Cisco Certified Network Associate (CCNA) 200-301 Practice Test 2
Question 10
An AP uplink negotiates Ethernet at 1 Gb/s and carries management pings, but the AP repeatedly reboots. `show power inline` shows the device requests 25 W while its switchport allocates only 15.4 W. Which problem is most directly supported?
- The Ethernet speed must be zero because an AP cannot negotiate carrier without all requested PoE watts.
- The only fault is missing an IPv6 default route, which directly changes switch PoE power allocation.
- The negotiated PoE class or switch power allocation is insufficient for the AP even though the data link is up.
- A WLAN controller has changed the switch’s STP root bridge, so the AP uses less input power than its stated requirement.
Explanation
Correct Answer
C:Power over Ethernet negotiates electrical power separately from Ethernet data framing. A device requiring 25 W can fail or degrade with a 15.4 W allocation despite valid carrier and occasional pings; select a suitable PoE standard and ensure switch budget and cabling support it.
Incorrect Answers
A:The observed link is operational; the data link and adequate sustained power are related but distinct.
B:Routing information cannot increase watts negotiated on the power-delivery interface.
D:STP root election does not explain the explicit 25 W request versus 15.4 W allocation.
Question 11
R1 routes 10.20.0.0/16 via next hop 192.0.2.2 on Gi0/0. Its ARP table lists 192.0.2.2 as MAC 00aa.00bb.00cc and Gi0/0 is operational. Which combination of facts proves the intended next-hop decision on Ethernet?
- A switch MAC address table lists a client MAC, so the router ignores its installed destination route.
- The route’s configured next hop is 192.0.2.2 but its Gi0/0 neighbor resolution is irrelevant to frame delivery.
- The installed destination route resolves through Gi0/0 to next-hop 192.0.2.2, and ARP provides that neighbor’s Ethernet destination MAC.
- A controller WLC has a joined AP, which is sufficient to prove this IPv4 next-hop and ARP binding.
Explanation
Correct Answer
C:Routing selects an L3 next hop from the destination lookup; on Ethernet, neighbor address resolution supplies the L2 address to encapsulate the forwarded frame. Both installed route and neighbor mapping are needed to confirm this path, independent of the source host’s MAC.
Incorrect Answers
A:L2 source learning cannot replace a router’s prefix-based next-hop choice.
B:To send over Ethernet, the router needs the destination link-layer mapping for the chosen neighbor.
D:Wireless controller join does not validate the specific router’s forwarding and Ethernet adjacency.
Question 12
A multilayer switch has SVI Vlan10=10.10.10.1/24 and Vlan20=10.10.20.1/24. After enabling inter-VLAN routing, operations must prove both local VLANs are routable. Which check is most conclusive?
- Confirm only that VLAN 10 and VLAN 20 are named in the VLAN database while all SVIs remain down.
- `show ip interface brief` shows both SVIs up/up, `show ip route` lists connected routes for both /24 networks, and hosts can reach their respective gateway and cross-VLAN peers.
- Read the AP association table and infer switch IP routing works for the two SVI subnets.
- Ping the external Internet through an unrelated edge router without inspecting the two SVI gateways.
Explanation
Correct Answer
B:Healthy SVIs and IP routing produce connected Layer 3 routes. End-host tests also confirm that access VLAN membership and default gateways work. Merely saving an SVI address does not prove operational line protocol or successful forwarding.
Incorrect Answers
A:Layer 2 VLAN creation is not proof of active routed gateway interfaces.
C:Wireless client association does not establish inter-VLAN route installation on the switch.
D:An unrelated route can work even while the required local SVI VLAN interfaces fail.
Question 13
After enabling an inline IPS drop signature on a stateful firewall, testers replay one known malicious TCP request and one allowed HTTPS session. Which log/counter combination proves the intended distinction?
- The malicious test increments an IPS drop event and does not reach the server, while the allowed HTTPS session matches a permit rule and succeeds.
- Both malicious and benign requests only generate IDS alerts while both complete, and that is accepted as successful blocking.
- The port link is up and the switch CRC count is zero, without exercising either IPS policy.
- The malicious session is denied but so is every benign HTTPS connection, despite a requirement to preserve authorized access.
