100% Latest & Updated Cisco 200-301 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 140
A small office has supported WPA2-Personal clients that do not implement WPA3 SAE, and must use an encrypted PSK WLAN rather than WEP or TKIP-only. Which security choice is appropriate?
- Use WPA2 with TKIP-only protection to avoid AES-CCMP requirements
- Use an open WLAN with hidden SSID and no link-layer encryption
- Use WPA3-SAE-only authentication even though the stated clients do not support SAE
- Use WPA2-Personal with AES-CCMP and a strong shared passphrase
Explanation
Correct Answer
D:WPA2-Personal with AES-CCMP provides supported encrypted client access with the matching strong PSK for this fleet.
Incorrect Answers
A:TKIP-only is legacy protection and does not meet the requested WPA2-AES security baseline for the supported devices.
B:Disabling encryption and hiding a WLAN name does not provide WPA2-Personal authenticated confidentiality.
C:WPA3-only SAE cannot be used by the stipulated client fleet lacking SAE support, even if the platform itself supports WPA3.
Question 141
A testing host must run separate Windows and Linux guest operating systems with independent kernels on one server. Which virtualization method addresses that requirement?
- Run separate virtual machines under a hypervisor
- Create application containers that share the Linux host kernel
- Separate the host’s IP route entries with VRFs but keep one OS kernel
- Place two user processes in distinct Linux namespaces without guest kernels
Explanation
Correct Answer
A:A hypervisor provides virtual hardware for independently bootable guest operating systems and their kernels, accommodating distinct OS environments.
Incorrect Answers
B:Ordinary application containers share the host kernel and cannot supply independently booting Windows and Linux guest kernels on one Linux host.
C:VRF isolates routing tables, not the operating system instance or its kernel.
D:Process namespaces can provide isolation within the same host OS but do not create independent guest kernels.
Question 142
A development team packages multiple applications in isolated process environments that share a common Linux kernel, avoiding the overhead of an entire guest OS per app. Which virtualization packaging model is appropriate?
- Use full VMs with independently booted guest kernels for every application process
- Use VRFs to isolate application processes by IP prefix only
- Deploy operating-system containers
- Use separate physical servers for each container image rather than sharing a host
Explanation
Correct Answer
C:Containers package isolated processes and dependencies while typically sharing the host operating-system kernel. A virtual machine instead emulates a separate guest OS environment under a hypervisor.
Incorrect Answers
A:VMs are useful for separate operating systems, but this task deliberately avoids per-app guest OS overhead and shares a host kernel.
B:VRF isolates routing state, not the userspace filesystem/process isolation model described.
D:Dedicated hardware per application would defeat the requested lightweight shared-kernel packaging.
Question 143
A Cisco IOS XE router has global routes plus tenant VRFs TENANT-A and TENANT-B. An engineer must inspect only the IPv4 destination prefixes and next hops installed in TENANT-A without mixing another tenant’s routes. Which operational command meets that requirement?
- Use show ip route on the global routing table and assume it includes every tenant VRF
- Use show vlan brief to display the full separate Layer 3 VRF routing information
- Use show ip route vrf TENANT-A to inspect that tenant’s independent routing table
- Use show spanning-tree vlan 20 to confirm the selected IPv4 next hops in the VRF
Explanation
Correct Answer
C:The VRF-qualified show ip route command displays prefixes and next hops installed in the specified logical routing instance, rather than mixing tenant routes.
Incorrect Answers
A:The global RIB is a separate routing context and its ordinary display may omit routes that exist exclusively in a tenant VRF.
B:A VLAN display reports Layer 2 membership and cannot enumerate prefixes or next hops from the tenant routing table.
D:Spanning-tree output describes Layer 2 forwarding roles and cannot reveal destination IP routes installed in an independent VRF.
Question 144
An enterprise will install virtualization software directly on a physical server so that no general-purpose host operating system sits underneath the hypervisor. What type meets that explicit placement requirement?
- Type 1 bare-metal hypervisor
- Type 2 hosted hypervisor installed inside a desktop operating system
- Operating-system containers that share the running Linux kernel
- VLAN routing instances on a physical network switch
Explanation
Correct Answer
A:A type 1 hypervisor runs on server hardware and hosts virtual machines without requiring a separately booted general-purpose host OS beneath it.
Incorrect Answers
B:A type 2 hypervisor is hosted by a general-purpose OS, contradicting the stated bare-metal placement.
C:Containers isolate userspace applications within a host OS rather than serving as a bare-metal VM hypervisor.
D:VLAN/VRF network isolation does not virtualize server hardware or create guest operating systems.
Question 145
A microservices platform needs to instantiate, stop and schedule numerous isolated shared-kernel containers across hosts. Which platform layer manages their lifecycles rather than emulating complete guest operating systems?
- Use a single hypervisor VM manager without any container lifecycle tool
- Use a container runtime and orchestrator
- Manually start each container once and leave failures unmonitored
- Use a Layer 3 VRF configuration tool as the container scheduler
Explanation
Correct Answer
B:Container runtimes start instances from images, while orchestration manages placement, desired replica count and recovery of failed instances. This supports repeated deployments more efficiently than manually building full guest operating systems.
