Cisco 200-301 Practice Test 54
Question 530
A company identifies unauthorized physical access as a risk for distribution closets. Which mitigation directly addresses it?
- Increase every switch's OSPF hello interval
- Restrict cabinet entry with locks and audited badge access
- Set all user DNS TTLs to zero
- Remove VLAN tags from the WAN interface
Explanation
Correct Answer
B:Locks, controlled badge access and accountable entry records directly reduce unauthorized access to distribution cabinets and network closets. Restricting keys or badges to approved staff makes it harder to reach consoles, cables and removable media, while auditable logs support investigation of suspicious entry. These controls should be combined with visitor escort, periodic entitlement review and prompt deactivation of lost credentials. Physical security complements management-plane authentication because possession of a switch can expose ports and recovery paths even when remote access is protected.
Incorrect Answers
A:OSPF hello intervals determine the frequency of routing-protocol discovery messages on participating interfaces; they do not control who can enter a distribution closet. Changing them may disrupt routing adjacencies if neighbors use incompatible settings. A physical access risk requires entrance and cabinet security controls, not a tuning of routing timers.
C:DNS TTL determines how long resolvers or clients may cache a DNS resource record, not whether someone is permitted to access a network closet. Setting TTLs to zero would increase resolver workload without providing badge verification or door locking. The risk arises from physical entry to infrastructure, so naming-service behavior does not address its cause.
D:VLAN tagging governs logical Layer 2 segmentation and can influence which traffic traverses trunks. Removing those tags from a WAN interface does not prevent a person from entering a closet, unplugging equipment or attaching an unauthorized device. It might actually disrupt network connectivity and security segmentation while leaving the physical vulnerability unchanged.
Question 531
A static route on a multiaccess Ethernet segment uses only a local egress interface, forcing address resolution for many remote destinations. How can it be made more deterministic?
- Specify the intended next-hop IP along with the exit interface as a fully specified static route
- Set all remote destinations to the local subnet's broadcast address
- Remove the IP adjacency to the next router and use only CDP
- Change the Ethernet interface to a different access VLAN on each packet
Explanation
Correct Answer
A:On a multiaccess Ethernet network, specifying both the outgoing interface and the reachable next-hop IPv4 address creates a fully specified static route. The router then resolves a known neighboring gateway instead of treating many remote destination addresses as individually on-link when an interface-only route is used. This is useful on Ethernet, where ARP behavior and proxy ARP could otherwise produce unnecessary or confusing destination resolution. The next hop must be in reach of that interface, and the destination prefix/mask must still match the intended remote network.
Incorrect Answers
B:Replacing all destinations with a subnet's directed broadcast would not create valid unicast forwarding toward remote networks. Broadcast addresses are reserved for particular local delivery semantics and are not a substitute for specifying the correct static prefix and next-hop router. Such a change could cause routing errors rather than resolve the Ethernet ARP issue described.
C:CDP advertises directly connected Cisco neighbor information, but it is not the transport mechanism that delivers arbitrary IP packets across remote destinations. Removing the IP adjacency to the next router would undermine forwarding, while CDP cannot supply a complete static next-hop route. Use CDP as a diagnostic aid, not a replacement for IP routing configuration.
D:Changing an access VLAN on every packet is not a valid Cisco static-route technique; switchport VLAN membership is a configured Layer 2 property, not a per-destination route resolver. A multiaccess Ethernet router uses ARP for a specified on-link next hop, and a fully specified route gives that resolver a predictable neighbor address instead of a generic interface-only instruction.
Question 532
A WPA2-Personal WLAN rejects users after the administrator changes its shared key in the GUI. What must match on the clients?
- The switch's OSPF router ID and cost exactly
- The controller's serial number as each user's IPv4 gateway
- A different password for every client in a single shared-PSK WLAN
- The newly configured WPA2 preshared key and supported authentication settings
Explanation
Correct Answer
D:After changing a WPA2-Personal passphrase in the controller GUI, clients must use the corresponding new preshared key and compatible WLAN authentication/encryption settings. Devices caching the old profile may still see the SSID but fail association or the four-way handshake. Update the saved wireless profiles through an approved credential-distribution process, verify the chosen security mode, and test one client without exposing the secret in tickets or logs. A broader migration to Enterprise authentication would involve different identity architecture.
Incorrect Answers
A:OSPF router IDs and route costs belong to Layer 3 routing protocol operation, whereas WPA2-Personal clients authenticate using a configured shared wireless credential. Even a healthy OSPF adjacency cannot make a client with an obsolete PSK pass the Wi-Fi handshake. Troubleshooting should start with the WLAN security profile and each affected client rather than routing IDs.
