Cisco Certified Network Associate (CCNA) 200-301 Practice Test 49
Question 480
A workstation chooses a valid AAAA answer but its IPv6 connection fails while IPv4 to the same service succeeds. After restoring the IPv6 route, which combined test most directly validates the original dual-stack failure is gone?
- Test only the IPv4 A destination and ignore the AAAA result.
- Query A and AAAA records, inspect an installed IPv6 route and source address, and establish a permitted connection to the returned IPv6 destination.
- Check that the DNS recursive cache has a low TTL, without transmitting IPv6 traffic.
- Assume a valid-looking AAAA record proves the client has an IPv6 default route.
Explanation
Correct Answer
B:Name resolution and forwarding are separate. A valid AAAA result confirms the requested address; a successful IPv6 path/connection confirms that address is actually usable, while IPv4-only success would miss the prior fault.
Incorrect Answers
A:IPv4 success was present before the repair and cannot validate the missing IPv6 route.
C:TTL says how long an address is cached, not whether the IPv6 data path works.
D:DNS servers do not inspect the client routing table when returning an address record.
Question 481
After an A-record cutover, the authoritative DNS server answers a new IPv4 address but a recursive cache formerly returned the old one. Which check establishes that the recursive answer has caught up?
- Check only that the old IPv4 host responds to ping.
- Query both authoritative and recursive servers for the same A record and confirm the recursive answer now matches the authoritative value after appropriate TTL expiry or cache refresh.
- Inspect an unrelated AAAA record while the IPv4 A record remains stale.
- Confirm the recursive resolver's service process is running, without querying the target record.
Explanation
Correct Answer
B:Comparing record values from authoritative and caching servers isolates propagation of an earlier cached answer. A record-name match or reachable IP address alone does not prove the resolver stopped serving a stale value.
Incorrect Answers
A:Old service reachability does not establish that DNS clients are being directed to the new address.
C:The cutover concerns cached A data; IPv6 AAAA data can be independent.
D:A running resolver can continue to return a cached prior answer until TTL expiry.
Question 482
A network-management station polls a Cisco router for interface counters. The router runs the SNMP agent, while the management station schedules OID queries and stores the results. Which component roles correctly describe this exchange?
- The management station is the SNMP manager; the router is the agent providing managed-object data.
- The router is the manager because it owns the interface, and the station is the agent because it stores reports.
- Both devices are traps because SNMP polling uses no request and response messages.
- The router is an NTP client and the station is a syslog facility instead of any SNMP participant.
Explanation
Correct Answer
A:In the SNMP model, a management application acts as manager by initiating polling requests for object identifiers and collecting responses; the network device's agent exposes managed variables such as interface counters through a management information base. In a common deployment polling uses UDP 161, while unsolicited traps are typically delivered to a manager on UDP 162. Use the supported SNMP version and proper authentication/authorization controls, ideally SNMPv3 security, when configuring access. Verify an actual query and response rather than assuming a successful ICMP ping proves SNMP service. Device ownership of counters does not make that device the poller.
Incorrect Answers
B:The agent role is based on serving the device's managed values, not on which system retains historical reports. A monitoring server can store extensive metrics while still acting as manager; the router owns its interfaces but runs the agent. The proposed role reversal confuses data ownership with SNMP protocol initiation.
C:SNMP can carry manager-initiated queries and responses as well as unsolicited traps or informs, depending on deployment. The question explicitly describes scheduled OID polling and returning counters, which is a request/response interaction. Calling both participants traps ignores the manager and agent functions involved.
D:NTP synchronizes clocks and syslog transports event records; neither is the correct name for the component polling an SNMP OID or the device agent returning a managed counter. All three services may coexist on routers, but their protocol roles remain distinct. The observed OID request identifies SNMP.
Question 483
An NMS must learn immediately when a router interface goes down rather than waiting for its next periodic status query. Which SNMP mechanism fits this requirement?
- Configure the device SNMP agent to send an unsolicited link-down trap to the approved monitoring receiver.
- Schedule an SNMP GET poll every hour and claim it delivers an unsolicited event immediately.
- Send the trap to the device's own IPv4 loopback without defining a monitoring destination.
- Change DNS AAAA records on a web server and assume they signal SNMP link-down events.
Explanation
Correct Answer
A:SNMP traps are event-driven notifications sent from an agent to a manager, commonly to UDP port 162, while SNMP GET polling is initiated by the manager, usually to UDP port 161. Trap delivery is not inherently acknowledged like an inform.
