Cisco 200-301 Practice Test 30

Question 290

A router's remote administrative SSH sessions remain open for hours after administrators walk away. Which line setting reduces exposure from forgotten idle VTY sessions?

Enable AAA command accounting for the administrator but leave the idle VTY exec session with no inactivity timeout.
Configure an appropriate exec-timeout under the relevant line vty configuration.
Configure login block-for to throttle new failed SSH authentications without setting an idle-session timeout for authenticated users.
Reduce SSH connection establishment timeout without limiting how long an already authenticated idle EXEC shell stays open.

Explanation

Correct Answer

The VTY executive timeout disconnects sessions after configured inactivity, reducing the period an unattended shell remains authorized.

Incorrect Answers

Command accounting records actions but does not disconnect an abandoned privileged session. Configure a suitable exec-timeout on the affected VTY lines.

Brute-force login throttling protects the authentication stage. It does not expire a session that remains open after a valid administrator walks away.

The connection or negotiation timer concerns handshake setup. The idle EXEC session lifetime is controlled by the line exec-timeout setting.

Question 291

A router learns 172.20.10.0/24 through OSPF with AD 110 but has static route 172.20.10.8/29 pointing to another next hop. Where does traffic to 172.20.10.10 go?

Toward the OSPF /24, because OSPF always overrides static routes regardless of prefix length.
Both next hops simultaneously, because an overlapping /24 and /29 automatically form equal-cost routes.
Toward the /29 static next hop, because its matching prefix is more specific than the OSPF /24.
Toward a default route, because /29 host ranges cannot be installed in IPv4 routing tables.

Explanation

Correct Answer

Forwarding uses the longest matching prefix; 172.20.10.10 falls within .8–.15, so the /29 path wins if installed and reachable.

Incorrect Answers

AD comparison decides between sources of the same prefix, not a less-specific /24 against a matching /29.

Overlapping prefixes are not automatically equal-cost options; longest-prefix-match selects one most-specific route first.

A /29 is a valid network prefix, and ordinary routers can install such static routes for subnet forwarding.

Question 292

A PC has 192.168.30.67/26 and a configured gateway 192.168.30.1. Which diagnostic explains its failure to reach off-subnet services?

The gateway address is outside the host's 192.168.30.64/26 local subnet, so it cannot be resolved as an on-link next hop.
The gateway .1 is within .64/26, so the failure must come from DNS alone.
The host's subnet mask requires its gateway to be an IPv6 link-local address.
The host address .67 is reserved as the /26 broadcast and cannot be assigned.

Explanation

Correct Answer

A /26 divides the /24 into blocks of 64; .67 lies within .64–.127, while .1 is in a different block.

Incorrect Answers

192.168.30.1 is not on-link under the given mask, so gateway resolution fails before a remote DNS diagnosis is appropriate.

An IPv4 host normally uses an IPv4 gateway address on its on-link subnet, not an unrelated IPv6 link-local next hop.

Network .64 and broadcast .127 are reserved in this host subnet; .67 is a usable address, not broadcast.

Question 293

Two campus buildings use wireless APs to link a distant rooftop access point to a wired root AP without an Ethernet cable to the remote roof. Which AP role permits the wireless backhaul?

Local AP mode with a mandatory wired uplink on every AP, because the remote building has no cable.
Monitor mode, because RF scanning by itself forwards user traffic between buildings.
Sniffer mode streaming frames to a Wireshark host, because packet capture forms a transparent bridging uplink.
Mesh AP operation, using a wireless backhaul link to a root/gateway AP where supported.

Explanation

Correct Answer

Mesh deployment can connect remote APs through wireless backhaul to a root with wired connectivity, subject to throughput and RF design limits.

Incorrect Answers

A wired-only local AP mode does not solve the explicit absence of Ethernet backhaul to the roof.

Monitor mode dedicates the AP to scanning/rogue reporting rather than acting as a production wireless forwarding bridge.

Sniffer mode captures 802.11 frames for analysis and is not the ordinary mesh data forwarding path required by users.

Question 294

A client on VLAN 25 sends DHCP Discover broadcasts, but its SVI helper points to 192.0.2.99 while the actual DHCP server is at 192.0.2.50. All other routing works. What should be changed?

Remove the SVI IP address, because a gatewayless VLAN can route DHCP broadcasts to any external network.
Correct the helper address on the client-facing routed interface to the reachable DHCP server or approved relay destination.
Change the client's default gateway to the remote DHCP server, because DHCP broadcast packets cross routers without relay.
Fix the DHCP server pool’s default-router option but leave the helper on VLAN 25 pointing at the wrong server IP.

