Free Cisco 200-301 Practice Exam with Questions & Answers | Set: 8

Use A for this item. A switch added to an existing VTP domain must not have a higher revision number than the production database. A lower revision number prevents the old switch from overwriting current VLAN information. In Cisco CCNA 200-301 v1.1, Network Access questions frequently test the practical boundary between similar features: what the feature does, where it is configured, and what problem it is meant to solve. Dynamic trunking settings do not protect the VLAN database, and a higher revision number is exactly the dangerous condition. A clean way to validate the answer is to map the wording of the scenario to the actual device function. If the feature supplies addressing, forwarding, authentication, trunking, route selection, or controller communication, the answer must match that function exactly rather than a nearby protocol name.

To make a switch always win the STP root election for VLAN 750, configure the lowest possible bridge priority for that VLAN. Cisco STP priorities are configured in increments of 4096, and priority 0 is the lowest configurable value. The command spanning-tree vlan 750 root primary is convenient, but it calculates a priority intended to beat the current root at the time the command is entered. It is not as absolute as setting priority 0. Several listed numeric values are invalid or too high to guarantee root status. Cisco CCNA 200-301 v1.1 Network Access tests this because root bridge placement is a core switching design control. A switch becomes root by having the lowest bridge ID, and priority is compared before MAC address. Setting the VLAN priority to 0 gives the switch the strongest possible election position for VLAN 750. The command that best guarantees root status is spanning-tree vlan 750 priority 0.

The verified answer is A. The correct ACL option is the one that permits traffic arriving from G0/0 while denying traffic from G0/1 according to the exhibit direction. ACL placement and direction decide whether packets match at ingress or egress, so the selected list must be applied where the source interface condition is true. Cisco CCNA 200-301 v1.1 places this skill in Security Fundamentals, where the exam expects a working understanding of how the feature behaves on real Cisco networks, not just a memorized command. A list with reversed source logic or the wrong interface direction would either block valid hosts or fail to block the unwanted traffic. In production, this distinction matters because a misapplied command or design choice usually creates an outage, a security gap, or unnecessary troubleshooting noise. The correct choice matches the control-plane, data-plane, wireless, security, or services behaviour described in the scenario and should be preferred over options that merely sound related.

connect wireless devices to a wired network. Wireless designs depend on the correct access point mode, WLAN security method, controller function, RF band behavior, and client authentication process. Cisco CCNA 200-301 v1.1 includes this topic under Network Access, so the answer must be validated against normal Cisco device behavior and the operational wording of the scenario. The key is not simply recognizing a familiar acronym; it is identifying what the feature does, where it is configured, and what result it produces. The wrong options confuse authentication with encryption, autonomous behavior with controller-based operation, or management functions with client data forwarding. In a real network, selecting the wrong option would either leave the feature nonfunctional, create a forwarding or security gap, or send troubleshooting in the wrong direction. The selected answer is the only one that matches the stated requirement and the way Cisco switching, routing, services, security, wireless, or automation functions are expected to operate. This is why the verified answer remains the best technical choice for the question.

The requirement is to block SSH management access from PC-1 to any RTR-1 interface while allowing other traffic. Applying the control to the VTY lines targets management sessions to the router itself. That is cleaner than placing an interface ACL on only one routed interface, because the question says any RTR-1 interface. SSH uses TCP port 22, so the deny statement must match tcp host 172.16.1.33 any eq 22, followed by permit ip any any to avoid an implicit deny blocking everyone else. Telnet would use TCP port 23, so options that deny port 23 do not satisfy an SSH requirement. Cisco CCNA 200-301 v1.1 Security Fundamentals expects candidates to know the difference between filtering transit traffic on interfaces and restricting administrative access through VTY lines. The correct design is an ACL that denies PC-1 SSH to any router address and then permits other traffic, applied inbound to the VTY access path. That matches option B.

