Cisco 200-301 Practice Test 23

Question 220

A branch router has a static `0.0.0.0/0` route toward its ISP and no dynamic route for a remote website prefix. Once the next hop resolves and no specific route matches, what path is used?

The installed default static route toward the ISP.
The router must discard packets because default routes cannot be static.
The DNS recursive resolver as a packet-level next hop without routing.
The local VLAN 10 connected route, regardless of website address.

Explanation

Correct Answer

A default route matches any IPv4 destination but is selected only when no longer-prefix entry applies. It sends unknown destinations toward the configured ISP next hop.

Incorrect Answers

IPv4 default routes can be configured manually with static syntax and commonly provide branch Internet egress when valid.

DNS provides name-to-IP resolution. Once the destination address is known, the router uses the routing table rather than sending every packet to a DNS resolver.

A connected VLAN route matches only its local prefix and is not a catch-all for arbitrary Internet destinations.

Question 221

A Mac laptop joins a campus network. It has a usable 192.168.28.55 address but cannot reach 198.51.100.10 by IP, while local hosts work. Where should the technician inspect its routing information?

Change its SSID display name and assume routing is fixed.
Clear only the Safari browser cache and stop testing.
Modify a DNS search suffix without checking the numeric IP route.
Inspect macOS network route/default gateway information, for example with `netstat -rn` or route commands.

Explanation

Correct Answer

The symptoms separate local IP connectivity from off-subnet routing. macOS route inspection can show whether a correct default gateway or specific route exists.

Incorrect Answers

SSID names affect wireless network identification; they do not themselves install an IP default route or repair gateway ARP resolution.

Browser cache affects web content behavior but cannot fix a missing IP next hop to a numeric external address. Test the network stack directly.

DNS suffix changes influence name lookup, not reachability of an already supplied numeric IPv4 destination. Check routing first.

Question 222

A WLAN profile exists with the right SSID and WPA2 settings, but no clients can see it. The controller's GUI shows it administratively disabled and mapped to a retired interface group. Which two settings need review before testing association?

Raise transmit power without correcting the interface mapping.
Enable the WLAN and bind it to the correct supported interface/VLAN group.
Increase the DHCP lease duration without enabling the WLAN.
Rename the SSID only while leaving its administrative state disabled.

Explanation

Correct Answer

An administratively disabled WLAN will not serve clients as expected. Enabling it and selecting the intended policy/interface mapping are prerequisites before normal association tests.

Incorrect Answers

RF power can affect coverage once the WLAN is active, but it does not repair a disabled profile or incorrect controller-to-VLAN mapping.

DHCP duration matters only after clients successfully connect and acquire a lease. It cannot make an administratively disabled WLAN advertise itself.

A new name cannot override a disabled WLAN state or move traffic from a retired interface. Both explicit configuration problems remain.

Question 223

Two FHRP routers serve the same office VLAN. The active router suddenly loses power and the standby has healthy LAN and upstream connectivity. What is the intended first-hop result?

All client IP addresses must be renumbered to the standby's physical subnet.
Internet NAT pools automatically select a new client gateway.
The standby assumes virtual gateway forwarding after protocol failure detection without clients changing their gateway IP.
The backup becomes a DNS server instead of a default gateway.

Explanation

Correct Answer

First-hop redundancy uses a shared virtual gateway identity so a healthy standby can take responsibility after the active fails. Hosts retain their configured IP next hop.

Incorrect Answers

Readdressing clients is exactly the disruption a virtual FHRP gateway is designed to avoid. The protocol changes router ownership instead.

NAT pools translate address mappings and do not signal FHRP takeover or update a user's default gateway IP configuration.

DNS resolves names and is unrelated to taking over the virtual IP/MAC forwarding identity when the first-hop router fails.

Question 224

A Cisco router has `ntp server 192.0.2.20` configured. An auditor wants to verify whether it has actually synchronized to this server rather than merely storing the configuration line. Which output should be checked?

