Pass Your Cisco 200-301 Exam Easy!

Cisco 200-301 Exam Questions & Answers, Accurate & Verified By IT Experts

Instant Download, Free Fast Updates, 99.6% Pass Rate

200-301 Premium Bundle

$74.99

Cisco 200-301 Premium Bundle

200-301 Premium File: 760 Questions & Answers

Last Update: Sep 27, 2026

200-301 PDF Study Guide: 1969 Pages

200-301 Bundle gives you unlimited access to "200-301" files. However, this does not replace the need for a .vce exam simulator. To download VCE exam simulator click here
Cisco 200-301 Premium Bundle
Cisco 200-301 Premium Bundle

200-301 Premium File: 760 Questions & Answers

Last Update: Sep 27, 2026

200-301 PDF Study Guide: 1969 Pages

$74.99

200-301 Bundle gives you unlimited access to "200-301" files. However, this does not replace the need for a .vce exam simulator. To download your .vce exam simulator click here

Cisco 200-301 Practice Test 12

Question 110

An access engineer must block one legacy workstation's IPv4 source address 10.10.7.44 from reaching a small subnet behind the distribution router, while allowing its other destinations. Only a standard ACL is available. Where should it generally be placed?

  1. Place a broad deny ACE below an existing permit any rule in the correct ACL, expecting the later deny to block the targeted host.
  2. Near the destination subnet so the source-only filter does not block unrelated paths earlier.
  3. Near the source on the first switch so all other destinations are blocked too.
  4. Bind a correct deny ACL outbound on an unrelated interface that the prohibited application flow never traverses.

Explanation

Correct Answer

B:

A standard ACL matches the source but not the destination. Placing it near the affected destination avoids denying that source's legitimate traffic to unrelated networks.

Incorrect Answers

A:

ACL processing stops at the first match; permit any above the specific deny would shadow it.

C:

Applying a source-only deny near the workstation would drop its traffic before any destination distinction is possible, exceeding the narrow requested access restriction.

D:

A valid ACL rule cannot enforce a policy if it is not attached to the relevant path and direction.

Question 111

A router connects to an Ethernet transit network through Gi0/1. The administrator wants a static network route with both outbound interface and specific next-hop address stated explicitly. Which form is fully specified?

  1. `ip route 10.48.0.0 255.255.0.0 Gi0/1` only.
  2. Configure a matching OSPF advertisement for the remote LAN without installing the requested static route on this router.
  3. `ip route 10.48.0.0 255.255.0.0 Gi0/1 192.0.2.2`.
  4. `ip route 10.48.0.0 255.255.0.0 192.0.2.2` only.

Explanation

Correct Answer

C:

The fully specified static route includes both the physical exit interface and next-hop IP. That clarifies the forwarding neighbor on a multipoint Ethernet transit link.

Incorrect Answers

A:

This is an interface-only static route, potentially requiring ARP resolution for destinations on Ethernet and lacking the requested explicit next-hop identity.

B:

Dynamic routing could be an alternative architecture, but it is not the explicit static route command being requested for the known next hop.

D:

The next-hop-only syntax is a valid recursive static route in many circumstances, but it omits the explicitly requested exit interface.

Question 112

Two Cisco switches are 90 meters apart inside the same data hall. Multimode fiber and matching short-reach optics are installed, and operations wants to use that existing media. Which choice fits?

  1. Use compatible multimode fiber transceivers of the same supported speed and optical specification on both ends.
  2. Run copper twisted-pair patch leads through the fiber termination connectors.
  3. Change the switch IP default gateway so incompatible optics can synchronize.
  4. Connect a single-mode-only long-reach optic to the existing multimode cabling without checking compatibility.

Explanation

Correct Answer

A:

Short-reach multimode optical transceivers can support the specified data-hall distance when their wavelength, speed, connector and fiber grade are compatible on both ends.

Incorrect Answers

B:

Copper Ethernet connectors and optical transceiver interfaces use different physical media and electrical/optical signaling. A twisted-pair cable cannot plug into fiber terminations as a direct equivalent.

C:

IP gateways are relevant after Layer 1/2 connectivity exists. They cannot correct an incompatible optical wavelength, connector or transceiver pairing preventing link establishment.

D:

Single-mode-only optics may not be designed for the installed multimode path. Connector shape alone does not prove the fiber/optical specification will negotiate a stable link.

Question 113

A trunk between Switch-A and Switch-B carries VLANs 10 and 20, but users in VLAN 30 cannot cross despite both switches having VLAN 30 locally. The configuration allows only 10,20 on the trunk. What must be modified?

  1. Keep VLAN 30 pruned from the switch trunk but configure it as the management native VLAN on an unrelated port.
  2. Change VLAN 30's IP gateway while keeping it pruned from the trunk.
  3. Reassign all VLAN 30 clients into the native VLAN on both switches.
  4. Add VLAN 30 to the trunk's allowed VLAN list on the required path.