The exhibit indicates Rapid PVST+ operation and shows FastEthernet 2/1 as the root port. In spanning-tree output, the protocol mode tells you whether the switch is running classic PVST+ or the rapid variant. Rapid PVST+ is Cisco ' s per-VLAN implementation of 802.1w rapid spanning tree behavior, giving faster convergence than traditional 802.1D STP. The root port is the switch port with the lowest-cost path toward the root bridge. A non-root switch has one root port per spanning-tree instance; the root bridge itself has no root port. A designated port is selected per segment to forward traffic away from the root. Cisco CCNA 200-301 v1.1 Network Access expects engineers to identify root bridge, root port, designated port, and STP mode from show command output. Since the output identifies Rapid PVST+ and FastEthernet 2/1 as the root-facing interface, C and E are the correct conclusions.

An engineer is configuring data and voice services to pass through the same port. The designated switch interface fastethernet0/1 must transmit packets using the same priority for data when they are received from the access port of the IP phone. Which configuration must be used?

A)

B)

C)

D)

A. Option A

B. Option B

C. Option C

D. Option D

Answer: A

A DHCP server maintains address pools and leases IP configuration to clients. The most basic information it holds is the list or range of available IP addresses that can be assigned from a pool, along with related options such as default gateway, DNS servers, domain name, and lease duration. It does not store public DNS name mappings; that is a DNS function. It does not normally store domain usernames and passwords; that belongs to directory or AAA systems. Static MAC-to-IP reservations can exist in DHCP, but the broad answer being tested is the available address pool. Cisco CCNA 200-301 v1.1 IP Services requires candidates to understand DHCP server, client, relay, pool, lease, exclusion, and default-router behavior. When a client sends DHCPDISCOVER, the server selects an address from the configured pool and offers it with network parameters. Therefore, the correct answer is A.

Answer B,C is correct: B. 192.168.1.61; C. 192.168.1.64. The scenario should be solved by matching the described behavior to the Cisco feature that actually performs it. Cisco CCNA 200-301 v1.1 includes this topic under IP Connectivity, so the answer must be validated against normal Cisco device behavior and the operational wording of the scenario. The key is not simply recognizing a familiar acronym; it is identifying what the feature does, where it is configured, and what result it produces. The other options are real networking terms or plausible phrases, but they operate at a different layer, solve a different problem, or do not create the outcome described. In a real network, selecting the wrong option would either leave the feature nonfunctional, create a forwarding or security gap, or send troubleshooting in the wrong direction. The selected answer is the only one that matches the stated requirement and the way Cisco switching, routing, services, security, wireless, or automation functions are expected to operate. This is why the verified answer remains the best technical choice for the question.

The file-transfer protocol mapping separates FTP from TFTP. FTP uses TCP, normally TCP ports 20 and 21, and provides a more reliable session-oriented transfer model because it rides on TCP. It also supports authentication. TFTP is deliberately simpler: it uses UDP port 69 and does not require username-based authentication. That simplicity is why TFTP is often seen in network-device bootstrapping, IOS image transfers, and configuration-copy workflows, especially in controlled management networks. The reliability clue belongs to FTP because TCP provides sequencing, acknowledgments, and retransmission. The “does not require user authentication” and “uses port 69” clues belong to TFTP. CCNA 200-301 v1.1 Network Fundamentals expects candidates to identify common application protocols, their transport protocols, and well-known ports. In operations, engineers choose TFTP for lightweight device transfers and FTP or more secure alternatives when authentication and stronger transport behavior are required. Reference: Cisco device-management file transfer fundamentals and CCNA protocol objectives.

