Pass Your Cisco 200-301 Exam Easy!

Cisco 200-301 Exam Questions & Answers, Accurate & Verified By IT Experts

Instant Download, Free Fast Updates, 99.6% Pass Rate

200-301 Premium Bundle

$74.99

Cisco 200-301 Premium Bundle

200-301 Premium File: 760 Questions & Answers

Last Update: Sep 27, 2026

200-301 PDF Study Guide: 1969 Pages

200-301 Bundle gives you unlimited access to "200-301" files. However, this does not replace the need for a .vce exam simulator. To download VCE exam simulator click here
Cisco 200-301 Premium Bundle
Cisco 200-301 Premium Bundle

200-301 Premium File: 760 Questions & Answers

Last Update: Sep 27, 2026

200-301 PDF Study Guide: 1969 Pages

$74.99

200-301 Bundle gives you unlimited access to "200-301" files. However, this does not replace the need for a .vce exam simulator. To download your .vce exam simulator click here

Cisco 200-301 Practice Test 28

Question 270

Privileged switch administrators repeatedly paste unverified configuration snippets from messages into live devices. Which security-awareness intervention is best targeted to this behavior?

  1. Disabling all access VLANs to reduce the chance an administrator copies an unsafe command.
  2. Role-based training and peer-reviewed change procedures focused on configuration provenance and privileged command risk.
  3. Generic phishing awareness alone, without explaining device command review or change-control responsibilities.
  4. Increasing switch log retention so unsafe configuration commands become safe to execute.

Explanation

Correct Answer

B:

Training designed for privileged network operators should address trusted configuration sources, approval, testing and incident response for high-impact device changes.

Incorrect Answers

A:

Shutting VLANs down disrupts service and is not an awareness strategy for changing administrator behavior and review processes.

C:

Phishing education helps security literacy, but does not specifically teach secure device-change verification or the observed pasted command hazard.

D:

Logs help reconstruct changes after the fact; they do not verify whether a command is safe before execution.

Question 271

A backup static route to 10.6.0.0/16 should activate only when an OSPF route to the same prefix disappears. Which AD setting makes the static route floating relative to standard OSPF internal routes?

  1. Leave the static route at its default administrative distance of 1 so OSPF always wins.
  2. Set the OSPF process ID numerically above the static route administrative distance.
  3. Configure the static route administrative distance above OSPF's 110, such as 200.
  4. Set the floating static AD to 0 to give the dynamic route greater priority.

Explanation

Correct Answer

C:

A static route with AD greater than 110 loses to an available equal-prefix OSPF route but can enter the RIB when OSPF is withdrawn and its next hop is valid.

Incorrect Answers

A:

Default static AD 1 is more preferred than OSPF's 110, so it would normally displace the desired primary dynamic path.

B:

OSPF process identifiers distinguish routing processes locally; they are not administrative distances and do not control route-source preference.

D:

Lower administrative distance means higher preference. Zero would favor the static path instead of creating a standby route.

Question 272

A laptop moves from switch port Gi1/0/10 to Gi1/0/20, but traffic still briefly targets the old learned MAC-table interface. Which switch behavior eventually updates the forwarding entry?

  1. Source-MAC learning on the new ingress port and aging/removal of stale MAC-to-port entries.
  2. Recalculating the IPv4 subnet mask on all hosts updates the Layer 2 forwarding table.
  3. Renaming the access VLAN forces the switch to know the physical location of every endpoint.
  4. ARP aging alone changes every switch MAC forwarding entry even without a frame from the moved host.

Explanation

Correct Answer

A:

Switches learn MAC-to-port associations from source addresses of incoming Ethernet frames, updating entries when a moved device transmits and aging unused records.

Incorrect Answers

B:

Host subnet masks determine IP on-link logic; changing them does not update which switch port carries a particular Ethernet source MAC.

C:

VLAN names are administrative labels. They cannot discover a newly moved endpoint until appropriate MAC learning occurs.

D:

ARP maps IP addresses to MAC addresses on hosts or routers; it is not the sole mechanism populating the switch's forwarding table.

Question 273

A hotel guest SSID should allow Internet traffic but prevent one guest device from sending frames to another guest on the same WLAN. Which WLAN setting addresses this requirement?

  1. Enable fast roaming, because a faster reassociation automatically denies direct client-to-client traffic.
  2. Broadcast the SSID more frequently, because beacon interval changes enforce separation of associated clients.
  3. Put guests on the same unmanaged VLAN and rely on WPA2 encryption to prevent any authenticated guest from contacting another.
  4. Client isolation or peer-to-peer blocking on the guest WLAN, with routing/firewall policy for external access.

Explanation

Correct Answer

D:

Wireless client isolation restricts direct peer-to-peer forwarding while separate routing policies can still permit Internet-bound traffic.

