Cisco Certified Network Associate (CCNA) 200-301 Practice Test 64
Question 630
A Cisco wireless controller GUI is configured for WPA2-Personal with a pre-shared key and AES-CCMP. A client successfully joins the SSID. Before approving the WLAN, the security administrator must confirm that it is not using legacy TKIP encryption. Which evidence directly demonstrates compliance?
- The SSID name appears in an over-the-air beacon without cipher information
- The client receives a DHCP lease after association, without any negotiated security details
- The controller client session reports WPA2-PSK with the negotiated CCMP/AES data cipher
- A basic controller log entry says the client joined but omits the pairwise cipher suite
Explanation
Correct Answer
C:The controller session information showing WPA2-Personal/PSK with CCMP/AES is direct evidence that this client is using the intended pairwise data confidentiality mechanism. WPA2-Personal authenticates the client using the shared secret and normally performs a four-way handshake before protected data traffic is exchanged. CCMP is the AES-based cipher suite required by this design, whereas TKIP is a legacy protection mechanism that the security policy excludes. Examine the negotiated session or capture, not merely the saved WLAN profile, and test an actual associated client to ensure the active connection matches the authorized security posture.
Incorrect Answers
A:A wireless beacon may expose the network name and capabilities, but the visible SSID alone does not establish what pairwise encryption a particular associated client actually negotiated. Multiple security policies and clients can share an SSID across operational changes. The requirement is to prove that TKIP was not used for this session. Inspect session security details or an equivalent capture that identifies the negotiated cipher suite rather than relying on network name discovery.
B:Obtaining an IP address through DHCP indicates that some Layer 2 connectivity and DHCP communication succeeded, but it is not proof of the negotiated Wi-Fi data cipher. A network can issue leases through a WLAN even when its security design permits an unwanted legacy algorithm. The security question concerns WPA2-PSK encryption specifically. DHCP lease state is useful in a separate client-connectivity investigation but cannot establish whether CCMP/AES was negotiated.
D:A successful join event without pairwise-cipher details only shows that the controller accepted a client association; it leaves open the security protocol and encryption actually used. A policy might advertise multiple transition choices, and logging labels can omit the cryptographic distinction important to the audit. To demonstrate exclusion of TKIP, the evidence must name the negotiated AES-CCMP cipher for the client session or show equivalent validated handshake data.
Question 631
An operator edits the running configuration on 35 switches every week. A switch fails after a bad image upgrade, and the team discovers it has no recent copy of that switch's configuration. Which automation change directly addresses the recovery risk?
- Increase the syslog severity threshold so fewer routine configuration events are recorded.
- Schedule authenticated, versioned configuration backups after changes and verify restore data is available for each switch.
- Remove all access controls on the switches so backup jobs never encounter an authentication failure.
- Configure OSPF neighbors to share one router ID so the backup server learns their combined configuration.
Explanation
Correct Answer
B:Repeatable configuration backup automation reduces dependence on an engineer remembering to save each device's current approved state. A job can retrieve running or startup configuration using an authorized management protocol, store versioned snapshots with device identifiers and timestamps, and check that every expected device is covered. Protect backup credentials and sensitive configuration values. For disaster recovery, periodically test restoration and verify that a retrieved version corresponds to the intended device and pre-change state. Merely scheduling a transfer is insufficient if it silently fails or captures the wrong artifact. A versioned repository also helps identify unintended configuration drift.
Incorrect Answers
A:Syslog severity controls event filtering and logging visibility, which is useful for monitoring but does not produce a recoverable configuration snapshot. Reducing event volume could remove evidence while leaving the failed switch with no saved commands. The stated risk is missing restore material after a change, so implement verified backups.
C:Removing access controls to make a job succeed introduces a major security weakness and is unnecessary for authenticated backup automation. A service account can be authorized for the required read and storage operations without granting unrestricted management access. Diagnose permission failures explicitly while retaining least privilege and protected credentials.
D:OSPF router IDs identify routing processes; duplicates can disrupt protocol operation and do not combine device configuration states into a usable backup. A backup system should retrieve individual device configuration files and maintain unique identities. Routing adjacency does not replace configuration archive storage.
Question 632
A deployment system manages 120 campus switches. An approved baseline requires only VLANs 10 and 20 on the user-uplink trunk and a standard management ACL. Two switches were hand-edited to allow VLAN 999. What automation design best prevents this policy drift while preserving approved exceptions?
- Schedule only nightly `show version` collection, leaving all trunk and ACL configuration unmanaged.
- Run a one-time manual configuration session on only the original two devices and stop checking for subsequent changes.
- Store the desired trunk/ACL configuration in a reviewed version-controlled template, detect differences per device, and converge out-of-policy devices with an exception register.
- Overwrite every running configuration with one unreviewed file, including documented site-specific exceptions.