B:A wireless controller's serial number is inventory or licensing information and is not meant to be a client's IPv4 default gateway. A gateway address becomes relevant after a client associates and obtains suitable IP configuration. WPA2-Personal authentication fails earlier if the client presents a mismatched shared key, so assigning a serial number cannot help.
C:A common WPA2-Personal SSID typically uses the same preshared key across authorized client devices, rather than a separate different password issued through that one shared-PSK profile. Individual directory-backed identities instead fit Enterprise 802.1X designs. Requiring arbitrary different keys without an explicitly supported per-device PSK feature would not match the stated controller configuration.
Question 533
A power budget report shows a 24-port PoE switch supplies 370 watts total and all installed devices together request 405 watts. What must be planned?
- Enable OSPF on the switch to allocate more PoE watts
- Reduce simultaneous PoE demand or install a switch with enough available PoE budget
- Change all port VLAN numbers to increase electrical power
- Replace each endpoint IPv4 address with an IPv6 address
Explanation
Correct Answer
B:The attached PoE devices request a combined 405 watts, exceeding the switch's stated 370-watt total power budget by 35 watts before accounting for any platform-specific reservations. Plan to reduce simultaneous demand, disable or relocate nonessential loads, choose supported lower-power device modes, or use a switch and power supply rated for the required budget. Confirm per-port IEEE PoE class negotiation, total available supply and worst-case startup demand. Simply having 24 physical ports does not mean enough watts exist to fully power everything attached.
Incorrect Answers
A:OSPF is a routing protocol that exchanges IP reachability and path costs; enabling it cannot increase a switch's physical power supply capacity. A PoE power budget depends on power-supply hardware, platform capabilities and the demands of connected devices. Routing changes would be unrelated and might introduce unnecessary network instability during a genuine electrical capacity shortage.
C:VLAN identifiers separate Ethernet traffic into logical broadcast domains; changing them does not create additional electrical watts on a Power over Ethernet switch. Reassigning VLANs might also disrupt endpoint reachability or voice/guest policy while the switch remains over its power budget. The mismatch is quantitative electrical demand versus available power, not packet classification.
D:Changing host addresses from IPv4 to IPv6 can affect routing and neighbor discovery but does not alter the electrical power a phone or access point requests through PoE negotiation. The requirement is to supply sufficient hardware power to 405 watts of devices. Address-family migration would add operational complexity without solving a 370-watt supply limit.
Question 534
A network engineer changes the configured OSPF router-id but show ip ospf still displays the prior ID. What explains it?
- OSPF router IDs are allocated by DNS and cannot be changed locally
- The command must be entered on every user workstation instead
- The already running OSPF process may require restart or reinitialization to adopt the new ID
- A VLAN tagging mismatch automatically reverts all router-id configuration
Explanation
Correct Answer
C:The router ID is normally selected when the OSPF process initializes and may remain in use despite editing the configured router-id command. On supported Cisco IOS versions, an appropriate clear ip ospf process or process restart can be required before the new value takes effect, and this may temporarily disrupt adjacencies and route convergence. Schedule such a change carefully and confirm a unique identifier across the domain. The running configuration can show the new desired ID before operational OSPF output reflects it.
Incorrect Answers
A:DNS can resolve names to IP addresses, but a router's OSPF router ID is an explicitly configured or locally selected 32-bit identifier within the routing process. It is not issued by DNS, and OSPF implementations permit an administrator to configure it. A stale displayed value after a config change is explained by process state rather than name resolution.
B:An OSPF router ID is set on the routing device, not separately on every employee workstation. Hosts ordinarily do not participate in the enterprise router's OSPF adjacencies or choose that device's LSDB identity. Asking clients to change their settings would not make show ip ospf report the new identifier.
D:A mismatched 802.1Q native VLAN can cause Layer 2 classification problems on a trunk but does not automatically revert the OSPF router-id line stored under a routing process. VLAN connectivity might affect neighbors reaching each other, yet it does not account for an unchanged process-selected identifier after a configuration update. Inspect OSPF state and restart behavior instead.
Question 535
A device API returns {"interfaces":[{"name":"Gi0/1"},{"name":"Gi0/2"}]}. Which data structure is associated with interfaces?
