Cisco Certified Network Associate (CCNA) 200-301 Practice Test 65
Question 640
Two campus switches should allow VLANs 10 and 20 across the same role-based uplink. SW2 previously allowed VLAN 999 after an unauthorized manual edit. Following a desired-state automation run, which evidence most directly shows that drift has been corrected?
- Ansible reports no host unreachable, but there is no device configuration readback or compliance check.
- Both devices have recent backup files, but SW2 still allows VLAN 999.
- A postrun configuration diff and compliance report show SW1 and SW2 match the approved VLAN list, with the unauthorized VLAN 999 removed and any authorized exceptions recorded.
- The monitoring dashboard shows low CRC errors, even though SW2 still carries the unauthorized VLAN.
Explanation
Correct Answer
C:The acceptance test must verify actual device state, not merely that the automation engine ran. Checking both configurations against the version-controlled baseline shows convergence and makes approved exceptions auditable.
Incorrect Answers
A:Transport success alone does not prove the intended VLAN list was installed.
B:Fresh archives aid recovery but can preserve an incorrect live configuration.
D:Physical-frame quality does not validate trunk access-policy compliance.
Question 641
Two routers run OSPF over an established transit link. The network management dashboard is offline, but the routers continue exchanging LSAs and selecting routes. Which statement correctly describes who computes those forwarding paths?
- The dashboard alone calculates SPF and transmits a new FIB for every packet while OSPF routers remain passive.
- Each router independently runs its OSPF control-plane algorithm using learned LSDB information and installs its own forwarding entries.
- An Ethernet access switch decides the OSPF route solely by the destination MAC address of an incoming frame.
- The DHCP server installs all OSPF routes because it already advertises the local default gateway to clients.
Explanation
Correct Answer
B:In a traditional distributed control plane, participating routers form adjacencies, exchange topology information and calculate best paths locally. A separate management dashboard can observe or configure devices but does not have to calculate their OSPF SPF result.
Incorrect Answers
A:That is not how the described OSPF distributed control plane works.
C:Layer 2 MAC forwarding does not replace each router’s OSPF route calculation.
D:DHCP host configuration and router link-state path calculation are independent operations.
Question 642
A controller-based network application should deploy one approved access policy consistently to hundreds of managed switches. An engineer contrasts this with configuring every switch manually. Which architectural behavior is most characteristic of controller-based management?
- An application submits centralized policy intent to the controller, which translates and distributes appropriate device configurations through its supported southbound mechanisms.
- Every device stops using a local forwarding table and sends every user packet through the controller for a route decision.
- An OSPF Hello packet is used as the only way a management application can send policy intent to the controller.
- The controller automatically turns all existing Layer 2 access links into WAN serial circuits.
Explanation
Correct Answer
A:A controller can offer a common management plane where an application or operator defines intended network behavior once rather than repeating CLI changes by hand on every node. The controller maintains inventory and policy context and uses supported device integrations or southbound interfaces to apply concrete configuration or programming. Managed devices typically continue forwarding according to their installed local data-plane state, which must be verified after policy distribution. The change process should check deployment success, detect devices not reached, and confirm actual forwarding behavior. Centralized intent is a control/management architecture, not an assertion that user packets always traverse the controller itself.
Incorrect Answers
B:Controller-based management does not inherently remove every switch's local forwarding information base or require every user packet to travel to a central control service. Devices can continue forwarding with installed policies even during temporary management disconnection, depending on architecture. The controller's role is to coordinate configuration or control state.
C:OSPF Hello packets are routing-protocol control messages used to discover and maintain routing neighbors, not a general management application's northbound interface for submitting enterprise policy intent. A controller commonly exposes an API or management workflow for application requests, then programs managed devices using appropriate integrations.
D:The presence of a controller does not alter the physical medium of existing Ethernet links into serial WAN circuits. It can change logical configuration and policy across devices but does not perform physical cabling transformations. The architectural distinction is centralized intent and distributed configuration, not a new cable type.
