Free Cisco CCNA 200-301 v1.1 Practice Exam

Current exam: v1.1 is available through February 2, 2027. Testing later? Use CCNA v2.0 .

Original IT Mastery practice questions, independently written and selected from the app question bank. They are not official Cisco questions or copied exam content.

How to use this practice set

Work through all 100 questions before revealing explanations. This is an editorial practice length, not a fixed Cisco item count or a reproduction of hands-on lab tasks. Cisco specifies 120 minutes for the exam; you may use that as a practice time budget, but this set is not an equivalent live exam form.

There are 90 single-answer questions and 10 Select TWO questions. For self-scoring, award one point only when you select exactly the keyed answer or keyed pair; do not award partial credit. The interaction mix is editorial, not a claimed Cisco distribution.

Answer choices were shuffled when this page was generated. Explanations use the displayed letters; refreshing the page keeps the same order. Record your reasoning as well as your choice.

Practice-set coverage

Practice questions

Questions 1-25

Question 1

Topic: Network Access

Rapid PVST+ has converged for VLAN 20. All links are point-to-point trunks permitting VLAN 20, with STP cost 4 at each end.

Port IDs on every switch are 128.1 for Gi0/1, 128.2 for Gi0/2, and 128.3 for Gi0/3.

Which two statements about VLAN 20 STP roles are supported? Select TWO.

Options:

• A. SW3 Gi0/1 is the designated port on the SW1-SW3 segment.

• B. SW2 Gi0/3 is an alternate port on the SW2-SW4 segment.

• C. SW3 Gi0/2 is the designated port on the SW2-SW3 segment.

• D. SW4 Gi0/2 is an alternate port on the SW3-SW4 segment.

• E. SW2 Gi0/2 is the designated port on the SW2-SW3 segment.

Correct answers: D and E

Explanation: SW1 is the root bridge because its VLAN 20 bridge priority is lowest. SW2 and SW3 therefore use their Gi0/1 interfaces as root ports, each with root path cost 4. On the SW2-SW3 segment, both advertise the same root cost, so SW2’s lower bridge ID wins the designated-port election. SW4 has equal-cost paths through SW2 and SW3. The sender bridge ID breaks this tie, making the link through lower-ID SW2 its root-port path and the link through SW3 its alternate path. On the SW2-SW4 segment, SW2 is designated because its root cost is lower than SW4’s.

• SW3 Gi0/2 loses the designated-port election because SW3 has a higher bridge ID than SW2.
• SW2 Gi0/3 is designated because SW2 has root cost 4, compared with SW4’s cost 8.
• SW3 Gi0/1 is a root port; SW1 Gi0/2 is designated because SW1 is the root bridge.

Question 2

Topic: Network Access

A Cisco 3504 WLC running AireOS connects to one Catalyst 9300 switch stack.

• AP operation: FlexConnect with local client switching
• WLC: LAG enabled; management interface uses VLAN 120
• Switch uplinks: Two identical 802.1Q trunks allow VLAN 120
• Requirement: Use both links as one aggregated controller uplink

Which switch-side action meets the requirement?

Options:

• A. Leave both trunks unbundled and use spanning tree for redundancy.

• B. Place both trunks in channel-group 20 mode on.

• C. Place both trunks in channel-group 20 mode active.

• D. Place both trunks in channel-group 20 mode desirable.

Best answer: B

Explanation: Cisco AireOS controller LAG uses a static EtherChannel on the adjacent switch. The switch interfaces must have matching trunk settings and use channel-group mode on, which forms the bundle without a negotiation protocol. LACP active and PAgP desirable expect participation from the neighboring device, but this controller family does not negotiate either protocol for its LAG.

FlexConnect local switching keeps client data at the branch, so client VLANs do not need to traverse the WLC uplink. Management and CAPWAP traffic still reach the controller through allowed VLAN 120. Independent trunks do not form the single logical uplink expected by the enabled controller LAG.

• LACP active fails because the AireOS controller does not negotiate LACP for its LAG.
• PAgP desirable fails because the controller does not participate in Cisco PAgP negotiation.
• Independent trunks do not form the single logical bundle expected by the enabled WLC LAG.

Question 3

Topic: Network Access

Two Cisco IOS switches have one interswitch link: SW1 Gi0/1 to SW2 Gi0/1. VLANs 20, 30, and 99 exist on both switches. The trunk uses native VLAN 99, allows VLANs 20, 30, and 99 on both ends, and is forwarding for VLANs 20 and 30. All access ports are up and forwarding.

Hosts in each VLAN share a subnet. An administrator enters only this command:

SW1(config-if)# switchport trunk allowed vlan remove 30

Which reachability outcome is expected?

Options:

• A. H1 reaches H3 but not H2; H4 cannot reach H5.

• B. H1 reaches H3 but not H2; H4 still reaches H5.

• C. H1 reaches H2 and H3; H4 still reaches H5.

• D. H1 reaches neither H2 nor H3; H4 still reaches H5.

Best answer: B

Explanation: An allowed VLAN list controls which tagged VLAN traffic a trunk carries. Removing VLAN 30 from SW1 Gi0/1 prevents VLAN 30 frames from crossing the only interswitch link, even though VLAN 30 still exists and spanning tree previously placed the link in forwarding state for that VLAN.

H1 and H3 remain reachable because both access ports belong to VLAN 30 on SW1, so their traffic does not use the trunk. H2 is separated from them because it resides on SW2. VLAN 20 connectivity between H4 and H5 continues because VLAN 20 remains permitted on the trunk. VLAN existence, trunk permission, and spanning-tree forwarding are separate requirements for cross-switch VLAN connectivity.

• Allowing VLAN 30 on SW2 does not preserve connectivity because SW1 no longer permits that VLAN on its trunk interface.
• Removing VLAN 30 from a trunk does not disable local VLAN 30 switching between access ports on SW1.
• VLAN 20 remains permitted and forwarding, so its cross-switch communication is unaffected.

Question 4

Topic: IP Services

An engineer reviews this simplified SNMP monitoring record:

NMS -> SW1  UDP dst 161  SNMPv3 GET       authPriv
SW1 -> NMS  UDP src 161  SNMPv3 RESPONSE  authPriv
SW1 -> NMS  UDP dst 162  SNMPv2c TRAP     community alerts

Which interpretation of the exchange is supported? (Select one.)

Options:

• A. The NMS manages polling, but SW1 becomes manager for the notification; only the polling messages are authenticated and encrypted.

• B. The NMS is manager and SW1 is agent; polling is authenticated but unencrypted, while the notification is also unencrypted.

• C. The NMS is manager and SW1 is agent; all three messages inherit authentication and encryption from the initial authPriv request.

• D. The NMS is manager and SW1 is agent; polling is authenticated and encrypted, while the notification lacks SNMPv3 protection.

Best answer: D

Explanation: The NMS is the SNMP manager because it initiates the GET, and SW1 is the agent because it returns the response and sends the notification. Message security must be evaluated separately. The SNMPv3 authPriv level provides message authentication, integrity, and privacy through encryption for the GET and RESPONSE. The TRAP is explicitly SNMPv2c, which uses a community string but does not provide SNMPv3 authentication or encryption. Security from an SNMPv3 request is not inherited by a later notification.

Sending a notification does not make SW1 the manager; agents can initiate traps toward a manager’s UDP port 162.

• Extending authPriv to every message fails because the independently encoded SNMPv2c trap does not inherit SNMPv3 security.
• Reversing roles for the trap confuses packet direction with function; an agent sends notifications to a manager.
• Calling authPriv unencrypted ignores the priv security level, which provides payload privacy through encryption.

Question 5

Topic: Network Fundamentals

All unencrypted HTTP traffic from the client to APP1 follows the displayed path. The data center boundary begins at SEC1’s client-facing interface. Policy requires stateful access control at that boundary and inline intrusion prevention before APP1.

During one interval:

• R1 had an installed route to 172.16.50.0/24.
• SEC1’s stateful firewall rule admitted 250 TCP/8080 sessions.
• SEC1’s inline IPS examined 250 sessions and dropped 4 signature matches.
• APP1 accepted 246 sessions.

Which TWO statements are supported?

Options:

• A. APP1’s listening socket enforces the required access policy for the server subnet.

• B. R1’s installed route provides stateful access control for the application traffic.

• C. SEC1’s IPS stage blocks signature matches after admission and before APP1.

• D. SEC1’s firewall stage provides stateful access control at the data center boundary.

• E. SEC1’s firewall permit result establishes that each admitted request is nonmalicious.

Correct answers: C and D

Explanation: Forwarding, access control, intrusion prevention, and application service are distinct roles, even when the firewall and IPS share one appliance. R1’s installed route supplies next-hop reachability but does not establish stateful security inspection. At SEC1, the firewall stage decides whether TCP/8080 sessions may cross the data center boundary. A permit means the session satisfies that access rule, not that its application content is harmless. The inline IPS then examines admitted HTTP traffic and drops signature matches before forwarding. The counters reconcile: 250 sessions were admitted, 4 were dropped, and 246 reached APP1. APP1 provides the HTTP service rather than boundary access control.

• An installed route enables forwarding toward the server subnet but does not provide stateful access control.
• A firewall permit confirms policy admission, not the absence of malicious application content.
• A listening socket accepts service connections but does not enforce the stated network boundary policy.

Question 6

Topic: Security Fundamentals

A Catalyst 9300 access switch running IOS XE protects VLAN 20 with DHCP snooping, Dynamic ARP Inspection (DAI), and port security. A statically addressed endpoint uses 10.20.20.50/24, gateway 10.20.20.1, and MAC aaaa.bbbb.cccc.

Simplified evidence:

ip dhcp snooping vlan 20
ip arp inspection vlan 20
interface GigabitEthernet1/0/10
 switchport mode access
 switchport access vlan 20
 switchport port-security
 switchport port-security maximum 2
 switchport port-security violation restrict

Port status: secure-up
Secure MACs: 1 of 2
Last source: aaaa.bbbb.cccc, VLAN 20
Violations: 0
DAI: denied ARP from 10.20.20.50, no binding

The port must remain untrusted for DAI, and DHCP clients must continue using snooping-based validation. Which configuration action should the administrator take?

Options:

• A. Configure the endpoint MAC as a static secure address, then retain the current port-security limit.

• B. Install a static ARP mapping on the default gateway, then clear its dynamic ARP entry.

• C. Create an ARP ACL for the IP-MAC pair, then apply it to DAI on VLAN 20.

• D. Mark the endpoint interface as DAI trusted, then retain the existing port-security configuration.

Best answer: C

Explanation: DAI checks ARP received on untrusted ports against the DHCP snooping binding database. Because the endpoint uses a static IP address, it has no DHCP-created binding, so its otherwise valid ARP is rejected. An ARP ACL permitting the endpoint’s specific IP-to-MAC mapping can be applied with ip arp inspection filter for VLAN 20. Without the static keyword, ARP packets not permitted by that ACL can still be checked against DHCP snooping bindings.

Port security is a separate control that limits or identifies source MAC addresses. Its counters show that the endpoint is within the configured limit and has caused no violation. The required correction must therefore address DAI validation rather than port-security enforcement.

• Static secure MAC affects port-security learning and limits but does not provide DAI with an approved IP-to-MAC mapping.
• Gateway ARP mapping changes the gateway’s ARP resolution but does not change inspection on the access switch.
• Trusted access port would bypass DAI validation and violate the requirement to keep the endpoint port untrusted.

Question 7

Topic: IP Connectivity

Two Cisco IOS XE routers should form an OSPF adjacency over a direct link. The adjacency remains in EXSTART.

Verified facts:

• Interfaces are up/up with addresses 10.20.12.1/30 and 10.20.12.2/30.
• Both interfaces use area 0, point-to-point network type, and 10/40-second timers.
• Router IDs are unique, authentication is disabled, and neither interface is passive.

R1# show ip ospf neighbor
Neighbor ID  Pri  State       Address       Interface
2.2.2.2        0  EXSTART/-   10.20.12.2    Gi0/0

Which additional evidence should be compared next to isolate the most likely cause?

Options:

• A. Compare learned route counts using show ip route ospf on both routers.

• B. Compare physical error counters using show interfaces on both routers.

• C. Compare router-LSA checksums using show ip ospf database on both routers.

• D. Compare interface IP MTU values using show interfaces on both routers.

Best answer: D

Explanation: EXSTART occurs after the routers have exchanged Hellos but before they have synchronized their link-state databases. During this state, database description (DBD) packets establish exchange roles and advertise database summaries. These packets also carry the sending interface’s MTU. An incompatible MTU can cause DBD packets to be rejected, leaving the adjacency in EXSTART or EXCHANGE.

The supplied facts eliminate common Hello-stage problems involving area IDs, subnets, timers, network types, authentication, passive interfaces, and interface status. Comparing MTU values therefore directly tests a failure associated with the observed state. Route and database differences are expected while synchronization remains incomplete.

• Physical error counters can reveal packet loss, but they do not directly test the DBD negotiation issue indicated by persistent EXSTART.
• Router-LSA checksums may differ because database synchronization has not completed, making the difference a consequence rather than the cause.
• Learned route counts are downstream results of completed adjacency and SPF processing, so they cannot isolate DBD exchange failure.

Question 8

Topic: IP Connectivity

On IOS XE router R1, an engineer says the route named HOST_77 sends only 10.20.30.77 to 192.0.2.2. All shown routes are installed, all next hops are resolved, no policy-based routing is configured, and ACLs permit the packet.

Configuration and simplified route output:

ip route 10.20.30.0 255.255.255.0 192.0.2.2 name HOST_77

S 10.20.0.0/16    [1/0] via 192.0.2.1
S 10.20.30.0/24   [1/0] via 192.0.2.2
S 10.20.30.64/26  [1/0] via 192.0.2.3

R1 receives a packet destined for 10.20.30.77. Which forwarding decision does R1 make?

Options:

• A. Forward to 192.0.2.1 using the covering /16 route.

• B. Forward to 192.0.2.2 using the named /24 route.

• C. Forward across all three next hops using equal-cost load balancing.

• D. Forward to 192.0.2.3 using the /26 route.

Best answer: D

Explanation: IPv4 forwarding uses longest-prefix matching among installed routes. The route named HOST_77 is a /24 network route, not a /32 host route; its name does not affect forwarding. Address 10.20.30.77 belongs to the /16, /24, and /26 prefixes, but the /26 is the longest match, so R1 uses next hop 192.0.2.3.

Administrative distance and metric do not produce equal-cost sharing among routes with different prefix lengths. The permitting ACL also does not select an alternate route. A true exception for only 10.20.30.77 would require a 255.255.255.255 mask.

• The named /24 route covers the entire subnet and loses to the more-specific /26 route.
• The /16 route is the least-specific matching entry, so it is not selected.
• Equal route metrics do not override longest-prefix matching or create multipath forwarding across different prefixes.

Question 9

Topic: IP Services

A Cisco IOS XE 17.9 router has a 2,048-bit RSA key. The management client can reach TCP ports 22 and 23.

hostname BR1
ip domain name example.net
username netadmin privilege 15 secret 9 <hash>
ip ssh version 2
!
line vty 0 15
 login local
 transport input telnet ssh

Which configuration action disables inbound Telnet, permits inbound SSH, and preserves local user authentication?

Options:

• A. Configure transport output ssh on VTY lines; retain the current input transport.

• B. Configure access-class MGMT in on VTY lines; retain the current input transport.

• C. Configure ip ssh version 2 globally; retain the current VTY transport.

• D. Configure transport input ssh on VTY lines; retain login local.

Best answer: D

Explanation: VTY transport selection and login authentication are separate controls. Under line vty 0 15, transport input ssh restricts incoming virtual terminal sessions to SSH. The existing login local command continues authenticating users against the router’s local username database. The hostname, domain name, RSA key, and SSH version configuration already satisfy the stated SSH prerequisites, while TCP reachability confirms that network access is not the issue.

Changing an SSH global setting alone does not remove Telnet from the permitted VTY transports.

• Setting SSH version 2 controls the SSH protocol version but leaves Telnet permitted by the current VTY configuration.
• transport output ssh affects connections initiated from a VTY session, not incoming management connections.
• A VTY access class restricts permitted network sources but does not inherently remove Telnet as an allowed transport.

Question 10

Topic: Network Fundamentals

A company is deploying one small campus block.

Current design:

• A1 and A2 connect users and have redundant uplinks to C1 and C2.
• C1 and C2 provide VLAN SVIs, gateway redundancy, and WAN connectivity.

Requirements:

• Growth is limited to four access switches and no additional distribution blocks.
• A C-switch failure must not remove gateway service.
• Inter-VLAN traffic must remain on C1/C2; most other traffic travels toward the WAN.
• Use the minimum number of functional tiers that meets these requirements.

Which architecture classification and role assignment best fits the deployment?

Options:

• A. Add dedicated core switches above C1/C2, which remain distribution, and retain A1/A2 as access switches.

• B. Operate C1/C2 as a collapsed distribution/core pair and retain A1/A2 as access switches.

• C. Operate C1/C2 as data-center spines and A1/A2 as leaves for endpoint access.

• D. Operate C1/C2 as Layer 2 access switches and centralize all VLAN routing on the WAN edge.

Best answer: B

Explanation: Topology tiers represent functional roles, not the physical number of switches. A two-tier campus has an access tier and a collapsed distribution/core tier. Multiple switches can perform each role to provide capacity and redundancy without creating additional tiers.

Here, A1 and A2 provide endpoint access, while C1 and C2 aggregate uplinks, route between VLANs, provide redundant gateways, and forward traffic toward the WAN. Because there is only one small access block, a separate core tier is unnecessary. The traffic pattern and endpoint connectivity also describe a campus design rather than a data-center spine-leaf fabric.

• A dedicated core is useful for interconnecting multiple distribution blocks, which this bounded deployment does not have.
• WAN-edge routing would make local inter-VLAN traffic leave C1/C2, contrary to the forwarding requirement.
• Spine-leaf roles suit scalable data-center fabrics with substantial east-west traffic, not this campus access block.

Question 11

Topic: Automation and Programmability

A network controller manages interface-profile resources at /api/v1/interfaces/{id}.

API contract:

The writable fields are description and adminState. Resources 17 and 23 initially exist.

Request trace:

GET /api/v1/interfaces/17 -> 200
{"id":17,"description":"Old uplink","adminState":"up"}

PATCH /api/v1/interfaces/17
{"description":"Backup uplink"}
-> 200
{"id":17,"description":"Backup uplink","adminState":"up"}

DELETE /api/v1/interfaces/23 -> 204
GET /api/v1/interfaces/23 -> 404

Which two statements are supported? Select TWO.

Options:

• A. PATCH changed interface 17’s description while preserving its admin state.

• B. PATCH created interface 17 because status 200 indicates resource creation.

• C. DELETE removed interface 23, as confirmed by the subsequent GET.

• D. DELETE failed for interface 23 because the response had no body.

• E. PUT with only description would produce the same partial change.

Correct answers: A and C

Explanation: REST method behavior must be interpreted according to the API contract. Here, PATCH performs a partial update on an existing resource. The trace shows that description changed while the omitted adminState remained up.

DELETE removes the resource and returns 204 No Content, so an empty response body is expected. The following GET returning 404 confirms that interface profile 23 is no longer available. PUT has different semantics in this contract: it replaces an existing resource and requires both writable fields. Status 200 indicates successful processing here, not resource creation.

• PATCH as creation is unsupported because the contract defines PATCH as updating an existing resource, and interface 17 already existed.
• Empty DELETE response indicates success because 204 No Content explicitly has no response body.
• Partial PUT request would violate the contract because replacement requires all writable fields.

Question 12

Topic: IP Services

A new client in VLAN 10 sends a DHCPDISCOVER with the broadcast flag set. R1, an IOS XE router, is VLAN 10’s broadcast boundary.

R1 configuration:

interface GigabitEthernet0/0.10
 encapsulation dot1Q 10
 ip address 10.10.10.1 255.255.255.0
 ip helper-address 172.16.20.20
!
interface GigabitEthernet0/1
 ip address 172.16.10.1 255.255.255.252

R2 connects 172.16.10.0/30 to the server network 172.16.20.0/24. Both routers have routes between VLAN 10 and the server network. The DHCP server at 172.16.20.20 has an active 10.10.10.0/24 scope and uses R2 as its default gateway.

Which forwarding sequence occurs?

Options:

• A. R1 routes the original discover broadcast across G0/1 without setting giaddr; the server derives VLAN 10 from the client MAC address and returns an offer.

• B. R1 unicasts the discover with giaddr 10.10.10.1; the server selects the VLAN 10 scope and unicasts the offer directly to the proposed client address.

• C. R1 unicasts the discover with giaddr 10.10.10.1; the server selects the VLAN 10 scope, and R1 broadcasts the returned offer on G0/0.10.

• D. R1 unicasts the discover with giaddr 172.16.10.1; the server finds no matching client scope, so the exchange ends without an offer.

