Cisco Certified Network Associate (CCNA) 200-301 Practice Test 62
Question 610
An engineer successfully authenticates and configures a router, but there is no accounting record of the commands issued. The team should investigate which specific technical cause?
- Working login authentication automatically proves `aaa accounting commands` was enabled.
- The absence of logs means every executed configuration command was denied by authorization.
- The router’s native VLAN assignment alone determines which user commands appear on the TACACS+ accounting server.
- AAA accounting for relevant command levels was not enabled or bound to an effective reachable server/method list, so commands execute without central audit entries.
Explanation
Correct Answer
D:A device can authenticate/authorize an engineer while lacking session or command accounting. Verify actual `aaa accounting commands` configuration and server record delivery.
Incorrect Answers
A:AAA authentication and accounting are distinct services/configurations.
B:The engineer demonstrably configured the router; missing accounting means no record of that permitted action.
C:Switch trunk settings do not create AAA command-accounting policies.
Question 611
A network acceptance test follows this reported failure: A login fails because submitted credentials do not validate even though the user's intended privilege assignments are correct. Which verification most specifically demonstrates the repaired function rather than checking an unrelated feature?
- A valid known user now successfully authenticates using the intended AAA method and invalid credentials are rejected, while authorization remains separately correct.
- The user still fails password validation, but the operator reads a correct privilege assignment in the AAA server.
- The device can ping the AAA server, but credentials still get rejected with an explicit auth failure.
- A different user can configure terminal while the affected user’s credentials remain invalid.
Explanation
Correct Answer
A:The previous failure was identity credential validation, not command privilege. Check authentication server/local method results and a controlled invalid-login test, not just a post-login authorization policy.
Incorrect Answers
B:Authorization definitions cannot repair a failed initial authentication exchange.
C:IP reachability does not imply username/password/certificate acceptance.
D:Another account’s success cannot verify the intended login was repaired.
Question 612
A network operator logs in successfully using TACACS+ but is denied `configure terminal`. The administrator wants to prove the denial comes from a specific server command-authorization policy rather than from SSH transport failure. Which evidence most directly answers that question?
- Check only whether TCP port 22 completed the SSH handshake on the router.
- Change the operator's password and assume that a successful new login grants every IOS command.
- Inspect the TACACS+ authorization decision for the attempted command and the matching device AAA method list, including permit/deny attributes and the user identity.
- Inspect the subnet's DHCP relay address and treat a valid lease as proof of command authorization.
Explanation
Correct Answer
C:A successful TACACS+-authenticated login establishes identity, but command authorization can still deny a requested privileged operation. To verify this specific denial, inspect the device's configured AAA command authorization path and the server reply for the attempted command, including the user, command and returned permission result. Logs or debug output should be handled carefully to avoid exposing sensitive data. This evidence distinguishes a deliberate policy decision from a terminal transport outage. The answer tests verification of the authorization response, whereas simply observing a denied command identifies the symptom. Accounting records are useful complementary evidence if enabled.
Incorrect Answers
A:Successful SSH negotiation proves that encrypted terminal transport and basic connectivity work; it does not establish that the authenticated principal has permission for `configure terminal`. The operator already logged in. Command authorization occurs after identity verification and must be checked in the TACACS+ method list and policy response.
B:Password renewal may change authentication credentials, but a user can authenticate successfully and still lack command-level authorization. The incident explicitly occurs after login, so assuming another successful password check will unlock all commands confuses authentication with permission evaluation. Inspect the server's authorization rules.
D:DHCP relay controls how clients obtain IPv4 configuration from servers on other networks. A valid lease says nothing about whether an administrator is authorized to enter IOS configuration mode through TACACS+. The relevant evidence is the AAA command authorization exchange and the device's method list.
Question 613
The earlier fault was recorded as follows: An engineer successfully authenticates and configures a router, but there is no accounting record of the commands issued. After corrective work, which observation provides direct evidence that the affected function now behaves correctly?
- The user logs in and changes configuration, but the server still has no accounting entries for the actions.
