Cisco 200-301 Practice Test 38

Question 370

A switch administrator changes port-security configuration to avoid a hostile endpoint replacing a trusted workstation’s MAC identity. Which CIA property is most directly at stake if unauthorized frames are accepted as trusted?

Classify the issue as confidentiality only and ignore the integrity of the port’s authenticated endpoint identity.
The CIA triad is irrelevant to switch access because it applies only to servers.
Integrity of network identity and trusted device access behavior.
Availability only because every unauthorized MAC always causes a complete power loss.

Explanation

Correct Answer

MAC spoofing can undermine integrity of the claimed endpoint identity and lead to unauthorized traffic within a protected segment.

Incorrect Answers

Information exposure may result, but MAC impersonation also attacks the correctness of the claimed device identity used for access decisions.

Confidentiality, integrity, and availability also govern network control-plane and access-layer risks.

Unauthorized MAC use does not necessarily remove power; the concern is allowing improper network identity/traffic.

Question 371

A branch has OSPF route 10.90.0.0/16 at administrative distance 110 and a floating static backup to that same prefix at distance 200 through next hop 192.0.2.254. The OSPF route is withdrawn, but the router has no connected or learned route that resolves 192.0.2.254. What will happen to the intended backup?

The floating static automatically enters the forwarding table whenever OSPF withdraws, regardless of its unresolved next hop.
The backup static cannot forward until its next hop is recursively reachable through a valid outgoing interface, even though OSPF has withdrawn.
The router prefers an absent OSPF route over the configured static because OSPF administrative distance is lower.
The router creates an equal-cost static path via 192.0.2.254 by learning an Ethernet destination MAC through broadcast, even without a route to that next hop.

Explanation

Correct Answer

A floating static with higher administrative distance is only a candidate while a lower-distance OSPF route exists. After that route disappears, its specified next hop must still be resolved recursively through an operational egress path. If there is no route to 192.0.2.254, the static backup cannot become a valid forwarding entry. Diagnose adjacency or route recursion rather than lowering distance alone.

Incorrect Answers

Administrative distance affects preference among otherwise usable route sources; it does not make an unresolved next hop forwardable. The router still needs a valid path to reach 192.0.2.254 before using the backup static.

Once OSPF withdraws the advertised prefix, it is no longer an eligible active route for that destination. Preference for distance 110 cannot preserve a nonexistent OSPF entry; the relevant issue is whether the configured static backup is itself valid.

ARP resolves a usable on-link IPv4 next hop to an Ethernet MAC, but it does not discover an arbitrary off-link gateway with no route to its network. No equal-cost backup is created from missing recursive reachability. The route must resolve through an actual connected or learned path.

Question 372

An IPv6 SLAAC host constructs an EUI-64 interface identifier from Ethernet MAC 00:1C:2D:3E:4F:50. Which operation is part of modified EUI-64 construction?

Insert ff:fe in the middle of the MAC and invert the universal/local bit of its first octet.
Reverse the byte order of the complete 48-bit MAC without adding bits.
Append four zero bytes and preserve every bit of the first octet.
Replace the MAC with the IPv4 default gateway address.

Explanation

Correct Answer

Modified EUI-64 expands 48 to 64 bits by inserting FF:FE and flipping the seventh bit of the first octet.

Incorrect Answers

An unchanged 48-bit sequence does not yield the 64-bit identifier construction used by modified EUI-64.

EUI-64 uses a specific FF:FE insertion and toggles the universal/local bit rather than simply padding zeros.

SLAAC interface identifiers are not obtained by copying an unrelated IPv4 router address.

Question 373

Wireless clients on SSID Guest successfully associate and pass WPA authentication but receive addresses from the employee DHCP scope instead of the guest scope. Which WLAN mapping should be checked?

The AP’s system clock time zone only.
The client browser cache, which chooses an SSID’s VLAN.
Change the controller WLAN’s Layer 3 default route while leaving its incorrect Guest SSID-to-employee VLAN mapping untouched.
The SSID/interface-to-VLAN mapping and upstream trunk allowance for the guest VLAN.

