OSPF router IDs are used by routers in OSPF routing, not by end-client devices. Clients do not run OSPF, so this is irrelevant to the problem.

The specific factual error is using a range (10-20) instead of a list (10,20), which includes unintended VLANs.

The specific factual error is omitting the 'trunk' keyword in the native VLAN command, which is required for trunk ports.

The specific factual error is setting the native VLAN to 1 instead of 99, which does not meet the requirement.

Changing VLANs or using subinterfaces does not solve the problem because the router's physical interface must be up and have an IP address to serve the VLAN.

Enabling DHCP snooping or trust settings on the switch cannot fix a router interface that is administratively down and unassigned.

Assigning a static IP to the PC circumvents but does not resolve the root issue of the router's interface being down, and the scenario requires DHCP.

The 10.1.0.0/16 route is less specific than the 10.1.10.0/24 route. Although it matches the destination IP, the router prefers the more specific /24 prefix, so this option is incorrect.

The 0.0.0.0/0 default route is only used when no other specific route matches the destination. Since both /16 and /24 routes match, the default route is not chosen here, so this option is incorrect.

Overlapping routes like 10.1.0.0/16 and 10.1.10.0/24 are common and do not prevent routing. The router resolves overlaps by selecting the longest prefix, so this option is incorrect.

Option A is incorrect because the order of static route configuration does not influence which next hop is used. Cisco routers prioritize routes based on administrative distance and metric, not the sequence of configuration.

Option C is incorrect because static routes only load balance when they have equal administrative distance and equal metrics. Since the metrics differ here, only the route with the lower metric is used.

Option D is incorrect because static routes do not require tracking to be installed in the routing table. Tracking is optional and used to monitor route availability for failover purposes.

Reducing path cost on a nonroot switch does not affect the root bridge election, which is determined by lowest bridge ID.

Changing cost on one uplink of a nonroot switch does not force all designated ports on downstream switches into blocking; only a topology change might trigger recalculations.

Path cost adjustment does not stop BPDUs; BPDUs continue to be sent from all ports in the spanning tree.

The specific factual error is that 'show ip route ospf' shows only existing OSPF routes, not neighbor states. Redistribution is not needed for directly connected interfaces in the same OSPF area.

The specific factual error is that debugging is not the initial diagnostic step; it should be used after verifying neighbor states and interface parameters. Changing the router ID is unnecessary unless there is a duplicate router ID issue.

The specific factual error is that 'show ip protocols' does not display per-interface OSPF parameters. The problem is likely at the interface level, not the process level.

Adding a static route to the backup link does not correct the invalid next-hop 10.0.0.3 used in the default route and fails to address the root cause of the recursive lookup failure.

Swapping the administrative distances makes the backup path preferred instead of the primary, violating the requirement that R2 be the primary with AD 1.

Configuring the default route with an exit interface rather than a next-hop IP can cause ARP resolution issues in broadcast networks and does not replace the incorrect next-hop 10.0.0.3.

STP (Spanning Tree Protocol) prevents loops in redundant topologies and does not block hosts based on IP or MAC address changes. It operates at Layer 2 and is unrelated to IP address configuration.

OSPF is a Layer 3 routing protocol used between routers, not on access ports connecting hosts. OSPF authentication is configured on router interfaces and does not apply to host ARP traffic on a switch.

PPP (Point-to-Point Protocol) authentication is used on serial links or PPPoE connections, not on Ethernet switch ports. It is unrelated to ARP inspection or DHCP snooping in a switched network.

The specific factual error is that OSPFv3 uses interface-level commands ('ipv6 ospf area') rather than the network statement used in OSPFv2.

The specific factual error is that OSPFv3 interface configuration is required on each interface, not just globally.

The specific factual error is that 'router ospf' is for IPv4 OSPF; OSPFv3 requires 'ipv6 router ospf'.

LACP and PAgP are incompatible, so the bundle cannot form in PAgP mode when one side uses LACP.

