CCNA 200-301 v2 (200-301) — Questions 601–675

The VLAN number is not a factor in the STP root bridge election. The election is based solely on bridge ID, which consists of bridge priority and MAC address.

The number of trunk ports does not affect the root bridge election. STP uses bridge ID (priority and MAC address) to determine the root bridge, not port count or type.

The root bridge is elected based on the lowest bridge ID, not the highest. A higher bridge priority (numerically larger) makes a switch less likely to become root.

Incorrect because duplicate default routes affect routing decisions but do not impact the OSPF neighbor formation process, which depends on hello packets and network type compatibility.

Incorrect since VLAN trunking applies to Layer 2 switch ports, not routed interfaces running OSPF. The problem described involves OSPF adjacency, not VLAN or trunk configuration.

Incorrect because OSPF process IDs are locally significant identifiers and do not need to match between routers for neighbor relationships to form. This does not cause adjacency failure.

POST is used to create a new resource or submit data to be processed, which often results in a change in server state. It is not idempotent and is not designed for retrieval without modification.

PUT is used to update or replace an existing resource, which modifies the resource. It is not a safe or idempotent method for retrieval without side effects.

DELETE is used to remove a resource, not retrieve it. Using DELETE would modify the resource by deleting it, which contradicts the requirement of not modifying the resource.

The violation mode 'restrict' does not place the port in error-disabled state; it only drops traffic from unauthorized MACs and increments a counter.

The 'protect' mode drops violating frames but does not disable the port or generate syslog messages; it is the least restrictive violation mode.

The command 'switchport port-security mac-address' manually assigns a MAC address, whereas 'switchport port-security mac-address sticky' enables dynamic learning and storage of MAC addresses.

The next-hop is R1's own address (loop) and AD 1 makes the route equally preferred to dynamic routes, defeating the floating purpose.

AD 1 makes the route equally preferred, not a floating backup.

Incorrect because ARP does not discover routing protocol identifiers like OSPF router IDs; these are unrelated to Layer 2 address resolution.

Incorrect because ARP does not replace DNS; DNS resolves hostnames to IP addresses, whereas ARP resolves IP addresses to MAC addresses.

The specific factual error is that the ietf-interfaces model's operational data cannot be modified via PATCH; the writable description is under Cisco-IOS-XE-native. Also, the Accept header should be application/yang-data+json.

The specific factual error is that the GET request should use ietf-interfaces for operational data, and the PATCH request should use the native model with correct Content-Type.

The specific factual error is that the Content-Type header must be application/yang-data+json, not application/json, to indicate the payload is YANG-encoded JSON.

This distractor exploits the common tendency to blame the helper address configuration first, overlooking the security feature that silently drops the returning DHCPOFFER.

This plays on the misconception that a switch requires an IP address on the client VLAN to facilitate DHCP, when in fact the router acting as the relay agent provides Layer 3 connectivity.

This misinterprets DHCP snooping behavior: it assumes all DHCP traffic is filtered on untrusted ports, overlooking the critical distinction that only server-side messages are blocked, not client requests.

This option lacks 'standby 11 preempt', so R1 will not preempt for group 11, failing to resolve the active-active tie.

This option omits 'standby 10 preempt', so R1 will not preempt for group 10 as required.

This option uses the incorrect virtual IP 203.0.113.1 for group 11, which does not match the required 203.0.113.254.

Incorrect. DHCP snooping blocks unauthorized DHCP messages but does not cause BPDU Guard to err-disable a port. The log specifically mentions BPDU Guard, so DHCP snooping is unrelated here.

Incorrect. Port security violations cause err-disable states but are triggered by MAC address violations, not by receiving BPDUs. The log message points to BPDU Guard, not port security.

Incorrect. A trunk native VLAN mismatch causes VLAN tagging issues but does not trigger BPDU Guard or err-disable a port due to BPDU reception. This option does not explain the BPDU Guard log message.

TFTP is incorrect because it is a simple file transfer protocol used for tasks like configuration file transfers, not for synchronizing device clocks.

DHCP is incorrect because it provides IP addressing and network configuration to clients but does not handle time synchronization between devices.

CDP is incorrect because it is a Cisco proprietary protocol for device discovery and neighbor information exchange, not for clock synchronization.

The specific factual error is that a default route is already in place and working; adding another does not solve the NAT problem.

The specific factual error is that a host's default gateway must be on the same subnet; 203.0.113.1 is not reachable directly from PC1.

The specific factual error is that OSPF does not solve the private-to-public address translation problem; it only exchanges routes between routers.