Explanation

Correct Answer

The helper translates/retransmits DHCP broadcasts toward configured destination hosts. A wrong address prevents requests reaching the intended server even though normal routing is healthy.

Incorrect Answers

Removing the VLAN's Layer 3 SVI eliminates its gateway/relay attachment instead of correcting the misdirected DHCP relay destination.

Clients usually broadcast discovery before having an IP configuration and need a relay for cross-subnet servers; setting a remote server as gateway is not the remedy.

A correct router option is delivered only if the client reaches an authorized DHCP server. The specified relay still targets an incorrect server.

Question 295

A fabric overlays tenant VLAN-like Layer 2 segments across an IP routed data center. What encapsulation function do VXLAN tunnel endpoints provide?

Carry the tenant Ethernet frames as ordinary untagged LAN traffic across the routed spine-leaf underlay without an overlay encapsulation.
Send VXLAN tenant data inside BGP TCP 179 messages rather than encapsulating Ethernet frames in UDP-based VXLAN transport.
VTEPs encapsulate Ethernet tenant frames in VXLAN-over-UDP packets for transport across the underlay IP network.
The VTEP replaces every tenant MAC address with its own IP address and therefore needs no Layer 2 segmentation identifier.

Explanation

Correct Answer

VXLAN tunnel endpoints encapsulate and decapsulate overlay Layer 2 traffic across routable underlay IP connectivity while retaining tenant segmentation via VNIs.

Incorrect Answers

A routed underlay does not natively bridge remote tenant Layer 2 segments; VTEP VXLAN-over-UDP encapsulation provides the overlay transport.

BGP EVPN can distribute control-plane reachability for a VXLAN fabric but is not the data-plane tunnel carrying encapsulated tenant Ethernet frames.

VXLAN preserves Ethernet headers and uses a VXLAN Network Identifier; rewriting all tenant MACs into one address would lose the intended segmentation.

Question 296

Clients use 10.1.10.1 as a virtual default gateway shared by two HSRP routers. The active router fails and the standby becomes active. Why do clients not need a new gateway setting?

The FHRP virtual IP and virtual MAC can move to the newly active router while the configured gateway address remains stable.
Move clients to the standby router’s physical SVI address as soon as the original HSRP active fails, abandoning the shared virtual gateway IP.
Change the HSRP virtual IP to the surviving router’s physical interface address at each switchover and expect clients to retain their old default gateway.
Renew each client’s DHCP default-router option during every HSRP active-state transition before traffic can resume.

Explanation

Correct Answer

HSRP maintains one logical first-hop identity; eligible routers coordinate which one currently forwards traffic for its virtual address.

Incorrect Answers

HSRP is designed to keep the virtual gateway address stable across active-router changes. Renumbering clients is unnecessary and can disrupt the first-hop failover.

If the virtual gateway identity changes, existing client configurations may no longer resolve it. HSRP transfers the same virtual IP/MAC identity to the new active participant.

HSRP virtual gateway failover normally does not require updating a host’s configured default router. The shared virtual IP persists and ownership moves to the healthy router.

Question 297

A security policy requires a Cisco access port to enter err-disabled state after a second unauthorized MAC address appears, rather than silently drop frames while staying up. Which violation mode fits?

switchport port-security violation restrict, because restrict and shutdown are identical in interface state.
switchport port-security violation protect, because protect always errdisables the port after the first extra address.
spanning-tree bpduguard enable, because any second MAC address always triggers a BPDU packet.
switchport port-security violation shutdown.

Explanation

Correct Answer

Shutdown violation mode disables the interface on a port-security breach, typically requiring documented recovery or manual intervention depending on configuration.

Incorrect Answers

Restrict drops prohibited traffic and logs/counters but ordinarily does not place the port in the shutdown error state.

Protect drops traffic from unauthorized secure-MAC violations but generally keeps the interface operating, not the requested errdisabled outcome.

BPDU Guard reacts to unexpected spanning-tree BPDUs, not directly to the number of source MAC addresses learned on a port.

Question 298

A 24-port PoE switch has a total PoE budget of 370 W. It currently supplies eight APs each using 25 W and six phones each using 10 W. How much budget remains for further devices?

