Free Practice Questions for Cisco 200-301 Exam

Answer C is the technically correct selection. VLAN hopping is reduced by moving the native VLAN away from VLAN 1 and using an unused VLAN ID for untagged trunk traffic. A double-tagging attack depends on the attacker reaching a trunk that uses the same native VLAN, so making the native VLAN unused removes that easy path. This aligns with Cisco CCNA 200-301 v1.1 because the exam blueprint requires engineers to recognize operational behaviour from configuration symptoms and topology requirements. Dynamic ARP Inspection protects ARP, not VLAN tags; ACLs do not stop trunk negotiation; port security alone does not fix native VLAN exposure. Treat the distractors carefully: most are real Cisco terms, but they solve a different problem or operate at a different layer. The selected answer is the one that would be used by an engineer on the device or in the design to produce the outcome stated in the question.

In controller-based networking, the southbound API is the interface between the controller and the network devices it manages. The controller uses southbound communication to discover devices, collect operational data, push configuration, and influence forwarding behavior. Cisco CCNA 200-301 v1.1 separates this from northbound APIs, which are used by applications, orchestration tools, or business systems to communicate with the controller. The answer cannot be overlay or underlay because those terms describe logical and physical network transport designs, not API direction. Northbound is also wrong because it faces upward toward applications, not downward toward routers, switches, and access points. Common southbound technologies include NETCONF, RESTCONF, gNMI, and in SDN discussions, OpenFlow. The safest exam model is directional: northbound equals application-to-controller, while southbound equals controller-to-device. Since edge devices are the managed infrastructure, the API used to interact with them is southbound.

In a NAT translation table, the source address seen after inside-to-outside translation is the inside global address. The inside local address is the private address assigned to the internal host. The inside global address is the translated address that represents that internal host to the outside network. In the exhibit-based answer set, 172.23.104.4 is the address used as the translated source, so D is correct. This question is easy to miss if NAT terms are treated as labels instead of traffic direction. For outbound traffic, NAT changes the source from the inside local value to the inside global value. For return traffic, NAT reverses the operation and maps the destination back to the inside local host. Cisco CCNA v1.1 IP Services includes NAT concepts and configuration, so candidates must know inside local, inside global, outside local, and outside global. The tested idea is not merely public versus private; it is which translated field is used as the packet source.

Dynamic desirable actively attempts to form a trunk by sending Dynamic Trunking Protocol messages. If the neighboring switch is in trunk, dynamic desirable, or dynamic auto mode, the link negotiates as a trunk. The result described by option D is therefore correct: the link becomes a trunk port. The link would not be down or err-disabled simply because dynamic desirable is configured. It also would not become an access port if the DTP negotiation succeeds. This question tests a common CCNA 200-301 v1.1 Network Access table: trunk and dynamic desirable form a trunk; desirable and auto form a trunk; auto and auto do not actively negotiate a trunk. In production, many engineers avoid DTP by hard-coding trunk mode and using switchport nonegotiate, but the exam still expects recognition of DTP behavior. The verified answer is D. Reference: Cisco Catalyst trunking and Dynamic Trunking Protocol configuration behavior.

The correct response is D. With default DNS lookup behaviour, Cisco IOS attempts to resolve unrecognized text or hostnames. If a name server is not explicitly configured, the device may try a broadcast-style lookup attempt while translating the entered string. For Cisco CCNA 200-301 v1.1, the important point is the mechanism, not a generic description of the technology. It does not start a ping automatically or ask the user to type an IP address first. When this appears in a network, the symptom normally confirms the answer: the route installed, the state selected, the packet forwarded, the wireless client behaviour, or the management workflow will follow this rule. That is why this answer is the best fit for the scenario and not just a plausible networking term.

The correct response is C. A firewall checks packets against security policy and, in stateful designs, connection state. It determines whether traffic is legitimate before allowing it between security zones or networks. For Cisco CCNA 200-301 v1.1, the important point is the mechanism, not a generic description of the technology. Layer 2 switches forward frames, load balancers distribute sessions, and LAN controllers manage wireless infrastructure. When this appears in a network, the symptom normally confirms the answer: the route installed, the state selected, the packet forwarded, the wireless client behaviour, or the management workflow will follow this rule. That is why this answer is the best fit for the scenario and not just a plausible networking term.

DNS lets applications use names instead of forcing users and software to work directly with IP addresses. A client can ask for the address associated with a hostname, and DNS returns the resource records needed to reach that service. DNS can also map one name to multiple IP addresses, which supports simple distribution, redundancy, or service design depending on the record type and client behavior. It does not encrypt WAN traffic by default, and it does not secure IP addresses merely by hiding them behind fully qualified domain names. DNS is hierarchical, not flat, which is why the root, top-level domains, authoritative zones, and host records can scale globally. Cisco CCNA 200-301 v1.1 covers DNS under IP Services because name resolution is required for many network operations, including management access, web services, and application connectivity. The two valid roles here are enabling applications to identify resources by name and allowing a hostname to be associated with more than one IP address.

