Cisco Certified Network Associate (CCNA) 200-301 Practice Test 61
Question 600
DHCP snooping is enabled on VLAN 30. A rogue laptop sends DHCPOFFER on an untrusted access port, and legitimate DHCP server replies arrive on the uplink. After trusting only the genuine server-facing uplink, which evidence best validates the policy?
- The uplink is still untrusted and all DHCP server replies are discarded, regardless of their source.
- Port-security secure-MAC counts rise, with no check of DHCP message direction or snooping bindings.
- Dynamic ARP Inspection is disabled, which alone ensures DHCP offers cannot reach clients.
- `show ip dhcp snooping` identifies the legitimate uplink as trusted and client ports as untrusted; snooping bindings populate for leases, while rogue offers are dropped.
Explanation
Correct Answer
D:DHCP snooping distinguishes trusted server-facing ports from untrusted client ports. Verify trust state, appropriate discard counters for rogue replies and binding entries after successful legitimate leases; both acceptance and enforcement matter.
Incorrect Answers
A:Leaving the server-facing uplink untrusted would reproduce the broken legitimate lease exchange; DHCP snooping must permit server-originated messages only from trusted links.
B:Port security limits learned source MAC addresses, not the trust of DHCP server messages or lease metadata. Counts do not prove that rogue DHCPOFFERs were rejected.
C:Dynamic ARP Inspection validates ARP traffic using bindings and related checks. It is not the mechanism that allows valid DHCPOFFERs from trusted ports and blocks them on untrusted ones.
Question 601
The earlier fault was recorded as follows: ARP replies from a valid static-IP printer are dropped because there is no DHCP snooping binding and no static inspection permit. After corrective work, which observation provides direct evidence that the affected function now behaves correctly?
- Disable Dynamic ARP Inspection on the entire user VLAN and assume anti-spoofing protection is still enforced.
- Leave the printer absent from all trusted bindings and expect DAI to accept arbitrary static-IP ARP replies.
- The printer’s exact static IP/MAC mapping is authorized by an appropriate DAI ARP ACL or valid static binding, and `show ip arp inspection statistics` no longer increments drops for its legitimate ARP replies.
- Only verify that the printer switchport has carrier while ARP inspection drop counters keep rising.
Explanation
Correct Answer
C:Dynamic ARP Inspection normally validates ARP bindings learned from DHCP snooping; static-address hosts may need explicit trusted binding/ARP ACL. Repair should preserve spoofing protection rather than disabling DAI everywhere.
Incorrect Answers
A:That removes the very security validation rather than safely permitting the legitimate static printer.
B:Without a valid permit/binding, the reported ARP drops can continue.
D:Layer 1 link state cannot prove that legitimate ARP mappings pass inspection.
Question 602
A network security analyst has repaired a network problem. A third MAC appears on a port with maximum 2 and increments the port-security violation counter. Which device or protocol check is the strongest evidence that this particular failure is gone?
- The third unknown MAC is added as a third authorized source even though maximum remains 2, without any policy exception.
- `show port-security interface` reports maximum 2, the intended two authorized secure MACs and appropriate violation counter/action when a third unauthorized source is tested.
- Only the generic dynamic MAC table is inspected, with no port-security limit or secure address data.
- The port is permanently errdisabled during legitimate device tests and no recovery/access policy is verified.
Explanation
Correct Answer
B:Verify learned secure entries and whether the configured violation mode behaves as policy requires. A recorded third-MAC violation can be expected, but recovery should leave the legitimate two endpoints working.
Incorrect Answers
A:That contradicts the configured secure maximum and fails the source-MAC limit.
C:Ordinary MAC learning does not prove port-security maximum/violation logic.
D:An enforcement event without safe continued authorized operation is not a complete acceptance check.
Question 603
A network acceptance test follows this reported failure: A device was replaced but the old sticky learned MAC remains and rejects the new workstation unless the entry is updated. Which verification most specifically demonstrates the repaired function rather than checking an unrelated feature?
- The old sticky source MAC remains the only authorized address, while the replacement host is still rejected.
