100% Latest & Updated Cisco 200-301 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 690
A Catalyst 9300 switch has Dynamic ARP Inspection enabled on VLAN 25, and an untrusted access port legitimately sends a short burst of 80 ARP packets per second. The IP/MAC bindings are valid, but the port enters err-disabled state. The untrusted port uses the default DAI rate limit. Which independent DAI protection explains the shutdown?
- DHCP snooping permanently blocks every host that uses a static IPv4 configuration even when the ARP bindings are valid
- ARP ACLs automatically deny every request after 15 packets, even on a trusted interface with unlimited ARP rate
- The per-interface DAI ARP packet-rate limit is exceeded (normally 15 pps on untrusted ports), causing err-disable
- PortFast detects repeated legitimate ARP transmissions and automatically converts the interface into a spanning-tree blocking port
Explanation
Correct Answer
C:Cisco Catalyst DAI rate-limits incoming ARP on untrusted interfaces to 15 packets per second by default; exceeding that limit causes the switch to error-disable the interface, even when individual ARP identity bindings are otherwise acceptable.
Incorrect Answers
A:DHCP snooping is not itself a mandatory prohibition on all statically configured hosts; DAI binding policy and packet-rate handling are separate checks.
B:An ARP ACL governs whether ARP claims match its configured policy. DAI rate limiting is a separate limit and trusted ports are not limited by the default untrusted rate.
D:PortFast accelerates STP edge forwarding behavior and does not implement DAI ARP packet-rate enforcement.
Question 691
A network administrator presents an account name and password to an IOS AAA login method list. The system must verify the asserted identity **before** applying any privilege policy or recording resource usage. Which AAA function performs that identity check?
- Accounting: record command/session usage after access is granted
- Authorization: determine which commands and services an identified user may use
- Accounting stop-record processing for a completed session
- Authentication: verify credentials and the presented login identity
Explanation
Correct Answer
D:Authentication compares submitted credentials with an approved identity source before the user is admitted.
Incorrect Answers
A:Accounting retains audit records of activity, and does not itself validate an identity at login.
B:Authorization grants or denies specific rights after identification; it cannot replace credential verification.
C:Stop-record accounting is an audit event after a session, not the original access identity check.
Question 692
A user has authenticated successfully but is not allowed to execute `configure terminal` on the switch. Which AAA stage determines the privileges and permitted commands after login?
- Use authorization
- Use authentication
- Use command accounting to record actions after they occur, without evaluating whether the command is permitted
- Use only an unauthorizing login success record without an EXEC or command authorization policy
Explanation
Correct Answer
A:Authorization evaluates whether an authenticated user is permitted to run particular commands or access a function. Accounting is separate: it records what actions or sessions actually occurred.
Incorrect Answers
B:Authentication proves that the credential or identity is valid; it does not alone decide whether configure terminal is allowed after successful login.
C:Accounting generates an audit record of an executed command or session, but logging does not itself approve or deny a requested command.
D:A successful login event without command/EXEC authorization does not implement a permission decision for the requested privileged configuration command.
Question 693
An enterprise TACACS+ server already validates a network operator’s identity. Audit policy now requires a timestamped record of when that operator starts and ends an administrative EXEC session. Which AAA function is needed?
- Authentication, which checks the operator credentials again after every keystroke
- Authorization, which only grants the operator access to individual show commands
- Accounting with EXEC start/stop session records on the AAA server
- DHCP snooping, which records client address leases on access switches
Explanation
Correct Answer
C:AAA accounting can transmit EXEC session start and stop events to the designated TACACS+ server for later audit correlation.
Incorrect Answers
A:Authentication establishes identity at login but does not by itself produce a start-and-stop audit trail for the user session.
B:Authorization decides permitted privileges or commands; it cannot substitute for accounting records of when the session begins and ends.
D:DHCP snooping validates client/server DHCP exchanges and does not track administrative command-line login sessions.
Question 694
A corporate wireless network authenticates employee supplicants through WPA2-Enterprise 802.1X. The wireless authenticator must send access requests to a centralized AAA service. Which protocol/service pairing is standard for this task?
- RADIUS server handling EAP-backed network-access authentication requests
- TFTP server holding downloadable IOS configuration files
- Syslog collector whose severity threshold matches WLAN alarms
- NTP server synchronizing access-point clocks across VLANs
Explanation
Correct Answer
A:RADIUS is widely used as the back-end AAA transport for 802.1X network access and can carry the authentication exchange for enterprise WLAN admission.
Incorrect Answers
B:TFTP can transfer files but does not perform the EAP/RADIUS access-accept or access-reject decision for a supplicant.
C:Syslog records events and alerts; it is not the identity-validation back end used by the WLAN authenticator.
D:NTP supplies synchronized time, potentially useful to authentication systems, but it does not evaluate supplicant credentials.
Question 695
A network administrator successfully logs in to an IOS router but must be denied the `configure terminal` command unless a TACACS+ policy approves it. Which AAA operation enforces the per-command privilege decision?
- AAA authentication login, which identifies a user but cannot evaluate each entered command
- AAA accounting exec, which records session timestamps but does not prevent a command
- AAA authorization commands for the relevant privilege level via a TACACS+ method list
- SNMPv3 authPriv polling of router interfaces after the user executes the command
Explanation
Correct Answer
C:TACACS+-backed command authorization can check a command against the user’s permitted operations before IOS executes it.