Question 643
A controller-based campus system goes offline for five minutes. Existing switches continue forwarding previously programmed user traffic while operators cannot deploy a new access-policy intent. Which architecture assessment is most accurate?
- All data-plane packet forwarding necessarily stops on every device as soon as the management GUI is unreachable.
- A controller outage cannot affect network operations because controllers provide neither device management nor policy control.
- The controller is a management/control dependency for new policy operations, but a functioning distributed device data plane can continue forwarding installed rules during its outage.
- Every router automatically shuts down its OSPF neighbors when it loses a controller, even if the routing protocol runs locally.
Explanation
Correct Answer
C:Network controller outages do not necessarily interrupt all traffic immediately. Existing device forwarding tables can remain active independently of controller reachability, although future changes, telemetry, and policy convergence may be impaired depending on the product and design.
Incorrect Answers
A:The scenario directly demonstrates that devices retain working forwarding entries.
B:The inability to deploy new policy shows an important dependency despite existing forwarding continuity.
D:Traditional distributed neighbor adjacency is not inherently conditional on the controller GUI being online.
Question 644
A campus controller collects interface errors, client association health and device inventory from 140 switches/APs. Operations needs to correlate degradation across floors rather than inspect each device separately. Which capability provides that network-wide view?
- Provision identical VLAN IDs without collecting link or client telemetry.
- Aggregate authenticated multi-device telemetry and inventory in the controller, correlate events over time, and expose a consolidated assurance dashboard or API.
- Assume the controller runs OSPF SPF on behalf of every autonomous router regardless of the deployed network architecture.
- Collect one switch’s interface counters once per quarter and infer all wireless client issues from that single sample.
Explanation
Correct Answer
B:Controller-assisted operations centralize topology/context and collection while leaving individual devices responsible for observed forwarding. Correlated telemetry can identify common uplinks and time windows; it does not require the controller to transport ordinary user packets.
Incorrect Answers
A:Policy consistency alone does not create a health correlation dataset.
C:Distributed OSPF can calculate paths locally; the requirement is visibility and correlation, not route ownership.
D:That cannot provide timely, fleet-wide multi-source correlation.
Question 645
A branch router continues forwarding OSPF-learned traffic while the network-management dashboard is unreachable. A new engineer insists that the dashboard's central server must install every OSPF next hop and therefore all route entries should immediately disappear when the dashboard disconnects. Which misconception should be corrected?
- A controller can lose management connectivity while hardware forwarding entries remain programmed on an SDN switch.
- Traditional OSPF routers independently exchange routing information, compute routes, and install their own next hops rather than depending on a dashboard controller for each RIB update.
- Two routers with different OSPF areas might fail to become neighbors even while IP connectivity is present.
- A controller's inventory collection can lag behind the actual device configuration when telemetry stops.
Explanation
Correct Answer
B:OSPF is a distributed link-state routing protocol. Each participating router forms neighbor relationships, maintains a link-state database for its area, calculates shortest paths, and installs selected routes in its own routing information base. A management dashboard may monitor or configure routers, but it need not supply each OSPF next hop continuously. The observed forwarding while the dashboard is unreachable is compatible with normal distributed control. This scenario diagnoses an incorrect architectural assumption; the related verification question asks how to demonstrate each router's independent routing state.
Incorrect Answers
A:A controller-based design may continue forwarding previously programmed flows if its control session fails, depending on platform and policy. But that statement describes a possible controller architecture and persistence behavior rather than correcting the engineer's claim about this network's traditional distributed OSPF control plane. The routers in the scenario have already exchanged routes and continue using local routing and forwarding tables. The relevant distinction is who computes and installs those OSPF routes, not how SDN devices behave when central management is unavailable.
C:An OSPF area mismatch is a real adjacency problem: neighbors on the same transit link generally must agree on the area for proper formation. However, the question describes already learned routes continuing to forward after a dashboard outage, not missing neighbors or evidence of changed OSPF interface areas. Introducing a hypothetical area mismatch does not explain the engineer's belief that a central server must install all OSPF next hops. Inspect protocol adjacency only if real neighbor-state evidence suggests a routing fault.
