Cisco 200-301 Practice Test 36

Question 350

An extended ACL is configured inbound on Gi0/0. Operators suspect a rule is dropping HTTPS traffic. Which output most directly indicates whether that ACE is matching packets?

Inspect only show ip interface brief and assume an up interface proves the specific HTTPS ACL entry permits traffic.
The router uptime value in show version.
The match counter next to the relevant entry in show access-lists.
The interface description in show interfaces description.

Explanation

Correct Answer

IOS ACL counters help identify which ACEs have matched packets; counters and interface direction reveal real filter behavior.

Incorrect Answers

An up routed interface can still have inbound ACL denies; per-entry show access-lists hit counters supply the relevant filtering evidence.

Uptime can establish restart history but does not show whether a specific HTTPS deny ACE matched.

A description records operational labeling but not ACL decision counts.

Question 351

An OSPFv2 neighbor had been FULL. The connected physical link loses carrier and the interface goes down. Which TWO consequences should normally follow?

Routes learned only through that failed adjacency can be withdrawn or recalculated.
The router continues receiving Hellos on the down physical link indefinitely.
Every OSPF area on all devices is automatically deleted.
Expect the remaining router to hold a FULL adjacency state indefinitely because its OSPF Dead interval has not yet expired after local carrier loss.
The neighbor adjacency on that interface is torn down or removed.

Explanation

Correct Answers

OSPF reacts to topology loss and recomputes reachable destinations; routes without an alternate path may leave the RIB.

A physically down interface cannot exchange Hellos and no longer sustains a live neighbor state across that connection.

Incorrect Answers

A down interface does not transport regular OSPF packets, even though prior neighbor records may appear briefly during state transitions.

A single interface failure changes affected reachability but does not erase the router’s area configuration or unrelated adjacencies.

Local interface-down detection usually invalidates the neighbor immediately; timer-based expiry is a different failure path when Hellos stop on an otherwise up link.

Question 352

A switch knows the destination MAC for a PC within VLAN 15, but a technician claims it must first run ARP for that MAC before every frame. Which distinction corrects the claim?

MAC/CAM lookup forwards known Ethernet destinations; ARP maps an IPv4 neighbor address to a link-layer address.
Refresh the ARP table on every end host before allowing the switch to forward a known unicast MAC frame.
Use the switch’s ARP cache as its sole database of learned destination MAC-to-switchport bindings.
All Ethernet frames need a broadcast MAC until a router assigns a subnet.

Explanation

Correct Answer

The switch forwards based on learned Layer 2 MAC/VLAN entries; hosts or routing interfaces use ARP for IPv4-to-MAC resolution when needed.

Incorrect Answers

Hosts need ARP for IP-to-MAC resolution when necessary, but a switch with an existing CAM entry forwards Ethernet frames by destination MAC.

ARP maps IP neighbors to MAC addresses; a switch CAM table independently records MAC and VLAN associations to local forwarding ports.

Known unicast Layer 2 destinations are forwarded using the CAM table without forcing every frame to broadcast.

Question 353

A controller-based WLAN uses lightweight APs. The WLAN administrator centrally configures SSIDs and policies, while an AP still transmits client 802.11 frames. What is the split-MAC design principle?

The controller physically replaces all radios so access points no longer transmit.
Every IP route on the campus must be handled in the AP MAC sublayer.
Each client has a dedicated hardware controller installed on its laptop.
Some management/control responsibilities are centralized at the controller while time-sensitive radio functions remain on the AP.

Explanation

Correct Answer

Controller-based WLAN architecture separates policy and control decisions from AP functions requiring local real-time radio execution.

Incorrect Answers

Lightweight APs still provide the air interface; central management does not eliminate the radio hardware.

Layer 3 routing is separate from 802.11 management and the wireless control architecture.

Client stations associate with APs; the centralized controller is network infrastructure, not per-client equipment.

Question 354

A remote syslog collector receives events from branch routers, but each device log omits timestamps, making the sequence of an outage impossible to reconstruct. What should be changed?

