Cisco 200-301 Practice Test 26

Question 250

Two endpoints communicate directly using IPsec ESP transport mode rather than tunnel mode. Which packet property distinguishes this from site-to-site tunnel encapsulation?

Transport mode is an alternative to IPsec and uses only NAT to hide data.
Transport mode generally retains the original outer IP header while protecting upper-layer payload.
Transport mode always creates a new separate outer IP header around the entire original packet.
Transport mode disables integrity and encryption in every ESP configuration.

Explanation

Correct Answer

IPsec ESP transport mode protects the payload of an IP packet while keeping the original header as the network-layer outer header. Tunnel mode adds encapsulation around the whole inner packet.

Incorrect Answers

Transport mode is part of IPsec and uses negotiated security associations. NAT alone is not a cryptographic replacement.

The new outer IP header is characteristic of tunnel mode, not the transport-mode distinction requested.

ESP can provide confidentiality and integrity as configured in either mode; choosing transport mode does not prohibit those protections.

Question 251

An engineer needs to add a static route to every host in the remote 172.19.44.0/23 network through 192.0.2.2. Which prefix mask must be used in the route?

255.255.255.0, because the third octet is sufficient to identify every host in the two-subnet block.
255.255.255.255, because a remote network route must identify a single next-hop host.
255.255.254.0, because /23 includes adjacent 172.19.44 and 172.19.45 subnets.
255.255.252.0, because /22 is required to cover only the two third-octet values.

Explanation

Correct Answer

A /23 network mask covers 512 addresses across third-octet values 44 and 45; the route's destination and mask must match that network, with a separately reachable next hop.

Incorrect Answers

A /24 would include only 172.19.44.0 through 172.19.44.255, omitting the adjacent 45 subnet that the engineer explicitly wants to reach.

A /32 mask identifies one host destination, not the complete destination subnet. The next hop is provided separately from this prefix selection.

A /22 covers four contiguous third-octet values and can inadvertently match other remote networks; the requested destination needs only two /24 equivalents.

Question 252

A branch office uses one broadband router and one provider circuit for all cloud application access. The network diagram includes two access switches but no alternate WAN service. What single failure still interrupts external connectivity?

Failure of the single ISP circuit or its WAN termination, because the branch has no second upstream path.
Failure of a single DNS response always proves the provider link has physically failed.
Failure of one wireless AP necessarily disconnects wired hosts connected directly to the routers.
Failure of one user access switch always disconnects every branch employee even when the second switch remains active.

Explanation

Correct Answer

Local access redundancy does not remove a single-homed uplink dependency. An ISP circuit or terminating router failure can isolate the entire branch from external services.

Incorrect Answers

DNS resolution failures can make applications inaccessible while the provider link remains operational; distinguish name resolution from the physical uplink.

An AP outage primarily affects associated wireless clients. It does not automatically disconnect separately wired endpoints or prove WAN link failure.

A failure on one access switch impacts its attached users, but other users on the second switch may continue to reach the shared router.

Question 253

A WLAN engineer must observe neighboring channels, detect rogue access points, and collect RF measurements without serving regular client traffic from one dedicated AP. Which AP operating mode is appropriate?

FlexConnect mode, because locally switched clients always imply dedicated RF-only monitoring.
Local mode, because providing the primary production SSID is necessary to collect only rogue information.
Sniffer mode, because sending captures to a packet analyzer automatically makes the AP a broad rogue-monitoring service.
Monitor mode, where the radio scans and reports wireless conditions rather than accepting ordinary client associations.

Explanation

Correct Answer

Monitor mode is intended for off-channel scanning and RF security monitoring, including rogue detection, without normal client service on that radio.

Incorrect Answers

FlexConnect changes client data forwarding behavior in branch deployments; it is not the AP role specifically dedicated to RF scans.

Local mode normally services clients and may perform background scanning, but it does not dedicate the AP to the stated scan-only task.

Sniffer mode captures frames for packet analysis, but its narrow capture workflow is distinct from the requested general monitor-mode RF scanning role.

Question 254

A campus WAN interface carries interactive voice calls and bulk nightly backups. At congestion, voice packets require low delay and jitter, while backup traffic can tolerate queuing. Which QoS treatment best fits voice?