Best answer: C

Explanation: The ip helper-address command makes R1 a DHCP relay. R1 does not route the client’s limited broadcast unchanged. Instead, it sends a unicast request to the configured server and places the address of the client-facing interface, 10.10.10.1, in the DHCP giaddr field. The server uses that field to select its 10.10.10.0/24 scope.

Because return routing exists, the server sends the offer toward the relay address. The broadcast flag tells R1 to broadcast the returned offer on VLAN 10, where the unconfigured client can receive it. The server-facing interface address does not identify the client’s scope.

• Using 172.16.10.1 as giaddr incorrectly selects the relay’s outgoing interface rather than the interface that received the client broadcast.
• Routing the original broadcast omits DHCP relay processing; routers do not normally forward a limited broadcast between subnets.
• Sending the offer directly to the proposed address ignores the nonzero giaddr and the client’s request for a broadcast response.

Question 13

Topic: Network Access

A Cisco IOS XE switch uses Rapid PVST+. No BPDU filtering or loop guard is configured.

spanning-tree portfast bpduguard default
!
interface GigabitEthernet1/0/10
 switchport mode trunk
 switchport trunk allowed vlan 20
 spanning-tree guard root
!
interface GigabitEthernet1/0/20
 switchport mode access
 switchport access vlan 20
 spanning-tree portfast

Gi1/0/10 receives a superior BPDU for VLAN 20. Gi1/0/20 receives a valid BPDU. Which result should the engineer expect?

Options:

• A. Gi1/0/10 becomes root-inconsistent; Gi1/0/20 becomes err-disabled.

• B. Both interfaces block VLAN 20 in a root-inconsistent state.

• C. Gi1/0/10 becomes err-disabled; Gi1/0/20 becomes root-inconsistent.

• D. Both interfaces become err-disabled after receiving the BPDUs.

Best answer: A

Explanation: Root guard prevents an attached switch from becoming the STP root. When Gi1/0/10 receives a superior BPDU, VLAN 20 enters the root-inconsistent state and stops forwarding on that interface. The state normally clears automatically when superior BPDUs stop.

Global BPDU guard applies to PortFast-enabled interfaces. Because Gi1/0/20 is a PortFast access port, receiving any BPDU is treated as an edge-port boundary violation and places the interface into the err-disabled state. Recovery then requires the configured err-disable recovery mechanism or administrative intervention.

Missing expected BPDUs would relate to loop guard and loop-inconsistent blocking, neither of which is configured here.

• Swapping the states assigns root guard behavior to the PortFast access port and BPDU guard behavior to the protected trunk.
• Err-disabling both ports incorrectly treats root guard as an err-disable feature.
• Root-inconsistent blocking on both ports incorrectly treats BPDU guard as a per-VLAN blocking mechanism.

Question 14

Topic: IP Services

R1 must download router.cfg from an existing TFTP server on an isolated management network. TFTP’s lack of encryption and authentication is accepted for this task.

Simplified IOS XE output:

R1# ping files.example.net
Resolved address: 10.20.20.50
Success rate is 100 percent (5/5)

R1# copy tftp://files.example.net/router.cfg running-config
%Error opening tftp://files.example.net/router.cfg (Timed out)

A firewall has TFTP application inspection enabled, allowing the negotiated server transfer port after an authorized request. It currently records:

DENY udp 10.10.10.1:49160 -> 10.20.20.50:69

Which action should the administrator take to complete the download?

Options:

• A. Replace the hostname with 10.20.20.50 while retaining the current firewall policy.

• B. Permit UDP port 69 traffic from R1 to the TFTP server.

• C. Reverse the copy direction to upload R1’s running configuration to the server.

• D. Permit TCP port 21 traffic from R1 to the file server.

Best answer: B

Explanation: Name resolution, IP reachability, and file transfer test different functions. The successful lookup establishes that DNS mapped files.example.net to 10.20.20.50, while the ping establishes ICMP reachability. Neither result proves that the file-transfer protocol is permitted.

TFTP initiates a request to UDP destination port 69. The firewall log shows that exact request being denied. Permitting R1 to initiate the TFTP flow allows the configured TFTP inspection to admit the associated traffic from the server-selected UDP transfer port. The isolated-network requirement also makes TFTP’s lack of built-in encryption and authentication acceptable here.

Using the resolved IP address would bypass DNS lookup, but it would not bypass the transport-layer firewall rule.

• Replacing the hostname changes name-resolution behavior but leaves the denied UDP port 69 flow unchanged.
• Permitting TCP port 21 supports FTP control connections, not the required TFTP transfer.
• Reversing the copy direction would upload R1’s configuration rather than download the required file.

Question 15

Topic: Network Fundamentals

An IOS XE router connects two containers running on the same Linux host. The containers share the host kernel, but the host bridges Container A only to VLAN 10 and Container B only to VLAN 20.

• VLAN 10 enters VRF BLUE through G0/0.10.
• VLAN 20 enters VRF RED through G0/0.20.
• The displayed routes are installed, and each next hop is reachable within its VRF.

R1# show ip route vrf BLUE 10.20.0.0
S 10.20.0.0/24 [1/0] via 192.0.2.2

R1# show ip route vrf RED 10.20.0.0
S 10.20.0.0/24 [1/0] via 198.51.100.2

When each container sends a packet to 10.20.0.50, which forwarding behavior occurs?

Options:

• A. Forward both via the lower-metric next hop after comparing routes across the VRFs.

• B. Forward A via 192.0.2.2 and B via 198.51.100.2, using each ingress VRF.

• C. Forward both via 192.0.2.2, using the first matching prefix installed on R1.

• D. Drop B’s packet because shared-kernel containers cannot use overlapping destination prefixes.

Best answer: B

Explanation: A VRF provides an independent routing and forwarding table on R1. A packet arriving through G0/0.10 uses the BLUE table, while one arriving through G0/0.20 uses the RED table. The identical prefixes do not conflict because they are not candidates in the same table.

Containers share their host’s kernel, whereas virtual machines normally run separate guest operating systems and kernels. That runtime distinction does not merge the router’s VRF tables. The containers’ separate VLAN attachments direct their traffic into the appropriate VRF, so separate virtual machines are not required for this overlapping-address design.

• First installed route fails because route selection is scoped to the ingress VRF, not configuration order across VRFs.
• Cross-VRF metric comparison fails because R1 does not compare routes from independent VRF tables during a normal lookup.
• Shared-kernel restriction confuses runtime isolation with router forwarding; the VLAN and VRF boundaries preserve network separation.

Question 16

Topic: IP Services

A Cisco IOS XE router has this configuration and local log entry:

service timestamps log datetime msec
logging host 192.0.2.50
logging trap warnings

Mar 1 10:14:37.612: %LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to down

The remote collector has no %LINEPROTO-5-UPDOWN entry for this interface, and no delivery capture is available. Which two statements are supported? Select TWO.

Options:

• A. The warnings threshold confirms the collector received the LINK message.

• B. Severity 3 means errors and passes the warnings threshold.

• C. LINK is the facility, and UPDOWN is the mnemonic.

• D. No severity-5 entry means the line protocol did not change.

• E. UPDOWN is the facility, and LINK is the mnemonic.

Correct answers: B and C

Explanation: A Cisco syslog identifier follows %FACILITY-SEVERITY-MNEMONIC. Therefore, %LINK-3-UPDOWN contains facility LINK, numeric severity 3, and mnemonic UPDOWN. Syslog severity 3 is errors. Lower numbers indicate greater urgency, so a logging trap warnings threshold of 4 permits levels 0 through 4 to be sent to configured servers.

Filtering does not prove whether an excluded event occurred. A severity-5 notification would not pass this remote logging threshold, so its absence at the collector cannot establish that the line protocol never changed. Likewise, eligibility for transmission does not confirm successful network delivery or collector receipt.

• Reversed fields: The first text field is the facility, while the final text field is the mnemonic.
• Missing severity-5 entry: Level 5 is filtered by the level-4 threshold, so its absence does not disprove an event.
• Confirmed delivery: The configuration permits transmission but provides no evidence that the collector received the message.

Question 17

Topic: Network Fundamentals

On Cisco IOS XE router R1, GigabitEthernet0/0 is up/up and currently has only link-local address FE80::1. IPv6 unicast routing is enabled.

The attached LAN uses 2001:DB8:120:30::/64. R1 must use the exact address 2001:0DB8:0120:0030:0000:0000:0000:0001 and install the LAN’s connected prefix.

Which command should be entered in interface configuration mode?

Options:

• A. ipv6 address 2001:DB8:120:30::1/64

• B. ipv6 address 2001:DB8:120:30::/64

• C. ipv6 address 2001:DB8:120:3::1/64

• D. ipv6 address 2001:DB8:120:30::1/128

Best answer: A

Explanation: IPv6 compression removes leading zeros from each hextet and replaces one consecutive sequence of all-zero hextets with ::. Therefore, 2001:0DB8:0120:0030:0000:0000:0000:0001 compresses to 2001:DB8:120:30::1.

The /64 prefix length identifies the attached LAN prefix. Because the interface is up/up, IOS XE installs a connected route for 2001:DB8:120:30::/64 and a local /128 route for the router’s interface address. The existing link-local address remains available for link-local communication. Compression never changes a nonzero hextet, so 0030 becomes 30, not 3.

• Using /128 treats the address as a host-sized prefix and does not represent the attached /64 LAN.
• Ending the address at :: produces an all-zero interface identifier rather than the required ::1 address.
• Compressing 0030 to 3 changes the hextet’s value and selects a different IPv6 prefix.

Question 18

Topic: IP Services

An IOS XE router should statically publish a server. The inside-local address is 10.10.10.10, and the required inside-global address is 198.51.100.10.

interface GigabitEthernet0/0
 description LAN
 ip address 10.10.10.1 255.255.255.0
 ip nat outside
!
interface GigabitEthernet0/1
 description ISP
 ip address 203.0.113.1 255.255.255.252
 ip nat inside
!
ip nat inside source static 10.10.10.10 198.51.100.10
ip route 0.0.0.0 0.0.0.0 203.0.113.2

The server uses 10.10.10.1 as its gateway. The ISP routes 198.51.100.10/32 to R1, and no ACL blocks the traffic. A WAN capture of server-initiated traffic shows source 10.10.10.10.

Which configuration change should the engineer make?

Options:

• A. Assign an outside-source static mapping while retaining the current roles.

• B. Assign the reversed addresses in the inside-source static mapping.

• C. Assign G0/0 as NAT inside and G0/1 as NAT outside.

• D. Assign a host route for the inside-global address toward G0/0.

Best answer: C

Explanation: Static inside-source NAT translates an inside-local source address to its inside-global address when traffic travels from a NAT inside interface to a NAT outside interface. Here, server traffic enters G0/0, which is incorrectly marked outside, and exits G0/1, which is incorrectly marked inside. Consequently, the configured inside-source translation is not applied, and the private source remains visible on the WAN.

The static mapping already lists the addresses in the correct order. Routing and access permission are also satisfied by the stated default route, ISP host route, and absence of a blocking ACL. NAT interface roles must therefore be swapped.

• Reversing the mapping confuses the inside-local and inside-global addresses; their existing order is correct.
• Adding a LAN host route does not trigger translation and would send the untranslated global address toward the LAN.
• Outside-source NAT translates addresses representing outside hosts, not the source address of this internal server.

Question 19

Topic: Network Fundamentals

An Ubuntu 22.04 client cannot open https://app.example.com. The router has verified routes between the client and server VLANs, and the server is operational.

Network plan:

• Client VLAN: 10.20.30.0/24
• Client gateway: 10.20.30.1
• Application server: 10.20.40.20/24

Client output:

$ ip -br address show dev ens160
ens160  UP  10.20.30.45/16
$ ip route
default via 10.20.30.1 dev ens160 metric 100
10.20.0.0/16 dev ens160 proto kernel scope link src 10.20.30.45
$ resolvectl query app.example.com
app.example.com: 10.20.40.20
$ ip route get 10.20.40.20
10.20.40.20 dev ens160 src 10.20.30.45

Which persistent client configuration action should the administrator take to match the network plan and restore connectivity?

Options:

• A. Add 10.20.40.0/24 via 10.20.30.1 and retain the /16 prefix.

• B. Lower the default-route metric to 10 and retain the /16 prefix.

• C. Set ens160 to 10.20.30.45/24 and retain the default route.

• D. Set DNS to 10.20.30.1 and retain the /16 prefix.

Best answer: C

Explanation: Linux selects the longest matching route before considering route metrics. With /16 configured, the connected route 10.20.0.0/16 includes 10.20.40.20, so the client treats the server as directly attached and attempts local neighbor resolution instead of using its gateway. Changing the interface prefix to /24 produces the intended connected network, 10.20.30.0/24. The server address then matches no connected route, so traffic follows the default route through 10.20.30.1. The successful resolver query also confirms that name resolution is not causing the failure.

• Adding a destination-specific route could bypass the problem, but it leaves the client address inconsistent with the stated network plan.
• Lowering the default-route metric does not override a longer /16 prefix match.
• Changing DNS is unnecessary because the hostname already resolves to the correct server address.

Question 20

Topic: Network Fundamentals

A technician must replace an access point without changing switch configurations. The new AP requests 36 W from the PSE for full radio operation; with less power, it enters reduced-function mode. All candidate cabling supports 1 Gbps and uses the required VLAN.

Available connections:

Which connection should the technician use?

Options:

• A. Use SW-A Gi1/0/18.

• B. Use SW-C Gi1/0/12.

• C. Use SW-B Gi1/0/7.

• D. Use SW-D Gi1/0/4.

Best answer: C

Explanation: A powered connection must satisfy the AP’s requested power at both the port and switch levels. SW-B supports 802.3bt Type 3 with a 60 W per-port maximum, and its 38 W remaining budget exceeds the 36 W request. Its enabled state also permits the Ethernet link to become operational. Sufficient total switch capacity cannot compensate for an inadequate per-port limit, and sufficient per-port capacity cannot compensate for an exhausted power budget. An administratively disabled interface is also unsuitable when configuration changes are prohibited.

• SW-A has enough total budget, but its 30 W per-port limit cannot satisfy the 36 W request.
• SW-C supports the required PoE type, but its 32 W remaining budget is insufficient.
• SW-D has sufficient power capacity, but its administratively down interface cannot provide the required operational connection.

Question 21

Topic: IP Connectivity

An IOS XE router learns 10.40.0.0/16 through OSPF:

O 10.40.0.0/16 [110/20] via 10.0.0.2, GigabitEthernet0/0

The backup next hop 192.0.2.2 is directly reachable through an interface that remains up if GigabitEthernet0/0 fails. No object tracking is configured. The backup must install after the OSPF route is withdrawn and yield when OSPF returns. Use the lowest administrative distance that meets these requirements.

Which command should be configured?

Options:

• A. ip route 10.40.0.0 255.255.0.0 192.0.2.2 255

• B. ip route 10.40.0.0 255.255.0.0 192.0.2.2 111

• C. ip route 10.40.0.0 255.255.0.0 192.0.2.2 109

• D. ip route 10.40.0.0 255.255.0.0 192.0.2.2 110

Best answer: B

Explanation: A floating static route has an administrative distance greater than the primary route. OSPF has an administrative distance of 110, so 111 is the lowest value that keeps the static route out of the routing table while OSPF is available. If the OSPF route is withdrawn after the primary interface fails, the reachable static next hop allows the backup route to install. When OSPF returns, its lower distance causes it to replace the static route in the routing table.

Without object tracking, the static route responds to route and next-hop availability, not end-to-end destination health.

• A distance of 109 would make the static route preferable to the OSPF route.
• A distance of 110 is not greater than OSPF’s distance and does not create the required floating relationship.
• A distance of 255 prevents the route from being installed, even after the OSPF route is withdrawn.

Question 22

Topic: Network Fundamentals

Branch PCs cannot open a SaaS application hosted in the provider’s data center. The company owns the PCs and branch LAN, the ISP owns the branch WAN, and the SaaS provider owns the application and public endpoint.

Current evidence:

Branch PC -> default gateway: succeeds
Branch PC -> local file server: succeeds
DNS lookup for app.vendor.example: 203.0.113.80
Branch PC -> public website TCP/443: succeeds
Branch PC -> 203.0.113.80 TCP/443: times out
HQ PC using an independent ISP -> 203.0.113.80 TCP/443: times out
Both path traces reach the vendor network

Which operational decision best matches this evidence?

Options:

• A. Treat it as a remote-service connectivity failure; engage the SaaS provider.

• B. Treat it as a name-resolution failure; engage the enterprise DNS team.

• C. Treat it as an Internet access failure; engage the branch ISP.

• D. Treat it as an on-premises access failure; engage the branch LAN team.

Best answer: A

Explanation: Successful access to the default gateway and local file server confirms that the branch PCs have on-premises network access. Successful TCP/443 access to another public website shows that the branch Internet path is functioning, while the DNS lookup confirms name resolution. The decisive evidence is that clients using independent Internet paths both reach the vendor network but cannot establish TCP/443 connectivity to the same provider-owned endpoint. This does not identify the provider’s internal root cause, but it places investigation and escalation at the remote-service boundary rather than the branch LAN or WAN.

• On-premises access failure conflicts with successful connectivity to the gateway and local file server.
• Internet access failure conflicts with successful public website access and the identical failure through an independent ISP.
• Name-resolution failure conflicts with the successful lookup returning the application’s public IP address.

Question 23

Topic: Network Fundamentals

A site uses the private allocation 10.20.8.0/23. Both hosts connect to the same VLAN, ARP caches are empty, and no ACL blocks traffic. R1 has IP routing enabled; NAT is not involved.

Host A sends the first ICMP echo request to Host B. Which forwarding sequence occurs?

Options:

• A. A sends the request directly to B; B sends the reply through R1.

• B. A sends the request directly to B; B sends the reply directly to A.

• C. A sends the request through R1; B sends the reply through R1.

• D. A sends the request through R1; B sends the reply directly to A.

Best answer: D

Explanation: Each host independently uses its own subnet mask to determine whether a destination is local. Host A’s /24 covers 10.20.8.0 through 10.20.8.255, so 10.20.9.20 is remote and the request is sent to R1’s MAC address. R1’s /23 connected route includes Host B and forwards the request onto the same VLAN. Host B’s /23 covers 10.20.8.0 through 10.20.9.255, so it considers Host A local and sends the reply directly to Host A’s MAC address.

The RFC1918 classification does not determine whether an address is local, and NAT does not affect this forwarding decision.

• Reversing the path incorrectly applies Host B’s broader /23 decision to Host A.
• Direct forwarding in both directions ignores Host A’s narrower /24 boundary.
• Gateway forwarding in both directions ignores that Host B’s /23 includes Host A.

Question 24

Topic: Automation and Programmability

A network controller API rejects this interface configuration. Its contract requires exact, case-sensitive keys and rejects unknown keys.

Contract:

• interface: object
• name: string
• enabled: boolean
• ipv4: object containing address as a string and prefixLength as a number
• description: string or null

Payload:

{
  "interface": {
    "name": "GigabitEthernet1",
    "enabled": true,
    "ipv4": {
      "address": "192.0.2.10",
      "prefix-length": 24
    },
    "description": null
  }
}

Which single correction makes the payload conform to the contract?

Options:

• A. Change description from null to "".

• B. Wrap the ipv4 object in a one-element array.

• C. Rename prefix-length to prefixLength.

• D. Change 24 to the string "24".

Best answer: C

Explanation: JSON can be syntactically valid while failing an API contract. Key names are case-sensitive and punctuation is significant, so prefix-length and prefixLength are different fields. The payload therefore lacks the required prefixLength field and includes an unknown field instead. Renaming the key resolves both conditions while preserving 24 as the required numeric type.

The other values and structures already match the contract: description may be null, and ipv4 must remain an object rather than an array. Contract validation requires both valid JSON syntax and exact agreement with field names, types, and structures.

• Quoting 24 changes a valid number into a string, which violates the required data type.
• Replacing null is unnecessary because the contract explicitly permits a null description.
• Converting ipv4 to an array violates the requirement that it be an object.

Question 25

Topic: Network Access

An IOS XE access switch is expected to connect AP-Lobby on Gi1/0/24. No neighbor appears for that port, although its packet counters increased during a 30-second observation.

SW1# show cdp interface gigabitEthernet 1/0/24
GigabitEthernet1/0/24 is up, line protocol is up
  Encapsulation ARPA
  Sending CDP packets every 60 seconds

SW1# show cdp neighbors
Device ID  Local Intrfce  Holdtme  Capability  Platform   Port ID
DIST1      Gi1/0/1        145      S I         C9300-24T  Gi1/0/48
PHONE-12   Gi1/0/12       132      H P         IP Phone   Port 1

Which assessment and next action are most appropriate?

Options:

• A. Record the link as operational but local CDP as failed; restart CDP on SW1 before examining the peer.

• B. Record the link as operational and the expected AP confirmed; update inventory using the interface and traffic evidence.

• C. Record the link as failed and identity unavailable; test cabling and optics before reviewing peer discovery settings.

• D. Record the link as operational but identity unverified; check peer discovery settings and corroborate with LLDP or MAC evidence.

