Cisco 200-301 Practice Test 43

Question 420

A router already uses an OSPF route with AD 110 to 10.77.0.0/16. An administrator adds an equal-prefix static route with AD 200 that does not appear as active. Why?

The higher-distance static is a floating candidate; the lower-AD OSPF entry is preferred while available.
A configured static route must overwrite every learned route even with AD 200.
Compare OSPF and static path metrics directly instead of their configured administrative distances for this same /16 prefix.
OSPF installs a longer prefix even though both entries use the same /16 mask.

Explanation

Correct Answer

For equal destination prefixes, administrative distance normally selects which routing source is installed as active.

Incorrect Answers

A manually entered static can intentionally have higher AD than OSPF to serve as a backup.

Metrics from separate routing sources do not override the inter-source AD preference in an equal-prefix comparison.

The scenario compares equal-length prefixes, so source preference rather than longest-prefix specificity explains the result.

Question 421

A PC can ping its LAN default gateway and a public IPv4 address, but attempts to open intranet.example.local report name lookup failure. What should be checked first?

Use a successful ping to a public IPv4 address as proof the intranet hostname is present in the client’s DNS resolver.
Enable PortFast on the client access port to improve convergence, but leave the resolver unable to answer intranet.example.local.
Increase local route preference for Internet traffic while retaining the same failed internal hostname resolution path.
DNS resolver configuration and the existence of the appropriate intranet host record.

Explanation

Correct Answer

Working IP gateway and remote-IP connectivity isolate the symptom to name resolution rather than general routing failure.

Incorrect Answers

Numeric IP reachability bypasses name lookup, so a working ping does not establish that an intranet DNS record or resolver exists.

PortFast changes Layer 2 transition timing for a host port. It cannot create a missing DNS record or correct an incorrect resolver.

IP reachability to numeric public destinations is already healthy. Changing routes does not diagnose why the internal name cannot resolve.

Question 422

A WLAN administrator hides an SSID to deter casual discovery. A security review asks whether this setting alone encrypts user traffic. Which answer is accurate?

Yes; all nonbroadcast WLANs require personal pre-shared keys by protocol.
Suppress SSID beacons but leave the WLAN set to open authentication with no effective data encryption.
No; an SSID broadcast setting is not encryption. Configure an appropriate WPA2/WPA3 authentication and cipher suite.
Yes; a hidden SSID forces AES encryption even with Open authentication.

Explanation

Correct Answer

Hidden networks can still be discovered through management traffic; link confidentiality depends on actual WLAN security settings.

Incorrect Answers

Visibility and security mode can be configured separately; hiding a name is not proof of a key.

Hidden-name operation only alters discovery; client payload protection requires a proper WPA security configuration.

SSID beacon suppression does not change an open authentication profile into encrypted key management.

Question 423

R1 has a static route to 10.60.0.0/16 via 192.0.2.10, and it resolves 192.0.2.10 through its connected 192.0.2.0/24 interface. What is this process called?

A TCP handshake between the router and all hosts in 10.60.0.0/16.
Recursive next-hop resolution that finds an outgoing adjacency for the route’s specified next hop.
Replace the next-hop route lookup with a spanning-tree port cost calculation for 192.0.2.10.
Resolve the configured next hop by querying DNS for a matching hostname instead of checking installed route entries.

Explanation

Correct Answer

A route whose next hop is an IP address requires a usable path to that neighbor before the router can program forwarding.

Incorrect Answers

The router selects a forwarding adjacency independently of individual end-host transport sessions.

STP is relevant to Layer 2 topology but cannot substitute for IP recursive next-hop resolution through the routing table.

Router recursion follows connected or reachable IP routes; a DNS name is not the ordinary FIB adjacency lookup.

Question 424

Two routers need consistent clock time for troubleshooting. A technician configures the correct local timezone string on each, but their UTC clocks still differ by minutes. What should be used?

An approved NTP server or hierarchy with validated synchronization status.
Only clock timezone commands on both devices.
A larger switch MAC address table to preserve clock state.
The syslog server’s TCP port number as an NTP time source.

Explanation

Correct Answer

Time zone affects display, while NTP actually disciplines clocks to a shared time reference for event correlation.

Incorrect Answers

A timezone label does not automatically correct a drifting underlying clock or synchronize multiple devices.

MAC learning capacity does not synchronize the clock hardware or software.

A logging endpoint port is not by itself an authenticated time-reference service.

Question 425

An edge switch uses DHCP snooping and must reject an access port that generates excessive DHCP messages. Which protection is most relevant?

Trust the user-facing access port for all DHCP server replies.
Raise the DHCP server lease duration to reduce churn without limiting an untrusted host flooding discover packets.
Configure DHCP snooping but mark the untrusted user port as trusted so it can send any DHCP offers.
Set an appropriate DHCP snooping packet rate limit on the untrusted access interface.

Explanation

Correct Answer

Rate limiting can prevent DHCP starvation attempts or misbehaving hosts from flooding the trusted DHCP infrastructure.

Incorrect Answers

Trusting a client port can permit unauthorized DHCP server traffic and undermines the snooping boundary.

Longer leases may reduce normal renewals but do not rate-limit deliberate high-volume DHCP requests on the access interface.

Trusting the client port undermines the anti-rogue-server protection and does not enforce the requested client rate limit.

Question 426

An automation engineer needs to encode a switch description as JSON: The port is named "Lab A". Which string representation is valid in standard JSON?

