Cisco 200-301 Practice Test 48

Question 470

Dynamic ARP Inspection is enabled on VLAN 22 and a statically addressed printer is being dropped. The printer has no DHCP snooping binding entry. Which explanation fits?

Mark the printer access port as DAI trusted for all ARP assertions without defining an approved static identity exception.
Create an unrelated static IPv4 route to the printer while leaving its missing DAI IP/MAC binding unresolved.
DAI cannot validate the printer’s ARP against the DHCP snooping binding database; use a trusted binding/ARP ACL policy for the static host.
Increase the DHCP snooping binding aging interval without creating a verified static IP/MAC association for the printer.

Explanation

Correct Answer

DAI commonly checks ARP source IP/MAC against learned bindings; static endpoints need an approved validation mechanism rather than blind disablement.

Incorrect Answers

Trusting an ordinary endpoint port bypasses DAI validation and can admit forged claims; a narrowly scoped ARP ACL/binding is safer.

A router path cannot establish that the local printer ARP source pair is legitimate under switch DAI policy.

A longer age limit can retain previously learned dynamic entries, but this statically addressed printer never created the required lease binding. DAI still needs a trusted static validation rule or supported ARP ACL.

Question 471

Two distribution routers share an HSRP group. R1 is active at priority 120 but loses its tracked upstream WAN interface, reducing effective priority below standby R2. What should happen if the configuration permits takeover?

Adjust the STP root priority without modifying or checking HSRP interface tracking or effective group priority.
R2 can become active when the tracked priority reduction makes it preferable and preemption/standby behavior allows.
R1 must remain active because only interface MAC address ordering controls HSRP.
Assume lowering R1’s priority automatically causes a standby takeover even if R2 is not configured to preempt when required.

Explanation

Correct Answer

HSRP tracking ties gateway preference to upstream reachability, helping hosts avoid an active router whose external path failed.

Incorrect Answers

Bridge priority does not decide the active virtual IP gateway; tracking and preemption settings are the relevant HSRP controls.

Configured HSRP priority and tracking can affect active role; physical MAC alone is not the sole election factor.

The effective gateway switch also depends on role transition and preempt behavior, not priority arithmetic alone.

Question 472

A data center adds many application microservices on leaf switches. Most traffic goes between compute racks rather than directly out to users. Which traffic pattern describes this?

East-west traffic between internal server tiers, often traversing a spine-leaf fabric.
North-south traffic by definition, because all Ethernet frames contain a source and destination.
Only management-plane traffic, because servers never exchange application data.
Call inter-rack service RPCs north-south merely because each request passes through a spine node.

Explanation

Correct Answer

Inter-rack or application-to-application flows are east-west, unlike user-to-data-center Internet-facing north-south traffic.

Incorrect Answers

North-south generally describes traffic entering or leaving the data center rather than internal tier-to-tier flows.

Microservices regularly communicate over data-plane network connections among racks and services.

Fabric transit does not change the traffic classification; internal tier-to-tier data remains east-west even when it crosses spines.

Question 473

A laptop walks from AP1 to AP2 under the same controller and SSID while maintaining an active voice call. Which feature is central to the requested experience?

Forcing every roaming client to keep transmitting through the now-distant AP1 forever.
Changing the laptop’s Ethernet MAC address to the controller IP.
Disabling all 802.11 authentication and encryption during the call.
Supported WLAN client roaming that preserves authorized network connectivity and minimizes reassociation interruption.

Explanation

Correct Answer

Controller-coordinated mobility and compatible security/Layer 2 design help a client move between cells without losing application continuity.

Incorrect Answers

A radio handoff to a nearer AP is the purpose of roaming; sticking to the old AP can worsen call quality.

Roaming does not require replacing the client’s link-layer address with a controller’s Layer 3 address.

Roaming can operate with secure WLAN policies; disabling protection is not a valid mobility strategy.

Question 474

A branch has an internal IPv4 web server 10.10.30.15. The ISP assigns one public IP 198.51.100.30 to expose HTTPS to external clients while hiding the server’s private address. Which NAT approach applies?

