Pass Cisco 200-301 Exam in First Attempt Guaranteed!

HSRP priority is compared numerically with a HIGHER value preferred for active responsibility during the normal election. A router configured at 90 therefore loses to an otherwise eligible peer at 110; the lower value does not represent a stronger claim. Priority may be adjusted by interface tracking, so verify effective rather than merely configured values in real deployments, but the question explicitly states normal initial conditions without such complications.

Transport-layer TCP port numbers do not participate in HSRP active/standby elections. HSRP is a first-hop IP gateway redundancy mechanism, with role decisions based on group priority and relevant tie-breakers, not the client applications using the routers. Even if the two routers carried different management sessions, those session port numbers would not establish which one takes over the shared virtual gateway address.

HSRP generally provides one active router for a redundancy group and another standby participant ready to take over after a failure. It does not intend both members to respond as independent active owners of the same virtual gateway at the same time, which would create inconsistent forwarding identity. Operational role states and failover behavior should be checked with the appropriate HSRP show command rather than assuming an active/active design.

Plain HTTP normally transmits its application data without TLS protection, exposing device management sessions to interception or modification across untrusted network segments. It may be found in old laboratory appliances, but the question expressly requires TLS and rejects cleartext management. Enabling HTTP alone would not satisfy that condition; choose the device's secured HTTPS management endpoint and validate its certificate and authorization settings.

Telnet supplies an interactive terminal protocol, ordinarily on TCP port 23, rather than a browser-based management interface. Its normal session traffic is not protected by TLS and can expose administrative credentials and commands. Even if the network operator could reach the switch through Telnet, that would violate the encrypted web-console requirement. SSH would be the appropriate encrypted terminal alternative, but HTTPS is the browser-based service requested.

TFTP supports simple file transfers, commonly for configurations or network boot images in controlled environments. It is not an interactive web management service and does not offer TLS authentication or confidentiality. Using TFTP for device configuration may be appropriate in a secured lab segment, but it does not provide the encrypted browser session demanded here. Protect administrative pages using the proper HTTPS interface instead.

OSPF uses a routing-table code beginning with O for its learned routes and has its own adjacency and designated-router concepts. An S-prefixed 0/0 entry is a static default, not evidence that an OSPF DR advertised it. A router may redistribute a default into OSPF through separate configuration, but that is unrelated to the asterisk displayed beside this static route code in the local routing table.

The asterisk after S is a route-code annotation identifying default-route candidacy, not a signature or integrity mark. Cisco routing protocols do not become digitally signed merely because a particular character appears in a route table. Security authentication and signed management updates are separate controls and need their own configuration and verification. The line tells the operator about forwarding preference, not cryptographic validation of all updates.

A default route provides a fallback forwarding NEXT HOP for destinations not covered by more-specific routes. It does not make that next-hop router physically adjacent to every possible remote address or automatically prove reachability of all Internet hosts. The next hop 203.0.113.1 must itself be resolvable and reachable, but distant destinations remain beyond separate routed networks. The asterisk labels the route as default, not as universally connected.

A duplex mismatch can cause late collisions, retransmissions or poor throughput when one peer uses half duplex while the other uses full. The scenario explicitly states both peers report correctly matching full-duplex settings, removing the configuration evidence needed for this explanation. Moreover, the fault disappears after swapping out a visibly crushed cable. That sequence points to a physical signal impairment rather than a confirmed duplex disagreement.

IP routing-table errors can select a wrong next hop or prevent delivery to an off-subnet destination, but they do not rewrite the frame-check sequence of bits being received on a damaged Ethernet cable. FCS is checked at Layer 2 using the received frame bytes. The incident began with physical cable damage and was resolved with cable replacement, while there is no reported route change. A bad route would cause a different symptom.

A native VLAN mismatch on an 802.1Q trunk can cause untagged traffic to be assigned to different VLANs at opposite ends, potentially producing leakage or connectivity problems. It does not alter how an Ethernet CRC is computed from received bytes. In the stated event, the cable was crushed and FCS errors stopped when the cable was replaced, without a VLAN configuration change. Physical corruption, not checksum algorithm selection, explains the evidence.

switchport access vlan 10 assigns a Layer 2 data VLAN to an interface operating as an access port. It is unrelated to the local username database used when an SSH client authenticates to VTY lines. Changing this VLAN could affect connectivity to a device, but it would not create the user account or secret that login local asks IOS to verify. The question is an administrative authentication configuration, not VLAN membership.

ntp server 192.0.2.40 configures a remote time source. Accurate time supports useful logs and some security protocols, but NTP does not maintain the router's local login credentials. A switch that uses login local looks for locally defined usernames and associated secrets or passwords when accepting a VTY login. Adding an NTP association alone could never authenticate the SSH administrator named in the scenario.

An enable password value is associated with entering privileged EXEC mode under legacy mechanisms; it is not a named local username record. login local on VTY lines checks the local user database for the credentials supplied during remote login. Even if an enable password existed, the administrator would not automatically have a corresponding username and authenticated SSH login. Define user-specific credentials separately, preferably as protected secrets.

Many controller-managed switches maintain their own hardware forwarding tables and continue moving established user traffic according to installed state when a central orchestration process is temporarily unreachable. The scope of controller failure effects depends on the architecture, but an immediate total port shutdown is not a universal requirement. Some management functions and policy changes may become unavailable while normal forwarding continues. The scenario asks for that plane distinction, not an automatic device power-down response.

An SDN controller supplies logical management or control-plane orchestration and usually communicates over a management or routed network. It is not normally the single physical cable through which every endpoint packet must pass. Switches use installed forwarding state to transmit frames locally, so a controller application failure does not imply all user-to-server Ethernet links are physically broken. Separate the controller's role from the data-plane links and hardware paths.

