100% Latest & Updated Cisco 200-301 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 290
An AP has adequate PoE and Ethernet link but does not join its controller. Which network prerequisites involving the AP management subnet, IP routing and CAPWAP traffic should be verified?
- Validate management IP and CAPWAP reachability
- Replace WPA2-Enterprise with a PSK before checking AP management IP reachability
- Add all VLANs to the trunk even though the AP has a correct access-VLAN design
- Increase radio transmit power to extend client coverage
Explanation
Correct Answer
A:Client radio coverage does not establish that controller control traffic can reach the AP.
Incorrect Answers
B:WLAN client authentication occurs after AP join and is not the initial CAPWAP management reachability issue.
C:Overbroad trunking does not establish IP reachability to the controller and may violate VLAN policy.
D:RF transmit power cannot repair CAPWAP discovery, DHCP/default-gateway or routed IP path failures.
Question 291
An engineer is administering a Catalyst switch remotely from a trusted management workstation. The CLI session and credentials must remain encrypted over the network. Which secure management connection is appropriate?
- Use SSH over a protected management path
- Use Telnet on TCP port 23 to send administrative credentials in cleartext
- Use plain HTTP to a management GUI when CLI commands are required
- Use SNMPv2c community strings as an interactive encrypted remote CLI
Explanation
Correct Answer
A:SSH uses an encrypted authenticated terminal session, protecting administrator credentials and commands on the management connection. A reachable management IP and appropriate VTY configuration are still required.
Incorrect Answers
B:Telnet does not encrypt the session and violates the stated protection requirement.
C:HTTP is unencrypted and a browser GUI is not the specified protected CLI transport.
D:SNMPv2c is not an encrypted interactive command shell; the trusted CLI session requires SSH.
Question 292
A mirrored management link shows a technician entering a router password through a Telnet session, and the security team sees the credential in the captured payload. Which transport change directly protects future remote interactive CLI traffic from passive reading?
- Keep Telnet but require a stronger reusable password on the same unencrypted terminal channel
- Do not use Telnet; prefer SSH
- Keep Telnet but enable a server-side login banner warning about unauthorized access
- Keep Telnet but enable a syslog collector for successful and failed authentication attempts
Explanation
Correct Answer
B:Telnet sends terminal data and passwords without SSH’s transport encryption, exposing them on untrusted links. SSH provides cryptographic confidentiality and server authentication for device management.
Incorrect Answers
A:Password complexity cannot hide characters transmitted over a clear-text terminal transport; an observer can still read the new credential.
C:A terminal banner changes legal notice and user instructions but does not add confidentiality to Telnet packets.
D:Logging can support detection and audit, but transmitted credentials remain visible to a network eavesdropper during Telnet login.
Question 293
A router has its HTTPS GUI enabled but also an older plaintext HTTP administration listener. Policy forbids sending management credentials without transport encryption. Which GUI transport should the operator use?
- Use HTTP on port 80 but choose a long administrator password
- Use HTTPS instead of HTTP
- Use Telnet to manage the router rather than its graphical HTTPS interface
- Use plain HTTP with browser private/incognito mode
Explanation
Correct Answer
B:HTTPS protects browser-based management requests and responses with TLS rather than exposing them in plaintext HTTP. Enabling HTTPS also requires certificate/key and access-control considerations on the managed device.
Incorrect Answers
A:A stronger password does not encrypt HTTP requests or prevent exposure of credentials on the path.
C:Telnet provides an unencrypted terminal session, not the required protected web GUI.
D:Private browsing affects local history, not the confidentiality of HTTP traffic transmitted across the network.
Question 294
All in-band IP paths to a router have failed, and the local technician needs direct command-line recovery with physical access. Which console or separate out-of-band connection is suitable?
- Use SSH through the failed management SVI and assume local physical access repairs IP reachability
- Use web HTTPS over the same failed management VLAN
- Use the physical console or supported out-of-band access
- Use a normal user access Ethernet port without a console cable or management IP
Explanation
Correct Answer
C:Console access does not rely on production routed IP connectivity.
Incorrect Answers
A:SSH requires a working routed management path, which the scenario explicitly lacks.
B:HTTPS cannot reach the disconnected IP-based interface merely because the technician is physically near the chassis.
D:An Ethernet data port cannot provide a local IOS console session when the management network is unavailable.
Question 295
A company wants centrally managed administrator login policy and individual audit identities instead of a shared local password on every device. Which AAA-backend approach fits?
