Question 230
A security architecture team wants a network device to prove its identity using a certificate rather than a shared reusable plaintext password. Which authentication property is relevant?
- A common SNMPv2c community string uniquely authenticates every device.
- Certificate-based authentication can establish identity using validated trust chains and proof of private-key possession.
- A device's hostname alone is cryptographic identity proof.
- An unauthenticated ARP reply replaces a certificate chain.
Explanation
Correct Answer
B:Certificate authentication binds an identity to a public key and depends on validation of trust, validity and use constraints. A peer proves control of the corresponding private key.
Incorrect Answers
A:Shared SNMP community strings provide weak group-style access control and do not uniquely prove device identity or validate certificate ownership.
C:Hostnames can be spoofed or changed and are not cryptographic proof of an authorized device without a trusted binding mechanism.
D:ARP provides local address resolution and is not a verified public-key identity protocol. A spoofed ARP reply cannot establish certificate trust.
Question 231
A manufacturing router has an OSPF-learned route to 10.0.8.0/24 at administrative distance 110. An operator also installs an equal-prefix static route at distance 150 as a backup, and both next hops can currently be resolved. Which route should remain active while OSPF is healthy?
- The static route, because manual configuration overrides all learned paths regardless of its configured distance.
- Both route sources always load-balance traffic because they advertise exactly the same /24 prefix.
- The OSPF route with administrative distance 110; the distance-150 static remains a floating backup candidate.
- The route with the smaller physical interface number because identical route prefixes make administrative distance irrelevant.
Explanation
Correct Answer
C:Administrative distance expresses local source preference for equal-prefix route candidates. Here OSPF distance 110 is lower than the configured floating static distance 150, so OSPF normally remains installed until withdrawal or loss of next-hop reachability.
Incorrect Answers
A:Manual routes are often preferred by default, but this operator explicitly assigned the static distance 150. For otherwise valid equal-prefix sources, IOS normally installs the lower-distance OSPF candidate at 110 while preserving the static as a possible backup.
B:A matching destination prefix is necessary for comparing route-source preference but does not automatically establish equal-cost multipath. The configured administrative distances differ substantially, so only the lower-distance eligible source normally enters the active routing table.
D:Physical interface numbering is not used to arbitrate between otherwise valid routing sources for the same prefix. Their administrative distance values decide which is preferred for installation, and the higher-distance static is deliberately held in reserve.
Question 232
A company uses 192.168.44.0/24 for lab hosts and wants to know whether it is within RFC1918 private IPv4 space. Which statement is accurate?
- 192.168.44.0/24 belongs to private 192.168.0.0/16 address space.
- 192.168.44.0/24 is IPv6 unique-local addressing.
- It is a globally routable IPv4 prefix by default on the public Internet.
- All 192.x.x.x prefixes are public and RFC1918 excludes 192.168.
Explanation
Correct Answer
A:RFC1918 reserves 192.168.0.0/16 for private IPv4 networks. The lab /24 is a subnet within this larger private block.
Incorrect Answers
B:IPv6 unique-local addresses use fc00::/7 with colon notation. The provided dotted-decimal range is IPv4 and belongs to RFC1918 private space.
C:Private address ranges are not ordinarily advertised as globally routed destinations across the public Internet. Outbound NAT or other design may be required for external connectivity.
D:The entire 192/8 space is not private; the defined 192.168/16 subset is. Rejecting it based on the first octet misunderstands reserved boundaries.
Question 233
Two switches support LLDP, but a technician receives no neighbor information on Gi1/0/10. Global LLDP is enabled, while this interface has transmission and reception disabled. What change allows normal discovery?
- Increase DHCP address lease times for connected stations.
- Configure a new static default route on every host.
- Enable spanning-tree PortFast on a switch-to-switch trunk.
- Enable LLDP transmit and receive on the intended neighboring interface as allowed by policy.
Explanation
Correct Answer
D:LLDP neighbor entries depend on advertisements being sent and processed on the link. Both transmit and receive settings are relevant to full reciprocal discovery.
Incorrect Answers
A:DHCP leases manage endpoint addresses, not LLDP information advertisements over the adjacent Ethernet link.
B:Routing table changes on hosts do not enable LLDP Layer 2 TLV exchange between directly connected switchports.
C:PortFast on an interswitch trunk may be inappropriate for loop prevention and does not enable LLDP transmit/receive disabled at the interface.
Question 234
Network monitoring polls an interface's byte counter through SNMP and needs to identify the correct managed object consistently across switches. What identifies that object in the MIB hierarchy?
- The DHCP client's offered address only.
- Its Object Identifier (OID) within the MIB definition.
- The access VLAN's spanning-tree bridge priority.
- The router's longest-prefix forwarding entry.
Explanation
Correct Answer
B:An SNMP OID names a managed object such as interface counters within a MIB tree. The manager uses it to retrieve or interpret telemetry values.
Incorrect Answers
A:DHCP allocations describe client addresses and cannot identify an SNMP interface statistics object in the managed object naming hierarchy.
C:STP priority governs bridge-root election on Layer 2 segments and is not an identifier of an SNMP counter object.
D:A route prefix selects a forwarding path for an IP destination, not the MIB identity of a device management variable.
Question 235
A controller returns `{"interfaces":[{"name":"Gi1/0/1","up":true},{"name":"Gi1/0/2","up":false}]}` to an automation tool. How should the client access the second interface's operational state?
- Read the root object as a string and compare its entire content to true.
- Interpret array index 1 as the first interface and report true.
