Cisco Certified Network Associate (CCNA) 200-301 Practice Test 67
Question 660
Following a tenant overlay repair, two edge endpoints remain reachable at the IP layer and both are configured for tenant 20. Before the repair VTEP1 sent VNI 10020 but VTEP2 expected 10010. Which observation proves that this tenant-mapping fault is corrected?
- Both endpoints associate tenant 20 with the same approved VNI, and captures of actual tenant frames show that VNI across the reachable tunnel while cross-tenant isolation holds.
- Ping the two outer tunnel endpoint addresses only, without examining inner tenant frames or the VNI.
- Read a controller northbound API version number without observing device tunnel state.
- Confirm that a separate OSPF adjacency is FULL while VTEP2 still maps tenant 20 to the wrong VNI.
Explanation
Correct Answer
A:Underlay reachability alone was already healthy. The acceptance evidence must include matching VNI mapping and actual encapsulated tenant frames in the correct logical segment; checking that unrelated tenants remain isolated rules out an accidental shared overlay.
Incorrect Answers
B:That test succeeded before the repair and cannot establish corrected logical segmentation.
C:An API version does not prove the VNI applied on either VTEP.
D:Routing is orthogonal to the stated overlay identifier mismatch.
Question 661
A network operations team has a year of labeled optics and interface-error history. It wants to identify ports likely to fail within the next week rather than merely report current down/up state. Which analytics capability best matches this goal?
- Send only a periodic `show interfaces status` command and conclude the current up state proves no failure can occur soon.
- Treat every high-traffic interval as a confirmed physical failure with no labeled training or evaluation.
- Train and evaluate a predictive ML model on historical features such as optical power, corrected-error trends and utilization, then alert on elevated failure risk.
- Use a generative incident summarizer to invent missing link-history samples so the forecast dataset appears complete.
Explanation
Correct Answer
C:Supervised predictive analysis learns associations between historical measurements and later failures. It produces probability or risk estimates rather than proof of a future fault, so the team must validate predictions, false positives and drift against subsequent real outcomes.
Incorrect Answers
A:Current state inspection does not forecast degradation from historical signals.
B:Raw utilization alone is not a validated failure prediction.
D:Fabricating telemetry corrupts training evidence; summaries cannot replace missing measurements.
Question 662
An NOC wants to draft incident timelines from controller logs, ticket comments and interface telemetry. Each assertion must be traceable to a source before engineers publish it. Which AI-assisted workflow is appropriate?
- Let the model fill missing event timestamps with plausible values and label the result verified.
- Treat an anomaly score above its threshold as proof that one named user intentionally attacked the network.
- Use generative AI to draft a summary grounded in retrieved dated records, attach source references to claims, and require engineer verification before distribution.
- Allow the summarizer to push a corrective ACL automatically without any simulation or approval because its prose sounds credible.
Explanation
Correct Answer
C:Generative systems can synthesize large text datasets into readable narratives, but they can also fabricate causal links or timestamps. Grounding in original events and explicit review ensure that a fluent narrative is not mistaken for verified root-cause evidence.
Incorrect Answers
A:Invented timestamps would invalidate the incident chronology and falsely claim evidentiary support.
B:Anomaly detection flags deviation, not automatically identity or malicious intent.
D:Summarization and change execution have distinct safety requirements; a draft is not authorization to modify devices.
Question 663
A monitoring platform learns normal interface utilization patterns and raises alerts when current traffic deviates unusually far from each link's baseline. The network team does not provide a list of predefined malicious signatures. What AI/ML capability is being used?
- Static packet filtering that denies packets based only on a fixed IPv4 ACL wildcard.
- Anomaly detection that compares observations with a learned normal baseline and flags significant deviations.
- A DNS recursive resolver that returns the authoritative A record for each interface name.
- A text-generation assistant that writes a paragraph about every switch regardless of telemetry values.
Explanation
Correct Answer
B:Anomaly detection uses historical or expected behavior to establish a baseline and identify observations that depart from it. The platform can consider utilization trends, periodic load, error rates and other features; an alert indicates unusual behavior relative to that learned context, not automatic proof of an attack or outage. Validate the model against known maintenance windows, seasonality and actual faults. Repeated alerts after predictable changes may indicate a baseline that needs updating, while missed genuine incidents can indicate inadequate coverage. The distinguishing capability is comparing live measurements with learned normality rather than checking an explicit preprogrammed signature rule.
Incorrect Answers
A:An IPv4 access list evaluates network packets against explicitly defined match conditions and permitted or denied actions. It does not learn utilization trends or estimate whether a traffic level is statistically unusual for a given link. ACL enforcement and anomaly detection can coexist, but they perform different functions and use different evidence.
C:DNS recursion resolves names into resource-record answers by querying and caching relevant DNS servers. It does not learn time-series interface baselines or classify link utilization deviations as anomalous. Successful DNS resolution would not prove a network-monitoring model had detected unusual traffic behavior.