The passive side will respond to LACP negotiations, so both sides participate and the bundle forms.

Layer 2 switches do not support routed ports; they only support switchport mode access or trunk.

An access port cannot carry multiple VLANs; a trunk is required for Router-on-a-Stick.

Router-on-a-Stick requires subinterfaces; a single IP address on the physical interface only handles one VLAN. The 'vlan' command is not used on routers for inter-VLAN routing.

The network statement 10.0.0.0 0.255.255.255 area 0 matches any IP in the 10.0.0.0/8 range, which likely includes the interface IP. Therefore, the network statement is not the issue.

A router-id is automatically selected from the highest loopback or physical interface IP if not manually configured. Lack of manual configuration does not prevent adjacency formation; OSPF will still function.

The running-config does not show any authentication configuration, and the symptom (no neighbors) is consistent with passive interfaces, not authentication mismatches. An authentication mismatch would typically show neighbors in EXSTART/EXCHANGE state, not missing entirely.

Incorrect because PAT alone cannot provide a stable public IP for inbound connections to a server, making it unsuitable for predictable external access to internal services.

Incorrect because private IPv4 addresses are not routable on the Internet, so disabling NAT would prevent internal hosts from accessing external networks and external clients from reaching internal servers.

Incorrect because DHCP relay is used to forward DHCP requests across networks and does not influence NAT or the public accessibility of internal servers.

A router does not drop the packet without notification when the DF bit is not set; instead, it fragments the packet. Dropping without notification only occurs when the DF bit is set and the packet exceeds the MTU, in which case the router sends an ICMP Fragmentation Needed message.

Routers operate at Layer 3 (IP) and do not modify the transport layer protocol (e.g., UDP or TCP) to handle MTU issues. Converting a packet to UDP would change the protocol and is not a function of IP fragmentation or any standard routing behavior.

Switches operate at Layer 2 and do not perform IP fragmentation. Fragmentation is a Layer 3 function handled by routers or the source host. The router must fragment the packet before forwarding it to the switch.

NetFlow does not replace routing protocols; it is a monitoring tool that provides traffic statistics, not a path-selection mechanism.

NetFlow operates on routers and Layer 3 switches, not just Layer 2 switches, and is commonly used on routers for traffic analysis.

The specific factual error is that the question states SW1 is a multilayer switch with SVIs, so it can route internally without an external router. The issue is that IP routing is not enabled on the switch itself.

The specific factual error is that the SVIs are already up (hosts can ping the gateway), so 'no shutdown' is not the missing step. The problem is at Layer 3 routing, not Layer 2/3 interface status.

The specific factual error is that directly connected networks do not require static routes; the switch automatically installs them when the SVI is up. The problem is that 'ip routing' is not enabled, so the switch does not use these routes for forwarding.

A /30 subnet always has a block size of 4 addresses, starting at multiples of 4. The block starting at .18 would be 192.168.70.16–.19, not .18–.21. The range .18–.21 crosses a subnet boundary and includes addresses from two different subnets.

The block 192.168.70.12–.15 is a different /30 subnet (network .12, broadcast .15). The host .18 belongs to the subnet .16–.19, not .12–.15.

The block 192.168.70.20–.23 is the next /30 subnet (network .20, broadcast .23). The host .18 is not in this range; it is in the .16–.19 subnet.

Uses the keyword 'informational' instead of the required numeric level 6.

Uses 'ntp peer' instead of 'ntp server', and uses numeric levels but the primary command is wrong.

Mixes numeric and keyword severity levels; must use numeric 6 for both console and buffer.

The Ethernet trailer contains a Frame Check Sequence (FCS) for error detection at Layer 2, not application-layer data like bearer tokens. Tokens are part of the HTTP application layer and are never placed in the Ethernet trailer.

DNS responses contain resource records like A, AAAA, or CNAME, which map domain names to IP addresses. They have no role in carrying authentication tokens for REST API calls, as DNS is a separate protocol for name resolution.