Incorrect Answers

A:

Fast roaming optimizes handoff among APs and does not supply per-client traffic segregation.

B:

Beacon advertisements help clients discover the SSID; changing their frequency does not isolate associated stations from each other.

C:

Link encryption protects radio frames, but authorized clients in the same logical network may still communicate unless isolation or filtering is applied.

Question 274

A router's VTY lines should permit encrypted remote CLI with local user accounts, and reject inbound Telnet. Which combination directly implements this?

  1. Configure only service password-encryption, because obscuring stored passwords provides encrypted Telnet sessions.
  2. Configure transport input ssh and login local on the VTY lines, with SSH prerequisites set.
  3. Configure transport input telnet with login local, because usernames alone encrypt the transport.
  4. Configure transport input all but require a console password, because this automatically disables Telnet on VTY.

Explanation

Correct Answer

B:

The VTY transport setting limits incoming protocols to SSH and login local authenticates against configured local user accounts; SSH keys and prerequisites must also exist.

Incorrect Answers

A:

Service password-encryption affects some stored configuration passwords and does not negotiate encrypted remote management sessions.

C:

Telnet transmits session contents without SSH transport protection. Local passwords authenticate users but do not encrypt traffic.

D:

Allowing all incoming protocols permits Telnet unless separately blocked; the console password is unrelated to network VTY transport.

Question 275

A controller manages switches and access points from a common dashboard. An operator needs to see physical links, neighboring devices, and recent device state without logging into every node. Which feature helps?

  1. A per-switch CAM table alone, because it stores a global inventory of all routed links and wireless APs.
  2. A DHCP address pool, because a lease table represents the authoritative physical topology of every switch link.
  3. Controller-collected topology and inventory views based on discovered neighbors and managed-device telemetry.
  4. Client browser cookies, because they expose every physical device interconnection in the controller domain.

Explanation

Correct Answer

C:

Controllers can aggregate discovered neighbor, interface and managed-device records into a consolidated inventory and topology view for operational diagnosis.

Incorrect Answers

A:

A CAM table shows Layer 2 source learning on an individual device; it is not a complete routed and wireless topology inventory.

B:

DHCP leases identify address assignments and clients; they do not directly describe every switch-to-switch cable or controller-managed device state.

D:

Browser cookies persist user web state; they do not collect network-neighbor or physical port connectivity data.

Question 276

An OSPF network statement intended to cover one /30 WAN interface uses wildcard 0.0.255.255, accidentally enabling OSPF on many LAN interfaces. What is the right correction?

  1. Replace the broad wildcard with a host-specific or correctly bounded /30 wildcard matching only the intended interface.
  2. Change the OSPF hello interval globally, since timers control which interfaces a network statement matches.
  3. Lower the administrative distance, because that prevents OSPF advertisements from other local interfaces.
  4. Increase the OSPF router ID so that unrelated interfaces automatically stop joining the process.

Explanation

Correct Answer

A:

OSPF network statement wildcards select local interfaces by their addresses; narrow the matching range to avoid unwanted activation and adjacency attempts.

Incorrect Answers

B:

Hello intervals influence neighbor formation on enabled interfaces, not the IP addresses selected by the network statement.

C:

Administrative distance affects which learned routes enter the RIB, not which local interfaces the OSPF process enables.

D:

Router ID identifies the OSPF router logically but does not limit which interfaces match a broad network statement.

Question 277

A company uses WPA2-Enterprise to authenticate each employee separately. A technician suggests replacing it with one shared WPA2 passphrase distributed to all staff. Which capability would be lost?

  1. Replace the RADIUS-backed user identities with one shared PSK and assume the controller still records a unique successful 802.1X credential for each employee.
  2. Use WPA2-Personal with the same AES-based encryption while assuming a shared PSK continues to support individual credential revocation.
  3. Keep a RADIUS accounting server but configure the WLAN for shared-key Personal authentication, expecting it to perform EAP identity verification.
  4. Per-user 802.1X/EAP authentication through an enterprise AAA server rather than a common preshared key.

Explanation

Correct Answer

D:

Enterprise WLAN mode can perform individual EAP/802.1X identity authentication with centralized policy, unlike shared-PSK networks where users know the same secret.

Incorrect Answers

A:

Shared WPA2-Personal credentials do not provide per-user EAP authentication sessions at a RADIUS AAA service. Attribution and individualized access control are lost.

B:

Strong AES encryption can still protect traffic, but shared PSK mode cannot revoke one employee’s unique 802.1X credentials without changing shared access.

C:

A reachable AAA server does not make a PSK-only SSID use per-user 802.1X/EAP handshakes; the WLAN authentication mode must actually be Enterprise.