Incorrect Answers
A:A hypervisor manages guest OS resources, not necessarily the scheduling, restarting and replica reconciliation of shared-kernel application containers.
C:A single manual start is not the automated cross-host orchestration and desired-state lifecycle management requested.
D:VRF deals with route-table separation and cannot place or reconcile application container replicas across hosts.
Question 146
Two tenants use overlapping 10.12.0.0/16 networks on the same Cisco Layer 3 device. Neither tenant may learn the other tenant’s routes without deliberate route leaking. Which logical isolation technique meets both requirements?
- Place each tenant in a different access VLAN but leave both interfaces in one global routing table
- Place each tenant-facing Layer 3 interface in a distinct VRF with its own routing table
- Enable PortFast on the shared transit link so forwarding tables converge faster
- Use one NAT overload address for both tenants without separating routing lookups
Explanation
Correct Answer
B:Each VRF has an independent forwarding and routing context, allowing identical prefixes without mixing customer lookups unless explicit inter-VRF connectivity is configured.
Incorrect Answers
A:A VLAN separates Layer 2 broadcasts; interfaces in one global routing table can still share routed reachability and overlapping routes conflict.
C:PortFast changes spanning-tree edge transition behavior, not IP routing-table isolation or duplicate-prefix handling across tenants.
D:PAT changes source addresses on selected flows but does not by itself provide separate per-tenant route tables or resolve overlap.
Question 147
A Windows 11 engineer keeps the existing Linux desktop as the ordinary host OS, but installs virtualization software as an application on top of that Linux OS to boot an isolated Windows test guest. The hypervisor is not installed directly on bare metal. Which hypervisor architecture matches this layering?
- A Type 1 bare-metal hypervisor replacing the host Linux installation
- A Type 2 hosted hypervisor running above the existing Linux operating system
- A container runtime that runs a Windows kernel inside a Linux container without a VM
- A router VRF that assigns a separate routing table to the Windows guest
Explanation
Correct Answer
B:A Type 2 hosted hypervisor runs within the host operating system, and can host independent virtual machines for supported guest operating systems without replacing that Linux host.
Incorrect Answers
A:A Type 1 hypervisor executes directly on physical hardware; the scenario explicitly retains Linux as the general-purpose host beneath the hypervisor.
C:Ordinary Linux containers share their host kernel and cannot substitute for a separate full Windows guest kernel without a virtual machine or appropriate specialized layer.
D:A virtual routing and forwarding table separates IP routes and does not create an isolated guest operating system.
Question 148
An application team runs the same Linux service on several hosts with compatible container runtimes and host kernels. It wants to package runtime dependencies and deploy consistently without shipping an entire guest OS. Which artifact best fits?
- A versioned container image with the application and its user-space dependencies
- A virtual-switch port group containing only VLAN membership settings
- A single IPsec security association between the hosts
- A raw text list of the service’s port numbers without runtime libraries
Explanation
Correct Answer
A:A container image packages the executable and user-space dependencies for repeatable starts, while the host still supplies the kernel.
Incorrect Answers
B:A virtual-switch port group controls connectivity for virtual NICs; it does not bundle application code and libraries for deployment.
C:An IPsec association protects traffic on a path but does not distribute executable software or its dependency versions.
D:A port list can document connectivity needs but cannot reproduce the application runtime environment on another machine.
Question 149
A lab hypervisor is oversubscribed. Two guest VMs need separately reserved memory and specified virtual CPU allocations before benchmarking. Which component enforces the virtual compute allocations?
- A VRF on the top-of-rack router to select tenant routes
- The hypervisor’s per-VM CPU and memory resource configuration
- An Ethernet VLAN access-port assignment for each guest
- A spanning-tree root priority change on the physical switch
Explanation
Correct Answer
B:Hypervisor resource settings present virtual CPUs and memory to each VM and determine how the physical host schedules and allocates them.
Incorrect Answers
A:VRF settings choose forwarding tables; they do not schedule a host processor or reserve machine RAM for guest workloads.
C:VLAN membership segments frames sent by virtual adapters; it does not change compute allocation or guest memory reservation.
D:STP chooses loop-free Layer 2 paths and does not control virtual machine processor or memory resources.
Question 150
Two virtual machines share one physical hypervisor but must connect to different Layer 2 VLANs on its uplink. Their virtual NICs are already installed. Which virtual-network configuration distinguishes their Ethernet segments?
- Assign the same untagged virtual-switch port group to both VMs
- Attach each VM virtual NIC to the correct VLAN-associated virtual-switch port group
- Enable IP routing between all VLANs on the hypervisor to make traffic isolated
- Increase the hypervisor guest-memory reservation for both VMs
Explanation
Correct Answer
B:A virtual switch maps each virtual NIC to a port group with the intended VLAN handling, separating Layer 2 traffic at the host uplink.
Incorrect Answers
A:One shared untagged port group would place both virtual adapters in the same Layer 2 segment, contrary to the isolation requirement.
C:Enabling routing makes inter-subnet connectivity possible and is not a substitute for mapping guest vNICs to the correct VLANs.
D:Guest RAM allocations do not tag Ethernet frames or select which virtual switch broadcast domain a vNIC joins.
Cisco Certified Network Associate (CCNA) (200-301) Practice Tests
