Cisco CCNA 200-301 Exam — Questions and Answers

Question 1: What Syslog facility and level combination does the Cisco IOS command 'logging trap warnings' configure?

Sends messages of severity 4 (Warning) and above to the syslog server (Correct answer)
Sends only severity 4 messages to the syslog server
Enables SNMP traps for warnings
Sends severity 5 and below to the syslog server

Correct answer: Sends messages of severity 4 (Warning) and above to the syslog server

'logging trap warnings' (level 4) sends severity 0 through 4 messages to the configured syslog server.

Question 2: A network administrator notices that a host can communicate within its own subnet but cannot reach remote networks. Which OSI layer device is most likely misconfigured?

Hub (Layer 1)
Router (Layer 3) (Correct answer)
Firewall (Layer 7)
Switch (Layer 2)

Correct answer: Router (Layer 3)

Routers operate at Layer 3 and are responsible for forwarding traffic between different networks; a misconfigured default gateway or routing table would cause this symptom.

Question 3: Which automation approach is described as 'push-based' where a central controller sends configuration to devices?

Both Puppet and Chef
Ansible (Correct answer)
Puppet
Chef

Correct answer: Ansible

Ansible uses a push model where the control node actively pushes configuration to managed devices over SSH.

Question 4: When comparing JSON and XML for API data exchange, which statement is accurate?

JSON is generally more human-readable and less verbose than XML (Correct answer)
JSON uses tags like <key> and </key> to structure data
XML is the only format supported by REST APIs
XML is lighter weight and easier to parse than JSON

Correct answer: JSON is generally more human-readable and less verbose than XML

JSON uses key-value pairs with less syntactic overhead than XML's opening/closing tags, making it more concise and readable.

Question 5: What is the effect of configuring 'ip ospf priority 0' on a router interface?

The router becomes the DR for that segment
The router is ineligible to become DR or BDR on that segment (Correct answer)
The router's OSPF cost is set to zero
OSPF is disabled on that interface

Correct answer: The router is ineligible to become DR or BDR on that segment

An OSPF priority of 0 makes the router ineligible for DR/BDR election on that network segment.

Question 6: True/False: On Ethernet technology, CSMA/CD mechanisms prevent transmission at the same time.

B) True (Correct answer)
A) False

Correct answer: B) True

CSMA/CD (Carrier Sense Multiple Access with Collision Detection) is a media access control method used in half-duplex Ethernet networks. It ensures that devices listen for ongoing transmissions before sending data and detect collisions if they occur. Upon detecting a collision, devices stop transmitting, wait a random period, and then retransmit, effectively preventing simultaneous transmissions and managing shared media access.

Question 7: Which WLAN deployment mode should be used when an AP needs to detect rogue devices and monitor RF activity without serving any clients?

FlexConnect mode
Local mode
Monitor mode (Correct answer)
Sniffer mode

Correct answer: Monitor mode

In monitor mode, the AP dedicates all its resources to scanning channels for rogues, interference, and security threats without providing client access.

Question 8: What is the STP path cost for a 1 Gbps link using the IEEE 802.1D-2004 revised cost values?

19
100
2000
4 (Correct answer)

Correct answer: 4

The revised IEEE 802.1D-2004 cost for a 1 Gbps link is 4, while the original 1998 standard assigned it a cost of 4 as well (but 10 Gbps=2, 100 Mbps=19).

Question 9: Which Spanning Tree Protocol port state forwards data frames and learns MAC addresses?

Blocking
Forwarding (Correct answer)
Listening
Learning

Correct answer: Forwarding

Only the Forwarding state allows a port to both learn MAC addresses and forward data frames.

Question 10: Which of the following correctly describes a broadcast domain in a switched network?

All devices sharing a single collision domain
All devices in the same VLAN (Correct answer)
All devices connected to the same switch port
All devices separated by a router interface

Correct answer: All devices in the same VLAN

All devices in the same VLAN share one broadcast domain; switches by default do not contain broadcasts between VLANs.

Question 11: What are the two main types of site-to-site VPNs?

Included Based VPN
Excluded Based VPN
Intranet Based VPN (Correct answer)
Internet Based VPN
Extranet Based VPN (Correct answer)

Correct answer: Intranet Based VPN

Site-to-site VPNs connect entire networks, rather than individual hosts, over a public network. Intranet-based VPNs connect different sites belonging to the *same* organization, allowing secure access to internal resources. Extranet-based VPNs connect different sites of *different* organizations, such as business partners or suppliers, enabling secure collaboration between them.

Question 12: Which of the following protocols is a Distance Vector Protocol?

BGP
RIP (Correct answer)
EIGRP
OSPF

Correct answer: RIP

Distance Vector routing protocols determine the best path to a destination based on the 'distance' (e.g., hop count) and the 'direction' (vector) to reach it, typically relying on information from directly connected neighbors. RIP (Routing Information Protocol) is a classic example of a distance vector protocol, using hop count as its primary metric and periodically exchanging full routing tables with its neighbors.

Question 13: Which STP enhancement prevents a port from becoming a designated port if it stops receiving BPDUs, protecting against unidirectional link failures?

Root Guard
PortFast
Loop Guard (Correct answer)
BPDU Guard

Correct answer: Loop Guard

Loop Guard places a port in a loop-inconsistent blocking state if BPDUs stop arriving, preventing it from incorrectly transitioning to Forwarding.

Question 14: True/False: The Internet Protocol (IP) is a connectionless protocol.

