McAfee Secure

Cisco 200-301 Bundle

Exam Code: 200-301

Exam Name Cisco Certified Network Associate (CCNA)

Certification Provider: Cisco

Corresponding Certification: CCNA

Cisco 200-301 Bundle $44.99
200-301 Sample 1 200-301 Sample 2 200-301 Sample 3 200-301 Sample 4 200-301 Sample 5 200-301 Sample 6 200-301 Sample 7 200-301 Sample 8 200-301 Sample 9 200-301 Sample 10

100% Cisco 200-301 Guaranteed Success With Testking Training Materials

Get Real 200-301 Exam Questions & Expert Verified Answers as Experienced on the Real Exam!

  • Questions & Answers

    200-301 Questions & Answers

    760 Questions & Answers

    The ultimate exam preparation tool, Questions & Answers mirrors the actual 200-301 exam while allowing you to hone and measure every aspect of your test-taking ability.

  • 200-301 Video Course

    200-301 Training Course

    271 Video Lectures

    200-301 Video Course is developed by Cisco Professionals to help you pass the 200-301 exam.

    Description

    This course will improve your knowledge and skills required to pass Cisco Certified Network Associate (CCNA) exam.
  • Study Guide

    200-301 Study Guide

    1969 PDF Pages

    Developed by industry experts, this 1969-page guide spells out in painstaking detail all of the information you need to ace 200-301 exam.

Cisco Certified Network Associate (CCNA) (200-301) Practice Tests

Satisfaction Guaranteed

Money Back Guarantee

Testking provides hassle-free money back guarantee with our products. That is because we have 100% trust in the abilities of our professional and experience product team, and our record is a proof of that.

99.6% PASS RATE
Total Cost: $194.97
Bundle Price: $149.98

Purchase Individually

  • Questions & Answers

    Questions & Answers

    760 Questions

    $124.99
  • 200-301 Video Course

    Training Course

    271 Video Lectures

    $39.99
  • Study Guide

    Study Guide

    1969 PDF Pages

    $29.99

Cisco 200-301 Practice Test 86

Question 850

For the identical prefix 172.23.189.0/24, a router evaluates these route candidates: OSPF (AD 110, via 192.0.2.117); RIP (AD 120, via 192.0.2.34); static (AD 1, via 192.0.2.100); static route was withdrawn. Ignore differences in metric across protocols. Which available source takes precedence in the routing table?

  1. No eligible route remains for this prefix
  2. OSPF (AD 110, via 192.0.2.117)
  3. static (AD 1, via 192.0.2.100)
  4. RIP (AD 120, via 192.0.2.34)

Explanation

Correct Answer

B:

OSPF (AD 110) is the eligible same-prefix candidate with the lowest administrative distance; it is preferred over RIP (AD 120).

Incorrect Answers

A:

The OSPF (AD 110) candidate is still eligible for this exact prefix, so it is incorrect to say that no route remains.

C:

The static route was explicitly withdrawn; its former AD 1 does not make it an eligible candidate for this decision.

D:

This RIP route has AD 120, higher than the eligible OSPF (AD 110); for the same prefix, Cisco chooses the lower administrative distance.

Question 851

Riverside Data needs to block only inbound Telnet to a server without blocking SSH. Which implementation directly addresses that objective without replacing it with a different network control?

  1. Deny TCP destination port 23 with the intended host match, and permit TCP 22 as required
  2. Configure WPA2 PSK and a sufficiently strong passphrase in the WLC GUI
  3. Require screen locking and restricted physical device access
  4. Use wildcard 0.0.0.255 with base 10.3.8.0

Explanation

Correct Answer

A:

TCP port 23 identifies Telnet, while SSH normally uses TCP port 22. This is the control that implements the specified requirement.

Incorrect Answers

B:

A WPA2 PSK WLAN authenticates clients through the configured shared secret. That is not sufficient here: TCP port 23 identifies Telnet, while SSH normally uses TCP port 22.

