Cisco 200-301 Practice Test 57
Question 560
Four route sources offer identical prefix 10.81.0.0/16 for 10.81.0.7: EIGRP [AD 90, metric 120], OSPF [AD 110, metric 30], RIP [AD 120, metric 2], Static backup [AD 220, metric 0]. If all paths are usable, which source is installed by administrative distance?
- EIGRP route with AD 90
- Static backup route with AD 220
- RIP route with AD 120
- OSPF route with AD 110
Explanation
Correct Answer
A:All four candidate routes have the identical prefix 10.81.0.0/16 and are assumed usable, so Cisco IOS uses administrative distance to prefer the routing source. EIGRP's stated distance 90 is lower than OSPF 110, RIP 120 and the floating static 220; therefore the EIGRP entry is installed. The different protocol metrics cannot be directly ranked against one another to override source preference. Check actual platform settings if distances are modified or routes are withdrawn.
Incorrect Answers
B:The floating static route intentionally uses an increased administrative distance, here 220, so it remains a fallback behind lower-distance paths to the same prefix. Its metric 0 does not override AD 90 from EIGRP. It can become active only when preferred equal-prefix candidates are withdrawn or unusable, subject to next-hop resolution and tracking.
C:RIP advertises a hop-count metric, but its stated administrative distance 120 is higher than the competing EIGRP distance 90. Metrics of different routing protocols are not compared directly to choose which source enters the routing table for the identical prefix. The RIP path may still provide backup reachability if EIGRP and other preferred choices disappear.
D:OSPF's internal cost 30 is meaningful when comparing eligible OSPF paths to the same destination, not when ranking an OSPF route against EIGRP based on raw metric size. OSPF has stated distance 110, so the EIGRP 90 path wins at the route-source decision. The OSPF route may become installed when the EIGRP choice is absent or disqualified.
Question 561
An administrator must capture frames on a particular Wi-Fi channel for offline analysis using a dedicated AP. Which mode is most aligned?
- Local mode with no packet-capture destination
- Telnet server mode on the AP management VLAN
- Passive LLDP receive-only mode on the wired uplink
- Sniffer mode forwarding captured over-the-air frames to a capture analyzer
Explanation
Correct Answer
D:Cisco AP sniffer mode on supported wireless platforms lets an engineer configure a radio to observe traffic on a selected channel and forward captures to a configured analysis destination. This supports investigation of management, control and data frames without requiring the AP to serve normal clients on that radio. Check product/software support and capture destination reachability; collecting frame content may expose sensitive information and should follow approved privacy and security procedures.
Incorrect Answers
A:A local-mode lightweight AP normally provides WLAN client service and often forwards client data through CAPWAP to a controller. That does not make it the preferred dedicated radio capture mode when engineers need the contents of frames on one specific channel. Leaving the AP in ordinary service could miss the requested over-the-air evidence or disrupt its production clients if radio settings are changed.
B:Telnet is an unencrypted remote terminal protocol, not a Cisco AP radio operating mode that captures 802.11 frames. Enabling a Telnet server would expose management credentials and would not supply channel-specific packet traces to an analyzer. For supported devices, use a documented wireless sniffer function and a secure management path to collect the capture.
C:LLDP is used for announcing neighboring devices on wired network links. Receive-only LLDP may populate switch topology information but cannot tune an AP radio to listen for client frames on a specific wireless channel. The required evidence is over-the-air 802.11 traffic, not chassis and port TLVs received from the Ethernet uplink.
Question 562
A static backup route exists in running-config but is not in show ip route while OSPF carries the same prefix. Why can this be normal?
- The floating static has a worse administrative distance than the active OSPF route
- show running-config deletes routes as soon as they stop forwarding
- Static routes must always override every dynamic routing protocol
- OSPF automatically changes every static next hop to a multicast address
Explanation
Correct Answer
A:A floating static route can be configured with an administrative distance higher than a competing OSPF route to the same destination prefix. While OSPF is valid and has the lower configured distance, the router installs OSPF and keeps the static command only in configuration. If the OSPF entry disappears and the backup next hop remains resolvable, the floating static may enter the routing table. Verify the actual distances and route tracking instead of assuming a configured route must always be active.
Incorrect Answers
B:show running-config reports configured statements and does not delete a static route merely because another route currently wins. In contrast, show ip route shows installed routes selected for forwarding or route-table processing. The distinction between configuration and installed state is exactly why a backup can remain present in one display but absent in the other.