Incorrect Answers
B:Polling can detect a fault only when the next query is made; it does not proactively send a link-down notification.
C:The monitoring receiver must be reachable and configured to get notification packets; local loopback targeting may not notify the NMS.
D:DNS records describe naming; SNMP notification configuration controls link-status alarms.
Question 484
An SNMP manager sends an authenticated, permitted GET to a router, but the device returns no UDP/161 response. Local inspection shows that the SNMP agent is disabled and no SNMP service is listening. What most directly explains the missing GET response?
- The device SNMP agent is not active, so it cannot answer the manager’s GET requests.
- An IOS console show command fails whenever SNMP is disabled.
- A syslog severity filter suppresses the SNMP manager’s polling request.
- The SNMP trap receiver has no destination even though polling is independent of traps.
Explanation
Correct Answer
A:SNMP GET polling requires an enabled agent capable of receiving and responding to manager queries. The missing agent, confirmed locally, explains the absence of any UDP/161 reply.
Incorrect Answers
B:A local CLI command is a separate management function and can work without SNMP polling enabled.
C:Syslog logging severity governs system event messages, not whether an SNMP GET receives a response.
D:Unsolicited SNMP traps and solicited GET responses are different functions; missing a trap destination is not enough to explain polling failure.
Question 485
An IOS switch is configured to send SNMP link-down traps to management host 192.0.2.50, but the monitoring system receives none. Polling the switch's MIB from the management host works, and a capture on the switch shows traps addressed to 192.0.2.55. What is the direct fault?
- SNMP polling must be disabled because polling automatically suppresses every asynchronous trap.
- The switch's SSH host keys are missing, so SNMP packets are being converted into Telnet.
- The configured SNMP trap destination is 192.0.2.55 instead of the intended manager 192.0.2.50.
- The Ethernet access port is in a spanning-tree alternate role, even though polling succeeds.
Explanation
Correct Answer
C:A trap is an unsolicited event notification sent toward a configured manager. The capture shows link-down traps leaving for 192.0.2.55, while the monitoring service listens at 192.0.2.50. That address mismatch is sufficient to explain why the intended server receives none, even though SNMP polling works in the other direction. Correct the SNMP host/trap destination configuration, check protocol version/community or SNMPv3 security settings, and validate permitted UDP reception at the manager. Generate a controlled test event and confirm a packet reaches 192.0.2.50 and is accepted. Do not confuse successful polling with successful trap delivery: the target, direction, port and event configuration must all be validated separately.
Incorrect Answers
A:SNMP requests from a manager and unsolicited trap notifications are different communication patterns. Polling reachability does not require asynchronous traps to be disabled; both can operate simultaneously. A successful MIB poll demonstrates one management path but cannot prove that trap receivers and trap target addresses are configured correctly. The captured incorrect destination provides a more precise cause than a general polling/trap incompatibility claim.
B:SSH host keys secure interactive CLI sessions over SSH. SNMP traps use SNMP protocol messaging and configured management targets, not the router's SSH keypair. A missing SSH key could prevent remote CLI access but would not explain why observed trap packets are sent to 192.0.2.55 rather than the intended monitoring address. The packet destination itself is the relevant evidence.
D:Spanning-tree alternate ports may block some Layer 2 data-plane paths by design, but polling from the management host already succeeds and captures show traps being generated to the wrong IP address. Without any port-state or physical-path evidence, assigning the failure to STP ignores the directly observed configuration discrepancy. First correct the trap destination and retest event delivery.
Question 486
A monitoring server sends an SNMP GET to an IOS device, but no response arrives although the device CLI displays the requested interface status. After fixing access/security configuration, which capture proves polling works?
- The device sends an unsolicited trap on UDP 162 while all manager GET requests still time out.
- The device answers ICMP echo only, with all SNMP requests unanswered.
- A CLI `show interfaces` command returns data locally, with no SNMP network exchange.
- A manager-originated SNMP request reaches the device on its SNMP service port (typically UDP 161), and the device agent returns an authorized response.
Explanation
Correct Answer
D:For normal SNMP GET polling, a manager sends a request to the agent and receives a response containing permitted MIB data or a reported SNMP error. Both packet directions and the configured SNMP version/authentication must be considered.
Incorrect Answers
A:Traps are asynchronous notifications and do not establish that manager-initiated polling now works.
B:Ping verifies reachability but not SNMP agent availability, credentials, access controls or UDP replies.
C:Local CLI output cannot prove a remote monitoring manager can query the MIB through SNMP.