Explanation

Correct Answer

An incorrectly mapped WLAN can bridge client DHCP broadcasts into the employee VLAN, causing valid but wrong-scope leases.

Incorrect Answers

Time zones can affect logs but do not determine which VLAN receives client DHCP requests after association.

Browser cache has no role in Layer 2 WLAN-to-VLAN mapping or DHCP broadcast location.

Gateway routing may matter after DHCP, but it cannot fix client broadcasts being bridged into the wrong VLAN at association.

Question 374

A help-desk technician needs intranet.example.org to resolve to the IPv6 address 2001:db8:88::18. What DNS record type is appropriate?

MX pointing directly to an IPv6 literal as the user-facing address record.
PTR in the ordinary forward zone as the host’s IPv6 address.
AAAA with the IPv6 address as record data.
A with 2001:db8:88::18 stored in dotted-quad form.

Explanation

Correct Answer

AAAA records hold a hostname’s IPv6 address in forward DNS, as opposed to A for IPv4.

Incorrect Answers

MX identifies mail service routing; it is not the usual IPv6 host lookup entry.

PTR supports reverse lookup, not the standard hostname-to-IPv6 mapping requested.

An A record expects a 32-bit IPv4 address and cannot directly contain a 128-bit IPv6 address.

Question 375

A network team uses infrastructure-as-code to create VLANs and switch policies. Management wants every proposed change reviewed before it reaches production. What pipeline control directly supports that?

Review only the finished configuration after an unapproved apply.
Version-controlled IaC pull requests with plan/diff review and a protected apply gate.
Allow any contributor to run production apply immediately after saving locally.
Store network device passwords inside each IaC template for convenience.

Explanation

Correct Answer

Code review of proposed desired-state changes and a controlled deployment stage makes network modifications traceable and predictable.

Incorrect Answers

Post-change comparison can detect drift but does not satisfy the requested pre-deployment review gate.

Direct apply skips the required independent review and change authorization boundary.

Embedded secrets harm credential hygiene and do not establish whether the proposed change was approved.

Question 376

A host behind R1 sends a packet to a server behind R3 through R2. How does each routed hop choose where to forward the packet?

Each router independently performs a destination-prefix lookup and uses its own selected next-hop adjacency.
R1 writes the complete physical Ethernet port path into the IPv4 header for R2 and R3.
R3 dictates R1’s forwarding table through ARP broadcasts across the WAN.
Every router always uses its own default route even if a specific route exists.

Explanation

Correct Answer

IP forwarding is hop-by-hop; R2 does not blindly copy R1’s outgoing interface selection for the full path.

Incorrect Answers

Ordinary IP packets do not carry a complete per-hop Ethernet switchport list decided by the first router.

ARP is link-local; routed devices use routing entries and local adjacency resolution instead.

Longest-prefix match can select a more-specific route at any hop, independently of the default route.

Question 377

An IOS router should allow SSH management only from 192.0.2.0/24 to its VTY lines. Which control filters the inbound management source?

Apply a router interface IP ACL outbound toward the LAN but leave VTY management unrestricted from other source networks.
Configure AAA authentication for every SSH user while allowing management connections from all routed campus subnets.
Restrict an Ethernet switch trunk’s allowed VLAN list but leave all addresses on the management VLAN able to connect to VTY.
Apply a standard ACL to the VTY lines using access-class in.

Explanation

Correct Answer

An access-class on line vty can restrict which remote source addresses open management sessions before login.

Incorrect Answers

Traffic filtering can limit sessions if correctly placed, but access-class directly constrains remote VTY sources as requested.

Authentication validates the account but does not satisfy the separate requirement to limit SSH sources to the operations subnet.

VLAN pruning is not a reliable source-IP management filter across routed access networks; bind the permit list to VTY access.

Question 378

A department wants IPv6 workstations to form global unicast addresses through SLAAC without manual interface IDs. Which LAN subnet size should normally be advertised?