- A Boolean value indicating all links are active
- A numeric route cost with two decimal positions
- An array containing two objects
- A single string with the literal bracket characters
Explanation
Correct Answer
C:The value assigned to interfaces starts with [ and ends with ], which signifies a JSON array. Inside it are two separate objects enclosed in braces, each containing a name string such as Gi0/1 or Gi0/2. Software can iterate over those objects and inspect the named properties for each interface. This structure is common in controller inventory APIs, where a collection of similar resources is returned as an array rather than a single object or plain text string.
Incorrect Answers
A:A Boolean is a true/false data value represented in JSON by unquoted literals true or false. The interfaces member instead uses square brackets and contains nested brace-delimited records, not a Boolean flag. The object fields named name hold strings but do not change the enclosing array's data type.
B:A numeric JSON value contains a number such as 10 or 3.14 without quotation marks; the shown interfaces value has square brackets and two named objects. Route costs could be represented numerically elsewhere in a device API response, but this field encodes a collection of interface records rather than one scalar metric.
D:A JSON string is enclosed in double quotes and represents text, whereas the outer square brackets here are structural array delimiters in the parsed payload. Although an API could return text containing bracket characters, the shown valid JSON value is not quoted as one string. A parser would produce a sequence of two object records, not literal bracket-containing text.
Question 536
A network engineer configures logging host 192.0.2.55 to centralize router events. What function does the remote address serve?
- The next hop for all default IPv4 routes
- Syslog collector destination for emitted device logs
- DHCP relay target for every VLAN by itself
- Static DNS name server for router interfaces
Explanation
Correct Answer
B:On Cisco IOS, logging host 192.0.2.55 configures the destination where supported syslog messages are sent, subject to logging level, source-interface, routing and transport settings. A central collector can retain events from multiple devices for alerting, compliance and incident analysis. The command does not guarantee delivery by itself; verify permitted network paths, collector service, timestamps and optional protected transport where available. It centralizes event reporting rather than providing a default route or DNS resolver configuration.
Incorrect Answers
A:A default IPv4 route uses a destination such as 0.0.0.0/0 and a next-hop address under ip route or another routing protocol. The logging host command has separate management semantics and does not replace any route. A syslog destination itself needs ordinary IP reachability, but that dependency does not make it the router's gateway of last resort.
C:A DHCP relay target is typically configured through ip helper-address under an appropriate routed interface, not through the global syslog destination command. Relaying broadcasts may be useful for clients in remote subnets, but it is distinct from sending device-generated diagnostic messages. Configuring a logging host will not forward DHCP requests for every VLAN.
D:A DNS name server is ordinarily configured through a naming-service command such as ip name-server, while logging host points at a collector for system events. DNS resolution might be involved if a hostname is used for a collector, but this command does not change the router's preferred resolver. The address here is intended as a log receiver.
Question 537
An IOS router uses a locally authenticated administrator who must be allowed to view status commands but not alter interface configuration. Which control most directly limits commands after login?
- Use a single shared
enable password for all operators - Change the VLAN 1 SVI address to match the terminal IP
- Apply privilege levels or AAA command authorization for the administrator role
- Increase the AP controller WPA2 preshared-key length
Explanation
Correct Answer
C:Cisco IOS privilege levels and supported AAA command authorization can restrict which commands an authenticated account may run after login. Define a role that permits appropriate show or diagnostic operations while denying configuration-changing commands, and test the actual command set on the platform. With TACACS+ or supported authorization methods, accounting can also record attempted changes. Authentication proves identity; command authorization enforces the required read-only operational boundary.
Incorrect Answers
A:A shared enable password controls access to privileged mode poorly and undermines attribution; it does not grant per-user distinctions between viewing and configuring interfaces. Even a strong common secret cannot reliably represent a read-only operator. Use individual authentication with roles or command authorization appropriate to the IOS platform.
B:Changing the management SVI IP alters network reachability, not which IOS commands an authenticated user is allowed to execute. Duplicating an endpoint address could create an additional addressing conflict. Maintain a stable unique management interface and implement access controls in the authentication/authorization system rather than in the IP address.
D:A WPA2 preshared key protects a wireless client authentication arrangement, not local IOS command privileges on a router. Strong wireless credentials are valuable for an AP deployment, but they do not determine whether a router administrator can enter configuration mode. The question asks for role-specific CLI authorization following successful login.
Question 538
An access VLAN 90 is missing from a distribution switch and its uplink already permits VLAN 90. What must exist before local access ports forward VLAN 90 traffic?