- The TACACS+/AAA accounting server now receives records with the operator identity, successful session and executed privileged commands with usable timestamps.
- Only authorization rules are listed while `aaa accounting commands` remains disabled.
- A switch syslog says the link came up, but no user command identity or timestamp is recorded centrally.
Explanation
Correct Answer
B:The original engineer was able to make changes with no command audit. Confirm actual server records for a controlled test command and verify configured accounting coverage on the device.
Incorrect Answers
A:AAA authentication establishes the operator’s identity, but accounting separately records session or command activity. A successful login and configuration change with no command accounting entry proves that the audit-trail requirement still has not been met.
C:Permission rules do not by themselves generate command records.
D:General interface event logging is not proof of requested administrative accounting.
Question 614
A network security analyst is evaluating a deployment. A WLAN refresh should avoid outdated WPA/TKIP and use current approved encryption and authentication. What approach correctly addresses the stated requirement?
- Use WEP shared-key encryption because its short key improves client joining speed.
- Keep WPA with TKIP as the sole cipher for newly deployed production clients despite modern alternatives.
- Create an open WLAN and call it equivalent to WPA3 SAE because both broadcast an SSID.
- Select supported WPA3-Personal SAE with PMF where clients permit, or approved WPA2 AES-CCMP for necessary legacy compatibility; retire WEP and WPA/TKIP.
Explanation
Correct Answer
D:Modern Wi-Fi protection uses robust authentication/key agreement and CCMP/GCMP ciphers as supported. Legacy TKIP and WEP have known security limitations and should not be used in new production designs.
Incorrect Answers
A:WEP is obsolete and cryptographically weak.
B:TKIP was transitional and does not meet current stronger Wi-Fi security expectations.
C:SSID visibility is not authenticated/encrypted wireless key agreement.
Question 615
A campus WLAN must authenticate each employee using a centrally managed identity and distinct credentials so a departing employee can be revoked without changing a shared password for every station. The controller and clients support WPA3-Enterprise and 802.1X. Which security model should be selected?
- Deploy WPA3-Enterprise using 802.1X/EAP with an approved RADIUS authentication service and per-user credentials or certificates.
- Deploy WPA3-Personal SAE with the same shared passphrase on every employee device as the sole identity control.
- Enable WPA2-Personal with one common PSK and disable 802.1X so administrators can revoke individual users by changing only one account.
- Enable an unauthenticated open SSID and hide the name so corporate device identities are checked automatically.
Explanation
Correct Answer
A:Enterprise WLAN authentication uses 802.1X/EAP and an authentication server such as RADIUS to validate distinct user or device identities. WPA3-Enterprise supports centrally managed accounts and controlled revocation without rotating one passphrase on every station. The specific EAP method and server certificate validation must align with the organization’s policy.
Incorrect Answers
B:SAE strengthens WPA3-Personal password-based handshakes, but a common network passphrase is not a separate centrally managed employee identity and cannot revoke just one former worker without further controls.
C:A single shared WPA2 PSK is not a substitute for 802.1X per-person authentication. Disabling 802.1X removes the required centralized identity check rather than enabling individualized revocation.
D:Not advertising the SSID is not authentication. An open WLAN has no 802.1X identity exchange under the proposed settings and does not enforce the stated employee credential requirement.
Question 616
A wireless design requires WPA3-Personal rather than legacy WPA2-PSK and wants resistance to offline password guessing based solely on captured handshakes. Which authentication exchange should the WLAN use when its clients support WPA3-Personal?
- Simultaneous Authentication of Equals (SAE), with the required WPA3 protection settings.
- Legacy WEP shared-key authentication with 40-bit encryption to maximize compatibility.
- WPA2 pre-shared-key four-way handshake only, with WPA3 SAE disabled on the WLAN.
- Open-system association with no authentication because AES encryption alone identifies clients.
