Cisco 200-301 Practice Test 40

Question 390

A secure access port must learn the first approved workstation MAC address and save it into its running interface configuration automatically. Which feature should be used?

Configure a manually typed static secure MAC only, expecting a newly arriving workstation MAC to be learned automatically as sticky.
A static default route to the workstation IP.
Port security with sticky MAC learning on the access interface.
Enable ordinary dynamic MAC learning without port security and expect the learned address to appear as a sticky secure entry in running configuration.

Explanation

Correct Answer

Sticky learning adds dynamically observed secure MAC addresses to running configuration, enabling retention when saved according to policy.

Incorrect Answers

Static configuration can restrict a known identity but does not create automatic sticky learning of the first observed secure source.

Layer 3 static routing does not enforce an access-port MAC identity or learn secure addresses.

The CAM table may learn frame sources, but sticky security learning is a distinct interface feature that records secure MAC entries.

Question 391

Two OSPFv2 peers on the same LAN agree on area, subnet, and Hello timers, but adjacency will not form. One interface requires OSPF message authentication and the other uses a different key. What should be fixed?

Lower OSPF interface cost on one router while retaining conflicting authentication keys and security mode.
Align compatible OSPF authentication settings and valid shared key material on both peer interfaces.
Increase the default route administrative distance to 255.
Change only the Ethernet port description on both devices.

Explanation

Correct Answer

Peers that cannot authenticate OSPF packets discard them despite matching addressing and timers.

Incorrect Answers

Cost influences path selection after adjacency; it cannot authenticate neighbor Hellos or repair a key mismatch.

Static/default route preference does not satisfy OSPF neighbor authentication requirements.

Administrative descriptions have no cryptographic effect on OSPF control packets.

Question 392

A virtualization host provides VRF Green and VRF Blue on a router, each with an overlapping 10.0.0.0/24 subnet. What keeps route lookups isolated?

Each VRF uses a separate routing table and forwarding context unless explicitly leaked.
A single global routing table combines both /24s and automatically prevents any cross-tenant overlap.
Create separate access VLANs for overlapping prefixes but leave all VLAN SVIs in the same global routing table.
One common default gateway MAC with no interface isolation.

Explanation

Correct Answer

VRFs permit overlapping prefixes because interfaces and routes are associated with independent routing/forwarding instances.

Incorrect Answers

Overlapping routes in one table would be ambiguous; VRFs provide deliberate separated lookup contexts.

L2 isolation alone does not furnish independent route lookups for overlapping /24 destinations; assign the interfaces to separate VRFs.

A shared MAC alone does not establish tenant-specific route-table selection.

Question 393

A wireless controller has a management IP on VLAN 12 but its AP forwards user data on VLANs 40 and 41. Which behavior separates management plane and user data plane?

Every client must manage the WLC through TCP 22 before sending application packets.
Management VLAN assignment forces all WLAN user stations into the same management subnet.
Place the WLC management IP inside every roaming client DHCP pool so user sessions inherit the controller address.
Controller management access uses its management interface, while client data follows the configured WLAN forwarding path.

Explanation

Correct Answer

Administrative access and user traffic need distinct logical roles even when infrastructure shares physical uplinks.

Incorrect Answers

Wireless user sessions do not need interactive controller SSH access to carry their data frames.

WLAN client VLAN mappings can be independent of the controller’s administrative network.

The controller uses a stable management identity; client leases and WLAN data forwarding use separate addresses and policy contexts.

Question 394

A PAT-enabled router sees no entry in show ip nat translations immediately after boot. After an inside workstation opens an HTTPS connection, an entry appears. What does this show?

Enable a NAT rule but omit the inside/outside interface designations, expecting VLAN tagging alone to create PAT mappings.
PAT cannot translate TCP HTTPS sessions.
Dynamic PAT translations are commonly created by matching active traffic rather than populated for every idle host in advance.
Prepopulate a static one-to-one mapping for every DHCP client and describe the entries as traffic-created PAT state.

Explanation

Correct Answer

A qualifying outbound flow causes the NAT process to allocate a translated address/port mapping for that session.

Incorrect Answers

Traffic tagging and IP source translation are different features; NAT requires matching inside-to-outside flows and correct interface roles.

PAT is commonly used to share a public address among many TCP and UDP flows with distinct port mappings.

Static mappings can exist without activity, but they do not explain why dynamic PAT entries appear only after matching sessions begin.

Question 395

A centralized automation job pushes one ACL template to 600 access switches in one execution. A typo blocks remote management on all of them. Which design practice most directly reduces this blast radius?

Increase switch port bandwidth to make wrong ACLs evaluate faster.
Stage changes against tested devices, validate a dry-run diff, then use bounded canary deployment with rollback.
Allow the template to skip configuration syntax validation for faster deployment.
Use the same broad administrator token everywhere and suppress per-device logs.

Explanation

Correct Answer

Limited rollout scope and staged validation catch harmful network changes before propagating them across the fleet.

Incorrect Answers

Bandwidth does not correct a deny rule that locks out management sessions.

Skipping validation increases the chance of repeating an error across every device.

Broad credentials and missing traces reduce control and recovery from a fleet-wide policy error.

Question 396

An IPv6 route table includes 2001:db8:800::/48 via FE80::1 and an ::/0 default. A packet targets 2001:db8:800:10::5. Which route matches first?

The 2001:db8:800::/48 entry because it is more specific than ::/0.
The ::/0 entry because zero bits always have the greatest preference.
Neither route because IPv6 uses MAC addresses instead of network prefixes.
The fe80::/10 route because the next hop is link-local.

