Cisco 200-301 Practice Test 45
Question 440
A branch has HSRP routers R1 active and R2 standby. R1 fails completely. What function should R2 provide?
- Change every client address from IPv4 to IPv6 by itself
- Rewrite all WAN routing protocol metrics without being configured
- Become the root bridge for every switching VLAN
- Take over the virtual first-hop gateway role after failure detection
Explanation
Correct Answer
D:When HSRP active router R1 fails and peer R2 detects its loss, R2 can become active and assume forwarding for the shared virtual default-gateway identity. Hosts retain the configured virtual IP instead of being assigned R2's physical interface address, though a brief convergence interval may occur. Priority, authentication, tracking and preemption settings affect role selection and subsequent behavior; the described active/standby pair already has the relevant configuration. The surviving router must also retain upstream reachability to provide real service continuity.
Incorrect Answers
A:An HSRP takeover preserves a stable virtual IPv4 gateway for hosts; it does not automatically renumber every client into IPv6. IPv4 and IPv6 addressing remain separate technologies and require their own configuration and first-hop design. The scenario needs continuity of an existing virtual gateway after one router fails, not a protocol migration.
B:HSRP determines the active owner of a shared first-hop gateway address and does not unconditionally rewrite all WAN routing metrics. A surviving router may already have dynamic routing protocols configured, and those control-plane processes can react separately to failures. The requested HSRP function is maintaining local client gateway service, not changing every remote route's cost without policy.
C:STP root bridge election controls Layer 2 forwarding loops and is independent of HSRP active/standby router ownership. R2 could become HSRP active without being the root switch for any VLAN, depending on network design. Treating a spanning-tree role as the automatic failure response would confuse two redundancy mechanisms with different responsibilities.
Question 441
A WLAN profile is configured correctly in the controller GUI, but users cannot see it in the authorized AP group. What should be checked next?
- Whether client DNS servers contain the SSID as an MX record
- Whether the controller HTTP port has been changed to 80
- Whether the switch OSPF cost is exactly the WLAN identifier
- Whether the WLAN is enabled and mapped to the AP policy/profile in service
Explanation
Correct Answer
D:A controller-managed WLAN must be enabled and associated with the correct policy or AP group to be advertised where authorized users connect. A profile may have valid security settings yet still be absent because the AP group does not receive that WLAN or the applied configuration disables it. Verify WLAN enable state, policy/profile assignment, AP join status and SSID broadcast settings before changing client configuration. The relevant question is whether the configured service is actually active on those APs.
Incorrect Answers
A:DNS MX records identify mail exchange destinations for a domain and have no role in activating a wireless SSID on controller-managed access points. A correctly configured WLAN can remain unavailable because its enable state or policy assignment is wrong. The client's resolver settings should not be used as a substitute for verifying whether the AP group is actually advertising the intended WLAN.
B:Changing a controller's HTTP management port to 80 does not establish which WLAN profiles are enabled or mapped to a particular AP group. It might affect administrative web access, but the scenario already states that the team can configure the controller GUI. The missing client SSID is a wireless service and policy mapping issue, not an HTTP listener-port problem.
C:OSPF cost governs Layer 3 route selection on network links and does not have to equal a WLAN profile's numeric identifier or SSID text. Access points can have full routed reachability to the controller while a WLAN remains administratively disabled for their policy group. Changing a routing metric without evidence would not activate the intended wireless service.
Question 442
A route display contains O 10.200.12.0/24 [110/31] via 192.0.2.2. What does the 110 mean?
- Administrative distance for the OSPF route source
- OSPF hello interval in seconds on every interface
- Number of reachable hosts in the destination subnet
- Ethernet VLAN tag number for the outgoing frame
Explanation
Correct Answer
A:Cisco IOS routing output commonly displays brackets in the format [administrative distance/metric]. In O 10.200.12.0/24 [110/31], 110 is the administrative distance associated with the OSPF route source, while 31 is the OSPF path cost shown as the metric. Administrative distance helps compare candidate sources for the same destination prefix. It is not the OSPF hello interval, subnet host count or VLAN tag, even though those can also be expressed as numbers.
Incorrect Answers
B:OSPF hello intervals are interface-level adjacency settings and are not represented by the first number in the route-table [110/31] field. A route's administrative distance of 110 may appear whether a particular interface uses default or customized OSPF timers. Timer compatibility must be checked with OSPF interface or neighbor diagnostics, not by treating route preference as seconds.