- Only the dynamic MAC address table changes, with the configured sticky secure list still pinned to the old PC.
- Increase the maximum indefinitely and ignore old sticky bindings on every edge switchport.
- The stale sticky MAC is removed or updated for the replacement workstation; the new intended MAC is learned/approved in `show port-security address` and saved as required.
Explanation
Correct Answer
D:Sticky secure entries can outlive the replaced device in running/startup config. A new workstation may be rejected until the old secure binding is removed and the legitimate replacement recorded.
Incorrect Answers
A:Sticky MAC port security restricts permitted source addresses on the port. If the previous host MAC remains the only approved entry, replacement hardware with a new MAC can still trigger a violation until stale security state is deliberately updated.
B:Port-security enforcement uses secure entries, not merely ordinary forwarding-table aging.
C:Unbounded expansion undermines the intended controlled source-MAC policy and is not a targeted replacement correction.
Question 604
A network security analyst is validating a repair. Earlier, the switch logs a security violation and the interface transitions errdisabled after a third unauthorized MAC arrives. Which postchange check most directly establishes the specific problem is resolved?
- Switch the port to `protect` and claim it still implements the original requirement to errdisable on a third MAC.
- Let the unauthorized MAC remain connected, disable port security and call the errdisable issue repaired.
- With a controlled unauthorized third MAC, `show port-security interface` and logs identify a shutdown violation and errdisable; after removing it and recovering, the two authorized hosts remain functional.
- Observe a third MAC in the ordinary switch MAC table while never checking secure limit, violation action or port state.
Explanation
Correct Answer
C:The policy intentionally errdisables on excess secure MACs. Validation should establish the correct trigger and safe recovery, not disable the protection to suppress the symptom.
Incorrect Answers
A:Protect drops silently without the shutdown-mode interface disable.
B:That evades security policy rather than confirming the configured enforcement.
D:Forwarding-table learning does not prove shutdown-mode port-security behavior.
Question 605
An administrator logs into a Cisco router successfully, but a subsequent command is rejected because their assigned role lacks permission. The security logs independently record the attempted command. Which AAA functions correspond to these three different steps?
- Authorization validates the password, while accounting grants privilege, and authentication records commands.
- Authentication validates identity; authorization decides allowed commands; accounting records the administrator's actions.
- Accounting grants the session, authentication chooses router interfaces, and authorization encrypts SSH.
- All three steps are authentication because a successful password check permits every command.
Explanation
Correct Answer
B:AAA separates identity verification from the access decision and from records of use. Authentication can confirm the administrator's supplied credentials; authorization then evaluates whether that account or role may execute a given privileged command; accounting captures records of session activity or commands for audit when enabled and supported. The scenario deliberately shows login succeeding even though a command is denied, which demonstrates that authorization is independent of authentication. The audit record is the accounting function rather than a replacement for the permission check. Verify the AAA method lists, server responses and local fallback behavior without conflating these roles.
Incorrect Answers
A:The proposed mapping reverses the basic functions. Checking a password or other credential is authentication, while deciding whether the principal may execute a command is authorization. Accounting is about evidence of use, not granting new privileges. A correct login does not inherently confer unrestricted device configuration authority.
C:Accounting normally records security-relevant activity but does not create a session or issue permissions by itself. Authentication is not an interface-selection policy; SSH protects transport and can be required separately. The AAA labels describe identity, access rights and activity records, regardless of which secure terminal protocol carries the session.
D:A user can be authenticated and still denied access to privileged configuration commands when their authorization role lacks permission. The question explicitly describes that separation. Treating successful login as universal command authority would defeat role-based controls and erase the need for command authorization.
Question 606
A network security analyst is evaluating a deployment. After login, authorization should determine which commands or resources an authenticated operator may access. What approach correctly addresses the stated requirement?
- Use centralized TACACS+ command authorization with appropriate `aaa authorization commands` method lists and role rules after successful authentication.
- Use only `aaa authentication login` and assume it defines every permitted configuration command.
- Enable syslog timestamping and assume it blocks unauthorized `configure terminal` commands.