B) True (Correct answer)
A) False

Correct answer: B) True

The Internet Protocol (IP) is a connectionless protocol, meaning that each packet is treated independently without any prior connection establishment or guarantee of delivery. IP focuses on efficient, best-effort delivery of individual datagrams across networks. Reliability, ordering, and error checking are handled by higher-layer protocols like TCP.

Question 15: A VLAN ACL (VACL) differs from a routed ACL because it can filter traffic that is:

Only inbound on Layer 3 interfaces
Only destined for the router CPU
Both routed and bridged within the same VLAN (Correct answer)
Only routed between VLANs

Correct answer: Both routed and bridged within the same VLAN

VACLs apply to all traffic within a VLAN, including Layer 2 bridged traffic that never passes through a routed interface.

Question 16: Which frame type does a switch forward only out the single port associated with the destination MAC address?

Broadcast
Known unicast (Correct answer)
Multicast
Unknown unicast

Correct answer: Known unicast

When the destination MAC is found in the MAC address table (known unicast), the switch forwards the frame only to the specific port associated with that address.

Question 17: Which part of a MAC address identifies the manufacturer of the network interface card?

Last byte only
First byte only
Last 3 bytes
First 3 bytes (OUI) (Correct answer)

Correct answer: First 3 bytes (OUI)

The first 3 bytes of a MAC address form the Organizationally Unique Identifier (OUI), assigned by IEEE to the manufacturer.

Question 18: Which wildcard mask would match only the host 192.168.10.5?

0.0.0.255
255.255.255.0
0.0.255.255
0.0.0.0 (Correct answer)

Correct answer: 0.0.0.0

A wildcard mask of 0.0.0.0 means all bits must match, which specifies a single host.

Question 19: What is a webhook in the context of network automation?

An HTTP callback triggered by an event to notify another system (Correct answer)
A type of SSH key used for device authentication
A CLI command for Cisco IOS automation
A Python module for network scanning

Correct answer: An HTTP callback triggered by an event to notify another system

A webhook is an HTTP POST callback sent to a URL when a specific event occurs, enabling event-driven automation.

Question 20: Which protocol maps IP addresses to MAC addresses and operates at the boundary between OSI Layers 2 and 3?

RARP
ARP (Correct answer)
DNS
ICMP

Correct answer: ARP

ARP (Address Resolution Protocol) resolves known IP addresses to MAC addresses, bridging the Network (Layer 3) and Data Link (Layer 2) layers.

Question 21: Which command enables port security on a Cisco switch interface and sets the maximum number of MAC addresses to 2?

ip port-security maximum 2
switchport security limit 2
switchport port-security maximum 2 (Correct answer)
port-security max-addresses 2

Correct answer: switchport port-security maximum 2

After enabling 'switchport port-security', the 'switchport port-security maximum 2' command limits the port to two learned MAC addresses.

Question 22: What is the role of an API key in REST API authentication?

It identifies and authenticates the client making the API request (Correct answer)
It defines the rate limit for responses
It encrypts the API payload
It specifies the API version to use

Correct answer: It identifies and authenticates the client making the API request

An API key is a secret token passed in requests to identify and authenticate the calling application or user.

Question 23: Which OSPF packet type is used to discover and maintain neighbor relationships?

DBD (Database Description)
LSR (Link State Request)
LSU (Link State Update)
Hello (Correct answer)

Correct answer: Hello

Hello packets are sent periodically to discover neighbors and maintain adjacencies by confirming the neighbor is still reachable.

Question 24: A switch administrator wants to ensure a specific switch always becomes the root bridge for VLAN 1. Which command achieves this?

spanning-tree vlan 1 root primary (Correct answer)
spanning-tree vlan 1 priority 4096
spanning-tree mode rapid-pvst
spanning-tree vlan 1 cost 1

Correct answer: spanning-tree vlan 1 root primary

The 'spanning-tree vlan 1 root primary' command sets the bridge priority to ensure this switch wins the root bridge election.

Question 25: Which command hardens a Cisco IOS device by encrypting all plaintext passwords currently in the running configuration?

crypto password enable
enable secret level 5
service password-encryption (Correct answer)
password encrypt all

Correct answer: service password-encryption

'service password-encryption' applies a weak reversible Type 7 encryption to plaintext passwords in the configuration.

Question 26: Which command configures the LACP port priority on an interface to influence which links are selected as active in a bundle?

spanning-tree port-priority 128
channel-group priority 100
port-channel priority 100
lacp port-priority 100 (Correct answer)

Correct answer: lacp port-priority 100

'lacp port-priority' sets the priority value on an interface; lower values are preferred, making that port more likely to be selected as an active link.

Question 27: What is a primary characteristic of an autonomous WLAN architecture?

Each access point is individually configured and manages its own settings, security, and client associations. (Correct answer)
It relies on a cloud-based dashboard for all configuration and firmware updates.
It requires a dedicated Wireless LAN Controller (WLC) on the local network.
All client traffic is tunneled back to a central appliance using the CAPWAP protocol.

Correct answer: Each access point is individually configured and manages its own settings, security, and client associations.

An autonomous AP is a self-contained, standalone device. Each AP is configured and managed individually, typically via a CLI or web GUI. It handles all functions locally, including user authentication, security policies, and RF management, without the need for a WLC. [1, 2, 5] This architecture is simple for small deployments but becomes difficult to manage at scale. [2, 15]

Question 28: What is the purpose of the SNMP 'trap' message type compared to an SNMP 'inform'?