D:A generative system can summarize measurements into language, but writing generic descriptions without using current and historical telemetry would not detect out-of-pattern utilization. The requested capability is a learned comparison and alert decision. A separate generation model could describe a flagged anomaly after the detection step.
Question 664
An AI assistant suggests an access-list change to block suspected malicious traffic. The proposed deny might also block the branch VPN used for recovery. Which release control most directly prevents an unreviewed AI recommendation from causing a production outage?
- Grant the assistant unrestricted privileged CLI access and immediately apply every suggested deny.
- Require an authorized network engineer to validate scope and simulate/test the ACL before approving a staged deployment with rollback.
- Disable logging of assistant actions so changes can occur without a change record.
- Use only higher-frequency interface telemetry but never assess what destinations the ACL would match.
Explanation
Correct Answer
B:AI recommendations are inputs to change control, not proof that a policy is safe for a given device or traffic flow. Human-in-the-loop review examines intended and collateral matches, management access, blast radius and recovery options before any production command is issued.
Incorrect Answers
A:Automatic execution without validation can disrupt legitimate traffic and remove recovery access.
C:Removing auditability hides rather than controls a risky proposed action.
D:Better monitoring cannot establish that the proposed rule will preserve required flows.
Question 665
Anomaly detection was trained on an old optical-port baseline. After an approved transceiver upgrade, the distribution of expected pre-FEC counters changes; the model now labels the new healthy baseline as repeated faults despite passing optics diagnostics. What explains the false alarms?
- The post-upgrade telemetry distribution shifted from the training baseline (concept/data drift), so the model needs validation and recalibration.
- An actual interface disconnection is proven by a single elevated pre-FEC statistic.
- A router reboot must have happened although the logs contain no such event.
- An unreviewed configuration agent necessarily modified an ACL during the optic upgrade.
Explanation
Correct Answer
A:The approved hardware change alters the normal feature distribution. The old model can misclassify healthy data until it is monitored against the new operating baseline and retrained or recalibrated.
Incorrect Answers
B:A high error counter alone does not establish loss of carrier, especially when interface diagnostics and service remain healthy.
C:There is no reboot evidence, and the scenario provides an explicit approved change that explains the model’s false positive.
D:There is no autonomous ACL command or policy push; this concerns a monitoring model whose baseline is stale after changed input conditions.
Question 666
A generated incident report claims that router R7 rebooted at 02:15. Syslog history, boot-time output and the monitoring timeline all show continuous uptime; no source event supports a reboot. What is the defect in the report?
- The generative report invented an unsupported reboot event; the claimed root cause must be removed or marked unverified until primary evidence exists.
- An optical power anomaly has been definitively proved malicious because a language model mentioned a reboot.
- The network’s default route selected a higher-metric path, which necessarily produces a fabricated reboot line in a written summary.
- A scheduled backup window explains a model anomaly; therefore the report’s R7 reboot timestamp is necessarily genuine.
Explanation
Correct Answer
A:A generated narrative can be fluent while inaccurate. Evidence linking the causal claim to device uptime, syslog and timestamped telemetry is absent here. Ground the revised timeline in observed events and avoid treating an unverified hypothesis as fact.
Incorrect Answers
B:Neither malicious intent nor the asserted reboot follows from this evidence.
C:Routing metrics do not justify unsupported text-generation claims.
D:A maintenance event cannot independently validate a nonexistent reboot record.
Question 667
An anomaly model flags unusually high WAN utilization every Saturday at 01:00. Change records confirm an approved weekly backup starts at that time, and no packet loss or compromise indicators are present. What is the best interpretation?
- Every high anomaly score proves hostile exfiltration regardless of the scheduled and independently verified backup.
- The detector is necessarily wrong about the measured high utilization, so device counters should be discarded.
- The deviation is a likely benign maintenance-related false positive; correlate alerts with approved workload context and adjust evaluation without suppressing genuine faults.
- The correct fix is to disable all network telemetry permanently during all nights, including unscheduled outages.
Explanation
Correct Answer
C:Anomaly detection finds departures from a learned baseline, not automatically cyberattacks. Scheduled jobs are legitimate causes of outlier traffic. Confirm context and preserve sensitivity to unexpected deviations outside the known window.
Incorrect Answers
A:A score is not proof of malicious intent, and this scenario supplies a benign known cause.
B:The activity can be unusual yet benign; the classification, not the raw observation, needs context.
D:A blanket blackout loses detection and masks actual incidents.
Question 668
An autonomous assistant identifies a suspicious source and pushes a new edge ACL without a change ticket, traffic simulation or approval. The deny also blocks the provider VPN that supports emergency access. What governance failure caused the avoidable outage?
- The outage was caused primarily by treating a planned backup’s utilization spike as an anomaly, although the change log shows an ACL block.