Explanation

Correct Answer

The destination shares the /48 prefix; longest-prefix match chooses that route over the default.

Incorrect Answers

A default has the shortest prefix and is used only when no more specific suitable match applies.

IPv6 routers still compare destination address prefixes; Ethernet MAC addresses are for each link’s frame.

Next-hop address type is separate from the destination prefix being matched in the route table.

Question 397

Two OSPF neighbors exchange Hello packets across a routed uplink. An inbound ACL now denies IP protocol 89 on that interface, and the adjacency drops. What is the targeted correction?

Permit TCP destination port 89 only while leaving IP protocol 89 denied by the ACL.
Permit OSPF only as UDP destination port 89 and leave the protocol-number match denied.
Allow OSPF Hellos outbound but continue denying all inbound OSPF protocol 89 from the neighbor.
Permit necessary OSPF protocol 89 traffic from the legitimate neighbor while maintaining unrelated policy controls.

Explanation

Correct Answer

OSPF uses IP protocol number 89; an ACL filtering those packets can prevent neighbor discovery and updates.

Incorrect Answers

OSPF uses its own IP protocol number, not a TCP listening port; the ACL must allow the actual OSPF packet type.

OSPF does not use UDP port 89 for neighbor exchange; it is IP protocol 89 traffic.

Neighbor discovery requires received Hellos as well as transmitted packets; asymmetric filtering can keep the adjacency down.

Question 398

A campus architect compares running an ERP database on company-owned virtual hosts with consuming a cloud-hosted managed application. Which distinction is correct?

Lift and shift the ERP database to self-managed cloud VMs and assume the provider will automatically patch its guest OS and database.
Every managed cloud application gives the customer direct physical switch administration.
The managed cloud service shifts some infrastructure operation to the provider, while local virtualization leaves host operations with the organization.
Cloud-hosted applications must run without IP networking or security identities.

Explanation

Correct Answer

Both may deliver business applications, but hardware/platform management responsibility differs by the actual service model.

Incorrect Answers

Infrastructure-as-a-service typically leaves significant guest operating system and workload maintenance responsibilities with the customer.

Managed services generally abstract some underlying infrastructure rather than expose all physical device control.

Cloud services still depend on networking and access controls even when the provider operates infrastructure.

Question 399

A desktop port must move from VLAN 15 to VLAN 25. The uplink trunk already allows both VLANs. Which configuration change is targeted?

Refresh the desktop’s DHCP lease before reassigning its access port, expecting address renewal to change the switchport from VLAN 15 to 25.
Set switchport access vlan 25 on the workstation-facing access port.
Remove VLAN 15 from the uplink’s allowed VLAN list only.
Make the uplink native VLAN 25 while leaving the desktop untagged in access VLAN 15.

Explanation

Correct Answer

The access VLAN determines which untagged frames from the desktop map to the intended Layer 2 segment.

Incorrect Answers

DHCP changes host configuration after a VLAN is selected; it cannot alter the switchport’s configured Layer 2 membership.

Pruning a VLAN from a trunk may affect other users and does not reassign this specific desktop access port.

A trunk native VLAN controls untagged traffic on the uplink, not the workstation’s existing access VLAN setting.

Question 400

A router has IPv6 routes 2001:db8::/32 via R1 and 2001:db8:9000::/48 via R2. Traffic targets 2001:db8:9000:1::10. Which forwarding choice is expected?

Use the /48 route via R2 because it most specifically matches the destination.
Use R1 because /32 has fewer bits and therefore higher precision.
Use both next hops for every packet regardless of prefix length.
Use the IPv6 link-local all-nodes multicast path instead of unicast routing.

Explanation

Correct Answer

IPv6 forwarding uses longest-prefix match just like IPv4; the /48 is more specific than the containing /32.

Incorrect Answers

Fewer matched prefix bits means a broader, less specific route.

Equal cost comparisons occur among eligible equal-prefix routes, not arbitrary containing prefixes.

The destination is a global-unicast prefix, not an IPv6 multicast group.

Cisco Certified Network Associate (CCNA) (200-301) Practice Tests

Cisco 200-301 Practice Test 38 - 10 Questions (Last Reviewed 01-Oct-2026)
Cisco 200-301 Practice Test 39 - 10 Questions (Last Reviewed 30-Sep-2026)
Cisco 200-301 Practice Test 40 - 10 Questions (Last Reviewed 29-Sep-2026)
Cisco 200-301 Practice Test 41 - 10 Questions (Last Reviewed 28-Sep-2026)
Cisco 200-301 Practice Test 42 - 10 Questions (Last Reviewed 27-Sep-2026)

Pass Your Cisco 200-301 Exam Easy!

Question 390

Explanation

Correct Answer

Incorrect Answers

Question 391

Explanation

Correct Answer

Incorrect Answers

Question 392

Explanation

Correct Answer

Incorrect Answers

Question 393

Explanation

Correct Answer

Incorrect Answers

Question 394

Explanation

Correct Answer

Incorrect Answers

Question 395

Explanation

Correct Answer

Incorrect Answers

Question 396

Explanation

Correct Answer

Incorrect Answers

Question 397

Explanation

Correct Answer

Incorrect Answers

Question 398

Explanation

Correct Answer

Incorrect Answers

Question 399

Explanation

Correct Answer

Incorrect Answers

Question 400

Explanation

Correct Answer

Incorrect Answers

Cisco Certified Network Associate (CCNA) (200-301) Practice Tests