Best answer: D

Explanation: CDP is an advertisement protocol, not a link-state test or authentication mechanism. Gi1/0/24 is up/up, and increasing packet counters show activity on the interface, so the evidence supports operational physical and data-link connectivity. The CDP interface output shows that SW1 sends advertisements there, while the neighbor table proves only that SW1 received advertisements on other ports. A missing entry means SW1 has not learned a CDP neighbor; the peer might not support CDP, might have it disabled, or might instead use LLDP. The device identity therefore remains unverified. Check discovery settings and corroborate with LLDP or forwarding-table evidence. Even a reported CDP device name would support topology mapping, not authenticate the device as trusted.

• Physical repair is unsupported because the interface is up/up and packet counters are increasing.
• Interface state and traffic confirm connectivity, not that the expected AP is attached.
• A local CDP failure is not established because CDP is enabled on the interface and receives advertisements elsewhere.

Questions 26-50

Question 26

Topic: IP Connectivity

A Cisco IOS XE DHCP server supplies settings to VLAN 20.

• FHRP virtual address: 10.20.0.1
• R1 physical address: 10.20.0.2 (active)
• R2 physical address: 10.20.0.3 (standby)
• If the active router fails, the standby router becomes active.
• Clients use the first router address offered by DHCP and do not renew during a failure.

Clients must retain off-subnet connectivity when either router fails. Which command should complete the pool?

ip dhcp pool VLAN20
 network 10.20.0.0 255.255.255.0
 default-router ?

Options:

• A. default-router 10.20.0.2

• B. default-router 10.20.0.3

• C. default-router 10.20.0.2 10.20.0.3

• D. default-router 10.20.0.1

Best answer: D

Explanation: An FHRP presents a stable virtual address that hosts can use as their default gateway. While R1 is active, it forwards traffic sent through 10.20.0.1. If R1 fails, R2 becomes active and assumes responsibility for the same virtual address. The clients therefore require neither a DHCP renewal nor a gateway configuration change.

The physical addresses identify individual routers and do not move when FHRP roles change. Assigning either physical address would make that router a single point of failure. Listing both physical addresses also fails because these clients install only the first address rather than relying on the FHRP virtual identity.

• Using 10.20.0.2 makes R1 the fixed first hop, so its failure removes the configured gateway.
• Using 10.20.0.3 makes R2 the fixed first hop, so its failure removes the configured gateway.
• Listing both physical addresses still causes these clients to install 10.20.0.2 as their sole gateway.

Question 27

Topic: Network Fundamentals

A campus must connect two Cisco Catalyst switches through a 1,400 m conduit between buildings. The conduit runs beside high-voltage feeders, so the medium must provide electrical isolation and immunity to electromagnetic interference. No intermediate repeaters are allowed. Both switches support the listed SFPs.

Which implementation provides a 1-Gbps switched point-to-point full-duplex link that meets all requirements?

Options:

• A. Use shielded Cat6A copper with 1000BASE-T SFPs at both switches.

• B. Use duplex OS2 LC fiber with LX/LH at one end and SX at the other.

• C. Use duplex OS2 LC fiber with LX/LH SFPs at both switches.

• D. Use duplex OM3 LC fiber with SX SFPs at both switches.

Best answer: C

Explanation: The decisive factors are validated reach, matching optical interfaces, and electrical isolation. At 1,400 m, 1000BASE-SX over OM3 exceeds its stated 550 m reach, while LX/LH over OS2 is validated to 10 km. LX/LH SFPs at both ends also align the wavelength, fiber type, and duplex LC connectors. Fiber is nonconductive and immune to electromagnetic interference from the nearby feeders.

The fiber pair provides dedicated transmit and receive paths between two switch ports. The Ethernet link therefore operates point-to-point in full duplex rather than as a shared collision domain using CSMA/CD. Mixed SX and LX/LH optics are not a supported transceiver pair, while Cat6A exceeds its validated reach.

• Short multimode reach: OM3 with SX is EMI-resistant but exceeds the specified 550 m limit.
• Mismatched optics: Combining SX and LX/LH does not provide compatible endpoint wavelengths and link characteristics.
• Copper limitation: Shielded Cat6A still exceeds its 100 m reach and does not provide electrical isolation.

Question 28

Topic: IP Connectivity

R2 runs OSPFv2 on two Ethernet segments:

• R1 (router ID 1.1.1.1, priority 1) connects directly to R2. Both interfaces use the point-to-point network type.
• R2 (priority 100, router ID 2.2.2.2) and R3 (priority 50, router ID 3.3.3.3) complete a broadcast election at 09:00.
• R4 (priority 200, router ID 4.4.4.4) joins the broadcast segment at 09:05.

All parameters match, interfaces remain up, and OSPF is not restarted. Which stable show ip ospf neighbor state and role combination should R2 report?

Options:

• A. R1 FULL/-; R3 FULL/DROTHER; R4 FULL/DR

• B. R1 FULL/-; R3 FULL/BDR; R4 FULL/DROTHER

• C. R1 2WAY/-; R3 FULL/BDR; R4 FULL/DROTHER

• D. R1 FULL/-; R3 FULL/BDR; R4 2WAY/DROTHER

Best answer: B

Explanation: OSPF network type determines both election behavior and adjacency expectations. The direct point-to-point link has no DR or BDR election, so R1 and R2 form a FULL adjacency with no displayed role. On the broadcast segment, R2’s higher priority makes it DR and R3 becomes BDR during the 09:00 election. OSPF elections are nonpreemptive, so R4’s higher priority does not replace the existing DR when it joins later. R4 remains DROTHER but forms a FULL adjacency with R2 because R2 is the DR. A stable 2-WAY state can be normal between two DROTHER routers, but that condition does not apply between R2 and R4.

• Reporting R1 as 2-WAY is incorrect because matching point-to-point neighbors proceed to a FULL adjacency.
• Assigning R4 the DR role incorrectly assumes that its higher priority preempts the previously elected DR.
• Reporting R4 as 2-WAY misapplies DROTHER behavior because a DROTHER forms a FULL adjacency with the DR.

Question 29

Topic: Network Access

A remote engineer must open an interactive IOS XE CLI session to a Catalyst switch. Policy requires encrypted remote management. The workstation can ping the switch management IP 10.20.99.10, but the TACACS+ servers are not responding. A separate RADIUS service authenticates WLAN clients only.

The switch has this configuration:

aaa new-model
aaa authentication login default group tacacs+ local
username breakglass privilege 15 secret <redacted>
ip ssh version 2
ip http server
ip http secure-server
ip http authentication aaa
line console 0
 login local
line vty 0 15
 login authentication default
 transport input ssh telnet

The console is available only onsite. Which remote management workflow meets the requirements?

Options:

• A. HTTPS to 10.20.99.10 using the local fallback account

• B. HTTP to 10.20.99.10 using the local fallback account

• C. SSH to 10.20.99.10 using the local fallback account

• D. Telnet to 10.20.99.10 using the local fallback account

Best answer: C

Explanation: SSH provides an encrypted command-line session, while HTTPS provides encrypted browser-based management. Telnet offers a command-line session but sends management traffic without encryption, and HTTP is both browser-based and unencrypted.

The VTY lines accept SSH and Telnet and use the default AAA method list. Because the TACACS+ servers are unresponsive, group tacacs+ local proceeds to the local user database. The WLAN RADIUS service is a separate authentication path and does not authenticate switch administrators.

HTTPS is secure in transit, but it does not meet the requirement for an interactive IOS XE CLI session.

• HTTPS management encrypts browser traffic but does not provide the required interactive IOS XE CLI session.
• Telnet management provides CLI access and can use AAA fallback, but its traffic is not encrypted.
• HTTP management uses an unencrypted web session and therefore fails both the CLI and encryption requirements.

Question 30

Topic: IP Connectivity

R1 has received a packet destined for 10.44.8.25. Each next hop below is reachable, and all three routes are installed in the IPv4 routing table.

O  10.44.8.0/24 [110/20] via 192.0.2.2, GigabitEthernet0/0
S  10.44.0.0/16 [5/0] via 203.0.113.2, GigabitEthernet0/1
S* 0.0.0.0/0 [1/0] via 198.51.100.1, GigabitEthernet0/2

How will R1 forward the packet?

Options:

• A. Load-balance it across all three installed next hops

• B. Forward it to 192.0.2.2 using the /24 route

• C. Forward it to 198.51.100.1 using the default route

• D. Forward it to 203.0.113.2 using the /16 route

Best answer: B

Explanation: A router first applies longest-prefix matching among installed routes. The destination 10.44.8.25 matches the /24, /16, and default routes, but the /24 has the greatest prefix length and is therefore the most specific match. R1 forwards the packet to 192.0.2.2.

Administrative distance determines which route source is preferred when routes compete for the same prefix. It does not cause a less-specific route to override a more-specific installed route. Consequently, the static default route’s administrative distance of 1 does not make it preferable to the OSPF /24 route with an administrative distance of 110.

• The /16 static route matches the destination but is less specific than the installed /24 route.
• The default route has a lower administrative distance but is the least-specific matching entry.
• Load balancing does not occur across routes with different prefix lengths; only the longest matching route participates.

Question 31

Topic: Automation and Programmability

A network team repeatedly creates and removes virtual lab routers and networks. The required workflow must:

• Define the desired infrastructure in version-controlled files.
• Preview proposed changes before execution.
• Track managed resource state between runs.

Which operational approach best meets these requirements?

Options:

• A. Use SSH to enter IOS XE configuration commands interactively.

• B. Use Terraform to plan and apply the declared resource state.

• C. Use Ansible to run inventory-targeted configuration tasks.

• D. Use RESTCONF to send immediate configuration updates programmatically.

Best answer: B

Explanation: Terraform manages infrastructure declaratively: files describe the intended resource state, a plan previews the changes, and Terraform state tracks managed resources across runs. This supports repeated creation, modification, and removal as an infrastructure lifecycle.

Ansible commonly uses inventories and playbook tasks to automate configuration across devices. Interactive CLI and direct RESTCONF requests can also change configurations, but they are immediate operations and do not inherently provide Terraform’s planning and lifecycle-state model. The requirement for persistent resource tracking is the decisive distinction.

• Ansible is inventory- and task-oriented rather than centered on Terraform-style infrastructure lifecycle state.
• Interactive IOS XE commands perform immediate device changes without declarative planning or persistent resource tracking.
• Direct RESTCONF requests automate updates but do not inherently calculate plans or manage resource lifecycle state.

Question 32

Topic: IP Connectivity

R1 is a Cisco IOS XE router. All listed next hops resolve, their exit interfaces are up, and no policy-based routing is configured. This simplified candidate-route display uses [administrative distance/metric]; O means OSPF, D means EIGRP, and S means static.

Candidate routes:

O 10.50.8.0/24 [110/20]   via 192.0.2.2
D 10.50.8.0/24 [90/3072]  via 192.0.2.6
D 10.50.8.0/24 [90/4096]  via 192.0.2.10
S 10.50.0.0/16 [1/0]      via 192.0.2.14

After normal route selection, which route will R1 use for a packet destined for 10.50.8.44?

Options:

• A. Via 192.0.2.14 using the static /16 route

• B. Via 192.0.2.2 using the OSPF /24 route

• C. Via 192.0.2.10 using the EIGRP /24 route

• D. Via 192.0.2.6 using the EIGRP /24 route

Best answer: D

Explanation: Route selection first compares sources offering the identical prefix and mask. For 10.50.8.0/24, EIGRP’s administrative distance of 90 is lower than OSPF’s 110, so the OSPF metric is not compared with the EIGRP metrics. Between the two EIGRP candidates, the lower metric of 3072 selects next hop 192.0.2.6.

The static /16 route can also be installed because it represents a different prefix. During forwarding, 10.50.8.44 matches both the /16 and /24, but longest-prefix matching selects the more-specific /24 route.

• OSPF metric comparison: Metric 20 cannot be compared directly with an EIGRP metric because administrative distance selects between different route sources.
• Higher EIGRP metric: Both EIGRP candidates have the same administrative distance, so metric 4096 loses to metric 3072.
• Static route preference: Administrative distance 1 selects the /16 route only against candidates for that same prefix, not against a more-specific /24.

Question 33

Topic: Network Access

A campus uses a centralized Cisco Catalyst 9800 controller with lightweight APs. Production APs operate in local mode and centrally switch client traffic through CAPWAP.

A spare AP must capture all 802.11 management, control, and data frames on 5-GHz channel 44 and forward them to a remote packet analyzer. The spare AP will not serve clients during the capture.

Which configuration action meets the requirement?

Options:

• A. Configure the spare AP in local mode on channel 44 with central switching.

• B. Configure the spare AP in monitor mode across 5-GHz channels, targeting the analyzer.

• C. Configure the spare AP in FlexConnect mode on channel 44 with local switching.

• D. Configure the spare AP in sniffer mode on channel 44, targeting the analyzer.

Best answer: D

Explanation: In a centralized wireless architecture, sniffer mode dedicates a lightweight AP to capturing 802.11 frames on a selected channel. The AP forwards the captured frames across the wired network to a compatible remote packet analyzer and does not provide ordinary client access while operating in this mode.

Monitor mode also stops normal client service, but its primary role is scanning channels for wireless security, rogue detection, and location functions rather than supplying a continuous fixed-channel capture to an external analyzer. Local and FlexConnect modes are client-serving modes distinguished mainly by where client traffic is switched.

• Monitor mode scans the RF environment for security and location functions rather than providing the required fixed-channel packet stream.
• Local mode serves clients and normally tunnels their traffic to the centralized controller.
• FlexConnect supports remote-site client service and local switching, not dedicated raw 802.11 frame capture.

Question 34

Topic: IP Services

BR1 runs Cisco IOS XE and must serve synchronized time to two LAN switches. The switches can reach BR1 at 10.20.0.1, but a WAN ACL blocks their direct NTP access to upstream servers. No NTP access group blocks LAN requests on BR1.

Abbreviated IOS XE output:

BR1# show ntp associations
  address         ref clock       st  poll reach
*~192.0.2.10      198.51.100.10    2    64   377
+~192.0.2.20      198.51.100.20    3    64   377

* current system peer, + candidate, ~ configured
reach: 8-poll octal register; 377 = all eight replied

BR1# show ntp status
Clock is synchronized, stratum 3,
reference is 192.0.2.10

Which configuration action meets the requirement?

Options:

• A. Replace BR1’s associations with ntp master 2; point both switches to BR1.

• B. Keep BR1’s associations; configure ntp server 10.20.0.1 on both switches.

• C. Keep BR1’s associations; configure ntp server 192.0.2.10 on both switches.

• D. Remove BR1’s associations; configure clock set on BR1 and both switches.

Best answer: B

Explanation: The asterisk identifies 192.0.2.10 as BR1’s current system peer, and show ntp status confirms that BR1 is synchronized. BR1 is stratum 3 because its selected upstream server is stratum 2. A synchronized IOS XE router can serve NTP to downstream clients when access controls permit it, so the switches should use BR1’s reachable LAN address.

The 377 reach value shows successful recent exchanges, while the plus sign identifies the other server as a candidate rather than the selected peer. A lower stratum describes distance from a reference clock; it does not independently guarantee greater accuracy. Manually setting a clock creates no ongoing synchronization relationship.

• Manual clock setting establishes a local time value but does not maintain synchronization with an upstream source.
• Local NTP master makes BR1’s local clock authoritative instead of preserving the required upstream time lineage.
• Direct upstream access fails because the WAN ACL blocks NTP traffic from the switches to 192.0.2.10.

Question 35

Topic: Network Fundamentals

A small office owns a SOHO appliance that integrates an access point (AP), Ethernet switch, and IPv4 router/NAT. The inventory application runs on an office-owned server, while payroll is provider-hosted SaaS.

The Staff SSID is locally bridged into VLAN 10. The laptop’s gateway is 192.168.10.1, and the appliance has an installed default route through its operational WAN interface.

Which path pair correctly describes outbound application traffic from the laptop?

Options:

• A. Local: AP bridge -> switch -> LAN 3; SaaS: AP bridge -> switch -> router/NAT -> WAN

• B. Local: AP bridge -> switch -> router/NAT -> LAN 3; SaaS: AP bridge -> switch -> router/NAT -> WAN

• C. Local: AP routing -> switch -> LAN 3; SaaS: AP routing/NAT -> WAN interface -> Internet

• D. Local: AP bridge -> switch -> LAN 3; SaaS: AP bridge -> switch -> WAN interface -> Internet

Best answer: A

Explanation: The laptop and inventory server share the 192.168.10.0/24 subnet. The laptop therefore resolves the server’s MAC address and sends its frame through the AP’s bridging function into VLAN 10. The switch then forwards the frame to LAN 3 without involving the router or WAN.

The SaaS application is outside the local subnet. The laptop addresses its frame to the default gateway, the AP bridges it into VLAN 10, and the switch forwards it to the appliance’s router. The router performs Layer 3 forwarding and NAT before sending the packet through the WAN. Local switching serves the office-owned application, while Internet routing serves the provider-hosted application.

• Routing the local traffic is unnecessary because the laptop identifies the server as an on-link destination from its /24 mask.
• Switching directly to the WAN omits the routing and NAT required to reach an off-subnet public destination.
• Assigning routing and NAT to the AP confuses wireless Layer 2 bridging with the appliance’s Layer 3 router function.

Question 36

Topic: Network Fundamentals

On a Cisco IOS XE router, an engineer manually derived an IPv6 address from the interface MAC.

Interface evidence:

MAC address: 0C:12:34:56:78:9A
IPv6 prefix: 2001:db8:120:10::/64
Candidate:   2001:db8:120:10:0c12:34ff:fe56:789a/64

The candidate is intended as a unique global unicast address, not an anycast address. The interface also joins the ff02::1 multicast group, which is not MAC-derived.

Which command uses the correctly converted modified EUI-64 interface identifier?

Options:

• A. ipv6 address 2001:db8:120:10:0c12:34ff:fe56:789a/64

• B. ipv6 address 2001:db8:120:10:0d12:34ff:fe56:789a/64

• C. ipv6 address 2001:db8:120:10:0e12:34ff:fe56:789a/64

• D. ipv6 address 2001:db8:120:10:0e12:3456:fffe:789a/64

Best answer: C

Explanation: Modified EUI-64 converts a 48-bit MAC address into a 64-bit interface identifier. First, invert the universal/local bit, which has the value 0x02 in the first octet. Thus, 0C XOR 02 produces 0E. Next, insert FF:FE between the first three and last three MAC bytes. The resulting byte sequence is 0E:12:34:FF:FE:56:78:9A, regrouped as 0e12:34ff:fe56:789a.

The original candidate inserted FFFE correctly but failed to invert the U/L bit. Address roles do not change this conversion: ff02::1 is multicast, while unicast and anycast addresses use unicast address formats.

• Retaining 0C omits the required inversion of the universal/local bit.
• Changing 0C to 0D flips the individual/group bit instead of the universal/local bit.
• Placing FFFE after four MAC bytes fails to insert it between the original three-byte halves.

Question 37

Topic: IP Services

A Cisco IOS XE router must obtain time only from the stated NTP server 192.0.2.20. Both servers are IP-reachable, and NTP authentication is not configured.

R1# show running-config | include ntp server
ntp server 192.0.2.10
ntp server 192.0.2.20

R1# show ntp associations
 address         ref clock       st  reach
*~192.0.2.10     198.51.100.1     2    377
+~192.0.2.20     203.0.113.5      3    377

* = current system peer
+ = acceptable candidate
~ = configured association
st = stratum; reach = octal reachability register

Which configuration action meets the requirement?

Options:

• A. Prefer server 192.0.2.20 and retain both server associations.

• B. Remove server 192.0.2.10 and retain server 192.0.2.20.

• C. Remove both server associations and configure ntp master 3.

• D. Replace the 192.0.2.20 server association with a peer association.

Best answer: B

Explanation: The * identifies 192.0.2.10 as the current system peer, while 192.0.2.20 is a reachable candidate. Because the policy permits only 192.0.2.20, R1 should remove the other configured association with no ntp server 192.0.2.10. The existing ntp server 192.0.2.20 command already establishes the required client-to-server relationship. A lower stratum is considered during NTP selection, but it does not unconditionally prove that a source is more accurate or override the stated policy.

The key distinction is removing the disallowed source rather than merely influencing selection while retaining it.

• Preference only leaves the disallowed server configured and potentially selectable if the preferred source becomes unsuitable.
• Peer association creates a symmetric NTP relationship rather than the required client-to-server relationship.
• Local NTP master makes R1 a time source and does not obtain time from the stated external server.

Question 38

Topic: Network Access

A Cisco Catalyst 9300 connects two hosts. Both access ports are up and in a spanning-tree forwarding state. No ACLs are configured, and both host firewalls permit ICMP.

Relevant configuration and output:

no ip routing
!
interface Vlan10
 ip address 10.10.10.1 255.255.255.0
 no shutdown
interface Vlan20
 ip address 10.10.20.1 255.255.255.0
 no shutdown

Vlan10  10.10.10.1  up  up
Vlan20  10.10.20.1  up  up

Each host can ping its gateway, but the hosts cannot ping each other. Which two conclusions are supported? Select TWO.