Change the server’s private 10.10 address to an IPv6 multicast group.
Configure only an outbound source NAT overload rule and expect unsolicited inbound HTTPS flows to find the server automatically.
A static mapping or static PAT for the required public destination address and TCP service port to the internal server.
Only dynamic outbound PAT for inside clients initiating Internet access.

Explanation

Correct Answer

Publishing a stable service address/port requires a predictable inbound translation entry and corresponding access policy.

Incorrect Answers

Multicast addressing is not an inbound public IPv4 NAT publication solution.

Dynamic outbound PAT does not establish the static inbound destination address/port translation needed to publish the private service.

Generic outbound overload does not guarantee inbound connections to the private server’s public service mapping.

Question 475

A network automation team needs to know which person approved a firewall configuration change and roll back if it causes a failure. Which source-management practice supports this?

Embed the administrator password in each configuration commit for convenience.
Store configurations and changes in version control with peer review, commit history, and tested rollback plans.
Keep one unversioned text file named current and overwrite it after every change.
Save only screenshots of a running-config without recording a structured diff.

Explanation

Correct Answer

Version control records proposed diffs, authorship and review events and provides a reference point for controlled rollback.

Incorrect Answers

Putting secrets into version-control history creates avoidable disclosure and does not improve change authorization.

Overwriting removes traceable history and makes old approved policy difficult to reconstruct.

Screenshots may capture appearance but are not a reliable machine-applicable history or reviewable change set.

Question 476

An OSPF network upgrades all 1-Gbps links to 10 Gbps, but their configured OSPF costs still show 1. Which design parameter should be reviewed to differentiate high-speed interfaces?

The OSPF reference bandwidth used in automatic interface-cost calculation, consistently across routers.
Increase OSPF interface hello and dead timers to differentiate the new 10-Gbps link costs.
Set a larger OSPF reference bandwidth on only one router while retaining inconsistent metric interpretation across the area.
Raise the bandwidth administrative description on an interface without changing its actual bandwidth reference or explicit OSPF cost.

Explanation

Correct Answer

Default low reference bandwidth can make multiple high-speed links share cost 1; raising it consistently can reflect larger bandwidth differences.

Incorrect Answers

Neighbor timers affect adjacency liveness, not the reference-bandwidth formula used to calculate interface cost.

A changed reference affects local cost calculations; consistency among routers avoids unpredictable path selection and asymmetry.

Textual metadata does not recalculate SPF link weights; inspect the actual metric inputs and reference bandwidth.

Question 477

An IOS router permits SSH on its VTY lines but should deny login attempts from any source except subnet 192.0.2.0/24. Which management line control is appropriate?

Use a login authentication method list but leave the VTY access-class unspecified, allowing SSH attempts from any reachable subnet.
Apply a source ACL only on an unrelated transit interface where permitted SSH packets do not pass.
Disable VTY user authentication and accept traffic from an allowed network as sufficient administrator identity.
Apply an appropriate ACL with access-class in under line vty.

Explanation

Correct Answer

VTY access-class filters which remote IP addresses can establish administrative sessions to the device.

Incorrect Answers

AAA protects identity after connection; the case specifically requires an inbound management source ACL as a separate boundary.

A policy at the wrong ingress can miss management attempts; VTY access-class is the direct management source filter.

An access-class restricts source addresses but does not authenticate the person operating the router. Keep SSH login/AAA in place and apply a trusted VTY source filter as a complementary control.

Question 478

Three department VLANs need nonoverlapping /26 networks carved from 10.2.4.0/24. Which allocation is valid?

10.2.4.0/26, 10.2.4.60/26 and 10.2.4.120/26.
10.2.4.0/24, 10.2.4.64/26 and 10.2.4.128/26.
10.2.4.0/26, 10.2.4.64/26 and 10.2.4.128/26.
10.2.4.0/26, 10.2.4.32/26 and 10.2.4.64/26.

Explanation

Correct Answer

A /26 has 64-address blocks, so those three boundaries are distinct and inside the parent /24.

