Cisco Certified Network Associate (CCNA) 200-301 Practice Test 1
Question 1
A workstation at 192.168.40.11/24 must reach a server at 192.168.41.22/24. Both access switches forward Ethernet frames correctly, but neither has an IP routing interface. Which component is required to forward traffic between these two IPv4 subnets?
- A Layer 2 switch port configured for VLAN 40
- A router with routed interfaces or subinterfaces for both networks
- A PoE-capable switch power supply
- A wireless LAN controller with SSID 40
Explanation
Correct Answer
B:The two /24 subnets are different Layer 3 destinations, so the workstation sends off-subnet traffic to its configured default gateway. A router can receive a frame addressed to its local gateway MAC, consult the destination IPv4 route, decrement TTL, and forward a new frame toward the 192.168.41.0/24 network. Routed interfaces or 802.1Q subinterfaces can perform that inter-subnet role. Verify both subnet routes exist and that the hosts use appropriate gateway addresses. A host ARPs for the MAC of its local gateway, not for the MAC of a remote server on a different IPv4 network.
Incorrect Answers
A:An access switch forwards frames inside a VLAN using a learned destination MAC address. It does not by itself route packets between the two different /24 networks. Assigning an access port to VLAN 40 changes the Layer 2 broadcast domain of the connected endpoint, but the 192.168.41.22 destination still lies outside the sender’s IP subnet. The sender needs an IP default gateway that can route the packet onward.
C:Power over Ethernet provides electrical power to devices such as IP phones and wireless access points over supported Ethernet cabling. A larger or correctly sized power supply does not perform IPv4 route lookup and does not supply a default gateway. The switch may show link up and deliver sufficient watts while the workstation still cannot reach a different IP subnet.
D:A wireless LAN controller centrally configures APs and WLAN policy, such as SSIDs, radio settings, and client segmentation. The scenario describes working wired access switches but no routing interfaces. Adding an SSID to the controller will not establish an IPv4 forwarding path from 192.168.40.0/24 to 192.168.41.0/24. A separate routed gateway remains necessary.
Question 2
A campus distribution switch supports Layer 3 switching. Users in VLAN 10 (10.10.10.0/24) and VLAN 20 (10.10.20.0/24) need to communicate without a separate router-on-a-stick connection. What configuration supplies the required gateway function on this switch?
- Configure an SVI with a unique gateway address in each VLAN and enable IP routing
- Set all access ports in both departments to VLAN 1
- Enable PortFast on the uplinks between distribution and access switches
- Configure only a single management IP address on the switch
Explanation
Correct Answer
A:A switched virtual interface is a Layer 3 interface representing a VLAN. Configure interface VLAN 10 with an address such as 10.10.10.1/24, interface VLAN 20 with 10.10.20.1/24, and enable the platform’s IP routing function. Each host uses the SVI in its own subnet as its default gateway. The switch then routes packets between connected prefixes, subject to any policy controls. Verify both VLANs are active, the SVIs are operationally up, and the connected routes appear. A physically connected VLAN with no active member port may leave an SVI line protocol down despite correct IP addressing.
Incorrect Answers
B:Putting both groups in VLAN 1 would collapse their intended Layer 2 segmentation and would not make their existing 10.10.10.0/24 and 10.10.20.0/24 addresses communicate by IP routing. The networks still have distinct IP prefixes. VLAN consolidation can also broaden broadcast and security exposure, contrary to the campus segmentation requirement.
C:PortFast is an STP edge-port feature designed for host-facing ports to begin forwarding quickly. It does not create a Layer 3 interface or route between subnets. Enabling PortFast on switch-to-switch uplinks can also be unsafe because such links may participate in a redundant Layer 2 topology and should not automatically be treated as host edges.
D:A management address allows operators to reach the switch control plane. It does not automatically create per-VLAN default gateways for both user networks. A switch with a single management SVI and IP routing disabled can be managed while hosts in different IP subnets remain isolated from one another unless a separate routing device is present.
Question 3
A company needs its Internet edge to enforce policy on allowed applications while also preventing known attacks. A dedicated IDS can alert but cannot drop packets by itself. Which component-role distinction leads to a correct design?
- Use a next-generation firewall for stateful/application-aware policy enforcement and an inline IPS to actively block detected attacks; an out-of-band IDS primarily detects and alerts.
- Use a standalone passive IDS as the only prevention device because every alert automatically stops the offending packets.
- Deploy a Layer 2 switch with a trunk VLAN and assume its MAC learning performs application-aware intrusion inspection.