Options:

• A. Configure static routes for both local subnets because SVIs do not create connected routes.

• B. Convert both endpoint links to trunks so their traffic carries 802.1Q tags.

• C. Keep both endpoint links as access ports; endpoint traffic requires no VLAN tags.

• D. Apply no shutdown to both SVIs so their connected routes become available.

• E. Enable ip routing; the operational SVIs will provide the connected routed path.

Correct answers: C and E

Explanation: A multilayer switch needs operational SVIs and global IP routing to route between VLANs. Both SVIs are already up/up, have the hosts’ configured gateway addresses, and represent directly connected subnets. The missing requirement is ip routing; after it is enabled, the switch can install both connected routes and forward packets between them.

The host-facing interfaces should remain access ports. Hosts send ordinary untagged Ethernet frames, and the switch assigns those frames to VLAN 10 or VLAN 20 according to each port’s access VLAN. Static routes and router-on-a-stick trunking are unnecessary for these directly attached networks.

• Endpoint trunks are unnecessary because each endpoint belongs to one VLAN and uses an access port.
• SVI shutdown state is not the fault because both VLAN interfaces already report up/up.
• Static routes are unnecessary because operational SVIs produce connected routes after global routing is enabled.

Question 39

Topic: Security Fundamentals

On an IOS XE router, Gi0/0 connects users at 10.10.10.0/24 and applies USERS-IN inbound. Gi0/1 connects servers at 192.0.2.0/24 and applies SERVERS-IN inbound. Both networks are installed as connected routes, and all hosts use R1 as their default gateway.

The policy must admit HTTPS return packets from 192.0.2.20 carrying ACK or RST, retain permitted DNS replies, and reject new SYN-only sessions from the server network.

Counters were cleared before one HTTPS attempt from 10.10.10.50. No other traffic was sent.

Extended IP access list USERS-IN
 10 permit tcp 10.10.10.0 0.0.0.255 host 192.0.2.20 eq 443 (4 matches)
 20 permit udp 10.10.10.0 0.0.0.255 host 192.0.2.53 eq domain (0 matches)
 90 deny ip any any log (0 matches)
Extended IP access list SERVERS-IN
 10 permit udp host 192.0.2.53 eq domain 10.10.10.0 0.0.0.255 gt 1023 (0 matches)
 90 deny ip any any log (4 matches)

%SEC-6-IPACCESSLOGP: list SERVERS-IN denied tcp
192.0.2.20(443) -> 10.10.10.50(51514), 4 packets

Which two statements are supported? Select TWO.

Options:

• A. The USERS-IN permit creates temporary session state that should automatically admit the matching server packets.

• B. Adding permit tcp host 192.0.2.20 eq 443 10.10.10.0 0.0.0.255 established before sequence 90 admits the required returns.

• C. The SERVERS-IN deny increase shows that R1 has no usable route back to the user subnet.

• D. Adding permit tcp host 192.0.2.20 eq 443 10.10.10.0 0.0.0.255 before sequence 90 admits only return packets.

• E. The client packets match the USERS-IN permit, while server responses match the SERVERS-IN explicit deny.

Correct answers: B and E

Explanation: IOS extended ACLs are stateless. Permitting client TCP packets in one direction does not automatically permit the reverse packets through another ACL. Here, the request counter increases in USERS-IN, while the log and deny counter show packets returning from the server’s TCP port 443 being rejected by SERVERS-IN. Connected routes and correct default gateways rule out a missing return route.

The TCP established keyword matches packets with ACK or RST set; it does not maintain session state. Scoping that ACE to the web server, source port 443, and user subnet provides the required narrow exception. Inserting it before the explicit deny also leaves the existing DNS reply permit unchanged. The counters demonstrate ACL matches, not overall application health.

• Missing return route is contradicted by the installed connected route to the user subnet and the stated gateway configuration.
• Temporary ACL state is unsupported because an IOS extended ACL evaluates each direction independently.
• Source port alone also admits SYN-only packets originating from port 443, violating the stated flag requirement.

Question 40

Topic: IP Connectivity

A Cisco IOS XE router must reach the entire 10.20.30.0/24 network through R2. Configure a fully specified static route that identifies both the Ethernet exit interface and adjacent next hop.

• R1 GigabitEthernet0/0: 192.0.2.1/24, up/up
• R2 address on the same Ethernet LAN: 192.0.2.2/24
• R2 has a route to 10.20.30.0/24
• R3 at 192.0.2.3 reaches only 10.20.40.0/24
• R1 GigabitEthernet0/1: 198.51.100.1/30

Which single command meets the requirement?

Options:

• A. ip route 10.20.30.0 255.255.255.0 GigabitEthernet0/0 192.0.2.2

• B. ip route 10.20.30.0 255.255.255.128 GigabitEthernet0/0 192.0.2.2

• C. ip route 10.20.30.0 255.255.255.0 GigabitEthernet0/0 192.0.2.3

• D. ip route 10.20.30.0 255.255.255.0 GigabitEthernet0/1 192.0.2.2

Best answer: A

Explanation: A fully specified static route includes both an exit interface and a next-hop address. Here, the destination requires mask 255.255.255.0, while R2 is the router that provides the path to that destination. Because R2 shares the Ethernet LAN attached to GigabitEthernet0/0, R1 can use ARP on that interface to resolve 192.0.2.2 to R2’s MAC address.

Specifying both values avoids treating every remote destination as directly attached to the Ethernet segment. The exit interface and next hop must also be consistent: the next-hop address must be reachable through the named interface.

• The /25 mask installs a route for only half of the required /24 destination.
• The R3 next hop leads to a different remote network under the supplied routing facts.
• GigabitEthernet0/1 is not connected to the subnet containing the specified R2 address.

Question 41

Topic: IP Services

An IOS XE branch router is the trust boundary for voice traffic arriving on Gi0/0.20. Endpoint markings are not trusted.

Current facts:

• RTP packets arrive with DSCP 0.
• The 100-Mbps WAN carries 125 Mbps during congestion.
• RTP peaks at 12 Mbps.
• The WAN egress policy and provider give EF traffic priority service capped at 15 Mbps.

ip access-list extended RTP-ACL
 permit udp 10.20.30.0 0.0.0.255 any range 16384 32767
class-map match-all RTP
 match access-group name RTP-ACL

Which policy design will classify the RTP flow and mark its packets for downstream treatment?

Options:

• A. Classify with RTP-ACL, then set IP DSCP to EF.

• B. Classify with RTP-ACL, then set 802.1Q CoS to 5.

• C. Classify with RTP-ACL, then allocate a 15-Mbps priority queue.

• D. Classify with RTP-ACL, then police the class at 15 Mbps.

Best answer: A

Explanation: Classification and marking are separate QoS functions. The ACL and class map classify packets by matching the RTP flow, but they do not change packet headers. Applying set dscp ef writes the EF value into the IP DSCP field, allowing both the router’s WAN egress policy and the provider to recognize the traffic.

The WAN is congested, so priority treatment is useful, but QoS does not create additional bandwidth. The existing 15-Mbps priority cap already exceeds the stated 12-Mbps RTP peak. CoS is a Layer 2 marking, while queuing and policing control local treatment rather than providing the required downstream DSCP signal.

• CoS marking changes an 802.1Q Layer 2 field, not the IP DSCP field used across the routed WAN.
• Priority queuing schedules packets during congestion but does not mark them for the provider’s next hop.
• Policing enforces a traffic rate and exceed action but does not supply the required DSCP marking.

Question 42

Topic: IP Connectivity

A Cisco IOS XE router has these current facts:

• ipv6 unicast-routing is enabled.
• R2 is connected through GigabitEthernet0/0 with next-hop address FE80::1.
• Another neighbor on GigabitEthernet0/1 also uses FE80::1.
• R1 uses 2001:DB8:10:1::2/64 on GigabitEthernet0/0.

Which command configures an IPv6 default route toward R2?

Options:

• A. ipv6 route ::/0 GigabitEthernet0/0 2001:DB8:10:1::2

• B. ipv6 route ::/0 GigabitEthernet0/1 FE80::1

• C. ipv6 route ::/0 FE80::1

• D. ipv6 route ::/0 GigabitEthernet0/0 FE80::1

Best answer: D

Explanation: An IPv6 default route uses the destination prefix ::/0. A link-local next-hop address has meaning only within its local link, so a static route using that address must also identify the outbound interface. This is especially important here because FE80::1 exists on both connected links. R2 is reached through GigabitEthernet0/0, which provides the required interface scope. The global address 2001:DB8:10:1::2 belongs to R1 and cannot identify R2 as the next hop.

The essential combination is the default prefix, R2’s interface, and R2’s link-local address.

• Omitting the interface leaves the link-local next hop without the required link scope.
• Selecting GigabitEthernet0/1 scopes FE80::1 to the other neighbor rather than R2.
• Using 2001:DB8:10:1::2 identifies R1’s own interface address, not the upstream neighbor.

Question 43

Topic: IP Connectivity

R1 runs Cisco IOS XE with ipv6 unicast-routing enabled. Both listed interfaces are up/up, and these static routes are installed:

S   2001:DB8:1200::/48 [1/0]
     via FE80::1, GigabitEthernet0/1
S   ::/0 [1/0]
     via FE80::1, GigabitEthernet0/2

R1 receives a packet destined for 2001:DB8:1200:34::25. Which forwarding decision will R1 make?

Options:

• A. Load-balance through both interfaces because the static routes have equal distance.

• B. Drop the packet because FE80::1 is ambiguous across the two interfaces.

• C. Forward through GigabitEthernet0/2 to FE80::1 using the default route.

• D. Forward through GigabitEthernet0/1 to FE80::1 using the /48 route.

Best answer: D

Explanation: IPv6 forwarding uses longest-prefix matching among installed routes. The destination 2001:DB8:1200:34::25 begins with the 48-bit prefix 2001:DB8:1200, so it matches both the /48 static route and the ::/0 default route. The /48 is more specific and therefore directs the packet through GigabitEthernet0/1.

A link-local next hop has significance only on its local link. Each route includes an outbound interface, so the two occurrences of FE80::1 refer to neighbors within different interface scopes. The default route is used only when no more-specific installed route matches the destination.

• The default route loses to the matching /48 route under longest-prefix selection.
• Equal administrative distances do not cause load balancing between routes for different prefixes.
• The outbound interfaces provide the scope needed to disambiguate identical link-local next-hop addresses.

Question 44

Topic: IP Connectivity

R1 and R2 should form an OSPFv2 adjacency over a shared Ethernet segment. Both interfaces use broadcast network type, are in area 0, and are not passive. Authentication is disabled, and all other OSPF parameters match. The segment standard requires 5-second hello and 20-second dead intervals.

R1# show ip ospf interface g0/0
GigabitEthernet0/0 is up, line protocol is up
Internet Address 10.20.0.1/24, Area 0
Network Type BROADCAST
Timer intervals configured, Hello 10, Dead 40
Neighbor Count is 0

R2# show ip ospf interface g0/0
GigabitEthernet0/0 is up, line protocol is up
Internet Address 10.20.0.2/24, Area 0
Network Type BROADCAST
Timer intervals configured, Hello 5, Dead 20
Neighbor Count is 0

Which configuration action should the engineer take?

Options:

• A. On R2 G0/0, set ip ospf hello-interval 10 and ip ospf dead-interval 40.

• B. On R1 G0/0, set ip ospf hello-interval 5 and ip ospf dead-interval 40.

• C. On R1 G0/0, set ip ospf hello-interval 5 and ip ospf dead-interval 20.

• D. On R1 G0/0, set ip ospf hello-interval 10 and ip ospf dead-interval 20.

Best answer: C

Explanation: OSPF neighbors on a shared link must use matching hello and dead intervals. These values are carried in OSPF hello packets, and a router rejects hellos whose timer values differ from its local interface settings. R1 currently uses 10/40, while R2 uses the required 5/20 values. Changing both timers on R1 to 5/20 removes the mismatch and complies with the segment standard.

Matching only one timer is insufficient. Changing R2 to 10/40 would align the routers but would violate the stated operational requirement.

• Setting R1 to 5/40 fixes the hello interval but leaves the dead intervals mismatched.
• Setting R1 to 10/20 fixes the dead interval but leaves the hello intervals mismatched.
• Setting R2 to 10/40 would align the timers but would violate the required 5/20 segment standard.

Question 45

Topic: IP Connectivity

R1 receives a packet destined for 192.0.2.50. The following simplified Cisco IOS routing table is complete for this task and contains only installed routes.

S  192.0.2.0/24 via 10.10.10.2
O  10.10.10.0/24 via 172.16.12.2
C  10.10.0.0/16 is directly connected, GigabitEthernet0/2
C  172.16.12.0/30 is directly connected, GigabitEthernet0/1
S* 0.0.0.0/0 via 198.51.100.2
C  198.51.100.0/30 is directly connected, GigabitEthernet0/0

Which outgoing interface does R1 use?

Options:

• A. No interface; R1 drops the packet

• B. GigabitEthernet0/0

• C. GigabitEthernet0/2

• D. GigabitEthernet0/1

Best answer: D

Explanation: R1 first uses longest-prefix matching for the destination, selecting the static route to 192.0.2.0/24. Because that route specifies only 10.10.10.2 as its next hop, R1 recursively resolves that address. Both 10.10.10.0/24 and 10.10.0.0/16 match, but the OSPF /24 is more specific. Its next hop, 172.16.12.2, is reachable through the connected 172.16.12.0/30 route on GigabitEthernet0/1.

The recursive chain therefore terminates at a connected route, making the installed static route usable.

• GigabitEthernet0/2 comes from the less-specific /16 route, which loses to the OSPF /24 during next-hop resolution.
• GigabitEthernet0/0 supports the default route, but more-specific routes resolve both the destination and recursive next hops.
• Dropping the packet would apply if recursion failed, but the provided chain terminates at a connected route.

Question 46

Topic: Security Fundamentals

A branch office has these controls and conditions:

• Badge readers prevent unescorted access beyond reception.
• Escorted visitors can reach meeting rooms with active Ethernet ports in employee VLAN 20.
• Employees and approved contractors require different network access policies.
• Awareness training tells receptionists to verify unexpected visitors, but the switches do not authenticate connected devices.

A phishing message convinces a receptionist to escort an attacker posing as a contractor to an active port.

Which action best enforces identity-based network access even when the receptionist is deceived?

Options:

• A. Expand phishing training with supervisor verification before admitting escorted contractors.

• B. Configure 802.1X with RADIUS authorization for role-based VLAN or ACL assignment.

• C. Configure DHCP snooping with Dynamic ARP Inspection on the meeting-room VLAN.

• D. Configure sticky port security with one learned MAC address and shutdown violations.

Best answer: B

Explanation: IEEE 802.1X provides technical enforcement at the switch port. The switch acts as the authenticator and uses RADIUS to validate the connecting user or device before allowing normal network access. RADIUS authorization can then assign a role-specific VLAN or ACL for an employee or approved contractor.

Physical access controls reduce who can reach the port, while awareness training reduces the likelihood that staff will accept a fraudulent request. Neither causes the switch to reject an unauthorized endpoint after an escort procedure fails. Identity-based network access control therefore addresses the stated failure scenario directly.

• Sticky port security limits learned MAC addresses, but the attacker’s device could become the first learned device on an unused port.
• DHCP snooping and ARP inspection protect address-assignment and ARP integrity after connection; they do not authenticate endpoint identity.
• Additional training may reduce successful deception, but it remains procedural and cannot make the switch deny an unauthorized connection.

Question 47

Topic: Network Access

An IOS XE access switch runs Rapid PVST+. A workstation directly connects to GigabitEthernet1/0/18 and sends no BPDUs. Its DHCP request times out immediately after link-up but succeeds later.

Configuration and simplified output:

spanning-tree mode rapid-pvst
interface GigabitEthernet1/0/18
 switchport mode access
 switchport access vlan 30
 spanning-tree bpduguard enable

VLAN0030 role: designated
State at t=16 seconds: learning (default forward-delay timers)
Operational edge: no
BPDUs received: 0

Which interface configuration action should the engineer take to restore expected edge behavior?

Options:

• A. Configure spanning-tree vlan 30 port-priority 0 on GigabitEthernet1/0/18.

• B. Remove spanning-tree bpduguard enable from GigabitEthernet1/0/18.

• C. Configure spanning-tree portfast on GigabitEthernet1/0/18.

• D. Configure spanning-tree link-type point-to-point on GigabitEthernet1/0/18.

Best answer: C

Explanation: Rapid PVST+ uses the discarding, learning, and forwarding port states. A non-edge designated port can remain nonforwarding during startup before progressing through learning to forwarding, delaying the workstation’s initial DHCP traffic. PortFast identifies a known endpoint-facing port as an edge port and permits it to enter forwarding immediately after link-up.

PortFast does not disable spanning tree or prevent BPDU processing. The existing BPDU Guard configuration can therefore remain in place to protect the access port if a BPDU unexpectedly arrives. Point-to-point behavior is intended to accelerate Rapid STP negotiation between bridges, while port priority influences STP role selection rather than startup state progression.

• Point-to-point link type depends on Rapid STP negotiation with another bridge; the workstation does not participate in that exchange.
• Lower port priority can affect role-selection tie-breakers but does not classify the interface as an edge port.
• Removing BPDU Guard does not accelerate startup because no BPDU was received and BPDU Guard does not control normal state transitions.

Question 48

Topic: IP Connectivity

A client at 10.10.10.50/24 uses R1 as its default gateway. A server at 172.16.20.99/24 uses R4. R2 and R3 can forward traffic between R1 and R4. All interfaces and routes are operational, and ACLs permit ICMP in both directions.

Relevant installed routes:

R1# show ip route
S 172.16.20.99/32 [1/0] via 192.0.2.2, R2
O 172.16.20.0/24  [110/20] via 198.51.100.2, R3

R4# show ip route
S 10.10.10.0/24 [1/0] via 203.0.113.5, R3

Which paths are used when the client successfully pings the server?

Options:

• A. Request: R1 to R2 to R4; reply: R4 to R2 to R1

• B. Request: R1 to R3 to R4; reply: R4 to R2 to R1

• C. Request: R1 to R2 to R4; reply: R4 to R3 to R1

• D. Request: R1 to R3 to R4; reply: R4 to R3 to R1

Best answer: C

Explanation: Routers perform an independent longest-prefix-match lookup for each packet direction. On R1, the request destination 172.16.20.99 matches both the /32 host route and the surrounding /24 route. The more specific /32 route wins, regardless of the routes’ administrative distances, so R1 forwards the request through R2.

The server sends its reply toward R4 with destination 10.10.10.50. R4’s installed route for 10.10.10.0/24 points through R3, producing an asymmetric return path. Such asymmetry does not prevent basic IP forwarding when the relevant ACLs permit the traffic. ACL permission determines whether traffic is allowed, not which installed route is selected.

• A symmetric return through R2 ignores R4’s installed route to 10.10.10.0/24 through R3.
• Sending the request through R3 incorrectly favors the /24 route over R1’s more-specific /32 route.
• Using R3 outbound and R2 inbound conflicts with the longest-prefix match on R1 and the installed return route on R4.

Question 49

Topic: Security Fundamentals

A Catalyst switch has DHCP snooping enabled as shown:

ip dhcp snooping
ip dhcp snooping vlan 30
!
interface GigabitEthernet1/0/1
 ip dhcp snooping trust

All ports are forwarding. After the client broadcasts a DHCPDISCOVER, a legitimate DHCPOFFER enters Gi1/0/1 and a rogue DHCPOFFER enters Gi1/0/20. Which forwarding result should the switch produce?

Options:

• A. Drop the Gi1/0/20 offer and forward the Gi1/0/1 offer.

• B. Forward whichever offer arrives first and drop the later offer.

• C. Forward both offers because each arrived within snooping-enabled VLAN 30.

• D. Drop both offers until the client has a DHCP snooping binding.

Best answer: A

Explanation: DHCP snooping classifies switch ports according to whether received DHCP server messages are trusted. Client-originated messages such as DHCPDISCOVER may enter untrusted access ports, but server-originated messages such as DHCPOFFER are dropped when received on an untrusted port. Therefore, the rogue offer entering Gi1/0/20 is discarded. The legitimate offer enters through trusted Gi1/0/1 and can be forwarded to the client in VLAN 30.

A DHCP snooping binding is learned from an accepted DHCP exchange; it is not required before the initial offer. Trust should be assigned only to ports on the legitimate server-message path, not broadly to user-facing ports.

• Same VLAN does not make both offers valid; ingress trust determines whether server messages are accepted.
• First response is irrelevant because DHCP snooping does not select offers according to arrival order.
• Existing binding is unnecessary because the binding is created as the permitted DHCP exchange completes.

Question 50

Topic: IP Connectivity

R1 runs Cisco IOS XE. A link beyond primary router R2 has failed, but R1’s links to R2 and backup router R3 remain up/up. Both next hops reply to ping, and no object tracking is configured.