The TCP checksum field is used for error detection of the TCP segment header and payload at the transport layer. It is computed by the sender and verified by the receiver; it does not carry any application data such as bearer tokens.

The current DNS server is reachable but lacks the record; simply changing the DNS server to an arbitrary IP would not guarantee resolution unless that server is known to hold the correct record, and there is no indication that 203.0.113.53 is a valid DNS server.

DNS resolution failure is not due to routing: the router can already reach the DNS server. Adding a static route will not fix missing DNS records.

The Google public DNS server likely does not have an entry for the internal hostname fileserver.courseiva.com, so this will not enable resolution.

This option is incorrect because a higher metric indicates a less preferred path in OSPF. The route with metric 30 is less optimal than the one with metric 20 and therefore not preferred.

This option is incorrect because OSPF does not reject routes simply because their metrics differ. Differing metrics are normal and help the router choose the best path rather than causing route rejection.

This option is incorrect because the router already has specific OSPF routes to the destination. A default route is not preferred when a more specific route with a valid metric exists.

10.55.8.119 is the broadcast address for the subnet 10.55.8.112/29, not the network address. The broadcast address is the last address in the block (112+8-1=119) and is used to send traffic to all hosts in the subnet.

10.55.8.120 is the network address of the next /29 subnet (120-127), not the current one. The current subnet ends at 119, so 120 belongs to a different subnet.

10.55.8.116 is a valid host address within the subnet 10.55.8.112/29 (usable range: 113-118). It is not the network address, which must be the first address (112).

The admin-status is 'up', which means the interface is not administratively shut down. A shut down interface would show admin-status as 'down'.

An interface operating normally would have oper-status 'up'. The oper-status 'down' indicates the interface is not passing traffic, so it is not functioning normally.

A loopback interface is a virtual interface that is always up/up (admin up, oper up) unless administratively shut down. The JSON shows oper-status 'down', which is not typical for a loopback.

NETCONF uses XML‑encoded RPCs over SSH or TLS, not HTTP methods; HTTP methods are used by RESTCONF.

RESTCONF does not have a separate commit operation; changes are applied immediately with each HTTP request, unlike NETCONF's explicit commit step.

BGP (Border Gateway Protocol) is a path-vector routing protocol used to exchange routing information between autonomous systems, not a data serialization format. It is unrelated to REST API data formatting.

STP (Spanning Tree Protocol) is a Layer 2 protocol that prevents loops in Ethernet networks, not a data format for APIs. It operates at the data link layer and has no role in REST API responses.

ARP (Address Resolution Protocol) is used to map IP addresses to MAC addresses in local networks, not a data serialization format. It is a network layer protocol, not an API data format.

The show authentication sessions output indicates 'Authz Success', meaning authentication and authorization succeeded. A shared secret mismatch would cause authentication failure, not a successful authorization.

The show command output clearly shows the port status as 'AUTHORIZED' and 'Authz Success'. There is no indication of err-disable. Port-security violations would show a different status, such as 'err-disabled' or 'security-violation'.

The output shows 'authVlan = 100' and the session is authorized with 'method = dot1x' and 'status = AUTHORIZED'. This indicates the supplicant successfully authenticated and was placed in the auth VLAN, not the guest VLAN. If the supplicant had failed, the port would be in the guest VLAN.

Authentication is incorrect because it only verifies the user's identity to allow login; it does not control what commands or modes the user can access after login.

Accounting is incorrect because it only records user activity and command usage for auditing purposes and does not influence login permissions or command access.

DNS is incorrect because it is related to name resolution and does not control user authentication, authorization, or command permissions on network devices.

OSPFv3 uses link-local addresses, not global unicast addresses, for neighbor formation.

OSPFv3 requires explicit interface configuration under the routing process; it is not automatically enabled.

The neighbor ID shown is the Router ID, not the IPv6 address of the neighbor's interface.