D:Stale controller inventory can explain why a dashboard shows old device state after connectivity is lost. But the engineer's erroneous claim concerns routing-plane dependence: the dashboard is assumed to be the sole source of local OSPF next hops. Even perfectly fresh inventory would not make a distributed OSPF implementation controller-dependent. The correct architectural interpretation is that routers compute and maintain their own route choices, while centralized dashboards can provide orchestration and visibility without handling every forwarding decision.
Question 646
A controller-managed campus WAN loses IP connectivity from one branch edge to the controller. The branch continues forwarding with its last installed policy, but a new central QoS intent is not applied there. What is the most precise operational diagnosis?
- The loss of controller management connectivity necessarily deletes the branch's existing local forwarding table.
- Every branch must now learn an OSPF default route from the controller northbound API.
- The branch data plane can continue from installed state while its control/management-plane disconnection prevents new central intent from reaching it.
- The policy difference proves the branch's transceiver is receiving CRC errors on all ports.
Explanation
Correct Answer
C:The observation separates two planes: the branch continues forwarding with its last committed local state, while central changes do not arrive because the edge cannot reach its controller. Restoring authenticated controller reachability and checking configuration version, acknowledgments and device sync status is the appropriate next action. Then compare the intended QoS policy with the actual installed branch policy and apply any missed changes safely. A central orchestration system is not guaranteed to carry every data packet, and an unreachable controller does not automatically invalidate already programmed routes. This interpretation explains both continued service and missing newly requested policy without inventing an unrelated underlay or hardware fault; underlying transport still must be investigated to restore management.
Incorrect Answers
A:Many controller-based designs place forwarding decisions in local devices after configuration or programming. Losing contact with the controller need not erase already installed forwarding entries or immediately stop all user traffic. That is consistent with the observed continuing branch service. An absolute claim that all forwarding tables are deleted ignores the distinction between data-plane state and remote policy distribution.
B:A northbound API exposes controller capabilities or intent to applications; it is not inherently a routing protocol and cannot be assumed to inject OSPF defaults into every branch. The outage specifically concerns the channel used to deliver fresh centralized policy. Adding an OSPF route from the wrong interface is not a valid general explanation of stale controller-managed configuration.
D:CRC errors can explain physical-link corruption on an affected interface, but the question does not provide interface error counters or broad traffic failures. It states the data plane continues forwarding and specifically cannot receive new controller policy. Those facts point first to management-path reachability and synchronization. Hardware faults are possible root causes of path loss, but claiming universal CRC errors is not supported by the available evidence.
Question 647
During a controller outage, a campus switch still forwards users between existing VLANs, but the policy team cannot distribute newly approved ACL changes. A manager claims the controller failure must have stopped every existing packet. Which finding refutes that claim?
- All switch ASIC forwarding tables are necessarily erased the instant a controller loses an HTTPS session.
- The inability to create a new ACL proves the existing IP gateway addresses are all invalid.
- The switches retained installed forwarding/ACL state and continue forwarding existing permitted flows even though new centrally managed policy cannot be pushed.
- The observed forwarding must be performed by the controller’s own management HTTPS endpoint because the switches cannot make local decisions.
Explanation
Correct Answer
C:A data plane with installed forwarding state can often operate without a continuous management API session. Controller outage affects availability for new intent, monitoring and updates; it is not sufficient evidence of a complete packet-forwarding outage.
Incorrect Answers
A:Controller reachability and local hardware forwarding tables are distinct; no such clearing is supported by the observed traffic.
B:The incident documents a new-policy management failure, not invalidated live gateways.
D:Previously installed device forwarding remains operational in the scenario.
Question 648
After TACACS credentials for a telemetry collector were rotated, a switch stops sending fresh interface counters to a central network dashboard. The dashboard still displays its last healthy snapshot as current. Which failure mode explains the misleading green state?
- All monitored interfaces are conclusively healthy because the last dashboard sample was green.
- The OSPF control plane has automatically converted telemetry into up-to-date counters.
- The switch must be physically disconnected, even though local interface counters still update.