Question 278

A 10G fiber uplink uses single-mode fiber and an LR optical transceiver on one end. The other end is fitted with a short-range multimode SR module. The link remains down. What should be verified?

  1. Match both optical modules at 10 Gbps while leaving one at 850 nm SR and the other at 1310 nm LR.
  2. Matching optics standards, wavelength, fiber type, distance, and compatible connectors at both ends.
  3. Swap one end to a connector that physically fits the same fiber but retain an incompatible SR-versus-LR wavelength and media combination.
  4. The switch MAC-address table capacity, because learned MACs must match the SFP's optical frequency.

Explanation

Correct Answer

B:

Optical compatibility requires suitable LR/SR modules, fiber media and wavelengths on the physical link; mismatched SR and LR modules can prevent signal detection.

Incorrect Answers

A:

Nominal data rate alignment is necessary but insufficient when wavelengths and fiber standards differ; both ends must use compatible optical specifications.

C:

Connector shape does not determine laser wavelength or supported link budget. Optical standards and fiber type must align at both ends.

D:

Forwarding table capacity influences switching after link-up, not basic transceiver photonics or whether optical carriers are received.

Question 279

A switch port connected to a user workstation unexpectedly negotiates an 802.1Q trunk with an attached unmanaged intermediary. Security policy forbids endpoint trunk negotiation. What risk and correction are most relevant?

  1. Trunk negotiation can only affect interface speed, so there is no VLAN separation risk to evaluate.
  2. Enable a faster STP hello interval, because timers are the main control of Dynamic Trunking Protocol.
  3. Dynamic trunk negotiation can expose unintended VLAN tags; force the endpoint port to access mode and disable negotiation.
  4. Allow all VLANs on the port so negotiation chooses the most secure one automatically.

Explanation

Correct Answer

C:

A user-facing port should be fixed as an access port with negotiation disabled where supported, preventing the endpoint from gaining trunked VLAN access.

Incorrect Answers

A:

Trunk formation changes frame tagging and VLAN reachability rather than merely link speed, potentially exposing other broadcast domains.

B:

Spanning-tree timers manage loop-detection behavior and do not disable DTP negotiation on user-facing switchports.

D:

Allowing all VLANs broadens reachability; it does not constrain the endpoint to its intended access VLAN.

Question 280

Router A forwards 10.55.0.0/16 to Router B while Router B forwards the same prefix to Router A. Neither has a route to the actual destination. What is the outcome and appropriate fix?

  1. A routing loop until packet TTL expires; correct one or both static routes to a valid destination or remove the bogus path.
  2. Only a DNS lookup failure, because routing tables never use a next-hop route recursively.
  3. Automatic OSPF loop prevention, because even static routes are subject to SPF neighbor validation.
  4. Immediate success through load balancing, because the two routers hold symmetric static routes.

Explanation

Correct Answer

A:

The packets can bounce between routers as each static route points back at the other; TTL limits the loop duration but not its misconfiguration impact.

Incorrect Answers

B:

Name resolution is independent of a forwarding loop for a known IP destination, and static next hops can be resolved recursively.

C:

OSPF's loop-free SPF calculation does not automatically repair manually configured mutually recursive static paths without valid reachability.

D:

Symmetric static routes do not prove a reachable destination. Without a real next hop they produce repeated forwarding rather than useful load sharing.


Cisco Certified Network Associate (CCNA) (200-301) Practice Tests

Purchase Individually

200-301 Premium File

Premium File
200-301 Premium File
760 Q&A
$76.99$69.99

200-301 Study Guide

Study Guide
200-301 Study Guide
1969 PDF Pages
$27.49$24.99

Site Search:

 

VISA, MasterCard, AmericanExpress, UnionPay

SPECIAL OFFER: GET 10% OFF

ExamCollection Premium

ExamCollection Premium Files

Pass your Exam with ExamCollection's PREMIUM files!

  • ExamCollection Certified Safe Files
  • Guaranteed to have ACTUAL Exam Questions
  • Up-to-Date Exam Study Material - Verified by Experts
  • Instant Downloads
Enter Your Email Address to Receive Your 10% Off Discount Code
A Confirmation Link will be sent to this email address to verify your login
We value your privacy. We will not rent or sell your email address

SPECIAL OFFER: GET 10% OFF

Use Discount Code:

MIN10OFF

A confirmation link was sent to your e-mail.
Please check your mailbox for a message from support@examcollection.com and follow the directions.

Next

Download Free Demo of VCE Exam Simulator

Experience Avanset VCE Exam Simulator for yourself.

Simply submit your e-mail address below to get started with our interactive software demo of your free trial.

Free Demo Limits: In the demo version you will be able to access only first 5 questions from exam.