C:Ordinary static routes frequently default to an administrative distance of 1 and can beat OSPF, but Cisco allows the static distance to be changed. A floating static intentionally uses a worse distance as a backup. Claiming all static statements unconditionally override every dynamic protocol ignores the configured administrative-distance field and next-hop usability.
D:OSPF uses multicast addresses for selected routing control-plane communications on compatible networks, but it does not automatically rewrite a configured static next-hop IP into multicast. The unused backup route is a normal result of route-source preference for the same prefix. Inspect administrative distance and next-hop resolution, not a nonexistent OSPF static-route conversion.
Question 563
An internal server has 10.228.4.17, and the business wants Internet clients to reach it via a public address. Which gateway function is normally needed?
- Change only the server's access VLAN without public edge mapping
- Advertise the 10/8 prefix across the public Internet unchanged
- Disable all Layer 3 gateways on the private subnet
- Static translation or equivalent public ingress mapping at an edge device
Explanation
Correct Answer
D:An edge device can expose a private 10.228.4.17 service through a public destination, using a carefully configured static NAT or destination-port mapping, a reverse proxy, or an equivalent published ingress design. The edge translates or proxies incoming requests, while routes and ACL/firewall policy permit only intended services. Verify the server's return path, external DNS naming, certificate behavior and permitted client sources. Publishing a service should not mean making every private port reachable.
Incorrect Answers
A:Changing the server's access VLAN affects its Layer 2 connectivity and may change which gateway it uses, but does not assign a public ingress identity. A private IPv4 server still needs a public-facing service path for remote Internet clients. VLAN moves alone neither advertise the private destination on the Internet nor translate the external destination toward the internal host.
B:The 10.0.0.0/8 address family is reserved for private use, so advertising it unchanged across the public Internet is not a valid general public-reachability strategy. Multiple organizations reuse that space, and Internet routers normally do not deliver it as globally unique destinations. An edge mapping or reverse proxy is needed instead of assuming private LAN addresses are publicly routable.
C:Disabling local Layer 3 gateways would remove the private server's path to off-subnet clients and generally worsen reachability. A server reached through static NAT or a proxy still requires valid routing to and from its edge device, along with return-path and security controls. Removing gateways does not create a route between public clients and RFC1918 addresses.
Question 564
Dynamic ARP Inspection drops a static-IP printer's ARP replies although its gateway works for DHCP users. What is a likely missing prerequisite?
- An authorized static ARP ACL or binding for the non-DHCP device
- A larger NAT translation pool on the Internet router
- A shorter OSPF hello interval on the printer interface
- A second DHCP offer to change the printer's static address
Explanation
Correct Answer
A:Dynamic ARP Inspection normally validates ARP packets against trusted DHCP snooping bindings or an explicitly configured authorized ARP ACL, depending on platform design. A printer with a fixed IP may lack a DHCP lease entry even when its address is legitimate, so its ARP replies can be rejected as unverified. Provide an accurately scoped static permit/binding for the printer and verify interface trust status; do not mark all user ports trusted merely to bypass protection.
Incorrect Answers
B:A NAT pool determines external translation capacity, usually on a router or firewall, not the MAC-to-IP association that DAI validates on a switch. Enlarging it would not give a statically configured printer a DHCP snooping record. The ARP reply is being filtered inside the LAN before any Internet address translation matters.
C:OSPF hello intervals influence adjacency formation between routers, while a printer's ARP reply is a Layer 2 address-resolution message. Changing hello timers cannot supply the binding information required by Dynamic ARP Inspection and may destabilize unrelated routing neighbors. Diagnose the DAI validation table or authorized ARP ACL for the fixed-address endpoint.
D:A statically addressed printer generally does not request and accept DHCP leases; forcing another OFFER would neither be required nor automatically repair its chosen static configuration. The missing DAI binding must be handled through approved static-host validation or appropriate port trust rules. Sending arbitrary offers could create an IP conflict or obscure the legitimate fixed address.
Question 565
A controller installs forwarding changes on physical fabric switches using its infrastructure interface. Which controller interaction is shown?
- Southbound controller-to-device management or control interface
- A Layer 2 broadcast frame sent from an end-user browser
- Northbound user app querying high-level topology
- DNS round-robin service discovery alone
Explanation
Correct Answer
A:Southbound interfaces connect a controller's centralized control or management logic to the physical or virtual forwarding devices it operates. When the controller installs a new path or ACL on a fabric switch, it is exercising that controller-to-device function using the supported API or control protocol. Confirm that the device acknowledged the change and installed the expected forwarding state; the controller's intended policy alone is not proof of enforcement.