Use A for this item. The global spanning-tree portfast default command makes access ports transition to forwarding immediately when endpoints connect. PortFast is intended for host-facing access ports so DHCP and initial connectivity are not delayed by STP listening and learning behaviour. In Cisco CCNA 200-301 v1.1, Network Access questions frequently test the practical boundary between similar features: what the feature does, where it is configured, and what problem it is meant to solve. The trunk PortFast command is for special trunk edge cases, and disabling PortFast would not meet the requirement. A clean way to validate the answer is to map the wording of the scenario to the actual device function. If the feature supplies addressing, forwarding, authentication, trunking, route selection, or controller communication, the answer must match that function exactly rather than a nearby protocol name.

The correct command is ipv6 address 2001:DB8:5:112::/64 eui-64. The wording says the address is generated from a specified IPv6 prefix and the interface MAC address. That is exactly what the eui-64 keyword does: it derives the 64-bit interface identifier from the MAC address and combines it with the configured /64 prefix. The ipv6 address autoconfig command also can create an address, but it learns the prefix from Router Advertisement messages through SLAAC; the prefix is not explicitly specified in the command. DHCPv6 would request addressing information from a DHCPv6 server, and the link-local option shown is not a global unicast address built from the stated prefix. Cisco CCNA v1.1 Network Fundamentals includes IPv6 address types and address configuration methods, and this question tests precise IOS syntax. When the prefix is typed in the command and the MAC-derived interface ID is required, choose the static EUI-64 form, not autoconfig.

Private IPv4 address ranges allow different organizations to reuse the same internal address space without creating global internet conflicts. RFC 1918 reserves 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 for private use. These addresses are not meant to be routed on the public internet. That reuse is one reason enterprises, homes, labs, and cloud networks can all use addresses such as 10.1.1.0 internally. When private hosts need internet access, NAT or another translation design is normally required. Cisco CCNA 200-301 v1.1 includes private addressing and NAT under IP Services because these concepts appear constantly in enterprise networks. The wrong answers imply that private addressing provides direct external reachability or removes the need for NAT, which is exactly backwards. Private addressing conserves public IPv4 space and avoids the need for every internal host to consume a globally unique address. Therefore, A correctly states the function.

Cisco WLC WPA2-PSK configuration supports a pre-shared key entered either as ASCII text or as a hexadecimal key. ASCII is the human-readable passphrase format administrators normally use, while hexadecimal is the raw key representation. Base64, binary, and decimal are not the WLC PSK input formats for this configuration task. This question is easy to miss because it is asking about the selectable key formats in the Cisco Wireless LAN Controller GUI, not about the WPA2 cipher itself. Under CCNA 200-301 v1.1 Network Access, candidates are expected to recognize basic WLAN security configuration elements, including WPA2, PSK, SSID, and wireless controller settings. In practice, using ASCII simplifies administration, while hexadecimal is useful when a precise key value must be supplied. The verified choices are therefore A and E. Reference: Cisco Wireless LAN Controller WLAN security configuration guidance for WPA/WPA2 pre-shared keys.

Use D for this item. HSRP provides first-hop redundancy by giving a group of routers a shared virtual IP address and virtual MAC address. Hosts use the virtual IP as their default gateway; the active router forwards traffic and the standby router takes over if the active fails. In Cisco CCNA 200-301 v1.1, IP Connectivity questions frequently test the practical boundary between similar features: what the feature does, where it is configured, and what problem it is meant to solve. HSRP is not route load balancing, Layer 2 flooding, or per-packet distribution across routed links. A clean way to validate the answer is to map the wording of the scenario to the actual device function. If the feature supplies addressing, forwarding, authentication, trunking, route selection, or controller communication, the answer must match that function exactly rather than a nearby protocol name.

The correct response is B. For 2.4-GHz Wi-Fi, the standard nonoverlapping channel plan uses channels 1, 6, and 11. Adjacent APs should be placed on nonoverlapping channels to reduce co-channel and adjacent-channel interference. For Cisco CCNA 200-301 v1.1, the important point is the mechanism, not a generic description of the technology. Grouping nearby APs on the same channel or physically adjacent overlapping channels increases contention and lowers performance. When this appears in a network, the symptom normally confirms the answer: the route installed, the state selected, the packet forwarded, the wireless client behaviour, or the management workflow will follow this rule. That is why this answer is the best fit for the scenario and not just a plausible networking term.

