Free Practice Questions for Cisco 200-301 Exam

The verified answer is the displayed drag-and-drop mapping. Cisco WLC WLAN security settings map to Layer 2 security, Layer 3 security, and AAA-related mechanisms. Correct matching depends on separating authentication/encryption methods, web policy, and AAA server interaction. Cisco CCNA 200-301 v1.1 places this skill in Security Fundamentals, where the exam expects a working understanding of how the feature behaves on real Cisco networks, not just a memorized command. Mixing cipher settings with authentication servers is the usual error in this drag-and-drop item. In production, this distinction matters because a misapplied command or design choice usually creates an outage, a security gap, or unnecessary troubleshooting noise. The correct choice matches the control-plane, data-plane, wireless, security, or services behaviour described in the scenario and should be preferred over options that merely sound related.

The verified answer is C. The correct switchport configuration assigns PCs to the data VLAN and the Cisco phone to the voice VLAN. A typical access port uses switchport access vlan for the attached data device and switchport voice vlan for the phone voice traffic. Cisco CCNA 200-301 v1.1 places this skill in Network Access, where the exam expects a working understanding of how the feature behaves on real Cisco networks, not just a memorized command. Configurations missing either data or voice VLAN assignment will fail the stated placement requirement. In production, this distinction matters because a misapplied command or design choice usually creates an outage, a security gap, or unnecessary troubleshooting noise. The correct choice matches the control-plane, data-plane, wireless, security, or services behaviour described in the scenario and should be preferred over options that merely sound related.

access -distribution - core - distribution - access. The scenario should be solved by matching the described behavior to the Cisco feature that actually performs it. Cisco CCNA 200-301 v1.1 includes this topic under Network Access, so the answer must be validated against normal Cisco device behavior and the operational wording of the scenario. The key is not simply recognizing a familiar acronym; it is identifying what the feature does, where it is configured, and what result it produces. The other options are real networking terms or plausible phrases, but they operate at a different layer, solve a different problem, or do not create the outcome described. In a real network, selecting the wrong option would either leave the feature nonfunctional, create a forwarding or security gap, or send troubleshooting in the wrong direction. The selected answer is the only one that matches the stated requirement and the way Cisco switching, routing, services, security, wireless, or automation functions are expected to operate. This is why the verified answer remains the best technical choice for the question.

Option C. Cisco forwarding uses longest-prefix match first, then administrative distance and metric when multiple sources compete. Cisco CCNA 200-301 v1.1 includes this under IP Connectivity, where the expected skill is identifying the mechanism that actually satisfies the scenario. The wording usually gives the decisive clue: a protocol number, a route prefix, a control-plane role, a wireless security method, or a management command. Wrong choices either do not match the destination prefix, point to the wrong next hop, or fail to create the required primary or backup route. In a real network, selecting the wrong option would usually produce a failed adjacency, broken client connectivity, insecure management access, or an incorrect forwarding path. The selected answer matches the Cisco behavior and configuration model required by the question, so it is retained as the verified answer for this item.

in the binding database. IP services questions test the exact function of infrastructure services such as addressing, name resolution, time synchronization, logging, monitoring, and secure management. Cisco CCNA 200-301 v1.1 includes this topic under Network Access, so the answer must be validated against normal Cisco device behavior and the operational wording of the scenario. The key is not simply recognizing a familiar acronym; it is identifying what the feature does, where it is configured, and what result it produces. The distractors name valid services, but they provide a different service function from the one required in the prompt. In a real network, selecting the wrong option would either leave the feature nonfunctional, create a forwarding or security gap, or send troubleshooting in the wrong direction. The selected answer is the only one that matches the stated requirement and the way Cisco switching, routing, services, security, wireless, or automation functions are expected to operate. This is why the verified answer remains the best technical choice for the question.

set of values that represent the processes that can generate a log message. A syslog facility identifies the source process or functional area that generated a log message, such as local, kernel, mail, authorization, or other facility values used by a syslog receiver to classify messages. The facility is not the remote host that receives logs, and it is not a password or a severity grouping. Severity tells how urgent the event is; facility tells where the event belongs. Cisco CCNA 200-301 v1.1 IP Services expects that distinction because engineers must configure logging destinations, severity levels, and facilities without mixing their roles. In practice, a network device can send many different log messages to the same server, and the server can store or filter them based on facility plus severity. That is why the correct choice is the set of values representing the processes that can generate a log message.

