Cisco 200-301 Bundle

An 802.1Q trunk carries multiple VLANs over one link; it cannot substitute for a gateway that routes traffic between their IP prefixes. Trunking and routing solve different parts of the topology.

PortFast can accelerate edge-port forwarding but does not supply routed interfaces or enable IP routing. Using it indiscriminately on switch interconnections can also weaken protection against bridging loops.

MAC learning associates destination hardware addresses with ports inside a broadcast domain. It cannot select IP next hops between VLANs, so increasing the table capacity does not create the requested gateways.

An AP provides radio association and bridges client traffic. Broadcasting a WLAN does not inspect exploit signatures and stop malicious sessions entering a separate server network.

An IDS can identify suspicious traffic and notify an analyst but does not inherently block packets on the path. The stated preventive control requires an inline enforcement action.

A simple repeater forwards physical signals without making application-security decisions. It cannot identify exploit patterns or enforce inline prevention rules.

An IPS can inspect and block exploit traffic, but detecting malicious payloads is not the ordinary destination-prefix forwarding function being requested. The inter-subnet next hop is decided by routing.

Layer 2 switching delivers Ethernet frames inside one broadcast domain using a MAC table. It does not ordinarily compare destination IP prefixes and select an inter-subnet next hop, which is the stated requirement.

An AP associates wireless stations and bridges their frames to a wired network. Merely advertising a radio SSID cannot perform the specified enterprise IP-prefix route lookup between subnets.

Option 82 can relay access-network information to a DHCP server for address allocation policies. It does not inject DC power into the cable, which is the missing physical capability.

Port address translation lets multiple inside IP sessions share public addressing but provides no electrical power on Ethernet wires. It would not resolve camera installation constraints at the endpoint.

VLAN tagging distinguishes Layer 2 traffic classes on trunk links; it does not change the switch power circuitry. A data-only switch cannot power cameras merely by carrying tagged frames.

A client device participates in a WLAN but does not coordinate all other APs and network-wide wireless policy. A saved password can establish client authentication; it is not centralized AP management.

DHCP provides network addressing so APs can communicate, but lease assignment does not define SSIDs, radio policy or the controller association process. Address assignment and wireless control are distinct services.

A router forwards IP traffic and maintains neighbor information, but that does not make it the WLAN control plane. The controller handles managed AP policy even when the router carries their management traffic.

A subnet prefix determines IP addressing and routing reachability. It does not supply electrical power or increase the physical power capacity available to an Ethernet port.

A MAC table controls where Layer 2 frames are forwarded, not how many watts the hardware can deliver. MAC table capacity cannot substitute for the required PoE power budget.

Administrative distance chooses between competing route sources. It does not negotiate PoE classes or allocate electricity from the access switch chassis.

Routers choose IP next hops and separate broadcast domains, but they do not independently remove a loop formed among ports inside a bridged VLAN. STP is the relevant Layer 2 safeguard.

More MAC storage may delay exhaustion but does not stop broadcasts or unknown unicasts circulating through a physical bridge loop. STP topology must be made safe.

Numerical VLAN identifiers classify frames into broadcast domains. Their values do not determine whether a redundant path is safely blocked or causes a loop.

Transmit power changes radio coverage and does not discover or authenticate a controller across an IP network. AP-management reachability is a separate control-plane dependency.

An SSID identifies client wireless service. Controller discovery uses supported management protocols and controller address discovery rather than the advertised client network name.

Lightweight APs normally do not establish the enterprise routing protocol merely to join a controller. Check controller discovery and control packets rather than inventing routing adjacency.

VLANs segregate Ethernet broadcast domains; switches do not automatically host the directory or DNS application merely by carrying their traffic. Clients still require actual server services.

A patch panel organizes passive cabling and does not run DNS or directory processes. Good cabling is needed for connectivity, but it is not the requested shared application endpoint.

A PoE injector supplies power to a compatible link, not a DNS database or directory authentication server. Electrical power alone cannot answer application queries.

Additional routed interfaces add potential paths but do not create the required selective filter. An explicit forwarding policy is needed when one application is permitted and another forbidden.

Duplicate gateway addressing creates an invalid operational design and does not specify permitted DNS versus blocked Payroll traffic. Packet filtering must implement the security rule.

Without an alternative design, disabling all routing would block the authorized DNS path as well as prohibited Payroll sessions. The requirement is granular policy, not total outage.