Explanation
Correct Answer
C:A consistent desired-state template lets the operator compare each device with the authoritative policy and repair unauthorized differences. Approved exceptions must be explicit so automation does not overwrite intentional site-specific differences. Version control and diff results provide review evidence.
Incorrect Answers
A:Version telemetry cannot reconcile the allowed-VLAN or management ACL settings that actually drifted.
B:A one-off action may repair today’s variance but does not prevent or detect recurring fleet drift.
D:Blind replacement can remove valid local settings and cause outages; audited convergence should respect approved exceptions.
Question 633
Operations discovers that a fiber uplink has been accumulating CRC and optical power warnings for 40 minutes, but no automatic notice was raised. The team wants device-neutral recurring collection and threshold-based alerts for the next incident. Which automation approach addresses that requirement?
- Push the same access VLAN template to every device at midnight but never collect interface telemetry.
- Poll or subscribe to supported interface counters and optical telemetry through an authenticated monitoring API, timestamp the samples, and alert on validated deltas or thresholds.
- Take a one-off configuration backup after each planned change, but inspect interface statistics only when a user calls.
- Disable polling and suppress fault logs so dashboards display only healthy devices.
Explanation
Correct Answer
B:The missing capability is timely operational observation, not configuration deployment. Programmable polling or streaming telemetry yields timestamped measured values; an alert needs a meaningful counter rate or threshold, correlation with link state, and a chosen collection interval.
Incorrect Answers
A:Uniform configuration does not reveal rising optical errors or CRC deltas on an existing uplink.
C:Versioned backups aid recovery but do not implement recurring fault detection.
D:Removing observations hides degradation rather than satisfying the monitoring requirement.
Question 634
A revised access ACL has passed the lab test but has not run on production routers. The change affects all 60 branches, and an incorrect deny would block remote support. Which automation release process best limits the impact of an unexpected error?
- Apply the unverified ACL to all 60 branches at once and investigate only after business users report failures.
- Verify that the SSH login banner contains the maintenance ticket number and skip data-plane and management reachability tests.
- Run prechecks, deploy to a small canary group, verify management and application reachability, then expand in stages with tested rollback and stop-on-failure gates.
- Run an SNMP read-only poll after the entire fleet push and assume it can automatically reverse a broken access list.
Explanation
Correct Answer
C:Canary rollout and explicit acceptance checks restrict the affected sites if an ACL rule behaves unexpectedly. Save known-good device configurations and preserve an out-of-band recovery path where possible. A rollback plan must be operational rather than just documented.
Incorrect Answers
A:A simultaneous push multiplies the blast radius and provides no safe decision point before widespread impact.
B:Ticket labeling is not proof that the ACL still permits required flows.
D:Telemetry alone is not a prevalidated rollback or staged change control mechanism.
Question 635
A branch router was upgraded overnight. Its new software cannot load the startup configuration, but the only available backup was manually saved six months earlier. The nightly automation job was never configured to capture post-change versions. What is the main recovery-process defect?
- The branch has no recent restorable configuration snapshot because backups relied on manual exports and did not run after approved changes.
- The platform has configuration drift because two healthy switches advertise different allowed VLAN lists.
- The routing table prefers OSPF over a static route because its administrative distance is smaller.
- The monitoring poll interval was too long to detect packet drops, but a complete recent configuration backup exists.
Explanation
Correct Answer
A:The backup evidence is stale relative to the most recent working state. A versioned backup after changes—validated by checksum or a controlled restore test—provides recovery data for failed upgrades. The observed problem is not an interface counter or routing protocol error.
Incorrect Answers
B:No inconsistent peer policy is described; the missing artifact is the pre-upgrade configuration for this router.
C:No route-selection observation explains why the latest device configuration cannot be restored.
D:This contradicts the finding that no recent restorable copy exists.
Question 636
An organization uses an approved automation repository to configure NTP on 80 routers. Two engineers later apply local CLI changes to three routers. The next compliance check finds the live NTP server settings differ from the declared repository. What issue has the automation team identified?
- A required OSPF DR election because NTP addresses are different router IDs.
- An IP fragmentation problem because the repository's YAML files contain multiple lines.
- Configuration drift from out-of-band manual edits; compare live device state with the approved desired configuration and reconcile changes.
- A DHCP lease renewal problem that can be fixed by shortening every router interface's address lifetime.
Explanation
Correct Answer
C:Configuration drift occurs when deployed state diverges from the approved intended configuration. Here the repository still describes the authorized NTP servers, but three devices have different live values after untracked local CLI edits. An automation compliance or diff task should identify the precise resource and value differences, record whether the manual changes were authorized, and either update the declared source of truth through change control or restore the approved configuration. Running the same successful playbook repeatedly is not enough if it fails to detect device-specific deviations. Preserve evidence of both actual and desired states for traceability and rollback.