C:The destination network is a /24, which has 256 total IPv4 addresses and normally 254 conventional usable hosts, not 110. More importantly, routing-table bracket notation does not present host counts. The field identifies how the router ranks a route source against alternatives; host capacity is calculated from the prefix length instead.
D:Ethernet VLAN IDs are applied at Layer 2 in switching contexts and are not encoded as the first bracketed value of an OSPF IPv4 route. The selected route's next hop might eventually be carried on a VLAN-tagged link, but the routing-table [110/31] values convey routing preference and cost. They do not dictate which 802.1Q tag appears on the outgoing frame.
Question 443
A laptop chooses the IPv6 destination ff02::1 on its local Ethernet segment. Which delivery scope and audience does it target?
- A globally routed one-to-one unicast destination
- One link-local IPv6 default-router unicast address
- Link-local all-nodes multicast on the current link
- A unique local /48 prefix for enterprise addressing
Explanation
Correct Answer
C:The ff00::/8 family represents IPv6 multicast; ff02 specifically indicates link-local scope. Destination ff02::1 is the all-nodes multicast group on the current link, so participating nodes on that local segment are intended recipients. Routers do not forward this link-scoped multicast onto remote networks. This behavior differs from ::1 loopback, fe80 link-local unicast and 2000::/3 global-unicast-style addressing; recognizing the prefix prevents improper routing assumptions.
Incorrect Answers
A:Globally routed IPv6 unicast addresses commonly fall within broad 2000::/3 space and identify one endpoint or routing destination. The address ff02::1 instead starts with ff, indicating multicast, and the scope value is link-local. A router does not ordinarily carry it as a one-to-one destination across the public Internet. Treating it as global unicast would misclassify both audience and propagation scope.
B:An IPv6 default router can advertise itself with link-local unicast addresses such as fe80::..., but ff02::1 is a multicast group, not one router's personal unicast address. It can reach all IPv6 nodes listening on the attached link, not just the first-hop router. For all-routers multicast the common link-local group is ff02::2, which is also distinct.
D:Unique-local IPv6 addresses are unicast identifiers from fc00::/7, commonly using locally generated fd prefixes for enterprise private routing. They do not begin with ff and are not inherently multicast groups. A /48 unique-local prefix can be used to number local networks, whereas ff02::1 is a specific multicast destination on one link.
Question 444
An attacker connects a rogue DHCP service to an untrusted access port. Which Layer 2 guard can reject unauthorized DHCP server replies?
- DHCP snooping with only authorized infrastructure ports trusted
- OSPF process priority zero on that access switch
- TCP window scaling on every client
- A larger switch management subnet mask
Explanation
Correct Answer
A:DHCP snooping differentiates trusted infrastructure-facing ports, through which legitimate DHCP server replies are expected, from ordinary client-facing untrusted ports. On a user access port, an unauthorized DHCP OFFER or ACK can be dropped when received from the wrong direction, mitigating rogue server behavior. Configure the VLAN, trusted server or relay uplink and any required rate limits appropriately. A trust designation must follow the real topology; blindly trusting all ports would defeat the feature.
Incorrect Answers
B:OSPF router priority affects DR/BDR election on broadcast routing segments and does not validate DHCP message types on a user-facing switch port. The rogue DHCP service can send OFFER packets without participating in OSPF at all. Setting an OSPF priority to zero would only affect the router's eligibility for a routing role, not stop lease replies.
C:TCP window scaling adjusts how large a TCP receive window can be represented, supporting performance on high-bandwidth or long-delay connections. DHCPv4 commonly uses UDP for client/server messages and does not depend on TCP window scaling. The unauthorized DHCP server's packets need Layer 2 source-direction inspection, not a host transport-flow-control setting.
D:A larger management subnet mask alters IPv4 prefix membership for the switch's management address, but does not identify which user-facing ports may send DHCP server responses. The rogue endpoint remains connected to the same access port and can still originate DHCP messages. Use DHCP snooping trust controls instead of modifying unrelated management addressing.
Question 445
An API client needs to read a controller's device inventory without changing any resources. Which HTTP verb fits a safe read operation?
- POST with an unconditional device-creation body
- DELETE
- GET
- PATCH with a new VLAN setting
Explanation
Correct Answer
C:HTTP GET is the conventional safe method for retrieving a controller's device inventory or the representation of a specific resource. A properly authenticated client sends GET to the documented endpoint and parses the response without requesting configuration changes. Safe method semantics do not guarantee that the server is bug-free, but the request expresses read-only intent. Authorization, pagination and response schema still need to be handled for reliable inventory collection.
