User Account Shopping Cart
Practice Exams:
View All

Cisco 200-301 Exam Dumps, Practice Test Questions

100% Latest & Updated Cisco 200-301 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!

Cisco 200-301 Premium Bundle
$79.97
$59.98

200-301 Premium Bundle

  • Premium File: 760 Questions & Answers. Last update: Nov 12, 2026
  • Training Course: 271 Video Lectures
  • Study Guide: 1969 Pages
  • Latest Questions
  • 100% Accurate Answers
  • Fast Exam Updates

200-301 Premium Bundle

Cisco 200-301 Premium Bundle
  • Premium File: 760 Questions & Answers. Last update: Nov 12, 2026
  • Training Course: 271 Video Lectures
  • Study Guide: 1969 Pages
  • Latest Questions
  • 100% Accurate Answers
  • Fast Exam Updates
$79.97
$59.98

Cisco 200-301 Practice Test 60

Question 590

An IOS XE router has an applied class-based WAN QoS policy. Users report loss during congestion. The engineer needs read-only per-class match, offered-rate, queue and drop counters on the actual egress interface to distinguish policing losses from queue drops. Which command is the best starting point?

  1. show ip route ospf
  2. show interfaces trunk
  3. show running-config | section router ospf
  4. show policy-map interface GigabitEthernet0/0

Explanation

Correct Answer

D:

`show policy-map interface` exposes applied QoS policy classes with matched packets and supported rate, queue and drop statistics for runtime troubleshooting.

Incorrect Answers

A:

The IP route table does not report the active QoS per-class packet accounting and drop counters.

B:

802.1Q trunk state is not the per-class WAN egress policy and packet-drop evidence requested.

C:

OSPF process configuration cannot show current QoS class matches, queues or drops on the active interface.

Question 591

An IOS router has a domain name configured and must accept SSHv2; it currently has no usable RSA host key pair. Which cryptographic key-generation command supplies the SSH server's host keys?

  1. Generate an RSA key pair using crypto key generate rsa
  2. Configure ip ssh version 2 with no SSH host key configured
  3. Configure username operator secret but leave RSA host keys absent
  4. Set transport input ssh on VTY and assume that creates missing RSA keys

Explanation

Correct Answer

A:

An IOS SSH server needs appropriate cryptographic host keys and a supported SSH configuration; generating an RSA key pair provides those keys. Secure operation also requires authenticated users and VTY transport restrictions.

Incorrect Answers

B:

Choosing a protocol version does not generate the missing cryptographic server host key pair.

C:

Local credentials support user login but do not establish the server RSA key identity required for this SSH setup.

D:

Restricting incoming terminal transport does not itself generate the required cryptographic host keys.

Question 592

A Cisco IOS switch must authenticate an administrator named `operator` using a local nonplaintext secret, not an unprotected line password. Which local user-database command defines that identity?

  1. Configure a VTY line password instead of a named local IOS user
  2. Configure enable secret as the user operator password
  3. Configure login local on VTY without creating the operator account
  4. Create a username with a secret

Explanation

Correct Answer

D:

A local username configured with `secret` stores a protected credential for IOS authentication. The VTY lines must be set to use `login local` or suitable AAA policy before that user record is checked.

Incorrect Answers

A:

A shared line password does not create the required named operator identity with an IOS stored secret.

B:

Enable secret protects privileged EXEC escalation, not a separate local username entry for login.

C:

VTY login local enables a lookup against existing local accounts but does not create the new operator credential.

Question 593

SSH transport is enabled on IOS VTY lines, but login attempts should check the switch's configured local username/secret database. Which VTY login setting enforces local authentication?

  1. Set transport input ssh without configuring a VTY login method
  2. Set password on the VTY line and use login without local
  3. Generate new SSH RSA keys without modifying the VTY authentication method
  4. Configure login local under line vty

Explanation

Correct Answer

D:

`login local` directs a VTY login to the local username/secret database rather than a shared line password. This controls authentication; `transport input ssh` separately limits the allowed transport protocol.

Incorrect Answers

A:

VTY transport selection restricts protocol but does not tell IOS to authenticate users against its local username database.

B:

An independent shared VTY line password is not the local named-user authentication required.

C:

Keys identify the SSH server but do not switch the VTY login method to the defined local user database.

Question 594

A Cisco IOS XE router already has a domain name, supported RSA host keys and an authorized VTY login method. The administrator must explicitly require the supported modern SSH protocol version for new CLI management sessions. Which global command does that?

  1. transport input telnet on the VTY lines
  2. ip ssh version 2
  3. ip http server
  4. login local in interface configuration mode

Explanation

Correct Answer

B:

The ip ssh version 2 command selects SSHv2 on supported IOS images, using the previously configured keys and authentication method.

Incorrect Answers

A:

Telnet allows an unencrypted legacy terminal transport and does not negotiate the SSH protocol version.

C:

The HTTP service enables web management on supported devices, not version selection of encrypted terminal SSH sessions.

D:

Login local is a line authentication setting, not an interface command for selecting which SSH transport version is offered.

Question 595

The SSH daemon is enabled on an IOS router. A technician wants its configured SSH protocol version, timeout and authentication parameters without changing configuration. Which show command reports SSH server status?

