Cisco 200-301 Practice Test 14

Question 130

An engineer logs in successfully to a Cisco router through TACACS+, but the policy must prevent junior operators from running configuration-changing commands. Which AAA function determines permitted commands after authentication?

Enable detailed AAA accounting for junior operators while leaving their command authorization rules unrestricted.
Authorization, applied to the authenticated identity and requested command or privilege.
Authentication, because verifying identity automatically allows all commands.
Accounting, because logging a command inherently blocks its execution.

Explanation

Correct Answer

Authorization evaluates whether the verified user is allowed to perform a particular operation or command. It can enforce role and privilege policies through supported AAA integrations.

Incorrect Answers

Accounting records executed commands but cannot prevent an authenticated user from issuing an unauthorized configuration command.

Authentication establishes who the user is; that is necessary but does not mean every authenticated user should be permitted to change routing configuration.

Accounting records access and commands for audit but does not necessarily deny an unauthorized request. The policy needs an enforceable authorization decision.

Question 131

On a broadcast LAN the current OSPF DR has router ID 2.2.2.2 and remains healthy. A new router with higher priority joins later, but the DR role does not move immediately. Why?

Higher router IDs can never be used in DR elections.
An OSPF DR remains fixed even if its interface goes down permanently.
Standard OSPF DR/BDR elections are non-preemptive while existing roles remain valid.
OSPF DR selection always requires the smallest IP address.

Explanation

Correct Answer

The OSPF broadcast DR election normally does not immediately replace a healthy incumbent simply because a higher-priority neighbor arrives. Roles change under appropriate topology and adjacency events.

Incorrect Answers

Router IDs serve as tie breakers when interface priorities are equal. They remain relevant to election, but do not force continuous preemption of an existing DR.

DR continuity is not permanent regardless of failure. If an active DR disappears or the network reconverges, backup and new election behavior can change leadership.

The lowest IP address is not the default rule. Eligible interface priority and router ID determine candidate preference during election events.

Question 132

A Linux technician sees `inet 192.168.27.18/24` on eth0 but `ip route` has no `default via` entry. The host can reach local devices but not remote IPv4 networks. What is most likely missing?

An appropriate default route pointing toward the VLAN's reachable gateway.
A different Ethernet MAC address in the host's NIC.
An extra loopback IPv6 address on `lo`.
Increase the local subnet mask to include all Internet hosts on-link instead of defining a valid default gateway.

Explanation

Correct Answer

A /24 connected route permits communication on the local subnet. Without a default or other route for external prefixes, the host cannot forward off-subnet IP packets to a router.

Incorrect Answers

A working local Ethernet interface and address already support LAN communication. Changing its MAC does not install a missing default route into the IP table.

Loopback IPv6 addressing serves local host communication; it does not define the missing IPv4 next-hop gateway for destinations beyond the /24.

A wider prefix can break neighbor resolution and cannot replace a route to off-link destinations through an actual router.

Question 133

A remote branch has lightweight wireless APs controlled over a WAN. The site must continue locally switching client traffic onto its branch VLAN during a controller WAN interruption, using a supported AP mode. Which mode best matches?

Sniffer mode that captures packets instead of serving associated clients.
Monitor mode only, with all client forwarding disabled.
Place management state in the central controller but require every user frame to travel across WAN before it can be locally switched.
FlexConnect local switching, with necessary WLAN and VLAN mappings configured.

Explanation

Correct Answer

FlexConnect can allow supported APs to locally bridge selected WLAN client traffic at a remote site while central controller connectivity is limited. Verify authentication and feature limitations for disconnected operation.

Incorrect Answers

Sniffer mode collects wireless traffic for analysis; it is not the client forwarding mode requested to maintain branch LAN service.

Monitor mode is used for RF monitoring and security analysis rather than serving the normal client-data WLAN as a local bridge.

Local switching needs a supported AP data path that can continue carrying branch clients if controller connectivity is impaired.

Question 134

An NTP client router reports it is not synchronized with its configured time source, and syslog timestamps differ from the network baseline. The team wants accurate time correlation for audit. What should be verified?

