Pass Cisco 200-301 Exam in First Attempt Guaranteed!

Ports connected to untrusted workstation endpoints should generally remain untrusted under DHCP snooping; that classification prevents a client from supplying unauthorized server-style replies. Trusting every user-facing port would permit rogue DHCP OFFER or ACK messages on those ports and undermine the protection. DHCP snooping operates by inspecting DHCP messages and enforcing trusted ingress locations. The scenario requires permitting the known server uplink, not granting unrestricted trust throughout VLAN 20.

The VLAN 20 SVI supplies a routed default gateway if the switch is performing Layer 3 forwarding for the client subnet. DHCP snooping is a Layer 2 trust mechanism and does not require removing that gateway. Disabling the SVI might break normal off-subnet connectivity while leaving the rogue-server problem conceptually separate. Keep addressing and routing functional, and apply DHCP snooping to distinguish authorized server-facing paths from untrusted client access ports.

Spanning Tree Protocol chooses loop-free Layer 2 forwarding paths using bridge and port roles; it does not hold a list of endpoint MAC addresses for authorizing DHCP servers. A request to put every client MAC in an STP root table confuses topology control with DHCP message inspection. DHCP snooping uses VLAN enablement and trusted interface designation to control DHCP replies, not the root bridge election data structures.

A /64 route covers the entire 2001:db8:7::/64 subnet, not just the one host ending in::55. Applying that route to the separate next hop would also affect other destinations whose first 64 bits match, violating the requirement to preserve their existing forwarding. A /64 is useful for a whole-subnet network route, but the stated exception needs a single-address host route with /128 specificity.

A /48 prefix covers many /64 subnets inside the larger 2001:db8:7:: address block. This scope is far broader than the individual IPv6 endpoint described. Advertising or installing a /48 via an exceptional next hop could attract unrelated subnets, defeating the limited traffic-steering goal. Prefix length controls how many destination bits must match; increasing route specificity to /128 is the appropriate way to isolate one host.

The::/0 default route is the least-specific IPv6 route and applies only when no more-specific installed prefix matches a destination. Making the exceptional next hop the default would potentially alter forwarding for many unrelated IPv6 addresses instead of only::55. Defaults solve general fallback reachability, not narrow policy exceptions. A /128 host route is much more precise and normally outranks the /64 route for that one address.

A port identifier can break certain spanning-tree selection ties after more important path metrics and bridge identifiers are considered. It does not override a lower total path cost toward the root, and choosing the highest numerical identifier is not the stated rule. The scenario explicitly says the non-root switch has candidate ports with different cumulative costs, so the preferred path is selected on that metric before port-ID tie-breakers become relevant.

Spanning Tree uses bridge IDs, path costs and port identifiers in its BPDU comparison, not alphabetic ordering of switch hostnames. A switch name can help an engineer identify equipment, but it is not part of the bridge-ID or root-port election algorithm. Selecting a port based on a lower hostname could produce a suboptimal or looping topology. Evaluate the actual root-path cost advertised along each candidate port instead.

The time a cable has been connected is not a primary criterion for root-port selection in normal spanning tree. A newly connected low-cost uplink may become preferred, while an older high-cost link can be left alternate or blocking. Convergence timing affects when roles settle, but not the comparison rule stated in the question. The operator should examine BPDUs and resulting path costs rather than treating link age as route preference.

ip -6 addr show reports IPv6 addresses and interface assignment details on Linux, including address scope and prefix lengths. That is useful for checking whether an interface possesses the expected local or global address, but it does not directly show the default route or other routing-table entries. The incident involves an incorrect IPv6 default route, so the relevant evidence is the IPv6 route view, not merely an address inventory.