- Telemetry ingest is stale because device access failed after the credentials change; freshness timestamps must be checked.
Explanation
Correct Answer
D:The credential change breaks collection, so the dashboard has old data rather than current evidence. Restoring authenticated telemetry and showing sample age corrects the misleading state.
Incorrect Answers
A:A previous successful observation cannot prove current device health when collection has stopped.
B:Routing protocols do not refresh an independent telemetry datastore without the collection pipeline.
C:Collection failure may be administrative rather than a physical disconnect; the evidence points to stale telemetry.
Question 649
A network team wants to demonstrate that the branch remains a traditional distributed OSPF network even when its management dashboard is disconnected. Which observation provides the most direct proof from the routers themselves?
- A configuration-management job exits successfully without showing any router routing table.
- The network controller's last saved topology includes both routers, but live management connectivity is unavailable.
- Each router's local `show ip route ospf` shows installed OSPF prefixes and `show ip ospf neighbor` confirms the expected live adjacency.
- A switch MAC address table shows the branch routers' interface MAC addresses on an access VLAN.
Explanation
Correct Answer
C:The `show ip ospf neighbor` output establishes that the expected adjacency is present, while `show ip route ospf` confirms that locally selected OSPF routes are installed in the router's RIB. Collecting these observations on both routers demonstrates the per-router distributed control behavior under examination. This verification question is distinct from the conceptual fault diagnosis: it asks for the actual state proving independent protocol operation rather than simply naming the misconception. If the management dashboard is offline, locally collected protocol and route evidence is still available.
Incorrect Answers
A:A successful configuration-management run indicates that automation commands may have completed, but it does not demonstrate that each router currently holds live OSPF-learned routes or a working adjacency. An orchestrator can return success for a different set of tasks while the routing plane is unhealthy. The requirement is to prove distributed OSPF operation independently of the dashboard, so evidence should come directly from routers' protocol neighbor state and installed routes. Configuration job logs can supplement, but cannot substitute for, routing-plane inspection.
B:An offline or cached controller topology is historical information about inventory or connectivity. It may be accurate, but it cannot show that routers are currently exchanging LSAs or that their forwarding choices are installed. When the dashboard is disconnected, trusting its last view would recreate the faulty assumption that central management is authoritative for every route. Direct CLI or equivalent on-device protocol inspection is needed to establish active router-local OSPF state, regardless of whether a monitoring controller is presently reachable.
D:A switch's MAC address table can show which local ports have learned frames sourced from the routers' Layer 2 interfaces. It does not reveal OSPF neighbor state, routing advertisements, shortest-path calculations, or the routes installed in either router's RIB. MAC learning may continue while a routing adjacency is down. Because the acceptance test concerns distributed routing control, a switch forwarding table is an inadequate proxy. Inspect on-router OSPF neighbors and OSPF-learned routes instead.
Question 650
An SDN controller shows an approved ACL policy for a switch group, but one group was omitted from deployment and retained older forwarding rules. Which check best confirms the discrepancy has been repaired?
- Confirm controller deployment status for every targeted device and inspect each affected device's installed ACL/forwarding policy against the approved intent.
- Open the controller's policy design screen and assume a saved policy must already be running everywhere.
- Check only that the controller management IP answers ICMP echo from an administrator's laptop.
- Disconnect the controller temporarily and infer that all past policy pushes succeeded if other switches still forward traffic.
Explanation
Correct Answer
A:Intent stored centrally is not proof that each intended switch received or installed it. Correlating per-device push success with the actual programmed ACL state catches omissions and deployment failures; traffic tests on representative relevant flows can add end-to-end confirmation.
Incorrect Answers
B:A saved intent object describes desired policy, not confirmed device application. The original fault explicitly occurred after a missed deployment to a device group.
C:Management-plane reachability to the controller does not reveal whether a particular switch group successfully installed a matching ACL. The failing control is configuration distribution.
D:Many devices forward existing traffic when their controller is unavailable, which says little about whether their ACL configuration was updated before the outage. Forwarding independence is not deployment verification.
