Cisco 200-301 Practice Test 39

Question 380

A stub router has two WAN exit links. The primary ISP next hop 203.0.113.1 should be preferred; backup 198.51.100.1 is used if the primary default route is removed. Which simple route design works?

Two default static routes with higher administrative distance on the backup, and appropriate next-hop reachability tracking.
Two identical default routes with the same administrative distance when strict primary/backup is required.
A /32 host route to one Internet website instead of defaults.
One static default route through the LAN access switch with no WAN next hop.

Explanation

Correct Answer

A floating static default has a worse AD than the preferred primary, becoming eligible when the primary is withdrawn.

Incorrect Answers

Equal eligible routes may load share rather than enforce the intended standby preference.

A host route cannot cover all external destinations that the stub router needs to reach.

The LAN switch is not automatically a valid ISP exit; forwarding needs an actual reachable WAN next hop.

Question 381

A workstation needs 10.60.8.16/28 and its configuration lists 10.60.8.31 as the peer server address. Why should the address plan be questioned?

Because a /28 contains just two IPv4 addresses total.
Assign .31/28 to the peer and rely on proxy ARP to make the conventional subnet broadcast address usable as a normal endpoint.
Because the /28 boundary must always begin at .1.
In 10.60.8.16/28, .31 is the subnet broadcast address, not a normal usable host.

Explanation

Correct Answer

A /28 spans .16–.31, with network .16 and broadcast .31; typical assigned hosts are .17 through .30.

Incorrect Answers

A /28 has four host bits, sixteen total addresses, and fourteen usual usable host addresses.

Proxy ARP cannot turn the designated /28 broadcast into an ordinary unicast host address; readdress the peer within .17–.30.

Subnets align to multiples of 16 in the fourth octet for /28, not one fixed .1 offset.

Question 382

A switch moves an endpoint from Gi1/0/4 to Gi1/0/12. LLDP still lists an old neighbor on Gi1/0/4 for a short time. What explains the outdated neighbor entry?

Check the IPv4 ARP entry for the former device and treat its presence as proof LLDP can still see the old physical neighbor.
Assume the LLDP neighbor is live because the former switch still advertises its management IP in a historical inventory record.
LLDP discovery information can remain until its advertised hold time expires or the table is refreshed.
Replace the new device’s interface IP address to match the obsolete LLDP neighbor record, without validating current live discovery.

Explanation

Correct Answer

Neighbor records are maintained from received advertisements and can briefly reflect the former attachment until aging or fresh information catches up.

Incorrect Answers

ARP records address mappings and may age differently from LLDP; neither table by itself proves the old device is still attached.

Inventory and discovery tables can be stale, so inspect live LLDP hold time and newly received advertisements before concluding cabling is unchanged.

Adopting a stale management address risks conflicts and does not refresh an expired chassis/port advertisement on the local link.

Question 383

In a single OSPFv2 area, a router shows O 10.74.0.0/24 [110/20] via 192.0.2.2. What does the O route code tell the operator?

Treat an installed OSPF route as proof the same traffic automatically bypasses configured inbound or outbound IP access lists.
The prefix was learned as an OSPF intra-area route rather than a static or connected entry.
The O code means this prefix is directly connected to the local Ethernet interface.
Interpret O as an OSPF external type-2 route rather than an intra-area O entry.

Explanation

Correct Answer

Cisco IOS uses O as the normal code for OSPF intra-area reachability; the bracketed values are AD and routing metric.

Incorrect Answers

A route is a forwarding candidate; interface ACLs remain independent filters that can block packets even for reachable prefixes.

Connected IPv4 prefixes are marked C, not the OSPF-learned O code.

Cisco’s O E2 route code identifies external type 2; the plain O code denotes intra-area OSPF routing.

Question 384

An enterprise router forwards a client DHCPDISCOVER from VLAN 35 to a central DHCP server using ip helper-address. How can the server select the correct subnet pool?