Answer B,E is correct: B. implement port-based authentication; E. shut down unused ports. The scenario should be solved by matching the described behavior to the Cisco feature that actually performs it. Cisco CCNA 200-301 v1.1 includes this topic under Network Fundamentals, so the answer must be validated against normal Cisco device behavior and the operational wording of the scenario. The key is not simply recognizing a familiar acronym; it is identifying what the feature does, where it is configured, and what result it produces. The other options are real networking terms or plausible phrases, but they operate at a different layer, solve a different problem, or do not create the outcome described. In a real network, selecting the wrong option would either leave the feature nonfunctional, create a forwarding or security gap, or send troubleshooting in the wrong direction. The selected answer is the only one that matches the stated requirement and the way Cisco switching, routing, services, security, wireless, or automation functions are expected to operate. This is why the verified answer remains the best technical choice for the question.

It ignores the new static route until the existing OSPF default route is removed. OSPF decisions depend on router IDs, area membership, matching timers, network type, interface state, and cost calculation rather than arbitrary route preference. Cisco CCNA 200-301 v1.1 includes this topic under IP Connectivity, so the answer must be validated against normal Cisco device behavior and the operational wording of the scenario. The key is not simply recognizing a familiar acronym; it is identifying what the feature does, where it is configured, and what result it produces. Distractors that mention process IDs, unrelated metrics, or the wrong interface parameter do not satisfy OSPF neighbor or route-selection requirements. In a real network, selecting the wrong option would either leave the feature nonfunctional, create a forwarding or security gap, or send troubleshooting in the wrong direction. The selected answer is the only one that matches the stated requirement and the way Cisco switching, routing, services, security, wireless, or automation functions are expected to operate. This is why the verified answer remains the best technical choice for the question.

The correct response is A. Cisco DNA Center health dashboards summarize significant network issues so operators can prioritize remediation. The Overall Health view is meant to surface broad client, device, and network status information rather than raw host CPU charts. For Cisco CCNA 200-301 v1.1, the important point is the mechanism, not a generic description of the technology. Detailed logging for only ten devices or wireless-only summaries does not describe the overall dashboard function. When this appears in a network, the symptom normally confirms the answer: the route installed, the state selected, the packet forwarded, the wireless client behaviour, or the management workflow will follow this rule. That is why this answer is the best fit for the scenario and not just a plausible networking term.

Answer C is the technically correct selection. TACACS+ separates authentication, authorization, and accounting, while RADIUS commonly combines authentication and authorization. TACACS+ also encrypts more of the packet payload than RADIUS, but the answer choice that states only password encryption for TACACS+ reverses the facts. This aligns with Cisco CCNA 200-301 v1.1 because the exam blueprint requires engineers to recognize operational behaviour from configuration symptoms and topology requirements. Command accounting is usually stronger with TACACS+ for device administration, making C the correct comparison. Treat the distractors carefully: most are real Cisco terms, but they solve a different problem or operate at a different layer. The selected answer is the one that would be used by an engineer on the device or in the design to produce the outcome stated in the question.

ipv6 address 2001:db8::500:a:400F:583B. IPv6 questions require identifying the address scope, address block, assignment method, and the role of multicast, link-local, unique-local, or global-unicast addressing. Cisco CCNA 200-301 v1.1 includes this topic under Network Fundamentals, so the answer must be validated against normal Cisco device behavior and the operational wording of the scenario. The key is not simply recognizing a familiar acronym; it is identifying what the feature does, where it is configured, and what result it produces. The wrong choices describe another IPv6 scope or an assignment process that does not match the address behavior in the prompt. In a real network, selecting the wrong option would either leave the feature nonfunctional, create a forwarding or security gap, or send troubleshooting in the wrong direction. The selected answer is the only one that matches the stated requirement and the way Cisco switching, routing, services, security, wireless, or automation functions are expected to operate. This is why the verified answer remains the best technical choice for the question.

The verified answer is C. When identical prefixes are learned from different routing sources, the router compares administrative distance. eBGP has an administrative distance of 20, which is lower than EIGRP internal 90, OSPF 110, and iBGP 200. Cisco CCNA 200-301 v1.1 places this skill in IP Connectivity, where the exam expects a working understanding of how the feature behaves on real Cisco networks, not just a memorized command. The router installs the route with the lowest administrative distance unless more specific prefix matching changes the comparison. In production, this distinction matters because a misapplied command or design choice usually creates an outage, a security gap, or unnecessary troubleshooting noise. The correct choice matches the control-plane, data-plane, wireless, security, or services behaviour described in the scenario and should be preferred over options that merely sound related.