Change only the router’s time zone display string while its NTP client still reports an unsynchronized clock.
NTP peer reachability, association status and the selected source's synchronization/stratum.
Choose a lower NTP polling interval without confirming that the configured time server is reachable or responding.
MAC address table aging on the connected Ethernet switch.

Explanation

Correct Answer

NTP synchronization depends on a reachable legitimate time source and healthy association. Check status and stratum rather than assuming a configured server line guarantees accurate time.

Incorrect Answers

Time zone formatting changes presentation, not the underlying UTC clock accuracy required for correlated syslog events.

More frequent failed queries cannot synchronize the client; investigate reachability, source legitimacy and actual NTP association state.

MAC aging affects learned Ethernet destinations. It does not set accurate clock synchronization or explain an NTP peer association failing.

Question 135

Network operations feeds historic interface utilization and fault records into a model that learns patterns and predicts abnormal traffic before tickets appear. Which approach is being applied?

Static manual logging only, with no model or learned patterns.
NAT overloading based on port-number translation as an anomaly model.
Machine-learning anomaly detection using telemetry-derived baselines and evaluated alerts.
A generative text prompt that invents incident predictions without telemetry evidence.

Explanation

Correct Answer

A machine-learning predictor can learn statistical relationships from measured network telemetry and surface departures from expected behavior. Validate false positives and drift as conditions change.

Incorrect Answers

Manual logs are useful historical records but do not by themselves train a predictor or identify anomalies from learned traffic distributions.

NAT changes address/port mappings for connectivity. It neither learns from prior utilization nor predicts anomalous traffic, so it solves a different network function.

Generative summaries can explain observations, but predictions without grounded telemetry and validation cannot reliably identify abnormal link behavior as required.

Question 136

An administrator creates `ip route 10.88.0.0 255.255.0.0 Gi0/0` on a multiaccess Ethernet interface with many neighbors. The router begins ARPing for remote destinations and traffic is unreliable. Which static-route correction is preferable?

Specify an appropriate reachable next-hop IP, optionally with the exit interface, for the Ethernet static route.
Convert the static Ethernet exit-interface route to another interface-only route that still relies on proxy ARP for every remote host.
Configure the same route through an arbitrary host's MAC address instead of an IP next hop.
Raise the static route’s administrative distance while keeping its Ethernet interface-only forwarding behavior unchanged.

Explanation

Correct Answer

Interface-only static routes on Ethernet can lead the router to ARP for destination addresses rather than a specific routed neighbor. An explicit next hop provides the intended Layer 3 forwarding target.

Incorrect Answers

The recommended multiaccess static route names a reachable next-hop IP, avoiding per-destination ARP behavior on Ethernet.

Static routing syntax uses networks and interfaces or next-hop IPs, not an arbitrary destination MAC as a replacement for route resolution on Ethernet.

Administrative distance changes candidate preference, not how ARP resolves destinations on a multiaccess medium.

Question 137

A security architect wants an extended IPv4 ACL to stop one application flow from entering a large campus, while leaving unrelated traffic from the same server allowed to other destinations. Where should it generally be placed?

As a standard ACL at the source that denies the entire server's address.
At a destination-only position with no source, protocol or port conditions.
Attach the correct extended ACL to an unrelated management interface instead of the routed application traffic path.
Near the source so the extended conditions can reject the unwanted flow before it traverses the network.

Explanation

Correct Answer

Extended ACLs can match source, destination, protocol and ports, allowing narrow early filtering near the source of unwanted traffic while preserving other legitimate flows.

Incorrect Answers

A standard ACL keyed only to the server's source would block all its traffic instead of the one specified application. More granular conditions are needed.

A destination placement may still be usable in specific designs, but omitting required match conditions prevents the selective application-flow restriction.

A good ACE does not enforce the security rule if applied where packets never traverse it.

Question 138

A live multiplayer game sends frequent small position updates and tolerates occasional lost datagrams rather than waiting for retransmission. Which transport is a natural fit?

Ethernet ARP packets to carry application position updates.
UDP with application-specific sequencing or loss recovery if needed.
TCP solely because it always preserves delivery without adding delay.
ICMP echo messages as the full game transport.

