100% Latest & Updated Cisco 200-301 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 300
A corporate WLAN/controller administrative login backend is already deployed through a RADIUS service and needs centralized credential checks. Which AAA protocol/service should be selected for that documented policy?
- Use local switchport MAC address learning as the admin account verifier
- Choose Telnet transport and assume it is an AAA authentication protocol
- Use RADIUS authentication
- Use an HTTP server without forwarding credentials to the RADIUS backend
Explanation
Correct Answer
C:RADIUS is widely used to connect network access devices to centralized user authentication.
Incorrect Answers
A:MAC forwarding state does not authenticate administrators to the already deployed central RADIUS backend.
B:Telnet is an unencrypted terminal transport, not the central RADIUS service required.
D:HTTP alone cannot carry out the stated RADIUS-backed user credential validation.
Question 301
During an administrator SSH connection to an IOS device, the client reports that the stored server host-key fingerprint unexpectedly changed. What is the safest next action before continuing the session?
- Accept the changed SSH key permanently without checking it
- Switch to Telnet to avoid the SSH host-key warning
- Verify the new host-key fingerprint over an independent trusted channel before accepting it
- Disable host-key checking globally so all future keys are trusted
Explanation
Correct Answer
C:An unexpected SSH server host-key change must be authenticated against a trusted device inventory or verified out of band to rule out a man-in-the-middle or unauthorized replacement before the client trusts the new identity.
Incorrect Answers
A:An unexplained key change can indicate reinstallation or a man-in-the-middle; accepting it blindly undermines identity verification.
B:Telnet removes confidentiality and server authentication instead of addressing the unexpected key change.
D:Suppressing verification removes an essential protection and does not establish the router’s new key identity.
Question 302
An engineer connects a laptop directly to a router serial console. The terminal receives garbled characters even though the cable and adapter are functional. What should be checked to make the CLI legible?
- Match the terminal emulator baud rate, data bits, parity and stop bits to the router console settings
- Switch from serial console to Telnet despite no working management IP
- Change the IOS enable secret to improve console text legibility
- Increase the monitor’s font size without adjusting serial parameters
Explanation
Correct Answer
A:A direct serial console session requires matching UART framing parameters at the console and terminal emulator. A mismatch can render otherwise valid IOS output as unreadable characters.
Incorrect Answers
B:Telnet requires a reachable IP path and cannot repair an unreadable local serial-console session.
C:Password changes do not alter the console UART speed, parity or character framing.
D:Display scaling does not correct baud-rate or framing mismatches that cause garbled terminal characters.
Question 303
A Cisco IOS XE web GUI is required for administrators, but it must not be reachable from arbitrary external IPv4 networks. The HTTPS server remains enabled. Which additional control best restricts who can reach the GUI?
- Apply a supported ip http access-class restricting WebUI sources to the trusted management subnet
- Rename the local administrator username while leaving web access open to all sources
- Enable ip http server in addition to ip http secure-server
- Configure a routed default gateway on the workstation only
Explanation
Correct Answer
A:The HTTP server access-class feature can permit only selected source addresses to the WebUI, limiting exposure while keeping approved HTTPS management.
Incorrect Answers
B:Renaming an account does not filter management packets based on source address and leaves exposure unchanged.
C:Adding plain HTTP increases the reachable service surface and does not restrict source networks.
D:Changing a workstation gateway does not establish an inbound access policy on the router’s WebUI.
Question 304
A managed switch is enrolled in a vendor cloud-management platform whose approved portal supplies the required inventory and configuration interface. Which management path matches that deployment model?
- Access the switch through an unrelated consumer Wi-Fi router dashboard
- Use an unencrypted Telnet session without logging into the enrolled service
- Use the vendor cloud-management platform
- Use only SNMP traps received by a monitoring server as the change portal
Explanation
Correct Answer
C:Cloud management systems can push policy and monitor registered managed devices.
Incorrect Answers
A:An unrelated local gateway cannot provide the switch inventory and configuration held by its approved vendor-cloud account.
B:Telnet would neither use the approved vendor-cloud inventory nor satisfy protected management transport.
D:Trap notifications report events; they are not the authenticated cloud configuration and inventory control plane requested.
Question 305
The campus routing uplink and in-band management VLAN are unreachable after a core routing failure. Network administrators need emergency access to the affected switch command line without restoring production IP routing first. A dedicated console server has an independent management path to the site. Which connection should they use?
- SSH through the failed in-band management SVI as the only permitted path
- A separate out-of-band console server connected to the switch console port
- HTTPS to the user-facing production IP address on the down core uplink
- SNMP read-only polling from the unreachable monitoring subnet
Explanation
Correct Answer
B:An independent console-server path gives terminal management access without depending on the operational state of the switch production VLAN or routing plane.
