100% Latest & Updated Cisco 200-301 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 720
A WPA2-Personal wireless security profile still permits legacy TKIP in mixed cipher mode. The security baseline requires clients to negotiate AES-CCMP and prohibits TKIP. What setting must be validated and enforced?
- Configure AES-CCMP as the permitted WPA2 data cipher and disable TKIP
- Enable WPA2 with both TKIP and AES while leaving legacy TKIP selectable
- Change the WLAN SSID name to include AES
- Enable open authentication and depend on upstream VPNs for encryption
Explanation
Correct Answer
A:The WLAN encryption policy should permit AES-CCMP for WPA2-Personal data and remove TKIP negotiation under the AES-only baseline. Changing SSIDs or management settings cannot enforce the negotiated cipher.
Incorrect Answers
B:The compliance requirement explicitly prohibits TKIP-only and legacy cipher negotiation; leaving TKIP enabled is not a verified AES-only posture.
C:An SSID name does not control or prove the negotiated data cipher.
D:A VPN may protect selected applications but does not satisfy WPA2-Personal AES-CCMP radio-link confidentiality requirements.
Question 721
A network engineer currently logs into 60 Catalyst switches individually to apply the same reviewed interface description and then manually records success. The goal is consistent repeatable deployment with fewer CLI transcription errors. Which change approach best meets the goal?
- Copy and paste the change by hand into each of the 60 CLI sessions
- Inspect last week’s configuration drift report but never deploy a change
- Disable change validation and send the same command to every device blindly
- Use repeatable programmatic configuration workflows
Explanation
Correct Answer
D:Automating repeatable device changes avoids manually retyping identical CLI lines across routers and switches, reducing inconsistency and time spent on routine deployments. A reviewed template also makes intended changes reproducible.
Incorrect Answers
A:Manual repetition retains the main source of typing errors and does not provide a repeatable automated deployment process.
B:A drift report identifies differences but does not apply the requested standardized update to all devices.
C:Unvalidated deployment expands the blast radius of a bad change and does not satisfy the goal of a controlled repeatable workflow.
Question 722
A campus team maintains an approved baseline for switch port-security and management ACL settings. Nightly checks reveal one access switch no longer matches the approved baseline, but its last deployment completed without error. Which automation check directly detects this condition?
- Repeat the last configuration push without reading current device state
- Review an old approved Git commit without collecting current network configuration
- Run a configuration drift comparison
- Look only at packet loss tests from a user station
Explanation
Correct Answer
C:Drift detection compares observed running configuration against an approved baseline and highlights deviations for investigation. It does not require assuming every difference is malicious; authorized exceptions must be evaluated.
Incorrect Answers
A:Blind reapplication is not a comparison of observed state against approved intent and can hide or worsen unexpected differences.
B:Version history alone proves what was approved, not what the live switch actually has configured now.
D:Traffic health can be normal even when policy commands drift from approved configuration, so reachability alone is insufficient.
Question 723
A network automation team needs to reconstruct who changed a standard configuration template, compare old and new lines, and roll back an incorrectly approved edit. Which source management practice provides that audit trail?
- Store the only copy of the template in an untracked text editor buffer
- Store configuration as version-controlled source
- Keep the latest configuration only on the last upgraded switch
- Enable more detailed syslog on every switch but never version the template
Explanation
Correct Answer
B:Storing templates and intended configurations under version control gives a diffable change history, supports review and traceable approvals, and enables controlled rollback to a known revision.
Incorrect Answers
A:An untracked buffer cannot provide reliable change diffs, commit history, reviewers or a known rollback baseline.
C:A device running configuration is operational state, not an authoritative versioned history of changes to shared intent.
D:Syslog can record device events but is not a complete reviewable source-control history of automation templates and edits.
Question 724
An Ansible change is ready to update ACLs on 200 branches. The team must detect a malformed command or failed policy assertion before any production device changes. Which pipeline stage is most relevant?
- Run the deployment to all production devices and inspect complaints afterward
- Skip linting and checks so the pipeline finishes sooner
- Run validation and predeployment tests in a pipeline
- Use only a source-control tag naming the release
Explanation
Correct Answer
C:Predeployment validation and tests can check syntax, intended state and policy constraints before production changes, reducing the chance of deploying a faulty network command.
Incorrect Answers
A:This postpones detection until after a broad potentially disruptive change and does not meet predeployment safety requirements.
B:Without validation, avoidable syntax errors and unintended changes can reach production rather than being detected ahead of time.
D:A version tag identifies a revision but does not test its syntax, expected configuration effects or policy constraints.
Question 725
A single template update must reach hundreds of branch switches, but the operations team requires limited blast radius, measurements after each step and a reversible deployment plan. Which rollout strategy satisfies all three controls?