Increase the syslog logging level to debug while leaving the emitted event records without timestamps and routers unsynchronized.
Send router logs to a single collector but preserve each device’s local unsynchronized time and omit timestamps from message content.
Enable appropriately timed syslog entries on devices and synchronize their clocks with NTP.
Turn off NTP on all routers so device clocks drift equally.

Explanation

Correct Answer

service timestamps log with clock synchronization gives collectors consistent event times, improving multi-device incident correlation.

Incorrect Answers

More verbose messages cannot reconstruct cross-device event order when their actual event times remain missing or inconsistent.

A shared collector helps storage but cannot always recover the precise originating event time when device clocks are unaligned and events are delayed.

Unmanaged clocks diverge and worsen timeline reconstruction even if logs are otherwise transmitted.

Question 355

An automation client expects JSON from a controller REST API. Its HTTP request uses Content-Type: application/json but never sends an Accept header. Which header distinction is correct?

Both headers are authentication tokens that replace TLS.
Content-Type describes the request body media type; Accept indicates the response representations the client can handle.
Content-Type specifies only the response format and Accept controls the POST request body.
Accept is an IP routing metric used to select the nearest controller.

Explanation

Correct Answer

An HTTP client can use application/json for both, but the headers express different directions of the request/response contract.

Incorrect Answers

Neither header authorizes a caller nor encrypts transport; they describe representation handling.

That reverses the usual semantics; Content-Type belongs to the representation being sent in that message.

Accept is an HTTP content-negotiation header, not a control-plane routing attribute.

Question 356

R1 Gi0/0 is 172.16.45.1/30 and R2 Gi0/0 is 172.16.45.6/30. The routers are directly cabled and OSPF is enabled, but neighbor discovery fails. What addressing correction is needed?

Place both peer interfaces in the same /30 link subnet, for example R1 .5/30 and R2 .6/30.
Make both interfaces exactly 172.16.45.6/30.
Use 172.16.45.3 on R1 and .6 on R2.
Increase OSPF cost on R1 to compensate for disjoint /30 addresses.

Explanation

Correct Answer

172.16.45.1 belongs to .0/30, while .6 belongs to .4/30; directly connected OSPF peers need compatible IP subnetting.

Incorrect Answers

Duplicate endpoint IPs create a conflict; each link endpoint needs a unique usable address in the same subnet.

.3 is the broadcast address of .0/30 and is not a usable /30 link endpoint.

Path metrics do not fix on-link IP reachability or the fact that the interfaces are in different networks.

Question 357

A security officer investigates a switchport that reports a port-security violation after a second workstation connects. Which TWO IOS checks directly help identify secure addresses and the observed violation?

Inspect only show port-security interface and assume its summary reveals each individual secure MAC address without consulting the address list.
Inspect only show mac address-table dynamic and treat every learned MAC as a configured secure port-security identity.
Inspect only show interface status to confirm the port is physically connected, without port-security counters or secure address data.
Inspect show port-security interface for limit, mode and violation count.
Inspect show port-security address for the secure MAC addresses learned or configured.

Explanation

Correct Answers

Interface port-security details expose configured MAC maximum, observed violations and the enforcement action, distinguishing restrict, protect and shutdown behavior.

The address listing indicates which MACs are considered secure and on which ports, supporting investigation of the unrecognized second host.

Incorrect Answers

Violation counters and limit are visible in interface output, but the second requirement asks which secure addresses were learned; inspect the address table too.

An ordinary dynamic MAC table does not reliably distinguish port-security configured or sticky secure identities or provide violation-mode evidence.

A connected interface can still drop violating source frames; port status alone does not identify which secure MAC was permitted.

Question 358

A 1-Gbps copper Ethernet link connects a workstation directly to a switch with full duplex on both ends. What behavior should be expected?