Incorrect Answers
A:POST commonly submits a new resource or requests a server-defined state-changing operation, not an ordinary safe inventory read. Sending an unconditional device creation payload could modify controller state and introduce duplicate or unintended objects. The use case needs observation only, so choose the retrieval method intended not to change resource state.
B:DELETE requests removal of a named resource when supported and authorized by the API. It is the wrong semantic action for listing inventory and could be destructive if pointed at a real configuration object. A read-only script should not invoke DELETE as a substitute for fetching a resource representation.
D:PATCH communicates a partial update to an existing resource, such as changing one VLAN-related field of an object. The question explicitly forbids modifying controller resources while retrieving inventory. Using PATCH would conflate data observation with configuration mutation and introduce avoidable risk to the managed network.
Question 446
A syslog collector receives emergency severity 0 and debugging severity 7 messages. Which is the more severe event level?
- Emergency level 0
- Level 7 is always a hardware failure needing instant shutdown
- Debugging level 7
- Both are exactly equal in severity because they are syslog
Explanation
Correct Answer
A:Cisco syslog severity numbers run in descending importance from 0 for emergency to 7 for debugging. Level 0 signals an emergency condition requiring the highest attention, while level 7 produces detailed troubleshooting information with much lower urgency. The severity is separate from the facility and mnemonic identifying the event's source. Operational alerting should consider context, but comparing these two standard levels makes emergency zero more severe.
Incorrect Answers
B:Severity 7 is labeled debugging and often emits verbose diagnostic detail rather than representing an automatic hardware-failure shutdown. A level-7 message can still contain useful evidence, but the numerical scale is inverted from the assumption that bigger numbers mean more serious events. Emergency level 0 is higher priority under the syslog convention.
C:Debugging at level 7 is the least urgent standard syslog severity, useful for detailed diagnosis rather than the top alert category. Configuring a device to report debugging messages can generate substantial log volume, but that quantity does not make the level more severe. The competing emergency level 0 is the more critical classification.
D:Syslog messages have distinct severity levels from zero through seven rather than all sharing one urgency. Collectors may apply filters, but an emergency event and a debugging event should not be interpreted identically by default. Failing to preserve their severity would hinder incident triage and could bury an actual emergency among routine diagnostics.
Question 447
Traffic to 172.18.12.90 fails after a technician adds a static 172.18.12.80/28 route toward a dead next hop. A healthy broader 172.18.12.0/25 route still exists. What should be investigated first?
- The more-specific /28 is attracting the packet toward the failed next hop despite the healthy /25
- Increase the DHCP lease duration so the /25 route becomes more specific
- Remove the /25 route because broad prefixes cannot coexist with /28 entries
- Change every router DNS search suffix to the same text
Explanation
Correct Answer
A:The destination 172.18.12.90 lies inside both the /28 block.80–.95 and the broader /25 block.0–.127. The installed /28 is more specific, so packets prefer its bad next hop even though the /25 path is healthy. Examine the static route's next-hop validity and remove or repair the erroneous more-specific route. The problem is a routing black hole caused by specificity, not a missing broad route or DNS failure.
Incorrect Answers
B:DHCP lease time controls client address assignment, not the number of destination bits in a routing prefix. Increasing a lease timer cannot change a /25 into a more-specific route or override an installed /28. Fix the static route or the failing next hop rather than editing unrelated client configuration.
C:It is normal for a broad network route and a more-specific route to coexist; the broad route serves destinations not covered by the narrower prefix. Removing the healthy /25 would cut off additional addresses and leave the bad /28 problem unresolved. Repair the /28 path and preserve the general fallback route.
D:DNS search suffixes determine how unqualified names are expanded and do not govern IPv4 forwarding for a literal destination address. The packet is already headed for 172.18.12.90, and the problem describes a mismatched next hop in the routing table. Altering hostname lookup settings cannot fix a more-specific route pointing at a dead neighbor.
Question 448
A voice-capable Cisco phone shares a switch access interface with a PC. Data belongs in VLAN 25 and tagged voice in VLAN 125. Which configuration pattern matches?