Incorrect Answers
B:A Layer 2 broadcast emitted from a browser is ordinary network traffic rather than a controller southbound management interaction. End-user application requests generally use higher-level APIs and may pass through multiple hops. They do not inherently program switch forwarding entries or represent a documented infrastructure-control channel between controller and device.
C:A northbound API exposes controller services to external applications or administrators, for example a request to inspect a topology or set high-level intent. The question instead describes the later act of pushing the resulting change to physical switches. That is the southbound direction, even though a northbound request might have initiated the workflow.
D:DNS round-robin resolves a hostname to multiple possible addresses and can aid service discovery or traffic distribution. It is not the mechanism by which a network controller configures fabric forwarding tables. The controller may need DNS to find device services, but a name lookup does not perform the actual infrastructure programming operation.
Question 566
An IOS device will not generate its initial RSA host keys for SSH because it has no configured domain name. What prerequisite should be verified?
- A DHCP relay helper address to the public Internet
- STP bridge priority equal to zero on every switch
- A suitable hostname and ip domain-name before generating supported RSA keys
- A static NAT rule for every internal user workstation
Explanation
Correct Answer
C:On Cisco IOS variants that require it, the device hostname and ip domain-name together form a local identity used during RSA key generation for SSH. Verify a suitable hostname, configure the administrative domain name, and then generate supported-size RSA keys before enabling SSH version and properly secured VTY login. Also verify local or AAA authentication and transport settings; the domain setting is a prerequisite in the stated failure, not the complete secure-management configuration.
Incorrect Answers
A:A DHCP helper address relays client broadcasts to a server in another subnet. It does not establish the local router's identity for RSA host-key generation and may not even be required for the management VLAN. The stated CLI failure concerns missing device naming prerequisites, not an inability of a workstation to obtain an IPv4 address.
B:Spanning-tree bridge priority controls which switch becomes the root of a Layer 2 topology. Forcing every switch priority to zero would be an invalid or disruptive election strategy and would not create RSA keys. SSH host-key generation needs cryptographic and naming configuration, not STP election changes on unrelated access switches.
D:Static NAT maps internal and external IP identities but does not determine the local router's domain-name setting or SSH keypair. Creating translations for every user would increase exposure and management complexity without satisfying RSA-generation prerequisites. Administrators should protect management access with SSH and ACLs rather than add unnecessary inbound NAT rules.
Question 567
An Ethernet OSPF broadcast segment has router priorities R1=0, R2=100 and R3=1. Which router is ineligible for DR election?
- All three because broadcast OSPF never uses a DR
- R3 because priority one is always excluded
- R2 because its priority is numerically highest
- R1 with interface OSPF priority zero
Explanation
Correct Answer
D:An OSPF interface priority of zero expressly makes that router ineligible to become designated or backup designated router on the broadcast segment. R1 may still form appropriate OSPF adjacencies and exchange routing information, but it cannot win the DR/BDR election with priority zero. Positive-priority R2 and R3 remain eligible, with highest priority preferred at a new election and router ID used for ties.
Incorrect Answers
A:OSPF on multiaccess broadcast segments commonly elects a designated router and backup designated router to reduce adjacency overhead. The statement that broadcast OSPF never uses a DR is incorrect; point-to-point OSPF network types are examples where a DR election is not needed. The question explicitly gives a broadcast segment and interface priorities for election consideration.
B:An OSPF interface priority of 1 is normally a valid positive candidate, although a router with priority 100 usually outranks it among equally eligible peers during election. Priority 1 does not by itself make R3 ineligible. Actual DR behavior also depends on router IDs, election timing and the non-preemptive nature of established DR roles.
C:A priority of 100 gives R2 a strong preference for DR/BDR election and is not a disqualifying setting. In a fresh election among three otherwise eligible routers, the highest positive priority is preferred, subject to router-ID tie-breaking. An incumbent DR is not automatically preempted if a higher-priority participant joins later, so distinguish election eligibility from instantaneous role change.
Question 568
A controller appliance has a management port and user data uplinks. Which connection must remain available for AP management/control communications?
- A direct physical HDMI connection from each AP to the controller
- A reachable controller management/control network path
- A separate RJ-11 analog telephone cable per SSID
- A dedicated DNS MX mail exchanger record for every AP
Explanation
Correct Answer
B:Controller-managed APs require a viable IP path to the controller's management or control-plane endpoint for discovery, registration, configuration and ongoing control communications. The controller need not be cabled directly to each AP, but routing, firewalls and any CAPWAP transport requirements must permit the exchange. Confirm management addressing, DNS or discovery methods where applicable, and controller/AP software compatibility. Client data may be locally or centrally switched depending on the deployment mode.