- The user interface rendered the incident summary in JSON rather than HTML, which changed router packet matching.
- The workflow lacked an approval and safety gate between AI-generated remediation and high-impact device command execution.
- No controller ever sent any configuration command, so a newly installed ACL cannot be involved.
Explanation
Correct Answer
C:The proposed rule was allowed to change production state without validating permitted paths or rollback. Requiring authorized review, test cases, change scoping, and recovery access interrupts that unsafe control loop; the assistant’s confidence does not make an ACL harmless.
Incorrect Answers
A:The documented loss of connectivity follows an unauthorized ACL push, not a backup anomaly.
B:Formatting a report cannot directly alter an IOS access-list match.
D:The evidence explicitly records an agent-issued ACL deployment.
Question 669
An ML model forecasts access-link failure based on historical utilization and errors. A pilot produced probabilities for 120 links. Operations now has actual failure outcomes for the following month. Which validation establishes how useful the forecast was before deployment to all sites?
- Confirm that the router's OSPF priority is unchanged on all 120 links, without comparing forecasts to outcomes.
- Verify the model generated 120 nonempty text strings, treating any prediction as automatically accurate.
- Compare predicted risks with observed failures using a held-out period and meaningful measures such as false alarms, missed failures, precision and recall.
- Count the number of DNS AAAA records in the asset inventory and use that total as the model's accuracy score.
Explanation
Correct Answer
C:Model usefulness must be evaluated against the events it was supposed to predict, not inferred from successful execution alone. With recorded risk scores and subsequent observed failures, select a decision threshold and calculate outcomes such as true positives, false positives, false negatives, precision and recall. Consider class imbalance, calibration, how early the alert arrived, and the operational cost of missed failures versus unnecessary interventions. Hold out future periods or sites where feasible to avoid evaluating on the training data. This acceptance question measures predictive quality; concept drift investigation is a separate diagnostic task when a previously valid model's error distribution changes.
Incorrect Answers
A:OSPF interface priority affects designated-router candidacy on eligible network types, not whether an ML risk forecast correctly identifies failed links. Even a network with stable routing preferences can have a useless predictive model. The validation must match predicted risks against later observed outcomes.
B:Producing one output per input proves the prediction pipeline ran but not that the resulting scores are meaningful. A constant forecast could generate 120 nonempty values yet miss nearly every genuine failure. Use ground-truth outcomes and error metrics to assess the classifier's operational value.
D:DNS AAAA records map hostnames to IPv6 addresses and do not form a confusion matrix for a link-failure forecasting model. Their count may describe inventory coverage but is unrelated to predicted-versus-observed failures. Evaluate forecast outcomes against actual incidents and operational thresholds.
Question 670
An AI-assisted network operations summary states that a switch rebooted because of a power failure. Its only cited evidence is a syslog interface link-down event; there is no reboot event, power telemetry or device uptime record. What is the appropriate acceptance decision?
- Approve the power-failure conclusion because a link-down log is always caused by a reboot.
- Reject the unsupported root-cause claim and require corroborating reboot or power evidence with verifiable citations.
- Delete all syslog entries so the model no longer produces inconsistent summaries.
- Execute the proposed power-supply replacement automatically because AI confidence is not shown.
Explanation
Correct Answer
B:The cited link-down record supports only the narrower observation that the interface went down. To claim the switch rebooted because it lost power, the system should produce evidence such as boot markers, uptime discontinuity, power-source alarms, environmental telemetry or correlated neighbor and power logs. If that evidence does not exist, present the cause as undetermined rather than asserted fact. An AI summary should map each substantive assertion to actual accessible observations and preserve uncertainty, and potentially disruptive remediation should require an explicitly authorized operational workflow. This scenario tests evidence-grounded AI use in network operations, not generic model confidence or automatic execution. Cross-check event timestamps and device identity before drawing a root-cause conclusion.
Incorrect Answers
A:A link-down event is compatible with several causes: unplugged media, neighbor failure, switchport shutdown, physical errors or a local device interruption. It is not exclusive proof that the switch rebooted, much less that power failed. Accepting a single explanation as certain would turn a weak inference into an operationally costly maintenance decision. Investigate additional logs and state rather than assuming causation from temporal proximity.
C:Deleting logs removes precisely the historical evidence needed to assess the incident and makes future audit harder. The mismatch is an inference-quality issue, not a reason to erase potentially relevant telemetry. Preserve original records, retrieve additional data sources and make the summarizer state when it cannot substantiate a conclusion. Deletion can also violate operational retention policy.
D:Replacing hardware is an impactful physical change that should follow a supported diagnosis and appropriate approval. No power telemetry or reboot proof is available, so a power-supply swap would be speculative. Model-generated suggestions do not become operational authority merely because they are phrased confidently. Establish independent evidence of a failed component and follow the organization's change process before physical remediation.