Explanation
Correct Answer
A:The firewall policy decides whether the application flow is permitted, while an inline IPS enforces its detection verdict when configured to drop. Combining policy hit counters, IPS actions and server-side observation verifies prevention without overblocking benign traffic.
Incorrect Answers
B:Alerts without packet drops do not satisfy an inline prevention requirement.
C:Physical integrity cannot establish whether a security rule permits or blocks these flows.
D:An indiscriminate deny would not demonstrate the specified balance of prevention and permitted traffic.
Question 14
A lightweight AP shows joined in the controller, but a test client with the right SSID cannot associate because the selected WLAN security policy rejects the client. What acceptance evidence distinguishes AP control health from client connectivity?
- Treat AP registration alone as proof that every client must have passed its four-way WPA2 handshake.
- Verify the AP remains registered and independently check the target client’s association/authentication state and negotiated WLAN policy on the WLC.
- Check only that a separate router has an IPv4 default route and ignore wireless client logs.
- Inspect switchport PoE allocation, then assume every saved SSID security policy must be correct.
Explanation
Correct Answer
B:AP CAPWAP join and client 802.11 association are different state machines. A joined AP can still reject a station for mismatched authentication, unsupported cipher, or policy. A complete test correlates AP status, client event logs and actual successful association.
Incorrect Answers
A:Controller join does not imply client-specific WLAN authentication success.
C:External routing does not identify a WLAN association/security denial.
D:Power availability may sustain the AP but cannot prove a particular station’s authentication.
Question 15
A PoE switch lists APs and phones on 12 ports. Technicians need to confirm a new power-budget allocation actually supplies each endpoint rather than only that Ethernet carrier is up. What should they examine?
- `show power inline` or platform equivalent reports each port’s negotiated/allocated power and the overall available budget, and all devices remain stable under normal load.
- Read only interface VLAN membership and ignore wattage, although some APs reboot due to insufficient power.
- Rely solely on `show ip route` because a default route measures each phone’s PoE consumption.
- Disable power on some ports, then accept their zero draw as proof of adequate power allocation for all APs.
Explanation
Correct Answer
A:PoE hardware reserves and delivers power based on supported classes, power requirements and available chassis budget. A connected data link does not prove the endpoint receives enough watts; per-port allocation and actual draw/operation provide more relevant evidence.
Incorrect Answers
B:L2 VLAN configuration cannot establish adequate electrical supply.
C:Routing tables do not report the switch power subsystem.
D:A powered-off port is not meeting an endpoint demand and zero draw is not a successful service test.
Question 16
A company has a single campus building with 80 access-switch ports and needs redundant uplinks and centralized inter-VLAN routing. It has no separate data-center transit domain and wants to minimize switch tiers. Which campus topology best matches this requirement?
- Build a three-tier campus with a dedicated standalone core pair even though no additional scalability or separation is required.
- Use a spine-leaf data-center fabric where every server-facing leaf uplinks to every spine, replacing all campus user access functions.
- Place all access devices on one unmanaged Ethernet hub and let collision detection provide redundant Layer 3 routing.
- Deploy a two-tier collapsed-core: access switches connect to a redundant distribution/core pair that performs routed aggregation.
Explanation
Correct Answer
D:A collapsed core combines distribution and high-speed core duties in a pair for modest campuses. Access ports remain at the access layer, and the upstream pair provides routed aggregation and redundancy without an additional transit-only core tier.
Incorrect Answers
A:A three-tier campus can function, but the question explicitly optimizes a modest site for fewer tiers and no separate transit need.
B:Spine-leaf is suited to predictable east-west fabric paths and is not the stated simplified access/distribution requirement.
C:A hub cannot route, separate VLANs or provide the required resilient routed aggregation.
Question 17
A large multi-building campus requires separate layers for endpoint access, departmental VLAN and policy aggregation, and fast transit between distribution blocks. Which design correctly places the high-speed transit function?
- Use a dedicated core tier to carry traffic rapidly between distribution blocks, leaving endpoint access at access switches and policy aggregation at distribution.
- Terminate every desktop in the core tier and perform all endpoint access policy on core switch edge ports.