`show ntp status` and `show ntp associations` for synchronization and selected peer.
`show mac address-table` for network clock source selection.
`show interfaces trunk` for IP time synchronization.
`show access-lists` for line-number matches only.

Explanation

Correct Answer

NTP status and association commands expose synchronization state, peers and sometimes reachability/stratum indicators, distinguishing operational sync from intended settings.

Incorrect Answers

A MAC address table holds Layer 2 forwarding entries and cannot report NTP stratum, selected peer or clock sync state.

Trunk output displays VLAN carriage; it does not prove the router's NTP clock is synchronized with the specified time server.

ACL output can help diagnose blocked NTP packets in a separate step, but does not directly report that the router selected a valid time peer.

Question 225

An edge router sees repeated failed password attempts on its VTY lines. Operations needs to throttle new login attempts after a defined burst without disabling legitimate access forever. Which IOS feature is relevant?

Change the OSPF router ID after every failed attempt.
Set the console terminal width to a smaller number.
Increase DHCP server lease expiration to 24 hours.
Configure a supported `login block-for` policy with appropriate attempts and quiet-period limits.

Explanation

Correct Answer

IOS login blocking can impose a quiet period after repeated failed authentication attempts, reducing brute-force exposure. Tune policy and monitoring to avoid administrative lockout.

Incorrect Answers

OSPF router ID is a routing protocol identifier; changing it would disrupt adjacencies rather than control management login retries.

Console terminal width changes display formatting only and does not rate-limit VTY authentication requests from untrusted sources.

DHCP lease duration governs IP address allocation and has no role in throttling invalid CLI password attempts.

Question 226

A generative AI assistant suggests router configuration fixes from old incident notes. One suggestion would disable spanning tree on the production core, although the current topology has redundant Layer 2 loops. What safeguard is necessary?

Treat the assistant's prose as more authoritative than running configuration.
Validate generated recommendations against current topology, approved standards and human change control before execution.
Execute every highly confident AI suggestion immediately without testing.
Disable logs so the model's incorrect suggestion is not retained.

Explanation

Correct Answer

Generative models can produce fluent but unsupported configuration commands. Real topology evidence, simulation or change review must govern potentially disruptive actions.

Incorrect Answers

Running configuration and verified network state are authoritative operational facts, while a generated answer is only a recommendation requiring validation.

Model confidence is not proof that a suggested command is safe for the current network; disabling loop prevention could cause a campus-wide outage.

Logging and audit evidence help diagnose unsafe proposals and compare approvals. Disabling them conceals the cause without preventing a bad change.

Question 227

Two routers communicate on a configured point-to-point OSPFv2 link rather than an Ethernet broadcast segment. What adjacency behavior should an engineer expect?

Mandatory DR election based on highest IP address.
Router IDs must match for Full state.
Direct OSPF adjacency between peers without DR/BDR election on the point-to-point network type.
Neighbors remain permanently 2WAY because they are not on Ethernet.

Explanation

Correct Answer

Point-to-point OSPF network types do not use the broadcast DR/BDR mechanism. Compatible peers can form a full adjacency directly.

Incorrect Answers

DR election is a feature of relevant multiaccess network types and does not become mandatory for an explicitly point-to-point OSPF interface.

Router IDs should identify distinct routers; equal IDs can cause OSPF conflicts. They are not required to match for adjacency.

A correctly configured point-to-point adjacency can reach Full. Stable 2WAY between DROTHER peers applies to certain broadcast contexts, not this link.

Question 228

A client sends a TCP SYN to a web server. A network analyst then observes SYN-ACK and final ACK before application data begins. Which mechanism is shown?

TCP three-way connection establishment with synchronized sequence state.
DHCP discovery-offer negotiation of an IP lease.
An Ethernet ARP probe for the default gateway MAC.
UDP's connection handshake with no acknowledgement.

Explanation

Correct Answer

TCP uses SYN, SYN-ACK and ACK to establish state and acknowledge initial sequence values before an ordinary connection carries ordered data.