Switches do not automatically rewrite peer configurations; configuration changes must be made manually or via network automation tools. LACP only negotiates parameters like speed and duplex, not switchport mode or VLAN settings.

LACP operates at Layer 2 and does not change the interface type; a mismatched link remains a Layer 2 interface. Converting to a routed interface requires manual configuration with 'no switchport' command.

This is incorrect because a switchport mode mismatch in an EtherChannel typically causes the link to be suspended or placed into an errdisable state, not into a spanning-tree blocking state. Spanning tree deals with loops, not port-channel parameter mismatches.

The PC's APIPA address cannot reach the 192.168.10.1 gateway because it is not in the same subnet, so configuring a default gateway alone does not restore connectivity.

Changing the VLAN to VLAN 1 would isolate PC-A from the correct subnet (VLAN 10), breaking connectivity instead of fixing it.

The 'ip helper-address' command is used on interfaces that need to forward DHCP broadcasts to a remote DHCP server; here R1 itself is the DHCP server and is directly attached, so the command is not needed.

Adding a global 'router ospfv3 1' command is unnecessary; OSPFv3 can be enabled directly on the interface without a separate global configuration.

Using 'show ip ospf neighbor' and 'show ip route ospf' are IPv4 OSPFv2 commands, not valid for OSPFv3 which requires 'show ospfv3 neighbor' and 'show ipv6 route ospf'.

The 'show ipv6 route' command displays all IPv6 routes, not just OSPF-learned ones; the filter 'ospf' is required to see OSPF routes specifically.

An incorrect SSID would prevent the client from associating to the WLAN at all, not allow authentication followed by DHCP failure.

A statically configured IP is less likely the strongest cause because the client would either not use DHCP or would obtain an APIPA address, and the issue is specifically about failing to obtain a correct address via DHCP.

The access point’s default gateway does not impact DHCP forwarding for client traffic; in controller-based deployments, DHCP packets are handled by the controller or bridged directly to the wired network.

Uses 1000BASE-SX, which cannot support the required 2 km distance.

Retains 'negotiation auto', which is not supported on fiber SFPs and prevents the link from establishing.

Configures 'speed 100', a value incompatible with a 1000BASE-LX SFP, causing a link failure.

PortFast is incorrect because it is an STP feature that immediately transitions a switch port to forwarding state and does not provide any tunneling or routing capabilities.

DHCP relay is incorrect because it only forwards DHCP broadcast requests between clients and servers and does not create tunnels or connect sites logically over an IP network.

Root guard is incorrect because it is an STP topology protection feature that prevents a port from becoming a root port, and it does not create tunnels or affect routing.

Enabling CDP globally is incorrect because CDP is a device discovery protocol and does not secure or restrict remote CLI access, so it does not support the goal of blocking insecure access.

Configuring the console line for transport input ssh is incorrect because the console line is for local physical access and does not support SSH, so this does not enforce secure remote access.

The pool range includes 10.0.0.2 (the ISP's IP) and lacks the overload keyword, so PAT is disabled.

The ACL permits all traffic (any) and the inside/outside interfaces are reversed.

This uses interface overload instead of a NAT pool, contradicting the pool requirement.

Root Guard is only effective on designated ports; applying it to a root port would not prevent a rogue switch from becoming root. Loop Guard on a designated port is unnecessary and could cause false positives.

BPDU Guard on a trunk port would err-disable it upon receiving a BPDU, which is normal for trunk ports. Loop Guard on the root port is essential for loop prevention; removing it would leave the network vulnerable.

Root Guard on an access port would block the port if a superior BPDU is received, but access ports should not receive BPDUs if PortFast is enabled. BPDU Guard already handles that by err-disabling the port.

The specific factual error is that IP phones typically use an access port with a voice VLAN, not a trunk port. Trunking is unnecessary and can cause compatibility issues.

The specific factual error is confusing the access VLAN and voice VLAN assignments. The voice VLAN is configured with 'switchport voice vlan', and the access VLAN with 'switchport access vlan'.

The specific factual error is reversing the PoE settings: 'power inline never' on the phone port and 'power inline auto' on the AP port.

PAT does not require a 1:1 mapping; it allows many internal addresses to share a single public IP. A 1:1 mapping is characteristic of static NAT, not PAT.

PAT can be configured with either a single public IP address (using the interface address) or a pool of public IP addresses. It does not require a pool; a single address is sufficient for PAT overload.

PAT translations are dynamic and have a timeout (default 86400 seconds for general translations, but shorter for TCP/UDP). They are removed after the session ends or the timeout expires.