- Use DHCP option 3 to map usernames to command privilege levels.
Explanation
Correct Answer
A:Authentication establishes the user identity; authorization enforces allowed EXEC level and commands. TACACS+ commonly supports granular device-command authorization beyond basic login.
Incorrect Answers
B:Login authentication alone does not supply per-command authorization decisions.
C:Syslog records events but is not the decision engine for command permission.
D:DHCP supplies client network options, not router administrative AAA rights.
Question 607
A proposed network design has this requirement: An AAA deployment records successful sessions and commands so changes can be traced to users and timestamps. Which choice is technically appropriate for that deployment?
- Enable only successful login authentication, with `aaa accounting` disabled, and expect every command to appear centrally.
- Configure an ACL blocking user traffic and assume it records privileged configuration commands by username.
- Disable network time synchronization and write all audit entries with arbitrary local clock times.
- Configure AAA accounting for admin sessions and relevant privilege-level command execution to a reachable TACACS+ server with reliable timestamps.
Explanation
Correct Answer
D:Accounting records who did what and when. Authentication and authorization alone can let changes happen without generating the requested command audit trail unless accounting method lists are also enabled.
Incorrect Answers
A:Authentication events do not by themselves create per-command accounting records.
B:Packet ACL logs are not the same as authenticated administrator command accounting.
C:Unsynchronized timestamps degrade event correlation and accountability.
Question 608
An IOS operator successfully logs in using TACACS+ and receives an EXEC shell. The AAA command-authorization server then rejects `configure terminal` because that user lacks configuration privileges. Which AAA function made the denial?
- Authorization denied the requested configuration command after successful authentication.
- Authentication failed to validate the username/password, so no login session formed.
- Accounting omitted the command from its audit record even though the command was allowed.
- The RADIUS server lost NTP synchronization and therefore blocks every packet without checking a command policy.
Explanation
Correct Answer
A:Authentication verified the identity and created the session. Authorization then evaluated permitted operations and denied `configure terminal`, which is precisely the post-login permission decision.
Incorrect Answers
B:The user is already in an EXEC session, so the identity authentication stage cannot be the cause of the later denied configuration command.
C:Accounting records actions and does not decide whether this command is permitted; authorization does.
D:Clock skew can affect some authentication mechanisms, but the evidence includes an explicit AAA command-authorization denial rather than an NTP problem.
Question 609
Troubleshooting report: An authenticated read-only user successfully logs in but cannot issue configure terminal because command permissions deny it. Which finding best accounts for the behavior?
- A successful login guarantees the user must be permitted every IOS command.
- The problem is necessarily an SSH cipher failure, although the user already has an authenticated EXEC session.
- The router DHCP lease is missing, causing only `configure terminal` to be denied after CLI login.
- The user authenticated successfully but authorization denies `configure terminal` because their granted role lacks privileged configuration rights.
Explanation
Correct Answer
D:AAA authentication and command authorization are separate stages. Read-only operators may log in to inspect allowed commands without obtaining configuration privilege.
Incorrect Answers
A:Identity verification does not imply unlimited authorization.
B:The secure login channel succeeded; the denial occurs at command authorization.
C:DHCP has no role in a post-login command permission check.
Question 610
An engineer successfully authenticates and configures a router, but there is no accounting record of the commands issued. The team should investigate which specific technical cause?
- Working login authentication automatically proves `aaa accounting commands` was enabled.
- The absence of logs means every executed configuration command was denied by authorization.
- The router’s native VLAN assignment alone determines which user commands appear on the TACACS+ accounting server.
- AAA accounting for relevant command levels was not enabled or bound to an effective reachable server/method list, so commands execute without central audit entries.
Explanation
Correct Answer
D:A device can authenticate/authorize an engineer while lacking session or command accounting. Verify actual `aaa accounting commands` configuration and server record delivery.
Incorrect Answers
A:AAA authentication and accounting are distinct services/configurations.
B:The engineer demonstrably configured the router; missing accounting means no record of that permitted action.
C:Switch trunk settings do not create AAA command-accounting policies.