Both are identical in function
Traps are unacknowledged; informs require acknowledgment from the manager (Correct answer)
Informs are only used in SNMPv1
Traps require acknowledgment; informs are unacknowledged

Correct answer: Traps are unacknowledged; informs require acknowledgment from the manager

SNMP traps are sent once with no acknowledgment, while informs are retransmitted until the manager acknowledges receipt.

Question 29: What is the minimum RSA key size recommended when generating SSH keys on a Cisco IOS device for SSHv2?

512 bits
2048 bits (Correct answer)
1024 bits
768 bits

Correct answer: 2048 bits

SSHv2 requires a minimum RSA key modulus of 768 bits, but Cisco and industry best practices recommend at least 2048 bits for current deployments.

Question 30: An OSPFv2 router has the following loopback interfaces: Lo0 = 1.1.1.1/32, Lo1 = 2.2.2.2/32. No manual router-id is configured. What is the router ID?

2.2.2.2 (Correct answer)
The highest active physical interface IP
1.1.1.1
The lowest active physical interface IP

Correct answer: 2.2.2.2

When no manual router ID is set, OSPF selects the highest IP address among all loopback interfaces.

Question 31: Which IP SLA probe type can measure round-trip time (RTT) to a remote Cisco device using ICMP echo?

icmp-echo (Correct answer)
udp-jitter
http
tcp-connect

Correct answer: icmp-echo

IP SLA icmp-echo probes send ICMP echo requests to a target IP and measure round-trip time for availability monitoring.

Question 32: Which type of OSPF LSA is generated by an ABR to describe routes in other areas?

Type 2 - Network LSA
Type 3 - Summary LSA (Correct answer)
Type 5 - AS External LSA
Type 1 - Router LSA

Correct answer: Type 3 - Summary LSA

ABRs generate Type 3 Summary LSAs to advertise networks from one OSPF area into another, summarizing inter-area routing information.

Question 33: A switch receives a frame on its Fa0/1 interface. The source MAC address is 0000.aaaa.aaaa and the destination MAC address is 0000.bbbb.bbbb. The switch has no entry for 0000.bbbb.bbbb in its MAC address table. What action will the switch take?

Forward the frame out of all interfaces except the originating port, Fa0/1. (Correct answer)
Forward the frame out of all interfaces.
Send an ARP request to find the location of the destination MAC address.
Drop the frame.

Correct answer: Forward the frame out of all interfaces except the originating port, Fa0/1.

When a switch receives a unicast frame with a destination MAC address that is not in its MAC address table, it floods the frame to all ports within the same VLAN except for the port on which it was received. This process is known as unknown unicast flooding. The switch also learns the source MAC address (0000.aaaa.aaaa) and associates it with the incoming port (Fa0/1).

Question 34: What does the 'established' keyword do in an extended ACL?

Denies all new TCP connections
Permits all TCP traffic
Permits TCP packets with ACK or RST bits set (Correct answer)
Matches only UDP traffic

Correct answer: Permits TCP packets with ACK or RST bits set

The 'established' keyword matches TCP segments that have the ACK or RST bit set, indicating an existing session.

Question 35: What is the maximum number of subnets created when borrowing 4 bits from the host portion of a classful Class C network?

8
14
30
16 (Correct answer)

Correct answer: 16

Borrowing 4 bits provides 2^4 = 16 subnets (all 16 are usable with classless/CIDR addressing).

Question 36: A router interface is configured with 'ipv6 address 2001:DB8:A:1::/64 eui-64'. What does the eui-64 keyword cause the router to do?

Use a randomly generated interface ID
Derive the interface ID from the interface's MAC address using EUI-64 (Correct answer)
Configure only the prefix without an interface ID
Use DHCPv6 to obtain the full address

Correct answer: Derive the interface ID from the interface's MAC address using EUI-64

The eui-64 keyword instructs the router to generate the 64-bit interface ID automatically from the interface's MAC address using the EUI-64 method.

Question 37: What does the STP BPDU Guard feature do when it detects a BPDU on a PortFast-enabled port?

It blocks the port and notifies the root bridge
It immediately puts the port into err-disabled state (Correct answer)
It disables PortFast on that port and runs normal STP
It forwards the BPDU to the root bridge for analysis

Correct answer: It immediately puts the port into err-disabled state

BPDU Guard places the port in err-disabled state when a BPDU is received, protecting the network from unauthorized switches.

Question 38: What is the function of the Priority Code Point (PCP) field in the 802.1Q tag?

It identifies the VLAN number
It specifies the Class of Service (CoS) priority for QoS (Correct answer)
It signals that the frame is a native VLAN frame
It indicates whether the frame is eligible to be dropped

Correct answer: It specifies the Class of Service (CoS) priority for QoS

The 3-bit PCP field carries Layer 2 Class of Service markings used for QoS prioritization.

Question 39: Which statement about NAT and IPv6 is most accurate from a CCNA perspective?

NAT64 is required for all IPv6 networks
IPv6 was designed with sufficient address space to eliminate the need for NAT (Correct answer)
NAT is mandatory in dual-stack environments
IPv6 uses the same NAT implementation as IPv4

Correct answer: IPv6 was designed with sufficient address space to eliminate the need for NAT

IPv6's 128-bit address space provides enough unique addresses for every device globally, removing the address-conservation motivation that drove widespread IPv4 NAT adoption.