Incorrect Answers

The .60 and .120 addresses are not properly aligned /26 network boundaries.

The /24 overlaps both /26 allocations, violating the nonoverlap requirement.

The .32/26 address sits inside 10.2.4.0/26 and is not a separate aligned /26 network.

Question 479

Two switch members of an intended LACP EtherChannel have mismatched trunk allowed VLAN sets and one bundle member is suspended. Which TWO corrective checks are relevant?

Allow VLANs 10 and 20 only on one LACP member and remove them from the other member while expecting that asymmetry to remain bundled.
Compare and align each candidate member’s trunk mode and allowed/native VLAN consistency for the bundle.
Verify both ends use compatible LACP negotiation settings and that expected physical ports participate.
Configure one member as an access port for VLAN 10 while the second remains an 802.1Q trunk carrying VLANs 10 and 20.
Keep the conflicting trunk allowed VLAN sets but set both member LACP priorities to the same value as a workaround.

Explanation

Correct Answers

EtherChannel requires compatible Layer 2 switchport settings; mismatched trunk characteristics can prevent safe member aggregation.

Correct LACP active/passive behavior and member eligibility are prerequisites to negotiated aggregation.

Incorrect Answers

EtherChannel members need compatible trunk characteristics, including the appropriate allowed VLAN consistency. Splitting allowed sets by physical member can suspend or misconfigure the bundle.

An LACP channel cannot provide a consistent logical Layer 2 trunk when its intended physical members use incompatible access/trunk modes. Align member configuration and verify bundle state.

LACP system or port priority does not replace compatibility of Layer 2 trunk configuration. The mismatch in VLAN handling remains, even if LACP can negotiate at the protocol level.

Question 480

A stub office has one upstream ISP router reachable at 192.0.2.1 on its WAN /30 and no dynamic default routing. Which IOS configuration allows it to forward unmatched IPv4 destinations to the ISP?

ip route 0.0.0.0 0.0.0.0 192.0.2.1
ip route 255.255.255.255 255.255.255.255 192.0.2.1
ip route 0.0.0.0 255.255.255.0 192.0.2.1
ip route 0.0.0.0 0.0.0.0 192.0.2.0

Explanation

Correct Answer

The default IPv4 route covers destinations not matched by more-specific prefixes and points to the valid adjacent ISP next hop.

Incorrect Answers

That /32 represents one destination rather than all otherwise unmatched addresses.

A /24 route to 0.0.0.0 does not provide a universal IPv4 default route.

192.0.2.0 is the /30 network identifier, not the usable next-hop router address given.

Cisco Certified Network Associate (CCNA) (200-301) Practice Tests

Cisco 200-301 Practice Test 46 - 10 Questions (Last Reviewed 23-Sep-2026)
Cisco 200-301 Practice Test 47 - 10 Questions (Last Reviewed 22-Sep-2026)
Cisco 200-301 Practice Test 48 - 10 Questions (Last Reviewed 21-Sep-2026)
Cisco 200-301 Practice Test 49 - 10 Questions (Last Reviewed 20-Sep-2026)
Cisco 200-301 Practice Test 50 - 10 Questions (Last Reviewed 19-Sep-2026)

Pass Your Cisco 200-301 Exam Easy!

Question 470

Explanation

Correct Answer

Incorrect Answers

Question 471

Explanation

Correct Answer

Incorrect Answers

Question 472

Explanation

Correct Answer

Incorrect Answers

Question 473

Explanation

Correct Answer

Incorrect Answers

Question 474

Explanation

Correct Answer

Incorrect Answers

Question 475

Explanation

Correct Answer

Incorrect Answers

Question 476

Explanation

Correct Answer

Incorrect Answers

Question 477

Explanation

Correct Answer

Incorrect Answers

Question 478

Explanation

Correct Answer

Incorrect Answers

Question 479

Explanation

Correct Answers

Incorrect Answers

Question 480

Explanation

Correct Answer

Incorrect Answers

Cisco Certified Network Associate (CCNA) (200-301) Practice Tests