Cisco 200-301 Practice Test 27

Question 260

Two OSPF routes advertise the same 10.88.0.0/16 prefix, are both intra-area, and have working next hops. Path A has interface costs 10 + 15; Path B costs 5 + 10. Which TWO statements correctly predict the route selection? (Select TWO.)

The path with cost 25 wins because routers always prefer routes containing more expensive interfaces.
The path with total OSPF cost 15 is preferred over total cost 25 for this equal-length intra-area destination.
The route with the larger last-hop interface speed necessarily wins, without accounting for all upstream interface costs.
Administrative distance alone decides between two routes from the same OSPF process, ignoring their distinct path costs.
If the two routes instead had equal total OSPF cost and equivalent type, both could be eligible for equal-cost multipath forwarding.

Explanation

Correct Answers

OSPF computes a path metric by summing relevant interface costs; for equivalent route type and prefix, lower accumulated cost is the preferred route.

With equal eligible OSPF costs, many Cisco devices can install multiple equal-cost next hops if ECMP limits permit; route type and destination remain matching.

Incorrect Answers

OSPF does not seek high cumulative cost. The 25-cost route loses to a viable 15-cost path for the same OSPF destination.

A single fast link does not establish total route cost. OSPF accumulates the relevant link/interface costs across the complete candidate path.

Administrative distance selects between route sources, such as OSPF versus static; paths within one OSPF calculation are ranked by their routing metric.

Question 261

A user PC opens a web page hosted on an internal application server. The PC issues requests while the server listens on an HTTPS port and returns content. Which device roles fit the transaction?

Both hosts act only as routers because they exchange IPv4 packets over the LAN.
The PC must be the server because it initiates the TCP connection to the listening application.
The HTTPS server becomes a Layer 2 switch when replying to the client through an Ethernet link.
The PC is a client of the web service, and the application host provides the server role.

Explanation

Correct Answer

The request initiator consumes the service while the listening application provides the requested resource; these client/server roles describe the application behavior.

Incorrect Answers

End systems can exchange routed IP packets without becoming intermediate routing devices; application roles are independent of their IP protocol use.

Connection initiation is typical client behavior here, not evidence that the PC is hosting the requested HTTPS service.

Sending Ethernet frames does not turn a web application into a switch. It remains a service endpoint while network devices forward its traffic.

Question 262

Switches in several buildings need centralized user login for 802.1X access. The existing identity platform provides RADIUS policy and accounting. Which integration is most suitable?

Use SNMP read-only communities as login credentials, since monitoring polling replaces AAA authentication.
Configure network devices as RADIUS clients and point authentication requests to the authorized central AAA servers.
Configure only a local enable password on every switch, since that automatically authenticates endpoint users through central policy.
Disable 802.1X on switch access ports so that MAC learning becomes an equivalent identity authentication service.

Explanation

Correct Answer

RADIUS supports centralized network-access authentication, authorization attributes and accounting, making it a suitable backend for 802.1X authenticator switches.

Incorrect Answers

SNMP polling reads management data; community strings do not provide the 802.1X EAP/RADIUS authorization and accounting process.

An enable password affects network device administration and provides no per-endpoint identity decision against the central access policy.

Port MAC learning is ordinary Layer 2 forwarding state, not authentication of the user or device into the access network.

Question 263

A router has a connected route 10.22.6.0/24 through an up interface, and an administrator also configures ip route 10.22.6.0 255.255.255.0 192.0.2.9 with default AD 1. Which TWO statements are true while the connected interface is operational? (Select TWO.)

The static route wins because an explicit administrative route always overrides a directly connected interface regardless of distance.
The directly connected route normally wins the equal-prefix candidate comparison because connected AD 0 is lower than static AD 1.
OSPF metric cost automatically determines the winner even though neither candidate is learned by OSPF.
Both routes are always installed for per-packet load balancing despite having different administrative distances.
The configured static route can become relevant if the connected route is withdrawn and its static next hop remains resolvable.

Explanation

Correct Answers

Cisco route selection prefers the lower administrative distance for routes to an equal-length destination; connected AD 0 typically beats ordinary static AD 1.

If the connected network disappears from the RIB, a valid alternative static route may become active provided its next-hop resolution and interface states permit it.

Incorrect Answers

Explicit configuration does not override the basic AD ordering for equal-prefix connected and static routes, so the connected source normally remains active.

OSPF metrics are relevant to OSPF routes, not the comparison between a directly connected route and a locally configured static route.

Equal-cost multipath requires equal eligible forwarding costs and routes; the distinct connected and static administrative distances prevent automatic equal treatment.