R2# configure terminal

R2(config)# interface Ethernet0/0

R2(config-if)# ip ospf priority 255

R2(config-if)# exit

R2(config)# interface Ethernet0/1

R2(config-if)# ip ospf priority 255

R2(config-if)# exit

R2(config)# router ospf 30

R2(config-router)# router-id 10.22.22.22

R2(config-router)# network 10.0.12.0 0.0.0.3 area 0

R2(config-router)# network 10.0.23.0 0.0.0.15 area 0

R2(config-router)# end

R2# copy running-config startup-config

Verification commands:

R2# show ip ospf neighbor

R2# show ip ospf interface Ethernet0/0

R2# show ip ospf interface Ethernet0/1

R2# show ip protocols

The router ospf 30 command creates the locally significant OSPF process requested by the task. The explicit router-id 10.22.22.22 command prevents R2 from dynamically selecting another active interface address as its router ID. The /30 network requires wildcard mask 0.0.0.3, while the /28 network requires 0.0.0.15; placing both prefixes in area 0 enables OSPF on R2’s links toward R1 and R3 and permits neighbor formation when the remaining OSPF parameters match.

The interface command ip ospf priority 255 gives R2 the maximum OSPF interface priority on both broadcast segments. This makes R2 the strongest DR candidate. OSPF DR elections are non-preemptive, so if a DR election has already completed, the election must be restarted by clearing the relevant OSPF processes or resetting the affected interfaces. Cisco documents that OSPF router IDs identify OSPF instances, while the DR and BDR reduce flooding on broadcast networks; OSPF process numbers do not have to match between neighboring routers.

Answer as below configuration:

1.- on R3

config terminal

ip route 192.168.1.1 255.255.255.255 209.165.200.229

end

copy running start

2.- on R2

config terminal

ip route 0.0.0.0 0.0.0.0 209.165.202.130

end

copy running start

3.- on R2

config terminal

ipv6 route ::/0 2001:db8:abcd::2

end

copy running start

Answer as below configuration:

on R1

config terminal

ipv6 unicast-routing

inter eth0/1

ip addre 192.168.1.1 255.255.255.240

ipv6 addre 2001:db8:aaaa::1/64

not shut

end

copy running start

on R2

config terminal

ipv6 unicast-routing

inter eth0/1

ip address 192.168.1.14 255.255.255.240

ipv6 address 2001:db8:aaaa::2/64

not shut

end

copy running start

---------------------

for test from R1

ping ipv6 2001:db8:aaaa::1

for test from R2

ping ipv6 2001:db8:aaaa::2

1,6,11. Physical-layer and Ethernet questions depend on media characteristics, interface counters, duplex behavior, and how frames are transmitted or errored on the link. Cisco CCNA 200-301 v1.1 includes this topic under Network Fundamentals, so the answer must be validated against normal Cisco device behavior and the operational wording of the scenario. The key is not simply recognizing a familiar acronym; it is identifying what the feature does, where it is configured, and what result it produces. The incorrect answers either describe a different medium, the wrong connector, or an error counter that would not increment for the condition described. In a real network, selecting the wrong option would either leave the feature nonfunctional, create a forwarding or security gap, or send troubleshooting in the wrong direction. The selected answer is the only one that matches the stated requirement and the way Cisco switching, routing, services, security, wireless, or automation functions are expected to operate. This is why the verified answer remains the best technical choice for the question.

Answer as below configuration:

on sw1

enable

conf t

vlan 100

name Compute

vlan 200

name Telephony

int e0/1

switchport voice vlan 200

switchport access vlan 100

int e0/0

switchport mode access

do wr

on sw2

Vlan 99

Name Available

Int e0/1

Switchport access vlan 99

do wr

SW-1

SW-1# configure terminal

SW-1(config)# interface Ethernet0/0

SW-1(config-if)# switchport trunk allowed vlan 5,6

SW-1(config-if)# exit

SW-1(config)# interface Ethernet0/1

SW-1(config-if)# switchport trunk native vlan 77

SW-1(config-if)# end

SW-1# copy running-config startup-config

SW-2

SW-2# configure terminal

SW-2(config)# interface Ethernet0/1

SW-2(config-if)# switchport trunk native vlan 77

SW-2(config-if)# exit

SW-2(config)# interface Ethernet0/2

SW-2(config-if)# switchport trunk allowed vlan 6

SW-2(config-if)# end

SW-2# copy running-config startup-config

SW-3

SW-3# configure terminal

SW-3(config)# interface range Ethernet0/0 - 1

SW-3(config-if-range)# channel-group 34 mode active

SW-3(config-if-range)# end

SW-3# copy running-config startup-config

SW-4

SW-4# configure terminal

SW-4(config)# interface range Ethernet0/0 - 1

SW-4(config-if-range)# channel-group 34 mode passive

SW-4(config-if-range)# end

SW-4# copy running-config startup-config

Verification commands:

SW-1# show interfaces trunk

SW-2# show interfaces trunk

SW-3# show etherchannel summary

SW-4# show etherchannel summary

SW-3# show interfaces port-channel 34

SW-4# show interfaces port-channel 34

The command switchport trunk allowed vlan 5,6 replaces the default allowed-VLAN list on SW-1 Ethernet0/0 so that only VLANs 5 and 6 can cross that trunk. The same command with VLAN 6 restricts SW-2 Ethernet0/2 to VLAN 6. Cisco documents that all VLANs are permitted on a trunk by default and that switchport trunk allowed vlan vlan-list defines the permitted list. The native VLAN must match at both ends of an 802.1Q trunk, so VLAN 77 is configured on Ethernet0/1 of both SW-1 and SW-2.