Configuration and current lookup:

ipv6 route 2001:db8:100::25/128 2001:db8:12::2 5
ipv6 route 2001:db8:100::25/128 2001:db8:13::3 200

R1# show ipv6 route 2001:db8:100::25
S 2001:db8:100::25/128 [5/0]
  via 2001:db8:12::2

A ping from R1 to 2001:db8:100::25 fails. Which conclusion explains why the backup route remains inactive?

Options:

• A. R1 replaces the AD 5 route after destination pings fail because static routing uses ICMP reachability to select the backup.

• B. R1 installs both routes because equal /128 prefix lengths permit ECMP even when their administrative distances differ.

• C. R1 retains the AD 5 route because its next hop resolves; AD 200 remains standby until that route is withdrawn.

• D. R1 rejects the AD 200 route because an IPv6 static backup requires a distance lower than the installed route.

Best answer: C

Explanation: A floating static route has a higher administrative distance than the preferred route for the same prefix. IOS XE installs the usable route with the lowest distance, but an ordinary static route does not monitor reachability to the remote destination. Here, the primary next hop remains reachable through an up interface, so the AD 5 host route remains installed despite the downstream failure and unsuccessful destination ping. The AD 200 route can become active only when the primary route is removed, its recursive next-hop resolution fails, or tracking configured for the primary route withdraws it. An administrative distance of 200 is valid; it simply loses to the installed AD 5 route.

• Ping-driven failover is incorrect because failed destination pings do not withdraw an untracked static route.
• ECMP installation is incorrect because routes with different administrative distances are not equal-cost installed paths.
• Lower backup distance reverses floating-route behavior and would make the supposed backup preferred over the AD 5 route.

Questions 51-75

Question 51

Topic: Automation and Programmability

An enterprise fabric operates as follows:

• An automation application retrieves topology and submits policy intent.
• A centralized controller translates the intent and programs leaf switches.
• The application host reaches the controller through a routed management network using HTTPS.
• The controller uses NETCONF with the switches.
• VXLAN tunnels cross the physical leaf-spine Ethernet fabric.

Which connection is the northbound interface relative to the controller?

Options:

• A. The HTTPS REST API linking the application to the controller

• B. The NETCONF sessions linking the controller to the leaf switches

• C. The VXLAN tunnels linking leaf switches across the fabric

• D. The Ethernet links connecting leaf switches to the spine

Best answer: A

Explanation: Interface direction in software-defined networking is defined relative to the controller. A northbound interface exposes network information and intent-based services to applications, so the application’s HTTPS REST API is northbound. The physical management network merely transports that logical API communication.

NETCONF sessions from the controller toward managed switches are southbound interfaces. VXLAN tunnels form the logical overlay used to carry tenant traffic, while leaf-spine Ethernet links form the physical underlay. Neither provides application-to-controller communication.

• NETCONF is southbound because it carries controller instructions toward managed network devices.
• VXLAN provides overlay data-plane connectivity between tunnel endpoints, not application access to controller services.
• Leaf-spine Ethernet forms the physical underlay that transports traffic through the fabric.

Question 52

Topic: Network Fundamentals

R1 and R2 run IOS XE with IPv6 unicast routing enabled. No dynamic routing protocol is configured.

R1 must route every address in 2001:DB8:20::/64 through R2 using R2’s link-local address. Which command should be configured on R1?

Options:

• A. ipv6 route 2001:DB8:20::/128 Gi0/0 FE80::2

• B. ipv6 route 2001:DB8:20::/64 Gi0/0 FE80::2

• C. ipv6 route 2001:DB8:20::/64 Gi0/0 FE80::1

• D. ipv6 route 2001:DB8:20::/64 FE80:0:0:0:0:0:0:2

Best answer: B

Explanation: An IPv6 link-local address identifies a neighbor only on the local link and can be reused on other links. IOS XE therefore requires an outgoing interface when a static route uses a link-local next hop. Here, Gi0/0 identifies the relevant link, and FE80::2 identifies R2 on that link. The destination length /64 installs a route for the entire remote LAN; a /128 would describe only one IPv6 address. R1’s transit /64 is a connected prefix, while its own interface address also has a local host route. FE80::2 and FE80:0:0:0:0:0:0:2 are equal addresses, but expanded notation does not supply the required interface scope.

• The /128 command covers only 2001:DB8:20::, not every address in the remote /64.
• Using FE80::1 selects R1’s own link-local address rather than the adjacent router.
• The expanded address equals FE80::2, but omitting Gi0/0 leaves the link-local next hop without interface scope.

Question 53

Topic: Network Access

A Cisco AireOS WLC hosts a voice WLAN. All approved handsets support WMM, and the existing WPA2-Enterprise authentication works.

The WLAN must use the voice QoS profile, reject non-WMM clients during association, and block IP connectivity unless a client obtains its address through DHCP. Which configuration meets these requirements?

Options:

• A. Set Platinum, set WMM to Required, and leave DHCP assignment required disabled.

• B. Set Platinum, set WMM to Allowed, and enable DHCP assignment required.

• C. Set Gold, set WMM to Required, and enable DHCP assignment required.

• D. Set Platinum, set WMM to Required, and enable DHCP assignment required.

Best answer: D

Explanation: On an AireOS controller, the Platinum QoS profile is intended for voice traffic, while Gold is associated with video and Silver with best-effort traffic. Setting WMM Policy to Required makes WMM support a condition for client association; Allowed permits both WMM and non-WMM clients. Enabling DHCP Addr. Assignment Required allows association and authentication but prevents normal IP connectivity until the client obtains an address through DHCP.

These settings affect different stages: WMM can gate association, WPA2-Enterprise performs authentication, and the DHCP requirement controls subsequent IP connectivity.

• WMM Allowed still permits non-WMM clients to associate, contrary to the handset-only requirement.
• Gold QoS provides the AireOS video profile rather than the required voice profile.
• DHCP check disabled permits static addressing instead of requiring successful DHCP address assignment.

Question 54

Topic: IP Connectivity

All interfaces are up/up, the listed routes are installed, and no ACL or firewall blocks traffic. Proxy ARP is disabled.

Topology and host settings:

PC-A: 192.168.10.10/24, gateway 10.0.12.2
LAN A: 192.168.10.0/24
R1 G0/0: 192.168.10.1/24
R1 G0/1: 10.0.12.1/30
Transit link: 10.0.12.0/30
R2 G0/0: 10.0.12.2/30
R2 G0/1: 192.168.20.1/24
LAN B: 192.168.20.0/24
PC-B: 192.168.20.20/24, gateway 192.168.20.1

Relevant installed routes:

R1: 192.168.20.0/24 via 10.0.12.2
R2: 192.168.10.0/24 via 10.0.12.1

Which default gateway should replace PC-A’s current value to enable two-way connectivity with PC-B?

Options:

• A. 10.0.12.2

• B. 192.168.20.1

• C. 192.168.10.1

• D. 10.0.12.1

Best answer: C

Explanation: A host’s default gateway must be a router interface on the host’s local subnet. PC-A is in 192.168.10.0/24, so it sends off-subnet traffic to R1 at 192.168.10.1 after resolving R1’s MAC address with ARP.

R1 then makes a separate routing decision. Its route to 192.168.20.0/24 uses 10.0.12.2 as the next hop. R2 has a return route through 10.0.12.1, and PC-B already uses its local R2 interface as its gateway. Therefore, the forward and return router paths are complete once PC-A uses its local R1 interface as the gateway. A router’s transit next hop is not the source host’s default gateway.

• R1’s transit address is outside PC-A’s local /24 and cannot serve as its on-link gateway.
• R2’s transit address is R1’s routing next hop, not a gateway directly reachable by PC-A.
• R2’s LAN address is PC-B’s gateway and belongs to the remote 192.168.20.0/24 subnet.

Question 55

Topic: Automation and Programmability

An engineer can establish TCP and TLS sessions to a controller API. The API documentation specifies:

• Method and endpoint: PATCH /api/v1/interfaces/GigabitEthernet1
• Authentication: Authorization: Bearer <token>
• Request content type: application/json

The engineer sends this request with a fictitious token:

curl --request PATCH https://controller.example.com/api/v1/interfaces/GigabitEthernet1 \
  --header 'Authorization: Bearer demo-token-7f3a' \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data 'description=Branch uplink'

HTTP/1.1 415 Unsupported Media Type
Audit: identity netauto authenticated; handler not invoked

Which action should the engineer take first?

Options:

• A. Encode the body as JSON and set Content-Type: application/json.

• B. Keep form encoding and replace the bearer token before retrying.

• C. Keep the current headers and change the method from PATCH to PUT.

• D. Keep form encoding and set Accept: application/json on the request.

Best answer: A

Explanation: HTTP status 415 indicates that the server does not support the request body’s media type. The client used form encoding even though the API contract requires JSON. The audit record confirms that the bearer token authenticated successfully, and receiving an HTTP response confirms TCP and TLS reachability. The engineer should therefore send a valid JSON object and identify it with Content-Type: application/json.

An invalid or expired token would normally produce an authentication-related response such as 401. The Accept header describes the desired response representation, not the request body’s format. Changing the documented PATCH method would address neither the media-type failure nor the encoding mismatch.

• Setting Accept to JSON changes the preferred response format but leaves the unsupported form-encoded request body unchanged.
• Replacing the token does not address the failure because the audit record confirms successful authentication.
• Changing PATCH to PUT conflicts with the documented method and leaves the unsupported content type unchanged.

Question 56

Topic: Security Fundamentals

A Cisco IOS XE access switch connects a DHCP PC and a static-address printer through Gi1/0/12. Both approved MAC addresses are already learned as secure. The printer uses 10.20.20.50 and MAC 00aa.bbcc.ddee.

Current configuration and DAI evidence:

ip dhcp snooping vlan 20
ip arp inspection vlan 20
!
interface GigabitEthernet1/0/12
 switchport access vlan 20
 switchport mode access
 switchport port-security
 switchport port-security maximum 2
 switchport port-security violation protect

DHCP snooping binding:
0011.2233.4455  10.20.20.21  VLAN 20  Gi1/0/12

The untrusted port must validate both hosts with DAI. Traffic from a third source MAC must be dropped, logged as a violation, and must not disable the interface. Which configuration change meets these requirements?

Options:

• A. Configure a printer ARP ACL; set port-security mode to shutdown.

• B. Configure the printer as a static secure MAC; set mode to restrict.

• C. Configure a printer ARP ACL; set port-security mode to restrict.

• D. Configure a printer ARP ACL; retain port-security mode protect.

Best answer: C

Explanation: DAI and port security validate different information. DAI checks ARP sender IP-to-MAC mappings. The DHCP PC has a snooping binding, but the static-address printer does not, so an ARP ACL must explicitly provide its valid mapping while the port remains untrusted.

Port security limits learned source MAC addresses. With a maximum of two secure addresses, a third source causes a violation. Protect drops the traffic without generating violation notifications. Restrict drops the traffic, increments the violation counter, generates logging, and leaves the port forwarding. Shutdown places the interface into an error-disabled state. A static secure MAC entry alone does not provide the IP-to-MAC evidence required by DAI.

• Protect mode drops frames from the third MAC but does not provide the required violation logging.
• Shutdown mode logs the violation but error-disables the interface, interrupting both approved hosts.
• Static secure MAC satisfies port-security learning but does not create a DAI-valid IP-to-MAC mapping for the printer.

Question 57

Topic: IP Connectivity

A host at 192.168.10.10 uses R1 as its default gateway. The ISP next hop can forward traffic toward 8.8.8.0/24. The simplified outputs show all installed IPv4 routes; no NAT or policy-based routing is configured.

R1
C  192.168.10.0/24 is directly connected, G0/1
C  10.0.12.0/30 is directly connected, G0/0
S  198.51.100.0/24 is directly connected, Null0
S* 0.0.0.0/0 [1/0] via 10.0.12.2

R2
C  10.0.12.0/30 is directly connected, G0/0
C  192.0.2.0/30 is directly connected, G0/1
S  8.8.8.0/24 [1/0] via 192.0.2.1
S* 0.0.0.0/0 [1/0] via 192.0.2.1

Which two statements are supported? Select TWO.

Options:

• A. R2 confirms end-to-end reachability to 8.8.8.8 because it has both a /24 route and a default route.

• B. R1 discards traffic to 198.51.100.25 through Null0 because the /24 route is the longest match.

• C. R1 forwards traffic to 198.51.100.25 to R2 because the default route has the same administrative distance.

• D. R1 forwards traffic to 8.8.8.8 to R2 by default, but the shown routes provide no return path toward R1.

• E. R2 forwards replies for 192.168.10.10 to R1 because its connected route includes the R1-R2 link.

Correct answers: B and D

Explanation: Routers apply longest-prefix matching before considering administrative distance. On R1, 198.51.100.25 matches the installed /24, so the packet is discarded through Null0 rather than using the /0 default. Because R1 has no more-specific route for 8.8.8.8, it forwards that packet to R2 using its default route. R2 then uses its /24 route toward the ISP.

Forward routing does not establish bidirectional reachability. A reply destined for 192.168.10.10 does not match R2’s connected 10.0.12.0/30 route. With no route for 192.168.10.0/24, R2 sends the reply toward the ISP using its default route rather than toward R1. A default route therefore handles unmatched destinations but does not create the required return route.

• Administrative distance comparison fails because route specificity is evaluated before administrative distance.
• End-to-end conclusion is unsupported because forward-path routes do not prove that a usable return path exists.
• Connected-link inference fails because 10.0.12.0/30 does not include the downstream 192.168.10.0/24 network.

Question 58

Topic: Security Fundamentals

A centrally switched WLAN on a Cisco Catalyst 9800 has this configuration:

The client supports WPA2-Personal with AES but not WPA3. Its saved profile names STAFF-NET. Testing shows:

• Association: successful
• WPA2 four-way handshake: completed
• IPv4 address: 169.254.44.8/16
• DHCP: three Discover messages, no Offer

Which action should the engineer take next?

Options:

• A. Re-enter the PSK and repeat the WPA2 key negotiation.

• B. Enable SSID broadcast and repeat the client discovery process.

• C. Adjust the AP radio settings and repeat association testing.

• D. Verify VLAN 30 DHCP relay and server response path.

Best answer: D

Explanation: WLAN connectivity occurs in stages. Successful association confirms that the client reached the WLAN through a compatible radio. Completing the WPA2 four-way handshake confirms that the client and WLAN used compatible WPA2-Personal, AES, and PSK-derived key material. The 169.254.0.0/16 address indicates that the client did not receive a DHCP lease. Because DHCP Discover messages leave the client but no Offer returns, troubleshooting should move to VLAN 30 forwarding, DHCP relay, and the DHCP server response path.

A hidden SSID affects discovery, not encryption, and the saved profile already allowed association. Radio or PSK changes would revisit stages that have already succeeded.

• Broadcast the SSID does not address the failure because the saved profile already associated with the hidden WLAN.
• Re-enter the PSK is unnecessary because successful four-way key negotiation demonstrates working WPA2 credentials.
• Adjust radio settings targets association, which has already completed successfully.

Question 59

Topic: IP Connectivity

R1 has the following route candidates immediately before an event. The OSPF adjacency remains FULL, and all OSPF routes remain valid.

An IP SLA tracking event withdraws the tracked static route. After convergence, how does R1 forward a packet to 10.20.30.25?

Options:

• A. Forward via 198.51.100.2 using the OSPF /24, which becomes installed after withdrawal.

• B. Forward via 203.0.113.2 using the OSPF /16, whose OSPF metric is lower.

• C. Forward via 192.0.2.2 using the static /24, whose AD remains lower than OSPF.

• D. Forward via 192.0.2.6 using the static default, whose AD is lower than OSPF.

Best answer: A

Explanation: Administrative distance selects among valid route sources for the same prefix and mask. Initially, the static /24 is installed because AD 5 is lower than OSPF AD 110. When tracking withdraws that static route, it is no longer a candidate, so the valid OSPF /24 can enter the routing table. Packet forwarding then uses longest-prefix matching. For 10.20.30.25, the installed /24 is more specific than either the OSPF /16 or the static default route. Metrics do not make the /16 preferable to the /24, and administrative distance is not used to compare routes with different prefix lengths.

• The static /24 cannot remain preferred because the tracking event removed it from the routing table.
• The OSPF /16’s lower metric does not override the more-specific installed /24 during forwarding.
• The default route’s lower AD does not defeat a /24 because different prefix lengths are resolved by longest-prefix matching.

Question 60

Topic: IP Connectivity

R1 is a Cisco Catalyst 8000V running IOS XE. Its GigabitEthernet1 interface is up with address 192.0.2.1/24; R2 is connected to the same Ethernet at 192.0.2.2. R2 has valid forward and return routes but has proxy ARP disabled.

Current installed route:

ip route 10.40.0.0 255.255.255.0 GigabitEthernet1

Proposed replacement:

ip route 10.40.0.0 255.255.255.0 GigabitEthernet1 192.0.2.2

R1 sends packets to 10.40.0.10 and 10.40.0.20. Which statement correctly compares the routes?

Options:

• A. The current route ARPs separately for each remote host; the replacement resolves 192.0.2.2 and forwards both flows using R2’s MAC address.

• B. The current route ARPs once for 10.40.0.0; the replacement ARPs separately for 10.40.0.10 and 10.40.0.20 before forwarding.

• C. The current route is withdrawn when ARP fails; the replacement remains active because specifying a next hop suppresses interface-state tracking.

• D. The current route resolves 192.0.2.2 for both flows; the replacement changes the route display but preserves the same Layer 2 resolution.

Best answer: A

Explanation: An exit-interface-only static route on multiaccess Ethernet makes each destination appear directly connected. R1 therefore attempts ARP resolution for 10.40.0.10 and 10.40.0.20 individually. Because R2 has proxy ARP disabled, it does not answer those requests, so R1 cannot create the required Layer 2 adjacencies.

The fully specified route supplies both the Ethernet interface and next-hop address. R1 resolves only 192.0.2.2, then sends packets for both remote hosts to R2’s MAC address. Failed ARP resolution does not remove the current static route from the routing table while its exit interface remains operational.

• Implicit next hop fails because an exit-interface-only route does not identify R2’s IPv4 address.
• Network-address ARP is incorrect because R1 resolves individual on-link destinations, not the route’s network prefix.
• Route withdrawal confuses adjacency failure with route installation; unanswered ARP requests do not make the up interface go down.

Question 61

Topic: Network Access

A branch uses a centralized wireless controller architecture with a Cisco Catalyst 9800-CL hosted in a public cloud.

Which forwarding behavior occurs when the client sends a packet to its default gateway?

Options:

• A. The AP translates the client behind its management address, and the branch switch routes the packet to VLAN 30.

• B. The AP tunnels the frame to the 9800-CL, and the controller forwards it toward the branch SVI.

• C. The AP sends the frame untagged on VLAN 99, and the branch switch forwards it to that SVI.

• D. The AP tags the frame for VLAN 30, and the branch switch forwards it to the local SVI.

Best answer: D

Explanation: A FlexConnect AP using local switching converts the wireless frame to Ethernet and bridges it directly onto the configured local VLAN. Because the WLAN maps clients to VLAN 30 and the trunk’s native VLAN is 99, the client frame is tagged for VLAN 30. The branch switch then forwards it to the MAC address of the local VLAN 30 SVI.

Hosting the 9800-CL controller in a public cloud does not automatically place it in the client data path. Central switching would use a CAPWAP data tunnel to the controller, while local switching keeps client forwarding at the branch. FlexConnect remains client-serving, unlike monitor or sniffer modes.

• Central tunneling would apply if the WLAN used central switching rather than FlexConnect local switching.
• Native VLAN forwarding fails because client traffic is mapped to tagged VLAN 30, not native VLAN 99.
• AP address translation is not performed merely because the AP management interface uses VLAN 99.

Question 62

Topic: IP Connectivity

A Cisco IOS XE router has this routing state:

R1# show ip route 0.0.0.0
O*E2 0.0.0.0/0 [110/1] via 10.0.12.2, GigabitEthernet0/0

R1# show running-config | include ^ip route
ip route 0.0.0.0 0.0.0.0 10.0.13.2 200

ISP-A stops forwarding traffic beyond 10.0.12.2. However, the interface remains up, the OSPF adjacency stays FULL, and the default advertisement continues. The backup next hop remains reachable, and no tracking is configured. ISP-A later restores service.

What happens to R1’s default route during the outage and restoration?

Options:

• A. Both default routes install, and traffic is shared until upstream forwarding recovers.

• B. The floating static default installs, and OSPF returns after upstream forwarding recovers.

• C. The OSPF default is removed, leaving no default until the advertisement refreshes.

• D. The OSPF default remains installed, and restoration causes no route-table transition.

Best answer: D

Explanation: A floating static route reacts to routing-table availability, not end-to-end service health. R1 continues receiving the OSPF default route through a FULL adjacency, so that route remains installed with administrative distance 110. The configured static route has administrative distance 200 and remains a backup candidate rather than entering the routing table.