Prioritize the bulk backup class above voice because larger packets require more buffer memory.
A bounded strict-priority queue for classified voice traffic, with other classes allocated fair bandwidth.
Place voice in the same default FIFO queue as backups and rely on fast links to prevent delay.
Use random early detection on only the voice class so calls experience early packet loss before backup traffic.

Explanation

Correct Answer

Low-latency priority scheduling gives correctly marked voice packets prompt service during contention while protecting other classes with a configured bound.

Incorrect Answers

Backups are comparatively tolerant of queuing and should not preempt the strict voice latency requirement simply because their frames are large.

FIFO allows large backup packets to delay time-sensitive voice under congestion, producing jitter even when total average throughput looks acceptable.

Random early detection is primarily a congestion-avoidance technique and intentionally discards packets; it is not a substitute for predictable priority servicing.

Question 255

A company deploys ten nearly identical branch router configurations each month. Manual CLI entry frequently misses one QoS policy and delays rollout. What automation property most directly reduces the deployment time and drift?

A shared document of past CLI commands without an automated application or validation mechanism.
Increasing router CPU capacity to accelerate the human entry of configuration commands.
Reusable parameterized configuration templates with validated variables and repeatable deployment execution.
A dashboard that visualizes link utilization but never applies an intended configuration to new routers.

Explanation

Correct Answer

Templates encode common QoS and interface intent once while branch-specific variables are supplied per site; automated application and checks reduce repeated typing errors.

Incorrect Answers

A command reference is useful guidance, but technicians must still enter, order and verify every line manually, preserving the observed drift risk.

Faster network processing does not reduce the human work of manually entering branch-specific commands or prevent missing policy statements.

Monitoring reveals operational state after deployment; it does not itself make the initial configurations consistent or automate their application.

Question 256

A LAN uses HSRP for a virtual gateway address, and both routers connect upstream through the same sole ISP circuit. What does this design guarantee and fail to guarantee?

Gateway redundancy if a participating router fails, but not upstream circuit redundancy when the shared ISP connection fails.
Automatic rerouting around every WAN failure without configured alternative routed paths.
Redundant DNS resolution because HSRP advertises two independent name servers to clients.
Protection from all provider outages because the virtual gateway moves to the surviving router.

Explanation

Correct Answer

An FHRP supplies a resilient first-hop IP/MAC endpoint, allowing hosts to keep their gateway when one gateway router fails. It cannot create a second provider path.

Incorrect Answers

First-hop redundancy governs LAN gateway ownership, while alternate WAN routing requires distinct paths and forwarding configuration beyond the FHRP group.

HSRP has no inherent DNS server advertisement or name-resolution redundancy function; its scope is host default-gateway reachability.

A shared WAN circuit remains a single failure domain even with two gateway devices; virtual IP failover cannot repair an unavailable provider link.

Question 257

A switch access port must accept only one approved workstation MAC address and reject extra devices. Which port-security configuration sets the permitted address count?

Configure the VLAN allowed list to one VLAN, because that permits only one workstation MAC address.
Set spanning-tree portfast on the port, because it restricts the number of learned endpoint MAC addresses.
Increase the MAC-address table aging timer, because a longer timer guarantees only one device can transmit.
Set switchport port-security maximum 1 on the access port, with appropriate learning and violation handling.

Explanation

Correct Answer

The port-security maximum limits the number of permitted secure MAC addresses learned or configured on the specific port. Configure the intended enforcement mode as well.

Incorrect Answers

A single access VLAN groups traffic logically but can contain many MAC addresses; VLAN membership does not establish one-host port security.

PortFast speeds a host-facing STP transition and does not set a per-port secure MAC address limit; another endpoint could still connect.

Aging controls how learned addresses expire, not how many distinct endpoint identities a port may accept simultaneously.

Question 258

A router access control entry will match the 192.168.84.0/22 subnet. Which wildcard mask is the binary inverse of its 255.255.252.0 subnet mask?

255.255.252.0, because wildcard masks and subnet masks are interchangeable in Cisco ACL syntax.
0.0.3.255, allowing variation in the bottom two bits of the third octet and all fourth-octet bits.
0.0.0.255, because the wildcard must always match a single /24.
0.0.7.255, because a /22 wildcard covers eight consecutive /24 networks.

Explanation

Correct Answer

Subtract each subnet-mask octet from 255: 255−252 equals 3, yielding 0.0.3.255 for the /22 matching range.