C:

Basic endpoint hygiene and physical controls help protect logged-in administrative sessions. That is not sufficient here: TCP port 23 identifies Telnet, while SSH normally uses TCP port 22.

D:

A wildcard bit set to one means ignore that address bit for ACL matching. That is not sufficient here: TCP port 23 identifies Telnet, while SSH normally uses TCP port 22.

Question 852

At both ends of one compatible Ethernet bundle, S1 Gi1/0/1 is configured channel-group 1 mode passive and S2 Gi1/0/1 is configured mode passive. Which LACP outcome is expected?

  1. No LACP bundle forms because neither passive side starts negotiation
  2. The two passive peers negotiate immediately without any active LACP speaker
  3. A static port-channel mode on the peer is implied by passive LACP
  4. An 802.1Q tag automatically triggers LACP discovery

Explanation

Correct Answer

A:

Passive mode listens but does not initiate LACP; two passive interfaces cannot start negotiation.

Incorrect Answers

B:

The stated mode behavior does not produce this result. LACP still requires an actively initiating peer and compatible link parameters.

C:

That explanation does not distinguish this option. “A static port-channel mode on the peer is implied by passive LACP” is an alternative action, but it does not by itself establish the outcome required in this case.

D:

That explanation does not distinguish this option. “An 802.1Q tag automatically triggers LACP discovery” is an alternative action, but it does not by itself establish the outcome required in this case.

Question 853

An acceptance check at Baypoint Retail has two requirements: (1) identify the spanning-tree root switch from bridge IDs, and (2) reduce the chance of an unintended access switch becoming STP root. Which option addresses both requirements?

  1. First, select the switch with the lowest priority plus MAC bridge identifier; then use a supported out-of-band console connection.
  2. First, configure spanning-tree portfast on a true endpoint-facing access port; then enable Loop Guard on eligible non-designated spanning-tree links.
  3. First, select the switch with the lowest priority plus MAC bridge identifier; then set the intended distribution switch's STP priority lower than competing bridges.
  4. First, explicitly set switchport mode access on the endpoint-facing port; then set the intended distribution switch's STP priority lower than competing bridges.

Explanation

Correct Answer

C:

Both outcomes are covered: (1) STP elects the lowest bridge ID as the root for a spanning-tree instance. (2) STP root election prefers the lowest bridge ID, so priority controls root placement. Neither action is a substitute for the other.

Incorrect Answers

A:

The first step covers (1), but the second addresses manage a switch when its production network is unreachable. A console provides local management access independent of in-band IP reachability. It leaves outcome (2) unfulfilled.

B:

Neither step is the requested pair: Configure spanning-tree portfast on a true endpoint-facing access port is for enable rapid host access without waiting for ordinary STP transitions, and Enable Loop Guard on eligible non-designated spanning-tree links is for avoid a blocked STP link unexpectedly forwarding after BPDUs disappear. PortFast brings an edge port to forwarding quickly; it is not safe for an unintended switch link. The proposed plan misses the two stated outcomes.

D:

The second step covers (2), but the first addresses avoid a user access port automatically forming an unintended trunk. Access mode prevents the interface from carrying multiple data VLANs as a negotiated trunk. It leaves outcome (1) unfulfilled.

Question 854

After BPDU guard puts a PortFast endpoint port into errdisabled state, technicians remove the unauthorized small switch. What should precede controlled recovery of the affected access port?

  1. Disable all spanning tree protection on the entire access switch
  2. Change the bridge priority to zero so BPDU guard stops operating
  3. Replace the port with a routed OSPF tunnel irrespective of endpoint needs
  4. Verify that the attached device is now an endpoint and apply the approved errdisable recovery procedure while retaining BPDU guard.

Explanation

Correct Answer

D:

Recovering the interface without removing the cause repeats the topology violation. Validate the cabling and peer, then use approved administrative or timed recovery while keeping the safeguard.