Question 40: A Cisco router has the following entry: 'O IA 172.16.5.0/24 [110/30] via 10.1.1.1'. What does 'IA' indicate?

The route is an OSPF external Type 1 route
The route was imported from an autonomous system outside OSPF
The route was learned via an internal OSPF adjacency on the same router
The route is an inter-area OSPF route learned from an ABR (Correct answer)

Correct answer: The route is an inter-area OSPF route learned from an ABR

The 'IA' tag in the routing table identifies OSPF inter-area routes that were generated by an Area Border Router from a different OSPF area.

Question 41: What is the maximum number of physical links that can be bundled in a single EtherChannel on a Cisco switch?

8 (Correct answer)
16
4
6

Correct answer: 8

A Cisco EtherChannel supports up to 8 active physical links bundled into a single logical port-channel interface.

Question 42: Which 802.11 service set type allows two wireless clients to communicate directly without an AP?

ESS (Extended Service Set)
DSS (Distribution Service Set)
BSS (Basic Service Set)
IBSS (Independent Basic Service Set) (Correct answer)

Correct answer: IBSS (Independent Basic Service Set)

An IBSS (Independent BSS), also called an ad-hoc network, allows devices to communicate peer-to-peer without requiring an access point.

Question 43: What is the purpose of configuring an 'exec-timeout' on Cisco VTY lines?

Automatically disconnects idle management sessions after a specified time (Correct answer)
Sets the maximum session login time
Applies an inactivity ACL to VTY lines
Limits the number of concurrent VTY sessions

Correct answer: Automatically disconnects idle management sessions after a specified time

'exec-timeout <minutes> <seconds>' closes inactive VTY sessions automatically, reducing the risk of unauthorized access to unattended sessions.

Question 44: Which of the following correctly identifies the IPv6 address type FF05::2?

Link-local multicast — all routers on local link
Unique local — used within an organization
Global unicast — routable on the Internet
Site-local multicast — all routers within the site (Correct answer)

Correct answer: Site-local multicast — all routers within the site

FF05::2 is a site-scoped multicast address targeting all routers within the site (scope value 5 = site-local).

Question 45: A network engineer is developing a Python script to make REST API calls to a Cisco Meraki dashboard to automate the creation of new wireless networks. Which standard Python library is most commonly used to handle the HTTP requests and responses for this task?

Requests (Correct answer)
Paramiko
Netmiko
Scapy

Correct answer: Requests

The 'requests' library is the de facto standard in Python for making HTTP requests to APIs. [2, 11] It simplifies the process of sending GET, POST, PUT, and other HTTP methods. [19] Paramiko and Netmiko are primarily used for automating interactions over SSH, not for web-based REST APIs. [11, 17] Scapy is a library used for packet crafting and analysis at a lower level of the network stack.

Question 46: When a host sends data using TCP, at which OSI layer is the segment header added?

Layer 3 - Network
Layer 2 - Data Link
Layer 4 - Transport (Correct answer)
Layer 5 - Session

Correct answer: Layer 4 - Transport

TCP is a Transport layer (Layer 4) protocol, and the TCP header (containing source/destination ports, sequence numbers, etc.) is added at Layer 4.

Question 47: Which SNMP version introduced authentication and encryption for secure management communications?

SNMPv2c
SNMPv2p
SNMPv1
SNMPv3 (Correct answer)

Correct answer: SNMPv3

SNMPv3 added user-based security with MD5/SHA authentication and DES/AES encryption, replacing the community-string model.

Question 48: A network has three switches with default bridge priorities. Switch A has MAC 00:00:00:00:00:01, Switch B has MAC 00:00:00:00:00:02, and Switch C has MAC 00:00:00:00:00:03. Which switch becomes the root bridge?

They rotate the root bridge role
Switch C
Switch A (Correct answer)
Switch B

Correct answer: Switch A

With equal priorities, the switch with the lowest MAC address wins; 00:00:00:00:00:01 is the lowest, making Switch A the root bridge.

Question 49: Which attack does DHCP snooping protect against on a switched network?

VLAN hopping attacks
ARP spoofing attacks
Rogue DHCP server attacks (Correct answer)
MAC flooding attacks

Correct answer: Rogue DHCP server attacks

DHCP snooping prevents rogue DHCP servers by only forwarding DHCP offers from trusted (uplink) ports, blocking unauthorized IP assignments.

Question 50: What is the maximum number of hops allowed in an MST (Multiple Spanning Tree) region before a BPDU is discarded?

15
20 (Correct answer)
7
32

Correct answer: 20

MST uses a max hops field (default 20) instead of the traditional max age timer to limit BPDU propagation within a region.

Question 51: NAT is often criticized for which networking principle violation?

It prevents VLAN tagging on trunks
It violates end-to-end connectivity by modifying IP headers in transit (Correct answer)
It breaks OSPF neighbor adjacency by default
It increases routing table size

Correct answer: It violates end-to-end connectivity by modifying IP headers in transit

NAT violates the end-to-end principle of IP networking because it modifies source/destination addresses in packet headers, breaking transparency between endpoints.

Question 52: What happens when a packet matches a permit statement in an ACL?

The remaining ACL entries are still checked
The packet is dropped and logged
The packet is forwarded and no further ACL entries are checked (Correct answer)
The packet is sent to the CPU for inspection

Correct answer: The packet is forwarded and no further ACL entries are checked

Once a packet matches any ACL statement (permit or deny), processing stops and the action is taken immediately.

