Cisco 200-301 Practice Test 46

Question 450

A network engineer intentionally exports a configuration containing administrator credentials to a personal mailbox, violating policy. A colleague accidentally leaves an ACL too broad while troubleshooting. What security distinction fits?

The ACL error is necessarily malicious because every network misconfiguration is intentional.
Classify the unauthorized credential export as an accidental change-control typo because it was performed by a normal employee.
The export illustrates an intentional insider threat; the broad ACL illustrates accidental misconfiguration risk.
Treat the accidental broad permit as deliberate exfiltration without establishing intent or any actual information transfer.

Explanation

Correct Answer

Intentional misuse by someone with authorized access is different from unintentional configuration error, though both can harm security.

Incorrect Answers

Operational mistakes can occur without hostile intent; investigation should distinguish negligence from abuse.

The person’s role does not change the intent described; knowingly exporting privileged secrets outside policy is intentional insider misuse.

A broad ACL can create exposure through operator mistake; the scenario supplies intentional behavior only for the separate credential export.

Question 451

R1 and R2 form OSPFv2 adjacency over a point-to-point routed Ethernet link where no third router exists. Which OSPF network type is appropriate when the interfaces are deliberately configured for a two-router adjacency without DR election?

An OSPF passive interface on both ends to exchange routes.
Point-to-point on both OSPF interfaces, with compatible Hello/dead and area settings.
Broadcast on R1 and point-to-point on R2 without reconciling behavior.
Nonbroadcast multiaccess on both sides without defining static neighbors.

Explanation

Correct Answer

OSPF point-to-point network type suppresses DR/BDR election on that link and supports a direct two-router adjacency.

Incorrect Answers

Passive interfaces suppress OSPF neighbor Hellos, preventing the desired adjacency.

Mismatched network types can yield inconsistent neighbor roles and routing behavior; the design calls for a common point-to-point configuration.

NBMA behavior is for other media and can require neighbor configuration; it is unnecessary for the simple routed two-router Ethernet link.

Question 452

After replacing a damaged copper cable, Gi0/1 remains up and CRC errors are no longer increasing. What evidence best validates that the physical issue was repaired?

Compare interface CRC/input error counters and link-flap history over an equivalent traffic period.
Clear interface counters after replacing the cable and accept the repair without observing CRC or link-flap behavior under load.
Verify only that the interface is administratively enabled, ignoring CRC errors and carrier transitions.
Record one successful ICMP echo after replacement and disregard recurring physical CRC counters.

Explanation

Correct Answer

An improving physical link should show stable carrier and no continuing corrupt-frame trend under normal load.

Incorrect Answers

A cleared counter looks clean initially even if frame corruption continues; compare error growth and link stability over a representative traffic period.

An interface can be up in configuration yet exhibit physical-layer corruption or flapping, which requires direct link measurements.

A single ping can pass despite an intermittent damaged link; error-rate trends and flaps directly test the original failure.

Question 453

A network management VLAN 99 is reachable from many campus prefixes. Policy now permits router SSH only from operations subnet 192.0.2.0/24. What control best enforces that source boundary?

Enable SSH authentication for all remote subnets but omit the approved IP-source ACL on management VTY.
A default route through the operations subnet.
Apply the source ACL only to a server-facing data interface that is not on the management packet path.
A source-filter ACL bound to the management VTY/access path, plus authenticated management access.

Explanation

Correct Answer

Restricting allowed management source networks independently of password authentication reduces the exposed administrative surface.

Incorrect Answers

Authentication identifies users but does not restrict which source networks can even attempt the administrative connection.

Routing preference is not a substitute for a permit/deny policy on SSH management connections.

An ACL at the wrong attachment point will not enforce the required restriction on routed SSH traffic to the VTY lines.

Question 454

An access switch receives voice frames marked DSCP EF from a managed IP phone but receives untrusted high-priority DSCP markings from an ordinary PC. Where should QoS trust be defined?

Set the switch hostname to EF so voice tags are recognized.
Classify the PC’s bulk packets into an EF-priority queue because the PC sends EF markings, without checking trust.
At the appropriate controlled ingress boundary, trusting the approved phone markings and remarking untrusted client traffic.
Trust every marking on every access interface regardless of attached device.

Explanation

Correct Answer

QoS trust policy decides which upstream labels are accepted; unconditional trust lets users claim priority and crowd out legitimate voice.

Incorrect Answers

A hostname does not establish DSCP classification or trust policy.

Untrusted hosts can spoof DSCP; a controlled ingress boundary should remark or reject those claims to protect actual voice service.

Unrestricted marking trust permits an untrusted PC to elevate bulk traffic into high-priority queues.

Question 455

A campus SDN controller becomes temporarily unreachable, while switches already have installed forwarding entries. Which statement is generally defensible?

The controller’s disappearance automatically converts every switch into a Layer 3 Internet router.
Existing programmed data-plane flows can often continue until table or topology state requires changes; new policy updates may be impaired.
All user packets must immediately stop because the controller forwards each physical Ethernet frame.
The switches permanently lose all Ethernet MAC addresses when controller TCP connectivity drops.

Explanation

Correct Answer

Switch forwarding does not necessarily hairpin every packet through a controller, but fresh provisioning and policy adaptation can depend on it.

Incorrect Answers

A control outage does not change physical hardware capabilities or installed VLAN/routing roles automatically.

SDN commonly separates controller decisions from device data forwarding; installed entries may persist through a control outage.

A control-connection failure does not inherently wipe every switch forwarding database instantly.

Question 456

A router has a route to 10.77.7.0/24 through Gi0/1, and the adjacent Ethernet switch shows host MACs in its CAM table. Which table chooses the outgoing routed interface for an IP packet to 10.77.7.8?

