CISCO CCNA 200-301 EXAM– QUESTIONS AND ANSWERS |
VERIFIED AND WELL DETAILED ANSWERS PLUS RATIONALES |
GUARANTEED PASS | LATEST EXAM UPDATE | EXAM PREP |
STUDY GUIDE | PRACTICE TEST| DOWNLOAD INSTANT PDF
1. A network engineer is configuring a new enterprise switch and needs to ensure that only
a specific, trusted workstation with MAC address 001a.2b3c.4d5e is allowed to send traffic
through interface FastEthernet 0/1. Which port security violation mode should be selected
if the requirement is to drop packets from unauthorized sources silently, log the violation
event via SNMP, and keep the port operational without shutting it down?
A. Shutdown
B. Restrict
C. Protect
D. Discard
The restrict violation mode drops frames with unknown source MAC addresses, triggers an
SNMP trap and syslog message to log the security event, and increments the violation counter
while keeping the port active and forwarding legitimate traffic. The shutdown mode disables
the port entirely, while the protect mode drops unauthorized traffic without generating any
notification logs or incrementing counters. Discard is not a standard port security violation
mode.
2. A junior network administrator is troubleshooting connectivity between two VLANs on
a layer 3 switch. Hosts in VLAN 10 cannot communicate with hosts in VLAN 20 despite
both VLAN interfaces being configured with correct IP addresses. What fundamental
configuration command must be verified globally on the switch to enable inter-VLAN
routing?
A. ip routing
B. spanning-tree vlan root primary
C. router-on-stick enable
D. vtp mode transparent
On a multilayer switch, routing between VLANs is disabled by default. The global
configuration command "ip routing" must be explicitly entered to enable the switch to act as a
router and route packets between different subnets and VLANs. Spanning-tree, VTP, and
,router-on-a-stick settings do not substitute for enabling internal layer 3 routing functionality
on a multilayer switch.
3. An administrator is configuring a static route on a Cisco router to reach a remote subnet
192.168.10.0/24 via next-hop IP address 10.0.0.2. Which of the following commands
accomplishes this correctly?
A. router(config)# ip route 192.168.10.0 255.255.255.0 10.0.0.2
B. router(config)# ip route 10.0.0.2 255.255.255.0 192.168.10.0
C. router(config-route)# static-route 192.168.10.0 255.255.255.0 10.0.0.2
D. router(config)# route 192.168.10.0 255.255.255.0 gateway 10.0.0.2
The correct syntax for configuring a static route in Cisco IOS is "ip route [destination
network] [subnet mask] [next-hop IP or exit interface]". Option A correctly specifies the target
network, subnet mask, and next-hop router address from global configuration mode. The
other options use incorrect syntax or command structures.
4. A network technician needs to verify the operational status of all switch ports, their
assigned VLANs, duplex settings, and speed settings in a single command. Which command
provides this comprehensive summary output?
A. show ip interface brief
B. show interfaces status
C. show vlan brief
D. show running-config interface
The "show interfaces status" command displays a concise table containing port names,
status, native or assigned VLANs, duplex, and speed settings for every interface on the switch.
"show ip interface brief" focuses strictly on layer 3 IP addresses and line protocols, while
"show vlan brief" displays VLAN-to-port mappings without hardware link details.
5. Which of the following wireless network security protocols introduces Protected
Management Frames (PMF) as a mandatory requirement to protect against de-
authentication and disassociation attacks?
A. WEP
B. WPA
C. WPA2
, D. WPA3
WPA3 mandates the use of Protected Management Frames (PMF), which cryptographically
protects management frames such as de-authentication and disassociation frames to prevent
rogue access points from performing wireless denial-of-service attacks. While WPA2 supports
optional PMF, it is not mandatory.
6. A network engineer connects two Cisco switches using a trunk link. By default, which
Spanning Tree Protocol (STP) variant is enabled on modern Cisco Catalyst switches,
providing rapid convergence and per-VLAN spanning tree capabilities?
A. IEEE 802.1D Classic STP
B. PVST+ (Per-VLAN Spanning Tree Plus)
C. Rapid PVST+ (IEEE 802.1w)
D. Multiple Spanning Tree (MST) IEEE 802.1s
Modern Cisco Catalyst switches run Rapid PVST+ (based on IEEE 802.1w) by default,
providing rapid convergence through explicit handshakes and port roles while maintaining a
separate spanning tree instance for each configured VLAN. Classic STP (802.1D) was the
default on older legacy hardware.
7. An organization requires an IPv4 subnet mask that provides a maximum of 30 usable
host addresses per subnet. Which of the following subnet masks meets this requirement
with the least amount of wasted address space?
A. 255.255.255.192
B. 255.255.255.224
C. 255.255.255.240
D. 255.255.255.248
A subnet mask of 255.255.255.224 leaves 5 host bits ($2^5 = 32$ total addresses). Subtracting
2 for the network and broadcast addresses leaves 30 usable host addresses, which exactly
matches the requirement. A /28 mask (/240) provides only 14 usable hosts, while a /26 mask
(/192) provides 62 usable hosts, creating unnecessary waste.
8. A host with IP address 192.168.1.50/24 needs to send data to a web server located on a
completely different remote subnet. What destination MAC address will the host place in
the Ethernet frame header when forwarding this packet to its default gateway?