Use the relay-agent giaddr identifying the client’s originating routed subnet.
Use the Ethernet source MAC of the server-facing interface as an IPv4 subnet mask.
Choose a scope from the relay’s Ethernet source MAC instead of the giaddr inserted for the original client segment.
Assign every relayed client an address from the DHCP server’s own local subnet.

Explanation

Correct Answer

The DHCP relay populates gateway address information so the remote DHCP server can choose a suitable pool for that client VLAN.

Incorrect Answers

A MAC address is not a pool-selection subnet identifier in the DHCP relay exchange.

The server needs the originating routed-subnet context, which relay gateway addressing supplies rather than the relay’s link-layer identity.

The remote client VLAN may have a different prefix, so the relay supplies subnet context rather than assuming server-local scope.

Question 385

Two offices must carry confidential application traffic across an untrusted WAN, and their internal subnets should communicate without individual client VPN logins. Which VPN design is most applicable?

A cleartext GRE tunnel without any encryption, treated as sufficient confidentiality.
Use remote-access VPN accounts on individual administrators’ laptops instead of a gateway-to-gateway tunnel for all office subnets.
Use an unencrypted routed GRE tunnel across the WAN and treat encapsulation as equivalent to IPsec confidentiality.
A site-to-site IPsec tunnel between the branch gateways with peer authentication and protected traffic selectors.

Explanation

Correct Answer

Gateway-to-gateway IPsec can secure routed private subnet traffic across a WAN while endpoints use their normal local routes.

Incorrect Answers

GRE can encapsulate routed traffic but does not inherently encrypt or authenticate the contents.

Client VPNs can be suitable for mobile users, but requiring separate administrator sessions does not furnish continuous branch-to-branch subnet connectivity.

GRE provides flexible encapsulation but no inherent encryption, so sensitive application payloads remain exposed without cryptographic protection.

Question 386

A campus SDN architecture has a policy controller, a physical fabric, and end-user applications. Which part commonly uses controller APIs to request network intent while switches still forward packets?

Expose the controller southbound device-programming interface directly as the end-user business application API.
An Ethernet hub that negotiates routing policies for all switches.
An application or orchestration layer using northbound controller interfaces for intent.
Have each switch accept individual application intent directly, with no common controller coordination or policy interpretation.

Explanation

Correct Answer

Applications express desired service or policy through controller APIs; the controller programs the fabric data plane through supported mechanisms.

Incorrect Answers

Southbound controls interact with network devices; northbound intent interfaces are the ordinary way applications request policy from a controller.

A basic hub does not understand SDN controller policy or route-programming functions.

Local device programming can work but does not represent the centrally orchestrated intent layer specified by the SDN design.

Question 387

R1 is connected on Gi0/0 to 192.0.2.0/30, with R2 at 192.0.2.2. R2 owns 10.77.0.0/16. Which R1 route command correctly identifies that remote network via R2?

ip route 192.0.2.0 255.255.255.252 10.77.0.0
ip route 10.77.0.0 255.255.0.0 192.0.2.2
ip route 10.77.0.0 255.255.255.0 192.0.2.3
ip route 10.77.0.0 255.255.0.0 192.0.2.0

Explanation

Correct Answer

The next hop .2 is usable and on R1’s directly connected /30; the prefix and mask match 10.77.0.0/16.

Incorrect Answers

That reverses destination and gateway; the requested remote 10.77/16 needs a reachable on-link next hop.

The /24 does not cover the requested /16, and .3 is the /30 broadcast address.

A /30 network identifier is not the neighbor’s usable next-hop host address.

Question 388

A coffee-shop operator advertises an SSID called StaffSecure with WPA2-Personal and a strong secret. A colleague argues an SSID with the word Secure is inherently encrypted even if open authentication is chosen. Which claim is accurate?