The ACL is applied in the wrong direction. Applying it outbound would filter traffic leaving the interface, not entering it.

The ACL permits all ICMP traffic instead of only echo-reply. This violates the requirement to permit only ICMP echo-reply.

Applying the ACL to an additional interface (G0/1) is unnecessary and may cause unintended filtering. The requirement specifies only one interface.

Option C is incorrect because YANG is not a routing protocol and does not handle OSPF adjacency formation or any routing functions.

Option D is incorrect as YANG is a modeling language, not a data format like JSON. Although YANG models can be encoded in JSON, they are not the same thing.

Option E is incorrect because YANG does not perform network discovery functions such as automatically discovering neighbors on a LAN; that is outside its scope.

192.168.90.47 is the broadcast address for the subnet 192.168.90.32/28. Broadcast addresses cannot be assigned to hosts; they are used to send traffic to all hosts in the subnet.

192.168.90.33 is the first usable host in the subnet (network address .32 + 1). The question asks for the last usable host, not the first.

192.168.90.48 is the network address of the next subnet (192.168.90.48/28). It is not part of the current subnet and cannot be used as a host address in the subnet containing .33.

Passive-interface does not influence router-ID selection, which is based solely on highest active loopback IP address at process initialization.

Confusing DR election parameters with router-ID election leads candidates to a parameter that is irrelevant to router-ID stability.

Changing area type does not address router-ID fluctuation; it targets LSDB optimization, which is unrelated to the dynamic router-ID re-election after loopback addition.

The OSPF process ID is locally significant and does not affect which networks are advertised. Changing the process ID to 50 is unnecessary and does not solve the problem of missing routes.

OSPF can advertise directly connected LANs if their interfaces are included in the OSPF network statements. This option is incorrect because directly connected LANs are advertised when properly configured.

A default route is not required for a router to learn intra-area OSPF routes. OSPF routers exchange routing information through link-state advertisements without needing a default route first.

DNS misconfiguration would not prevent direct IP connectivity to the gateway.

With the port down, the PC would not assign any IP address; APIPA assignment requires an active link.

Physical disconnection prevents link establishment, so no IP address is assigned.

The subnet 10.0.0.0/25 covers addresses 10.0.0.0 through 10.0.0.127. Since 10.0.0.130 is outside this range, it cannot belong to this subnet. The host's address must be within the subnet's range.

The /25 prefix length has a subnet size of 128, so valid network addresses are multiples of 128 (0, 128, 256, etc.). 10.0.0.64 is not a multiple of 128, so it is not a valid /25 network address.

The /25 prefix length creates subnets with a block size of 128, starting at 0, 128, 256, etc. 10.0.0.192/25 would be a valid subnet if the network started at 192, but 192 is not a valid /25 boundary because 192 is not a multiple of 128.

The specific factual error is that 'cdp enable' is used on interfaces, not globally. The global command to enable CDP is 'cdp run'.

The specific factual error is that 'no cdp disable' is not a valid Cisco IOS command. The proper command is 'cdp enable'.

The specific factual errors are: the global command should be 'cdp run', and the interface command should be 'cdp enable'.

This skips the obvious configuration mismatch and targets the wrong component. It assumes the issue is on the server side rather than the router's DHCP relay placement.

This action investigates Layer 1/2 status when the problem is already identified as a Layer 3 (DHCP relay) configuration error. It skips applying the fix and delays resolution.

Candidates might think the command simply didn't take effect and that reapplying it solves the problem, misunderstanding the directional requirement of DHCP relay placement.

Many engineers mistakenly think the helper should reside on the server VLAN; however, it must reside on the client-facing L3 interface.

A common misconception is that DHCP relay bypasses snooping, but snooping still inspects the server's unicast response and drops it unless the ingress port is trusted.

Candidates often suspect routing issues, but verified reachability eliminates this. The problem lies in the snooping policy, not IP connectivity.

ARP is specifically designed for IPv4 networks to map IPv4 addresses to MAC addresses. IPv6 uses Neighbor Discovery Protocol (NDP) with ICMPv6 messages to perform address resolution, not ARP.

ARP operates only within a single broadcast domain (subnet) and is not forwarded by routers. Routers separate broadcast domains and do not forward ARP requests or replies across subnets by default.

The configuration omits the 'ip flow ingress' (or any) interface command, so NetFlow will not collect any traffic.

The 'ip flow egress' command monitors outbound traffic, not the specified inbound traffic on GigabitEthernet0/0.