Plain ip route show commonly displays the IPv4 routing table unless a protocol family is explicitly selected. It may therefore miss the IPv6 default route responsible for the server's symptom. Linux iproute2 accepts -6 to request IPv6-specific state, separating it from the IPv4 table. Use the explicitly IPv6-scoped route command rather than relying on the default protocol family of the utility invocation.

ip -6 neigh show lists IPv6 Neighbor Discovery cache entries, relating nearby IPv6 addresses to link-layer neighbors on interfaces. A neighbor entry can help troubleshoot whether a chosen next hop resolves, but it does not identify which IPv6 default route the kernel selected. Since the operator already suspects routing configuration, first display the route table; then inspect neighbor reachability if the chosen next hop needs further diagnosis.

OSPF does not require routers to share the same hostname. Router IDs are identifiers used within the routing domain and should be distinct rather than copied as a shared label. Changing device names will not reconcile interfaces that advertise different OSPF areas on the same transit link. The adjacency formation checks area information carried in Hello packets; align those area assignments while keeping device identity unambiguous.

PortFast is a spanning-tree access-port feature intended for appropriate edge connections, not a fix for mismatched OSPF areas on routed Ethernet interfaces. Layer 3 adjacency negotiation occurs through OSPF Hello exchanges, independently of this STP edge optimization. Enabling PortFast would neither change area 5 to area 0 nor make the neighbor protocol accept inconsistent area information. It could also be inappropriate if applied blindly to inter-device switching links.

OSPFv2 neighbors on a normal shared transit link must agree on the area associated with their participating interfaces. One side advertising area 0 and the other area 5 causes a protocol-compatibility mismatch even if IPv4 addressing and timers are correct. Place both interfaces in the intended common area and verify show ip ospf neighbor afterward. The area agreement is necessary for a normal adjacency; each router should still have a unique router ID.

GET retrieves an existing resource or collection representation and is intended to be safe and read-only. It is appropriate to list devices or inspect a device's current state, not conventionally to create a new managed record using a JSON request body. Some APIs are nonstandard, but the question asks for the normal REST verb. Issuing GET would not express the required creation semantics and may not accept the proposed body.

DELETE requests removal of a targeted resource, which directly conflicts with creating a new item in the /devices collection. Invoking DELETE against the wrong endpoint could remove an existing inventory record if authorization permits. REST method semantics distinguish creation from destruction, and a child-creation operation ordinarily uses POST on its collection. Inspect API specifications and require explicit confirmation before destructive changes in production.

HEAD requests response headers for a resource without returning a normal body representation. It can help check whether a URL exists or inspect metadata, but is not the usual method for uploading a JSON device definition. A HEAD operation also does not conventionally have side effects that create new collection children. Use POST to express the creation intent and handle the service's validation and returned identifier.

A spanning-tree root priority affects which switch becomes the Layer 2 root bridge and can influence redundant path selection. It does not create hostname-to-IP mappings for intranet.example.test. Because the internal web application loads when its IPv4 address is used, basic network forwarding to that address already works. Investigate the name-resolution path before spending effort on unrelated root-election settings, unless additional link symptoms indicate a separate switching issue.

NTP stratum identifies a clock's synchronization distance from a reference and is useful for evaluating time services. It does not ordinarily determine whether a user can resolve an internal DNS hostname to an address. Accurate time can matter for authentication or certificates later in a web session, but the described failure occurs during DNS lookup. First check the client's configured resolver and the relevant DNS record rather than inspecting NTP hierarchy.

A NAT timeout controls how long address-translation state is retained for applicable connections, especially at a network boundary. It would not normally prevent a client from obtaining the IPv4 record for an internal hostname while direct IP access still succeeds. Translation issues may disrupt some flows, but the stem isolates hostname resolution as the difference between success and failure. Diagnose DNS records and resolver reachability before considering NAT session aging.

AAA method lists do not authorize every login merely because the preferred remote server is unreachable. After a TACACS+ timeout or unavailable response, the configured local method checks a matching account and credential. Allowing any password would destroy the point of both authentication methods. The fallback path is another valid verifier, not an automatic bypass. Correct server failure handling should be tested with a maintained local emergency account.

