100% Latest & Updated Cisco 200-301 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 1
A branch has an Ethernet client LAN in 10.24.8.0/24 and an ISP handoff in 198.51.100.0/30. The branch needs a dedicated device with routed interfaces to forward IP packets between these distinct networks. Which component supplies that role?
- An infrastructure access point operating as a Layer 2 wireless bridge
- A PoE-capable Layer 2 access switch with no IP routing enabled
- An Ethernet network tap that copies frames to a monitoring appliance
- A router with separate Layer 3 interfaces for the branch LAN and ISP network
Explanation
Correct Answer
D:A router owns Layer 3 interfaces in the two addressed networks, performs destination-IP route lookup, and can forward packets between the LAN and the ISP handoff after appropriate route and security configuration.
Incorrect Answers
A:A bridge-mode access point joins wireless stations to one wired broadcast domain, but it does not make an IP routing decision between the branch subnet and the ISP subnet.
B:An access-only Layer 2 switch forwards Ethernet frames by destination MAC within VLANs. PoE adds electrical power delivery, not the routed forwarding required between these IP networks.
C:A passive or aggregation network tap makes traffic copies for observation; it is not the branch IP default gateway and will not route packets toward an ISP.
Question 2
Two wired PCs on Gi1/0/5 and Gi1/0/6 are already in VLAN 20. Their traffic must be forwarded by destination MAC within that VLAN, with no intersubnet routing. Which dedicated network component supplies that forwarding behavior?
- A Layer 2 switch
- A repeater that regenerates Ethernet bits but never learns MAC source addresses
- A router using destination-IP longest-prefix routing between IP subnets
- A managed Ethernet tap that duplicates both endpoint frames to a sensor
Explanation
Correct Answer
A:A switch first learns each sender’s source MAC and ingress port within its VLAN. It then uses that VLAN-scoped table to send known unicasts only to the learned destination port, unlike a router performing an IP-prefix lookup.
Incorrect Answers
B:A Layer 1 repeater does not build VLAN-scoped MAC tables or selectively forward a known unicast frame.
C:These hosts are already in one VLAN and need destination-MAC forwarding, not an intersubnet Layer 3 decision.
D:A tap observes traffic and does not select the learned destination egress access port for ordinary switching.
Question 3
At an Internet edge, a security team must enforce connection-state and application-identity rules for traffic, not just forward IP packets or supply Ethernet power. Which dedicated component supplies the required policy function?
- A stateless IPv4 ACL that permits or denies only IP protocol and port matches
- A network address translator that modifies address/port fields without application policy
- A signature-only passive intrusion-detection sensor on a mirror port
- A next-generation firewall
Explanation
Correct Answer
D:A next-generation firewall combines state tracking with higher-layer application recognition so policy can permit or block traffic beyond simple IP and port matches. A Layer 2 switch or PoE port has no equivalent perimeter inspection role.
Incorrect Answers
A:A simple ACL lacks the required combined connection tracking and application-identity inspection.
B:NAT alone does not enforce the stated stateful and application-aware security inspection.
C:A passive sensor observes copies and cannot act as the inline stateful NGFW enforcement point.
Question 4
Wireless laptops must associate over 802.11 and be bridged to a floor's Ethernet LAN. The selected device needs an actual radio interface rather than only copper switch ports. Which component meets that condition?
- A wired router interface with a gateway address but no 802.11 radio
- An Ethernet access switch with only copper ports and no wireless module
- A wireless LAN controller software instance with no AP radios deployed
- An access point in infrastructure mode
Explanation
Correct Answer
D:An infrastructure-mode access point accepts 802.11 associations and bridges authorized wireless frames into the attached wired LAN. The wired switch carries the AP uplink, but it does not itself create the radio cell.
Incorrect Answers
A:Routing does not perform 802.11 client association or bridge radio frames into Ethernet.
B:MAC switching on wired ports cannot accept client Wi-Fi association frames absent radio hardware.
C:A controller can coordinate APs but, by itself without a serving radio/AP, does not create this local 802.11 access cell.
Question 5
A ceiling access point draws IEEE 802.3 PoE from its attached copper Ethernet cable. The selected switch port must both forward the AP uplink and supply negotiated electrical power. Which feature makes that possible?
- An IEEE 802.3 PoE-capable switch port
- A Layer 2 access switch whose port explicitly has no PoE power-sourcing capability
- An Ethernet inline surge protector that passes data but does not inject power
- A routed Ethernet interface configured for a default gateway but without PoE
Explanation
Correct Answer
A:A power-sourcing Ethernet switch port negotiates and supplies electrical power over the Ethernet cabling while also carrying data. That is the required power-delivery role; the access point consumes power rather than supplying it.
Incorrect Answers
B:Layer 2 switching alone does not imply that a switchport supplies negotiated electrical power to an AP; a non-PoE port cannot meet the requirement.