- Push the update simultaneously to every site without a pilot
- Archive the candidate template but leave all production switches unchanged
- Disable operational checks during the change window
- Use staged deployment with verification and rollback controls
Explanation
Correct Answer
D:A staged or canary rollout with explicit post-change checks and rollback criteria limits blast radius and permits a pause or reversal if observed behavior violates the intent.
Incorrect Answers
A:A global uncontrolled rollout maximizes the number of sites affected before any production validation can detect an adverse effect.
B:Archiving alone does not carry out the required change and provides no operational phased validation.
C:Suppressing measurements prevents identifying regressions at each step and conflicts with the specified verification controls.
Question 726
An automation job configures an access VLAN and a permitted trunk list on forty managed switches. The same approved job is rerun after a harmless controller timeout, and the desired device state is already present. Which script behavior prevents the rerun from accumulating unwanted changes?
- Append the same VLAN to each allowed list repeatedly without checking whether it is already present
- Run every configuration command twice irrespective of current state and suppress any change output
- Generate new VLAN IDs at random on every retry to prove the automation is running
- Use idempotent state-convergent tasks that detect the already-correct configuration and make no additional changes
Explanation
Correct Answer
D:Idempotent automation reconciles observed and desired state, so retrying the same approved task leaves already-compliant devices unchanged and repairs only actual drift.
Incorrect Answers
A:Blind repeated append operations risk duplicate or altered configuration rather than converging safely to the requested end state.
B:Unconditionally repeating commands does not itself guarantee safe retries or accurate detection of drift and desired configuration state.
C:Randomizing requested VLANs changes the desired outcome and may break correct existing segmentation on retry.
Question 727
Many branch switches need one baseline ACL and interface standard without hand-typing the same CLI repeatedly. Which template or declarative network configuration approach reduces drift?
- Manually copy a slightly different CLI sequence to each branch switch
- Collect inventory only without generating or applying desired configuration
- Use an unversioned text snippet pasted by every technician with no validation
- Use centralized templates or declarative configuration
Explanation
Correct Answer
D:A standardized definition reduces per-device manual inconsistency.
Incorrect Answers
A:Independent hand-edits tend to increase configuration drift and do not enforce the common policy as one reusable baseline.
B:Inventory discovers devices but does not apply the shared ACL/interface standard requested.
C:A freeform snippet lacks centralized source control, templating and compliance verification that reduce drift.
Question 728
A change pipeline has configured new VLANs and routes, but deployment must fail automatically if SSH, gateway pings or route assertions do not match the expected state. Which operational test automation is appropriate?
- Use automated operational state and connectivity tests
- Trust a deployment success return code without verifying the resulting network behavior
- Validate only that the YAML syntax parses and skip post-deployment testing
- Send an email saying the change succeeded without checking device operational state
Explanation
Correct Answer
A:Postchange validation checks actual behavior rather than assuming deployment succeeded.
Incorrect Answers
B:A configuration push can succeed syntactically while breaking actual SSH, reachability or routing state.
C:Correct syntax does not prove the live routed and management connectivity behavior.
D:A notification is not the asserted post-change automated test gate.
Question 729
A monitored event should trigger an automatic corrective action, but only after policy checks and safeguards prevent unintended repeated changes. Which event-driven automation design provides that response?
- Use event-driven automation with safeguards
- Trigger an unrestricted config push on every repeated syslog event
- Run a scheduled report only, without acting on the detected event
- Ignore event context and run the same change on every device simultaneously
Explanation
Correct Answer
A:Event-based workflows respond to monitored conditions within approved bounds.
Incorrect Answers
B:Without deduplication, policy and safety guards the automation may loop or make disruptive repeated changes.
C:Scheduled reporting observes changes but does not implement the requested event-triggered guarded remediation.
D:A safe event-driven action must scope the affected devices and require relevant preconditions.
Question 730
An automation job is rerun with the same intended state and should make no unnecessary config changes on already compliant devices. Which idempotent task behavior is required?
- Append duplicate ACL entries on each run regardless of existing state
- Rotate the VLAN IDs on every execution so the switch always reports changed
- Use idempotent automation tasks
- Force a full device reload on every job run whether or not the configuration differs
Explanation
Correct Answer
C:An idempotent operation converges on desired state without unintended repeated changes.
Incorrect Answers
A:Repeated changes to an already compliant device violate idempotence.
B:Changing identity across runs conflicts with convergence on one intended final state.
D:An unnecessary reload is disruptive and fails the no-change-on-compliant-device requirement.
Cisco Certified Network Associate (CCNA) (200-301) Practice Tests