Incorrect Answers

A:

Removing the protective controls broadens loop risk rather than fixing the offending attachment.

B:

Root priority is not a legitimate replacement for PortFast BPDU guard on access ports.

C:

An OSPF tunnel is unrelated to safe recovery from an unexpected BPDU on an access port.

Question 855

A router points a static summary for 10.100.0.0/16 to Null0 to discard traffic lacking a more-specific internal route. It also has a connected 10.100.3.0/24 interface. What happens to traffic destined for 10.100.3.25?

  1. The connected /24 route forwards it toward the local subnet; the broader Null0 summary catches only unmatched addresses inside /16.
  2. The /16 Null0 route discards it because Null0 is always preferred over an interface.
  3. The router broadcasts the packet on every network because Null0 conflicts with connected routes.
  4. The router must remove the connected route before using the /16 summary.

Explanation

Correct Answer

A:

Longest-prefix forwarding selects the connected /24 over the /16 discard summary, so known subnets remain reachable while unknown summary destinations can be dropped.

Incorrect Answers

B:

Null0 is not intrinsically more specific; the /24 destination match wins.

C:

A summary discard route can coexist with more-specific connected prefixes without broadcast fallback.

D:

Connected and static summary routes can coexist and serve different destination matches.

Question 856

A network upgrade at Pinecrest Schools has two requirements: (1) provide centralized wireless client authentication using an industry-standard AAA protocol, and (2) explain why newly created VLAN hosts cannot talk across VLANs by default. Select TWO actions that together satisfy both outcomes.

  1. Use a controller-based WLAN architecture
  2. Configure trunk and allowed VLANs on the port-channel interface
  3. Use RADIUS with an authorized WLAN authentication design
  4. Add routing through an SVI or router gateway
  5. Apply an appropriate WLC wireless QoS profile

Explanation

Correct Answers

C:

Correct for outcome (1): RADIUS commonly handles network-access authentication and accounting for 802.1X WLAN clients. The other outcome needs its separate action.

D:

Correct for outcome (2): A Layer 2 VLAN boundary does not forward IPv4 packets between IP subnets by itself. It complements the first required control.

Incorrect Answers

A:

Not selected: Use a controller-based WLAN architecture is for centrally manage radio settings of lightweight campus APs. Lightweight APs and a controller separate centralized policy/control from radio client access. This is outside the two requested outcomes.

B:

Not selected: Configure trunk and allowed VLANs on the port-channel interface is for keep an aggregated trunk's VLAN policy consistent. The logical port-channel is the switching interface whose member ports must have compatible settings. This does not provide either of the two specified controls.

E:

Not selected: Apply an appropriate WLC wireless QoS profile is for prioritize latency-sensitive voice clients over bulk wireless traffic. Wireless QoS maps traffic classes to airtime/queuing behavior for supported workloads. This is not one of the two required changes.

Question 857

A change advisory for Harborview Logistics has two requirements: (1) hold independent overlapping IP route tables on one router, and (2) provide wireless client association to a wired enterprise LAN. Which option addresses both requirements?

  1. First, use separate virtual routing and forwarding instances; then use show mac address-table to inspect learned entries.
  2. First, use a WAN transport design with appropriate edge routers; then use a next-generation firewall with relevant application policies.
  3. First, use separate virtual routing and forwarding instances; then deploy an access point connected to an appropriate switchport.
  4. First, use an appropriate PoE-capable switchport and compatible power budget; then deploy an access point connected to an appropriate switchport.

Explanation

Correct Answer

C:

Both outcomes are covered: (1) VRFs logically isolate routing tables even when interfaces share one physical platform. (2) The AP bridges 802.11 client frames to the wired distribution system. Neither action is a substitute for the other.

Incorrect Answers

A:

The first step covers (1), but the second addresses find a host's VLAN and learned switchport from its MAC address. The MAC table lists forwarding entries indexed by destination MAC and VLAN. It leaves outcome (2) unfulfilled.