The upstream forwarding failure does not withdraw or invalidate the OSPF route because the local interface, next hop, adjacency, and advertisement remain available. When ISP-A restores service, the control-plane state is unchanged, so no routing-table transition occurs. Detecting this type of failure would require explicitly configured tracking or another mechanism tied to route removal.

• Automatic failover assumes an end-to-end health probe, but no tracking mechanism is configured.
• Equal-cost sharing does not occur because routes with different administrative distances are not installed as equal paths.
• Removing the default confuses an upstream data-plane failure with loss of the OSPF adjacency or advertisement.

Question 63

Topic: IP Connectivity

Four routers share an OSPF area 0 Ethernet segment using the broadcast network type. All addressing, timers, and authentication settings match.

At t=0, only R1 and R2 are enabled and exchange Hellos. Their wait timers expire at t=40, completing the fresh election. R3 and R4 join at t=60. No interface resets or failures occur afterward.

Which two statements are supported after convergence? Select TWO.

Options:

• A. R4 remains 2-WAY with R1 and R2 because priority 0 prevents full adjacency.

• B. R1 is DR and R3 is BDR after all four routers finish forming neighbors.

• C. R3 and R4 can remain 2-WAY with each other while each is FULL with R1 and R2.

• D. R1 is DR and R2 is BDR after all four routers finish forming neighbors.

• E. R3 is DR and R1 is BDR after all four routers finish forming neighbors.

Correct answers: C and D

Explanation: OSPF DR and BDR elections on broadcast networks are nonpreemptive. When the initial election completes, R1 has the higher interface priority and becomes DR; R2 becomes BDR. R3’s later arrival with priority 200 does not trigger a replacement election. R4’s priority 0 makes it ineligible for DR or BDR but does not prevent neighbor formation.

The DR and BDR form full adjacencies with every participating router. DROTHER routers do not normally form full adjacencies with one another, so R3 and R4 can remain in the 2-WAY state while both are FULL with R1 and R2. A higher-priority late arrival matters only during a future election caused by role vacancy or process reset.

• Making R3 the DR incorrectly assumes that a higher-priority late arrival preempts the elected DR.
• Replacing R2 with R3 incorrectly treats the BDR role as preemptive.
• Keeping R4 at 2-WAY with R1 and R2 confuses election ineligibility with adjacency formation.

Question 64

Topic: Network Access

Two Catalyst switches use LACP EtherChannel 10. Both physical links are up, and every member is configured as a trunk. The intended native VLAN is 99.

SW1# show etherchannel summary
Group  Port-channel  Protocol  Ports
10     Po10(SU)      LACP      Gi1/0/1(P) Gi1/0/2(s)

Which action should the administrator take first to allow Gi1/0/2 to join the EtherChannel?

Options:

• A. Set SW1 Gi1/0/2 trunk native VLAN to 99.

• B. Set SW2 Gi1/0/2 LACP mode to active.

• C. Set SW2 Gi1/0/2 trunk native VLAN to 999.

• D. Set SW1 Gi1/0/2 LACP mode to passive.

Best answer: A

Explanation: An LACP active interface initiates negotiation, while a passive interface responds. Therefore, the active/passive arrangement can form the channel. The decisive issue is EtherChannel consistency: ports in the same local bundle must have compatible Layer 2 settings. On SW1, Gi1/0/2 uses native VLAN 999 while the bundled interface uses native VLAN 99. Correcting the suspended member to native VLAN 99 removes that local inconsistency and preserves the intended trunk configuration. Changing LACP modes does not repair the trunk mismatch, and changing the remote native VLAN would create another local inconsistency.

• Making SW2 active is unnecessary because SW1 already initiates LACP, and it does not correct the trunk mismatch.
• Making SW1 passive creates passive/passive negotiation on that link while leaving the Layer 2 mismatch unresolved.
• Changing SW2 to native VLAN 999 mismatches SW2’s local bundle and does not correct SW1’s inconsistent member.

Question 65

Topic: Security Fundamentals

A contractor has approved read-only access to an inventory application through an IPsec remote-access VPN.

Observed client and gateway data:

Route: 10.30.40.0/24 via VPN tunnel
IPsec encaps/decaps counters: increasing
TLS connection to 10.30.40.20:443: completed
HTTP response: 403 Forbidden
Application log: user authenticated; missing Inventory-Reader role

Which single action grants the required access while preserving IPsec protection and least privilege?

Options:

• A. Add the application subnet to the split-tunnel include list.

• B. Permit the contractor’s VPN pool to HTTPS at the gateway.

• C. Grant the contractor the Inventory-Reader application role.

• D. Convert the remote-access profile to a site-to-site VPN.

Best answer: C

Explanation: IPsec protects traffic between the contractor’s device and the VPN gateway, but it does not grant application permissions. The installed VPN route and increasing IPsec counters confirm that traffic uses the protected tunnel. The completed TLS connection also proves that the server is reachable on TCP port 443. The HTTP 403 response and application log identify the remaining failure: the authenticated user lacks the required application role.

Granting the approved read-only role resolves authorization at the layer where access is denied. Changes to routing, gateway filtering, or tunnel type do not supply application authorization.

• A new HTTPS permit is unnecessary because the completed TLS connection confirms that TCP port 443 is already reachable.
• A split-tunnel route is unnecessary because the client already routes the application subnet through the VPN.
• A site-to-site VPN connects networks rather than assigning an application role to an individual remote user.

Question 66

Topic: Network Fundamentals

A 100-Mb/s Ethernet link is up/up, but users report poor performance. SW1 must remain manually configured for 100-Mb/s full duplex. Counters were cleared before a 10-minute busy interval.

Simplified interface evidence:

SW1 Gi1/0/24
Configured: speed 100, duplex full
Operational: 100 Mb/s, full duplex
Delta: 846 CRC errors, 0 late collisions

R1 Gi0/0
Configured: speed auto, duplex auto
Operational: 100 Mb/s, half duplex
Delta: 0 CRC errors, 217 late collisions

Both interfaces: up/up, no carrier transitions

Which diagnosis and corrective action best address the fault?

Options:

• A. Identify congestion; shape R1 egress and retain current settings.

• B. Identify duplex mismatch; configure R1 for 100-Mb/s full duplex.

• C. Identify negotiation instability; configure R1 for 100-Mb/s half duplex.

• D. Identify cable corruption; replace the cable and retain current settings.

Best answer: B

Explanation: A forced/autonegotiated pairing can produce a duplex mismatch. SW1 is forced to 100-Mb/s full duplex, while R1 detects the speed but operates at half duplex because duplex cannot be determined through parallel detection. This mismatch commonly causes CRC or frame errors on the full-duplex side and late collisions on the half-duplex side. The stable up/up state and absence of carrier transitions make an intermittent physical link less likely. Configuring R1 for 100-Mb/s full duplex aligns both endpoints and satisfies the requirement to leave SW1 unchanged. Congestion can reduce performance, but it does not explain this combination of operational duplex states and asymmetric error counters.

• Cable corruption can cause CRC errors, but it does not explain R1 operating at half duplex with accumulating late collisions.
• Traffic congestion may cause queue drops, but shaping does not correct incompatible duplex modes.
• Half-duplex configuration would preserve the mismatch because SW1 must continue operating at full duplex.

Question 67

Topic: Network Access

A Cisco IOS XE switch runs Rapid PVST+. An access port is initially forwarding for VLAN 20.

spanning-tree mode rapid-pvst
!
interface GigabitEthernet1/0/10
 switchport mode access
 switchport access vlan 20
 spanning-tree portfast

Neither BPDU guard nor BPDU filtering is enabled globally or on the interface. A connected switch begins sending BPDUs that advertise the best path to the VLAN 20 root bridge. The link remains up.

Which operational result should the engineer expect after convergence?

Options:

• A. Treat the port as non-edge, process the BPDU, and converge to forwarding as the root port.

• B. Place the port in err-disabled, record a BPDU guard violation, and stop forwarding VLAN 20.

• C. Treat the port as non-edge, process the BPDU, and remain discarding as an alternate port.

• D. Keep the port as edge, ignore the BPDU, and remain forwarding as a designated port.

Best answer: A

Explanation: PortFast is an edge-transition feature, not a method of disabling Rapid PVST+. When a PortFast port receives a BPDU, it loses its operational edge status and participates in normal spanning-tree processing. Because this BPDU advertises the best path to the VLAN 20 root bridge, the interface becomes the root port and ultimately enters forwarding.

Rapid PVST+ uses three states: discarding neither forwards user frames nor learns source MAC addresses, learning learns source MAC addresses but does not forward user frames, and forwarding performs both functions. Rapid convergence can shorten intermediate-state transitions.

BPDU guard would instead err-disable the port, but it is not enabled here.

• Alternate role: The best root path becomes the root port, not a discarding alternate path.
• Ignored BPDU: PortFast does not suppress BPDU processing or preserve operational edge status after reception.
• BPDU guard: Err-disable requires BPDU guard; PortFast alone does not shut down a port receiving a BPDU.

Question 68

Topic: Automation and Programmability

A company manages 80 access switches by editing each device through SSH. It wants to:

• Define role-based access policy once
• Have policy translated and delivered automatically
• View deployment status centrally
• Keep user traffic forwarding during a controller outage

Which management workflow best meets these requirements?

Options:

• A. Define intent centrally; the controller evaluates every user flow before switches forward the associated traffic.

• B. Configure distribution switches; routing protocols advertise the access policy while all switches forward traffic locally.

• C. Generate configurations centrally; engineers paste each configuration while switches retain it and forward traffic locally.

• D. Define intent centrally; the controller deploys policy while switches retain it and forward traffic locally.

Best answer: D

Explanation: Controller-based management lets an administrator express centralized intent instead of editing each device separately. The controller translates that intent into device-specific policy, delivers it through southbound interfaces, and reports deployment status. The managed switches install the resulting configuration and continue performing local data-plane forwarding. Ordinary user packets do not need to traverse the controller, and loss of controller connectivity does not inherently stop forwarding under the retained policy.

Central configuration generation can reduce effort, but manually applying each configuration remains a device-by-device workflow rather than controller-based policy delivery.

• Central generation still requires engineers to apply separate device configurations and does not provide the requested automatic delivery workflow.
• Per-flow controller approval incorrectly places the controller in the user traffic forwarding path.
• Routing advertisements exchange reachability information; they do not distribute role-based access configurations to switches.

Question 69

Topic: Network Access

Two Cisco IOS XE switches connect through Gi1/0/24. Endpoints use access VLANs 10 and 20 on both switches. VLAN 999 has no access ports and is reserved as the native VLAN so endpoint traffic remains tagged.

Simplified interface output:

SW1 Gi1/0/24
Operational Mode: trunk
Native VLAN: 10
Allowed VLANs: 10,20,999
Native VLAN tagging: disabled

SW2 Gi1/0/24
Operational Mode: trunk
Native VLAN: 20
Allowed VLANs: 10,20,999
Native VLAN tagging: disabled

Which configuration action repairs the mismatch without changing endpoint VLAN assignments?

Options:

• A. Enable native VLAN tagging globally while retaining both native VLAN values.

• B. Set the trunk native VLAN to 10 on both switches.

• C. Set the trunk native VLAN to 999 on both switches.

• D. Set the trunk native VLAN to 20 on both switches.

Best answer: C

Explanation: With native VLAN tagging disabled, each 802.1Q trunk sends its native VLAN traffic untagged and assigns received untagged frames to its locally configured native VLAN. Different native VLAN values can therefore place the same untagged frame into different VLANs at each end.

Configuring VLAN 999 as native on both interfaces makes the classification consistent. Because VLAN 999 has no access ports, endpoint VLANs 10 and 20 continue crossing the trunk with tags, and their access-port assignments remain unchanged. Selecting VLAN 10 or 20 as native would align the trunk but violate the requirement to keep endpoint traffic tagged.

• Making VLAN 10 native aligns the interfaces but sends VLAN 10 traffic untagged on the trunk.
• Making VLAN 20 native aligns the interfaces but sends VLAN 20 traffic untagged on the trunk.
• Enabling native tagging may preserve VLAN tags, but retaining different native VLAN values does not correct the configured mismatch or use reserved VLAN 999.

Question 70

Topic: Network Fundamentals

A campus design must keep A1 clients connected after failure of any one physical uplink or either distribution switch. D1 and D2 are independent switches and cannot terminate one cross-switch EtherChannel. Both have working upstream connectivity, and all shown links are currently operational.

A1 reports:

Group  Port-channel  Protocol  Ports
10     Po10(SU)      LACP      Gi1/0/47(P) Gi1/0/48(P)

No LACP minimum-links requirement is configured. Which two statements are supported? Select TWO.

Options:

• A. The D1-D2 interconnect becomes A1’s alternate uplink automatically when D1 fails.

• B. The design tolerates one Po10 member-link failure with lower aggregate bandwidth.

• C. STP blocks one Po10 member and forwards the other to prevent a loop.

• D. The design fails the switch-failure requirement because both A1 uplinks terminate on D1.

• E. Each client flow is striped packet-by-packet across both active Po10 members.

Correct answers: B and D

Explanation: EtherChannel provides link aggregation and member-link redundancy, but this design does not provide distribution-device redundancy. LACP presents the two physical members as one logical STP port. If one member fails, the remaining member can continue carrying traffic, although total available bandwidth decreases.

Both members terminate on D1, so D1 is a shared failure point. The routed D1-D2 interconnect cannot help A1 after D1 fails because A1 has no physical connection that reaches D2 independently. Meeting the complete requirement would require an additional design that gives A1 connectivity through separate distribution devices. EtherChannel load balancing also normally assigns a flow to one member using a hash rather than striping its packets across all members.

• Independent STP blocking is unsupported because STP treats the bundled interfaces as one logical port rather than selecting among individual members.
• Interconnect as alternate uplink fails because A1 can reach that interconnect only through D1, which is unavailable in the stated failure.
• Packet-by-packet striping misstates EtherChannel forwarding, which normally hashes each flow onto one member link.

Question 71

Topic: Network Fundamentals

A controller-managed WLAN currently uses open authentication. The administrator must encrypt user data over the air while preserving connectivity for every device.

Client capabilities:

• Laptops: WPA2-Personal and WPA3-Personal
• Scanners: WPA2-Personal with AES-CCMP only

Which WLAN configuration meets both requirements?

Options:

• A. Configure WPA2-Personal with AES-CCMP and a pre-shared key.

• B. Configure WPA3-Personal with SAE and require protected management frames.

• C. Retain open authentication and disable SSID broadcast for the WLAN.

• D. Retain open authentication and require protected management frames for all clients.

Best answer: A

Explanation: AES-CCMP under WPA2-Personal provides confidentiality for wireless data-frame payloads. Every listed device supports this combination, so it protects traffic without excluding the scanners. WPA3-Personal also provides strong encryption, but the WPA2-only scanners cannot use it. Protected management frames secure certain management traffic against forgery and tampering; they do not encrypt user payloads on an open WLAN. Disabling SSID broadcast merely makes discovery less convenient and does not provide encryption.

The required setting must provide both payload encryption and compatibility with all current clients.

• WPA3-Personal excludes the scanners because they support only WPA2-Personal.
• Protected management frames protect management traffic rather than user payloads on an open WLAN.
• Hidden SSID changes network visibility but leaves transmitted payloads unencrypted.

Question 72

Topic: Network Fundamentals

A branch client must reach the HTTPS service APP1 at 10.40.8.20. The required component must act as PC1’s IPv4 default gateway and forward traffic from VLAN 10 into the routed WAN. In this deployment, switching, inspection, routing, and application service are separate roles.

Which component connects the branch subnet to the remote network at the required Layer 3 boundary?

Options:

• A. R1, the branch WAN router

• B. APP1, the remote application server

• C. SW1, the Layer 2 access switch

• D. FW1, the transparent inspection firewall

Best answer: A

Explanation: A host sends traffic for an off-subnet destination to its default gateway. PC1’s /24 prefix does not include 10.40.8.20, so PC1 sends the packet toward 192.168.10.1. R1 owns that address and has an installed route covering the destination, so it performs the required Layer 3 forwarding.

SW1 provides Layer 2 access within VLAN 10. FW1 inspects traffic while operating transparently, but it does not terminate the subnet or act as the gateway. APP1 provides the HTTPS application only after the network delivers the packet. A routed firewall or multilayer switch could serve as a gateway in another design, but the configured roles shown here determine the result.

• Layer 2 switching forwards VLAN frames but SW1 has no routed interface for the subnet boundary.
• Transparent inspection examines transit traffic but FW1 does not own the client’s gateway address.
• Application service terminates HTTPS sessions after delivery rather than forwarding packets between networks.

Question 73

Topic: Security Fundamentals

A packet arrives on router R1’s GigabitEthernet0/0 with source 192.168.10.100 and destination 10.20.30.40. The destination route is installed through GigabitEthernet0/1, and both interfaces are up. Assume ARP succeeds and no other ACL applies.

R1 configuration excerpt:

Standard IP access list 15
 10 permit 192.168.10.0 0.0.0.127
 20 deny   192.168.10.64 0.0.0.63
 30 permit 192.168.10.0 0.0.0.255

interface GigabitEthernet0/1
 ip access-group 15 out

What happens to the packet?

Options:

• A. It is dropped by the implicit deny.

• B. It is forwarded without ACL evaluation.

• C. It is dropped after matching sequence 20.

• D. It is forwarded after matching sequence 10.

Best answer: D

Explanation: Standard IPv4 ACLs evaluate only the packet’s source address and stop at the first matching entry. The wildcard in sequence 10 matches sources from 192.168.10.0 through 192.168.10.127, including 192.168.10.100. Although sequence 20 also describes a range containing that source, it is never evaluated because sequence 10 already permitted the packet. Routing selects GigabitEthernet0/1, where ACL 15 is evaluated in the outbound direction before transmission.

The implicit deny applies only when no explicit entry matches. A later, narrower ACL entry does not override an earlier match.

• Sequence 20 deny does not apply because ACL processing stopped at the earlier matching permit.
• Implicit deny is not reached because the source matches an explicit entry.
• No ACL evaluation is incorrect because the selected egress interface has ACL 15 applied outbound.

Question 74

Topic: Network Access

A Cisco Catalyst switch running IOS XE connects GigabitEthernet1/0/18 to a Cisco IP phone, with a workstation attached through the phone.

• VLAN 30 (USERS) and VLAN 150 (VOICE) exist and are active.
• Workstation data must enter VLAN 30 untagged.
• Phone voice traffic must enter VLAN 150 with 802.1Q tags.
• The interface must use the static access-port design.

Which interface configuration should be applied?

Options:

• A. Configure switchport mode access, switchport access vlan 150, and switchport voice vlan 30.

• B. Configure switchport mode access, switchport access vlan 30, and switchport voice vlan 1.

• C. Configure switchport mode access, switchport access vlan 30, and switchport voice vlan 150.

• D. Configure switchport mode trunk, switchport trunk native vlan 30, and switchport trunk allowed vlan 30,150.

Best answer: C

Explanation: On a Cisco access port supporting an IP phone and attached workstation, switchport access vlan assigns untagged data frames to the data VLAN. The switchport voice vlan command identifies a separate VLAN for voice frames tagged by the phone. Therefore, VLAN 30 must be the access VLAN and VLAN 150 must be the voice VLAN. Explicitly configuring switchport mode access also prevents the interface from operating as a trunk. A trunk with VLAN 30 as native could produce similar frame handling, but it does not satisfy the required static access-port design.

• Trunk configuration carries both VLANs but violates the requirement to use a static access port.
• Reversed VLAN roles places untagged workstation traffic in VLAN 150 and tagged voice traffic in VLAN 30.
• Default voice VLAN assigns tagged phone traffic to VLAN 1 instead of the required VLAN 150.

Question 75

Topic: Network Access

Two switches formed an LACP EtherChannel. Both member links have matching trunk settings, and no minimum-link requirement is configured.

SW1 Gi1/0/1-2: trunk, native 99, allowed 10,20
 channel-group 10 mode active
SW2 Gi1/0/1-2: trunk, native 99, allowed 10,20
 channel-group 10 mode passive

After the Gi1/0/1 cable is disconnected, both switches report:

Group  Port-channel  Protocol  Ports
10     Po10(SU)      LACP      Gi1/0/1(D) Gi1/0/2(P)

Which interpretation is accurate?

Options:

• A. Port-channel10 stays up; Gi1/0/2 remains bundled and forwards eligible traffic.

• B. Port-channel10 goes down; Gi1/0/2 cannot negotiate with the passive switch.

• C. Port-channel10 stays up; Gi1/0/2 becomes a standalone trunk outside the bundle.

• D. Port-channel10 goes down; Gi1/0/2 is suspended because two members are required.

Best answer: A

Explanation: In show etherchannel summary, SU indicates that the port-channel is a Layer 2 interface and is in use. The P flag shows that Gi1/0/2 remains bundled, while D shows that Gi1/0/1 is down. LACP active/passive operation is valid because the active side initiates negotiation and the passive side responds. With compatible Layer 2 settings and no minimum-link requirement, an EtherChannel can continue operating with one available member. Eligible traffic is redistributed across the remaining bundled links, which in this case means Gi1/0/2 carries it alone.