VERIFIED AND WELL DETAILED ANSWERS PLUS RATIONALES |
GUARANTEED PASS | LATEST EXAM UPDATE | EXAM PREP |
STUDY GUIDE | PRACTICE TEST| DOWNLOAD INSTANT PDF
1. A network engineer is configuring a new enterprise switch and needs to ensure that only
a specific, trusted workstation with MAC address 001a.2b3c.4d5e is allowed to send traffic
through interface FastEthernet 0/1. Which port security violation mode should be selected
if the requirement is to drop packets from unauthorized sources silently, log the violation
event via SNMP, and keep the port operational without shutting it down?
A. Shutdown
B. Restrict
C. Protect
D. Discard
The restrict violation mode drops frames with unknown source MAC addresses, triggers an
SNMP trap and syslog message to log the security event, and increments the violation counter
while keeping the port active and forwarding legitimate traffic. The shutdown mode disables
the port entirely, while the protect mode drops unauthorized traffic without generating any
notification logs or incrementing counters. Discard is not a standard port security violation
mode.
2. A junior network administrator is troubleshooting connectivity between two VLANs on
a layer 3 switch. Hosts in VLAN 10 cannot communicate with hosts in VLAN 20 despite
both VLAN interfaces being configured with correct IP addresses. What fundamental
configuration command must be verified globally on the switch to enable inter-VLAN
routing?
A. ip routing
B. spanning-tree vlan root primary
C. router-on-stick enable
D. vtp mode transparent
On a multilayer switch, routing between VLANs is disabled by default. The global
configuration command "ip routing" must be explicitly entered to enable the switch to act as a
router and route packets between different subnets and VLANs. Spanning-tree, VTP, and
,router-on-a-stick settings do not substitute for enabling internal layer 3 routing functionality
on a multilayer switch.
3. An administrator is configuring a static route on a Cisco router to reach a remote subnet
192.168.10.0/24 via next-hop IP address 10.0.0.2. Which of the following commands
accomplishes this correctly?
A. router(config)# ip route 192.168.10.0 255.255.255.0 10.0.0.2
B. router(config)# ip route 10.0.0.2 255.255.255.0 192.168.10.0
C. router(config-route)# static-route 192.168.10.0 255.255.255.0 10.0.0.2
D. router(config)# route 192.168.10.0 255.255.255.0 gateway 10.0.0.2
The correct syntax for configuring a static route in Cisco IOS is "ip route [destination
network] [subnet mask] [next-hop IP or exit interface]". Option A correctly specifies the target
network, subnet mask, and next-hop router address from global configuration mode. The
other options use incorrect syntax or command structures.
4. A network technician needs to verify the operational status of all switch ports, their
assigned VLANs, duplex settings, and speed settings in a single command. Which command
provides this comprehensive summary output?
A. show ip interface brief
B. show interfaces status
C. show vlan brief
D. show running-config interface
The "show interfaces status" command displays a concise table containing port names,
status, native or assigned VLANs, duplex, and speed settings for every interface on the switch.
"show ip interface brief" focuses strictly on layer 3 IP addresses and line protocols, while
"show vlan brief" displays VLAN-to-port mappings without hardware link details.
5. Which of the following wireless network security protocols introduces Protected
Management Frames (PMF) as a mandatory requirement to protect against de-
authentication and disassociation attacks?
A. WEP
B. WPA
C. WPA2
, D. WPA3
WPA3 mandates the use of Protected Management Frames (PMF), which cryptographically
protects management frames such as de-authentication and disassociation frames to prevent
rogue access points from performing wireless denial-of-service attacks. While WPA2 supports
optional PMF, it is not mandatory.
6. A network engineer connects two Cisco switches using a trunk link. By default, which
Spanning Tree Protocol (STP) variant is enabled on modern Cisco Catalyst switches,
providing rapid convergence and per-VLAN spanning tree capabilities?
A. IEEE 802.1D Classic STP
B. PVST+ (Per-VLAN Spanning Tree Plus)
C. Rapid PVST+ (IEEE 802.1w)
D. Multiple Spanning Tree (MST) IEEE 802.1s
Modern Cisco Catalyst switches run Rapid PVST+ (based on IEEE 802.1w) by default,
providing rapid convergence through explicit handshakes and port roles while maintaining a
separate spanning tree instance for each configured VLAN. Classic STP (802.1D) was the
default on older legacy hardware.
7. An organization requires an IPv4 subnet mask that provides a maximum of 30 usable
host addresses per subnet. Which of the following subnet masks meets this requirement
with the least amount of wasted address space?
A. 255.255.255.192
B. 255.255.255.224
C. 255.255.255.240
D. 255.255.255.248
A subnet mask of 255.255.255.224 leaves 5 host bits ($2^5 = 32$ total addresses). Subtracting
2 for the network and broadcast addresses leaves 30 usable host addresses, which exactly
matches the requirement. A /28 mask (/240) provides only 14 usable hosts, while a /26 mask
(/192) provides 62 usable hosts, creating unnecessary waste.
8. A host with IP address 192.168.1.50/24 needs to send data to a web server located on a
completely different remote subnet. What destination MAC address will the host place in
the Ethernet frame header when forwarding this packet to its default gateway?