Incorrect Answers

DHCP DORA allocates network configuration to hosts, not TCP sequence space between a web client and server.

ARP resolves local IPv4 neighbor MAC addresses and does not establish an end-to-end TCP transport session with sequence numbers.

UDP is connectionless and has no standardized transport handshake with SYN/ACK flags. Its applications can implement separate control protocols.

Question 229

On an access switch, a new workstation should be in VLAN 48 but receives an address from VLAN 1. The cable is good. What simple verification identifies its configured VLAN membership?

Inspect the workstation’s DHCP lease and assume its assigned IPv4 address identifies the actual configured access VLAN on the switch.
Run show interfaces trunk for the uplink and infer that an allowed VLAN 48 proves the workstation’s Gi access port belongs to VLAN 48.
Inspect only the MAC address table for the workstation and assume any learned source MAC is automatically assigned to the desired VLAN 48.
Inspect `show vlan brief` and the port's switchport access VLAN configuration.

Explanation

Correct Answer

The switch VLAN table and interface switchport mode reveal whether the workstation port is assigned to VLAN 48 or left at default VLAN 1.

Incorrect Answers

A DHCP lease reveals the network of the answer received, not necessarily the intended switchport access VLAN. Inspect the local VLAN assignment directly.

A trunk can permit VLAN 48 while the end-host access interface is still assigned to VLAN 1. Verify the actual switchport access setting.

A learned MAC can exist in the wrong access VLAN. The explicit access VLAN configuration or show vlan brief must be checked to diagnose the mismatch.

Question 230

A security architecture team wants a network device to prove its identity using a certificate rather than a shared reusable plaintext password. Which authentication property is relevant?

A common SNMPv2c community string uniquely authenticates every device.
Certificate-based authentication can establish identity using validated trust chains and proof of private-key possession.
A device's hostname alone is cryptographic identity proof.
An unauthenticated ARP reply replaces a certificate chain.

Explanation

Correct Answer

Certificate authentication binds an identity to a public key and depends on validation of trust, validity and use constraints. A peer proves control of the corresponding private key.

Incorrect Answers

Shared SNMP community strings provide weak group-style access control and do not uniquely prove device identity or validate certificate ownership.

Hostnames can be spoofed or changed and are not cryptographic proof of an authorized device without a trusted binding mechanism.

ARP provides local address resolution and is not a verified public-key identity protocol. A spoofed ARP reply cannot establish certificate trust.

Cisco Certified Network Associate (CCNA) (200-301) Practice Tests

Cisco 200-301 Practice Test 21 - 10 Questions (Last Reviewed 18-Oct-2026)
Cisco 200-301 Practice Test 22 - 10 Questions (Last Reviewed 17-Oct-2026)
Cisco 200-301 Practice Test 23 - 10 Questions (Last Reviewed 16-Oct-2026)
Cisco 200-301 Practice Test 24 - 10 Questions (Last Reviewed 15-Oct-2026)
Cisco 200-301 Practice Test 25 - 10 Questions (Last Reviewed 14-Oct-2026)

Pass Your Cisco 200-301 Exam Easy!

Question 220

Explanation

Correct Answer

Incorrect Answers

Question 221

Explanation

Correct Answer

Incorrect Answers

Question 222

Explanation

Correct Answer

Incorrect Answers

Question 223

Explanation

Correct Answer

Incorrect Answers

Question 224

Explanation

Correct Answer

Incorrect Answers

Question 225

Explanation

Correct Answer

Incorrect Answers

Question 226

Explanation

Correct Answer

Incorrect Answers

Question 227

Explanation

Correct Answer

Incorrect Answers

Question 228

Explanation

Correct Answer

Incorrect Answers

Question 229

Explanation

Correct Answer

Incorrect Answers

Question 230

Explanation

Correct Answer

Incorrect Answers

Cisco Certified Network Associate (CCNA) (200-301) Practice Tests