Incorrect Answers
A:HDMI is used for audiovisual connections and is not a network control path between wireless APs and a WLAN controller. Lightweight APs use wired IP connectivity and supported control protocols to join and receive policy. A direct video cable from each ceiling-mounted AP would neither discover the controller nor manage client WLAN sessions.
C:An RJ-11 analog telephone lead is unrelated to standard CAPWAP management of Ethernet-connected Wi-Fi access points. Different SSIDs are logical WLAN services carried over one or more AP radios and data paths, not separate analog lines to a controller. The scenario needs IP reachability of an existing AP/control path rather than extra telephone wiring.
D:DNS MX records tell mail systems where to exchange messages for a domain; they do not register AP radio channels or identify controller transport endpoints. Some AP discovery workflows can use DNS records, but a mail-exchanger record per AP is not the prescribed solution. Restore a reachable controller IP and relevant control ports before investigating client-specific WLAN policy.
Question 569
A switch SVI should advertise a /64 IPv6 subnet to attached clients, but hosts have no default router after boot. What packet/control mechanism should be checked?
- A manually configured IPv4 ARP cache on each client
- An IPv4 DHCP OFFER replacing all IPv6 neighbor discovery
- A DNS PTR record for the switch hostname only
- IPv6 router advertisements from the active router on that link
Explanation
Correct Answer
D:IPv6 router advertisements from an active Layer 3 interface tell hosts about default-router availability and may describe on-link prefixes and autonomous address-configuration flags. If no RA reaches the VLAN, SLAAC clients can have incomplete routing even when the SVI has an IPv6 address. Verify global IPv6 routing, interface operational state, RA suppression settings and ICMPv6 filters, then confirm hosts actually receive a valid default-router advertisement. DHCPv6 alone does not supply the conventional default-router mechanism.
Incorrect Answers
A:ARP resolves IPv4 addresses to Ethernet MAC addresses and does not distribute IPv6 default-router information. IPv6 hosts use Neighbor Discovery messages, including router advertisements, for on-link prefixes and router discovery. Changing an IPv4 ARP cache on each device would not make a missing IPv6 RA appear on the LAN.
B:An IPv4 DHCP OFFER delivers IPv4 lease parameters and cannot replace the IPv6 Router Advertisement mechanism. DHCPv6 can supply additional IPv6 address or DNS configuration in some deployments, but standard IPv6 default-router discovery remains based on RAs. Troubleshoot the router's IPv6 ND/RA configuration and whether the SVI is operating on the correct VLAN.
C:A DNS PTR record maps an address to a name for reverse lookups and has no role in advertising an IPv6 default router to newly booted hosts. Even a correct reverse DNS entry would not give clients an on-link prefix or a gateway. Router discovery uses link-local control messages, not hostname reverse-resolution records.
Question 570
A centralized management access design uses TACACS+ to permit different sets of IOS commands by administrator role. Which capability is relevant?
- SMTP relaying router commands to a mail server as permission checks
- A WLAN WPA2-Personal password for privileged EXEC commands
- A shared unaudited password for all engineers
- Fine-grained device command authorization through a TACACS+ policy
Explanation
Correct Answer
D:TACACS+ can provide centralized device administration AAA with fine-grained authorization of CLI commands and privilege levels, allowing different operator roles to use different command sets. Properly configure method lists, server availability, and accounting so administrative actions can be attributed to named users. If the AAA server becomes unreachable, the selected fallback policy must remain deliberately secure rather than silently granting broad access. This is distinct from simple network access authentication using a shared WLAN password.
Incorrect Answers
A:SMTP handles email message transfer and does not provide device command authorization during an interactive IOS administration session. Administrators may receive email alerts about their actions, but sending commands through an email relay is not how the router validates their privilege to enter a configuration command. Central AAA decisions require a compatible authentication/authorization protocol.
B:A WPA2-Personal passphrase controls access to a wireless network, not permissions for each privileged IOS command after administrative login. Even if engineers reach a device across Wi-Fi, the router must independently authorize command use according to configured local or centralized policies. One shared WLAN key cannot express per-operator CLI privileges.
C:One shared administrator password makes individual accountability difficult and may allow every engineer the same broad access. It cannot cleanly restrict dangerous IOS commands for a help-desk role while permitting them to a network engineer, and revoking one person often forces all users to rotate the secret. Role-based central authorization is more appropriate.