Cisco Certified Network Associate (CCNA) 200-301 Practice Test 27
Question 260
A switching team must implement a change. A network engineer must configure a switch locally through serial console when its in-band management VLAN cannot be reached. Which technical decision most directly meets these requirements?
- Attempt only SSH to the unreachable management IP and assume the console port uses the same IP path.
- Use a switch `line vty` session with no IP connectivity and expect it to traverse the serial console cable.
- Change an unrelated access VLAN and assume this immediately restores the damaged management network before local troubleshooting.
- Connect through the local console cable/USB console and authenticate on the device `line console 0` using the configured console login method.
Explanation
Correct Answer
D:A console provides out-of-band local CLI access even when the switch management SVI, default gateway or in-band network is unavailable. It may still enforce local or AAA login policy.
Incorrect Answers
A:SSH depends on a functioning in-band IP path, unlike physical console access.
B:VTY is virtual remote access; the console line is a distinct local physical management connection.
C:A VLAN change may not restore management and does not provide the requested direct local console entry.
Question 261
Enterprise login must use centralized AAA authorization with a documented local fallback during server outage. The team needs a solution consistent with this requirement. Which option is the most appropriate design or configuration decision?
- Configure a local username but create a VTY AAA method list containing remote servers only.
- Use a syslog server address as the AAA authentication server and assume it grants EXEC privileges.
- Configure an AAA login method list using TACACS+ (or suitable RADIUS) servers followed by `local` as the unreachable-server fallback, and bind an appropriate authorization method list to the management lines.
- Enable only `transport input ssh` and assume it independently provides centralized role/command authorization.
Explanation
Correct Answer
C:AAA authentication proves identity; authorization determines privileges or command rights. TACACS+ commonly provides fine-grained command authorization. Local fallback must be explicitly part of the method list, not merely an existing username.
Incorrect Answers
A:A local account will not automatically be tried after servers are unreachable unless the method list includes local fallback.
B:Syslog collects events; it is not a RADIUS/TACACS+ credential and authorization provider.
D:SSH is secure access transport, whereas AAA method lists control user verification and authorization.
Question 262
An engineer can ping a switch management IP. SSH from 192.0.2.10 times out before any password prompt, while SSH from permitted 192.0.2.11 connects to the same switch. VTY has an `access-class` restricting remote source addresses. What is the most direct cause?
- The affected management source cannot start SSH because the VTY `access-class` filters that source; check the applied ACL and its match before changing credentials.
- The SSH credentials must be wrong because ICMP succeeds, even though TCP 22 never connects from this source.
- The switch has no Ethernet carrier because TCP 22 is filtered, despite ICMP replies from the same interface.
- The telnet VTY service must be reenabled so an SSH access-class permits TCP 22.
Explanation
Correct Answer
A:If TCP port 22 connection attempts time out from one source while SSH succeeds from a permitted source, source filtering precedes username authentication. A password failure instead requires an established SSH session and login exchange.
Incorrect Answers
B:Incorrect credentials are not a sufficient explanation before a transport-level SSH session is established.
C:Successful ping proves some IP path; protocol-specific filtering can still block SSH.
D:Enabling Telnet is neither a fix for the applied SSH source ACL nor compliant with SSH-only management.
Question 263
A switching team must explain an outage. The browser gets redirected from HTTPS to an unencrypted HTTP login page, exposing the authentication exchange in cleartext. Which diagnosis follows from these observations?
- The login remains fully encrypted because the first URL began with `https://`, regardless of the final HTTP endpoint.
- The issue is an expired LLDP neighbor timer, which changes HTTPS into HTTP at the browser.
- The management server is redirecting credentials from a protected HTTPS session to a plaintext HTTP login endpoint, compromising transport confidentiality.
- The presence of any TLS certificate makes every HTTP request secure without an HTTPS handshake.
Explanation
Correct Answer
C:A login page that uses HTTP lacks TLS protection even when the initial navigation used HTTPS. Fix the redirection and require HTTPS for the complete authentication exchange.
Incorrect Answers
A:Security depends on the actual final transport: a redirected HTTP login is not TLS protected.
B:LLDP is link-local discovery and cannot explain an application-layer redirect to plaintext.
D:Certificates do not encrypt standalone HTTP requests that never negotiate TLS.
Question 264
A switching team collects this evidence: The management IP is unreachable, but the console cable connects physically and a local line login still works. Which root-cause interpretation best fits the observations?
- The switch console line is a separate local management path and can authenticate while IP-based VTY management is unreachable.
- Console access requires TCP port 22 reachability because all CLI lines are virtual terminals.
- The working console login proves that the management SVI and default route must be up.
- An unreachable management IP necessarily disables all locally connected console cables.
Explanation
Correct Answer
A:A physical serial/USB console does not rely on the switch’s management IP route. Its `line console 0` login method can differ from `line vty`, so successful local console access does not prove remote SSH connectivity.
Incorrect Answers
B:The console is local physical management, not a VTY carried over TCP/IP.
C:Console operation is compatible with a broken management VLAN or L3 path.
D:The physical console remains an independent troubleshooting route when IP networking fails.
Question 265
Troubleshooting report: RADIUS/TACACS+ servers are unreachable, and the VTY configuration has no usable fallback method despite local accounts being present. Which finding best accounts for the behavior?
- The applied AAA method list lacks `local` fallback after the unreachable RADIUS/TACACS+ server, so login cannot use the existing local account.
- The local account will always be used automatically whenever RADIUS is unreachable, even without `local` in the method list.