- Deploy a wireless LAN controller as the Internet firewall and rely solely on SSID broadcast settings to prevent exploits.
Explanation
Correct Answer
A:NGFW policy controls which flows are permitted, often based on state and applications. An intrusion prevention system in an inline forwarding path can stop matched malicious traffic; a passive intrusion detection sensor ordinarily reports rather than prevents it. The network must actually configure deny or drop actions.
Incorrect Answers
B:Detection outside the forwarding path does not inherently drop traffic, even when the alert is accurate.
C:Ordinary Ethernet forwarding cannot replace stateful firewall and intrusion policy evaluation.
D:SSID management is a wireless access function, not a substitute for inline Internet security inspection.
Question 4
A campus wireless deployment uses lightweight APs with a centralized wireless LAN controller. A user associates to an SSID at an AP, while administrators change WLAN authentication and RF policies centrally. Which statement correctly assigns these roles?
- The AP handles the over-the-air client radio connection and bridges or tunnels client traffic as configured; the WLC centrally manages AP registration and WLAN policies.
- The WLC is itself the RF radio that every station physically associates to, while APs merely supply DC power.
- APs run OSPF SPF for each wireless client because the controller has no responsibility for WLAN policy.
- A passive network IDS distributes SSID security keys over the AP radio as its main control-plane duty.
Explanation
Correct Answer
A:An AP is the RF access endpoint clients associate with; a controller coordinates AP control functions and WLAN configuration for lightweight APs. A registered AP alone is not proof that each client has successfully associated or authenticated.
Incorrect Answers
B:Client frames are transmitted over AP radios; the controller does not replace each remote radio.
C:Wireless AP association and centrally configured WLAN settings do not require per-client OSPF route computation.
D:Intrusion detection and wireless controller management are separate functions.
Question 5
A 24-port access switch has a 185 W PoE budget. Six new access points each negotiate 30 W, and four phones each reserve 7 W. The Ethernet links can carry data, but some APs fail to power on. What should the network administrator address first?
- Configure inter-VLAN routing on the access switch
- Disable spanning tree on the AP access ports
- Change the switch default gateway
- Increase available PoE budget or move powered devices to another suitable switch
Explanation
Correct Answer
D:Six APs at 30 W require 180 W, and four phones at 7 W require 28 W, so the reservation request totals 208 W against a 185 W power budget. The switch cannot guarantee that amount simultaneously even if every copper link is within Ethernet distance limits. Increase the supported PoE power supply budget or distribute endpoints across switches with sufficient power capacity. Confirm actual allocation, device class and port status using PoE show commands after the change. PoE class reservations can differ from measured consumption, so verify the particular switch model and allocation behavior before resizing hardware.
Incorrect Answers
A:Layer 3 inter-VLAN routing is used to move IP packets between broadcast domains. Power negotiation takes place before a newly attached access point can run the IP software necessary for that routing to matter. Enabling an SVI does not supply the missing 23 W of reserved power or fix an electrical power-budget exhaustion warning.
B:STP prevents Layer 2 loops and controls forwarding topology. Disabling it on an access switch is unrelated to PoE watt allocation and can introduce broadcast storms if a loop appears. An access point showing inadequate inline power should be investigated through power class, allocation, and switch hardware capacity rather than STP settings.
C:The switch default gateway only affects the switch’s own off-subnet management traffic when the device is operating as a Layer 2 switch. It cannot increase available inline electrical power. Correct routing may let a powered AP reach a controller, but it will not resolve an AP that does not receive adequate negotiated watts to boot.
Question 6
A Windows host 192.0.2.21/24 can ping 192.0.2.30 on its VLAN, ARP learns neighbors, and the switchport is connected. The host has no default gateway. It cannot reach 198.51.100.20, although the local router is 192.0.2.1/24. What should be corrected?
- Configure the host default gateway as the reachable router interface 192.0.2.1 for off-subnet destinations.
- Replace a known-working switchport cable because ARP and same-VLAN pings fail.
- Change the remote server address to 192.0.2.30 so every inter-network packet stays in the local VLAN.
- Enable a voice VLAN on the user switchport and expect it to create a host default IPv4 route.
Explanation
Correct Answer
A:The host has working local Layer 2 communication, so the switchport is not the immediate blocker. A destination outside the /24 requires a next-hop route; without a default gateway or more-specific route, the host cannot forward the packet to the local router.
Incorrect Answers
B:The observations say local ARP and pings work, contradicting a failed physical access port.
C:Changing the destination is not a network fix and hides the missing default route.