Question 53: What is the well-known UDP port number used by SNMP agents to receive requests from an SNMP manager?

123
162
514
161 (Correct answer)

Correct answer: 161

SNMP agents listen on UDP port 161 for polling requests sent by the SNMP manager.

Question 54: Which OSPF timer must match between two routers for them to become neighbors?

SPF delay timer
Dead interval (Correct answer)
LSA retransmit interval
LSA refresh timer

Correct answer: Dead interval

Both the Hello interval and Dead interval must match between OSPF neighbors; mismatched Dead intervals prevent adjacency formation.

Question 55: Where should an extended ACL be placed for optimal performance?

As close to the source as possible (Correct answer)
On the core switch only
As close to the destination as possible
On the default gateway router

Correct answer: As close to the source as possible

Extended ACLs should be placed close to the source to stop unwanted traffic early and reduce unnecessary network load.

Question 56: What is the default lease time for a DHCP address assignment on a Cisco IOS router if not explicitly configured?

1 day (Correct answer)
7 days
8 hours
12 hours

Correct answer: 1 day

Cisco IOS DHCP server defaults to a 1-day (24-hour) lease time when no explicit lease duration is configured.

Question 57: Which protocol encrypts the entire management session between an administrator and a Cisco device?

TFTP
SSH (Correct answer)
Telnet
SNMP v2c

Correct answer: SSH

SSH (Secure Shell) encrypts all traffic between the client and the network device, while Telnet transmits data in plaintext.

Question 58: A voice VLAN is configured on an access port with `switchport voice vlan 50`. How does the switch handle voice traffic on that port?

Voice traffic is tagged with VLAN 50 and data traffic remains untagged on the access VLAN (Correct answer)
Voice traffic is untagged and data traffic uses VLAN 50
All traffic is tagged with VLAN 50
The port becomes a trunk and carries both VLANs tagged

Correct answer: Voice traffic is tagged with VLAN 50 and data traffic remains untagged on the access VLAN

With a voice VLAN configured, the IP phone sends tagged voice frames on VLAN 50 while the PC behind it sends untagged data on the access VLAN.

Question 59: What happens to EIGRP routes when the variance command is set to 2?

Routes with a metric up to twice the successor's FD are eligible for unequal-cost load balancing (Correct answer)
Only routes with a metric exactly twice the successor's FD are added to the routing table
The EIGRP hello interval is doubled
Routes are redistributed into OSPF with a seed metric of 2

Correct answer: Routes with a metric up to twice the successor's FD are eligible for unequal-cost load balancing

Setting variance to 2 allows EIGRP to install feasible successor routes whose FD is up to 2x the successor's FD for unequal-cost load balancing.

Question 60: Instead of SNMP, SDN uses ____ as a network configuration management protocol.

SMTP
Rest
Netconf (Correct answer)
Open Flow

Correct answer: Netconf

SDN (Software-Defined Networking) centralizes network control and management, requiring programmatic configuration capabilities. While SNMP is primarily for monitoring, NETCONF (Network Configuration Protocol) is an XML-based protocol specifically designed for configuring network devices. It offers robust, programmatic configuration management, making it a suitable protocol for the automated and centralized control plane of SDN architectures.

Question 61: Which STP variant is defined by IEEE 802.1w and provides faster convergence than 802.1D?

MSTP
RSTP (Correct answer)
VSTP
PVST+

Correct answer: RSTP

Rapid Spanning Tree Protocol (RSTP), defined in IEEE 802.1w, significantly reduces convergence time compared to the original STP.

Question 62: A network administrator configures a Cisco router to translate multiple private IP addresses from the 192.168.10.0/24 network to a single public IP address on its GigabitEthernet0/0 interface. Which command correctly configures this Port Address Translation (PAT)?

ip nat pool MY_POOL 203.0.113.5 203.0.113.5 netmask 255.255.255.0
ip nat inside source static 192.168.10.10 203.0.113.5
ip nat inside source list 1 pool MY_POOL
ip nat inside source list 1 interface GigabitEthernet0/0 overload (Correct answer)

Correct answer: ip nat inside source list 1 interface GigabitEthernet0/0 overload

To configure PAT, also known as NAT Overload, the 'overload' keyword is essential. This keyword allows many internal (inside local) addresses to be translated to a single public (inside global) address by tracking unique port numbers for each session. The command `ip nat inside source list 1 interface GigabitEthernet0/0 overload` correctly ties an access list (list 1) to the public interface's IP address and enables the overload functionality.

Question 63: Which of the following correctly identifies the Protocol Data Unit (PDU) at the OSI Transport Layer?

Packet
Segment (Correct answer)
Frame
Bits

Correct answer: Segment

The Protocol Data Unit (PDU) at the Transport Layer (Layer 4) is called a segment when using TCP, or a datagram when using UDP. Packets are the PDU for the Network Layer (Layer 3), Frames are for the Data Link Layer (Layer 2), and Bits are for the Physical Layer (Layer 1).