WPA2 security settings, not the SSID text, determine the protected Wi-Fi association mechanism.
Any SSID containing Secure forces WPA3 management-frame protection.
Hidden SSID operation automatically supplies a private pre-shared key.
Use SSID cloaking and MAC allowlists as replacements for WPA2-Personal encryption, leaving data traffic in open mode.

Explanation

Correct Answer

An SSID is a network identifier. Actual encryption and access requirements come from the selected 802.11 security profile and key management.

Incorrect Answers

Human-readable name strings have no protocol power to enable cryptographic key agreement.

Suppressing ordinary SSID broadcast is discovery behavior, not an authentication or encryption configuration.

Discovery restrictions and spoofable identifiers do not establish the cryptographic WPA key handshake that protects wireless payloads.

Question 389

A controller uses a dedicated management subnet 10.8.0.0/24. The Guest WLAN should bridge clients into VLAN 95. Which design rule matters?

Put every guest client into the controller’s management VLAN by default.
Map the Guest SSID to the controller management VLAN 12 because the controller itself is administered from that subnet.
Assign the AP a MAC address equal to 00:00:00:00:00:95 to select VLAN 95.
Map the Guest WLAN to the intended client VLAN 95 independently of controller/AP management reachability.

Explanation

Correct Answer

WLAN client traffic forwarding uses an SSID-to-interface/VLAN mapping; management addresses need not belong to the client VLAN.

Incorrect Answers

Management and client data can be separate security zones; putting guests into management defeats intended segmentation.

Management reachability does not determine the intended guest user VLAN; attaching guests to the management segment defeats separation.

A MAC address does not encode the desired VLAN in that manner; use the WLAN mapping and switch trunk config.

Question 390

A secure access port must learn the first approved workstation MAC address and save it into its running interface configuration automatically. Which feature should be used?

Configure a manually typed static secure MAC only, expecting a newly arriving workstation MAC to be learned automatically as sticky.
A static default route to the workstation IP.
Port security with sticky MAC learning on the access interface.
Enable ordinary dynamic MAC learning without port security and expect the learned address to appear as a sticky secure entry in running configuration.

Explanation

Correct Answer

Sticky learning adds dynamically observed secure MAC addresses to running configuration, enabling retention when saved according to policy.

Incorrect Answers

Static configuration can restrict a known identity but does not create automatic sticky learning of the first observed secure source.

Layer 3 static routing does not enforce an access-port MAC identity or learn secure addresses.

The CAM table may learn frame sources, but sticky security learning is a distinct interface feature that records secure MAC entries.

Cisco Certified Network Associate (CCNA) (200-301) Practice Tests

Cisco 200-301 Practice Test 37 - 10 Questions (Last Reviewed 02-Oct-2026)
Cisco 200-301 Practice Test 38 - 10 Questions (Last Reviewed 01-Oct-2026)
Cisco 200-301 Practice Test 39 - 10 Questions (Last Reviewed 30-Sep-2026)
Cisco 200-301 Practice Test 40 - 10 Questions (Last Reviewed 29-Sep-2026)
Cisco 200-301 Practice Test 41 - 10 Questions (Last Reviewed 28-Sep-2026)

Pass Your Cisco 200-301 Exam Easy!

Question 380

Explanation

Correct Answer

Incorrect Answers

Question 381

Explanation

Correct Answer

Incorrect Answers

Question 382

Explanation

Correct Answer

Incorrect Answers

Question 383

Explanation

Correct Answer

Incorrect Answers

Question 384

Explanation

Correct Answer

Incorrect Answers

Question 385

Explanation

Correct Answer

Incorrect Answers

Question 386

Explanation

Correct Answer

Incorrect Answers

Question 387

Explanation

Correct Answer

Incorrect Answers

Question 388

Explanation

Correct Answer

Incorrect Answers

Question 389

Explanation

Correct Answer

Incorrect Answers

Question 390

Explanation

Correct Answer

Incorrect Answers

Cisco Certified Network Associate (CCNA) (200-301) Practice Tests