Incorrect Answers
A:Login authentication answers who the user is; it is not the command-by-command authorization step required by the policy.
B:Accounting supplies an activity trail, not a pre-execution allow-or-deny decision for a restricted privileged command.
D:SNMPv3 protects monitoring exchanges and has no role in authorizing a CLI command submitted by an authenticated administrator.
Question 696
An IOS router uses `aaa authentication login default group tacacs+ local` and has a valid local emergency account. Which condition is required before the device tries the local method after TACACS+ is attempted?
- The TACACS+ method is unavailable or errors out; an explicit reject from a reachable server does not trigger local fallback
- Any wrong password rejected by a reachable TACACS+ server automatically activates the local account check
- The local method is always tried first even if TACACS+ responds normally
- The router ignores all AAA replies and falls back when the username contains a dash
Explanation
Correct Answer
A:An AAA method list generally moves to the next method upon an error/unavailability, not upon an authoritative authentication failure from the selected TACACS+ server.
Incorrect Answers
B:An explicit valid server denial is a failed authentication, so falling back to local would bypass that policy; Cisco documents that it does not do this.
C:Method order is TACACS+ first, local second, so local is not the normal first attempt.
D:Username punctuation is not a legitimate reason to discard reachable AAA responses or alter the configured method list.
Question 697
A help-desk engineer authenticates successfully to a router but should receive read-only operational access rather than configuration privileges. What AAA check governs which privilege level and commands become available after login?
- Authorization based on the engineer’s allowed access attributes and policy
- Authentication alone, because successful password verification always grants privilege 15
- Accounting alone, because logging the command prevents unauthorized execution
- NTP authentication, because synchronized time controls IOS privilege escalation
Explanation
Correct Answer
A:Authorization maps an authenticated identity to allowable services or privilege levels; successful login does not imply full administrative rights.
Incorrect Answers
B:Authentication validates identity and can succeed for users with limited permissions; it does not automatically authorize privilege 15.
C:Accounting is an evidence trail and does not replace permission checks that decide what a user may do.
D:NTP authentication secures time synchronization packets, not the command privileges of a logged-in network engineer.
Question 698
An audit requires a per-command record of privilege-15 configuration actions, including which authenticated operator executed each action. A TACACS+ system is available. Which IOS AAA category must be configured?
- A login authentication method list only; it records every subsequent privileged command by default
- Command accounting for privilege level 15 using a TACACS+ method list
- An SNMP GET polling schedule for interface packet counters
- A console logging severity threshold instead of AAA user identity records
Explanation
Correct Answer
B:AAA command accounting can produce records for commands at a configured privilege level, allowing an audit server to correlate actions and users.
Incorrect Answers
A:A login method list checks user credentials; it does not inherently generate per-command accounting records for privileged changes.
C:SNMP counter polling observes device statistics and does not reliably associate individual CLI commands with their operators.
D:Syslog severity controls which system messages are selected; it does not replace explicit AAA command-accounting policy.
Question 699
A campus uses central authentication with detailed per-command authorization and accounting for IOS administrators. Which AAA transport protocol is suitable when the policy requires TACACS+ features?
- Choose RADIUS and assume all IOS per-command authorization semantics are identical
- Configure local AAA user secrets only with no central TACACS+ server
- Choose TACACS+ under a documented policy
- Enable only SSH encryption and omit the AAA authorization/accounting service
Explanation
Correct Answer
C:TACACS+ supports granular device administration control.
Incorrect Answers
A:RADIUS can support centralized AAA but TACACS+ is commonly used for granular IOS command authorization and accounting.
B:Local authentication does not implement the required centralized command-level policy across devices.
D:Secure remote transport protects bytes but does not supply the specified central per-command authorization.
Question 700
A Cisco Catalyst 9800 WLAN uses a single 802.1X SSID for staff and contractors. After identity authentication, Cisco ISE must assign staff to VLAN 30 and contractors to VLAN 40 dynamically without requiring two different SSIDs. Which RADIUS authorization response mechanism determines the assigned VLAN?
- Send only a Syslog notification identifying the authenticated username, without RADIUS attributes
- Force every associated user to inherit the trunk native VLAN regardless of the RADIUS reply
- Return Access-Accept with the VLAN tunnel attributes, including Tunnel-Type, Tunnel-Medium-Type and Tunnel-Private-Group-ID
- Replace the WLAN SSID name with the VLAN number so that no user authorization attributes are required
Explanation
Correct Answer
C:After successful 802.1X authentication, a RADIUS Access-Accept can carry IETF tunnel attributes 64 (VLAN type), 65 (802 medium) and 81 (VLAN/group ID), allowing the controller to assign the authorized user to the specified VLAN.
Incorrect Answers
A:Syslog can record a result, but a log message does not carry the network-access authorization attributes that tell the controller which VLAN to use.
B:A trunk native VLAN concerns untagged Ethernet transport; it does not override per-user RADIUS-assigned WLAN policy for an 802.1X client.
D:An SSID is the wireless service identity, not a per-user authorization attribute; renaming it cannot dynamically assign different VLANs to staff and contractors.
Cisco Certified Network Associate (CCNA) (200-301) Practice Tests
