mcAfee Secure Website
23

Cisco 200-301 Bundle

Exam Code: 200-301

Exam Name Cisco Certified Network Associate (CCNA)

Certification Provider: Cisco

Corresponding Certification: CCNA

200-301 Training Materials $44.99
Pass4sure Q&A Sample #1 Pass4sure Q&A Sample #2 Pass4sure Q&A Sample #3 Pass4sure Q&A Sample #4 Pass4sure Q&A Sample #5 Pass4sure Q&A Sample #6 Pass4sure Q&A Sample #7 Pass4sure Q&A Sample #8 Pass4sure Q&A Sample #9 Pass4sure Q&A Sample #10

Reliable & Actual Study Materials for 200-301 Exam Success

The Latest 200-301 Exam Questions as Experienced in the Actual Test!

  • 24
    Questions & Answers

    200-301 Questions & Answers

    760 Questions & Answers

    Includes questions types found on actual exam such as drag and drop, simulation, type in, and fill in the blank.

  • 25
    200-301 Video Course

    200-301 Training Course

    271 Video Lectures

    Based on Real Life Scenarios which you will encounter in exam and learn by working with real equipment.

  • exam =30
    Study Guide

    200-301 Study Guide

    1969 PDF Pages

    Study Guide developed by industry experts who have written exams in the past. They are technology-specific IT certification researchers with at least a decade of experience at Fortune 500 companies.

exam =32

Cisco Certified Network Associate (CCNA) (200-301) Practice Tests

Guarantee

Satisfaction Guaranteed

Pass4sure has a remarkable Cisco Candidate Success record. We're confident of our products and provide no hassle product exchange. That's how confident we are!

99.3% Pass Rate
Total Cost: $194.97
Bundle Price: $149.98

Purchase Individually

  • exam =34
    Questions & Answers

    Questions & Answers

    760 Questions

    $124.99
    exam =35
  • exam =37
    200-301 Video Course

    Training Course

    271 Video Lectures

    $39.99
  • exam =36
    Study Guide

    Study Guide

    1969 PDF Pages

    $29.99

Cisco 200-301 Practice Test 53

Question 520

An access switch uses port security allowing one secure MAC on Gi0/8 with violation mode shutdown. A second unauthorized device transmits from a different MAC on that port. What is the expected response?

  1. The router changes the host IP subnet so the second MAC becomes eligible.
  2. The switch permits the second MAC silently because all source addresses are learned.
  3. The switch error-disables the protected port according to shutdown violation mode.
  4. The switch only sends a debug log and leaves all violating traffic enabled.

Explanation

Correct Answer

C:

Port security can enforce a maximum number of approved source MACs and trigger a configured action when a violating source appears. Shutdown violation mode normally places the interface into an error-disabled condition, stopping ordinary traffic until recovery policy or administrative reset. This is more disruptive but stronger than modes that only discard violating frames while leaving the port up.

Incorrect Answers

A:

MAC acceptance is enforced at the switchport and is not repaired through Layer 3 subnet renumbering. The unauthorized source still violates port security.

B:

Port security overrides unrestricted dynamic MAC learning once the secure-MAC limit or policy would be violated. The new source is not automatically accepted.

D:

Shutdown mode changes forwarding state rather than merely logging; it can take the entire port down. Other violation modes have different notification/drop behavior.

Question 521

A switch has DHCP snooping enabled on VLAN 20 and sees server OFFER messages arriving through an approved uplink. The uplink is already TRUSTED, but new clients still receive no leases and counters show `DHCP snooping rate-limit` drops on their edge ports. What specific control should be investigated?

  1. Mark every client-facing port trusted so all rate-limit drops disappear.
  2. Check the configured DHCP snooping packet-rate threshold and client retransmission volume on the affected untrusted edge ports.
  3. Delete the default route on the switch because routing always causes DHCP rate-limit counters.
  4. Change the switch hostname to match the DHCP scope and keep the low rate limit.

Explanation

Correct Answer

B:

DHCP snooping can independently use trusted-interface rules and rate controls. Even with the authorized server uplink correctly trusted, a too-low client-port rate threshold can discard legitimate discovery or renewal bursts. Compare drop counters and supported rate policy before weakening trust boundaries or disabling snooping altogether.

Incorrect Answers

A:

Trusting untrusted clients would permit server-style DHCP messages from unauthorized hosts and defeat a key security boundary. Correct the rate setting rather than broadening trust.

C:

A DHCP snooping rate counter is a Layer 2 protection feature; normal IP route preference cannot explain that specific drop signal. Diagnose the actual limiting policy.

D:

Hostname spelling does not affect DHCP packet processing rate thresholds. The observed drops require counter and policy inspection.

Question 522

An access switch uses DHCP snooping and Dynamic ARP Inspection. A client has a correct IPv4 lease, but after moving to a DIFFERENT switch access port its ARP requests are dropped until a valid binding is learned. Which operational relationship should the technician check?

