Cisco 200-301 Practice Test 13

Question 120

Four OSPFv2 routers join a new shared Ethernet network and simultaneously elect DR and BDR. Router A has priority 120 and ID 1.1.1.1; B priority 40 ID 9.9.9.9; C priority 40 ID 8.8.8.8; D priority 0 ID 10.10.10.10. Which TWO statements identify the correct election outcomes? (Select TWO.)

Router B is elected BDR because it has the highest router ID among the remaining priority-40 candidates.
Elect both B and C as joint DRs because their equal priority means neither can be broken by router ID.
Choose Router D as BDR because its router ID is highest, despite its OSPF interface priority being zero.
Router A is elected DR because its interface priority is the highest.
Choose Router C as BDR because router IDs are compared in reverse order after the DR election.

Explanation

Correct Answers

After identifying the DR, eligible B and C have equal priority 40, so the higher router ID 9.9.9.9 wins the BDR tie break. The priority-zero router cannot become DR or BDR.

An OSPF broadcast-network DR election considers nonzero interface priority first and router ID as tie breaker. A's priority 120 exceeds 40 and zero, so it is the preferred DR in this simultaneous election.

Incorrect Answers

OSPF DR/BDR election does not produce two simultaneous DRs for the same multiaccess segment. Router ID breaks the equal-priority tie between B and C after higher-priority A is selected DR.

An OSPFv2 priority of zero makes an interface ineligible for DR or BDR election. A router ID can break a tie only among eligible candidates with equal priority.

After eligible highest-priority A becomes DR, B and C both have priority 40. The higher router ID, B at 9.9.9.9, wins the remaining BDR position.

Question 121

A router's Gi0/0 interface is assigned 2001:db8:1234:aa00::1/64. The operator needs the IPv6 network prefix used for that on-link segment. Which one is correct?

2001:db8:1234:aa00::1/128 as the entire LAN network.
2001:db8:1234::/48, which omits the fourth hextet.
fe80::/10 because all configured IPv6 LANs use a link-local prefix.
2001:db8:1234:aa00::/64, comprising the first 64 bits.

Explanation

Correct Answer

An IPv6 /64 keeps the first four 16-bit hextets as the subnet prefix. Host/interface bits are zero for the network identifier; link-local neighbor addressing can also coexist.

Incorrect Answers

A /128 identifies one individual IPv6 address, not the entire /64 network used for neighbor discovery and host addresses.

A /48 contains many /64 LANs and is broader than the specified interface's on-link prefix. It cannot identify this particular aa00 subnet.

Link-local addresses exist independently for single-link communication and neighbor discovery on IPv6 interfaces. They do not replace this explicitly configured global-unicast /64 segment prefix.

Question 122

Two switchports are being added to a Layer 2 LACP EtherChannel trunk. Gi1/0/1 uses native VLAN 99 while Gi1/0/2 uses native VLAN 1, and the bundle reports incompatible members. Which setting should be aligned?

Add a routed IP address to one Layer 2 physical member without touching the trunk.
Make native VLAN and other trunk parameters consistent across member ports before forming the channel.
Set a different native VLAN on each member to increase isolation.
Assign both interfaces different channel-group modes on the same local switch.

Explanation

Correct Answer

An EtherChannel treats physical links as one logical interface, so member speed, mode and relevant trunk settings need compatible configuration. Native VLAN disagreement can prevent aggregation or cause traffic misclassification.

Incorrect Answers

A routed address on one member changes the physical port role and does not align its Layer 2 trunk settings with the rest of the intended channel.

Distinct native VLANs across physical members would make the same untagged frame mean different broadcast domains depending on the member. This conflicts with deterministic bundling.

Channel-group mode mismatches on local members can prevent a consistent LACP bundle. They are not a solution to conflicting trunk parameters.

Question 123

A Cisco route entry reads `O 172.22.56.0/21 [110/40] via 192.0.2.2`. Which network is matched by that route's prefix?

Only the single 172.22.56.0 host address.
The unrelated 192.0.2.0/24 next-hop transport network.
The 172.22.56.0/21 block, covering third octets 56 through 63.
The larger 172.22.0.0/16 network covering every third octet.

Explanation

Correct Answer

A /21 mask is 255.255.248.0, so the third octet advances in groups of eight. The block starting at 56 covers 56 through 63.