Explanation
Correct Answer
A:WPA3-Personal uses SAE, a password-authenticated key-exchange method intended to provide improved protection against passive offline dictionary testing compared with a captured legacy WPA2-PSK exchange. Supported clients and infrastructure must negotiate the appropriate WPA3-Personal authentication and protections, including required Protected Management Frames in a WPA3-only mode. Confirm the WLAN security profile and actual association negotiation rather than assuming an SSID name implies WPA3. SAE does not excuse weak password management, device firmware vulnerabilities or endpoint authorization, but it is the specific exchange requested for the design objective.
Incorrect Answers
B:WEP is an obsolete wireless security mechanism with widely understood cryptographic weaknesses. Choosing it for compatibility would substantially weaken the WLAN and is unrelated to the modern SAE requirement. WPA3-Personal-capable clients should use the specified negotiated protection rather than downgrade to legacy WEP authentication.
C:A WPA2-PSK handshake can provide confidentiality when correctly configured with strong cipher settings, but it is not WPA3-Personal's SAE exchange. Captured WPA2-PSK material can permit offline passphrase verification in ways that SAE is designed to resist. Disabling SAE contradicts the explicitly stated WPA3-Personal design requirement.
D:AES is a cipher used as part of a wireless protection suite, but encryption alone does not identify an authorized client or perform the requested password-authenticated exchange. An open association without appropriate authentication would not meet the WPA3-Personal policy. Configure SAE and verify negotiated security mode and PMF.
Question 617
A WLAN is upgraded from legacy WPA/TKIP to WPA2-Personal with AES-CCMP only. Current phones join and use AES, but a ten-year-old barcode scanner can advertise only WPA/TKIP in its wireless capability list and fails at the security-negotiation stage. Which diagnosis fits the difference between successful and failed clients?
- The scanner does not support the mandatory AES-CCMP security suite, so it cannot negotiate the upgraded WPA2-only WLAN profile.
- The controller has confused the terms threat source and vulnerability in its security report.
- The barcode scanner is blocked by a physical access-control reader at the building entrance.
- The Cisco device accepted SSH login but denied a privileged command through TACACS+ authorization.
Explanation
Correct Answer
A:WPA used TKIP for backward compatibility, while WPA2 commonly uses AES-CCMP. If a legacy scanner only advertises WPA/TKIP and the WLAN requires WPA2/AES-CCMP, the client and controller lack a mutually supported security suite. Its failure at the security-negotiation stage while current devices connect provides direct compatibility evidence. Maintain the approved secure mode, identify a supported scanner firmware upgrade or replacement, and avoid re-enabling obsolete ciphers for production merely to accommodate an unsupported endpoint. Confirm client capabilities and controller security settings before blaming RF strength.
Incorrect Answers
B:Classifying threats and vulnerabilities correctly supports security analysis, but an imprecise report cannot itself explain this observed 802.11 capability mismatch. The old scanner advertises only a legacy cipher and authentication combination; the controller requires a modern one. A terminology error would not change the client's association negotiation messages. To restore compatibility, assess supported security suites and device upgrade options instead of revising an unrelated risk document or ignoring the actual capabilities in the wireless frames.
C:Physical access-control devices govern entry to facilities and may use badge readers or monitoring. The incident, however, describes a barcode scanner communicating over Wi-Fi and failing when the security negotiation reaches WPA2/AES requirements. No building access event is involved. The scanner's presence at the site and successful RF detection do not override the controller's cipher requirements. Investigating door-access logs would not explain a rejected wireless security association; compare wireless security capabilities and policy.
D:TACACS+ command authorization applies to administrator actions on network devices after authentication and is unrelated to a handheld scanner's 802.11 security suite negotiation. The scanner is not attempting a privileged IOS command; it is attempting to join a WLAN using a cipher the updated policy no longer accepts. Command-permission errors would appear in management AAA logs rather than at the radio handshake. Use WLAN client security events and advertised capabilities, not device administrator authorization, for this diagnosis.
Question 618
Clients use the correct SSID and strong signal but cannot complete the WPA2 key handshake because the PSK differs. The team should investigate which specific technical cause?
