200-301 Practice Questions

Question 1

Drag and drop the following steps into the correct order to configure a Cisco switch as a DHCP relay agent with DHCP snooping, where the DHCP server is located on a remote router.

Accepted Answer

Configure a DHCP pool with network, default gateway, and lease parameters on the router acting as the DHCP server.. First, the DHCP server must be properly configured on the router. Next, DHCP snooping is enabled globally on the switch to protect against rogue servers. Then, the specific client VLANs must be added to the snooping database. After that, the uplink interface to the DHCP server must be trusted to allow legitimate server responses. Finally, the ip helper-address command is placed on the client's SVI to forward DHCP broadcasts to the remote server.

Question 2

Match each REST-style method to the most common intent.

Accepted Answer

GET - Retrieve a resource. RESTful methods map to CRUD operations: GET retrieves, POST creates, PUT replaces, PATCH partially updates, DELETE removes, and OPTIONS returns allowed methods.

Answer

GET - Create a new resource

Answer

POST - Retrieve a resource

Answer

PUT - Partially update a resource

Question 3

A network engineer notices that internal hosts (192.168.1.0/24) can reach external servers on the internet, but replies from external servers never reach the internal hosts. The router R1 is configured with dynamic NAT to translate the internal subnet to a pool of public IPs (203.0.113.10-203.0.113.20). The engineer runs 'show ip nat translations' and sees only a few stale translations. What is the most likely cause of the issue?

Accepted Answer

The outside interface (GigabitEthernet0/0) is missing the 'ip nat outside' command.. The 'ip nat outside' command must be applied to the interface facing the external network (GigabitEthernet0/0) for the router to translate return traffic. Without it, the router does not perform NAT on packets arriving on that interface, so replies from external servers are forwarded without translation back to the inside local IPs, which are not routable on the internet. The stale translations indicate that outbound translations were created but never used for return traffic, confirming the missing outside interface command.

Answer

The access list 'NAT' is incorrect; it should permit only specific hosts, not the entire subnet.

Answer

The NAT configuration lacks the 'overload' keyword, so the pool is exhausted quickly.

Answer

The NAT pool 'POOL' has too few addresses; it should be expanded to a /24 subnet.

Question 4

A network administrator is troubleshooting a wireless connectivity issue in a large office. Users on the 5 GHz band report intermittent disconnections and slow performance, while 2.4 GHz clients are unaffected. The office uses a Cisco 9800 WLC with APs that support 802.11ac Wave 2. The administrator checks the WLC's RF profile and notices a high number of channel utilization reports on channel 36. What is the most likely cause of the problem?

Accepted Answer

Change some APs to use channels 40, 44, or 48 to reduce co-channel interference.. Channel 36 is a 20 MHz channel in the 5 GHz band. When many APs use the same channel (channel 36), they share the same medium, leading to co-channel interference (CCI). This causes intermittent disconnections and slow performance for 5 GHz clients because they must contend for airtime. Spreading APs across non-overlapping channels like 40, 44, or 48 reduces CCI and improves performance.

Answer

Enable DFS channels to avoid radar interference.

Answer

Increase the channel width to 160 MHz to improve throughput.

Answer

Disable the 2.4 GHz radios to force all clients to 5 GHz.

Question 5

Drag and drop the following steps into the correct order to configure a switch port for data and voice traffic.

Accepted Answer

Enter interface configuration mode for the desired switch port.. The correct order is: 1) Enter interface configuration mode, because all port-specific commands must be applied under the interface. 2) Set the port as an access port with 'switchport mode access'—a voice VLAN can only be assigned on an access port. 3) Assign the data VLAN with 'switchport access vlan' to ensure proper Layer 2 forwarding for data traffic. 4) Assign the voice VLAN with 'switchport voice vlan' so the IP phone's voice frames are tagged with the voice VLAN. 5) Enable PortFast with 'spanning-tree portfast' to immediately transition the port to forwarding, preventing DHCP timeouts for the phone and host.

Question 6

Which TWO statements about IPv4 and IPv6 ACLs are true?

Accepted Answer

Extended IPv4 ACLs should be placed as close to the source as possible to minimize unnecessary traffic on the network.. Extended IPv4 ACLs filter on source and destination IP addresses, ports, and protocols, so placing them as close to the source as possible prevents unwanted traffic from traversing the network, reducing bandwidth waste and security risks. This is a best practice for extended ACLs, unlike standard ACLs which should be placed close to the destination.