- A locally active VLAN 90 entry in the switch VLAN database
- A matching OSPF router ID of 0.0.0.90
- A DNS CNAME record named VLAN90
- A NAT translation covering every client subnet
Explanation
Correct Answer
A:A switch must have VLAN 90 present and active in its local VLAN database or equivalent supported VLAN configuration to forward ordinary access and trunk traffic for that VLAN. The fact that the uplink's allowed list includes VLAN 90 is necessary for transport but does not automatically create it on the distribution switch. Create and verify the VLAN, then associate intended access ports and confirm that trunks and STP permit forwarding end to end. Administrative shutdown or suspended VLAN state would still prevent normal service even with a correct VLAN number.
Incorrect Answers
B:An OSPF router ID identifies a routing process and is not derived from the number of a Layer 2 VLAN. The value 0.0.0.90 would not create the required VLAN forwarding domain in the switch database. Routing may be needed for inter-VLAN communication later, but the immediate prerequisite is the presence of the local VLAN 90 object.
C:DNS CNAME records map one hostname alias to another name; a record named VLAN90 has no effect on the creation of an Ethernet broadcast domain. Endpoint and switch name resolution are independent of the VLAN database. Adding that record might change application naming but would not make access ports forward frames with VLAN ID 90.
D:NAT maps IP addresses and sometimes transport ports and is not used to instantiate VLAN entries on a Layer 2 switch. A routed gateway may translate traffic after a host leaves its VLAN, but the local access network must exist first. The problem states the uplink already allows the tag; it is the switch's missing local VLAN configuration that matters.
Question 539
A remote clinic needs reliable corporate connectivity even when its primary WAN link fails. What should its network design include?
- A larger local DNS cache as the sole backup transport
- A second Ethernet cable connected to the same failed WAN modem only
- An independent backup WAN path with tested routing failover
- A private RFC1918 address on a disconnected spare printer
Explanation
Correct Answer
C:The clinic needs a backup WAN path independent of the primary failure domain, along with routing or SD-WAN policies that detect failures and move traffic to the healthy alternative. The secondary path may be another carrier, cellular service or separate circuit, depending on availability and requirements. Validate failover and restoration under controlled tests, including application sessions, DNS dependencies, firewall and VPN state, and return routing. Redundancy on paper is insufficient unless the alternate link and control logic actually work during an outage.
Incorrect Answers
A:DNS caching can help avoid repeated name lookups but cannot carry user packets after a physical or service-provider WAN path fails. A host may resolve its application hostname correctly while having no viable next hop beyond the clinic. The requirement concerns transport resilience and route continuity, not merely the efficiency of resolving names.
B:A second cable to the same failed modem does not provide a genuinely independent WAN path when the modem, access circuit or provider connection is the shared failure point. Redundancy should avoid single points of failure where practicable, including access devices, circuits, providers and power. Duplicating only one local cable leaves the primary outage cause unchanged.
D:An RFC1918 address assigned to a disconnected printer is not a usable alternate route to corporate services. Private IP addressing is common in internal networks, but address allocation cannot substitute for a physical or logical WAN connection. The backup design needs an operating path between the clinic and corporate endpoints, not merely another reserved address.
Question 540
A learned routing table line has a timer of 00:04:16 next to its next-hop IP. What is that displayed field?
- The wireless channel width in megahertz
- The age since the route information was last updated
- The total number of packet drops on the interface
- The subnet mask in hexadecimal notation
Explanation
Correct Answer
B:An elapsed field such as 00:04:16 beside a learned route indicates its displayed age, typically the time since the routing information was last updated or installed according to the route source and IOS output format. It is useful for diagnosing recent convergence or whether an advertisement has been refreshed. It does not measure packet latency, interface errors or an OSPF cost. The exact timer semantics depend on the route protocol and display, so confirm with the relevant routing diagnostic if investigating a stale path.
Incorrect Answers
A:Wireless channel widths are expressed in megahertz and configured in radio settings, not shown as an elapsed hh:mm:ss value beside an IP route next hop. A route display contains path and update diagnostics rather than 802.11 RF channel data. The presence of a routed next-hop address makes the routing interpretation especially relevant.
C:Packet-drop counters represent failures to forward or accept packets and are usually displayed under interface statistics or traffic policy commands. A route's elapsed age has units of time, not a packet total. Interpreting 00:04:16 as a drop count would mix routing control-plane history with forwarding data-plane statistics and lead to incorrect troubleshooting.
D:An IPv4 subnet mask appears as a dotted-decimal mask or CIDR prefix length such as /24 in configuration and routing output. The displayed 00:04:16 is a clock-like elapsed interval, not hexadecimal notation for a mask. A valid subnet mask is based on contiguous prefix bits, which this timer field does not encode.