- Parse the interfaces array and read element index 1's Boolean up value, which is false.
- Expect both interface records at the same object key named up in the root.
Explanation
Correct Answer
C:The interfaces key maps to a JSON array with zero-based positions. Its second object has up set to the Boolean false, not a quoted string.
Incorrect Answers
A:JSON objects and arrays have structure; treating the entire document as a single string discards the nested interface field that must be evaluated.
B:Most client languages use zero-based array indexing, so index 1 is the second element. The first is index 0 and has a different state.
D:Each interface object contains its own up key. There is no single root up key that represents both independent port states.
Question 236
A static route to 10.31.0.0/16 uses next hop 192.0.2.99, but the router has no connected or learned path to 192.0.2.99. The static statement appears in the configuration, not the active routing table. Why?
- The next-hop route cannot be resolved, so the static route cannot become a usable installed path.
- All static routes must use OSPF administrative distance 110.
- A route to a remote prefix never requires next-hop resolution.
- The router needs a larger DHCP pool before installing static routes.
Explanation
Correct Answer
A:IOS normally installs a next-hop static route only when forwarding resolution is possible through a usable path. The missing route to 192.0.2.99 blocks that prerequisite.
Incorrect Answers
B:Static routes have configurable administrative distance and do not require OSPF's default preference 110. The failure here is unresolved reachability.
C:The router must ultimately determine an outgoing adjacency to forward packets. An unreachable next hop cannot be ignored simply because the route statement exists.
D:DHCP pool capacity relates to leased endpoint addresses, not whether a router can resolve the configured IP next hop for a static route.
Question 237
An auditor wants a network device to record when a privileged engineer ran commands and which authenticated account made the changes. Which AAA function is most relevant?
- Authorization only, which decides permitted actions but need not record every executed command.
- Authentication only, which determines who logged in but stores no subsequent commands.
- IPsec tunnel encryption between offices as the audit record.
- Accounting with command/session records and timestamps tied to user identities.
Explanation
Correct Answer
D:AAA accounting records connection and command activity with associated identities and time data, enabling post-change reconstruction when configured with a suitable backend.
Incorrect Answers
A:Authorization enforces which actions are allowed; logging them is a distinct accounting function that must be configured rather than assumed.
B:Authentication validates the user's identity but does not necessarily persist a complete record of commands the user performed after login.
C:IPsec protects data across a network tunnel but is not a device command-history or user session accounting mechanism.
Question 238
A router must create an IPv6 static route using neighbor next hop fe80::2 on GigabitEthernet0/0. The neighbor address is link-local, and the router has multiple interfaces. What additional information should the command include?
- Put ff02::1 as the next hop to reach every IPv6 router.
- Specify the outgoing interface along with the link-local next-hop address.
- Use the same fe80::2 without an interface, assuming it is globally unique.
- Translate the fe80 address into an IPv4 dotted mask.
Explanation
Correct Answer
B:Link-local addresses are valid only on a particular interface scope, so IOS needs the egress interface to resolve an IPv6 static route via a link-local next hop.
Incorrect Answers
A:ff02::1 is the link-local all-nodes multicast group, not a unique next-hop router address suitable for this static route.
C:The same fe80::2 can appear on different links. Without interface context, the router cannot infer which neighbor adjacency should carry the packet.
D:IPv4 dotted masks do not encode IPv6 link-local interface scope and cannot convert an IPv6 neighbor literal into a routable IPv4 next hop.
Question 239
A controller-managed AP associates to its controller but clients in VLAN 80 lose DHCP after a switch migration. The AP management VLAN remains reachable, while the client VLAN was removed from its trunk. What should be corrected?
- Change the controller's password because the AP is already joined.
- Disable the WLAN encryption key to restore Layer 2 connectivity.
- Permit the intended client VLAN on the required AP/switch trunk while keeping management connectivity intact.
- Increase the wireless radio transmit power to fix DHCP.
Explanation
Correct Answer
C:Management and client data VLANs can traverse different mappings; controller reachability alone does not prove the client VLAN is carried. Fix the missing tagged path.
Incorrect Answers
A:The AP is already registered and managed, so changing authentication credentials would not restore a client VLAN omitted from the Ethernet trunk.
B:Disabling security introduces a new authentication flaw and does not repair switch-side allowed-VLAN configuration for clients who already associate.
D:RF power affects client signal quality and cannot add an excluded 802.1Q VLAN on a wired path carrying DHCP traffic.
Question 240
An OSPF deployment uses reference bandwidth 1000 Mbps. A Gigabit interface has a 1-Gb speed and a 100-Mb interface has a 100-Mb speed. Which default cost relation follows from that reference, ignoring minimum-clamp issues?
- The 1-Gb interface cost is 1 and the 100-Mb interface cost is 10.
- Both cost 1000 because the reference value is copied unchanged.
- Interface cost is determined solely by the router ID.
- The 1-Gb interface cost is 10 and the 100-Mb cost is 1.
Explanation
Correct Answer
A:OSPF interface cost commonly derives from reference bandwidth divided by interface bandwidth. 1000/1000 yields 1 and 1000/100 yields 10 for this setup.
Incorrect Answers
B:Reference bandwidth sets the numerator; it is not simply used as every interface's cost regardless of link speed.
C:Router ID distinguishes routers and can break some election ties; it does not determine OSPF cost derived from bandwidth settings.
D:The lower-bandwidth link generally receives a higher path cost, so reversing 1 and 10 contradicts the stated reference/bandwidth calculation.
Cisco Certified Network Associate (CCNA) (200-301) Practice Tests