Incorrect Answers

A host route requires a /32 mask. This route's /21 prefix covers 2,048 addresses rather than specifying only the network address as an endpoint.

The `via` address identifies the next-hop router used to forward matching traffic. It is not the destination network represented by the route prefix.

A /16 covers far more destinations than the installed /21. Routers use the listed prefix length to determine which addresses match this entry.

Question 124

A router is translating inside-local 10.20.1.8 to inside-global 198.51.100.8. The operator wants to verify the active mapping rather than just inspect the configured NAT statements. Which command output is most direct?

`show ip nat translations` with matching inside local and inside global columns.
Inspect only show ip route and expect it to list individual NAT inside-local to inside-global translation entries.
Inspect only the NAT configuration lines and assume an operational translation exists for the inside host.
Use the IOS interface description as proof the inside address was translated to 198.51.100.8.

Explanation

Correct Answer

The NAT translation table shows which private inside addresses and ports are mapped to visible global addresses for actual flows. Inspecting matching entries confirms operational translation state.

Incorrect Answers

Routing entries provide destination paths, not session/address translation state; show ip nat translations is the relevant source.

A rule can be configured without current session state; operational translation tables show actual dynamic address mappings.

Interface labels do not display NAT address/port associations generated by traffic and policy.

Question 125

The security team wants administrator access to a router management portal to require a password plus a second independent possession factor. Which access policy best meets that requirement?

Set two different passwords that the same user memorizes, calling them separate factors.
Require a longer password and claim it counts as two factors.
Require only a badge at the wiring closet while keeping remote portal password-only.
Require multifactor authentication using distinct factors for privileged remote management.

Explanation

Correct Answer

MFA combines different factor categories, such as something known and a device or authenticator possessed, reducing exposure from a stolen password alone. Implement through an appropriate AAA/identity service.

Incorrect Answers

Two memorized passwords remain two instances of the knowledge factor; compromise of the user's credential information may affect both. The policy calls for independent factors.

Password length improves resistance to guessing but remains a single knowledge factor. A longer secret does not create a separate factor category or independently verify possession.

Physical site security is valuable but does not enforce a second factor at a remotely accessible management login. The remote portal still needs actual multifactor authentication.

Question 126

An automation client already knows the REST URI of a stored device record. It wants to replace only its `description` property while preserving all other properties according to a documented partial-update API contract. Which HTTP method is best suited?

Issue an HTTP GET for the existing device and assume retrieval will apply the requested replacement field value.
PATCH the existing resource with the description change.
POST to the collection to create a second device record.
DELETE the resource and then issue a GET for its prior content.

Explanation

Correct Answer

PATCH is conventionally used for partial modifications when the API supports that contract. It avoids replacing fields omitted from the submitted representation.

Incorrect Answers

GET returns a representation rather than modifying the resource; use a documented update method with validated body/authorization.

POST to a collection is commonly for creation, not for modifying one known existing object. It might create an unwanted duplicate entry.

DELETE removes the resource; a following GET cannot recover properties from a deleted record in the normal REST contract. This is not a safe partial update.

Question 127

A router has a connected route to 10.20.0.0/16 and a static route to 10.20.8.0/24 with administrative distance 200. A packet arrives for 10.20.8.9. Which prefix is considered first for forwarding?

The /16 connected route always wins because connected AD is zero.
Select the connected /16 route solely because its administrative distance is zero, before checking that a more-specific /24 route is active.
The 10.20.8.0/24 route, provided it is installed and usable, because it is more specific.
Both prefixes are used interchangeably with equal sharing.

Explanation

Correct Answer

Forwarding lookup uses longest destination-prefix match among installed routes. Administrative distance establishes whether candidate routes to a given prefix install; it does not make a broad /16 override a valid /24.

Incorrect Answers

Connected routes normally have AD zero, but route-source trust cannot override a more-specific installed route for a matching destination. The /24 has more matching bits.

Longest-prefix matching among installed routes occurs before source preference across different destination prefixes.

ECMP considers equivalent paths to the same destination prefix; /16 and /24 do not represent equal destination matches for 10.20.8.9.

Question 128

A school plans two VLANs: printers 10.10.8.0/25 and staff 10.10.8.64/26. Devices on both VLANs intermittently resolve to unexpected gateways. What design error should be corrected?