- switchport trunk allowed vlan 125 only on the shared desktop link
- switchport access vlan 25 plus switchport voice vlan 125
- switchport access vlan 125 and switchport voice vlan 25
- no switchport plus ip address 192.0.2.1 255.255.255.0
Explanation
Correct Answer
B:The switchport access vlan 25 setting classifies the connected PC's untagged data frames into VLAN 25, while switchport voice vlan 125 provides the separate voice VLAN used by a compatible Cisco IP phone. The phone can tag its voice frames for VLAN 125 and bridge workstation traffic untagged, avoiding a normal negotiated switch-to-switch trunk. Both VLANs must exist and the voice device must learn or be configured for the tagging policy. This is the standard two-VLAN access-port pattern.
Incorrect Answers
A:A trunk allowed VLAN list is for an operational multi-VLAN 802.1Q trunk, whereas the phone-and-PC arrangement uses an access-port data VLAN with a separate voice VLAN feature. Allowing only VLAN 125 would omit the required data VLAN 25 from the link's defined transport role. It also does not configure the standard access/voice pair requested for the attached endpoints.
C:These settings swap data and voice assignments, putting untagged PC traffic into VLAN 125 and phone voice traffic into VLAN 25. The syntax may be accepted but violates the application's explicit segmentation. Matching the labels to the required roles matters; simply having both VLAN numbers present does not make the access/voice policy correct.
D:no switchport converts a suitable multilayer-switch interface into a Layer 3 routed port, after which it would no longer provide the intended Layer 2 access and voice VLAN behavior. An IPv4 interface address can route traffic but cannot replace the switchport configuration for a shared phone and PC. The scenario needs Layer 2 VLAN tagging and classification, not a physical routed interface.
Question 449
A macOS laptop has a self-assigned IPv4 link-local address and no router reachability. Which client information should be verified first?
- Whether DHCP succeeded and the interface received a valid address, mask and gateway
- Whether an OSPF area 0 database exists on the laptop
- Whether the switch is advertising a public DNS MX record
- Whether the core router has an enable secret configured
Explanation
Correct Answer
A:A self-assigned IPv4 link-local address on a macOS client commonly appears when a normal DHCP lease is unavailable or unsuccessful, although other configurations should be checked. Inspect interface addressing, DHCP transaction status, mask and default-gateway information to determine whether the client obtained valid settings for the intended LAN. A 169.254/16 address alone does not normally provide routed connectivity through the campus gateway. Verify switch access VLAN and DHCP server/relay reachability if lease negotiation fails.
Incorrect Answers
B:A normal macOS laptop does not participate as an OSPF router or maintain an area 0 link-state database just to obtain basic network access. Client connectivity depends on address assignment, default gateway and DNS, not router-level adjacency state. Investigating an OSPF database on the laptop ignores the immediate IPv4 link-local symptom.
C:DNS MX records specify mail exchangers for a domain, not how a client obtains a valid IPv4 address and gateway. The laptop's link-local self-assignment points first to DHCP and Layer 2 connectivity. Even correct external mail records would not give a workstation an appropriate address on the local corporate subnet.
D:An enable secret protects privileged administrative access to a Cisco router and is useful for security, but it does not distribute DHCP leases to macOS endpoints. A router can have a properly protected enable credential while its DHCP relay or client VLAN is misconfigured. Investigate the addressing path rather than device-login secrets to resolve the present symptom.
Question 450
A user successfully logs in to a router but cannot run configuration commands allowed to other operators. Which AAA phase is making that decision?
- Accounting only after a session has ended
- Authentication alone, independent of privileges
- Authorization after authentication
- Ethernet spanning-tree root election
Explanation
Correct Answer
C:Authorization determines what an already authenticated identity is permitted to do, including device privilege level, roles and individual management commands. The router has accepted the user's login but denies configuration commands that other accounts can execute, so the identity is established and the remaining distinction is permission. Review the configured AAA authorization method, roles and group policies, then confirm accounting captures attempts appropriately. Authentication and authorization are separate decisions within AAA.
Incorrect Answers
A:AAA accounting records which users connect or execute actions so administrators can audit activity, but it does not by itself grant permissions for entering configuration mode. A user may be successfully authenticated and have accurate accounting records while still lacking the necessary role or command privileges. The scenario concerns a live access decision, not solely a post-session record.
B:Authentication verifies who the operator is, such as by password, token or certificate, and the prompt already states that login succeeded. That first step does not necessarily permit configuration commands. A separate authorization check can restrict the same authenticated person to read-only operations while another administrator has additional privileges.
D:Spanning-tree root election determines Layer 2 topology and loop avoidance among switches, not an administrator's permission to enter IOS configuration mode. A device can be a root bridge and still deny one user's commands. The issue is a per-identity management access policy, not physical or logical network path selection.