B:

Neither step is the requested pair: Use a WAN transport design with appropriate edge routers is for connect branch locations across a provider-operated geographic network, and Use a next-generation firewall with relevant application policies is for apply stateful application-aware inspection at the edge. WAN connectivity links geographically separated LAN sites via a provider or overlay. The proposed plan misses the two stated outcomes.

D:

The second step covers (2), but the first addresses power a ceiling AP through its Ethernet cable. PoE delivers specified electrical power over Ethernet pairs while carrying network traffic. It leaves outcome (1) unfulfilled.

Question 858

A branch design for Lighthouse Medical has two requirements: (1) provide centralized wireless client authentication using an industry-standard AAA protocol, and (2) avoid transmitting an administrator password in cleartext to a router CLI. Which proposed plan satisfies both outcomes?

  1. First, recognize VLAN 1 as the default access VLAN; then add routing through an SVI or router gateway.
  2. First, use RADIUS with an authorized WLAN authentication design; then use SSH rather than Telnet.
  3. First, use RADIUS with an authorized WLAN authentication design; then use show interfaces trunk.
  4. First, keep the alternate port discarding until needed; then use SSH rather than Telnet.

Explanation

Correct Answer

B:

Both outcomes are covered: (1) RADIUS commonly handles network-access authentication and accounting for 802.1X WLAN clients. (2) SSH encrypts remote terminal data and authentication, whereas Telnet does not. Neither action is a substitute for the other.

Incorrect Answers

A:

Neither step is the requested pair: Recognize VLAN 1 as the default access VLAN is for place untagged access switchports into their default VLAN on a factory-reset switch, and Add routing through an SVI or router gateway is for explain why newly created VLAN hosts cannot talk across VLANs by default. Cisco default Layer 2 switchports belong to VLAN 1 until explicitly assigned otherwise. The proposed plan misses the two stated outcomes.

C:

The first step covers (1), but the second addresses confirm which VLANs are actively forwarded over a trunk. The command displays operational trunks, encapsulation/native VLAN and allowed/active VLANs. It leaves outcome (2) unfulfilled.

D:

The second step covers (2), but the first addresses understand Rapid PVST+ alternate-port behavior. An alternate port provides a backup path that does not forward user frames during normal loop-free operation. It leaves outcome (1) unfulfilled.

Question 859

A branch receives the subnet 10.7.28.0/22. What is its highest ordinary usable IPv4 host address under conventional subnet rules?

  1. 10.7.31.254
  2. 10.7.28.254
  3. 10.7.31.255
  4. 10.7.32.1

Explanation

Correct Answer

A:

A /22 extends from third octet 28 through 31. The directed broadcast is 10.7.31.255, leaving .31.254 as the last host.

Incorrect Answers

B:

This is usable, but not the highest host across the full /22.

C:

The final address of the subnet is the directed broadcast, not an assignable host.

D:

This is outside the /22 and belongs to the following block.

Question 860

During a review, the administrator for Oakbridge University is asked to avoid transmitting an administrator password in cleartext to a router CLI. Which approach satisfies the precise requirement?

  1. Remove it from the trunk allowed VLAN list
  2. Use SSH rather than Telnet
  3. Configure a supported WPA2-Personal PSK WLAN
  4. Consider FlexConnect operation on supported APs

Explanation

Correct Answer

B:

SSH encrypts remote terminal data and authentication, whereas Telnet does not. This is the control that implements the specified requirement.

Incorrect Answers

A:

The allowed list determines which tagged VLANs may traverse the trunk. That is not sufficient here: SSH encrypts remote terminal data and authentication, whereas Telnet does not.

C:

WPA2-Personal authenticates users with the configured shared key, unlike enterprise 802.1X. That is not sufficient here: SSH encrypts remote terminal data and authentication, whereas Telnet does not.

D:

FlexConnect supports selected local switching and local survivability behavior in branch deployments. That is not sufficient here: SSH encrypts remote terminal data and authentication, whereas Telnet does not.