Question 64: A network administrator wants to restrict Telnet and SSH access to a router's virtual terminal (VTY) lines, allowing access only from the management workstation with the IP address 10.0.0.99. Which set of commands correctly accomplishes this?

router(config)# access-list 101 permit ip host 10.0.0.99 any router(config)# line vty 0 15 router(config-line)# ip access-group 101 in
router(config)# access-list 1 permit host 10.0.0.99 router(config)# line vty 0 15 router(config-line)# access-class 1 in (Correct answer)
router(config)# access-list 1 permit host 10.0.0.99 router(config)# interface vty 0 15 router(config-if)# ip access-group 1 in
router(config)# access-list 1 permit any router(config)# line vty 0 15 router(config-line)# access-class 10.0.0.99 in

Correct answer: router(config)# access-list 1 permit host 10.0.0.99 router(config)# line vty 0 15 router(config-line)# access-class 1 in

To apply an access control list to VTY lines to filter management access (like Telnet or SSH), the `access-class` command must be used under `line vty` configuration mode. The `ip access-group` command is used for applying ACLs to physical or logical Layer 3 interfaces, not VTY lines.

Question 65: Which NetFlow command on a Cisco router exports flow data to a collector at 10.0.0.50 on UDP port 9996?

ip flow-export destination 10.0.0.50 9996 (Correct answer)
netflow export 10.0.0.50 9996
ip flow destination 10.0.0.50 port 9996
ip netflow collector 10.0.0.50 9996

Correct answer: ip flow-export destination 10.0.0.50 9996

The command 'ip flow-export destination <ip> <port>' configures the router to send NetFlow records to the specified collector.

Question 66: Which Cisco platform provides a REST API for managing network infrastructure through a centralized controller?

Cisco AnyConnect
Cisco IOS-XE
Cisco ISE
Cisco DNA Center (Correct answer)

Correct answer: Cisco DNA Center

Cisco DNA Center (now Cisco Catalyst Center) exposes northbound REST APIs for network intent-based automation and management.

Question 67: What is the purpose of the STP Topology Change Notification (TCN) BPDU?

To block redundant ports in the network
To inform other switches that the Layer 2 topology has changed so MAC tables can be flushed (Correct answer)
To elect a new root bridge after a link failure
To synchronize VLAN databases across switches

Correct answer: To inform other switches that the Layer 2 topology has changed so MAC tables can be flushed

TCN BPDUs signal topology changes so that switches reduce their MAC address aging timer to quickly flush stale entries.

Question 68: What is the default OSPF Hello interval on a broadcast multi-access network?

30 seconds
10 seconds (Correct answer)
40 seconds
60 seconds

Correct answer: 10 seconds

The default Hello interval on broadcast multi-access networks (like Ethernet) is 10 seconds.

Question 69: Which Ansible component describes the desired state of managed devices?

Role
Inventory
Playbook (Correct answer)
Module

Correct answer: Playbook

An Ansible playbook is a YAML file that defines the desired configuration state for managed hosts.

Question 70: A network administrator issues the `passive-interface default` command under the OSPF process. What is the effect of this command?

It sets the OSPF cost to the default value on all interfaces.
It enables OSPF on all interfaces using default timers.
It prevents all interfaces from being advertised in OSPF.
It stops OSPF from forming adjacencies on any interface. (Correct answer)

Correct answer: It stops OSPF from forming adjacencies on any interface.

The `passive-interface default` command globally prevents the router from sending or receiving OSPF Hello packets on all interfaces by default. This stops the formation of neighbor adjacencies. To form an adjacency on a specific interface, the administrator must then use the `no passive-interface <interface-name>` command. The networks on passive interfaces are still advertised into OSPF.

Question 71: Which command configures a Cisco router as a DHCP server and excludes the first 10 addresses of the 192.168.1.0/24 pool?

ip dhcp no-assign 192.168.1.1 192.168.1.10
no ip dhcp address 192.168.1.1 192.168.1.10
ip dhcp pool exclude 192.168.1.1 192.168.1.10
ip dhcp excluded-address 192.168.1.1 192.168.1.10 (Correct answer)

Correct answer: ip dhcp excluded-address 192.168.1.1 192.168.1.10

The 'ip dhcp excluded-address' command prevents specified IP addresses from being assigned by the DHCP server.

Question 72: Which layer of the OSI model does a switch primarily operate at?

Layer 4
Layer 2 (Correct answer)
Layer 1
Layer 3

Correct answer: Layer 2

Switches operate at Layer 2 (Data Link) and use MAC addresses to forward frames within a network.

Question 73: How many layers does the TCP/IP model have compared to the OSI model?

The TCP/IP model has 3 layers; OSI has 5
The TCP/IP model has 4 layers; OSI has 7 (Correct answer)
Both models have 7 layers
The TCP/IP model has 5 layers; OSI has 7

Correct answer: The TCP/IP model has 4 layers; OSI has 7

The TCP/IP model has 4 layers (Application, Transport, Internet, Network Access), while the OSI model has 7 layers.

Question 74: What command is used to turn on the Cisco router interface?

no shutdown (Correct answer)
activate
run
shutdown

Correct answer: no shutdown

In Cisco IOS, network interfaces are often administratively shut down by default or can be manually disabled. The `no shutdown` command is used within the interface configuration mode to bring an interface up and enable it to send and receive traffic. This command is essential for activating a router's physical or logical connections.

Question 75: When using Python's 'requests' library to call a HTTPS REST API that uses a self-signed certificate, what parameter disables SSL verification (for lab/testing only)?

cert=None
ssl=False
tls_check=False
verify=False (Correct answer)

Correct answer: verify=False

Passing verify=False to requests.get() or requests.post() disables SSL certificate verification, used only in lab environments.

Question 76: Which of the following is the correct compressed version of the IPv6 address FE80:0000:0000:0000:02AA:00FF:FE9A:4CA2?