The verified answer is A. WPA2 with AES is the strongest encryption combination in the listed options. AES/CCMP replaced older WEP, RC4, and TKIP-based approaches and is the expected secure WPA2 cipher choice. Cisco CCNA 200-301 v1.1 places this skill in Security Fundamentals, where the exam expects a working understanding of how the feature behaves on real Cisco networks, not just a memorized command. WEP and TKIP are deprecated, and WPA with AES is not the preferred WPA2 security combination. In production, this distinction matters because a misapplied command or design choice usually creates an outage, a security gap, or unnecessary troubleshooting noise. The correct choice matches the control-plane, data-plane, wireless, security, or services behaviour described in the scenario and should be preferred over options that merely sound related.

SNMP is the protocol associated with IOS MIB access and centralized network management. The Management Information Base is the structured set of managed objects that an SNMP manager can query or, where permitted, modify on an SNMP agent. In the context of backing up many router configurations globally, SNMP can be used by management software to interact with Cisco IOS MIB objects and trigger configuration-copy operations. CDP discovers directly connected Cisco neighbors; it is not a configuration backup protocol. SMTP is for mail transfer. ARP resolves IPv4 addresses to MAC addresses on a local segment. Cisco CCNA v1.1 IP Services includes device management protocols such as SNMP, syslog, and NTP. The important distinction is scope: SNMP gives a management station structured visibility and control through MIB objects across many devices. That is why the Cisco IOS MIB clue points directly to SNMP.

By default, EIGRP calculates its composite metric using bandwidth and delay. The classic Cisco explanation is that the default K values make bandwidth and delay active, while reliability, load, and MTU are not used in the default metric calculation. Bandwidth is based on the slowest link along the path, and delay is cumulative across the path. Cisco CCNA 200-301 v1.1 includes EIGRP route-selection fundamentals even though advanced EIGRP tuning is beyond the basic exam depth. The wrong answers describe other protocols or incorrect defaults. OSPF uses cost, often derived from reference bandwidth divided by interface bandwidth. RIP uses hop count. EIGRP does not assign a universal default metric of 10 to learned routes. In practical troubleshooting, engineers compare feasible distance and successor routes, but the metric itself still comes from bandwidth and delay unless the K values are changed. For this question, the direct and tested answer is A.

Answer D is the technically correct selection. Badge readers on data-center doors are physical access control. They regulate who can enter protected spaces based on identity, role, and authorization. This aligns with Cisco CCNA 200-301 v1.1 because the exam blueprint requires engineers to recognize operational behaviour from configuration symptoms and topology requirements. RBAC can influence the policy, biometrics can be a factor, and MFA can strengthen authentication, but the control described is physical facility access. Treat the distractors carefully: most are real Cisco terms, but they solve a different problem or operate at a different layer. The selected answer is the one that would be used by an engineer on the device or in the design to produce the outcome stated in the question.

OSPFv2 neighbors do not form just because two routers can ping each other. Several parameters must agree before adjacency can progress. The interfaces must be in the same IP subnet and OSPF area. Hello and dead intervals must match. Authentication, if configured, must match. Stub-area flags must match, and MTU mismatches can prevent database exchange from completing. Router IDs must be unique, but they do not have to match. OSPF process IDs are locally significant on Cisco IOS, so the process number can differ between neighbors. Network type also matters because it affects DR/BDR election and adjacency behavior. Cisco CCNA v1.1 IP Connectivity includes single-area OSPFv2 configuration and neighbor adjacency requirements. The point of the drag-and-drop is to separate mandatory matching values from values that are local-only or simply need uniqueness. A clean OSPF adjacency requires matching operational parameters on the shared link, not identical router configuration everywhere.

This drag-and-drop item maps common Layer 2 and access-layer threats to their mitigation controls. Dynamic ARP Inspection protects against ARP spoofing or poisoning by validating ARP packets against trusted binding information. DHCP snooping blocks rogue DHCP behavior and builds the binding table used by other protections. BPDU Guard protects PortFast edge ports by err-disabling a port that receives an unexpected spanning-tree BPDU, which helps prevent rogue switch insertion. A nondefault or unused native VLAN, combined with disabling DTP and manually configuring trunks, reduces VLAN hopping exposure. Cisco CCNA 200-301 v1.1 Security Fundamentals and Network Access both touch these controls because many campus attacks happen before traffic ever reaches a firewall. The dependable way to solve the matching is to identify the abused protocol: ARP attacks map to DAI, DHCP attacks map to DHCP snooping, unexpected switch/STP participation maps to BPDU Guard, and trunk/native-VLAN abuse maps to VLAN-hopping mitigation.

The correct response is B. A southbound API enables communication between the controller and network hardware. The controller uses southbound protocols to read state and push operational intent or configuration to switches, routers, and other devices. For Cisco CCNA 200-301 v1.1, the important point is the mechanism, not a generic description of the technology. Northbound APIs face applications, and integration APIs connect management or orchestration systems. When this appears in a network, the symptom normally confirms the answer: the route installed, the state selected, the packet forwarded, the wireless client behaviour, or the management workflow will follow this rule. That is why this answer is the best fit for the scenario and not just a plausible networking term.