A single-quoted string containing unescaped double quotes.
A double-quoted JSON string containing unescaped interior quote marks.
A quoted JSON string with the interior double quotes escaped, such as "The port is named \"Lab A\"".
An unquoted value containing The port is named Lab A.

Explanation

Correct Answer

JSON string delimiters use double quotes; a literal embedded double quote must be escaped with a backslash to remain valid syntax.

Incorrect Answers

Standard JSON requires double quotes around strings rather than JavaScript-style single-quoted literals.

Unescaped quote characters would terminate the string early and make the JSON parser fail.

JSON does not permit arbitrary unquoted text values; strings require double-quote delimiters.

Question 427

R1 has a route to 10.0.0.0/8 with AD 1 and a route to 10.14.8.0/24 with AD 110. A packet targets 10.14.8.10. Which entry is selected?

Neither route because the host uses private IPv4 space.
The /24 route despite its higher AD, because longest-prefix matching applies first across different prefixes.
The /8 route because AD 1 always wins across every prefix length.
Choose the lower-AD /8 route before checking the /24 match length for the packet’s destination.

Explanation

Correct Answer

The more-specific route identifies the destination network more precisely; AD compares competing sources for comparable prefix matches.

Incorrect Answers

Private IPv4 is routable inside an organization, and both entries match the destination.

Administrative distance does not override destination specificity when both prefixes are installed and one is longer.

The /24 is the more-specific installed route; administrative distance does not make the broader /8 win the destination lookup.

Question 428

An operator opens two HTTPS sessions from the same workstation to the same web server. Which transport details help the server distinguish simultaneous TCP conversations?

Source/destination addresses and TCP port numbers, forming distinct endpoint tuples.
Use only the remote HTTPS destination port 443 and ignore distinct ephemeral client source ports for concurrent TCP sessions.
Use only the destination server IP and assume one client cannot have simultaneous sessions to the same host.
The switch chassis serial number as the TCP sequence number.

Explanation

Correct Answer

TCP sessions are identified by transport endpoint combinations; ephemeral source ports let one client open multiple simultaneous connections.

Incorrect Answers

Two connections can share destination and server address yet be separated by the client-side ephemeral port in the transport tuple.

Multiple TCP connections can share an IP endpoint but have distinct source ports, so the destination address alone is insufficient.

Switch inventory metadata is not TCP port or byte-stream state for application connections.

Question 429

R1 is attached to a switch trunk carrying VLANs 10 and 20, and must route between them using separate subinterfaces on one physical port. Which configuration feature identifies VLAN 20 traffic on the router subinterface?

switchport access vlan 20 on the physical router interface.
Configure the router subinterface IP address but omit the required 802.1Q encapsulation setting for VLAN 20.
Configure dot1Q encapsulation 10 on the VLAN 20 subinterface and use an IP gateway address for VLAN 20.
encapsulation dot1Q 20 on the corresponding routed subinterface.

Explanation

Correct Answer

Router-on-a-stick uses 802.1Q subinterfaces with VLAN-specific encapsulation tags and gateway IP addresses.

Incorrect Answers

A router-on-a-stick design uses routed subinterfaces and tagged trunk traffic, not a normal switch access-port assignment.

A gateway IP alone does not tell the subinterface which tagged VLAN to receive across a router-on-a-stick trunk.

Even a correctly addressed subinterface must match the actual VLAN ID in the trunk’s Ethernet tag to handle that VLAN.

Question 430

An extended ACL should permit clients from 192.0.2.0/24 to reach web server 198.51.100.10 TCP port 443. Which port field must the destination service match?

The UDP destination port eq 443 only.
Match the client’s source TCP port 443 instead of the destination listener on the web server.
The TCP destination port eq 443 after the destination host address.
The TCP source port eq 443 on every client.

Explanation

Correct Answer

A normal HTTPS client uses an ephemeral source port; the listening service is on the server’s TCP destination port 443.

Incorrect Answers

QUIC may use UDP 443, but the explicitly requested TCP HTTPS flow requires TCP matching.

Typical HTTPS clients initiate from ephemeral source ports, so source eq 443 would reject their ordinary connections.

Clients generally originate sessions from ephemeral ports, so source eq 443 would miss typical HTTPS flows.

Cisco Certified Network Associate (CCNA) (200-301) Practice Tests

Cisco 200-301 Practice Test 41 - 10 Questions (Last Reviewed 28-Sep-2026)
Cisco 200-301 Practice Test 42 - 10 Questions (Last Reviewed 27-Sep-2026)
Cisco 200-301 Practice Test 43 - 10 Questions (Last Reviewed 26-Sep-2026)
Cisco 200-301 Practice Test 44 - 10 Questions (Last Reviewed 25-Sep-2026)
Cisco 200-301 Practice Test 45 - 10 Questions (Last Reviewed 24-Sep-2026)

Pass Your Cisco 200-301 Exam Easy!

Question 420

Explanation

Correct Answer

Incorrect Answers

Question 421

Explanation

Correct Answer

Incorrect Answers

Question 422

Explanation

Correct Answer

Incorrect Answers

Question 423

Explanation

Correct Answer

Incorrect Answers

Question 424

Explanation

Correct Answer

Incorrect Answers

Question 425

Explanation

Correct Answer

Incorrect Answers

Question 426

Explanation

Correct Answer

Incorrect Answers

Question 427

Explanation

Correct Answer

Incorrect Answers

Question 428

Explanation

Correct Answer

Incorrect Answers

Question 429

Explanation

Correct Answer

Incorrect Answers

Question 430

Explanation

Correct Answer

Incorrect Answers

Cisco Certified Network Associate (CCNA) (200-301) Practice Tests