An AAA list with group tacacs+ local explicitly provides a subsequent local authentication method for situations where the TACACS+ group is unavailable. Thus a server outage does not necessarily reject every login immediately. There is an important distinction between an unavailable service and a reachable service sending an explicit authentication failure: the latter normally should not trigger fallback. This rule prevents a failed remote credential from being retried permissively against another authority.

Spanning tree elects a root bridge for a Layer 2 VLAN and computes loop-free forwarding roles. It neither stores administrative login identities nor answers TACACS+ authentication requests. An AAA fallback is implemented through the configured authentication method list, with local credentials on the device if remote authentication is unavailable. Routing a login request toward an STP root would confuse topology maintenance with identity validation and cannot authorize a CLI session.

Local mode is the common controller-managed AP role for serving wireless clients; the radio can carry user traffic while the controller provides centralized policy and management. It is not designed to dedicate all radios exclusively to scanning for rogue transmitters. A Local-mode AP may perform some off-channel scanning, but that does not equal the stated no-client-associations monitor role. The question asks for a dedicated monitoring mode rather than normal client service.

FlexConnect supports certain locally switched client-data paths at remote sites while retaining controller management where appropriate. Its main purpose is branch WAN and wireless traffic handling, not operating as a radio that only measures RF conditions. A FlexConnect AP typically still serves station associations when configured for a WLAN. The described requirement excludes normal client service and calls for a mode dedicated to scanning and rogue detection.

Bridge mode is used in supported outdoor or special topologies to connect networks wirelessly, such as point-to-point or mesh backhaul arrangements. It does not by itself designate a radio as a dedicated intrusion-monitoring sensor. Bridging focuses on carrying network data between links, while the scenario asks to collect rogue-AP and radio-resource measurements without associating clients. The AP mode should match that monitoring-only intent.

Widening 2.4-GHz channels to 40 MHz in a dense environment generally increases spectral overlap and contention rather than creating more independent channels. Forcing every dual-band device back to 2.4 GHz concentrates load on an already crowded band. A radio may use wider channels in controlled low-density designs, but this office has multiple overlapping WLANs. Channel reuse and interference are the current limiting factors, so the proposal worsens those constraints.

2.4-GHz signals can propagate farther through some obstacles, but greater reach is not the deciding objective when that spectrum is congested by many overlapping networks. Disabling 5-GHz radios removes a useful pool of additional channels and can increase contention among clients. If legacy devices require 2.4 GHz it can remain available for them, while capable devices should be encouraged toward suitable less-congested 5-GHz channels.

Increasing every access point to maximum transmit power can make neighboring cells overlap more and can create asymmetric links where the client cannot transmit back with matching power. That often increases contention instead of improving usable capacity. Good RF engineering coordinates cell sizes, channel reuse and client capabilities. The question describes congestion in 2.4 GHz, so selecting suitable 5-GHz channels offers a more relevant solution than indiscriminate power increases.

Cisco Discovery Protocol advertises device identity and connection information between neighboring supported devices. It has no virtual default-gateway address election or failover mechanism for hosts. CDP can help identify the routers physically attached to a switch, but it cannot provide an interoperable first-hop redundancy service. The requirements call for a standardized protocol that coordinates ownership of a virtual IP rather than neighbor discovery messages.

Rapid PVST+ operates spanning-tree instances to control Layer 2 forwarding loops and selects bridge and port roles. It is not a first-hop redundancy mechanism that shares an IPv4 gateway between routers. Even if the root bridge is also a router, STP root status alone does not present a stable virtual default gateway for hosts. The multivendor requirement concerns a routing gateway protocol, not a Cisco-flavored Layer 2 loop-avoidance variant.

Link Aggregation Control Protocol groups compatible physical Ethernet interfaces into a logical bundle and negotiates member status. It can improve link-level redundancy or bandwidth between devices, but it does not elect a virtual IP gateway that survives router failure. The requested feature operates at the hosts' first-hop Layer 3 boundary, while LACP handles Layer 2 aggregation. Even a perfectly formed Port-channel would not substitute for VRRP's shared gateway identity.