Explanation

Correct Answer

D:

The allowed VLAN list filters which tagged VLANs may traverse an 802.1Q trunk. Adding 30 on the appropriate trunk endpoints restores its intended Layer 2 path, subject to STP.

Incorrect Answers

A:

A separate native VLAN setting does not restore required VLAN 30 tagging across the actual interswitch trunk.

B:

A correct gateway cannot make VLAN 30 frames cross a trunk that administratively excludes them. The missing Layer 2 path must be repaired first.

C:

Changing client VLANs to native would collapse logical segregation and alter user connectivity. The required fix is permitting VLAN 30 while preserving the intended VLAN mapping.

Question 114

Two floor switches connect users in VLAN 36 to a DHCP server located in another IP subnet. The server is reachable by routing but the local client DHCP broadcast does not cross the router. What should be configured?

  1. Enable a local DHCP scope on a different access-point management interface without relaying VLAN 36 broadcasts to the existing server.
  2. Configure a DHCP relay/helper address on the client VLAN's Layer 3 gateway interface.
  3. Add a static MAC entry for the DHCP server on each access switch.
  4. Change only the client DNS server option while leaving the DHCP relay helper address absent from the routed VLAN interface.

Explanation

Correct Answer

B:

DHCP initial discovery uses broadcast on the client's link. A relay on the routed VLAN interface forwards the request toward the remote server and records the client subnet context.

Incorrect Answers

A:

Changing wireless management settings does not provide client DHCP forwarding across the specified routed VLAN boundary.

C:

Static MAC entries support local Ethernet destination forwarding, not forwarding a DHCP broadcast across an IP subnet boundary. The router still needs relay behavior.

D:

DNS settings matter after a lease; the issue is that DHCP broadcasts cannot reach the off-subnet server without relay.

Question 115

A company deploys 25 similar cloud network environments and wants reviewed declarative infrastructure changes with a plan showing expected resource differences before applying them. Which mechanism is suitable?

  1. Manually repeat 25 portal click sequences without recording resulting configurations.
  2. Store desired network objects as untyped prose in a model prompt, without an infrastructure execution tool.
  3. Terraform infrastructure-as-code with version-controlled configuration, plan review and controlled apply.
  4. Use only a packet-capture tool to reproduce cloud virtual networks.

Explanation

Correct Answer

C:

Terraform can define resources declaratively, calculate a proposed change plan and apply approved infrastructure state through supported providers. Review helps prevent accidental environment drift.

Incorrect Answers

A:

Manual portal steps can create networks but are difficult to reproduce consistently across many environments and provide weaker controlled differences than reviewed infrastructure code.

B:

Natural-language descriptions can document intent but do not enforce a durable infrastructure state. An authorized IaC provider and controlled apply process are needed.

D:

Packet captures inspect network traffic behavior and cannot create or synchronize cloud network infrastructure resources. They are diagnostics, not declarative provisioning.

Question 116

An HSRP group on a user VLAN has two routers with priorities 125 and 95, both healthy, and preemption configured as needed. Which router should normally be active?

  1. The router with priority 125 is preferred for the active HSRP role.
  2. Both routers become active and share the same virtual MAC simultaneously.
  3. The router with the largest physical MAC must become active regardless of priority.
  4. The router with priority 95 wins because lower values indicate higher preference.

Explanation

Correct Answer

A:

HSRP elects an active router using priority, with higher priority preferred when election or permitted preemption occurs. Router ID/MAC can break certain ties.

Incorrect Answers

B:

HSRP active/standby operation generally has one active gateway per group at a time. Claiming simultaneous active ownership can create forwarding confusion.

C:

MAC-related tie breakers matter only when relevant election criteria tie. The explicit priority difference controls this described HSRP decision, not the largest MAC.

D:

HSRP priority is not an inverse cost. The lower priority router normally serves standby rather than displacing a healthy higher-priority active router.

Question 117

A staff member receives an email pretending to be IT support, containing a false login page and urgent account-reset demand. The security analyst must classify the primary attack approach. What is it?

  1. Treat a phishing email link as trustworthy because the sender uses the organization’s support display name, without validating the domain or request.
  2. An authorized vulnerability scan of the email server.
  3. Classify the fake reset message as legitimate because it was sent during a scheduled network maintenance window.
  4. Phishing, a social-engineering attempt to obtain credentials through deceptive communication.

Explanation

Correct Answer

D:

Phishing uses impersonation and a lure to induce a user to disclose credentials or execute a malicious step. The fake service-desk identity is central to the attack.

Incorrect Answers

A:

A display name is easily imitated; phishing detection requires checking the actual destination and unexpected credential request.

B:

Vulnerability scanning tests systems for exposures with authorization and technical probes; the described fraudulent email seeks user action and credentials, not permissioned security assessment.

C:

Timing alone does not authenticate the sender or validate the destination of a credential-harvesting link.

Question 118

One side of a switch link is forced to full duplex while the other negotiates half duplex. The half-duplex side reports late collisions and the full-duplex side has FCS errors. What is the likely issue?

