CCNA Network Services and Security Practice Question
Network Topology
You are connected to R1, a multilayer switch acting as a DNS forwarder for two VLANs. Users on VLAN 10 report that they cannot resolve 'files.example.com' while VLAN 20 works fine. The DNS server 198.51.100.53 is reachable but returns SERVFAIL for queries from subnet 192.168.10.0/24, while server 203.0.113.53 responds correctly for both VLANs. Diagnose and fix the DNS resolution issue using nslookup and dig, then adjust the IOS-XE configuration to ensure proper name resolution. Choose the best fix that permanently resolves the problem.
⚠ Common exam trap
Do not confuse a reachable DNS server with a functional one. SERVFAIL means the server is responding but cannot resolve the query. The solution is to remove the faulty server, not reorder or add static entries.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Remove the faulty primary DNS server using 'no ip name-server 198.51.100.53' and keep the working secondary server 203.0.113.53.
The faulty DNS server 198.51.100.53 returns SERVFAIL for the A record query, indicating a misconfiguration or missing record on that server. Although reordering (Option C) would allow resolution to work by querying the functional server first, it is not the optimal fix because the broken server remains in the list and could still be used if the primary times out or for future queries. The best practice is to completely remove the faulty server using 'no ip name-server 198.51.100.53'. Option B adds a static entry that only helps one domain and does not address the root cause. Option D would make the router use only the broken server, worsening the problem.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Remove the faulty primary DNS server using 'no ip name-server 198.51.100.53' and keep the working secondary server 203.0.113.53.
Why this is correct
The router's DNS resolver sends queries to configured name servers in order. Since 198.51.100.53 returns SERVFAIL (a definitive failure response), the router treats the query as failed and does not fall back to the secondary server. By issuing "no ip name-server 198.51.100.53", the faulty server is removed from the configuration, leaving only 203.0.113.53, which successfully resolves names for VLAN 10. This addresses the root cause without affecting other VLANs that rely on the same DNS configuration.
- ✗
Add a static DNS entry for 'files.example.com' using 'ip host files.example.com 10.0.0.1' on R1.
Why it's wrong here
This is incorrect because the issue is with the DNS server, not a missing static entry. Adding a static entry would bypass DNS but does not fix the underlying server problem and is not a scalable solution.
- ✗
Change the DNS server order so that the working server is primary using 'ip name-server 203.0.113.53 198.51.100.53'.
Why it's wrong here
This is incorrect because simply reordering the servers does not fix the faulty server. The router will still query the primary server first, and if it returns SERVFAIL, the resolution fails. The faulty server should be removed entirely.
- ✗
Configure the router to use only the faulty server by removing the working server with 'no ip name-server 203.0.113.53'.
Why it's wrong here
Issuing "no ip name-server 203.0.113.53" would delete the only operational DNS server, leaving the router with just the faulty 198.51.100.53. Subsequent resolution attempts would still receive SERVFAIL from that remaining server, so VLAN 10 would remain broken. In fact, this makes the situation worse because the working server is no longer available as a fallback for any VLAN, and the router cannot resolve any hostnames using DNS.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Remove the faulty primary DNS server using 'no ip name-server 198.51.100.53' and keep the working secondary server 203.0.113.53.Correct answer▾
Why this is correct
The router's DNS resolver sends queries to configured name servers in order. Since 198.51.100.53 returns SERVFAIL (a definitive failure response), the router treats the query as failed and does not fall back to the secondary server. By issuing "no ip name-server 198.51.100.53", the faulty server is removed from the configuration, leaving only 203.0.113.53, which successfully resolves names for VLAN 10. This addresses the root cause without affecting other VLANs that rely on the same DNS configuration.
✗Add a static DNS entry for 'files.example.com' using 'ip host files.example.com 10.0.0.1' on R1.Wrong answer — click to see why▾
Why this is wrong here
The specific factual error: Static DNS entries are used for local hostname resolution, not for fixing a faulty DNS server. The problem is that the primary DNS server returns SERVFAIL, so the solution should address the server configuration.
Why candidates choose this
Candidates might think that adding a static entry is a quick fix for resolution failures, but this does not address the root cause and would not help with other domain queries.
✗Change the DNS server order so that the working server is primary using 'ip name-server 203.0.113.53 198.51.100.53'.Wrong answer — click to see why▾
Why this is wrong here
This only reorders the servers, keeping the broken server in the list. While it may work immediately, it is not the optimal fix because the faulty server remains and could be used if the primary fails or for other queries, and it does not remove the misconfigured source of delay or failure.
Why candidates choose this
Candidates may think that making the working server primary will solve the issue, but they overlook that the router still tries the faulty server first and may not fall back if the response is an error.
✗Configure the router to use only the faulty server by removing the working server with 'no ip name-server 203.0.113.53'.Wrong answer — click to see why▾
Why this is wrong here
The specific factual error: Removing the working server exacerbates the problem. The goal is to fix resolution, not break it further.
Why candidates choose this
Candidates might misinterpret the diagnostic output and think the faulty server is the correct one to keep, but this would cause complete resolution failure.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
Common DNS Record Types
| Record | Purpose | Example |
|---|---|---|
| A | IPv4 address mapping | example.com → 93.184.216.34 |
| AAAA | IPv6 address mapping | example.com → 2606:2800::1 |
| CNAME | Alias to another hostname | www → example.com |
| MX | Mail server for domain | example.com → mail.example.com (priority 10) |
| TXT | Text data (SPF, DKIM, verification) | v=spf1 include:_spf.example.com ~all |
| NS | Authoritative name servers | example.com NS ns1.example.com |
| PTR | Reverse DNS (IP → hostname) | 34.216.184.93.in-addr.arpa → example.com |
| SOA | Zone authority record | Primary NS, admin email, serial, TTL defaults |
Go deeper
Related to this question
Learn chapter
RA Guard — IPv6 First-Hop Security
Key term
DNS
DNS is the system that translates human-friendly domain names like example.com into machine-readable IP addresses so computers can find each other on a network.
Key term
Fully Qualified Domain Name
A Fully Qualified Domain Name is the complete and unambiguous website or server name that includes the host, domain, and top-level domain, leaving no room for guesswork.
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.