Assume that every port in the same VLAN shares one collision domain even when all physical links negotiate full duplex.
Force one side to half duplex to speed up simultaneous two-way transfers on a correctly operating full-duplex link.
Both ends can transmit and receive simultaneously without CSMA/CD collisions on that point-to-point link.
Every transmitted frame must wait for a collision before being delivered.

Explanation

Correct Answer

Full-duplex switched Ethernet separates send and receive directions and does not require shared half-duplex contention arbitration.

Incorrect Answers

A VLAN defines a broadcast domain, whereas individual full-duplex switch links avoid shared-medium Ethernet collision handling.

A duplex mismatch can cause late collisions, drops and performance problems rather than increasing simultaneous transmission capacity.

CSMA/CD collision recovery is associated with half-duplex shared media, not a correctly negotiated full-duplex switched link.

Question 359

Two switches use a tagged 802.1Q trunk for data VLAN 80 and voice VLAN 90. A voice frame with VLAN 90 traverses the link. How is the VLAN identified to the receiving switch?

Use the trunk native VLAN setting to classify every received voice frame, even though the frame already carries a VLAN 90 tag.
By the 802.1Q VLAN tag carrying the VLAN 90 identifier in the Ethernet frame.
Infer VLAN 90 from a voice DSCP EF marking in the IP header instead of the 802.1Q Ethernet header.
By changing the source MAC address to 00:00:00:00:00:90.

Explanation

Correct Answer

A trunk transports multiple VLANs and tags non-native VLAN frames so the receiver associates them with the correct VLAN.

Incorrect Answers

Native-VLAN mapping ordinarily applies to untagged traffic; tagged user/voice frames are associated with their explicit 802.1Q VLAN IDs.

DSCP is a Layer 3 QoS signal and cannot replace the VLAN identifier used for trunk Layer 2 segmentation.

802.1Q VLANs do not encode numeric IDs as special source MAC addresses.

Question 360

A static route to 198.51.100.0/24 is configured using only exit interface Gi0/1. The interface goes line-protocol down. What happens to forwarding through that route?

The static path tied to the failed interface is no longer usable and may be removed from the active RIB.
The route stays forwarding normally because static routes ignore interface state.
The router automatically enables Gi0/1 again whenever a packet matches.
The route becomes a directly connected C route automatically.

Explanation

Correct Answer

A static exit-interface dependency needs that interface operational; losing line protocol prevents forwarding through it.

Incorrect Answers

A configured line remains in configuration, but an unusable associated exit interface prevents live forwarding through it.

Route lookup is not an interface recovery mechanism; a physical or administrative link problem still needs repair.

A static route is not reclassified as a connected network merely because an exit interface was named.

Cisco Certified Network Associate (CCNA) (200-301) Practice Tests

Cisco 200-301 Practice Test 34 - 10 Questions (Last Reviewed 05-Oct-2026)
Cisco 200-301 Practice Test 35 - 10 Questions (Last Reviewed 04-Oct-2026)
Cisco 200-301 Practice Test 36 - 10 Questions (Last Reviewed 03-Oct-2026)
Cisco 200-301 Practice Test 37 - 10 Questions (Last Reviewed 02-Oct-2026)
Cisco 200-301 Practice Test 38 - 10 Questions (Last Reviewed 01-Oct-2026)

Pass Your Cisco 200-301 Exam Easy!

Question 350

Explanation

Correct Answer

Incorrect Answers

Question 351

Explanation

Correct Answers

Incorrect Answers

Question 352

Explanation

Correct Answer

Incorrect Answers

Question 353

Explanation

Correct Answer

Incorrect Answers

Question 354

Explanation

Correct Answer

Incorrect Answers

Question 355

Explanation

Correct Answer

Incorrect Answers

Question 356

Explanation

Correct Answer

Incorrect Answers

Question 357

Explanation

Correct Answers

Incorrect Answers

Question 358

Explanation

Correct Answer

Incorrect Answers

Question 359

Explanation

Correct Answer

Incorrect Answers

Question 360

Explanation

Correct Answer

Incorrect Answers

Cisco Certified Network Associate (CCNA) (200-301) Practice Tests