Cisco 200-301 Practice Test 31

Question 300

Two OSPFv2 routers on the same Ethernet segment send common Hello packets to all OSPF routers in that link. Which IPv4 multicast destination is commonly used?

224.0.0.5, the AllSPFRouters multicast address for OSPFv2.
224.0.0.9, because RIP's multicast group is used for OSPFv2 hellos.
224.0.0.10, because EIGRP's group is OSPF's all-neighbor destination.
224.0.0.6, because this address always targets every OSPF router regardless of DR role.

Explanation

Correct Answer

OSPFv2 uses 224.0.0.5 for messages addressed to all participating OSPF routers on a broadcast link, including routine hello discovery.

Incorrect Answers

224.0.0.9 is associated with RIP version 2 multicasts and is not OSPF's hello destination.

224.0.0.10 is the EIGRP multicast address, not the standard OSPFv2 AllSPFRouters destination.

224.0.0.6 identifies the AllDRouters group for designated and backup designated routers, not the general AllSPFRouters group.

Question 301

An IPv6 host on an Ethernet LAN needs to resolve the link-layer address for neighbor 2001:db8:5::27. Rather than broadcast, which destination is used for the Neighbor Solicitation?

The ff02::1 all-nodes multicast group for every solicitation.
The ff02::2 all-routers multicast group for the target host.
The public routable group ff0e::1, regardless of LAN scope.
The target IPv6 address’s solicited-node multicast group, derived from its low 24 address bits.

Explanation

Correct Answer

Neighbor Discovery directs the solicitation to ff02::1:ffXX:XXXX for the target, letting interested interfaces process it without an IPv4-style broadcast.

Incorrect Answers

All-nodes is a valid scoped group, but targeted Neighbor Solicitation generally uses the more selective solicited-node address rather than interrupting every host.

All-routers receives router-focused messages; a host’s address-resolution inquiry is sent to that host’s solicited-node group, not to routers by default.

Neighbor discovery is link-local control traffic and uses link-scoped solicited-node multicast, not globally scoped group routing.

Question 302

A redundant three-switch PVST+ topology has one root switch that loses power. Which TWO observations are expected when the remaining switches reconverge?

Every port instantly forwards all VLANs because the root has disappeared.
The switch with the most access ports is automatically the replacement root.
The old root retains ownership because its stored bridge ID survives while powered off.
A surviving bridge is elected root for the affected VLAN according to bridge ID.
Some former alternate ports can move to forwarding after the protocol completes convergence.

Explanation

Correct Answers

Without the original root, spanning tree elects the lowest eligible bridge ID, combining configured priority and the system identifier or MAC.

The topology may need formerly blocked redundancy to carry traffic; RSTP can transition alternate roles according to proposal/agreement state.

Incorrect Answers

Eliminating the root does not disable loop prevention. Forwarding roles still must be recalculated for each affected spanning-tree instance.

Port count does not elect an STP root; root selection uses the bridge identifier and advertised superior information.

A failed bridge cannot originate live BPDUs and the surviving topology eventually ages out its information and elects a present root.

Question 303

R1 can ping R2 over a /30 WAN, and a static route to the remote LAN was added on R1. Hosts still cannot ping back from that LAN. What should be checked next?

Change only the TTL of R1’s echo-request packets to 255.
Verify the reverse route from R2 toward the original source LAN and return path policy.
Conclude that the R1-to-R2 transit ping proves R2 already has a return route to the original source LAN, so skip examining the reverse path.
Disable CEF on R1 to force routing to occur.

Explanation

Correct Answer

ICMP echo-reply traffic needs a usable route to the initiator. A one-way static route on R1 does not automatically establish the inverse path.

Incorrect Answers

Extra hop allowance cannot make R2 know the return subnet; a route and policy need verification.

The transit ping tests only addresses on the point-to-point link. R2 can still lack or misroute traffic toward the original source network; the return path and policy require explicit verification.

CEF improves forwarding; disabling it is not a principled repair for a missing reverse route and may reduce performance.

Question 304

A DNS server hosts a record for files.example.net that should resolve to an IPv4 address 192.0.2.50. Which resource record should the administrator create?

An A record mapping files.example.net to 192.0.2.50.
An AAAA record containing the IPv4 dotted-quad address.
An MX record pointing the name to 192.0.2.50.
A PTR record in the forward zone for files.example.net.

Explanation

Correct Answer

A stores an IPv4 address for a hostname, which is the exact resolution the client requests.

Incorrect Answers

AAAA represents IPv6 addresses; an IPv4 dotted-quad is not valid for that resource-record data.

MX indicates mail exchangers for a domain; it is not the usual host-to-IPv4-address mapping.

PTR is used for reverse-address lookups, not the ordinary forward lookup described.

Question 305

An access-list on a branch router should permit browsers to reach an HTTPS portal at 203.0.113.25 but deny plain HTTP access to the same host. Which match is the most precise for the permit line?

Permit TCP with source port 443 to any server.
Permit all UDP traffic to 203.0.113.25.
Permit TCP destination eq 80 to 203.0.113.25.
Permit TCP to destination host 203.0.113.25 with destination eq 443.

Explanation

Correct Answer

HTTPS commonly uses TCP port 443, so the destination-port and host test can narrowly permit the intended flow while HTTP port 80 remains excluded.

Incorrect Answers

A browser generally uses an ephemeral source port. Matching the source as 443 fails to describe portal destination service access.

The requested standard HTTPS TCP flow is not matched by UDP-only authorization; it also opens unrelated UDP services.

TCP 80 is ordinary HTTP, the specific traffic the security policy says to deny.