Answer

Standard IPv4 ACLs use numbers in the range 100-199.

Answer

Standard IPv4 ACLs filter only the source IP address and are best placed close to the source to be most effective.

Answer

Numbered ACLs allow individual access control entries (ACEs) to be deleted without removing the entire ACL.

Question 7

A network administrator is troubleshooting an IPv6 connectivity issue on a newly deployed router. The router's G0/0/0 interface is configured with an IPv6 address using EUI-64, but hosts on that subnet cannot reach the router's link-local address. The administrator runs 'show ipv6 interface g0/0/0' and sees that the interface is up/up but the IPv6 address is not in the expected format. What is the most likely cause of the problem?

Accepted Answer

The IPv6 address was not configured correctly; the 'ipv6 address' command was likely omitted or misconfigured.. The router's G0/0/0 interface is up/up, but the IPv6 address is not in the expected EUI-64 format. This indicates that the 'ipv6 address' command was likely omitted entirely, because if it were simply misconfigured (e.g., without the `eui-64` keyword), the router would still automatically generate a link-local address, and hosts would be able to reach it. Since hosts cannot reach the link-local address, IPv6 is not enabled on the interface at all. The correct configuration requires the `ipv6 address` command with the appropriate prefix and the `eui-64` keyword.

Answer

The interface is administratively down.

Answer

The MAC address of the interface is invalid, preventing EUI-64 from generating a proper address.

Answer

The router is not sending Router Advertisements, so hosts cannot autoconfigure.

Question 8

A network administrator is configuring a new Windows workstation on a small office network that uses IPv4 addressing. The workstation must be able to communicate with devices on other subnets and resolve hostnames via a company DNS server at 10.10.10.5. The administrator has already set the IP address to 10.10.10.10 and the subnet mask to 255.255.255.0. Which additional parameter must be configured to meet both requirements?

Accepted Answer

Configure a default gateway of 10.10.10.1 and a DNS server of 10.10.10.5.. To communicate with devices on other subnets, the workstation needs a default gateway (router) to forward traffic beyond its local subnet. The IP address 10.10.10.10 with subnet mask 255.255.255.0 places it in the 10.10.10.0/24 network, so a default gateway (e.g., 10.10.10.1) is required for inter-subnet routing. Additionally, to resolve hostnames, the DNS server address must be explicitly configured; the company DNS server is at 10.10.10.5. Option A correctly provides both parameters.

Answer

Configure only a DNS server of 10.10.10.5.

Answer

Change the subnet mask to 255.255.0.0 to allow communication across subnets.

Answer

Configure a default gateway of 10.10.20.1 and a DNS server of 10.10.10.5.

Question 9

Which TWO statements accurately describe the characteristics and deployment considerations for fiber optic cabling in a modern enterprise network?

Accepted Answer

When using a 10GBASE-SR SFP+ transceiver over OM3 multimode fiber, the maximum supported distance is 300 meters.. The correct statements are that 10GBASE-SR over OM3 multimode fiber supports up to 300 meters and that fiber optic cabling is immune to electromagnetic interference (EMI), making it ideal for electrically noisy environments. Single-mode fiber actually has a smaller core diameter than multimode, making option A incorrect. Multimode fiber is designed for shorter links, so option B is wrong. Standard 1000BASE-LX SFP transceivers over single-mode fiber are limited to 5 km, not 10 km, so option C is inaccurate.

Answer

Single-mode fiber (SMF) typically uses a larger core diameter than multimode fiber (MMF).

Answer

Multimode fiber (MMF) is generally preferred for longer-distance links, such as between buildings on a campus network.

Answer

A 1000BASE-LX SFP transceiver operating over single-mode fiber can support distances up to 10 km.

Question 10

A network administrator is troubleshooting connectivity issues in a switched network. Users on VLAN 10 report intermittent connectivity to the server farm. The network uses Rapid PVST+ as the spanning-tree protocol. The administrator examines the switch that is the root bridge for VLAN 10 and notices that one of the uplink interfaces to an access switch is in a blocking state. What is the most likely cause of this issue?

Accepted Answer

Check the spanning-tree priority on other switches to ensure the intended root bridge has the lowest priority for VLAN 10.. In Rapid PVST+, the root bridge for a VLAN should have all its ports in a forwarding state. If an uplink interface on the root bridge is blocking, it indicates that another switch is being elected as the root bridge for VLAN 10, likely because it has a lower spanning-tree priority. By checking and adjusting the priority on other switches, the administrator can ensure the intended switch becomes the root bridge, resolving the intermittent connectivity caused by suboptimal path selection.