TCP and UDP both include checksums, but TCP adds reliability mechanisms that UDP does not provide. TCP uses acknowledgments so the sender knows what data arrived, retransmissions when data is lost, sequencing to put data back in order, and windowing to control the amount of outstanding data. UDP is deliberately simpler. It uses a checksum for error detection, but it does not establish a reliable session, acknowledge every segment, or retransmit lost data at the transport layer. Applications that use UDP can build their own recovery if they need it, but UDP itself does not guarantee delivery. Cisco CCNA 200-301 v1.1 Network Fundamentals expects this distinction to be automatic: TCP is connection-oriented and reliable; UDP is connectionless and best-effort. The other answer choices introduce parity checks or CRC as transport reliability methods, which is not the TCP/UDP comparison being tested. The correct statement is that TCP uses checksum, acknowledgments, and retransmissions, while UDP uses checksums only.

Use B for this item. A DHCP helper address is configured on the Layer 3 interface that receives the client broadcast. The first-hop router closest to the client converts DHCP broadcast traffic into unicast traffic toward the DHCP server. In Cisco CCNA 200-301 v1.1, IP Services questions frequently test the practical boundary between similar features: what the feature does, where it is configured, and what problem it is meant to solve. Putting the command near the server, on every router, or on a switch trunk does not intercept the original client DHCPDISCOVER broadcast correctly. A clean way to validate the answer is to map the wording of the scenario to the actual device function. If the feature supplies addressing, forwarding, authentication, trunking, route selection, or controller communication, the answer must match that function exactly rather than a nearby protocol name.

Use D for this item. Private IPv4 addressing is appropriate for hosts that communicate only inside the organization. Those addresses are not routed globally and can be reused in separate private networks. In Cisco CCNA 200-301 v1.1, Network Fundamentals questions frequently test the practical boundary between similar features: what the feature does, where it is configured, and what problem it is meant to solve. Public-facing firewall interfaces and directly reachable Internet services require public addressing or NAT design. A clean way to validate the answer is to map the wording of the scenario to the actual device function. If the feature supplies addressing, forwarding, authentication, trunking, route selection, or controller communication, the answer must match that function exactly rather than a nearby protocol name.

For a small office/home office, broadband cable is the most realistic WAN access technology in the answer set. SOHO designs prioritize cost, availability, ease of installation, and adequate Internet access for a small number of users. Broadband cable and similar consumer or business broadband services fit that model. Frame Relay and ISDN are legacy WAN technologies and are not preferred for a modern SOHO architecture. A dedicated leased line can work, but it is expensive and excessive for most small office requirements. Cisco CCNA 200-301 v1.1 includes SOHO, WAN, and cloud/on-premises topology recognition under Network Fundamentals. The exam is testing design fit, not theoretical maximum control. Broadband access gives the site shared Internet connectivity without the cost and provisioning burden of carrier private circuits. The preferred WAN access technology for this use case is broadband cable access.

Use the displayed drag-and-drop mapping for this item. SNMP uses manager and agent identifiers so a monitoring station can poll, receive traps, and identify managed devices. Commands for contact, location, chassis ID, and community or user parameters help the NMS organize and authenticate device management information. In Cisco CCNA 200-301 v1.1, IP Services questions frequently test the practical boundary between similar features: what the feature does, where it is configured, and what problem it is meant to solve. These identifiers are not forwarding commands; they support operational monitoring and inventory visibility. A clean way to validate the answer is to map the wording of the scenario to the actual device function. If the feature supplies addressing, forwarding, authentication, trunking, route selection, or controller communication, the answer must match that function exactly rather than a nearby protocol name.

Pure IPsec protects unicast IP traffic well, but it does not natively carry multicast or broadcast traffic across sites in the way routing protocols and some legacy services may require. GRE can encapsulate many traffic types, including multicast, inside a unicast tunnel. When GRE is combined with IPsec, GRE provides the tunnel that can carry multicast traffic and IPsec provides encryption and integrity protection for the GRE packets. This is why GRE over IPsec is a common design when encrypted site-to-site connectivity must also support routing protocol hellos or multicast-dependent control traffic. ISATAP is an IPv6 transition mechanism, not the answer for encrypted multicast between remote sites. GRE alone carries the traffic but does not encrypt it. Cisco CCNA 200-301 v1.1 Security Fundamentals expects candidates to understand the division of labor: GRE encapsulates; IPsec secures. Therefore, the mechanism that carries multicast between remote sites and supports encryption is GRE over IPsec.