Question 306

A network automation script authenticates to a REST controller and receives a bearer token. What connection requirement protects that credential in transit?

Put the token in the URL query string of an HTTP request.
Base64-encode the token but leave transport encryption disabled.
Send the token in authorized HTTPS requests with certificate validation enabled.
Use HTTP so that bearer tokens are visible in packet captures for troubleshooting.

Explanation

Correct Answer

TLS protects the token from passive observation or easy alteration in transit; validate the controller certificate and handle token expiry and scope.

Incorrect Answers

URL parameters can be logged and leaked, while HTTP provides no transport confidentiality. Use a protected authorization header over TLS.

Encoding is reversible data representation, not encryption. The token still needs protected transport and credential handling.

A bearer token grants access to anyone possessing it; unencrypted HTTP makes interception and replay substantially easier.

Question 307

On an OSPFv2 Ethernet broadcast segment with a designated router, which multicast address is commonly used for packets directed to DR and BDR?

224.0.0.10, the multicast address for the OSPF backup DR.
224.0.0.6, the AllDRouters group.
224.0.0.5, which addresses only DR and BDR.
224.0.0.9, the OSPF DR election multicast group.

Explanation

Correct Answer

OSPFv2 defines the AllDRouters multicast address for communication directed to elected DR/BDR participants on a multiaccess network.

Incorrect Answers

224.0.0.10 is an EIGRP multicast destination; OSPF has a distinct DR multicast group.

224.0.0.5 is AllSPFRouters, received by OSPF participants generally, rather than the DR-specific multicast group.

224.0.0.9 is associated with RIP version 2, not designated-router OSPF traffic.

Question 308

A subnet administrator assigns /29 blocks in increasing order. The current block is 192.0.2.40/29. What is the next network address?

192.0.2.48/29, increasing the fourth octet by eight.
192.0.2.41/29, because usable hosts increment by one.
192.0.2.46/29, because there are six usable hosts.
192.0.2.56/30, because the host range must be halved.

Explanation

Correct Answer

A /29 contains eight consecutive addresses. After .40 through .47, the next aligned network begins at .48.

Incorrect Answers

The .41 address is inside the current /29 block, not the next network boundary.

The six usable-host count does not determine the stride between successive /29 network identifiers.

The requested next block is still /29; changing to /30 changes subnet size and skips the correct boundary.

Question 309

A technician discovers an unfamiliar switch through LLDP and wants its advertised management IP address rather than just the chassis name. Which LLDP detail should be inspected?

The neighbor Port ID alone, interpreted as its management subnet.
Inspect only the LLDP Port Description TLV and treat its free-form label as the neighbor management IP.
The LLDP hold-time counter interpreted as dotted-decimal IP.
The optional Management Address TLV of the LLDP neighbor entry.

Explanation

Correct Answer

LLDP can advertise a management address independently of chassis and port identifiers; show lldp neighbors detail can expose it.

Incorrect Answers

A port identifier describes the remote interface, not necessarily its reachable management IP.

A port description may describe an uplink or site name, but it does not carry the optional Management Address TLV needed for a precise administrative IP.

Hold time expresses advertisement lifetime, not a network management address.

Question 310

A VPN operator reviews a site-to-site IPsec deployment. Which distinction between IKE and ESP is technically correct?

IKE encrypts all data packets directly after the tunnel is established, with no IPsec data-plane protocol.
ESP replaces the need to validate the VPN peer identity.
IKE negotiates security associations and keys; ESP protects user IP traffic according to the negotiated policy.
Use ESP security associations to negotiate the peer certificate and phase-one key exchange, leaving IKE only for user payload encryption.

Explanation

Correct Answer

IKE coordinates authenticated negotiation and keying, while ESP provides packet confidentiality and/or integrity for protected data traffic.

Incorrect Answers

IKE is the control/keying exchange. Actual protected payload traffic is carried under ESP security associations.

Peer authentication belongs to secure tunnel establishment; ESP packet protection does not make peer-authentication policy optional.

This reverses the two functions: IKE handles authenticated peer negotiation and keying; ESP applies the negotiated packet protection to user data.

Cisco Certified Network Associate (CCNA) (200-301) Practice Tests

Cisco 200-301 Practice Test 29 - 10 Questions (Last Reviewed 10-Oct-2026)
Cisco 200-301 Practice Test 30 - 10 Questions (Last Reviewed 09-Oct-2026)
Cisco 200-301 Practice Test 31 - 10 Questions (Last Reviewed 08-Oct-2026)
Cisco 200-301 Practice Test 32 - 10 Questions (Last Reviewed 07-Oct-2026)
Cisco 200-301 Practice Test 33 - 10 Questions (Last Reviewed 06-Oct-2026)

Pass Your Cisco 200-301 Exam Easy!

Question 300

Explanation

Correct Answer

Incorrect Answers

Question 301

Explanation

Correct Answer

Incorrect Answers

Question 302

Explanation

Correct Answers

Incorrect Answers

Question 303

Explanation

Correct Answer

Incorrect Answers

Question 304

Explanation

Correct Answer

Incorrect Answers

Question 305

Explanation

Correct Answer

Incorrect Answers

Question 306

Explanation

Correct Answer

Incorrect Answers

Question 307

Explanation

Correct Answer

Incorrect Answers

Question 308

Explanation

Correct Answer

Incorrect Answers

Question 309

Explanation

Correct Answer

Incorrect Answers

Question 310

Explanation

Correct Answer

Incorrect Answers

Cisco Certified Network Associate (CCNA) (200-301) Practice Tests