For LACP, active initiates negotiation and passive only responds. Therefore, SW-3 must use channel-group 34 mode active, while SW-4 must use channel-group 34 mode passive. Cisco confirms that active-to-passive forms an EtherChannel, whereas passive-to-passive does not. Because the physical interfaces are already identically configured as trunks, no trunk commands should be replaced during channel creation. The channel-group command creates and binds the physical members to logical Port-Channel 34.

To configure an LACP EtherChannel and number it as 44, configure it between switches SW1 and SW2 using interfaces Ethernet0/0 and Ethernet0/1 on both sides, configure the EtherChannel as a trunk link, configure the trunk link with 802.1q tags, and configure VLAN ‘MONITORING’ as the untagged VLAN of the EtherChannel, you need to follow these steps:

On both SW1 and SW2, enter the global configuration mode by using the configure terminal command.

On both SW1 and SW2, select the two interfaces that will form the EtherChannel by using the interface range ethernet 0/0 - 1 command. This will enter the interface range configuration mode.

On both SW1 and SW2, set the protocol to LACP by using the channel-protocol lacp command.

On both SW1 and SW2, assign the interfaces to an EtherChannel group number 44 by using the channel-group 44 mode active command. This will create a logical interface named Port-channel44 and set the LACP mode to active on both ends. The LACP mode must match on both ends for the EtherChannel to form.

On both SW1 and SW2, exit the interface range configuration mode by using the exit command.

On both SW1 and SW2, enter the Port-channel interface configuration mode by using the interface port-channel 44 command.

On both SW1 and SW2, configure the Port-channel interface as a trunk link by using the switchport mode trunk command.

On both SW1 and SW2, configure the Port-channel interface to use 802.1q tags for VLAN identification by using the switchport trunk encapsulation dot1q command.

On both SW1 and SW2, configure VLAN ‘MONITORING’ as the untagged VLAN of the Port-channel interface by using the switchport trunk native vlan MONITORING command.

On both SW1 and SW2, exit the Port-channel interface configuration mode by using the exit command.

On both SW1 and SW2, save the configuration to NVRAM by using the copy running-config startup-config command.

To configure static routing on R1 to ensure that it prefers the path through R2 to reach only PC1 on R4’s LAN, you need to create a static route for the host 10.0.0.100/8 with a next-hop address of 20.0.0.2, which is the IP address of R2’s interface connected to R1. You also need to assign a lower administrative distance (AD) to this route than the default AD of 1 for static routes, so that it has a higher preference over other possible routes. For example, you can use an AD of 10 for this route. To create this static route, you need to enter the following commands on R1’s console:

R1#configure terminal R1(config)#ip route 10.0.0.100 255.0.0.0 20.0.0.2 10 R1(config)#end

To configure static routing on R1 that ensures that traffic sourced from R1 will take an alternate path through R3 to PC1 in the event of an outage along the primary path, you need to create another static route for the host 10.0.0.100/8 with a next-hop address of 40.0.0.2, which is the IP address of R3’s interface connected to R1. You also need to assign a higher AD to this route than the AD of the primary route, so that it has a lower preference and acts as a backup route. For example, you can use an AD of 20 for this route. This type of static route is also known as a floating static route. To create this static route, you need to enter the following commands on R1’s console:

R1#configure terminal R1(config)#ip route 10.0.0.100 255.0.0.0 40.0.0.2 20 R1(config)#end

To configure default routes on R1 and R3 to the Internet using the least number of hops, you need to create a static route for the network 0.0.0.0/0 with a next-hop address of the ISP’s interface connected to each router respectively. A default route is a special type of static route that matches any destination address and is used when no other specific route is available. The ISP’s interface connected to R1 has an IP address of 10.0.0.4, and the ISP’s interface connected to R3 has an IP address of 50.0.0.4. To create these default routes, you need to enter the following commands on each router’s console:

On R1: R1#configure terminal R1(config)#ip route 0.0.0.0 0.0.0.0 10.0.0.4 R1(config)#end

On R3: R3#configure terminal R3(config)#ip route 0.0.0.0 0.0.0.0 50.0.0.4 R3(config)#end