Cisco 200-301 Exam Dumps, Practice Test Questions

A /24 wildcard covers only 10.10.16.0–10.10.16.255 and excludes other hosts in the required /20.

This /19-style wildcard includes 10.10.0.0–10.10.31.255 and is broader than the exact /20.

This selects the lower /20 10.10.0.0–10.10.15.255 rather than the requested /20 starting at 16.

The scenario specifies UDP DNS queries, so TCP-only transport does not match those requests.

A blanket permit defeats the source, host and destination-port restriction.

Clients commonly use ephemeral UDP source ports; destination UDP 53 identifies the recursive resolver service.

SSH normally uses TCP transport; permitting UDP 22 alone does not allow the stated TCP session.

This needlessly broadens both the protected hosts and services beyond one named router TCP 22.

SSH clients generally use ephemeral source ports; destination TCP 22 is the server listener.

The broad permit would match 192.0.2.19 first, so the subsequent deny never executes for that host.

ACL evaluation is first-match by ordered sequence; deny does not inherently outrank permit.

The objective is to deny traffic originating from this host, so direction and host predicate matter.

The ACL definition and counters alone cannot prove where and in which direction it is applied.

Routes reveal forwarding paths, not which access-group is attached inbound or outbound.

VLAN membership is unrelated to the interface access-group direction in routed IPv4 policy.

A stateless ACL lacks connection tracking and can independently deny the reverse traffic.

An unrestricted blanket permit is not a safe replacement for the required return-policy analysis.

Routing-source preference cannot authorize packets blocked by a stateless ACL in the return direction.

Making untrusted clients trusted defeats the boundary that blocks rogue server replies originating at access ports.

DAI validates ARP IP/MAC bindings, not server-role authorization of DHCP offers; it is not a substitute for DHCP snooping.

Port security limits learned source MAC addresses but cannot reliably identify unauthorized DHCPOFFER messages from one otherwise permitted MAC.

Port security controls switchport source MACs; it does not perform full ARP sender IP/MAC binding validation.

Trusting client ports lets rogue DHCP replies through and undermines the binding source DAI should depend on.

ARP spoofing occurs in local Layer 2 resolution and routing-table correctness does not validate forged ARP replies.

Snooping filters DHCP message trust; it does not limit the count of learned secure source MACs on one edge port.

Rate limits constrain traffic volume, not how many distinct MAC addresses are authorized on the port.

Routes use IP prefixes and do not enforce secure MAC count on Layer 2 access ports.

Trusting client-facing ports defeats the rogue-server filtering goal and can allow unauthorized DHCPOFFER traffic into the VLAN.

Disabling snooping restores uncontrolled DHCP traffic and removes the protection needed to distinguish legitimate server paths.

DAI trust controls ARP inspection, not whether the switch permits DHCP server replies at the configured snooping boundary.

A one-address limit is violated by the second unauthorized MAC, so the observed Secure-shutdown status cannot mean unrestricted forwarding.

The port-security counter reports a MAC-security limit event rather than proving a native VLAN tagging mismatch.

Spanning-tree role/state is a different control plane; the displayed port-security status and count directly identify MAC-security enforcement.