Cisco Certified Network Associate (CCNA) 200-301 Practice Test 26
Question 250
A switching team is evaluating a deployment. An AP locally switches two SSIDs into VLAN 10 and VLAN 20 through a tagged switch uplink. What approach correctly addresses the stated requirement?
- Configure the locally switching AP Ethernet uplink as a compatible 802.1Q trunk carrying tagged WLAN client VLANs 10 and 20, with a suitable native/management VLAN.
- Use an ordinary access VLAN 10 port and assume it transports tagged VLAN 20 frames without trunking.
- Allow VLAN 10 only on the operational trunk and expect VLAN 20 SSID clients to obtain their correct gateway.
- Configure the AP in monitor-only mode instead of verifying local WLAN VLAN tags.
Explanation
Correct Answer
A:Locally switched WLAN traffic must preserve client SSID-to-VLAN mappings across the wired AP uplink. A correctly configured trunk carries both VLAN identities rather than collapsing all stations into one access VLAN.
Incorrect Answers
B:A single access VLAN cannot preserve both intended client VLANs from the AP.
C:Pruning VLAN 20 breaks the second locally switched client data path.
D:A monitor radio cannot replace the requested production SSID client forwarding.
Question 251
A proposed network design has this requirement: A WLC uses a supported link aggregation group connecting to a matching switch Port-channel for uplink redundancy. Which choice is technically appropriate for that deployment?
- Use the WLC platform’s supported LAG configuration and a matching switch Port-channel with consistent member settings, tagged VLANs and native policy.
- Configure unrelated access VLANs on individual WLC uplinks but leave the switch Port-channel absent.
- Configure a switch LACP bundle but assume every WLC platform and software version negotiates LACP in the same way.
- Use one arbitrary IP address on each physical WLC uplink to replace its logical LAG interface.
Explanation
Correct Answer
A:A controller supporting LAG treats multiple physical uplinks as one logical aggregated attachment. The connected switch must present the same aggregation and VLAN expectations for stable forwarding and redundancy.
Incorrect Answers
B:Mismatched bundle membership and VLAN behavior can create blackholes or loops instead of one valid LAG.
C:Some WLC LAG implementations have specific protocol/static requirements; follow the platform-supported mode.
D:That does not implement the controller’s supported aggregated uplink data path.
Question 252
A new Wi-Fi 6 access point on Gi1/0/4 links at 1 Gbps but reboots whenever both radios become active. `show power inline` reports that the switch is granting less power than the AP's required PoE class; no CRC errors are seen. Which corrective action best addresses the symptom?
- Provide an appropriate PoE/PoE+ or higher supported power class and sufficient switch power budget for that AP, then verify actual power allocation.
- Add a static default route on the AP's management VLAN and ignore the power report.
- Change the AP's SSID name to avoid overlapping 2.4-GHz channel numbers.
- Disable spanning tree on the distribution-switch core so the AP receives more Ethernet bandwidth.
Explanation
Correct Answer
A:An Ethernet data link can remain up even while an attached access point receives insufficient electrical power for peak radio load. The switch's inline-power display directly shows a budget or class allocation below the AP's requirement, matching the reboot pattern when radios activate. Verify device power specifications, negotiate a supported PoE power mode and ensure aggregate switch power budget is sufficient. Then confirm the allocated and measured draw with `show power inline` under normal and peak operation. This isolates power delivery from IP routing, radio-channel selection and Layer 2 topology changes.
Incorrect Answers
B:A default route helps management or client traffic reach destinations beyond a local subnet, but it does not increase the electrical watts delivered through an Ethernet switchport. The switch already reports inadequate PoE allocation, and reboots correlate with increased radio power demand. Resolve power negotiation and hardware budget first.
C:An SSID identifies a wireless network to clients. Renaming it does not change the AP's negotiated Power over Ethernet class or available wattage from its upstream switch. Channel overlap may reduce RF throughput, but it does not explain an inline-power warning followed by power-related reboots. Treat those as separate tests.
D:Spanning-tree behavior protects Ethernet topology against loops; disabling it on a core switch does not raise PoE wattage and can introduce serious broadcast storms. The access point's physical Ethernet link is already up. Power budget and negotiated class are the observable defects to correct, not a network-wide Layer 2 protection mechanism.
