Pass Cisco 200-301 Exam in First Attempt Guaranteed!

An attacker interested in stealing configuration secrets is a threat actor with a possible harmful objective. Their interest or capability does not alone establish that a vulnerable service has been triggered or that an exploit has occurred. The question asks for an actual action that uses a weakness to produce unintended behavior. A threat actor may initiate an exploit, but the two terms describe different elements of a security incident.

An old, unchanged administrative password can be a vulnerability because it may be weak, reused, leaked, or poorly managed. The weakness increases the attack surface but is not itself the act of exploiting it. An exploit would involve a technique that leverages such a weakness, such as unauthorized credential use. The scenario's distinguishing requirement is behavior that directly triggers unintended execution on the router.

A patch that removes a router flaw is a mitigation or remediation action intended to reduce the likelihood that an attacker can exploit the vulnerability. Applying a patch is generally beneficial and is not an attack technique. The question asks which example is an exploit, so an action that closes the weakness cannot meet it. Review patch deployment separately from attack execution and detection.

The ip route family shown is for configuring IPv4 static routes and requires IPv4 destinations and masks; it cannot accept an IPv6 next hop in place of an IPv4 address. For the described IPv6 router-to-neighbor path, IOS uses the ipv6 route command family. The IPv4 0.0.0.0/0 address representation is also not the requested IPv6 default prefix, which is written ::/0.

The ipv6 address command assigns IPv6 interface addresses under interface configuration context rather than adding forwarding destinations and next hops to the routing table. Combining ::/0 and another IPv6 address as written does not express the requested static default route. Because the requirement is forwarding of otherwise unmatched IPv6 destinations, use a route statement under global routing configuration, not an interface address assignment.

This statement reverses the roles of the destination and next hop and uses::/0 where IOS expects a forwarding address. It also targets only the attached documentation subnet 2001:db8:0:12::/64 instead of the catch-all IPv6 default. A correct static default needs::/0 as its destination and the reachable neighboring IPv6 address as its next hop, preserving route semantics.

Central switching of client data through a controller can be valid for some wireless operating modes, but it defeats the branch-local design in the question. If every ordinary client frame had to traverse the WAN to headquarters, the branch LAN would remain dependent on that data path. A locally switched FlexConnect WLAN instead bridges client traffic to locally mapped VLANs while the control relationship to the WLC is managed separately.

The spanning-tree root bridge is determined by bridge IDs and spanning-tree control messages on the wired switching infrastructure. An AP operating FlexConnect does not become the root of every Ethernet VLAN merely because it bridges local wireless traffic. Its benefit is forwarding WLAN client frames onto local wired VLANs rather than providing campus STP root election or replacing the branch's Layer 2 topology controls.

FlexConnect local switching does not require permanently eliminating CAPWAP control traffic. The AP normally still uses a controller for centralized management, configuration, and certain client/security functions while appropriate WLAN data traffic can be bridged locally. If WAN access to the WLC is lost, supported survivability behavior depends on specific AP and authentication settings. Treat control-plane reachability and data-plane local switching as distinct design elements.

A collapsed-core or two-tier campus intentionally combines distribution and core responsibilities in one upper layer. It can be efficient for smaller sites, but the question explicitly requires separate endpoint access, policy aggregation, and fast backbone transit roles. Collapsing two of those responsibilities would not deliver three distinct functional tiers. A three-tier design is the appropriate conceptual description when each role must be independently represented.

A flat Layer 2 design might connect all hosts at a small location, but it does not distinguish separate access, distribution-policy, and transit-backbone layers. It can also enlarge failure and broadcast domains if not carefully segmented. The enterprise scenario requests distinct functional responsibility at each tier. A flat topology lacks the explicit aggregation and core transit structure, so it does not match the intended architecture.

A small-office integrated gateway can combine routing, NAT, firewall, switching, and wireless services with minimal hardware. That makes it useful for a SOHO branch rather than a large campus requiring dedicated policy aggregation and a separate resilient high-speed backbone. One all-in-one appliance cannot represent three distinct campus hierarchy roles at the required scale. The design choice should follow size and architectural separation, not simply device count.

show ip ospf neighbor displays OSPF peer discovery and adjacency states, which is valuable when troubleshooting a failure to form a neighbor relationship. A neighbor reaching FULL state does not by itself prove that a particular destination is installed as an OSPF route. The stem asks to isolate entries already installed in the IP routing table, not to inspect the routing-protocol neighbor-state machine. Use the routing-table filter for that purpose.

show spanning-tree vlan 1 reports Layer 2 spanning-tree topology, root election and port roles for VLAN 1 on a supporting switch. That information cannot isolate OSPFv2-derived IPv4 routes, since spanning tree and OSPF operate at different layers and solve different forwarding problems. It might be useful if Ethernet loop prevention disrupted adjacency reachability, but the requested output is an installed route inventory.

show interfaces switchport presents switchport administrative and operational Layer 2 settings such as mode and VLAN assignment. Those details can help identify a trunk or access-port problem that indirectly affects routed connectivity. They do not filter the IPv4 route table by origin protocol, however. The question already assumes functioning single-area OSPF and needs to see only the paths installed from it.

Applying an ACL change to every remote switch simultaneously creates a shared failure mode. A single mistaken management permit line or direction can lock the team out of many sites at once, leaving no healthy reference switch to compare. The question specifically asks to reduce loss of access, so a big-bang rollout without backups is the dangerous alternative. Prefer staged deployment and recovery preparation.