A /32 per workstation, matching an IPv4 host mask.
A default route of ::/0 advertised as the only host prefix.
A /64 prefix per VLAN, with router advertisements and suitable flags.
A /120 prefix for each LAN, assuming typical SLAAC creates 8-bit identifiers.

Explanation

Correct Answer

Standard SLAAC address formation uses a 64-bit interface identifier with an advertised /64 prefix.

Incorrect Answers

IPv6 interface ID construction and SLAAC prefix requirements differ from IPv4 network addressing.

The default route is reachability information, not the on-link /64 prefix used to form an IPv6 address.

Conventional SLAAC on Ethernet expects /64 and does not form ordinary 8-bit interface IDs from /120.

Question 379

A PC in VLAN 15 can reach its local gateway SVI, but cannot reach a server in VLAN 25 through the same Layer 3 switch. Which verification sequence most directly tests inter-VLAN routing?

Verify only the client DNS settings even though the failed test uses the numeric server IPv4 address in another VLAN.
Check both SVIs’ up state and IP prefixes, ip routing status, and route/ACL forwarding between them.
Check only the Layer 2 MAC table on the client access switch and assume a local MAC entry proves the routed path to VLAN 25.
Disable all trunking between campus switches.

Explanation

Correct Answer

Local gateway reachability proves only one VLAN; inter-VLAN forwarding needs both routed VLAN interfaces and appropriate policy.

Incorrect Answers

Name resolution is irrelevant to this direct routed-IP test; inspect SVI state, Layer 3 routing and ACL policy instead.

Local bridging state cannot establish that the L3 switch has both active SVIs, routing enabled and no blocking inter-VLAN policy.

Removing trunks may block VLAN reachability and does not solve the routed switch’s inter-VLAN path.

Question 380

A stub router has two WAN exit links. The primary ISP next hop 203.0.113.1 should be preferred; backup 198.51.100.1 is used if the primary default route is removed. Which simple route design works?

Two default static routes with higher administrative distance on the backup, and appropriate next-hop reachability tracking.
Two identical default routes with the same administrative distance when strict primary/backup is required.
A /32 host route to one Internet website instead of defaults.
One static default route through the LAN access switch with no WAN next hop.

Explanation

Correct Answer

A floating static default has a worse AD than the preferred primary, becoming eligible when the primary is withdrawn.

Incorrect Answers

Equal eligible routes may load share rather than enforce the intended standby preference.

A host route cannot cover all external destinations that the stub router needs to reach.

The LAN switch is not automatically a valid ISP exit; forwarding needs an actual reachable WAN next hop.

Cisco Certified Network Associate (CCNA) (200-301) Practice Tests

Cisco 200-301 Practice Test 36 - 10 Questions (Last Reviewed 03-Oct-2026)
Cisco 200-301 Practice Test 37 - 10 Questions (Last Reviewed 02-Oct-2026)
Cisco 200-301 Practice Test 38 - 10 Questions (Last Reviewed 01-Oct-2026)
Cisco 200-301 Practice Test 39 - 10 Questions (Last Reviewed 30-Sep-2026)
Cisco 200-301 Practice Test 40 - 10 Questions (Last Reviewed 29-Sep-2026)

Pass Your Cisco 200-301 Exam Easy!

Question 370

Explanation

Correct Answer

Incorrect Answers

Question 371

Explanation

Correct Answer

Incorrect Answers

Question 372

Explanation

Correct Answer

Incorrect Answers

Question 373

Explanation

Correct Answer

Incorrect Answers

Question 374

Explanation

Correct Answer

Incorrect Answers

Question 375

Explanation

Correct Answer

Incorrect Answers

Question 376

Explanation

Correct Answer

Incorrect Answers

Question 377

Explanation

Correct Answer

Incorrect Answers

Question 378

Explanation

Correct Answer

Incorrect Answers

Question 379

Explanation

Correct Answer

Incorrect Answers

Question 380

Explanation

Correct Answer

Incorrect Answers

Cisco Certified Network Associate (CCNA) (200-301) Practice Tests