Question 253
Troubleshooting report: One SSID works, but frames from the second are dropped because VLAN 20 is missing from the AP uplink's trunk allowed list. Which finding best accounts for the behavior?
- VLAN 20 is pruned from the AP’s operational trunk, so the second locally switched SSID cannot reach its correct wired VLAN.
- Both SSIDs must work because they share one AP management IP even if VLAN 20 is excluded from the uplink.
- The issue is necessarily a WPA2 PSK mismatch although affected clients can associate and the missing VLAN is observed.
- The uplink is an untagged access VLAN 10, which automatically handles tagged VLAN 20 without any additional configuration.
Explanation
Correct Answer
A:A working first SSID proves the AP has some connectivity but not that all tagged WLAN client VLANs are permitted. Correct the uplink allowed list and verify both SSID-to-VLAN mappings.
Incorrect Answers
B:AP management reachability cannot substitute for the omitted client VLAN tag forwarding.
C:Association and authentication are distinct from the wired VLAN 20 forwarding problem reported.
D:That does not carry the missing locally switched VLAN 20 traffic as required.
Question 254
The WLC shows an aggregate, but a physical switch uplink was configured separately and is inconsistent with the Port-channel. The team should investigate which specific technical cause?
- The misconfigured switch-side physical uplink is not compatible with the WLC’s intended LAG/Port-channel membership and VLAN characteristics.
- Any physical port with carrier must already be part of the correct Port-channel regardless of mode and VLAN settings.
- The problem is a missing WPA2 passphrase on a wireless client, which explains a switch port excluded from the aggregate.
- Setting a default route on an AP automatically adds the mismatched switch port into the controller LAG.
Explanation
Correct Answer
A:Aggregate links require consistent logical and physical member parameters. A separately configured member can remain unbundled or forward differently, causing asymmetry even while the controller shows an aggregate.
Incorrect Answers
B:Member eligibility and LAG consistency are independent of basic link-up.
C:Client authentication does not cause the observed wired Port-channel configuration mismatch.
D:Routing does not reconcile switch aggregation member configuration.
Question 255
A network acceptance test follows this reported failure: Switchport carrier is up, but available PoE wattage is less than the AP's requested class and the radio fails initialization. Which verification most specifically demonstrates the repaired function rather than checking an unrelated feature?
- The Ethernet carrier is up but PoE allocation remains below the AP’s requirement and the radio never initializes.
- `show vlan brief` lists the AP management VLAN while switch PoE power remains denied.
- The switch PoE operational output reports enough allocated/delivered watts for the AP class, the AP boots with radios active, and it receives the expected IP lease.
- A different AP has a valid IP lease but the affected AP remains unpowered or stuck booting.
Explanation
Correct Answer
C:Ethernet link-up alone coexisted with a PoE shortfall. Inspect negotiated/allocated power and actual AP radio startup plus DHCP bootstrapping to prove the original fault was removed.
Incorrect Answers
A:Ethernet carrier alone does not guarantee that the powered device has its required PoE wattage or class. If power allocation remains below the AP demand, radio startup still fails despite healthy link-state indications.
B:VLAN presence cannot supply the electrical power required by the AP.
D:Unrelated device connectivity does not verify this AP’s power and radio operation.
Question 256
A switching team is validating a repair. Earlier, one SSID works, but frames from the second are dropped because VLAN 20 is missing from the AP uplink's trunk allowed list. Which postchange check most directly establishes the specific problem is resolved?
- Operational uplink trunk permits VLAN 20 and the controller/AP WLAN mapping places the second SSID in VLAN 20; a test client receives a VLAN 20 lease and reaches its gateway.
- The first SSID on VLAN 10 works while VLAN 20 remains pruned and second-SSID clients still fail.
- The AP joins its WLC but the locally switched SSID’s wired VLAN 20 is absent from the trunk.
- The PoE budget is sufficient but the affected SSID clients receive no VLAN 20 connectivity.
Explanation
Correct Answer
A:The former error was pruned VLAN 20. The verification checks both wired tag forwarding and correct SSID-client addressing rather than just successful AP management.
Incorrect Answers
B:Success in one VLAN does not verify the missing second client VLAN.