Incorrect Answers

An ACL wildcard uses zero bits for required matches and one bits for variation; repeating the subnet mask reverses the intended semantics.

A 0.0.0.255 wildcard matches just one /24, which is narrower than the four /24-equivalent blocks in a /22.

A third-octet wildcard of 7 covers eight /24 equivalents and corresponds to a /21, making the ACL broader than requested.

Question 259

A host in VLAN 10 at 10.10.10.20/24 must contact a server in VLAN 20 at 10.10.20.30/24. Both access ports attach to the same Layer 2 switch, with no routed interfaces configured. What capability is missing?

Additional switch CAM table capacity to forward directly between IP subnets using only Ethernet MAC learning.
A larger DHCP lease timer to let the host discover the remote server without a gateway.
Inter-VLAN routing via a Layer 3 gateway such as a router subinterface or routed switch SVI.
A common VLAN name on the switch while keeping the ports in distinct VLAN IDs and different subnets.

Explanation

Correct Answer

Different IP subnets and VLAN broadcast domains require a Layer 3 forwarding decision at an authorized gateway before packets can reach the other network.

Incorrect Answers

An Ethernet switch learns MAC destination locations inside a VLAN; expanding CAM memory does not route traffic between different VLAN interfaces.

DHCP lease duration controls address assignment lifetime and does not create a packet-forwarding path between separate IP subnets.

Descriptive VLAN names do not combine distinct VLAN IDs or supply routing; each interface remains isolated at Layer 2 absent a gateway.

Question 260

Two OSPF routes advertise the same 10.88.0.0/16 prefix, are both intra-area, and have working next hops. Path A has interface costs 10 + 15; Path B costs 5 + 10. Which TWO statements correctly predict the route selection? (Select TWO.)

The path with cost 25 wins because routers always prefer routes containing more expensive interfaces.
The path with total OSPF cost 15 is preferred over total cost 25 for this equal-length intra-area destination.
The route with the larger last-hop interface speed necessarily wins, without accounting for all upstream interface costs.
Administrative distance alone decides between two routes from the same OSPF process, ignoring their distinct path costs.
If the two routes instead had equal total OSPF cost and equivalent type, both could be eligible for equal-cost multipath forwarding.

Explanation

Correct Answers

OSPF computes a path metric by summing relevant interface costs; for equivalent route type and prefix, lower accumulated cost is the preferred route.

With equal eligible OSPF costs, many Cisco devices can install multiple equal-cost next hops if ECMP limits permit; route type and destination remain matching.

Incorrect Answers

OSPF does not seek high cumulative cost. The 25-cost route loses to a viable 15-cost path for the same OSPF destination.

A single fast link does not establish total route cost. OSPF accumulates the relevant link/interface costs across the complete candidate path.

Administrative distance selects between route sources, such as OSPF versus static; paths within one OSPF calculation are ranked by their routing metric.

Cisco Certified Network Associate (CCNA) (200-301) Practice Tests

Cisco 200-301 Practice Test 24 - 10 Questions (Last Reviewed 15-Oct-2026)
Cisco 200-301 Practice Test 25 - 10 Questions (Last Reviewed 14-Oct-2026)
Cisco 200-301 Practice Test 26 - 10 Questions (Last Reviewed 13-Oct-2026)
Cisco 200-301 Practice Test 27 - 10 Questions (Last Reviewed 12-Oct-2026)
Cisco 200-301 Practice Test 28 - 10 Questions (Last Reviewed 11-Oct-2026)

Pass Your Cisco 200-301 Exam Easy!

Question 250

Explanation

Correct Answer

Incorrect Answers

Question 251

Explanation

Correct Answer

Incorrect Answers

Question 252

Explanation

Correct Answer

Incorrect Answers

Question 253

Explanation

Correct Answer

Incorrect Answers

Question 254

Explanation

Correct Answer

Incorrect Answers

Question 255

Explanation

Correct Answer

Incorrect Answers

Question 256

Explanation

Correct Answer

Incorrect Answers

Question 257

Explanation

Correct Answer

Incorrect Answers

Question 258

Explanation

Correct Answer

Incorrect Answers

Question 259

Explanation

Correct Answer

Incorrect Answers

Question 260

Explanation

Correct Answers

Incorrect Answers

Cisco Certified Network Associate (CCNA) (200-301) Practice Tests