Passive/passive would fail to initiate LACP, but that is not the configured mode pair here.

• Requiring two members would apply only if an appropriate minimum-link requirement were configured.
• Passive mode can respond to LACP packets sent by the active switch, so negotiation continues.
• A surviving member remains part of the EtherChannel rather than automatically becoming an independent trunk.

Questions 76-100

Question 76

Topic: Security Fundamentals

A Cisco Catalyst 9800 WLC serves an inventory WLAN. Existing handhelds connect successfully, but a replacement handheld reports an authentication failure. The replacement supports WPA2-Personal, WPA2-Enterprise, and WPA3-Personal. The WLAN policy must remain unchanged.

Which client configuration should the administrator apply?

Options:

• A. Configure WPA2-Personal/AES with PSK Parts-Floor-72.

• B. Configure WPA2-Enterprise/PEAP with password Parts-Floor-27.

• C. Configure WPA2-Personal/AES with PSK Parts-Floor-27.

• D. Configure WPA3-Personal/SAE with passphrase Parts-Floor-27.

Best answer: C

Explanation: WPA2-Personal authentication requires the client and WLAN to use compatible security settings and the same pre-shared key. The SSID, WPA2-Personal mode, and AES/CCMP encryption already match, but the displayed credentials differ. Because existing clients connect and the WLAN policy cannot change, the replacement handheld must use Parts-Floor-27.

WPA3-Personal uses SAE rather than WPA2-PSK authentication. WPA2-Enterprise uses 802.1X/EAP and normally depends on an authentication server rather than a shared WLAN passphrase. Client capability alone does not make either mode compatible with the configured WLAN.

• Retaining Parts-Floor-72 preserves the PSK mismatch causing authentication to fail.
• WPA3-Personal with SAE does not match the WLAN’s WPA2-PSK authentication mode.
• WPA2-Enterprise with PEAP expects 802.1X authentication rather than the configured shared-key method.

Question 77

Topic: Security Fundamentals

An IOS XE router receives client traffic on GigabitEthernet0/0. Client 192.0.2.25 uses ephemeral source ports and must initiate HTTPS connections to server 198.51.100.10 on TCP port 443. Routing is operational.

interface GigabitEthernet0/0
 ip access-group WEB-IN in
!
ip access-list extended WEB-IN
 100 deny ip any any

Which ACE should be inserted before sequence 100 to permit only the specified service?

Options:

• A. 10 permit tcp host 192.0.2.25 eq 443 host 198.51.100.10

• B. 10 permit tcp host 192.0.2.25 host 198.51.100.10 eq 443

• C. 10 permit tcp host 198.51.100.10 eq 443 host 192.0.2.25

• D. 10 permit tcp host 192.0.2.25 host 198.51.100.10 eq 443 established

Best answer: B

Explanation: An inbound ACL on the client-facing interface examines packets as they enter the router. The initial HTTPS SYN has source address 192.0.2.25, an ephemeral source port, destination address 198.51.100.10, and destination TCP port 443. Extended ACL syntax lists the source tuple before the destination tuple, so eq 443 must follow the server address.

The established keyword does not make an IOS extended ACL stateful. It matches TCP packets containing the ACK or RST flag, so it would not permit the client’s initial SYN. The decisive factors are traffic direction and the placement of the service port in the destination tuple.

• Placing eq 443 after the client address incorrectly requires the client’s source port to be 443.
• Reversing the addresses describes server-to-client traffic, which does not enter the client-facing interface.
• Adding established prevents the initial SYN from matching because that packet does not contain ACK or RST.

Question 78

Topic: Automation and Programmability

A NOC monitors a WAN interface with a repeatable weekday traffic pattern. Policy requires alerts for statistically unusual behavior before a capacity limit is reached. Such alerts initiate investigation but do not establish a root cause.

Current telemetry:

The model is healthy, and all values use the same aggregation period. Which operational decision best satisfies the policy?

Options:

• A. Open a routing-loop alert because the forecast deviation establishes the cause.

• B. Open an anomaly alert while leaving the fixed capacity alert clear.

• C. Open a capacity alert and permanently lower its fixed threshold to 52%.

• D. Leave both alerts clear until utilization reaches the fixed 85% threshold.

Best answer: B

Explanation: Anomaly detection compares an observation with an expected pattern and its uncertainty. The observed 72% utilization is outside the model’s 36% to 52% forecast interval, so it is statistically unusual for that weekday and time. However, it remains below the independent 85% capacity threshold, so the fixed threshold alert does not activate.

An anomaly indicates that current behavior differs from the learned baseline. It provides a reason to investigate telemetry, configuration changes, traffic sources, or routing conditions, but it does not prove which condition caused the deviation. A static threshold instead evaluates only whether a predefined absolute value has been crossed.

• Waiting for 85% ignores unusual behavior relative to the time-specific baseline.
• Permanently using 52% converts a contextual forecast boundary into a static threshold that cannot follow changing patterns.
• Assigning a routing-loop cause treats statistical deviation as proof rather than an investigative lead.

Question 79

Topic: IP Services

An IOS XE router has inside and outside NAT interfaces configured. No other NAT statements exist.

ip nat pool PUBLIC 203.0.113.10 203.0.113.12 netmask 255.255.255.248
access-list 10 permit 10.10.10.0 0.0.0.255
ip nat inside source list 10 pool PUBLIC

Inside global    Inside local
203.0.113.10     10.10.10.21
203.0.113.11     10.10.10.22
203.0.113.12     10.10.10.23

All displayed translations are active. Host 10.10.10.24 now initiates an Internet connection. Which result should the engineer expect?

Options:

• A. Translate the new flow by reusing an address with a different source port.

• B. Drop the new flow because no inside-global address is available.

• C. Translate the new flow after replacing the oldest active one-to-one mapping.

• D. Forward the new flow unchanged because NAT allocation cannot be completed.

Best answer: B

Explanation: Dynamic NAT creates a one-to-one mapping between an inside-local address and an address explicitly included in the configured pool. The pool contains only three addresses, and all three have active translations. Although the ACL identifies 10.10.10.24 as eligible for translation, it does not increase pool capacity. Because the NAT statement does not include overload, the router cannot reuse a global address by distinguishing sessions with transport-layer ports. The router therefore cannot create the required translation and drops the new traffic until an address becomes available through expiration or administrative clearing.

PAT would permit address reuse, but it must be explicitly configured with overload.

• Address and port reuse requires PAT through the overload keyword; dynamic one-to-one NAT does not enable it automatically.
• Pool exhaustion does not cause the router to replace an active translation with a newer request.
• Eligible traffic is not forwarded untranslated when the required dynamic NAT allocation fails.

Question 80

Topic: Network Access

Two Catalyst 9300 switches running IOS XE are connected through Gi1/0/24. VLANs 10 and 99 are allowed, active, and forwarding on the operational trunk.

An administrator changes only S1:

S1(config)# vlan dot1q tag native

Which forwarding result occurs for VLAN 99 data frames?

Options:

• A. Frames in both directions are dropped because the tagging mismatch removes VLAN 99 from the trunk forwarding state.

• B. S1-to-S2 frames are tagged and dropped by S2; reverse frames are untagged and accepted in VLAN 99.

• C. Frames in both directions are accepted in VLAN 99, with each switch normalizing the different native encapsulation.

• D. S1-to-S2 frames are tagged and accepted in VLAN 99; reverse frames are untagged and dropped by S1.

Best answer: D

Explanation: The vlan dot1q tag native command changes native VLAN handling globally on S1 without changing its native VLAN number. S1 now transmits VLAN 99 data with an 802.1Q tag and drops untagged data received on its trunks. S2 still accepts the explicitly tagged VLAN 99 traffic from S1. However, because native tagging remains disabled on S2, S2 transmits its VLAN 99 traffic untagged, and S1 discards it.

The trunk remains operational and VLAN 99 remains allowed and forwarding; the one-sided change creates asymmetric data forwarding rather than suspending the trunk.

• Bidirectional acceptance overlooks that S1 now drops the untagged native-VLAN data transmitted by S2.
• Reversed behavior incorrectly assumes S2 rejects tagged VLAN 99 traffic and S1 continues accepting untagged data.
• Trunk suspension confuses an encapsulation mismatch with an operational failure; the allowed and forwarding VLAN state remains unchanged.

Question 81

Topic: Network Fundamentals

A U.S. office WLAN operates under the FCC regulatory domain. An RF survey shows that all three APs hear one another strongly.

Each AP must remain on 2.4 GHz, and all clients support 20 MHz channels. Capacity across the coverage area is more important than maximum single-client throughput. The administrator must minimize adjacent-channel overlap while avoiding co-channel reuse among these APs.

Which radio configuration should the administrator apply?

Options:

• A. Use 20 MHz channels 1, 7, and 13 on AP-A, AP-B, and AP-C.

• B. Use 20 MHz channels 1, 6, and 11 on AP-A, AP-B, and AP-C.

• C. Use 40 MHz pairs 1+5, 6+10, and 11+7 on AP-A, AP-B, and AP-C.

• D. Use 20 MHz channels 1, 5, and 9 on AP-A, AP-B, and AP-C.

Best answer: B

Explanation: In the U.S. 2.4 GHz band, channels 1, 6, and 11 form the conventional non-overlapping set when 20 MHz channel widths are used. Because 2.4 GHz channel centers are only 5 MHz apart, closer assignments such as 1, 5, and 9 overlap substantially. Bonding two 20 MHz channels into a 40 MHz channel occupies even more spectrum, so different primary channel numbers do not prevent the wider channels from overlapping. The strong mutual signal makes that interference significant. Channel 13 could support a different plan in some regulatory domains, but it is unavailable under the stated FCC context. Reducing the width to 20 MHz therefore provides the required three-channel reuse plan without sacrificing capacity to overlap or co-channel contention.

• Retaining 40 MHz preserves the overlapping bonded channel pairs that the administrator must eliminate.
• Using channels 1, 5, and 9 leaves adjacent-channel overlap because their center frequencies are insufficiently separated.
• Using channel 13 conflicts with the stated U.S. FCC regulatory domain, which permits 2.4 GHz Wi-Fi channels 1 through 11.

Question 82

Topic: Security Fundamentals

An enterprise is responding to online password guessing and confirmed reuse of breached passwords against its remote administration portal.

Required controls:

• Minimum 14 characters
• Breached-password screening
• Password history of 10
• Lockout for 15 minutes after five failures
• Two different authentication factor types
• Existing TACACS+ command authorization roles remain enforced

Supported authentication:

Which policy should the security team implement?

Options:

• A. Apply all listed controls, require password plus a client certificate, and retain TACACS+ roles.

• B. Apply all listed controls, require password plus TOTP, and retain TACACS+ roles.

• C. Apply all listed controls, require two distinct passwords, and retain TACACS+ roles.

• D. Apply all listed controls, require password plus TOTP, and assign one shared admin role.

Best answer: B

Explanation: Password controls and multifactor authentication address different risks. Breached-password screening and password history reduce known and recent reuse. Minimum length increases guessing difficulty, while lockout slows repeated online attempts. A directory password is a knowledge factor, and a TOTP code from an enrolled device is a possession factor. Two passwords remain one factor type, regardless of whether they are different. A certificate can provide a possession factor when supported, but it is not enabled here; the phone biometric is only a local app-unlock mechanism. Strong authentication also does not replace TACACS+ authorization, which controls the commands each administrator may perform.

• Two passwords provide multiple secrets but remain knowledge factors, so they do not satisfy the requirement for different factor types.
• Client certificate could provide another factor, but certificate authentication is not enabled on this portal.
• Shared administrator role removes existing command-level authorization even though password and TOTP strengthen authentication.

Question 83

Topic: Security Fundamentals

A contractor connects a rogue switch to an IOS XE access switch, configures its port as dynamic desirable, and floods broadcasts tagged for finance VLAN 70. Finance services become unavailable.

Current configuration

interface GigabitEthernet1/0/18
 switchport access vlan 20
 switchport mode dynamic auto

Verification

Port       Mode  Encapsulation  Status    Native vlan
Gi1/0/18   auto  n-802.1q       trunking  1

Port       Vlans allowed on trunk
Gi1/0/18   1-4094

Which assessment identifies the configuration vulnerability exploited to form the trunk and the action that directly removes it?

Options:

• A. Vulnerability: rogue DTP negotiation; action: require 802.1X authentication on the port.

• B. Vulnerability: the finance outage; action: apply broadcast storm control to the port.

• C. Vulnerability: VLAN 70 is permitted; action: prune VLAN 70 from the trunk.

• D. Vulnerability: dynamic DTP mode; action: set access mode and disable negotiation.

Best answer: D

Explanation: A vulnerability is a preexisting weakness. Here, switchport mode dynamic auto leaves DTP active and allows the port to become a trunk when the rogue peer uses dynamic desirable. The contractor is the threat actor, DTP negotiation and the tagged broadcast flood are the exploit and attack, and the finance outage is the impact.

Configuring switchport mode access keeps the port in VLAN 20 and prevents trunk formation. Adding switchport nonegotiate disables DTP exchanges. VLAN pruning, 802.1X, and storm control can address related exposure, admission, or flooding concerns, but they do not directly remove the dynamic trunking weakness.

• Pruning VLAN 70 limits this incident’s reach but leaves the edge port able to negotiate unauthorized trunks.
• Rogue DTP negotiation is the exploit, while 802.1X controls endpoint admission rather than dynamic trunk mode.
• Storm control limits broadcast rates, but the outage is an impact rather than the exploited configuration weakness.

Question 84

Topic: Network Access

Two Catalyst 9300 switches run IOS XE. R1 reaches 192.0.2.0/24 through R2 using routed LACP Port-channel10; its members have no IP addresses. The OSPF route through the port-channel has metric 20, while an alternate path through R3 has metric 50. No minimum-links value is configured.

Source-destination IP hashing initially maps flow X to Gi1/0/1 and flow Y to Gi1/0/2. After Gi1/0/1 fails, the OSPF dead timer does not expire.

Group  Port-channel  Protocol  Ports
10     Po10(RU)      LACP      Gi1/0/1(D) Gi1/0/2(P)
R = Layer3, U = in use, P = bundled, D = down

Which forwarding result occurs after the bundle membership updates?

Options:

• A. Flow X uses the OSPF alternate, while flow Y continues through Po10 on Gi1/0/2.

• B. Both flows use the OSPF alternate because any member failure withdraws the Po10 route.

• C. Flow X remains dropped, while flow Y continues through Po10 until flow X restarts.

• D. Both flows use Gi1/0/2 through Po10, and the route through R2 remains installed.

Best answer: D

Explanation: A routed EtherChannel operates as one logical Layer 3 interface. Its IP address, OSPF adjacency, and route are associated with Port-channel10, while the physical members carry frames selected by the configured hash. The RU flags show that Po10 remains a routed interface in use, and Gi1/0/2(P) remains bundled. Because no minimum-member requirement forces the bundle down, OSPF continues using the lower-metric path through R2.

When bundle membership changes, EtherChannel recalculates member selection from the active links. With only Gi1/0/2 available, both flows use that member. The Layer 3 backup is considered only if the logical port-channel route becomes unavailable; an affected flow does not need to restart.

• Split routed paths fails because routing selects Po10 before EtherChannel hashing selects one of its active members.
• Withdraw the route fails because one surviving bundled member keeps Po10 operational when no minimum-link requirement applies.
• Preserve the failed mapping fails because member selection updates when the active-link set changes; existing flows are not permanently pinned to a failed member.

Question 85

Topic: Automation and Programmability

An automation script receives the following IOS XE interface inventory. It uses JSONPath notation, where $ is the root and array indexes start at 0.

{
  "device": {
    "hostname": "R1",
    "interfaces": [
      {
        "name": "GigabitEthernet1",
        "enabled": true,
        "description": null,
        "properties": {"mtu": 1500, "speedMbps": 1000}
      },
      {
        "name": "GigabitEthernet2",
        "enabled": false,
        "properties": {"mtu": "1500", "speedMbps": null}
      }
    ]
  }
}

The script must retrieve the numeric MTU for GigabitEthernet1. Which property reference should it use?

Options:

• A. $.device.Interfaces[0].properties.mtu

• B. $.device.interfaces[0].mtu

• C. $.device.interfaces[0].properties.mtu

• D. $.device.interfaces[1].properties.mtu

Best answer: C

Explanation: JSON object keys are case-sensitive, and JSON array indexes begin at 0. The interfaces key contains an array whose first element represents GigabitEthernet1. Within that element, mtu is inside the nested properties object and has the unquoted numeric value 1500. The second interface contains "1500", which is a string rather than a number. A missing key is also different from a key explicitly containing null; accessing an absent path does not retrieve a null-valued property.

The complete path must follow every object level and select the correct array element.

• Selecting array index 1 reaches GigabitEthernet2 and returns a quoted string rather than the required numeric value.
• Using Interfaces fails because its capitalization does not match the interfaces key.
• Omitting properties searches for mtu at the interface level, where that key is absent.

Question 86

Topic: Network Access

PC-A and PC-B use addresses in the same subnet and must communicate through two directly connected Catalyst switches. The switches have only one inter-switch link.

Simplified command output:

SW1
Gi1/0/10 access VLAN: 30 (active)
VLAN 30: USERS, active
Gi1/0/24: trunking; allowed VLANs 10,20,30
STP VLAN 30 on Gi1/0/24: forwarding

SW2
Gi1/0/10 access VLAN: 30 (inactive)
VLAN 30: no entry
Gi1/0/24: trunking; allowed VLANs 10,20,30
STP VLAN 30: no instance; no inconsistent ports

Which single configuration action on SW2 will restore Layer 2 connectivity after spanning-tree convergence?

Options:

• A. Clear an STP inconsistency for VLAN 30 on SW2.

• B. Create VLAN 30 in SW2’s local VLAN database.

• C. Add VLAN 30 to SW2’s trunk allowed list.

• D. Reapply VLAN 30 to SW2’s access-port assignment.

Best answer: B

Explanation: A VLAN must exist locally on each switch that forwards traffic for that VLAN. SW2’s access port is already assigned to VLAN 30, but the assignment is inactive because VLAN 30 is absent from its VLAN database. The trunk already permits VLAN 30, so changing its allowed list is unnecessary. SW2 has no VLAN 30 spanning-tree instance because the VLAN does not exist, not because spanning tree has blocked or placed the port into an inconsistent state. Creating the VLAN activates the access-port membership and starts the local spanning-tree instance; the single inter-switch path can then transition to forwarding.

• Adding VLAN 30 to the trunk changes nothing because it is already permitted on SW2.
• Reapplying the access VLAN changes nothing because Gi1/0/10 is already assigned to VLAN 30.
• Clearing an STP inconsistency is unsuitable because no inconsistency exists; the VLAN instance itself is absent.

Question 87

Topic: Network Fundamentals

A network management application transfers a complete configuration archive from a branch router to a central server. The WAN can drop or reorder packets. The receiving application validates the final archive but cannot request missing blocks, reorder datagrams, or remove duplicates. It must receive all bytes in sequence before processing the archive.

Which transport design best meets these requirements?

Options:

• A. Use one TCP connection for the complete archive transfer.

• B. Use one UDP flow with duplicate block transmissions.

• C. Use parallel TCP connections for individual archive blocks.

• D. Use one UDP flow with application sequence numbers.

Best answer: A

Explanation: TCP supplies an ordered, reliable byte stream between endpoints. It detects missing data, retransmits unacknowledged segments, removes transport-level duplicates, and presents bytes to the receiving application in order. These capabilities fit an application that lacks its own recovery and reordering logic.

TCP does not guarantee overall application success because connections can still fail and application-level validation can still reject the archive. However, it provides the required transport behavior. UDP preserves datagram boundaries but does not provide retransmission or ordered delivery; an application using UDP must implement those functions itself. A single TCP connection also preserves ordering more directly than independent parallel connections.

• UDP sequence numbers identify order but cannot recover or reorder data without supporting application logic.
• Parallel TCP connections order bytes within each connection, not across all independently transferred blocks.
• Duplicate UDP blocks may reduce loss probability but can create duplicates and still leave missing or reordered data.

Question 88

Topic: IP Connectivity

A network engineer compares a design record with simplified Cisco IOS XE routing output. Which two statements are supported? Select TWO.

Design record:

• Remote host: 10.20.14.130
• Subnet mask: 255.255.248.0

Routing table:

Codes: C - connected, L - local, O - OSPF

O 10.20.8.0/21 [110/30] via 192.0.2.2
C 192.0.2.0/24 is directly connected, GigabitEthernet0/0
L 192.0.2.1/32 is directly connected, GigabitEthernet0/0

Options:

• A. The OSPF prefix is directly connected because its next hop is reached through GigabitEthernet0/0.

• B. The connected and local entries describe the same /24 destination using equivalent mask notation.

• C. The local entry represents R1’s interface address, while the connected entry represents its attached subnet.

• D. The remote host belongs to 10.20.8.0/21, matching the installed OSPF prefix.