260 W, because current used wattage is the same as remaining capacity.
110 W, because present consumption is 8×25 + 6×10 = 260 W.
170 W, because only the AP consumption should count against the budget.
310 W, because a PoE switch counts only the phone load and ignores APs.

Explanation

Correct Answer

Total powered-device usage is 200 W plus 60 W, or 260 W, leaving 370 minus 260 equals 110 W available under the stated budget.

Incorrect Answers

260 W is present load, not remaining headroom. Remaining budget is found by subtracting combined consumption from total capacity.

The remaining budget must subtract both AP and phone draw. Ignoring phones overestimates capacity and can lead to denied power to later ports.

Ignoring AP consumption is incorrect because APs consume powered-device watts from the same chassis PoE pool.

Question 299

Two 802.1Q trunk ports should use VLAN 99 as their native VLAN, while VLANs 10 and 20 carry tagged production traffic. Which TWO checks are correct? (Select TWO.)

Set native VLAN 10 at one end and 99 at the other, because mismatches make tags more secure.
Set or verify native VLAN 99 on BOTH ends of the trunk, using matching administrative configuration.
Remove VLAN 99 from all VLAN databases, because a native VLAN must never exist on the switches.
Convert one endpoint to access mode while keeping the other a trunk, because mixed trunk/access operation provides consistent 802.1Q tagging.
Verify VLANs 10 and 20 are permitted and active on the trunk, so their frames can be carried with tags.

Explanation

Correct Answers

Native VLAN mismatches can cause untagged traffic to be associated with different VLANs and produce a security or connectivity problem; both ends should match.

Allowed and active VLAN checks ensure tagged application VLANs traverse the trunk, independent of the native VLAN used for untagged frames.

Incorrect Answers

Native mismatch is not a security feature. It can connect unintended broadcast domains or cause inconsistent forwarding of untagged frames.

Native VLAN settings require the relevant VLAN context to be valid on devices; deleting the VLAN is not a substitute for matched trunk configuration.

An access/trunk mismatch prevents the intended consistent tagging of VLANs 10 and 20 across the interswitch connection.

Question 300

Two OSPFv2 routers on the same Ethernet segment send common Hello packets to all OSPF routers in that link. Which IPv4 multicast destination is commonly used?

224.0.0.5, the AllSPFRouters multicast address for OSPFv2.
224.0.0.9, because RIP's multicast group is used for OSPFv2 hellos.
224.0.0.10, because EIGRP's group is OSPF's all-neighbor destination.
224.0.0.6, because this address always targets every OSPF router regardless of DR role.

Explanation

Correct Answer

OSPFv2 uses 224.0.0.5 for messages addressed to all participating OSPF routers on a broadcast link, including routine hello discovery.

Incorrect Answers

224.0.0.9 is associated with RIP version 2 multicasts and is not OSPF's hello destination.

224.0.0.10 is the EIGRP multicast address, not the standard OSPFv2 AllSPFRouters destination.

224.0.0.6 identifies the AllDRouters group for designated and backup designated routers, not the general AllSPFRouters group.

Cisco Certified Network Associate (CCNA) (200-301) Practice Tests

Cisco 200-301 Practice Test 28 - 10 Questions (Last Reviewed 11-Oct-2026)
Cisco 200-301 Practice Test 29 - 10 Questions (Last Reviewed 10-Oct-2026)
Cisco 200-301 Practice Test 30 - 10 Questions (Last Reviewed 09-Oct-2026)
Cisco 200-301 Practice Test 31 - 10 Questions (Last Reviewed 08-Oct-2026)
Cisco 200-301 Practice Test 32 - 10 Questions (Last Reviewed 07-Oct-2026)

Pass Your Cisco 200-301 Exam Easy!

Question 290

Explanation

Correct Answer

Incorrect Answers

Question 291

Explanation

Correct Answer

Incorrect Answers

Question 292

Explanation

Correct Answer

Incorrect Answers

Question 293

Explanation

Correct Answer

Incorrect Answers

Question 294

Explanation

Correct Answer

Incorrect Answers

Question 295

Explanation

Correct Answer

Incorrect Answers

Question 296

Explanation

Correct Answer

Incorrect Answers

Question 297

Explanation

Correct Answer

Incorrect Answers

Question 298

Explanation

Correct Answer

Incorrect Answers

Question 299

Explanation

Correct Answers

Incorrect Answers

Question 300

Explanation

Correct Answer

Incorrect Answers

Cisco Certified Network Associate (CCNA) (200-301) Practice Tests