D:Voice VLAN classification cannot insert the needed IP gateway on a host.
Question 7
A Layer 3 switch should route VLAN 20 through `interface Vlan20`. The VLAN exists and Gi1/0/10 forwards in VLAN 20, but `show ip interface brief` reports Vlan20 `administratively down/down`. Why is the gateway unreachable?
- The absence of all active VLAN 20 ports is the only explanation, although Gi1/0/10 is already forwarding in VLAN 20.
- `ip routing` must be disabled because the SVI shows administratively down, and enabling it alone changes the interface state.
- An expired DHCP lease on a remote workstation is the direct cause of the switch SVI administrative shutdown.
- The SVI was shut down administratively; enter `interface vlan 20` and `no shutdown`, then verify operational state and IP routing.
Explanation
Correct Answer
D:An interface explicitly reported administratively down is disabled by configuration. Missing active L2 VLAN membership can also keep an SVI protocol down, but that condition does not explain the administrative-down status given alongside active VLAN membership.
Incorrect Answers
A:Active L2 membership exists, and the IOS output states administrative shutdown.
B:Routing enablement affects forwarding between SVIs, not an explicitly shut interface.
C:A workstation lease cannot change IOS `shutdown` on the SVI.
Question 8
A firewall permits TCP/443 from a suspicious address. An out-of-band IDS raises repeated exploit alerts but no inline IPS blocking rule exists; captured sessions continue reaching the server. Which mechanism explains why the traffic is not stopped?
- The IDS must have dropped every packet because an alert was generated, even though connections complete.
- An 802.1Q native VLAN mismatch is established solely from a TCP/443 security alert.
- The firewall policy permits the flow and the IDS is detect-only, so no inline drop or deny action is applied.
- The public DNS A record is wrong because traffic from the suspicious address reaches the intended web server.
Explanation
Correct Answer
C:A passive alert is observation, not enforcement. If the stateful firewall permits the session and no inline intrusion-prevention rule drops the exploit, the packet path remains open. Enable and validate the intended drop mechanism rather than assuming alert volume equals prevention.
Incorrect Answers
A:Passive IDS events do not inherently block traffic and the observed sessions prove forwarding continues.
B:There is no evidence of Layer 2 VLAN classification failure in this policy scenario.
D:Reachability to the actual server does not support a DNS diagnosis.
Question 9
A lightweight AP has IP connectivity to its default gateway and can reach the controller address, but the WLC shows the AP has never successfully joined CAPWAP. A client sees a different working AP radio but not this AP’s intended SSID. Which fault should be diagnosed first?
- Treat it as a wrong WPA2 preshared key on a client already associated with the unregistered AP.
- Assume the AP has joined because a ping reaches the controller management IP.
- Repair a server’s OSPF metric so the AP automatically bypasses CAPWAP and runs central policies without a controller.
- Investigate CAPWAP discovery/join authentication and controller compatibility for the unregistered AP before troubleshooting client association to it.
Explanation
Correct Answer
D:A lightweight AP normally must register with its controller to receive WLAN configuration. IP reachability does not alone prove a successful CAPWAP join. Client authentication to an SSID cannot be tested on that AP until it is registered and advertising the intended service.
Incorrect Answers
A:No association to the affected AP was observed; controller join is the earlier failure.
B:Network-layer reachability is necessary but insufficient for CAPWAP establishment.
C:The stated blocker is AP registration, not a demonstrated router path-selection issue.
Question 10
An AP uplink negotiates Ethernet at 1 Gb/s and carries management pings, but the AP repeatedly reboots. `show power inline` shows the device requests 25 W while its switchport allocates only 15.4 W. Which problem is most directly supported?
- The Ethernet speed must be zero because an AP cannot negotiate carrier without all requested PoE watts.
- The only fault is missing an IPv6 default route, which directly changes switch PoE power allocation.
- The negotiated PoE class or switch power allocation is insufficient for the AP even though the data link is up.
- A WLAN controller has changed the switch’s STP root bridge, so the AP uses less input power than its stated requirement.
Explanation
Correct Answer
C:Power over Ethernet negotiates electrical power separately from Ethernet data framing. A device requiring 25 W can fail or degrade with a 15.4 W allocation despite valid carrier and occasional pings; select a suitable PoE standard and ensure switch budget and cabling support it.
Incorrect Answers
A:The observed link is operational; the data link and adequate sustained power are related but distinct.
B:Routing information cannot increase watts negotiated on the power-delivery interface.
D:STP root election does not explain the explicit 25 W request versus 15.4 W allocation.