  1. Confirm the current DHCP snooping IP-to-MAC-to-VLAN-to-port binding matches the client’s new physical port and DAI checks.
  2. Disable DAI and snooping permanently so any device can claim the default gateway address.
  3. Change the host’s DNS search suffix because it determines the DHCP snooping switchport index.
  4. Change only the VLAN number on an unrelated trunk and assume the moved host’s binding is refreshed.

Explanation

Correct Answer

A:

Dynamic ARP Inspection on untrusted ports can validate an ARP sender against a DHCP snooping binding that includes interface/VLAN context. When a host moves or its binding becomes stale, valid-looking ARP frames may fail that consistency check. Examine the binding and DAI counters, then permit a legitimate lease refresh or supported administrative correction instead of weakening the trust boundary.

Incorrect Answers

B:

Removing both protections would also permit spoofed ARP and rogue DHCP messages. Correct the stale binding rather than broadly trusting every endpoint.

C:

DNS suffixes govern name resolution, not which physical switch port a DHCP snooping binding names. Port movement is the relevant condition.

D:

An unrelated trunk edit does not update the client’s local secure binding. Check the actual access-port and VLAN association for that lease.

Question 523

On a DHCP-snooping-enabled switch, a malicious client sends DHCP messages with forged gateway or relay metadata to alter how replies are delivered. Which additional validation concern matters beyond simply marking the server-facing interface trusted?

  1. Disable all VLAN segmentation so client DHCP relay details are ignored.
  2. Use a lower spanning-tree bridge priority to verify DHCP relay information.
  3. Configure the authorized DHCP server as an untrusted endpoint while promoting every user port to trusted.
  4. Validate the supported DHCP snooping Option 82/relay-information policy and bindings for untrusted ingress traffic.

Explanation

Correct Answer

D:

Snooping distinguishes trusted infrastructure ports from untrusted client ports, but relay-agent information may require additional handling depending on topology. An attacker-controlled Option 82 or inconsistent snooping binding can misdirect lease processing. Review the platform’s insertion, acceptance and verification policy for untrusted ports without automatically trusting endpoints.

Incorrect Answers

A:

Removing VLAN isolation changes the network architecture and does not safely validate forged DHCP metadata. The security question is trust and information processing.

B:

STP priority controls loop-free Layer 2 topology, not whether Option 82 metadata is accepted. DHCP snooping policy must be reviewed directly.

C:

This reverses the intended trust boundary and allows rogue server replies from users. It does not resolve forged client relay fields safely.

Question 524

A switchport uses port-security sticky learning. Which behavior is associated with learning secure MAC addresses under this feature?

  1. The switch automatically creates an IPsec VPN per learned MAC.
  2. The feature learns only destination MAC addresses of outgoing frames.
  3. Dynamically observed secure MACs can be added as sticky entries to the running configuration, subject to limits.
  4. Every learned MAC is immediately deleted when the link is idle for one second.

Explanation

Correct Answer

C:

Sticky port security learns eligible source MAC addresses and places them into a sticky secure-MAC configuration representation, reducing the need to enter every endpoint address manually. These entries can be retained if configuration is saved appropriately; otherwise a reboot may lose unsaved state. This feature is separate from normal MAC-table aging and does not fully prevent deliberate MAC spoofing.

Incorrect Answers

A:

Sticky learning is Layer 2 source-MAC admission, not IPsec encryption. It cannot establish VPN security associations.

B:

Ethernet switches learn endpoint attachment primarily from observed source MACs on ingress. Sticky port security records eligible source identities, not arbitrary output destinations.

D:

Sticky entries are intended to retain learned secure associations in configuration, not act like a one-second dynamic forwarding timer. Their persistence depends on how configuration is saved.

Question 525

A technician enables port security with `switchport port-security maximum 1` and `violation restrict` on an access port. Two phones legitimately alternate using the jack, but the second MAC is silently blocked until the old secure address is cleared. What should the operator verify before changing the policy?

  1. Inspect the current secure-MAC table and aging policy, confirm the intended device count, then adjust authorized limits or aging settings.
  2. Set the switchport trunk allowed list to VLAN 1 only, regardless of where the phones register.
  3. Disable the port-security feature permanently whenever a workstation changes.
  4. Increase the OSPF router priority on the local switchport so a newer MAC address takes precedence.

Explanation

Correct Answer

A:

Port security can retain secure learned addresses until their applicable aging behavior removes them or an operator clears them. With a maximum of one, a replacement endpoint may be rejected while the previous address remains secured. Check the approved endpoint policy and relevant learned entries before enlarging the limit or disabling the security feature.

Incorrect Answers

B:

Trunk allowed VLANs govern Layer 2 VLAN carriage on a trunk, not secure MAC aging on a host access port. This change can remove needed voice or data connectivity without freeing a learned secure address.

C:

That removes the configured anti-spoofing admission control for all future attached devices. A bounded aging or approved secure-MAC update is more proportionate than removing the policy.