Explanation

Correct Answer

UDP avoids establishing a reliable ordered byte stream and can reduce transport-level recovery delay. Games can implement selective recovery for data whose loss matters.

Incorrect Answers

ARP resolves local IPv4 neighbors to MAC addresses. It is not a transport protocol for end-to-end game updates over routed networks.

TCP provides ordered reliable delivery but retransmissions and head-of-line blocking can increase latency for time-sensitive updates that soon become obsolete. It may suit other game traffic.

ICMP is mainly for control and diagnostic purposes and does not provide an ordinary application datagram service with appropriate game-session port multiplexing.

Question 139

A Layer 3 switch has configured SVI gateways for VLANs 12 and 22, but `ip routing` is disabled. Hosts can reach their own SVI but not each other's subnet. What is needed?

Disable VLAN 12's SVI and move all users into the management VLAN.
Increase both SVI subnet masks until they overlap.
Enable Layer 3 IP routing on the capable switch and verify each SVI is up with appropriate addressing.
Configure both routed VLAN SVIs but leave the global ip routing setting disabled, expecting switchport costs to create inter-VLAN forwarding.

Explanation

Correct Answer

SVIs supply VLAN gateway interfaces, but the switch must run IP routing to forward between different subnetworks. Verify that both VLANs have active member ports and working gateway IPs.

Incorrect Answers

Removing an SVI loses rather than restores one of the gateway endpoints. Collapsing users into management space also undermines VLAN separation.

Overlapping subnet masks create ambiguous host/routing behavior and are not a substitute for enabling the switch's supported inter-VLAN forwarding feature.

Layer 3 forwarding between SVIs needs the routing function enabled; Layer 2 cost changes cannot compensate.

Question 140

A router on an OSPF broadcast segment should participate in routing but must never become DR or BDR, even if other routers fail or priorities change. Which interface priority fits?

Set OSPF interface priority 0 on that router's broadcast interface.
Set OSPF reference bandwidth to zero to disable election.
Lower the router's system hostname alphabetically.
Set OSPF interface priority 255 for highest eligibility.

Explanation

Correct Answer

OSPF priority zero explicitly makes a router ineligible for DR and BDR election on that segment while it may still form required neighbor relationships.

Incorrect Answers

Reference bandwidth changes how interface cost is calculated and is unrelated to suppressing DR candidacy. It should not be set to an invalid value as a proxy for election policy.

Router name ordering does not determine OSPF DR or BDR election. Priority and router ID govern the eligible neighbor selection on a broadcast network.

Priority 255 is high and would make the router a strong DR/BDR candidate during an election, contrary to the requirement.

Cisco Certified Network Associate (CCNA) (200-301) Practice Tests

Cisco 200-301 Practice Test 12 - 10 Questions (Last Reviewed 27-Oct-2026)
Cisco 200-301 Practice Test 13 - 10 Questions (Last Reviewed 26-Oct-2026)
Cisco 200-301 Practice Test 14 - 10 Questions (Last Reviewed 25-Oct-2026)
Cisco 200-301 Practice Test 15 - 10 Questions (Last Reviewed 24-Oct-2026)
Cisco 200-301 Practice Test 16 - 10 Questions (Last Reviewed 23-Oct-2026)

Pass Your Cisco 200-301 Exam Easy!

Question 130

Explanation

Correct Answer

Incorrect Answers

Question 131

Explanation

Correct Answer

Incorrect Answers

Question 132

Explanation

Correct Answer

Incorrect Answers

Question 133

Explanation

Correct Answer

Incorrect Answers

Question 134

Explanation

Correct Answer

Incorrect Answers

Question 135

Explanation

Correct Answer

Incorrect Answers

Question 136

Explanation

Correct Answer

Incorrect Answers

Question 137

Explanation

Correct Answer

Incorrect Answers

Question 138

Explanation

Correct Answer

Incorrect Answers

Question 139

Explanation

Correct Answer

Incorrect Answers

Question 140

Explanation

Correct Answer

Incorrect Answers

Cisco Certified Network Associate (CCNA) (200-301) Practice Tests