C:A passive or surge-protection device cannot originate the 802.3 power required by the access point unless it is specifically a PoE injector.
D:Layer 3 IP forwarding provides reachability, but an interface without power-sourcing equipment cannot deliver the required AP wattage.
Question 6
Users in VLAN 10 need to reach users in VLAN 20, and the campus wants both IP gateways hosted on the same switching platform. Which component can route between configured, operational SVIs?
- A pure Layer 2 access switch with SVIs configured only for out-of-band management
- A router-on-a-stick setup on an unrelated router when gateways must reside on the switching platform
- A wireless LAN controller that configures SSIDs but provides no routed SVI gateway
- A Layer 3 switch with routed SVIs
Explanation
Correct Answer
D:A multilayer switch with operational switched virtual interfaces can provide an IP gateway address per VLAN and route between their subnets. Ordinary Layer 2 access ports alone cannot select an inter-VLAN next hop.
Incorrect Answers
A:Without routed SVI functionality/IP routing, it cannot forward between VLAN 10 and VLAN 20.
B:External subinterfaces could route generally, but would violate the stated requirement to host both gateways on this switch.
C:Central WLAN profile control alone does not create the required VLAN IP gateways and intersubnet forwarding.
Question 7
Twenty lightweight APs need centrally assigned WLAN profiles and RF policy, while access switches continue forwarding Ethernet frames. Which controller function coordinates these AP configurations?
- Use an independent autonomous AP configuration on each radio without central policy
- Use a RADIUS server to set physical AP RF channels and SSID profile assignments
- A wireless LAN controller
- Use DHCP address assignment as the sole central wireless policy service
Explanation
Correct Answer
C:A wireless LAN controller maintains centralized profiles and policy for supported lightweight access points. It can coordinate multiple APs without being the same component as the switch forwarding client Ethernet traffic.
Incorrect Answers
A:Per-device operation can provide WLANs but does not centrally distribute the twenty lightweight APs’ shared profiles.
B:RADIUS authenticates identities; it is not the lightweight AP WLAN/RF configuration controller.
D:DHCP supplies network addressing, not centralized WLAN security and RF management policies.
Question 8
An inline security appliance must detect signatures of malicious transit traffic and block matching packets before they reach the internal LAN. Which component provides inline prevention rather than merely mirroring frames?
- An intrusion prevention system
- Deploy a passive IDS sensor fed from a SPAN mirror port
- Apply an ACL that drops all traffic with one source IP, without signature analysis
- Run a NetFlow exporter on a router for telemetry-only observations
Explanation
Correct Answer
A:An inline IPS evaluates traffic against detection logic and can drop or block malicious flows as they traverse the enforcement point. Passive monitoring alone cannot enforce the required prevention decision.
Incorrect Answers
B:A passive IDS detects activity but cannot block the original inline transit packets.
C:A simple static ACL does not inspect malicious payload signatures and enforce signature-based prevention as requested.
D:Flow records can support analysis, but exporting records is not an inline signature-matching prevention engine.
Question 9
A branch client resolves `portal.example.test` by querying a central host that serves or recursively resolves DNS data for multiple users. Which server component performs that application service?
- Use a DNS cache stored only in the requesting workstation without central service
- A DNS application server
- Use a recursive web proxy that forwards HTTP requests but does not answer DNS records
- Use the IP default gateway’s routing lookup as the answer to each DNS question
Explanation
Correct Answer
B:A DNS server answers client name-resolution requests using zone data or recursive lookups as configured. Its service role is to resolve names for many endpoints, not route the endpoints’ packets between VLANs.
Incorrect Answers
A:The question calls for a central host answering multiple clients, not one endpoint’s private resolution cache.
C:Proxying application web traffic alone is not the queried recursive/authoritative DNS name-resolution service.
D:A router forwards DNS packets toward servers but does not necessarily resolve the requested names and send the DNS answers.
Question 10
A workstation initiates a TCP connection from its own ephemeral source port to a remote application server. Which role best describes the device originating this session, rather than a transit gateway?
- An endpoint client
- A transit Layer 3 router forwarding the workstation’s TCP packets
- A reverse proxy terminating the remote server side of a session
- An inline firewall observing the new TCP handshake
Explanation
Correct Answer
A:The workstation is the connection initiator: it creates application traffic using its own source address and ephemeral transport state. An intermediary device such as a router or switch forwards transit traffic instead.
Incorrect Answers
B:The router may forward traffic but is not the user device that initiates the connection with its own ephemeral source port.
C:A proxy may establish distinct connections but is not the stated original workstation endpoint.
D:Inspection or filtering does not mean the device originated the workstation’s application flow.
Cisco Certified Network Associate (CCNA) (200-301) Practice Tests