A controller becoming unavailable does not activate link encryption by itself. Protocols such as MACsec, IPsec, SSH or TLS require configured endpoints and cryptographic material. Devices normally continue enforcing whatever forwarding and protection policies were previously installed, rather than upgrading cleartext flows merely because management is down. The outage could affect ability to change security policy or collect status, but does not create encryption.

TFTP does not require a trusted TLS certificate chain for each read or write; it is a simple UDP file-transfer protocol without built-in cryptographic peer authentication. Certificate-based trust is common for protocols such as HTTPS/TLS, but not for ordinary TFTP. If secure transport is required, choose a suitable authenticated encrypted transfer method instead of assuming that TFTP can validate the server's certificate automatically.

TFTP normally uses UDP rather than a persistent TCP byte stream, and it does not negotiate TCP-based encryption or a TLS session. Its simple request, data and acknowledgment exchange is convenient for basic file transfer but leaves traffic exposed on untrusted networks. The question asks about security limitations, so describing TFTP as connection-oriented and encrypted reverses its actual transport and protection behavior.

TFTP is an IP-based UDP application protocol, commonly using port 69 for its initial request, and can cross routers when forwarding and firewall policy permit. It is not restricted to direct Layer 2 broadcast domains. The actual concern in the scenario is confidentiality and authentication of the transferred configuration, not an inability to route the traffic. A routed path might increase the exposure risk if the protocol remains unencrypted.

RIP hop count and OSPF cost are metrics with different scales and meanings, so their numerical values cannot be compared directly to select routes learned from different protocols. Cisco IOS normally first evaluates administrative distance for the identical destination prefix. The RIP path's hop count of 2 does not defeat OSPF's lower administrative distance, even though 2 appears smaller than cost 40. RIP could become usable if the preferred OSPF route disappears.

Equal destination prefixes do not automatically create equal-cost paths when the candidates originate from different routing protocols. ECMP generally requires routes eligible under the same selection rules and compatible metrics. Here IOS chooses OSPF over RIP using the lower administrative distance, rather than installing one path from each protocol simply because both cover /24. The distinction matters even when both next-hop addresses are operational and their numerical metrics look favorable.

The alphabetical spelling of protocol names is not part of Cisco IOS route selection. Route codes help an operator identify route origin, but numeric administrative distance governs preference among distinct sources to an identical prefix, followed by relevant metric comparisons inside the chosen protocol. Sorting protocol names would produce arbitrary behavior unrelated to routing trust or topology. The supplied AD values 110 and 120 explicitly decide this example.

The wireless LAN controller's management gateway controls how its administrative or control-plane interfaces reach off-subnet destinations. It does not correct the pairwise security key used by a client during WPA2-Personal association. The client already identifies the intended SSID, but the entered passphrase differs from the WLAN's configured key. Resolve that key mismatch first, rather than redirecting management traffic toward the DNS server and risking a separate connectivity fault.

Disabling all wireless association protection might let an unsupported insecure open network appear usable, but it would violate the stated WPA2-Personal security policy. The issue is a client using a mismatched PSK/passphrase, not a requirement to remove authentication. Fix the credential on the client or centrally rotate the valid WLAN key through an approved process, keeping both endpoints aligned. Lowering security is unnecessary and unsafe for a key mismatch.

DHCP address allocation normally occurs after the wireless client has successfully associated and completed the applicable link-layer security exchange. A missing DHCP pool could produce an address-assignment failure on an already-connected client, but it cannot reconcile a WPA2-Personal passphrase mismatch. The stem identifies an authentication exchange failing after a different passphrase was entered, so the right first check is the configured PSK rather than IP leasing.

TCP normally recovers lost segments and delivers stream bytes in order, which is useful for complete file transfer or records that cannot tolerate missing data. For interactive voice, however, waiting for retransmitted bytes can increase end-to-end latency and cause head-of-line blocking, making old audio less useful by the time it arrives. The question's application explicitly favors timely delivery and application-level handling of minor loss, so TCP's recovery behavior is not the desired characteristic.

TLS protects confidentiality and integrity when used with a compatible transport, often TCP, but does not eliminate transport loss or its associated retransmission delays. Encrypting a voice stream does not make missing packets arrive on time or prevent head-of-line blocking. Secure real-time communications can employ suitable datagram-based protection where supported, while the question is fundamentally about whether the chosen transport waits for lost data.

A connection-oriented ordered byte stream guarantees that later bytes are not delivered to the application ahead of missing earlier bytes, even when waiting makes them too old for real-time playback. That is a feature for reliable transactional data, not the loss-tolerant low-delay media path described. Voice applications often prefer to discard an unusably late sample and continue with newer audio rather than hold the stream for every missing segment.

Two separate passwords are still examples of the same knowledge factor: something the administrator knows. Using more than one password can add steps, but it does not by itself provide independent possession or inherence protection. A genuine multifactor design combines categories, such as a password and a hardware authenticator storing a separate cryptographic secret. The question explicitly supplies those different categories, which distinguishes it from simply requiring two passwords.

Authorization controls which commands or resources an identified administrator may use; it does not replace the authentication checks proving the identity. In the scenario the administrator enters a password and uses a separate hardware cryptographic authenticator, clearly describing two authentication proofs. Permission to configure the switch could be assessed afterward by role or AAA policy, but the question asks what security property the login itself demonstrates. That property is multifactor authentication.

TCP and UDP are transport protocols, not authentication factor categories. Standard SSH remote terminal sessions normally run over TCP, and choosing a different transport would not convert a password into independent cryptographic possession proof. The hardware authenticator's separate key creates the second factor in this scenario. Network port or protocol configuration may affect connectivity and security, but is not the reason the login is multifactor.