A successful automation job may only indicate that commands were accepted, not that management traffic remains permitted after the ACL takes effect. An ACL can have the wrong sequence, source wildcard, interface placement, or direction while still being valid IOS configuration. The team needs independent connectivity verification from expected management addresses. Trusting only an execution status creates false confidence during a high-impact security change.

Removing the device inventory would reduce the automation system's ability to target, verify, and reconcile which switches received the new ACL. It does not protect management sessions; in fact it makes staged deployment and rollback more difficult. The operator needs an accurate inventory, approved device grouping, and before/after state evidence. The question seeks recovery and validation safeguards, not deliberate loss of operational visibility.

transport input telnet ssh permits both Telnet and SSH inbound sessions on VTY lines when the other service requirements are met. That would preserve the insecure cleartext protocol the user explicitly wants to prohibit, so it fails the SSH-only requirement even though SSH would still work. The selected transport list must exclude Telnet, and device authentication and remote access policies should remain appropriately restricted.

access-class 1 out applies a standard ACL to outbound connections from a line in IOS contexts that support the command. It is not the VTY input-transport selector, and the direction shown does not inherently forbid incoming Telnet. An access-class could separately restrict where management sessions are accepted from, but the question specifically requires choosing SSH as the only allowed inbound remote-terminal protocol.

service password-encryption provides weak obfuscation for some stored plaintext-style configuration passwords and does not decide whether the VTY lines accept SSH, Telnet, or both. Having local usernames and RSA keys is compatible with secure SSH service, but an insecure transport can remain allowed unless its acceptance is explicitly restricted. The VTY transport statement rather than this password-display feature resolves the protocol prohibition.

Changing 802.11 channel width influences wireless spectrum usage, throughput, interference and client compatibility. It does not teach an engineer whether an unfamiliar website is authorized to receive a router's running configuration. Even perfectly optimized WLAN RF settings cannot prevent a person from voluntarily uploading sensitive information in response to a deceptive request. The protection sought here is employee judgment and established data-handling procedure.

Spanning-tree bridge priority influences root-bridge selection and Layer 2 path topology within the configured VLAN or instance. That mechanism does not detect phishing messages, verify a requested file-upload destination, or train staff to reject social-engineering approaches. If the network suffered an STP instability, bridge configuration would be relevant, but this question concerns the human handling of suspicious requests for configurations.

Changing every router's default route would redirect traffic for unmatched destinations, with potentially broad connectivity consequences and no inherent benefit against phishing. A malicious request for a configuration upload is an employee-facing deception, not a routing-table selection error. Network access controls can help protect systems, but the specific improvement requested is recognizing and reporting such attempts, which requires practiced security awareness and verification behavior.

A single untagged access VLAN cannot carry separate locally switched employee and guest VLANs over the same AP uplink under the described design. It would collapse both client traffic types into one wired broadcast domain or prevent one mapping from working. The AP needs to preserve the distinct VLAN identity when forwarding local wireless frames to the branch switch, which requires an appropriate tagged uplink and allowed VLANs.

The SSID is a wireless network identifier presented to clients and does not need to equal a numeric VLAN ID. Renaming an SSID to 10 or 30 would not create the corresponding tagged VLAN paths on the Ethernet uplink. The AP's WLAN-to-VLAN mapping and the switchport's trunk configuration are the relevant control points. Users can join clearly named employee and guest SSIDs while the infrastructure maintains separate VLAN assignments.

Disabling switching on the AP-facing port would remove the Ethernet path that a locally switched FlexConnect WLAN depends on to bridge client traffic into the branch VLANs. The objective is separation and local delivery, not isolation of the AP from its wired connection. The switch should remain active with compatible trunk mode, VLAN membership, and port security instead of being administratively shut down.

The question explicitly fixes both optical modules as short-range multimode designs. Connecting those SR multimode transceivers directly over a single-mode OS2 fiber path would mismatch the modules' intended core size and link characteristics. Single-mode is valuable for longer spans when matched to suitable long-range optics, but it is not a drop-in replacement for a 100-meter link engineered around multimode SR modules. Confirm fiber type and connector compatibility.

A copper twisted-pair cable with RJ-45 ends cannot be plugged into ordinary fiber-optic transceiver interfaces that expect optical fiber connectors. Copper Ethernet can provide valid rack or access connections when the interfaces are designed for it, but these endpoints have already been specified as optical SR modules. Converting the physical medium would require compatible copper ports or transceivers, not simply substituting an RJ-45 lead into an optical module.

A long-reach LR module is ordinarily engineered for a different optical wavelength and fiber medium from the stated short-range multimode SR module. Mixing those technologies on opposite ends of the same link does not produce a matched optical pair, even though both may use Ethernet signaling at a similar data rate. Choose compatible SR modules and supported multimode fiber for the required short span, or redesign both ends together.

HSRP priority is compared numerically with a HIGHER value preferred for active responsibility during the normal election. A router configured at 90 therefore loses to an otherwise eligible peer at 110; the lower value does not represent a stronger claim. Priority may be adjusted by interface tracking, so verify effective rather than merely configured values in real deployments, but the question explicitly states normal initial conditions without such complications.

Transport-layer TCP port numbers do not participate in HSRP active/standby elections. HSRP is a first-hop IP gateway redundancy mechanism, with role decisions based on group priority and relevant tie-breakers, not the client applications using the routers. Even if the two routers carried different management sessions, those session port numbers would not establish which one takes over the shared virtual gateway address.

HSRP generally provides one active router for a redundancy group and another standby participant ready to take over after a failure. It does not intend both members to respond as independent active owners of the same virtual gateway at the same time, which would create inconsistent forwarding identity. Operational role states and failover behavior should be checked with the appropriate HSRP show command rather than assuming an active/active design.