FE80::02AA:00FF:FE9A:4CA2
FE80::2AA:FF:FE9A:4CA2 (Correct answer)
FE80:0:0:0:2AA:FF:FE9A:4CA2
FE8::2AA:FF:FE9A:4CA2

Correct answer: FE80::2AA:FF:FE9A:4CA2

IPv6 compression rules allow for two main actions: omitting leading zeros within each hextet, and replacing one (and only one) contiguous block of all-zero hextets with a double colon (::). In FE80:0000:0000:0000:02AA:00FF:FE9A:4CA2, the three consecutive '0000' hextets can be replaced by '::', and the leading zeros in '02AA' and '00FF' can be removed, resulting in FE80::2AA:FF:FE9A:4CA2.

Question 77: Which encapsulation type must both ends of a trunk link agree upon for the trunk to function?

802.1Q
No encapsulation is required on Cisco switches
ISL
Either 802.1Q or ISL, but they must match (Correct answer)

Correct answer: Either 802.1Q or ISL, but they must match

Both ends of a trunk must use the same encapsulation (802.1Q or ISL); a mismatch prevents the trunk from forming.

Question 78: What is the purpose of the `switchport trunk native vlan 99` command?

Sets VLAN 99 as the untagged VLAN on the trunk (Correct answer)
Makes VLAN 99 the management VLAN
Removes all other VLANs from the trunk
Allows only VLAN 99 on the trunk

Correct answer: Sets VLAN 99 as the untagged VLAN on the trunk

This command changes the native VLAN on the trunk to VLAN 99, so untagged frames are associated with VLAN 99.

Question 79: What does the 'ip helper-address' command accomplish on a Cisco router interface?

Assigns a static IP address to a DHCP client
Creates a DHCP pool on the router
Enables DHCP snooping on the interface
Forwards UDP broadcasts (including DHCP) to a specified server IP (Correct answer)

Correct answer: Forwards UDP broadcasts (including DHCP) to a specified server IP

The 'ip helper-address' command relays UDP broadcast packets (including DHCP) from clients to a unicast server address on another subnet.

Question 80: What is the default sequence number increment when adding ACL entries without specifying a sequence number?

10 (Correct answer)
5
100
1

Correct answer: 10

Cisco IOS automatically assigns sequence numbers in increments of 10 (10, 20, 30…) for ACL entries.

Question 81: How many ACLs can be applied per interface per direction?

Unlimited
Four
One (Correct answer)
Two (one inbound, one outbound)

Correct answer: One

Cisco IOS allows only one ACL per interface per direction (one inbound and one outbound).

Question 82: An access port is assigned to a VLAN that does not exist in the switch's VLAN database. What is the result?

The port operates in VLAN 1 instead
The switch automatically creates the VLAN
The port is placed in an inactive state (Correct answer)
The port floods traffic to all VLANs

Correct answer: The port is placed in an inactive state

If a port is assigned to a non-existent VLAN, it becomes inactive and does not pass traffic until the VLAN is created.

Question 83: A switch receives a frame with a destination MAC address not in its MAC address table. What does it do?

Drops the frame
Buffers the frame until the address is learned
Sends the frame back to the source
Floods the frame out all ports except the incoming port (Correct answer)

Correct answer: Floods the frame out all ports except the incoming port

When a switch receives a frame with an unknown unicast destination, it floods the frame out all ports except the one it arrived on.

Question 84: During the data encapsulation process, which layer of the OSI model is responsible for adding a header that contains source and destination MAC addresses?

Physical Layer
Network Layer
Transport Layer
Data Link Layer (Correct answer)

Correct answer: Data Link Layer

The Data Link Layer (Layer 2) is responsible for creating frames. During encapsulation, it adds a header containing the source and destination MAC (physical) addresses to the packet received from the Network Layer. This framing is essential for delivery on the local network segment.

Question 85: In a Cisco DNA Center architecture, which type of API is used by external applications and orchestration systems to communicate high-level, business-oriented requests or 'intent' to the controller?

Westbound API
Southbound API
Eastbound API
Northbound API (Correct answer)

Correct answer: Northbound API

Northbound APIs (NBIs) are used for communication between the SDN controller (like Cisco DNA Center) and the applications or orchestration layers above it. [23, 29] These APIs abstract the complexity of the network and allow administrators to define policies and intent. [13] Southbound APIs (SBIs), on the other hand, are used by the controller to communicate with the network devices themselves (e.g., switches and routers) using protocols like NETCONF, RESTCONF, or SNMP. [5, 23]

Question 86: Which command configures BPDU Guard globally on all PortFast-enabled ports on a Cisco switch?

spanning-tree guard bpdu
spanning-tree portfast bpduguard default (Correct answer)
interface range fa0/1-24 spanning-tree bpduguard enable
spanning-tree bpduguard enable

Correct answer: spanning-tree portfast bpduguard default

The global command 'spanning-tree portfast bpduguard default' enables BPDU Guard on all ports that have PortFast configured.

Question 87: The IEEE 802.1Q frame tag, used for identifying VLANs, is 4 bytes long and inserted into the Ethernet frame header. Which field within this tag is 12 bits long and specifies the VLAN membership of the frame?

Canonical Format Indicator (CFI)
Priority Code Point (PCP)
VLAN Identifier (VID) (Correct answer)
Tag Protocol Identifier (TPID)

Correct answer: VLAN Identifier (VID)

The 802.1Q tag contains four fields. The VLAN Identifier (VID) is a 12-bit field that specifies the VLAN to which the frame belongs. This 12-bit length allows for 4096 possible VLANs, with 4094 being usable.