The 'ip flow monitor FLOW-MONITOR input' command references a flexible NetFlow monitor that does not exist; traditional 'ip flow ingress' is required.

The command 'switchport access vlan 10' assigns the interface to a specific access VLAN, placing it in access mode, not trunk mode. Trunk mode is required to carry multiple VLANs, and this command does not enable trunking.

The command 'switchport mode dynamic auto' places the interface in a mode that waits for the neighboring switch to initiate trunking via DTP. It does not directly force trunking; the interface will only become a trunk if the neighbor is set to 'dynamic desirable' or 'trunk'.

The command 'spanning-tree portfast' is used to speed up the transition of an access port to the forwarding state, bypassing the listening and learning phases. It has no effect on trunking mode and is unrelated to VLAN trunk configuration.

Candidates may equate a physical link symptom with a faulty cable, but the port’s active status indicates a good L1 connection. This action skips necessary logical checks.

This is a common ‘quick fix’ mindset, but in a structured troubleshooting process, clearing the cache hides information without solving the root cause.

Candidates might confuse local ARP failure with reachability issues to a remote subnet, but the gateway is the router itself. Routing is irrelevant until the destination is off-segment.

POST is incorrect because it is used to create or submit data, not to retrieve data without changes.

PUT is incorrect as it replaces or updates a resource, which modifies the data rather than just retrieving it.

DELETE is incorrect since it removes a resource, not retrieves data.

The OSPF 10.1.1.0/24 route matches the destination IP but has a shorter prefix length than the static /25 route. Since longest-prefix match takes priority, this route is not used.

The default route is a last-resort route used only when no other specific routes match the destination IP. Since more specific routes exist, it is not selected here.

The router does not load-balance across routes with different prefix lengths because longest-prefix match selects a single best route, so this option is incorrect.

Increasing bridge priority changes root bridge election but does not speed up the STP convergence process, so it does not resolve the 30-second connectivity loss.

Disabling PortFast affects only edge ports and does not influence the convergence time of uplink ports or VLANs experiencing link flaps.

Converting the uplink to a routed port removes it from STP but alters network design and does not specifically improve VLAN 40’s STP convergence speed.

The ip default-gateway command is used on Cisco switches in Layer 2 mode or on routers when IP routing is disabled. On a router with IP routing enabled, this command does not create a static route; it only sets the default gateway for the management interface, not for forwarding traffic.

The default-information originate command is used in routing protocols like OSPF or EIGRP to inject a default route into the routing domain. It does not create a static route itself; it only advertises an existing default route (which must already be present in the routing table) to other routers.

The route add command is used in Windows or Linux operating systems, not in Cisco IOS. Cisco IOS uses the ip route command to configure static routes. Using route add on a Cisco router would result in an unrecognized command error.

BPDU guard causes an err-disable state, which would show the interface as down or err-disabled, not as root-inconsistent.

Loop guard places a port into loop-inconsistent blocking state when BPDUs stop being received, not when a superior BPDU is received.

A forwarding state would allow traffic; the problem here is that the port is in a blocked state due to root guard, not a misconfigured VLAN.

The violation mode 'protect' does not shut down the port; it only drops offending traffic. The question explicitly requires the port to shut down.

The maximum MAC addresses must be set to 1 to restrict the port to a single device. Setting it to 2 allows an additional device.

The command 'switchport port-security mac-address 0000.1111.2222' statically assigns a MAC address, which does not allow dynamic learning. Sticky learning is enabled with the 'sticky' keyword.

Global unicast addresses are routable beyond the local link and are not automatically created for local link communication only.

Unique local addresses are similar to private IPv4 addresses and are routable within an organization, not limited to the local link.

Multicast addresses are used for group communication and are not assigned as interface addresses for unicast communication.

The 'show ipv6 interface' output shows 'up, line protocol is up', indicating the interface is not administratively down. An administratively down interface would show 'administratively down' in the output.

The link-local address (FE80::21A:2BFF:FE3C:4D5E) is correctly formed using EUI-64, which requires a valid MAC address. The presence of 'FF:FE' in the middle indicates EUI-64 is functioning properly, so the MAC address is valid.

The output shows 'ND router advertisements are sent every 200 seconds', confirming that Router Advertisements are enabled. The problem is about the router's own IPv6 address, not host autoconfiguration.

A standard static route with the default administrative distance of 1 would override the OSPF route (AD 110) because a lower AD is preferred. This would replace the primary OSPF path with the static route, not provide a backup that only activates upon failure.

Removing OSPF entirely eliminates the primary dynamic routing protocol, which is not a backup solution. The question requires preserving OSPF as the normal path and only providing an automatic backup when OSPF fails.

Disabling the routing table is not a valid operational practice; routers require the routing table to forward packets. This option does not provide any automatic backup mechanism and would break connectivity entirely.

The specific factual error is that the interface facing the outside (public) network is incorrectly configured as 'ip nat inside'.

The specific factual errors are: 1) The ACL does not match the correct inside network. 2) The 'overload' keyword is omitted, preventing PAT from working.

The specific factual error is that the static NAT command includes protocol and port, limiting the translation to TCP port 80 only.

Incorrect because NTP does not assign IP addresses; IP addressing is handled by DHCP or manual configuration, not time synchronization protocols.

Incorrect because NTP does not replace Syslog; NTP provides time synchronization, while Syslog collects and centralizes log messages from devices.

Incorrect because NTP does not encrypt Syslog messages; encryption requires separate protocols such as TLS or IPsec, not time synchronization services.

The ACL is applied in the wrong direction. For traffic originating from 192.168.1.0/24, the ACL must be applied inbound on the interface where that traffic enters the router (G0/0).

The ACL is applied on the wrong interface. The interface facing the restricted subnet (192.168.1.0/24) is G0/0, not G0/1.

The ACL should only be applied on the interface where the restricted subnet traffic enters (G0/0). Applying it on G0/1 is redundant and could inadvertently filter traffic from 192.168.2.0/24 if the ACL is modified later.

A root bridge election failure would not place the port in err-disabled state; it would cause loops but not trigger BPDU Guard directly.

PortFast and BPDU Guard are fully compatible with Rapid PVST+; this option implies incompatibility, which is incorrect.

A trunk misconfiguration alone would not cause the port to go err-disable unless a BPDU is received on a PortFast-enabled port, and BPDU Guard is the specific mechanism for that.

This option is incorrect because dynamic routes like OSPF are not automatically preferred over static routes. Administrative distance determines preference, and static routes have a lower AD than OSPF by default.

This option is incorrect because having the same prefix length does not mean both routes are installed. The router uses administrative distance to choose a single best route.

This option is incorrect because a normal static default route is valid and installed immediately. A floating static route is only needed if you want a backup route with a higher AD.

HSRP election uses priority as the primary tie-breaker; equal priority leads to comparison of primary IP addresses, which may not favor R1.

The virtual IP address must be consistent across all HSRP routers and match the configured gateway; a mismatch prevents proper operation.

Without tracking, R1's priority remains unchanged even if the uplink fails, so R1 would remain active despite losing connectivity, causing traffic black-holing.

Gi1/0/6 is an access port in VLAN 1 (the default VLAN), not VLAN 20. The question specifically asks for an interface operating as an access port in VLAN 20, so this option is incorrect.

Gi1/0/24 is configured as a trunk port, which carries traffic for multiple VLANs and is not an access port. Access ports belong to a single VLAN, so this option is incorrect.

Gi1/0/5 is clearly an access port in VLAN 20, so there is an interface that matches the description. Therefore, 'None of the interfaces' is incorrect.

Authentication is the process of verifying a user's identity during login. Since the engineer successfully logged in, authentication has already succeeded and is not preventing command execution.

Accounting records user activities and commands for auditing purposes but does not grant or deny access to commands or configuration modes, so it cannot be the cause of the command rejection.

Encryption protects data confidentiality during transmission but does not control user access or command permissions, so it is unrelated to the inability to enter configuration mode.

The 'show controllers' output confirms Full-duplex on both ends, so a duplex mismatch is not the cause. Duplex mismatch would typically cause collisions or CRC errors, which are not indicated here.

While excessive cable length can cause attenuation and errors, the 'show controllers' output does not show specific error counters like symbol errors or FCS errors that would indicate attenuation. The link is up and no errors are reported on this switch, making cable length an unlikely cause.

Speed is set to 1000 Mbps on both ends, and auto-negotiation is off, which is normal for fiber connections. A speed mismatch would prevent the link from coming up or cause constant errors, but the link is up and no errors are reported on this switch.

Area ID identifies OSPF areas, which are logical subdivisions within the OSPF domain, but it does not uniquely identify individual routers. Selecting area ID confuses the concept of router identification with area grouping.

Hello timer controls how often OSPF routers send hello packets to maintain neighbor adjacency. It does not serve as a unique identifier for routers.

Wildcard mask is used in OSPF network statements to specify which IP addresses belong to an OSPF area. It does not identify routers uniquely.