• E. The remote host belongs to 10.20.14.0/21, which the OSPF route does not cover.

Correct answers: C and D

Explanation: A subnet mask of 255.255.248.0 is equivalent to /21. The third-octet block size is 8, so the subnet beginning at 10.20.8.0 spans 10.20.8.0 through 10.20.15.255. Therefore, 10.20.14.130 is covered by the installed OSPF route for 10.20.8.0/21.

Cisco route codes identify the route source and purpose. An O route is learned through OSPF. A C route represents an attached network, while an L route is an automatically created /32 route for the router’s own interface address. The C and L entries overlap, but they do not represent the same destination boundary.

• Treating 10.20.14.0 as the /21 network ignores the 8-value third-octet boundary.
• Reaching an OSPF next hop through a connected interface does not reclassify the learned prefix as connected.
• The connected /24 covers the attached subnet, whereas the local /32 identifies one interface address.

Question 89

Topic: Network Access

Four Cisco switches run Rapid PVST+. VLAN 30 is allowed on every operational inter-switch trunk, and all switches exchange BPDUs. The following Bridge ID values are collected before the topology converges:

Switch  Effective priority                         MAC address
SW1     28702 (priority 28672, sys-id-ext 30)      0011.1111.0001
SW2     24606 (priority 24576, sys-id-ext 30)      00aa.aaaa.0200
SW3     24606 (priority 24576, sys-id-ext 30)      00aa.aaaa.0100
SW4     32798 (priority 32768, sys-id-ext 30)      0000.0000.0001

Which switch becomes the root bridge for VLAN 30?

Options:

• A. SW2 becomes the VLAN 30 root bridge.

• B. SW1 becomes the VLAN 30 root bridge.

• C. SW4 becomes the VLAN 30 root bridge.

• D. SW3 becomes the VLAN 30 root bridge.

Best answer: D

Explanation: STP elects the switch with the lowest Bridge ID as the root bridge. The Bridge ID comparison first uses the effective bridge priority, which includes the VLAN system-ID extension. SW2 and SW3 share the lowest effective priority of 24606. STP therefore compares their MAC addresses, and SW3’s 00aa.aaaa.0100 is lower than SW2’s 00aa.aaaa.0200.

Path costs and port identifiers are used later when switches select root and designated ports; they do not influence the root bridge election.

• SW1 has a lower configured priority than the default, but its effective priority of 28702 exceeds 24606.
• SW2 ties for the lowest effective priority but has a higher MAC address than SW3.
• SW4 has the lowest MAC address overall, but its higher priority is evaluated before the MAC address.

Question 90

Topic: Network Fundamentals

SW1 receives one Ethernet frame on Gi0/1. All listed ports are in the spanning-tree forwarding state, and no entries age out during this event.

Received frame: Source 00aa.aaaa.aaaa, destination 00dd.dddd.dddd

Vlan  Mac Address       Type      Ports
10    00dd.dddd.dddd    DYNAMIC   Gi0/4
20    00aa.aaaa.aaaa    DYNAMIC   Gi0/3
20    00bb.bbbb.bbbb    DYNAMIC   Gi0/2

Which forwarding and MAC-learning result occurs on SW1?

Options:

• A. Keep the source entry on Gi0/3; flood through Gi0/2 and Gi0/3.

• B. Move the source entry to Gi0/1; flood through Gi0/2 and Gi0/3.

• C. Learn the destination on Gi0/1; flood through Gi0/2 and Gi0/3.

• D. Move the source entry to Gi0/1; forward only through Gi0/4.

Best answer: B

Explanation: A switch learns from the source MAC address on the receiving port and within the receiving VLAN. Therefore, the existing VLAN 20 source entry moves from Gi0/3 to Gi0/1. Destination lookups are also VLAN-specific. Although the destination MAC appears in VLAN 10, it has no entry in VLAN 20 and is unknown for this frame. SW1 consequently floods the frame through every other forwarding interface carrying VLAN 20: access port Gi0/2 and trunk port Gi0/3. It does not send the frame through VLAN 10 port Gi0/4.

The key distinction is that MAC-table entries are scoped by VLAN, not applied globally across the switch.

• Forwarding only through Gi0/4 incorrectly applies a VLAN 10 destination entry to a frame received in VLAN 20.
• Retaining the Gi0/3 source entry overlooks that receiving the source on Gi0/1 updates its port association.
• Learning the destination on Gi0/1 reverses Ethernet learning behavior; switches learn the received frame’s source address.

Question 91

Topic: Security Fundamentals

A Cisco Catalyst switch running IOS XE must authenticate SSH sessions to VTY 0 through 4 with the local user ops. AAA is not enabled, and only the VTY configuration may change.

Simplified running configuration:

service password-encryption
username ops privilege 5 secret 9 <redacted>
enable secret 9 <redacted>
line con 0
 password 7 <redacted>
 login
line vty 0 4
 password 7 <redacted>
 login
 transport input ssh

SSH authentication for ops fails; the server keys and SSH transport are otherwise correctly configured. Which configuration action meets the requirement?

Options:

• A. Configure login local under the VTY lines.

• B. Configure privilege level 5 under the VTY lines.

• C. Configure the user’s secret as the VTY line password.

• D. Configure login authentication default under the VTY lines.

Best answer: A

Explanation: With AAA disabled, login local makes a line authenticate against locally configured usernames and secrets. The existing login command does not select that local database, and a VTY line password alone is insufficient for SSH authentication. The enable secret is used to enter privileged EXEC mode and does not authenticate the initial SSH session. A VTY privilege setting controls the session’s starting privilege level, not its credential source. Also, service password-encryption merely applies reversible obfuscation to line passwords; it neither selects the local database nor provides strong credential protection.

Because the change is confined to the VTY lines, login local provides the required authentication path without affecting console access.

• Default AAA method is unavailable because AAA is not enabled and no default authentication method list is defined.
• Matching passwords does not select the named local account and does not supply the required SSH authentication.
• VTY privilege level changes authorization after login but does not select the local user database.

Question 92

Topic: IP Connectivity

R1 runs Cisco IOS XE. Traffic to one server must immediately use R3, while all other traffic for its /64 continues through OSPF. Policy requires static routes to use administrative distance 200.

O  2001:db8:100:20::/64 [110/20]
   via fe80::2, GigabitEthernet0/0
C  2001:db8:0:13::/64 [0/0]
   via GigabitEthernet0/1

R3 is reachable at 2001:db8:0:13::2 and has valid forward and return routes. Which command meets the requirements?

Options:

• A. ipv6 route 2001:db8:100:20::25/128 2001:db8:0:13::2 200

• B. ipv6 route 2001:db8:100:20::25/128 2001:db8:0:13::2 100

• C. ipv6 route 2001:db8:100:20::25/128 fe80::2 GigabitEthernet0/0 200

• D. ipv6 route 2001:db8:100:20::/64 2001:db8:0:13::2 200

Best answer: A

Explanation: Administrative distance selects among routes for the same prefix; it does not prevent a more-specific route from being installed. The static /128 and OSPF /64 represent different destinations in the routing table. Because the global next hop through R3 is reachable over the connected network, the /128 can become active with administrative distance 200. Longest-prefix matching then sends traffic for 2001:db8:100:20::25 through R3, while other addresses in the /64 continue using OSPF. A static route for the entire /64 with distance 200 would instead remain a floating backup while the OSPF /64 is installed.

• The /64 static route loses to the OSPF route because both cover the same prefix and OSPF has the lower administrative distance.
• Administrative distance 100 would produce the desired path but violates the stated static-route policy.
• The link-local next hop on GigabitEthernet0/0 sends the host traffic toward the existing OSPF neighbor rather than R3.

Question 93

Topic: Automation and Programmability

A client cannot open https://portal.example.com. An AI-generated summary states:

DNS, the gateway, and routing are correct. R1 can ping the server, proving client reachability; therefore, the web application is down.

Independent facts:

The portal server is verified as 10.30.30.10. R1’s client-facing Gi0/1 is up/up with address 10.20.20.1/24; the client is attached to that LAN.

Client: 10.20.20.25/24
Gateway: 10.20.20.1
DNS result: portal.example.com = 10.30.30.10

R1# show ip route 10.30.30.10
O 10.30.30.0/24 via 192.0.2.2, GigabitEthernet0/0

R1# ping 10.30.30.10 source GigabitEthernet0/0
Success rate is 100 percent

GigabitEthernet0/1: ip access-group USERS_IN in
10 deny tcp 10.20.20.0 0.0.0.255 host 10.30.30.10 eq 443
20 permit ip any any

The deny counter increases during each client attempt. Which assumption in the generated explanation is unsupported?

Options:

• A. Router-sourced ICMP exercises the same policy path as client HTTPS.

• B. R1 has an installed route toward the destination server subnet.

• C. The client resolves the application hostname to the server address.

• D. The client is configured with the correct default gateway address.

Best answer: A

Explanation: A successful router-sourced ping validates only the tested ICMP path between that router source and the server. It does not prove that client HTTPS traffic follows the same security-policy path. The client packets enter R1 through GigabitEthernet0/1, where USERS_IN denies TCP port 443. Router-generated traffic does not enter that interface, and the ping uses ICMP rather than TCP. The increasing deny counter independently connects the ACL rule to the failed client attempts.

Generated operational conclusions should be checked against device evidence that matches the affected source, destination, protocol, port, and direction.

• The displayed client settings directly support the default-gateway claim.
• The DNS result directly confirms resolution to 10.30.30.10.
• The routing-table entry confirms that R1 has an installed OSPF route to the server subnet.

Question 94

Topic: Security Fundamentals

R1 applies USERS-IN inbound on up/up interface Gi0/0. The destination network 192.0.2.0/24 is directly connected through up/up Gi0/1.

After clearing counters, a one-minute test sends:

• Host A (10.10.10.50): 5 HTTPS packets and 3 ICMP packets to 192.0.2.20
• Host B (10.10.10.60): 7 HTTPS packets to 192.0.2.20

R1# show ip access-lists USERS-IN
10 permit tcp 10.10.10.0 0.0.0.255 host 192.0.2.20 eq 443 (12 matches)
20 deny tcp host 10.10.10.50 host 192.0.2.20 eq 443 (0 matches)
30 permit ip 10.10.10.0 0.0.0.255 any (3 matches)

The engineer clears the counters, moves the host-specific deny before the subnet-wide HTTPS permit, and repeats the identical test. Which forwarding result should occur?

Options:

• A. Drop Host A HTTPS and ICMP; forward Host B HTTPS.

• B. Drop both hosts’ HTTPS; forward Host A ICMP.

• C. Drop Host A HTTPS; forward Host A ICMP and Host B HTTPS.

• D. Forward both hosts’ HTTPS and Host A ICMP.

Best answer: C

Explanation: An ACL processes entries from top to bottom and stops at the first match. Initially, the subnet-wide HTTPS permit shadows the later host-specific deny, producing 12 permit matches and no deny matches. After reordering, Host A’s 5 HTTPS packets match the deny first. Host B does not match that host-specific entry, so its 7 HTTPS packets reach the broader permit. Host A’s 3 ICMP packets match neither TCP entry and reach the final IP permit. The expected counter increases are therefore 5, 7, and 3 respectively. These counters demonstrate ACL matching and disposition, not complete application health.

• Denying Host A’s ICMP is incorrect because the reordered deny matches only TCP destination port 443.
• Denying Host B’s HTTPS is incorrect because the host-specific deny matches only source 10.10.10.50.
• Forwarding all traffic ignores first-match processing; Host A’s HTTPS packets now encounter the deny before the broad permit.

Question 95

Topic: Network Fundamentals

A network administrator must address a new user VLAN between two existing allocations:

• Previous VLAN: 10.20.4.32/27
• New VLAN: 28 IPv4 interfaces, including the router
• Next VLAN: 10.20.4.96/27
• Use the smallest subnet that meets the requirement

Which router interface and host configuration pair is valid for the new VLAN?

Options:

• A. Router 10.20.4.66/27; host 10.20.4.95/27

• B. Router 10.20.4.65/28; host 10.20.4.78/28

• C. Router 10.20.4.64/27; host 10.20.4.94/27

• D. Router 10.20.4.65/27; host 10.20.4.94/27

Best answer: D

Explanation: A subnet must provide usable addresses for all 28 interfaces without overlapping the neighboring allocations. A /28 has 16 total addresses but only 14 usable host addresses. A /27 has 32 total addresses and 30 usable addresses, making it the smallest suitable subnet.

The available /27 block is 10.20.4.64/27, spanning 10.20.4.64 through 10.20.4.95. Its network address is 10.20.4.64, and its broadcast address is 10.20.4.95. Therefore, valid interface addresses range from 10.20.4.65 through 10.20.4.94.

• The /28 pair uses assignable addresses, but that subnet supports only 14 interfaces.
• The router address ending in .64 is the /27 network address and cannot be assigned.
• The host address ending in .95 is the /27 broadcast address and cannot be assigned.

Question 96

Topic: IP Connectivity

A Cisco IOS XE router runs single-area OSPFv2. Both paths to 10.60.8.0/24 have a total outgoing OSPF cost of 30. OSPF has maximum-paths 2, CEF uses default per-destination load sharing, and both adjacencies are resolved.

R1# show ip route 10.60.8.0
O 10.60.8.0/24 [110/30] via 192.0.2.2, GigabitEthernet0/0
                 [110/30] via 198.51.100.2, GigabitEthernet0/1

Which statement accurately describes R1’s outbound forwarding to this prefix?

Options:

• A. R1 installs only the first next hop and retains the second as an OSPF backup path.

• B. R1 installs both next hops but selects GigabitEthernet0/0 because its next-hop address is lower.

• C. R1 installs both next hops and uses a source-destination hash to select an eligible path.

• D. R1 installs both next hops and alternates every packet between interfaces in strict round-robin order.

Best answer: C

Explanation: OSPF equal-cost multipath occurs when multiple paths to the same prefix have equal OSPF metrics and fit within the configured maximum-path limit. The routing output lists both next hops under one OSPF route, so both are installed and eligible for outbound forwarding. With default CEF per-destination load sharing, a source-destination hash selects a path; packets for the same source-destination pair normally remain on that path while the forwarding state is unchanged. The listing order and numerical next-hop addresses do not establish preference. This output also describes only R1’s outbound route and does not prove that a return path exists.

• The second next hop is not merely a backup because both equal-cost paths appear as installed next hops.
• Default per-destination CEF does not alternate each successive packet in strict round-robin order.
• A lower numerical next-hop address does not override equal-cost OSPF multipath forwarding.

Question 97

Topic: IP Connectivity

R1 is a Cisco IOS XE edge router for a stub LAN. It has no dynamic routes.

ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/1 192.0.2.1
ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/2 198.51.100.1 200

Current facts:

• G0/0 is up/up with 10.10.10.1/24.
• G0/1 has changed from up/up to down/down.
• G0/2 is up/up, and 198.51.100.1 is reachable.
• The backup provider routes traffic to 203.0.113.10 and back to 10.10.10.0/24.

After convergence, which forwarding result should the engineer verify?

Options:

• A. The backup default installs; 203.0.113.10 uses 198.51.100.1, while 10.10.10.50 remains directly connected.

• B. The primary default remains; 203.0.113.10 uses 192.0.2.1, while 10.10.10.50 remains directly connected.

• C. The backup default installs; 203.0.113.10 and 10.10.10.50 both use 198.51.100.1.

• D. No default installs; 203.0.113.10 is dropped, while 10.10.10.50 remains directly connected.

Best answer: A

Explanation: A fully specified static route depends on both its exit interface and next hop. When G0/1 goes down, the primary default is removed from the routing table. The floating static default through G0/2 then becomes eligible despite its administrative distance of 200 because its interface and next hop remain reachable.

Traffic for 203.0.113.10 matches the installed /0 route. Traffic for 10.10.10.50 instead matches the connected 10.10.10.0/24 route because longest-prefix matching prefers /24 over /0. The stated provider forwarding and return route permit the external traffic to complete; merely installing a default would not prove reachability by itself.

• Removing both defaults overlooks that the floating static route becomes eligible when the preferred route is withdrawn.
• Retaining the primary default ignores the down state of its explicitly configured exit interface.
• Sending LAN traffic upstream ignores longest-prefix matching and the installed connected /24 route.

Question 98

Topic: Security Fundamentals

A Cisco IOS XE router uses a reachable centralized TACACS+ service.

The session has privilege level 15 with per-command authorization enabled. The TACACS+ service keeps an audit of authorization requests, including denials.

Requirements:

• Login: validate each administrator’s identity.
• Command permission: enforce role-based commands.
• Record keeping: log every attempted command.

Observed session:

R1# show ip interface brief
<output displayed>
R1# configure terminal
% Authorization failed.

The administrator remains logged in, and the failed command is recorded. Which AAA function made the decision to deny configure terminal?

Options:

• A. Per-command authorization

• B. Per-command accounting

• C. Login authentication

• D. EXEC session authorization

Best answer: A

Explanation: AAA separates identity verification, permission decisions, and activity recording. Authentication validated the administrator’s credentials, and EXEC authorization allowed the interactive session to begin. Authorization then compared configure terminal with the administrator’s role permissions and denied that specific command. The TACACS+ authorization audit recorded the denial. Accounting records activity; it does not make the permission decision.

The active session and successful show command distinguish a command-level authorization failure from login or EXEC session rejection.

• Login authentication already succeeded because the administrator obtained an interactive session.
• EXEC session authorization permitted the shell to start; it did not deny this individual command.
• Per-command accounting records activity rather than granting or rejecting command execution; the stated server authorization audit records this denial.

Question 99

Topic: Automation and Programmability

A team automates a change on 24 Cisco IOS XE access switches. The approved change adds VLAN 120 named VOICE and permits it on existing distribution trunks while preserving all other allowed VLANs.

The automation summary reports 24 changed hosts and no failures. Which evidence package best validates the change before closing the ticket?

Options:

• A. Approved intent, frozen inventory, all-device configuration diffs, and the successful all-device automation task summary

• B. Approved intent, frozen inventory, all-device configuration diffs, and post-change VLAN and trunk audit results

• C. Generated templates, frozen inventory, all-device configuration diffs, and template-based VLAN and trunk compliance results

• D. Approved intent, frozen inventory, sampled configuration diffs, and sampled post-change VLAN and trunk audit results

Best answer: B

Explanation: Repeatable validation must connect approved intent, deployment scope, configuration changes, and observed results. The frozen inventory identifies every target. Before-and-after diffs reveal whether unrelated trunk settings changed. Post-change results from commands such as show vlan id 120 and show interfaces trunk confirm the VLAN and trunk state on every switch.

A successful automation summary proves that tasks completed, not that the resulting configuration is correct. Likewise, consistent compliance with generated templates does not validate whether those templates accurately represent the approved change. Complete evidence must be evaluated against an independent source of intended state.

• Task summary only shows execution status but does not verify the resulting VLAN and trunk state.
• Template-based compliance can consistently validate an incorrect template because it lacks comparison with approved intent.
• Sampled validation cannot demonstrate that all 24 targeted switches reached the required state.

Question 100

Topic: IP Connectivity

An engineer changes the OSPFv2 router ID on a Cisco IOS router. All neighbors are currently FULL. The new ID must take effect during the maintenance window without reloading the router; a brief adjacency interruption is acceptable.

Current evidence:

R1# show running-config | section router ospf
router ospf 10
 router-id 10.255.255.1
 network 172.16.10.0 0.0.0.255 area 0

R1# show ip ospf | include Routing Process
 Routing Process "ospf 10" with ID 10.1.1.1

Which action should the engineer take?

Options:

• A. Restart the OSPF process with clear ip ospf process.

• B. Reset the OSPF interface with shutdown and no shutdown.

• C. Reapply the configured ID with no router-id and router-id.

• D. Force an SPF calculation by changing the interface OSPF cost.

Best answer: A

Explanation: A running Cisco IOS OSPF process retains the router ID selected when that process started. Changing the router-id command updates the configuration but does not immediately change the operational router ID, as demonstrated by show ip ospf. Executing clear ip ospf process restarts OSPF, causing process 10 to adopt 10.255.255.1. Existing adjacencies briefly go down and then reform, which the maintenance conditions permit.

The router ID is an OSPF identifier, not evidence that the corresponding IPv4 address is reachable. Interface resets and SPF calculations affect adjacencies or route computation but do not restart the process that selected the router ID.

• Resetting the interface rebuilds adjacency on that interface but does not restart the OSPF process or change its operational router ID.
• Reapplying the command changes configuration state again but still does not restart the running OSPF process.
• Forcing SPF recalculates paths after a topology change but does not repeat router-ID selection.

Review your attempt

Use your missed questions to identify a specific decision to revisit: an address boundary, route, interface state, security requirement or interpretation of output. Reproduce relevant tasks in a lab and use fresh scenarios to check understanding. A familiar-set score is not a pass prediction.

Continue in the web app

Use IT Mastery for interactive Cisco CCNA 200-301 v1.1 practice with mixed sets, timed mocks, topic drills, explanations, and progress tracking.

Try Cisco CCNA 200-301 v1.1 on Web