- A strong RSSI guarantees the client used the correct WPA2 key.
- The client and WLAN have mismatched WPA2-Personal PSKs, so the four-way key handshake fails despite successful RF discovery/association.
- An IP default gateway mismatch causes the 802.11 four-way handshake to fail before secure association.
- The WLAN must have a wrong broadcast SSID because the correct SSID is observed in scans.
Explanation
Correct Answer
B:WPA2-PSK security relies on matching derived key material. A client can see a strong SSID and begin association while failing authentication/key confirmation because its passphrase differs.
Incorrect Answers
A:Signal strength does not validate the key material.
C:Default-gateway IP is relevant after link-layer authentication, not a key mismatch explanation.
D:The evidence identifies a PSK key mismatch after SSID discovery.
Question 619
A network security analyst must explain an outage. A client restricted to WPA2-PSK cannot authenticate to an SAE-only WLAN because the security methods are incompatible. Which diagnosis follows from these observations?
- The WPA2-only client can always complete SAE automatically because both standards use AES.
- Changing the client DNS server makes an SAE-only WLAN accept a PSK-only security exchange.
- The client supports only WPA2-PSK, but the WLAN requires WPA3-SAE; upgrade client security support or use an explicitly approved transition SSID with evaluated risks.
- Disable the AP radio and assume WPA3-SAE authentication becomes compatible.
Explanation
Correct Answer
C:WPA3-Personal SAE and WPA2-Personal PSK are different authentication/key agreement modes. A WPA2-only station cannot complete an SAE-only WLAN association without compatible hardware/software policy.
Incorrect Answers
A:The authentication/key agreement method still differs even if data encryption primitives overlap.
B:DNS is independent of wireless association authentication negotiation.
D:No radio service cannot provide successful client association.
Question 620
After replacing or upgrading the legacy barcode scanner, the controller's WLAN profile still requires WPA2 with AES-CCMP. The rollout owner needs confirmation that the new scanner is not silently falling back to WPA/TKIP. Which observation directly confirms the negotiated wireless protection?
- The scanner receives an IP address through a site-to-site VPN, with no WLAN association details.
- The controller client detail and wireless association security record show the scanner negotiated WPA2 with AES-CCMP for its active session.
- The access switch MAC address table includes one sticky address for the scanner's uplink.
- A door-access camera records the scanner operator entering the storage room.
Explanation
Correct Answer
B:The controller's current client association record can show the actual negotiated authentication mode and pairwise cipher. For this rollout it must report WPA2 and AES-CCMP on the scanner's live session, not merely those options saved in the WLAN profile. That ties the configured policy to operational behavior and confirms the replacement device supports the required security suite. Verify the correct client MAC, SSID, session time, and active cipher so a stale or unrelated record cannot satisfy the acceptance test.
Incorrect Answers
A:An IP address or a VPN route can demonstrate that some network path works, but it does not identify the 802.11 authentication and cipher suite negotiated over the WLAN. A device might obtain an address through a weaker wireless profile or a different interface. Because the acceptance criterion specifically excludes legacy WPA/TKIP fallback, the evidence must name the associated client and its active negotiated security mode. IP reachability is a useful later check, not a substitute for connection security details.
C:Port Security sticky MAC learning is a switchport access control that can restrict endpoint source MAC identities. It says nothing about which wireless cipher an associated client negotiated, and an access-switch MAC table may represent traffic from an AP uplink rather than the scanner's direct radio session. Even correctly learned MAC addresses can coexist with an insecure WLAN association. The relevant proof comes from the WLAN controller's client security details or corroborating wireless handshake evidence, not an Ethernet source-MAC limit.
D:A camera or physical access log can support facility security and accountability, but neither validates an 802.11 cipher negotiation. The scenario concerns a scanner's active WPA2 association and whether the session uses AES-CCMP rather than legacy TKIP. Physical entry records cannot answer that question, even if they identify the person operating the scanner. Record wireless controller security state for the device, then separately assess any physical access controls required by the facility.