  1. Check only that both ends report a physically up link while ignoring their differing negotiated duplex modes and late collisions.
  2. Duplex mismatch between the two link endpoints.
  3. Increase the Ethernet receive buffer while leaving one endpoint full duplex and the other half duplex.
  4. Raise the interface MTU to the same value on both ends and assume duplex alignment is unnecessary.

Explanation

Correct Answer

B:

Different duplex assumptions produce collision behavior on one side and corrupted frames or other errors on the other. Verify both ends' negotiation and speed/duplex settings.

Incorrect Answers

A:

A link may be up but suffer severe duplex-mismatch errors; compare both interface operating modes and counters.

C:

Buffering does not reconcile the duplex mismatch that causes collisions and FCS/late-collision symptoms.

D:

Matching MTU can help frame-size compatibility but cannot resolve half/full-duplex operation mismatch.

Question 119

An engineer reviews Rapid-PVST+ interface states after a topology change. Which set lists the principal RSTP port states rather than legacy listening and blocking terminology?

  1. Blocking, listening, learning, forwarding, disabled as five separate RSTP states.
  2. Down, idle, negotiating, established for all ports.
  3. Discarding, learning, and forwarding.
  4. Discover, offer, request, acknowledge.

Explanation

Correct Answer

C:

RSTP consolidates nonforwarding states into discarding, retains learning for source-MAC learning without data forwarding, and uses forwarding when the port carries user frames.

Incorrect Answers

A:

The five-state enumeration reflects traditional 802.1D STP terminology. Rapid STP uses the simpler three-state representation in its state model.

B:

The provided states are not the RSTP port state vocabulary. Router or session terminology does not replace discarding, learning and forwarding roles.

D:

Discover, Offer, Request, and Acknowledge are DHCP lease exchange messages. They do not represent Rapid STP learning or forwarding states on Ethernet switchports.

Question 120

Four OSPFv2 routers join a new shared Ethernet network and simultaneously elect DR and BDR. Router A has priority 120 and ID 1.1.1.1; B priority 40 ID 9.9.9.9; C priority 40 ID 8.8.8.8; D priority 0 ID 10.10.10.10. Which TWO statements identify the correct election outcomes? (Select TWO.)

  1. Router B is elected BDR because it has the highest router ID among the remaining priority-40 candidates.
  2. Elect both B and C as joint DRs because their equal priority means neither can be broken by router ID.
  3. Choose Router D as BDR because its router ID is highest, despite its OSPF interface priority being zero.
  4. Router A is elected DR because its interface priority is the highest.
  5. Choose Router C as BDR because router IDs are compared in reverse order after the DR election.

Explanation

Correct Answers

A:

After identifying the DR, eligible B and C have equal priority 40, so the higher router ID 9.9.9.9 wins the BDR tie break. The priority-zero router cannot become DR or BDR.

D:

An OSPF broadcast-network DR election considers nonzero interface priority first and router ID as tie breaker. A's priority 120 exceeds 40 and zero, so it is the preferred DR in this simultaneous election.

Incorrect Answers

B:

OSPF DR/BDR election does not produce two simultaneous DRs for the same multiaccess segment. Router ID breaks the equal-priority tie between B and C after higher-priority A is selected DR.

C:

An OSPFv2 priority of zero makes an interface ineligible for DR or BDR election. A router ID can break a tie only among eligible candidates with equal priority.

E:

After eligible highest-priority A becomes DR, B and C both have priority 40. The higher router ID, B at 9.9.9.9, wins the remaining BDR position.


Cisco Certified Network Associate (CCNA) (200-301) Practice Tests

Purchase Individually

200-301 Premium File

Premium File
200-301 Premium File
760 Q&A
$76.99$69.99

200-301 Study Guide

Study Guide
200-301 Study Guide
1969 PDF Pages
$27.49$24.99

Site Search:

 

VISA, MasterCard, AmericanExpress, UnionPay

SPECIAL OFFER: GET 10% OFF

ExamCollection Premium

ExamCollection Premium Files

Pass your Exam with ExamCollection's PREMIUM files!

  • ExamCollection Certified Safe Files
  • Guaranteed to have ACTUAL Exam Questions
  • Up-to-Date Exam Study Material - Verified by Experts
  • Instant Downloads
Enter Your Email Address to Receive Your 10% Off Discount Code
A Confirmation Link will be sent to this email address to verify your login
We value your privacy. We will not rent or sell your email address

SPECIAL OFFER: GET 10% OFF

Use Discount Code:

MIN10OFF

A confirmation link was sent to your e-mail.
Please check your mailbox for a message from support@examcollection.com and follow the directions.

Next

Download Free Demo of VCE Exam Simulator

Experience Avanset VCE Exam Simulator for yourself.

Simply submit your e-mail address below to get started with our interactive software demo of your free trial.

Free Demo Limits: In the demo version you will be able to access only first 5 questions from exam.