Medium 200-301 practice questions

A network administrator needs to maintain a record of every configuration command that engineers enter on the core routers, including the username, timestamp, and the exact command issued, so that changes can be audited after an outage. The company already uses a TACACS+ server for AAA. Which AAA component should the administrator configure to meet this requirement?

A network administrator has deployed a TACACS+ server to control access to the company's routers. After a junior technician successfully logs in to a router, the administrator wants to ensure that the technician is only permitted to run a limited set of show commands and cannot enter configuration mode. Which AAA component enforces this restriction?

A network operations team wants to standardize router and switch configurations across 200 devices. They require a tool that pushes configuration changes without installing any software agent on the managed network devices, and they want the desired configurations expressed in human-readable YAML files. Which configuration management characteristic best matches Ansible for this requirement?

You are documenting a new network and cannot physically access the wiring closet. From switch SW1, you run 'show cdp neighbors detail' and see an entry showing Device ID 'SW2', Platform 'cisco WS-C2960', with 'Interface: GigabitEthernet0/1, Port ID (outgoing port): GigabitEthernet0/24'. Which conclusion is correct based on this output?

A network engineer configures interface GigabitEthernet0/0 on a router with the command 'ip address 10.20.30.1 255.255.255.0'. After the interface comes up, the engineer issues 'show ip route' and sees two entries related to this configuration. One is coded 'C 10.20.30.0/24' and the other is coded 'L 10.20.30.1/32'. What does the entry with code 'L' represent?

A DevOps team needs to deploy dozens of small, independent microservices on a single physical server. Each service must start in seconds, share the host operating system kernel, and use minimal memory and disk overhead so the server can run as many instances as possible. Which virtualization approach best meets these requirements?

A network engineer is documenting a newly deployed software-defined fabric. She notes that VXLAN tunnels carry endpoint traffic across the data center on top of an OSPF-routed IP network that provides reachability between the switches. In this architecture, which statement correctly describes the role of the OSPF-routed IP network?

A network administrator is configuring a branch router's WAN interface (GigabitEthernet0/1) to automatically obtain its IPv4 address from the ISP's DHCP server. After entering interface configuration mode, which command correctly configures the router to act as a DHCP client on that interface?

A company has a centralized DHCP server at 10.50.1.10 located in the data center. Client PCs on VLAN 20 (subnet 192.168.20.0/24) connect to a Layer 3 switch that acts as their default gateway on interface SVI Vlan20. Users on VLAN 20 report they cannot obtain IP addresses automatically, while statically configured hosts work fine. What configuration must be applied to the Layer 3 switch to resolve this?

A network administrator enables DHCP snooping on an access switch to prevent rogue DHCP servers. The legitimate DHCP server is reached through uplink port GigabitEthernet0/1, while end-user devices connect to ports Gi0/2 through Gi0/24. After enabling DHCP snooping, users report they can no longer obtain IP addresses. What must the administrator configure to restore proper DHCP operation?

A network engineer is configuring QoS on a campus router to prioritize voice traffic. Voice packets arriving from the IP phones must be identified and assigned a trust value near the network edge so that every downstream device applies consistent forwarding treatment. Which per-hop behavior (PHB) mechanism performs the initial identification of the voice traffic based on its characteristics before any trust value is set?

A network administrator discovers that an attacker on the LAN is sending forged ARP replies to associate the attacker's MAC address with the default gateway's IP, allowing the attacker to intercept traffic. DHCP snooping is already enabled on the switch. Which additional Layer 2 security feature should be configured to mitigate this specific attack?

A junior administrator is hardening a Cisco router. During a configuration review, you notice the running configuration contains the line 'enable password Cisco123' in clear text. The security policy requires that the password protecting privileged EXEC mode be stored using a strong, non-reversible hash. Which command should you use to meet this requirement?

A network administrator must restrict traffic on router R1's interface GigabitEthernet0/1 (inbound). Only the host 192.168.10.25 should be permitted to reach the web server at 172.16.5.10 on TCP port 443; all other traffic from the 192.168.10.0/24 subnet to that server must be denied, while normal traffic elsewhere continues. Which access control list entry correctly permits the required HTTPS traffic?

A network engineer configures a primary static default route through an MPLS link (next hop 10.1.1.1) and wants a broadband link (next hop 172.16.5.1) to serve only as a backup that activates automatically if the MPLS route fails. The primary route uses the default administrative distance. Which command creates the correct floating static backup route?

A network engineer wants to speed up documentation by using a tool that can produce a first draft of a device configuration and a plain-language summary of an interface troubleshooting log based on natural-language prompts. Which type of AI capability is the engineer relying on?

A network team wants their two edge routers to actively share the traffic load from 300 workstations that all use a single default gateway address. Both routers should forward traffic simultaneously while still providing redundancy if one fails. Which first hop redundancy protocol best meets this requirement?

Two distribution routers, R1 and R2, share a virtual gateway address for VLAN 10 using HSRP. R1 is configured with 'standby 10 priority 110' and R2 uses the default. Both interfaces are up and preemption is enabled on R1. Which router forwards traffic sent to the virtual IP, and why?

Two routers, R1 and R2, share HSRP group 10 on a LAN. R1 is configured with priority 110 and R2 with the default priority. R1 was the active router until it rebooted, at which point R2 became active. Now that R1 has fully rebooted, network engineers notice R2 remains the active router even though R1 is online again. Which configuration on R1 would cause it to reclaim the active role automatically?

A network technician is troubleshooting intermittent connectivity on a GigabitEthernet link between two switches. The 'show interfaces gigabitEthernet0/1' output shows a steadily increasing 'input errors' counter with a large 'CRC' count, but zero 'collisions' and zero 'late collisions'. The interface remains 'up/up' at 1000 Mbps full duplex on both ends. What is the MOST likely cause of these symptoms?

A company has 200 remote employees who work from home using company-issued laptops. Management wants each employee to establish a secure, encrypted connection to the corporate network on demand, without requiring dedicated hardware at each home office. Which VPN solution best meets this requirement?

A company needs to securely connect its headquarters router to a branch office router over the public internet. All traffic between the two sites' internal subnets must be encrypted automatically without requiring any user interaction, and the tunnel should remain established at all times. Which solution best meets these requirements?

A branch router R1 connects to the ISP through interface GigabitEthernet0/1, and the ISP's next-hop address is 203.0.113.1. R1 has no dynamic routing protocol configured and must forward all traffic destined to networks not found in its routing table toward the ISP. Which command correctly configures this behavior on R1?

A network technician runs 'ipconfig' on a Windows workstation and sees an IPv6 address of fe80::a1b2:c3d4:e5f6:7890 assigned to the Ethernet adapter, in addition to a global address. The workstation can ping other devices on the same VLAN using this fe80 address but cannot use it to reach a server in a remote subnet. Which statement correctly explains the fe80 address?

A network engineer is configuring an edge router named R1 that connects a branch office to the ISP. All internal branch subnets should reach any external IPv6 destination by forwarding traffic to the ISP's next-hop address 2001:DB8:AC:1::1. Which command correctly creates this IPv6 default static route on R1?