- The outage proves the console cable is disconnected because the remote AAA group is down.
- Changing only `ip default-gateway` to an unrelated address guarantees local user fallback.
Explanation
Correct Answer
A:Having a local username does not cause implicit retry after remote AAA server timeout. An explicit `group tacacs+ local` or equivalent method list and the correct line binding are required for server-unavailable fallback.
Incorrect Answers
B:IOS AAA method-list order governs fallback; accounts alone do not change the configured sequence.
C:Remote AAA availability and local physical console connectivity are separate factors.
D:A route change cannot insert the missing authentication method in the AAA list.
Question 266
After correcting an overly restrictive VTY `access-class`, administrators expect SSH from 192.0.2.10 to work; it previously timed out before a password prompt although ping succeeded. What result most directly confirms this repair?
- Only ICMP ping to the switch succeeds while SSH TCP 22 is still blocked from the affected management station.
- SSH works from a different approved subnet but the affected subnet is still denied by `access-class`.
- From the previously blocked management source, TCP 22 reaches the VTY, the SSH handshake completes, an authorized account authenticates, and VTY ACL settings now permit that source.
- Enable plaintext Telnet as a workaround and leave SSH denied.
Explanation
Correct Answer
C:A successful secure login from the exact source and VTY line config prove both source filtering and authentication path function. Testing from an already allowed source would not validate the repaired ACL.
Incorrect Answers
A:Ping was already successful during the fault and does not exercise the VTY SSH ACL.
B:A different source path cannot establish that the original filtered source now works.
D:That changes the protocol/security requirement rather than repairing SSH access.
Question 267
A network acceptance test follows this reported failure: The browser gets redirected from HTTPS to an unencrypted HTTP login page, exposing the authentication exchange in cleartext. Which verification most specifically demonstrates the repaired function rather than checking an unrelated feature?
- The site initially loads with HTTPS but redirects login POSTs to `http://` as before.
- An HTTPS certificate exists on the switch but the active login form posts over plain HTTP.
- A switch console login succeeds while web management still redirects to HTTP.
- A browser completes a TLS handshake with a valid certificate, remains on HTTPS through authentication, and credentials never traverse a plaintext HTTP request.
Explanation
Correct Answer
D:The reported defect was an insecure redirect to HTTP. Confirm the final login URL/transport and certificate validation under a browser or capture, not just that an HTTPS entry point exists.
Incorrect Answers
A:Credentials remain exposed on the unencrypted final authentication request.
B:The presence of an unused certificate cannot encrypt an HTTP request.
C:Local console authentication does not establish web TLS confidentiality.
Question 268
A switching team is validating a repair. Earlier, the management IP is unreachable, but the console cable connects physically and a local line login still works. Which postchange check most directly establishes the specific problem is resolved?
- Only the remote `line vty` SSH method succeeds after management IP recovery, without checking the local console.
- `show running-config | section line con` confirms intended local console login settings, and a direct console session authenticates successfully without relying on the unreachable management SVI.
- The console cable is disconnected and an ICMP echo succeeds from a remote client.
- A remote DNS name resolves while `line con` configuration and physical console authentication remain unverified.
Explanation
Correct Answer
B:A line-console acceptance test verifies the independent recovery channel and associated credentials. It must not be confused with remote VTY availability over the in-band management network.
Incorrect Answers
A:Remote CLI success does not demonstrate that the console recovery path and its login policy work.
C:Ping is not a local line-console access test.
D:Name resolution cannot prove a recovery console login works.
Question 269
A controller WLAN profile needs a configured SSID, enabled state, correct AP group and broadcast settings as required. The team needs a solution consistent with this requirement. Which option is the most appropriate design or configuration decision?
- Create/enable the WLAN with the intended SSID, assign it to the correct AP group/policy, and enable SSID broadcast if clients must discover it in scans.
- Create an SSID entry but leave the WLAN administratively disabled and expect it to appear in normal scans.
- Assign the WLAN only to an AP group that contains none of the serving APs.
- Configure only a corporate VLAN number without an enabled WLAN profile or SSID.
Explanation
Correct Answer
A:An SSID profile must be enabled and applied to the serving APs before clients can normally see or join the WLAN. Broadcast setting affects beacon advertisement, while security and VLAN mapping remain separate settings.
Incorrect Answers
B:A disabled WLAN does not provide the requested active advertising/client service.
C:The profile will not be applied to the intended coverage radios.
D:An L2 VLAN is not a transmitted 802.11 WLAN name or activation state.
Question 270
A switching team is evaluating a deployment. A controller must provide WPA2-Personal using AES-CCMP and an exact shared passphrase matching the clients. What approach correctly addresses the stated requirement?
- Configure WPA2-Enterprise 802.1X/RADIUS and expect the client’s PSK-only profile to use the same authentication method.
- Select legacy WEP encryption while requiring WPA2 AES-CCMP handshake compatibility.
- Use different passphrases at the controller and client and expect AES encryption alone to reconcile them.
- Configure WPA2-Personal with AES-CCMP and an identical strong pre-shared key on the WLC and authorized clients.
Explanation
Correct Answer
D:WPA2-Personal derives session keys from the shared passphrase and four-way handshake. A mismatched PSK or unsupported cipher prevents successful key exchange even if 802.11 association and RF strength are normal.
Incorrect Answers
A:Enterprise EAP credentials and Personal PSK are distinct security modes.
B:WEP is not WPA2-CCMP and fails the stated security method.
C:The parties must derive matching key material for the WPA2-Personal handshake to succeed.