Question 487
An interface-down event did not alert an NMS between polling cycles because the router had no SNMP notification target configured. After adding the receiver, what test best verifies event delivery?
- Verify only that the manager can GET an interface counter using UDP 161.
- Check router interface errors with no notification target or manager receipt.
- Trigger a controlled link-down event and confirm an SNMP trap is sent by the agent and received/processed by the monitoring manager on its notification listener.
- Change an unrelated DNS TTL and infer the trap target automatically registered.
Explanation
Correct Answer
C:Traps are agent-originated notifications, so acceptance involves observing an emitted event and actual manager receipt. SNMP polling can still work while trap destination or notification settings are broken.
Incorrect Answers
A:Successful polling does not prove unsolicited trap delivery to the notification receiver.
B:Local events may occur without any packet reaching the monitoring system.
D:DNS caching does not configure an SNMP notification receiver or validate the event path.
Question 488
A Cisco device forwards syslog messages with severities 2, 4 and 6. An operator mistakenly treats severity 6 as more urgent because its number is larger. Which interpretation follows the syslog severity scale?
- Severity 6 is the most urgent because a larger numerical field means higher priority.
- Severity 2 is more urgent than 4 and 6; lower numerical syslog severities indicate more serious events.
- All severities above 0 are equally urgent and should always trigger interface shutdown.
- Severity numbers identify the logging facility, not the importance of the message.
Explanation
Correct Answer
B:Syslog severity is conventionally numbered from 0, Emergency, through 7, Debugging. Smaller numbers describe greater seriousness: severity 2 is Critical, 4 is Warning, and 6 is Informational. A configured logging threshold can determine which messages are forwarded or displayed, but the numerical convention does not reverse at higher values. The operator should prioritize severity 2 and interpret 6 as informational, then examine message content and impact before taking action. The facility is a separate field describing the producing subsystem and should not be mistaken for the severity component.
Incorrect Answers
A:A severity of 6 is informational rather than the highest urgency. Syslog uses the opposite numeric direction from a naive increasing-priority scale: 0 through 2 are especially severe, while 7 denotes debugging detail. Monitoring rules should use the documented scale rather than comparing raw numbers as though larger means more urgent.
C:Syslog severity levels convey different classes of importance. A critical failure and an informational event do not warrant identical operational responses merely because both are nonzero. Automatic interface shutdown on every emitted message could create additional outages and is not the semantics of syslog severity numbering.
D:Syslog represents facility and severity as separate concepts, even when combined in a priority value. A facility identifies the type of program or system component producing the message; severity represents the importance level. The numbers 2, 4 and 6 here explicitly refer to severity and should be interpreted accordingly.
Question 489
A remote syslog collector organizes router and switch messages by subsystem. A change must preserve the source facility separately from how urgent each message is. Which principle is correct?
- Assume syslog facility 7 always means Debugging severity 7.
- Treat every high numeric severity such as 7 as more urgent than Emergency 0.
- Translate subsystem names into IPv4 default routes because syslog has no independent metadata.
- Use the syslog facility to classify source/subsystem and the numeric severity level separately to indicate message urgency.
Explanation
Correct Answer
D:Syslog metadata distinguishes facility and severity: for standard severity values, level 0 is Emergency and level 7 is Debugging. A collector can filter by facility and priority without confusing the two independent fields.
Incorrect Answers
A:Facility and severity are separate encoded values; the facility number is not the message urgency.
B:In the standard syslog scale, lower numeric severity is more urgent.
C:Syslog does carry facility/severity metadata and does not require converting them into Layer 3 route entries.
Question 490
A Cisco router must send syslog messages to remote collector `192.0.2.200` through a designated management interface. Which configuration approach directly establishes the remote logging path?
- Configure `logging host 192.0.2.200` with appropriate source-interface, severity and transport settings, and confirm a routed path to the collector.
- Configure only `ntp server 192.0.2.200` and expect syslog to be delivered to it.
- Configure only a local console logging level and assume a collector automatically subscribes.
- Change the VLAN native ID without defining a logging host or verifying collector reachability.
Explanation
Correct Answer
A:IOS remote syslog configuration identifies the recipient; optional source-interface and severity settings control identity and messages. Actual collector receipt still depends on IP routing, allowed transport and listener service.
Incorrect Answers
B:NTP provides clock synchronization and is not a remote syslog destination declaration.
C:Console output affects local display, not a remote log target.
D:A VLAN change cannot by itself create an IOS remote syslog destination.