Incorrect Answers
A:OSPF designated-router election is based on eligible interface priority, router ID and network type, not on the hostname or address of an NTP server in a configuration repository. The incident describes a desired-versus-live configuration mismatch caused by manual edits. An OSPF election would not reconcile that drift.
B:YAML is a structured text format frequently used for automation inputs; having multiple lines in a configuration file is not an IP fragmentation event. IP fragmentation concerns packets and path MTUs. The mismatch is between declared NTP configuration and actual router settings, so investigate configuration enforcement.
D:DHCP lease renewal governs temporary client address configuration, whereas these routers have manual changes to NTP server settings. Shortening address lifetimes does not compare live management configuration with desired state. An authorized automation diff and controlled reconciliation directly address the issue.
Question 637
Interface CRC and optical error counters began increasing at 14:02, but the monitoring platform only polls these counters every 60 minutes and sent the first alert at 15:00. No event-driven alarm was configured. Which failure mode primarily explains the alert delay?
- An incorrectly selected router ID prevented two OSPF neighbors from reaching FULL, so the CRC alarm was delayed.
- The fleet’s startup configurations were not backed up after an image upgrade, so the fault is unobservable.
- All switches were configured with different VLAN allowed lists after a manual emergency change.
- Infrequent collection and absent event-driven telemetry postponed detection of a measurable interface fault.
Explanation
Correct Answer
D:The underlying fault existed in device counters long before the alert. Poll interval and event-notification design determine when the monitoring system observes a change; this is distinct from an automation deployment failure. Shorter adaptive polling or supported event/streaming notifications can improve timeliness.
Incorrect Answers
A:The problem statement directly identifies the one-hour sampling schedule; OSPF identity is unrelated to counter collection.
B:Lack of backups impairs restoration, but the counters were visible and simply sampled too slowly.
C:A trunk policy mismatch is a separate drift problem, not the documented sampling delay.
Question 638
An automation job pushes a new ACL simultaneously to 85 branch routers. The rule accidentally denies the management network, all SSH sessions fail, and there was no tested rollback channel. Which process defect turned one bad rule into a network-wide incident?
- The issue was lack of SNMP interface polling, which automatically causes an ACL to drop SSH.
- The routers used equal OSPF costs, so an access list could not match the management subnet.
- A configuration archive was created before rollout, therefore the simultaneous mass push could not cause an outage.
- An unbounded all-at-once change without canary validation, stop conditions or a reachable rollback path amplified a single ACL mistake.
Explanation
Correct Answer
D:Automation can spread a defect as quickly as a legitimate change. Staged releases with representative tests, rollback prechecks and independent recovery access reduce blast radius. The root failure is change orchestration, not that all routers independently developed unrelated faults.
Incorrect Answers
A:Monitoring frequency affects when the failure is noticed; it does not install the incorrect access rule.
B:OSPF route metrics are not the cause of a policy blocking the stated SSH traffic.
C:A backup alone does not prevent a destructive rollout or guarantee recovery when management access is lost.
Question 639
After discovering stale router backups during a failed upgrade, the team enables automated configuration archiving after every approved change. Which validation proves those archives could support recovery for the affected router?
- Verify that the backup scheduler exists, although its output directory is empty.
- Ping the monitoring server once and conclude the switch startup configuration is archived.
- Inspect the latest timestamped version for that router, compare its captured configuration to the known-good change, and perform a controlled restore or parse validation.
- Compare two switches’ allowed VLAN lists while ignoring whether the failed router has a current recovery copy.
Explanation
Correct Answer
C:A job’s success flag without a useful artifact is insufficient. Recovery depends on having the correct device configuration, revision identity and a restorable format; a controlled test can establish that the backup can actually be consumed.
Incorrect Answers
A:Configured scheduling does not prove that any recovery data has been captured.
B:IP reachability does not validate saved configuration contents or revision freshness.
D:Compliance checks are useful for drift, but do not establish restorable router backups.
Question 640
Two campus switches should allow VLANs 10 and 20 across the same role-based uplink. SW2 previously allowed VLAN 999 after an unauthorized manual edit. Following a desired-state automation run, which evidence most directly shows that drift has been corrected?
- Ansible reports no host unreachable, but there is no device configuration readback or compliance check.
- Both devices have recent backup files, but SW2 still allows VLAN 999.
- A postrun configuration diff and compliance report show SW1 and SW2 match the approved VLAN list, with the unauthorized VLAN 999 removed and any authorized exceptions recorded.
- The monitoring dashboard shows low CRC errors, even though SW2 still carries the unauthorized VLAN.
Explanation
Correct Answer
C:The acceptance test must verify actual device state, not merely that the automation engine ran. Checking both configurations against the version-controlled baseline shows convergence and makes approved exceptions auditable.
Incorrect Answers
A:Transport success alone does not prove the intended VLAN list was installed.
B:Fresh archives aid recovery but can preserve an incorrect live configuration.
D:Physical-frame quality does not validate trunk access-policy compliance.