Answer

Change the port type of Gi0/3 to trunk to allow multiple VLANs.

Answer

Configure spanning-tree portfast on Gi0/3 to speed up convergence.

Answer

Enable BPDU guard on Gi0/3 to prevent unauthorized switches from affecting the network.

Question 11

A user reports that their computer cannot access the network. The technician checks the computer's IP configuration and finds an APIPA address (169.254.x.x). The computer is connected to a switch port on VLAN 20. The DHCP server is located on VLAN 1. The technician then examines the router's interfaces using 'show ip interface brief' and sees that all interfaces shown are up/up. What should the technician do next?

Accepted Answer

Verify that the ip helper-address command is configured on the router's VLAN 20 interface.. The APIPA address (169.254.x.x) indicates the host failed to obtain a DHCP lease. Since the DHCP server is on VLAN 1 and the host is on VLAN 20, a DHCP relay (ip helper-address) must be configured on the router's VLAN 20 interface to forward DHCP broadcast messages to the server. The 'show ip interface brief' shows all interfaces are up/up, so the next logical step is to verify the relay configuration.

Answer

Check the DHCP server logs to see if it is receiving Discover messages.

Answer

Attempt to ping the DHCP server's IP address from the host's APIPA address.

Answer

Restart the DHCP service on the server and recheck the host.

Question 12

A network administrator at a large enterprise notices that the network monitoring system frequently generates false positive alerts for unusual traffic patterns during normal business hours. The administrator wants to reduce these false positives while still detecting genuine security threats. Which AI/ML concept would best address this requirement?

Accepted Answer

Implement an anomaly detection system that uses machine learning to establish baseline behavior and flag deviations.. Anomaly detection using machine learning establishes a dynamic baseline of normal network behavior, allowing the system to flag only significant deviations. This reduces false positives during normal business hours while still detecting genuine threats that deviate from the learned baseline, unlike static thresholds that trigger alerts on routine traffic variations.

Answer

Deploy a predictive analytics model to forecast future traffic volumes and adjust thresholds accordingly.

Answer

Apply intent-based networking to automatically enforce security policies based on high-level business intent.

Answer

Use deep packet inspection to examine all traffic and create static rules for known threats.

Question 13

Based on the exhibit, why are clients in VLAN 70 failing to resolve hostnames even though they can reach remote IP addresses?

Accepted Answer

The clients are missing valid DNS server information.. The strongest explanation is that the clients are missing valid DNS server information. In practical terms, successful reachability to remote IP addresses proves that Layer 3 forwarding is working. The failure occurs only when a hostname is used, which points to a naming service problem rather than a general connectivity problem. The DHCP scope shown provides an address and default gateway, but no DNS server option is defined.

This is a very realistic IP-services troubleshooting pattern because the network path works while application usability still fails.

Answer

The default gateway must be removed from the DHCP scope.

Answer

The clients must use PPP before DNS works.

Answer

The VLAN must be converted to the native VLAN on all trunks.

Question 14

Match each network service to its primary function.

Accepted Answer

DNS: Translates domain names to IP addresses. Each network service has a distinct primary function: DNS translates names to IPs, DHCP automates IP assignment, NTP synchronizes time, SNMP manages devices, FTP transfers files, and HTTP serves web content.

Answer

DNS: Assigns IP addresses dynamically to devices on a network

Answer

DNS: Synchronizes time across network devices

Answer

DNS: Manages and monitors network devices

Question 15

Match each HTTP method to its common REST API action.

Accepted Answer

GET - Retrieve data. GET retrieves data; POST creates; PUT replaces; PATCH partially updates; DELETE removes; OPTIONS queries available methods.

Answer

GET - Create data

Answer

POST - Retrieve data

Answer

PUT - Partially update data

CCNA 200-301 v2 200-301 practice test

Three ways to study

Study 200-301 by domain

Study 200-301 by topic

Network Infrastructure and Connectivity practice questions

Switching and Network Access practice questions

IP Routing practice questions

Network Services and Security practice questions

AI and Network Operations practice questions

CCNA subnetting practice questions

CCNA OSPF practice questions

CCNA VLAN practice questions

CCNA STP practice questions

CCNA EtherChannel practice questions

CCNA ACL practice questions

CCNA NAT practice questions

Top 200-301 questions

CCNA 200-301 v2 practice questions

How to use these 200-301 questions

Quick answer