Incorrect Answers
A:The ordinary in-band SVI depends on the failed route, so that same network is not a reliable emergency recovery path.
C:The user-data IP interface uses the unavailable production network and provides no independent console access in this outage.
D:SNMP polling is neither a CLI recovery console nor a path that bypasses the broken in-band network dependency.
Question 306
A new guest wireless network should appear to clients as `Guest-Office`, with the controller mapping it to an existing WLAN profile. Which WLAN identity setting supplies that advertised network name?
- Rename the wireless policy profile to Guest-Office but leave the SSID unchanged
- Change only the controller management hostname to Guest-Office
- Change the client VLAN assignment without altering the WLAN identifier
- Configure the WLAN SSID
Explanation
Correct Answer
D:The SSID is the logical name advertised or selected by wireless clients for the corporate WLAN. It is separate from the controller’s VLAN mapping, security suite and quality-of-service policy, which govern what clients can do after association.
Incorrect Answers
A:A policy-profile name is administrative metadata and does not become the advertised 802.11 SSID seen in client scans.
B:A controller hostname is not the WLAN SSID broadcast to wireless clients.
C:VLAN mapping determines downstream client placement, not the radio-advertised Wi-Fi network name.
Question 307
An existing WLAN must serve devices that support WPA2-Personal, AES-CCMP and a documented shared passphrase; client keys must match the controller. Which security configuration is appropriate?
- Set WPA2-Personal AES security and matching PSK
- Select WPA2-Personal with TKIP as the only data cipher
- Require WPA3-only SAE while retaining the legacy WPA2 client requirement
- Enable WPA2-Enterprise 802.1X/RADIUS instead of the shared-PSK method
Explanation
Correct Answer
A:WPA2-Personal requires a configured PSK and compatible AES-CCMP settings on both client and WLAN. Changing the SSID or the VLAN assignment cannot repair a mismatched authentication passphrase.
Incorrect Answers
B:The endpoints explicitly require AES-CCMP; TKIP-only settings do not satisfy their supported WPA2 security policy.
C:An SAE-only WLAN can exclude clients restricted to WPA2-Personal PSK; the stem requires compatibility with those clients.
D:Individual EAP/RADIUS credentials use a different authentication model from the documented common WPA2 passphrase.
Question 308
Clients successfully associate to a controller WLAN but receive addresses from the wrong IPv4 subnet because the WLAN policy maps to VLAN 20 instead of VLAN 30. Which WLAN-to-VLAN interface mapping needs correction?
- Map the WLAN to its configured dynamic interface or VLAN
- Change the guest DHCP address pool to use VLAN 20 permanently
- Change the displayed SSID label without changing its policy profile
- Change only the WLAN AES cipher settings
Explanation
Correct Answer
A:WLAN-to-VLAN mapping controls the wired segment into which client traffic is placed.
Incorrect Answers
B:Altering the address plan to match an erroneous VLAN 20 policy violates the required client network VLAN 30.
C:SSID lettering does not alter the controller policy-profile VLAN binding that determines where client frames are sent.
D:Link-layer encryption affects confidentiality/association but does not remap an already associated client to the correct VLAN.
Question 309
Voice handsets share one controller WLAN with data devices and must receive the appropriate traffic priority policy rather than default best-effort treatment. Which WLAN QoS profile setting should be reviewed?
- Disable the WLAN multimedia/WMM capability for all voice clients
- Increase the AP channel width to 160 MHz on all radios
- Select the appropriate WLAN QoS profile
- Assign handsets a different DHCP lease duration
Explanation
Correct Answer
C:The WLAN QoS setting maps wireless service behavior to the required priority policy.
Incorrect Answers
A:Removing wireless QoS support can worsen voice scheduling, not provide the required prioritized traffic handling.
B:Channel width alters RF capacity and interference characteristics; it does not select the agreed per-class packet QoS service.
D:Address lease time does not prioritize voice traffic under radio or upstream congestion.
Question 310
A guest SSID must block direct station-to-station traffic even when users are on the same WLAN/VLAN. Which controller client isolation or peer-blocking policy should be enabled where supported?
- Enable WPA2 AES encryption and assume it forbids client-to-client packets
- Enable supported peer-to-peer or client isolation controls
- Disable the guest SSID advertisement while leaving the WLAN service active
- Change the guest VLAN ID but continue allowing peer communication there
Explanation
Correct Answer
B:Client isolation prevents direct station-to-station communication under the WLAN.
Incorrect Answers
A:Encryption protects wireless frames, but authenticated stations can still communicate with each other unless peer traffic is independently restricted.
C:Hiding the name is not client isolation; previously configured clients may still associate and exchange traffic.
D:Segmentation from other networks does not inherently block two stations that share a WLAN/VLAN.
Cisco Certified Network Associate (CCNA) (200-301) Practice Tests