D:

OSPF router priority controls designated-router election on certain routed networks. It has no role in the switchport secure-address table or violation processing.

Question 526

A remote RADIUS server provides wireless access authentication for thousands of clients. Which device typically acts as the RADIUS client forwarding the user’s authentication exchange?

  1. A supported wireless controller or access device acting as the network authenticator.
  2. The DNS authoritative server for the Wi-Fi domain.
  3. The Ethernet VLAN number itself.
  4. An NTP time source acting as the only user authenticator.

Explanation

Correct Answer

A:

In a RADIUS deployment, an AP, WLC or access switch can be the network access device that relays authentication information to the central AAA server. The user is the access requester rather than the RADIUS protocol peer in ordinary architecture. Shared secrets and transport protections must be configured between the network device and server.

Incorrect Answers

B:

DNS resolves names but is not generally the RADIUS network authenticator for wireless user sessions. AAA exchanges run through the access network device.

C:

A VLAN ID is a segment label, not a network device capable of exchanging RADIUS messages. The controller or access device performs the protocol role.

D:

NTP supplies clock synchronization and is not a RADIUS client/server authentication path. Timing can support logs but not credential validation.

Question 527

The enterprise wants network-device access to remain possible in an emergency when the central TACACS+ server is down, but with restricted local break-glass accounts. Which AAA consideration is relevant?

  1. Remove all login authentication whenever the server fails.
  2. Share one public Telnet password among every network operator.
  3. Configure only a default IP route and assume it creates local users.
  4. Configure a controlled local authentication fallback in the AAA method list.

Explanation

Correct Answer

D:

Cisco AAA methods can be ordered so an approved local account database is consulted when the remote service is unavailable, according to platform behavior. Break-glass access should be narrowly scoped, monitored and regularly tested. An unconditional shared anonymous login is not a safe substitute for structured fallback.

Incorrect Answers

A:

Bypassing identity checks creates unauthorized access and lacks per-user accountability. A controlled local credential path is safer.

B:

Telnet lacks SSH transport protection, and a shared credential weakens accountability. It does not implement approved limited emergency access.

C:

A route may help reach the AAA server, but it does not establish fallback identities or authentication policy when the service is actually unavailable.

Question 528

A Cisco device has already authenticated user Alice but allows her to run `show` commands while denying configuration commands. Which AAA function enforces that distinction?

  1. Authentication only, because knowing who Alice is grants every privilege.
  2. Authorization based on Alice’s approved role or command permissions.
  3. Accounting only, because recording an attempt prevents it.
  4. NTP client synchronization with the AAA server.

Explanation

Correct Answer

B:

Authorization evaluates what an authenticated principal is permitted to do. Alice’s identity has been accepted, but her role lacks configuration rights, so the command policy denies them. Authentication alone only proves who she is; accounting can record the attempted operation but does not decide access.

Incorrect Answers

A:

A valid identity does not automatically imply full device control. A separate authorization decision limits commands to the approved role.

C:

Logging an attempted command helps audit behavior but does not itself enforce a deny policy. Authorization is the actual decision point.

D:

Clock alignment can help log correlation but does not specify which commands Alice may execute. Her role policy controls authorization.

Question 529

A router checks an administrator’s username and secret against an approved identity server before granting CLI access. Which AAA phase is occurring?

  1. Authentication: establishing that the claimant is the identified user.
  2. Spanning-tree root election: selecting the network identity.
  3. Authorization: assigning which CLI commands the user may run.
  4. Accounting: writing the audit record of the session.

Explanation

Correct Answer

A:

Authentication validates an identity claim using credentials or another supported factor before access proceeds. Authorization subsequently determines what that authenticated user can do, while accounting records activity. A credential check by itself does not grant unrestricted command privileges; policy still needs to enforce roles.

Incorrect Answers

B:

STP root election avoids Layer 2 loops and has no role in validating administrator credentials for CLI access.

C:

Authorization determines permitted actions after identity is established. The scenario is asking about the initial identity credential check.

D:

Accounting logs session and command activity rather than validating credentials. The login decision is an authentication operation.

Question 530

Network operations needs records of when individual administrators connected and which sensitive configuration commands they ran. Which AAA function addresses this?

  1. A DHCP lease database as the command audit.
  2. Authorization only, without any event logging.
  3. Accounting that logs sessions and authorized command activity.
  4. Authentication only, which stores all executed commands automatically.

Explanation

Correct Answer

C:

AAA accounting collects evidence about device access and actions for investigation and policy compliance. The data should identify the principal and timestamps where supported. Authentication proves identity and authorization limits commands, but neither alone provides the requested historical activity record.

Incorrect Answers

A:

DHCP records address allocations, not privileged CLI command histories. It is not a substitute for AAA accounting.

B:

Authorization can permit or deny actions, but a policy decision does not guarantee durable records. Accounting must be configured for the required audit.

D:

Authentication checks credentials and does not necessarily keep a complete command history. Accounting is the dedicated activity tracking function.