  1. Run show users
  2. Run show line vty 0 4
  3. Run show running-config | section line vty
  4. Run show ip ssh

Explanation

Correct Answer

D:

The show command exposes IOS SSH server status and configuration.

Incorrect Answers

A:

Show users lists active terminal sessions; it does not directly report the SSH server version, timeout or authentication retry parameters.

B:

Line output examines terminal line properties rather than the SSH server’s negotiated/protocol configuration overview.

C:

That reveals VTY line transport/authentication configuration but is not the requested concise SSH server-status display.

Question 596

A router must copy a small configuration backup to a trusted management LAN host using a lightweight UDP file-transfer service with **no built-in login**. Which legacy file-transfer protocol is described?

  1. Use FTP over TCP with username/password authentication
  2. Use an SSH-based SFTP subsystem
  3. Use HTTP PUT to a web server
  4. Use TFTP to an authorized server

Explanation

Correct Answer

D:

TFTP is a lightweight file-transfer protocol using UDP port 69 for initial requests and provides no native user-login protection. It belongs on a controlled management network rather than an untrusted public link.

Incorrect Answers

A:

Conventional FTP uses TCP control and login rather than the specified lightweight unauthenticated UDP transfer.

B:

SFTP encrypts/authenticates over an SSH transport and does not use the described UDP-based TFTP request protocol.

C:

HTTP upload requires a supported web endpoint and uses TCP or HTTP/3 QUIC; it is not the described TFTP request protocol.

Question 597

A file-transfer job on a controlled management server explicitly requires FTP's authenticated control connection, not TFTP's unauthenticated UDP requests. Which traditional protocol meets the login model?

  1. Use TFTP with no login or control connection
  2. Use SFTP over SSH and identify it as classical FTP
  3. Use an HTTPS POST file-upload endpoint
  4. Use FTP with its user login mechanisms

Explanation

Correct Answer

D:

Ordinary FTP separates a TCP control login channel from data transfers and supports usernames and passwords. It does not encrypt those credentials by default, so it is unsuitable for secrets over an untrusted network without added protection.

Incorrect Answers

A:

TFTP runs over UDP without the conventional FTP authenticated TCP control channel requested.

B:

SFTP is a distinct SSH file-transfer protocol and not the specified traditional FTP control service.

C:

A web application upload does not implement the classic FTP authenticated command and control channel.

Question 598

An engineer is documenting initial TFTP read/write requests and must identify the standard well-known destination UDP port for the first request. Which port is used?

  1. Use UDP port 69
  2. UDP port 67, used by DHCP servers
  3. TCP port 21, used for FTP control
  4. UDP port 161, used by SNMP agents

Explanation

Correct Answer

A:

TFTP initiates its transfers through UDP port 69 before selecting transfer identifiers.

Incorrect Answers

B:

UDP 67 handles DHCP/BOOTP server traffic rather than initial TFTP requests.

C:

FTP control is TCP-based and not the initial UDP service port that the TFTP client contacts.

D:

SNMP polling uses UDP 161, not the well-known TFTP service port.

Question 599

A firewall rule must permit the **control connection** of conventional FTP from a client to a server. Which well-known TCP port establishes that FTP control channel?

  1. TCP port 20, traditionally associated with FTP data in active mode
  2. UDP port 69, used for TFTP requests
  3. TCP port 22, commonly used for SSH/SFTP
  4. Use TCP port 21

Explanation

Correct Answer

D:

FTP uses a TCP control session commonly listening on port 21.

Incorrect Answers

A:

TCP 20 can be used as the active-mode FTP server data source, but the control connection uses TCP 21.

B:

TFTP uses UDP and has no FTP TCP control-session semantics.

C:

SSH-based file transfer uses 22 but is a different protocol from the conventional FTP control channel.

Question 600

A configuration archive contains sensitive credentials and the transfer network is not fully trusted. Which encrypted alternative avoids sending the payload via plaintext FTP or TFTP?

  1. Use plain FTP with a strong password but no encrypted transport
  2. Use a protected alternative such as SFTP or an approved encrypted channel
  3. Use TFTP only on the same public network
  4. Encrypt only the destination filename while transferring the file unencrypted

Explanation

Correct Answer

B:

Conventional TFTP and FTP do not encrypt sensitive configuration contents.

Incorrect Answers

A:

Traditional FTP sends payload data without confidentiality; a strong login password alone does not encrypt the archived file.

C:

TFTP includes no intrinsic encryption/authentication and does not protect sensitive configuration content.

D:

A hidden filename does not encrypt transferred configuration bytes or embedded secrets.

Cisco Certified Network Associate (CCNA) (200-301) Practice Tests

Avanset - #1 VCE Player & Designer
How to Open VCE Files

Use VCE Exam Simulator to open VCE files

VCE Player for MAC
Sign UpSign Up Learn MoreLearn More Full VersionFull Version
UP

SPECIAL OFFER: GET 10% OFF

This is ONE TIME OFFER

ExamSnap Discount Offer
Enter Your Email Address to Receive Your 10% Off Discount Code

A confirmation link will be sent to this email address to verify your login. *We value your privacy. We will not rent or sell your email address.

Download Free Demo of VCE Exam Simulator

Experience Avanset VCE Exam Simulator for yourself.

Simply submit your e-mail address below to get started with our interactive software demo of your free trial.

Free Demo Limits: In the demo version you will be able to access only first 5 questions from exam.