Question 264

Fifteen office PCs with RFC1918 addresses access public HTTPS sites through one ISP-assigned IPv4 address. Sessions remain distinct even when two internal hosts choose the same source port. What translation feature enables this?

NAT overload/PAT, translating many inside local flows through one public inside global address with different transport ports.
IPv6 neighbor discovery, mapping the internal PCs to link-local addresses before sending to the Internet.
A Layer 2 VLAN trunk, adding Ethernet tags so external web servers distinguish private PC addresses.
Static one-to-one NAT, requiring a dedicated unique public IPv4 for every office host.

Explanation

Correct Answer

Port address translation tracks source and destination flow tuples and chooses public port mappings, letting many internal clients share one external IPv4 address.

Incorrect Answers

IPv6 NDP discovers on-link neighbors; it does not translate private IPv4 flows into publicly reachable IPv4 connection tuples.

VLAN tagging helps local switching across trunks; Internet services do not use these internal tags to route replies to private client addresses.

One-to-one static NAT consumes separate public mappings and is not the mechanism for simultaneous many-to-one translation of these sessions.

Question 265

A router uses stateless IPv4 extended ACLs, and a management PC 10.4.10.25 initiates HTTPS to 203.0.113.9. Security wants the request and legitimate reply allowed without broadly permitting inbound new sessions. Which TWO controls help meet that intent? (Select TWO.)

Apply only a deny any any statement on both interfaces, since the router automatically infers established connection state.
On the return path, use a suitable established TCP flag rule or explicit reverse-flow match with narrowly scoped endpoints, recognizing that a plain ACL is not a full stateful firewall.
Permit the outbound TCP request from the authorized PC to destination port 443 on the proper interface and direction.
Permit only inbound TCP packets whose destination port is 443 on the client-facing return path, without matching the server’s source 443 port.
Permit all inbound TCP connections from the Internet because replies must be indistinguishable from arbitrary new sessions.

Explanation

Correct Answers

Stateless filters do not maintain full connection state. A narrow reverse rule or established-bit heuristic can admit expected TCP reply packets but has recognized limitations.

An extended ACL can match the authorized source PC, destination host, TCP destination port 443, and interface direction without exposing other web destinations.

Incorrect Answers

A router ACL does not infer established sessions from a blanket deny. Without explicit matching permitted traffic or a separate stateful security feature, requests fail.

In a typical client-initiated HTTPS connection, the remote server replies FROM source port 443 TO the client ephemeral destination port. A return-path ACL matching destination 443 can miss those replies.

Permitting every inbound TCP source creates avoidable new inbound reachability and fails the stated restriction to authorized replies.

Question 266

A network monitoring client receives HTTP 404 for /api/devices/ABC and HTTP 429 after polling many devices per second. Which interpretation is correct?

Both errors mean the client has authenticated successfully and the requested action has already completed.
The 404 indicates the resource was not found at that route; 429 indicates too many requests or throttling, so inspect identity and retry limits appropriately.
Both errors indicate incorrect JSON syntax in a successful 200 response and require only modifying indentation.
The 404 proves the API is overloaded, while 429 means the requested device has no resource identifier.

Explanation

Correct Answer

HTTP 404 reports an absent or unavailable addressed resource, while 429 signals rate limiting; their distinct responses require different diagnostics.

Incorrect Answers

Neither error is proof of a completed business action. Check resource identity for 404 and backoff/Retry-After policy for 429.

JSON syntax errors generally produce other validation responses. Altering indentation cannot create a missing route or overcome rate limiting.

This reverses the status-code meanings and would send troubleshooting toward quota for a missing resource and toward identification for throttling.

Question 267

OSPF process 1 must include the point-to-point WAN interface 192.0.2.4/30 in area 0, without matching unrelated networks. Which network statement represents that interface subnet?

network 192.0.2.4 255.255.255.252 area 0, treating a subnet mask as an OSPF wildcard.
network 192.0.2.4 0.0.0.0 area 0, assuming the subnet address equals the interface host address.
network 192.0.2.4 0.0.0.3 area 0.
network 192.0.2.4 0.0.0.255 area 0, including every 192.0.2.x interface in the area.

Explanation

Correct Answer

The /30 wildcard is the inverse of 255.255.255.252, so 0.0.0.3 covers 192.0.2.4 through .7 and matches usable WAN hosts .5 and .6.

Incorrect Answers

Cisco OSPF network statements use wildcard masks, not netmasks. Entering 255.255.255.252 would match unintended address bits.