The two subnet allocations overlap, because .64/26 lies inside .0/25.
The staff /26 automatically begins at 10.10.8.128.
Ethernet VLAN tags prevent overlapping routed subnet routes from ever causing confusion.
The VLANs are safe because their prefix lengths differ.

Explanation

Correct Answer

A /25 starting at .0 spans addresses .0 through .127; the .64/26 occupies .64 through .127, entirely within that block. Reassign nonoverlapping ranges.

Incorrect Answers

A /26 containing .64 has network boundary .64, not .128. The /26 blocks are .0, .64, .128 and .192 in that octet.

VLANs isolate Layer 2 traffic, but overlapping IP prefixes can confuse routing, ARP expectations and gateway policies when hosts are meant to communicate across routed segments. Address planning still matters.

Different masks do not prove nonoverlap. Explicit network boundaries must be calculated, especially when a smaller /26 can be wholly contained in a larger /25.

Question 129

A guest WLAN is visible and the controller maps it to the correct VLAN. Several clients receive an authentication failure immediately after entering a shared passphrase that differs from the WLAN profile's configured WPA2 key. What should be checked?

Correct the WLAN DHCP scope before testing the WPA2-Personal key handshake that currently fails.
Add more DHCP lease capacity but retain the mismatched WPA2 authentication profile between client and AP.
Disable AES encryption to make incorrect credentials succeed.
Align the client-entered preshared key with the approved WPA2-Personal key on the WLAN.

Explanation

Correct Answer

WPA2-Personal association requires the client and AP to derive compatible keys from the same PSK and other parameters. A mismatched passphrase causes handshake failure before IP address allocation.

Incorrect Answers

Lease assignment occurs after the client has successfully associated and authenticated; a PSK failure is upstream of DHCP.

An address pool cannot fix a failed wireless key exchange; test security settings and credentials first.

Disabling encryption would undermine the configured security policy and is not an acceptable substitute for correcting a PSK mismatch. Verify the intended key and supported cipher mode.

Question 130

An engineer logs in successfully to a Cisco router through TACACS+, but the policy must prevent junior operators from running configuration-changing commands. Which AAA function determines permitted commands after authentication?

Enable detailed AAA accounting for junior operators while leaving their command authorization rules unrestricted.
Authorization, applied to the authenticated identity and requested command or privilege.
Authentication, because verifying identity automatically allows all commands.
Accounting, because logging a command inherently blocks its execution.

Explanation

Correct Answer

Authorization evaluates whether the verified user is allowed to perform a particular operation or command. It can enforce role and privilege policies through supported AAA integrations.

Incorrect Answers

Accounting records executed commands but cannot prevent an authenticated user from issuing an unauthorized configuration command.

Authentication establishes who the user is; that is necessary but does not mean every authenticated user should be permitted to change routing configuration.

Accounting records access and commands for audit but does not necessarily deny an unauthorized request. The policy needs an enforceable authorization decision.

Cisco Certified Network Associate (CCNA) (200-301) Practice Tests

Cisco 200-301 Practice Test 11 - 10 Questions (Last Reviewed 28-Oct-2026)
Cisco 200-301 Practice Test 12 - 10 Questions (Last Reviewed 27-Oct-2026)
Cisco 200-301 Practice Test 13 - 10 Questions (Last Reviewed 26-Oct-2026)
Cisco 200-301 Practice Test 14 - 10 Questions (Last Reviewed 25-Oct-2026)
Cisco 200-301 Practice Test 15 - 10 Questions (Last Reviewed 24-Oct-2026)

Pass Your Cisco 200-301 Exam Easy!

Question 120

Explanation

Correct Answers

Incorrect Answers

Question 121

Explanation

Correct Answer

Incorrect Answers

Question 122

Explanation

Correct Answer

Incorrect Answers

Question 123

Explanation

Correct Answer

Incorrect Answers

Question 124

Explanation

Correct Answer

Incorrect Answers

Question 125

Explanation

Correct Answer

Incorrect Answers

Question 126

Explanation

Correct Answer

Incorrect Answers

Question 127

Explanation

Correct Answer

Incorrect Answers

Question 128

Explanation

Correct Answer

Incorrect Answers

Question 129

Explanation

Correct Answer

Incorrect Answers

Question 130

Explanation

Correct Answer

Incorrect Answers

Cisco Certified Network Associate (CCNA) (200-301) Practice Tests