The router’s IP routing/forwarding information table, using longest-prefix destination lookup.
The switch CAM table, which stores every possible remote IP subnet.
Inspect only the local ARP cache and treat its neighbor IP-to-MAC mapping as a full remote prefix route table.
Use the switch’s MAC forwarding table to select the routed next-hop for a remote destination across VLAN boundaries.

Explanation

Correct Answer

IP prefixes select the routed next hop/exit interface, then local Layer 2 adjacency resolves the frame destination.

Incorrect Answers

A CAM table maps MAC addresses to local switchports and does not perform the router’s IPv4 prefix lookup.

ARP helps create Ethernet adjacency after routing chooses a next hop; it does not select the remote destination prefix and outgoing interface.

A switch CAM table maps link-layer destinations on local VLANs; the router uses its IP FIB to choose the routed path.

Question 457

An inbound extended ACL has sequence 10 permit tcp 192.0.2.0/24 any eq 443, followed by sequence 20 deny ip 192.0.2.0/24 any. A matching HTTPS packet arrives. What happens?

It is denied by sequence 20 because the last ACE always overrides earlier matches.
Both ACEs apply and the packet is simultaneously accepted and rejected.
Apply the implicit deny after sequence 20 before considering whether sequence 10 already matched the HTTPS packet.
It is permitted by sequence 10; the ACL stops at the first matching ACE.

Explanation

Correct Answer

IOS ACLs process entries in order, and a matching permit prevents later denies from being evaluated for that packet.

Incorrect Answers

Last-match-wins behavior is not the normal ACL evaluation rule; the first matching entry decides.

Sequential ACL evaluation does not combine contradictory actions after a first match.

The first matching permit ends evaluation; an implicit deny is applied only when no earlier ACE matched.

Question 458

An IPv6 router has a static host route 2001:db8:30::25/128 via FE80::2 out Gi0/1. Which destination does this prefix match?

All IPv6 destinations because /128 is a default route.
Only link-local addresses in FE80::/10.
Only the single IPv6 address 2001:db8:30::25.
Every address in the 2001:db8:30::/64 LAN.

Explanation

Correct Answer

A /128 specifies all 128 address bits, making it an IPv6 host route for exactly one destination.

Incorrect Answers

The IPv6 default route is ::/0, not a fully specified /128.

The next-hop can be link-local while the destination route remains a global-unicast /128.

A /64 includes many interface identifiers and is broader than the single-host /128 route.

Question 459

Two switches connect through an 802.1Q trunk. Client A in VLAN 18 sends a tagged frame over the trunk toward Client B in the same VLAN. How should the receiving switch classify that frame?

Ignore the VLAN tag and flood the frame across every campus VLAN.
Use VLAN ID 18 in the 802.1Q tag to select the corresponding VLAN forwarding context.
Use the source TCP port number as the Ethernet VLAN ID.
Treat the receiving trunk’s native VLAN as authoritative even though the arriving frame carries a VLAN 18 tag.

Explanation

Correct Answer

The receiving switch reads the tag and performs MAC forwarding within that VLAN, provided it is allowed and active.

Incorrect Answers

VLAN tagging creates Layer 2 separation; ignoring it would violate normal switched VLAN isolation.

Transport port fields belong to Layer 4 and do not identify the tagged VLAN on a trunk.

A correctly configured 802.1Q trunk uses an explicit tag for non-native VLAN traffic and does not recast it as native.

Question 460

A router receives traffic from 10.20.0.20 destined for 198.51.100.40. A route exists to the destination, but an ACL denies packets from source 10.20.0.0/24. Which functions are distinct?

The route determines the destination forwarding path; the ACL can independently deny based on source or other packet fields.
Routing tables choose only source address filters, never destination paths.
An ACL can never affect traffic when the router has a default route.
Assume a successful destination route makes the access list irrelevant to the flow’s source address and protocol.

Explanation

Correct Answer

A valid route and restrictive security policy can coexist, so reachability in the RIB is not permission to traverse the interface.

Incorrect Answers

Ordinary IP route lookup is based primarily on destination prefix, whereas ACLs provide packet filtering.

An installed default does not override configured inbound or outbound filtering rules.

Forwarding eligibility and packet security policy are independent; a permit or deny can stop an otherwise routable destination.

Cisco Certified Network Associate (CCNA) (200-301) Practice Tests

Cisco 200-301 Practice Test 44 - 10 Questions (Last Reviewed 25-Sep-2026)
Cisco 200-301 Practice Test 45 - 10 Questions (Last Reviewed 24-Sep-2026)
Cisco 200-301 Practice Test 46 - 10 Questions (Last Reviewed 23-Sep-2026)
Cisco 200-301 Practice Test 47 - 10 Questions (Last Reviewed 22-Sep-2026)
Cisco 200-301 Practice Test 48 - 10 Questions (Last Reviewed 21-Sep-2026)

Pass Your Cisco 200-301 Exam Easy!

Question 450

Explanation

Correct Answer

Incorrect Answers

Question 451

Explanation

Correct Answer

Incorrect Answers

Question 452

Explanation

Correct Answer

Incorrect Answers

Question 453

Explanation

Correct Answer

Incorrect Answers

Question 454

Explanation

Correct Answer

Incorrect Answers

Question 455

Explanation

Correct Answer

Incorrect Answers

Question 456

Explanation

Correct Answer

Incorrect Answers

Question 457

Explanation

Correct Answer

Incorrect Answers

Question 458

Explanation

Correct Answer

Incorrect Answers

Question 459

Explanation

Correct Answer

Incorrect Answers

Question 460

Explanation

Correct Answer

Incorrect Answers

Cisco Certified Network Associate (CCNA) (200-301) Practice Tests