The interface has a usable host address such as .5 or .6; matching only .4 with wildcard zero would not activate the interface.

A 0.0.0.255 wildcard covers an entire /24 and can unintentionally enable OSPF on other interfaces with addresses in that block.

Question 268

A DNS service advertises one IPv6 address from two geographically separated sites, each with a valid route to the same prefix. Routing tends to carry a client to the closer available site. What address model is illustrated?

Anycast, with one address intentionally announced from multiple reachable service locations.
Broadcast, where an IPv6 packet reaches every node on all networks.
Multicast, where each packet is deliberately delivered to every subscribed server at both sites.
Unicast, where a particular address is necessarily assigned to only one device throughout the Internet.

Explanation

Correct Answer

Anycast addresses are shared by multiple service instances and routing selects an appropriate reachable instance rather than sending one request to all.

Incorrect Answers

IPv6 has no conventional broadcast addressing, and the stated service behavior is routed to one reachable site, not flooded to all nodes.

Multicast creates delivery to multiple receivers in a group, while anycast directs a particular flow toward a selected instance.

Ordinary unicast selects a specific endpoint; the distinguishing feature here is multiple sites intentionally advertising the same service address.

Question 269

An EtherChannel member on one switch has speed 1 Gbps but its paired member is forced to 100 Mbps. The bundle shows a suspended interface. Which mismatch should be fixed?

Configure a different access VLAN only on the suspended member, because unlike speed mismatches VLAN mismatch guarantees safe aggregation.
Increase the interface description length, because description text determines EtherChannel bundling eligibility.
Disable LACP on one side while leaving the other side active, because a protocol mismatch repairs negotiated membership.
Match member speed and duplex requirements for compatible EtherChannel formation on each intended link.

Explanation

Correct Answer

Member links intended for one bundle must satisfy compatible physical settings and EtherChannel parameters; speed mismatch can prevent successful aggregation.

Incorrect Answers

Incompatible VLAN or trunk settings can introduce another aggregation inconsistency rather than fixing the documented physical speed problem.

Descriptions are administrative metadata and do not affect whether switch ports can negotiate and carry an EtherChannel.

Disabling negotiation on one end is likely to create a new protocol mismatch; first align the physical member parameters and configuration.

Question 270

Privileged switch administrators repeatedly paste unverified configuration snippets from messages into live devices. Which security-awareness intervention is best targeted to this behavior?

Disabling all access VLANs to reduce the chance an administrator copies an unsafe command.
Role-based training and peer-reviewed change procedures focused on configuration provenance and privileged command risk.
Generic phishing awareness alone, without explaining device command review or change-control responsibilities.
Increasing switch log retention so unsafe configuration commands become safe to execute.

Explanation

Correct Answer

Training designed for privileged network operators should address trusted configuration sources, approval, testing and incident response for high-impact device changes.

Incorrect Answers

Shutting VLANs down disrupts service and is not an awareness strategy for changing administrator behavior and review processes.

Phishing education helps security literacy, but does not specifically teach secure device-change verification or the observed pasted command hazard.

Logs help reconstruct changes after the fact; they do not verify whether a command is safe before execution.

Cisco Certified Network Associate (CCNA) (200-301) Practice Tests

Cisco 200-301 Practice Test 25 - 10 Questions (Last Reviewed 14-Oct-2026)
Cisco 200-301 Practice Test 26 - 10 Questions (Last Reviewed 13-Oct-2026)
Cisco 200-301 Practice Test 27 - 10 Questions (Last Reviewed 12-Oct-2026)
Cisco 200-301 Practice Test 28 - 10 Questions (Last Reviewed 11-Oct-2026)
Cisco 200-301 Practice Test 29 - 10 Questions (Last Reviewed 10-Oct-2026)

Pass Your Cisco 200-301 Exam Easy!

Question 260

Explanation

Correct Answers

Incorrect Answers

Question 261

Explanation

Correct Answer

Incorrect Answers

Question 262

Explanation

Correct Answer

Incorrect Answers

Question 263

Explanation

Correct Answers

Incorrect Answers

Question 264

Explanation

Correct Answer

Incorrect Answers

Question 265

Explanation

Correct Answers

Incorrect Answers

Question 266

Explanation

Correct Answer

Incorrect Answers

Question 267

Explanation

Correct Answer

Incorrect Answers

Question 268

Explanation

Correct Answer

Incorrect Answers

Question 269

Explanation

Correct Answer

Incorrect Answers

Question 270

Explanation

Correct Answer

Incorrect Answers

Cisco Certified Network Associate (CCNA) (200-301) Practice Tests