Question 88: Which command verifies which ACLs are applied to a specific interface and their direction?

show access-lists
show running-config
show ip interface (Correct answer)
show ip access-lists

Correct answer: show ip interface

'show ip interface' displays the inbound and outbound ACLs applied to each interface.

Question 89: Which statement accurately describes a key characteristic of dynamic routing protocols like OSPF and EIGRP compared to static routing?

They are best suited for small, simple networks with predictable traffic paths.
They provide greater security because routes are not advertised over the network.
They reduce administrative overhead in large networks by automatically learning routes. (Correct answer)
They consume no router CPU or memory resources.

Correct answer: They reduce administrative overhead in large networks by automatically learning routes.

Dynamic routing protocols automatically discover remote networks and adapt to topology changes without manual intervention. This significantly reduces the administrative burden required to maintain routing tables in large or frequently changing networks, which is a major drawback of relying solely on static routes.

Question 90: What is the function of the 802.11 Probe Request frame?

Sent by a client to confirm successful association with an AP
Sent by a client to actively discover available wireless networks (Correct answer)
Sent by an AP to announce its presence on a channel
Sent by a WLC to verify AP connectivity

Correct answer: Sent by a client to actively discover available wireless networks

A Probe Request is sent by wireless clients to actively scan for available SSIDs, either broadcasting to find all networks or targeting a specific SSID.

Question 91: On a switch, what does the term 'asymmetric switching' refer to?

Forwarding frames using different methods per port
A switch that operates at both Layer 2 and Layer 3
Switching between ports that have different bandwidth speeds (Correct answer)
Using multiple MAC address tables for different VLANs

Correct answer: Switching between ports that have different bandwidth speeds

Asymmetric switching provides switched connections between ports of unequal bandwidth, such as between 100 Mbps and 1 Gbps ports.

Question 92: In a Cisco WLC environment, which interface type is used to manage the WLC itself and is required for AP CAPWAP connections?

AP-Manager Interface
Management Interface (Correct answer)
Dynamic Interface
Virtual Interface

Correct answer: Management Interface

The Management Interface is the primary interface used for WLC administration, AP CAPWAP tunnel termination, and network management traffic.

Question 93: Which subnet contains the host address 192.168.5.200/27?

192.168.5.192/27 (Correct answer)
192.168.5.176/27
192.168.5.224/27
192.168.5.160/27

Correct answer: 192.168.5.192/27

With /27 (block size 32), subnet boundaries are .0, .32, .64, .96, .128, .160, .192, .224 — the address .200 falls in the 192.168.5.192/27 subnet.

Question 94: What is the administrative distance of a directly connected network on a Cisco router?

5
10
1
0 (Correct answer)

Correct answer: 0

Directly connected routes have an administrative distance of 0, making them the most trusted routes in the routing table.

Question 95: What does the 'I' stand for in the CRUD acronym used with REST APIs?

Index
Insert
CRUD does not contain an 'I' (Correct answer)
Integrate

Correct answer: CRUD does not contain an 'I'

CRUD stands for Create, Read, Update, Delete — there is no 'I' in the acronym.

Question 96: Which PAgP mode causes a port to actively send PAgP packets to initiate an EtherChannel?

Auto
Passive
Desirable (Correct answer)
On

Correct answer: Desirable

PAgP 'desirable' mode actively initiates EtherChannel negotiation by sending PAgP packets, similar to LACP 'active' mode.

Question 97: Which 802.11 band characteristic makes 5 GHz preferable to 2.4 GHz in dense environments?

5 GHz has more non-overlapping channels and typically less interference (Correct answer)
5 GHz requires less transmit power for the same coverage area
5 GHz is backward compatible with all 802.11b devices
5 GHz has greater range and penetrates walls better

Correct answer: 5 GHz has more non-overlapping channels and typically less interference

The 5 GHz band offers up to 24 non-overlapping channels (in the US) compared to only 3 in 2.4 GHz, reducing co-channel interference in dense deployments.

Question 98: Which field in an IP packet header is decremented by one at each router hop?

Checksum
TTL (Correct answer)
TOS
Protocol

Correct answer: TTL

The Time to Live (TTL) field is decremented by 1 at each router hop; when it reaches 0, the packet is discarded.

Question 99: Which command manually sets the OSPF cost on an interface to 50?

router ospf 1 → cost 50
ip ospf cost 50 (interface mode) (Correct answer)
ip ospf priority 50 (interface mode)
bandwidth 50 (interface mode)

Correct answer: ip ospf cost 50 (interface mode)

The 'ip ospf cost value' command in interface configuration mode directly sets the OSPF cost for that interface.

Question 100: Which command on a Cisco switch sends Syslog messages to a remote server at 10.1.1.100?

logging host 10.1.1.100 (Correct answer)
ip syslog 10.1.1.100
syslog server 10.1.1.100
logging 10.1.1.100 remote

Correct answer: logging host 10.1.1.100

The global configuration command 'logging host <ip>' directs Syslog output to the specified remote Syslog server.

Cisco CCNA 200-301 Exam

The Cisco Certified Network Associate (CCNA 200-301) exam validates the ability to install, configure, operate, and troubleshoot medium-sized routed and switched networks, covering network fundamentals, access, IP connectivity, services, security, and automation.

100

Questions

120 min

Time Limit

83%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds