Cisco Certified Network Associate (CCNA) 200-301 Practice Test 52
Question 510
During congestion, a WAN edge marks voice packets DSCP EF (46), but voice delay and drops remain high. The output policy has no priority queue configured for that traffic, and egress queue-drop counters rise. Which change addresses the observed forwarding problem?
- Configure an appropriate egress low-latency priority treatment for classified voice, with policing or bounds as required.
- Change all voice packets from DSCP EF to CS0 without adjusting egress scheduling.
- Add a DHCP relay helper address on the outgoing WAN interface.
- Enable PortFast on the Ethernet interface carrying the WAN traffic.
Explanation
Correct Answer
A:Classification and marking identify traffic, but they do not by themselves create an egress scheduling policy. Here the packets are correctly marked EF yet suffer congestion loss, and rising queue-drop counters support a data-plane queueing problem. An appropriately sized, platform-supported low-latency priority class in the egress service policy gives eligible voice packets expedited treatment, subject to bandwidth controls that prevent starvation. Verify policy attachment, class counters, offered load, drops and latency after adjustment. Do not promise zero loss under all circumstances; a priority queue still depends on capacity, correct classification and policers. The decisive distinction is between DSCP metadata and the actual per-hop behavior configured on the congested exit link.
Incorrect Answers
B:Remarking EF to default best effort removes the intended differentiated treatment and does not add a queue scheduler. Packets would still compete with bulk transfers in congested output queues and could experience comparable or worse delay. Reclassification could be appropriate if current markings are falsely trusted, but the scenario establishes legitimate voice packets with EF and a missing priority class.
C:DHCP relay forwards client address-assignment requests across IP subnets. It has no role in selecting which data packets depart a congested WAN queue first. The observed EF markings and queue-drop counters concern traffic scheduling, not missing DHCP offers or leases. Configuring a helper on the WAN link would not allocate bandwidth or protect voice latency.
D:PortFast influences Layer 2 spanning-tree transitions for genuine edge access ports. It is unrelated to per-class egress queuing on a WAN bottleneck. Enabling it on an uplink may be inappropriate and could weaken loop-avoidance expectations. The needed verification is on the QoS output policy and queue counters, not the spanning-tree edge timer.
Question 511
The access switch has been configured to trust or explicitly classify approved RTP traffic. The change owner must verify that packets retain their intended DSCP EF marking across the ingress trust boundary. Which check most directly satisfies that acceptance requirement?
- Confirm the DNS recursive resolver answers queries for the phones' NTP hostname.
- Capture the same RTP flow before and after the switch ingress policy and confirm DSCP 46 is retained, while the applied QoS policy or trust counters match the packets.
- Verify a new DHCP lease with a correct default gateway on a different client VLAN.
- Check that a NAT translation entry exists for a web server outside the voice subnet.
Explanation
Correct Answer
B:The pre- and post-boundary captures must match the same RTP flow and show DSCP 46 on each side of the policy. That proves the original EF marking was not erased during ingress processing. Interface QoS policy statistics or trust state can corroborate that the intended class or remarking action applied. The test differs from the previous root-cause item: rather than noticing an EF-to-zero change, it demonstrates the correction by showing preserved EF marking after the switch. A subsequent egress scheduling test can verify treatment, but is not required for this marking-specific check.
Incorrect Answers
A:A working DNS resolver is important for many services, but successful name resolution does not show whether RTP packets retained DSCP EF across the switch. A phone can resolve names while the ingress QoS policy rewrites priority bits. The requirement is packet classification and marking at a specific trust boundary. Inspect the actual RTP code point before and after the interface policy, and use configuration or counters as supporting evidence rather than unrelated application name resolution.
C:An IP lease and default gateway provide addressing and basic routing for a client, not packet-level QoS marking evidence. The switch may route or bridge traffic perfectly while still classifying voice as best effort at ingress. Checking an unrelated VLAN adds no confidence in the intended EF trust-policy change. Use a packet capture or marking diagnostic for the actual RTP flow on the affected interface and compare the code point through the boundary.
D:A NAT translation for a web connection can prove that address translation occurred somewhere in the network, but it does not reveal the DSCP code point of voice RTP packets at the switch ingress. Translation and QoS classification are independent mechanisms, even if some devices perform both. The acceptance criterion is to preserve EF/46 on the specific flow; inspecting a web server's NAT table cannot establish that behavior. Verify marking directly and document the applied classification policy.
Question 512
After adding a priority voice class to a congested WAN egress, which measurement best demonstrates the earlier FIFO-induced RTP jitter is reduced?
- Inspect the running configuration for an EF DSCP value but never generate congestion or check queue behavior.
- Disable the backup traffic completely so the egress never queues, then declare congestion handling proven.
- Under representative simultaneous voice and upload load, inspect QoS egress class counters/queue drops and voice delay or jitter to confirm prioritized service.
- Check only that the remote DNS service resolves the voice server name.
Explanation
Correct Answer
C:It is the behavior under congestion that matters. `show policy-map interface` can report class matches, offered rates and drops; monitoring actual voice quality validates that scheduling, not just DSCP marking, improved.
Incorrect Answers
A:Marking does not demonstrate that packets get the configured priority service at the bottleneck.
B:Removing load avoids the test condition and cannot establish correct operation under the original shared congestion.
D:Name resolution is not a direct measure of WAN scheduling, queue drops or RTP delay.
Question 513
A Cisco IOS switch has a hostname and must accept encrypted SSH management, but it has no SSH server host key yet. Which action enables the required cryptographic identity?
- Enable only `transport input telnet` on VTY lines without generating host keys.
- Configure only a user privilege 15 credential and assume this generates an SSH server key pair.
- Set an IP domain name where required and generate supported SSH host key material, such as `crypto key generate rsa` of an appropriate modulus.
- Set the interface speed to 1000 Mb/s and assume encrypted SSH transport begins automatically.
Explanation
Correct Answer
C:IOS SSH server operation requires cryptographic host keys and suitable SSH configuration. On platforms with classic RSA generation, hostname/domain plus `crypto key generate rsa` create usable key material; VTY transport and login controls must also permit authorized connections.
Incorrect Answers
A:Telnet does not provide the encrypted SSH transport or host cryptographic identity.
B:Local login identity does not itself create the host keys needed by SSH.
D:Physical link rate does not enable IOS SSH server keys or remote management authentication.
Question 514
A new IOS switch allows Telnet from a management subnet, but the security requirement is encrypted CLI access only. RSA host keys exist, a local user has a secret, and remote login works through SSH. Which VTY configuration enforces SSH-only transport while authenticating against the local user database?
- Apply `login local` and `transport input ssh` under the appropriate `line vty` range.
- Use `transport input telnet` with `service password-encryption` to encrypt Telnet sessions.
- Use `transport output ssh` only; incoming Telnet will then automatically be rejected.
- Enable HTTP secure-server on the switch and remove all VTY login authentication.
Explanation
Correct Answer
A:The VTY line configuration controls how incoming virtual-terminal sessions are accepted and authenticated. With host keys and an appropriate local user already configured, `login local` uses that local user database, while `transport input ssh` restricts inbound VTY sessions to SSH rather than Telnet. Test from an authorized management host: TCP 22 should negotiate SSH, and Telnet on TCP 23 should not provide a valid VTY login path. Apply any required source restrictions and privilege policies separately. `service password-encryption` is not a substitute for an encrypted management transport, because Telnet carries session contents in clear text.
Incorrect Answers
B:The `service password-encryption` feature obfuscates certain stored configuration passwords; it does not encrypt Telnet traffic across the network. With `transport input telnet`, VTY sessions still use an unencrypted remote terminal protocol. The requirement is SSH-only incoming management, not merely hiding password text in the running configuration.
C:The `transport output` setting controls connections initiated from the device's terminal line to other targets, not which protocols are accepted by clients connecting to the switch. Leaving `transport input` permissive could continue to allow Telnet. Restrict inbound transport explicitly and keep local authentication enabled.
D:An HTTPS management server protects browser-based administration, not incoming CLI sessions on VTY lines. Removing VTY authentication would weaken access controls and would not establish SSH-only acceptance. The direct CLI mechanism is `login local` combined with `transport input ssh`, with appropriate keys already present.
Question 515
A switch must authenticate operator `viewer` locally with a protected secret and assign that account privilege level 1, while `admin` has level 15. Which configuration addresses the per-user identities?
- Create `username viewer privilege 1 secret ...` and `username admin privilege 15 secret ...`, then use local login on intended management lines.
- Set only a global `enable secret` and assume it creates separate named operator accounts.
- Set only `transport input ssh` and assume all authenticated users automatically receive different configured privilege levels.
- Enable an SNMP read-only community string as a substitute for interactive local IOS credentials.
Explanation
Correct Answer
A:IOS local usernames can carry hashed/protected secrets and explicit privilege assignments. `login local` on a VTY or console uses that database; transport encryption and authorization are additional controls.
Incorrect Answers
B:The enable secret protects elevated exec access, not individual user identities with distinct privilege attributes.
C:SSH controls secure transport, but user creation and privilege mapping must be configured separately.
D:SNMP monitoring credentials are not the same as CLI user accounts and per-user privilege assignment.
Question 516
A freshly provisioned Cisco IOS switch has `ip domain name lab.example`, a local username, and VTY `transport input ssh`. `show ip ssh` reports that the SSH server is disabled, and the configuration has no crypto host keypair. Which cause best explains why TCP/22 SSH connections are refused?
- The switch lacks an OSPF neighbor and therefore cannot generate asymmetric host keys.
- The syslog facility is set to local7 instead of auth.
- The VTY is configured for SSH transport, which disables the SSH server by definition.
- The device has not generated an SSH host keypair, so the IOS SSH server is not enabled.
Explanation
Correct Answer
D:On the stated IOS workflow, an SSH server needs an appropriate generated host keypair; Cisco documents `crypto key generate rsa` for this purpose on applicable platforms. With domain name and local credentials already set but no keypair, `show ip ssh` showing a disabled server is consistent with this missing prerequisite. Generate a supported suitably strong key as the platform requires, configure the permitted SSH version and authentication, then verify `show ip ssh` and a real SSH login over TCP/22. Key creation enables the server, while VTY restrictions and account authentication determine who can use it. This is distinct from merely proving port 22 is reachable or checking its version after service activation.
Incorrect Answers
A:OSPF adjacency is unrelated to whether an IOS device can generate local SSH host keys. OSPF may supply IP reachability to management clients, but the question already points to SSH server disabled and a missing keypair. Generating RSA keys is a local cryptographic and device configuration operation; it does not require a routing neighbor. Routing can be checked after the SSH service is actually enabled.
B:Syslog facilities classify log messages and can affect collection or filtering at a remote log server. They do not determine whether the local SSH daemon has a host key or is enabled. A wrong facility could hide useful SSH errors from an operator, but the directly observed state is server disabled with no crypto keys. Repair the server prerequisite first.
C:`transport input ssh` restricts which protocols are accepted on VTY lines; it does not automatically disable the SSH server. It is an appropriate hardening step once SSH is configured. The device still needs a hostname/domain context and supported server host keys according to the platform's setup sequence. Changing the VTY to allow Telnet would not solve the missing SSH host identity and would weaken management security.
Question 517
A VTY line policy requires SSH-only administration. On R1, TCP/23 accepts a Telnet login prompt because `transport input telnet ssh` remains configured. What specifically violates the management transport baseline?
- An HTTPS web management certificate expired but Telnet was blocked.
- An SSH RSA host key is missing, which would prevent Telnet TCP/23 from accepting connections.
- An interface access VLAN is absent and all remote management ports are unreachable.
- The VTY transport list includes Telnet; set `transport input ssh` to stop plaintext remote CLI sessions.
Explanation
Correct Answer
D:The configured VTY transport list explicitly permits Telnet and SSH. Restricting it to SSH removes the plaintext method while retaining encrypted remote CLI access.
Incorrect Answers
A:HTTPS certificate validation affects browser-based management, not permission to open a Telnet session to port 23.
B:SSH host key creation is required for SSH, but it does not by itself prevent Telnet from accepting sessions when VTY transport permits it.
C:The terminal has already reached TCP/23, so a general missing VLAN preventing all management traffic is inconsistent with the observation.
Question 518
A remote user authenticates successfully over SSH but enters an EXEC shell at privilege level 1. The operational role requires `configure terminal`, which is rejected. What should the administrator investigate?
- Generate SSH host keys because the encrypted login session never established.
- Enable Telnet transport so the user bypasses privilege authorization.
- Check EXEC/command authorization and the user’s assigned privilege level; authentication succeeded but management permissions are insufficient.
- Replace the configured DNS resolver because authorization is tied to hostname lookup.
Explanation
Correct Answer
C:The SSH login and identity check have already succeeded. The denial concerns what an authenticated account is allowed to do, so inspect assigned privilege and AAA authorization method lists.
Incorrect Answers
A:The established SSH session proves the device already supports key negotiation; missing host keys cannot explain a post-login command denial.
B:Switching to Telnet would weaken confidentiality and would not correctly grant authorization to an authenticated user.
D:DNS name resolution does not determine CLI command permission after successful AAA authentication.
Question 519
After generating supported RSA host keys on a Cisco IOS switch, an engineer must verify that its SSH server is enabled and configured to use a secure SSH version. Which CLI check directly reports the SSH server state and version?
- `show interfaces trunk` for native VLAN and allowed VLAN lists.
- `show ip ssh` for SSH enablement, version and service configuration.
- `show ip nat translations` for active inside source address mappings.
- `show spanning-tree` for root bridge and alternate port roles.
Explanation
Correct Answer
B:Cisco IOS and IOS XE document `show ip ssh` to inspect whether the SSH server is running, its configured version and relevant parameters. After creating supported host keys, this is the direct control-plane confirmation that SSH was enabled; follow with a real authenticated SSH connection to validate management reachability and VTY authorization. Do not infer successful SSH solely from a reachable device ping or a `transport input ssh` line. Those provide route and line restrictions but not the actual SSH server state. This verification task differs from diagnosing a previously absent keypair: its objective is to check that the service is active and configured correctly after the repair, without altering unrelated routing or VLAN parameters.
Incorrect Answers
A:The trunk command can help determine whether a remote management path's VLAN is transported, but it does not display the switch's local SSH server enablement or supported protocol version. A trunk may be healthy while SSH is disabled due to missing host keys. Use a command that directly inspects SSH service state for this acceptance criterion.
C:NAT translations show address or port rewriting for traffic crossing a configured NAT boundary. The local SSH server on a switch can be enabled or disabled regardless of whether the device is performing NAT, and a switch may not be a NAT router at all. This command would not expose the SSH version or host-key prerequisites and cannot close the stated acceptance test.
D:Spanning tree describes Layer 2 loop-free topology, including root selection and port roles. It may be useful if an SSH client cannot reach the switch through a network loop or blocked port, but it is not an inspection of the SSH service itself. The task asks specifically for server enablement and protocol version, so the SSH-specific show command is the correct evidence.
Question 520
After the team removed Telnet access from the router VTY lines, they must demonstrate both that encrypted SSH management still works and that TCP/23 no longer accepts new sessions. Which verification proves the transport policy is enforced?
- Prove only that the SSH service responds on TCP/22; do not test TCP/23.
- Confirm local users have high privilege while leaving VTY transport input unchanged.
- Confirm VTY `transport input ssh`, establish an SSH session on TCP/22 and verify a Telnet connection to TCP/23 is refused.
- Verify the router DNS hostname resolves but do not test management transport.
Explanation
Correct Answer
C:The VTY configuration must permit SSH and exclude Telnet. Testing both a successful SSH login and a rejected TCP/23 connection shows the encrypted-only transport baseline is actually enforced.
Incorrect Answers
A:SSH success alone cannot prove Telnet is disabled, because IOS can allow both protocols simultaneously in its VTY transport list.
B:User privilege relates to authentication and authorization after transport; it does not restrict the plaintext Telnet protocol unless the VTY transport list does.
D:A resolvable management hostname does not indicate which CLI transports are accepted by the VTY lines.