C:CAPWAP control join alone does not establish a locally switched client data path.
D:Power repair is irrelevant to the confirmed trunk allowed-list failure.
Question 257
The earlier fault was recorded as follows: The WLC shows an aggregate, but a physical switch uplink was configured separately and is inconsistent with the Port-channel. After corrective work, which observation provides direct evidence that the affected function now behaves correctly?
- The controller LAG is configured but one connected switch port remains independent and incompatible with the Port-channel.
- One switch uplink has Ethernet carrier but `show etherchannel summary` still marks it suspended.
- An unrelated client can resolve DNS while the WLC uplink aggregate has a mismatched member.
- The WLC reports its supported LAG operational and the switch `show etherchannel summary` shows all intended uplinks bundled consistently with the Port-channel.
Explanation
Correct Answer
D:After a member mismatch, both ends of the aggregate need compatible states. Confirm member flags and stable traffic/VLAN forwarding instead of assuming a logical LAG name implies every cable is active.
Incorrect Answers
A:One physical member outside the intended Port-channel means the switch and controller do not share the same aggregate topology. The LAG may be shown as configured on the WLC while the actual switch member remains inconsistent; both sides must report operational membership.
B:Carrier does not demonstrate successful bundle membership.
C:Client DNS does not prove the physical LAG membership and redundancy were repaired.
Question 258
A switching team is evaluating a deployment. Device administrators must reach remote CLI through authenticated SSH rather than plaintext Telnet on the management IP. What approach correctly addresses the stated requirement?
- Set VTY `transport input telnet` as the only remote CLI method.
- Enable `ip http server` alone and expect it to create a secure SSH terminal.
- Enable SSH version 2 with reachable device management IP, appropriate local/AAA credentials, RSA keys as applicable and `transport input ssh` on the VTY lines.
- Allow ICMP echo to the management interface and assume it opens authenticated TCP port 22.
Explanation
Correct Answer
C:SSH encrypts the CLI session and authenticates the remote administrative login. Telnet exposes the session in plaintext; interface reachability alone does not configure VTY authentication or SSH transport.
Incorrect Answers
A:Telnet does not provide SSH transport encryption or the requested protected login.
B:HTTP management is a different service and does not establish an SSH VTY daemon.
D:Ping tests network reachability but does not configure SSH keys, users or VTY permitted transport.
Question 259
A proposed network design has this requirement: A switch Web GUI should be accessible over TLS-protected HTTPS with a valid certificate and no credentials exposed over HTTP. Which choice is technically appropriate for that deployment?
- Expose an unencrypted HTTP login page on TCP 80 and rely on a password prompt for confidentiality.
- Use Telnet port 23 for a management web GUI and call it TLS protected.
- Install a certificate but continue serving login only over HTTP with no TLS handshake.
- Enable the platform-supported HTTPS management service with a valid trusted TLS certificate and disable/redirect plaintext HTTP authentication safely.
Explanation
Correct Answer
D:HTTPS protects browser credentials and configuration transactions in transit. A valid certificate supports server identity; plain HTTP cannot provide the required transport confidentiality.
Incorrect Answers
A:An authentication prompt does not encrypt credentials or device-management traffic.
B:Telnet is plaintext terminal access, not HTTPS browser transport.
C:A certificate has no effect unless the browser session actually negotiates protected HTTPS.
Question 260
A switching team must implement a change. A network engineer must configure a switch locally through serial console when its in-band management VLAN cannot be reached. Which technical decision most directly meets these requirements?
- Attempt only SSH to the unreachable management IP and assume the console port uses the same IP path.
- Use a switch `line vty` session with no IP connectivity and expect it to traverse the serial console cable.
- Change an unrelated access VLAN and assume this immediately restores the damaged management network before local troubleshooting.
- Connect through the local console cable/USB console and authenticate on the device `line console 0` using the configured console login method.
Explanation
Correct Answer
D:A console provides out-of-band local CLI access even when the switch management SVI, default gateway or in-band network is unavailable. It may still enforce local or AAA login policy.
Incorrect Answers
A:SSH depends on a functioning in-band IP path, unlike physical console access.
B:VTY is virtual remote access; the console line is a distinct local physical management connection.
C:A VLAN change may not restore management and does not provide the requested direct local console entry.