- Attach each distribution block only to an Internet firewall and rely on Internet NAT instead of inter-building campus transit.
- Use a two-tier collapsed core because the organization explicitly needs a separate high-speed transit tier.
Explanation
Correct Answer
A:In the three-tier hierarchy, access switches terminate clients, distribution blocks aggregate and enforce campus routing/policy, and a distinct core supplies reliable high-speed transport between distribution domains. Core devices should not be treated as ordinary access ports.
Incorrect Answers
B:That defeats tier separation and creates a client-facing transit core, contrary to the requirement.
C:NAT at the perimeter is not a replacement for the requested campus core.
D:A two-tier model combines core/distribution, conflicting with the stated separate-core requirement.
Question 18
A data center plans 24 racks of servers that mostly exchange traffic with services in other racks. The design requires predictable short east-west paths and multiple equal-cost uplinks from each rack switch. Which architecture should be selected?
- Daisy-chain all rack switches so east-west traffic crosses a variable number of intermediate racks.
- Use a leaf-spine fabric: each rack-facing leaf connects to every spine, providing multiple short, equal-hop paths for inter-rack traffic.
- Connect the servers exclusively to an Internet WAN router, forcing inter-rack traffic to exit the data center.
- Attach each leaf to only one shared spine so one spine failure disconnects all rack switches.
Explanation
Correct Answer
B:In a standard leaf-spine fabric, server-facing leaves attach to spines rather than relying on a long chain of access/distribution switches. Fabric underlay routing can exploit equal-cost paths between different leaves and support consistent east-west path length.
Incorrect Answers
A:A chain introduces variable path length and extra failure dependencies, contrary to predictable fabric transit.
C:External WAN routing is not an appropriate replacement for the local high-bandwidth fabric.
D:A single uplink removes the required redundant multipath resilience.
Question 19
A remote branch has a 192.168.20.0/24 LAN and must reach headquarters over a provider-managed WAN service. The provider supplies a routed handoff at the branch demarcation. Which component should connect the branch LAN routing domain to that WAN?
- Install a WAN edge router capable of routing between the branch LAN and the provider handoff with appropriate routes and security policy.
- Use a passive patch panel as the only WAN endpoint, expecting it to choose IP next hops.
- Use a Layer 2 unmanaged hub, which performs corporate WAN route selection when traffic exits its local port.
- Configure only a cloud-hosted DNS name without a routed branch gateway.
Explanation
Correct Answer
A:A branch WAN edge provides Layer 3 interconnection across the provider demarcation. It may also apply VPN and QoS features depending on the service, but the decisive role here is routing between the local subnet and remote corporate prefixes.
Incorrect Answers
B:A patch panel provides physical cross-connect, not routed WAN gateway functionality.
C:A hub cannot interpret destination IP prefixes or reach provider-routed networks independently.
D:DNS may resolve service names but does not provide the missing Layer 3 demarcation and forwarding path.
Question 20
At a small collapsed-core campus, all access uplinks feed a distribution/core switch pair. Local LAN pings remain fast, no links are down, but latency rises sharply only during the daily simultaneous backup window. Uplink interfaces run near full utilization while core CPU remains low. What is the primary explanation?
- A core-tier hardware failure is proven because the network is a collapsed-core design.
- Oversubscribed access-to-distribution uplink capacity during the backup burst creates congestion and queueing despite healthy core forwarding.
- The destination routing table must be empty, although local and off-VLAN traffic completes outside the backup window.
- A native VLAN mismatch is proved by an otherwise healthy trunk reaching saturation only under backup load.
Explanation
Correct Answer
B:A physical port can remain up while carrying more offered load than its available bandwidth. Saturated uplink counters and timing tied to backups indicate oversubscription. Additional aggregate capacity, traffic scheduling or QoS may mitigate it; an invented core outage is not supported.
Incorrect Answers
A:The presented core pair has healthy hardware/CPU and the fault correlates with loaded uplinks.
C:A missing route would affect reachability persistently rather than only cause queueing at peak utilization.
D:A native VLAN mismatch can misclassify traffic, but no VLAN-specific symptom or warning appears in the evidence.