The verified answer is C and D. RSTP uses discarding, learning, and forwarding port states. Compared with classic STP, RSTP removes the separate listening and blocking names and converges more quickly through proposal and agreement behaviour. Cisco CCNA 200-301 v1.1 places this skill in Network Access, where the exam expects a working understanding of how the feature behaves on real Cisco networks, not just a memorized command. Listening and blocking are associated with 802.1D terminology, and speaking is not an RSTP port state. In production, this distinction matters because a misapplied command or design choice usually creates an outage, a security gap, or unnecessary troubleshooting noise. The correct choice matches the control-plane, data-plane, wireless, security, or services behaviour described in the scenario and should be preferred over options that merely sound related.

HSRP gives hosts a resilient default gateway by using a virtual IP address shared by a group of routers. One router is elected active and forwards traffic sent to the virtual gateway; another router waits as standby and takes over if the active router fails. The hosts do not need to know which physical router is active. They continue to use the same default gateway address. That is the central first-hop redundancy model Cisco expects CCNA candidates to understand. HSRP does not synchronize full router configurations, and it does not make every router use the same physical interface address. It also does not inherently load-balance all gateway traffic; classic HSRP is active/standby per group, although designs can use multiple groups for load sharing. The predictable HSRP behaviors are election of active and standby routers, plus use of a shared virtual IP address as the LAN default gateway. Therefore, B and D are the valid choices.

A CPU ACL on a Cisco Wireless LAN Controller restricts management-plane traffic destined to the controller itself. That is the feature used when management access must be limited to specific source networks. The CPU ACL is applied to traffic handled by the controller CPU, such as SSH, HTTPS, Telnet, SNMP, or other management access depending on platform support and configuration. TACACS+ and RADIUS are AAA services; they authenticate or authorize users but do not by themselves filter which source networks can reach the controller management plane. A Flex ACL applies to client data traffic in FlexConnect designs, not to controller management access. Cisco CCNA v1.1 Security Fundamentals expects the distinction between access control and authentication. If the requirement says restrict management access from specific networks, the security control must filter management-plane packets before login is even considered. On a WLC, that points to the CPU ACL.

The enable secret value takes precedence over enable password and line passwords for entering privileged EXEC mode. In the exhibit, the configured enable secret is testing1234, so the engineer must use that password to enter enable mode. The username and line password are relevant to user login and line access, but not preferred over enable secret for privilege escalation. Cisco IOS checks enable secret first because it is stored more securely than the older enable password. If enable secret were absent, enable password could be used; if neither were present, line behavior might affect access depending on the configuration. Here, the answer is unambiguous because enable secret is configured. CCNA 200-301 v1.1 Security Fundamentals expects candidates to understand basic device-access configuration and the priority of enable secret. The verified answer is C, with the option corrected to testing1234 to match the exhibit. Reference: Cisco IOS enable secret and device-access security behavior.

Unused switch ports should not remain active in the default VLAN. The proper hardening approach is to administratively shut them down and move them into an unused access VLAN, often called a parking, black-hole, or unused VLAN. Shutting the port stops an attacker from plugging in and immediately gaining Layer 2 connectivity. Moving the port out of VLAN 1 reduces the impact if someone later enables the port accidentally. EtherChannel is irrelevant because it aggregates links; it does not protect idle user-facing ports. Trunking unused ports is actively dangerous because it could expose multiple VLANs. CDP can disclose device information and is not a protection method for unused ports. Cisco CCNA v1.1 Network Access and Security Fundamentals overlap here: secure access-layer design includes disabling unused interfaces, avoiding the default VLAN for user access, and limiting unintended Layer 2 exposure. Therefore, B and C are the correct operational steps.