- Share the same privileged EXEC password on every device and skip individual identities
- Use RADIUS or TACACS+ with a defined policy
- Use only SSH transport encryption without an AAA identity backend
- Use VLAN isolation alone with no authentication service
Explanation
Correct Answer
B:Central AAA services support consistent operator identity and access controls.
Incorrect Answers
A:A common local password cannot provide centrally governed per-person authentication and audit attribution.
C:SSH protects traffic but does not by itself centralize user authorization and per-user records across devices.
D:A restricted VLAN may limit reachability but does not provide a central account policy or administrator authorization/accounting.
Question 296
The IOS SSH server already accepts encrypted administrator connections. An operator must display the **currently established SSH sessions**, their connection IDs, protocol versions and login state—not merely whether SSH is configured. Which operational command is appropriate?
- Run `show ssh`
- Run `show ip ssh` to see only the server configuration and defaults
- Configure `transport input ssh` on the VTY lines
- Run `show ip route` to list network routes
Explanation
Correct Answer
A:show ssh lists active SSH server connections and their session state, protocol version, cipher information and user details.
Incorrect Answers
B:show ip ssh summarizes SSH server configuration and status; it is not the active per-connection session inventory asked for.
C:transport input ssh controls what remote transport the VTY accepts and does not display existing sessions.
D:Routing-table output shows destination prefixes and next hops rather than SSH login sessions.
Question 297
An authorized administrator must enable the secure web-management listener on a Cisco IOS XE router. Plain HTTP must remain disabled, and the required certificates/trustpoints are already configured. Which configuration change meets this?
- Configure ip http secure-server and no ip http server
- Configure ip http server and no ip http secure-server
- Enable a Telnet server and keep HTTP authentication enabled
- Configure only transport input ssh under the VTY lines
Explanation
Correct Answer
A:The secure-server command enables HTTPS; disabling the plaintext HTTP server prevents an alternate unencrypted listener. Platform and certificate prerequisites must be satisfied.
Incorrect Answers
B:This explicitly enables unencrypted HTTP while disabling HTTPS, the opposite of the management requirement.
C:Telnet does not encrypt the management exchange and does not configure the HTTPS listener.
D:SSH on VTY lines secures remote CLI sessions but does not enable the web HTTPS service.
Question 298
The management SVI is unreachable after a routing change. A technician stands next to the switch and connects a laptop to its serial or USB console port. Which management connection is being used?
- Open an SSH session to the unreachable management SVI
- Use a console connection
- Open Telnet to the unreachable in-band interface
- Use HTTPS to the switch web GUI over the failed IP management route
Explanation
Correct Answer
B:Console provides local device CLI access without an assigned network address.
Incorrect Answers
A:SSH depends on working IP connectivity, while the technician is using a local physical serial/USB console.
C:Telnet cannot bypass the broken management path and is not the attached serial cable protocol.
D:Web management is network-based and cannot substitute for a direct serial console prompt.
Question 299
An enterprise manages dozens of IOS devices and wants per-command authorization and accounting for privileged operators. Which central authentication/authorization service is commonly suited to this use case?
- Use RADIUS network-access authentication alone and assume per-command device authorization is identical to TACACS+
- Use TACACS+ policy and accounting where supported
- Use HTTPS alone with no central AAA authorization rules
- Use local console line passwords shared by all operators
Explanation
Correct Answer
B:TACACS+ can support separate authentication, authorization and detailed command accounting.
Incorrect Answers
A:RADIUS is often used for network access; TACACS+ provides fine-grained per-command authorization/accounting on supported devices.
C:Encrypted GUI transport does not provide the required centralized per-command operator policies.
D:Shared local credentials lack centralized command-level authorization and individual accounting records.
Question 300
A corporate WLAN/controller administrative login backend is already deployed through a RADIUS service and needs centralized credential checks. Which AAA protocol/service should be selected for that documented policy?
- Use local switchport MAC address learning as the admin account verifier
- Choose Telnet transport and assume it is an AAA authentication protocol
- Use RADIUS authentication
- Use an HTTP server without forwarding credentials to the RADIUS backend
Explanation
Correct Answer
C:RADIUS is widely used to connect network access devices to centralized user authentication.
Incorrect Answers
A:MAC forwarding state does not authenticate administrators to the already deployed central RADIUS backend.
B:Telnet is an unencrypted terminal transport, not the central RADIUS service required.
D:HTTP alone cannot carry out the stated RADIUS-backed user credential validation.
Cisco Certified Network Associate (CCNA) (200-301) Practice Tests
