Free 200-301 practice questions

A router holds four routes that all match the destination 10.1.1.5: a connected route to 10.0.0.0/8, an OSPF route to 10.1.0.0/16, an EIGRP route to 10.1.1.0/24, and a static default route 0.0.0.0/0. By default, which route does the router use to forward the packet?

• AThe OSPF route to 10.1.0.0/16, because OSPF has a lower administrative distance than EIGRP
• BThe connected route to 10.0.0.0/8, because connected routes have the lowest administrative distance of 0
• CThe static default route 0.0.0.0/0, because static routes are preferred over dynamic routes
• DThe EIGRP route to 10.1.1.0/24, because it is the longest prefix that matches the destinationcheck_circle Correct

Why A is wrong: Administrative distance is tempting here, but it only breaks ties between routes to the SAME prefix; with different prefix lengths the longest match is chosen first, so the /16 is never compared by AD.

Why B is wrong: A connected route does have AD 0, but administrative distance is not consulted until after longest prefix match; the /8 is the least specific of the matches, so it loses on prefix length.

Why C is wrong: Static routes do carry a low AD of 1, but the default route is the least specific match of all; longest prefix match selects a more specific entry whenever one exists.

Why D is correct: Longest prefix match is the first and decisive test: /24 covers 10.1.1.5 and is more specific than /16, /8, or the default, so this route is installed for forwarding regardless of AD or metric.

A router learns the exact same prefix 192.168.20.0/24 from three sources at once: RIP, OSPF, and internal EIGRP. With default settings and no manual configuration changes, which route is installed in the routing table?

• AThe internal EIGRP route, because its administrative distance of 90 is the lowest of the threecheck_circle Correct
• BThe OSPF route, because OSPF uses cost based on bandwidth and is more accurate than EIGRP
• CThe RIP route, because RIP hop count gives the simplest and most reliable loop-free path
• DAll three routes, because the router load-balances equally across every protocol that offers the prefix

Why A is correct: When the prefix is identical, the router trusts the source with the lowest administrative distance; internal EIGRP at 90 beats OSPF at 110 and RIP at 120, so the EIGRP route is installed.

Why B is wrong: Metric quality is irrelevant across different protocols; selection here is by administrative distance, and OSPF at 110 is higher than internal EIGRP at 90, so OSPF is not preferred.

Why C is wrong: RIP carries the highest administrative distance of these three at 120, so it is the least trusted; its hop-count metric is never compared against the other protocols' metrics.

Why D is wrong: Routers do not load-balance across different protocols for one prefix; equal-cost load balancing only happens within a single protocol, so only the lowest-AD source is installed.

During route selection, a router must decide between administrative distance and routing protocol metric. Which statement correctly describes how each value is used by default?

• AMetric is compared first to find the fastest path, and administrative distance is only used if two metrics are equal
• BAdministrative distance selects the most trusted source for a prefix, and metric then picks the best path within that protocolcheck_circle Correct
• CAdministrative distance compares routes from the same protocol, while metric compares routes from different protocols
• DAdministrative distance and metric are added together, and the route with the lowest combined total is installed

Why A is wrong: This reverses the order; administrative distance is evaluated before metric, because the router must first decide which source to trust before comparing path costs.

Why B is correct: Administrative distance ranks how much the router trusts each route source, and once a protocol is chosen its own metric selects the lowest-cost path among that protocol's offerings, which is exactly the default behaviour.

Why C is wrong: The roles are swapped: metric compares paths within one protocol, and administrative distance compares trust between different sources, so this description is inverted.

Why D is wrong: The two values are never summed; they live on different scales and are applied in sequence, so adding an AD of 110 to an OSPF cost is meaningless.

A host is automatically configuring a link-local IPv6 address with no router present on the segment. Which prefix identifies the address it generates, and what is the defining property of that address?

• Afe80::/10, valid only on the local link and never forwarded by a routercheck_circle Correct
• Bfc00::/7, routable within a single organisation but not on the public internet
• C2000::/3, globally routable and reachable across the public internet
• Dff00::/8, delivered to every interface that has joined the group

Why A is correct: Link-local addresses always come from the fe80::/10 range and an IPv6 router never forwards them off the link, so they remain confined to the local segment - this is the defining property the question asks for.

Why B is wrong: fc00::/7 is the unique local address (ULA) range, which is site-scoped and can be routed between internal subnets; it is not the prefix a host self-assigns for link-local communication, so it is the wrong classification here.

Why C is wrong: 2000::/3 is the global unicast range used for internet-reachable addresses; a host cannot mint a globally routable address without a router advertisement supplying the prefix, so this does not describe the no-router self-configured address.

Why D is wrong: ff00::/8 is the multicast range used for one-to-many delivery, not a unicast address a single host assigns to its own interface; it is a tempting confusion because both are auto-derived, but it is not link-local.

An interface with MAC address 00:1C:2D:AA:BB:CC builds its 64-bit interface identifier using modified EUI-64. Which interface identifier results?

• A001C:2DFF:FEAA:BBCC, splitting the MAC and inserting FFFE with the first octet unchanged
• B021C:2DFF:FEAA:BBCC, splitting the MAC, inserting FFFE, and flipping the seventh bit of the first octetcheck_circle Correct
• C001C:2DFE:FFAA:BBCC, inserting the bytes FEFF in the middle and leaving the first octet unchanged
• D031C:2DFF:FEAA:BBCC, inserting FFFE and flipping the eighth bit of the first octet

Why A is wrong: This correctly splits the MAC and inserts FFFE in the middle but skips flipping the universal/local bit, leaving the first octet as 00 instead of 02; that omitted bit-flip is the single most common modified EUI-64 mistake.

Why B is correct: Modified EUI-64 splits the OUI from the device portion, inserts FFFE between them, and inverts the seventh bit of the first octet (00 becomes 02), producing exactly 021C:2DFF:FEAA:BBCC.

Why C is wrong: The inserted value is FFFE, not FEFF; reversing those two bytes is a plausible slip but yields an invalid interface identifier, and this answer also fails to flip the universal/local bit.

Why D is wrong: The bit that modified EUI-64 inverts is the seventh bit, not the eighth; flipping the wrong bit turns 00 into 01 rather than 02, so 031C is wrong and so is the stated bit position.

An engineer must write the address 2001:0DB8:0000:0000:00AB:0000:0000:1234 in its shortest valid form. Which representation is correct?

• A2001:DB8:0:0:AB:0:0:1234
• B2001:DB8:0:0:AB::1234
• C2001:DB8::AB:0:0:1234check_circle Correct
• D2001:DB8::AB::1234

Why A is wrong: This correctly drops the leading zeros in every group but never applies :: at all, so although it is a legal address it is not the shortest form the stem demands; a candidate who forgets that zero-run compression is required would stop here.

Why B is wrong: Here :: replaces the second run of zeros, but both zero runs are two groups long and equal length, so the rule requires collapsing the first run, not the second; choosing the later run is a valid-looking but incorrect placement.

Why C is correct: Leading zeros are dropped in every group and the longest zero run is replaced by ::; the two zero runs are equal length, so :: collapses the first one, giving 2001:DB8::AB:0:0:1234 as the single shortest legal form.

Why D is wrong: Using :: twice is illegal because it makes the address ambiguous about how many zero groups each :: represents, so an address may contain the :: symbol at most once; this is the classic double-:: mistake.

Two switches are joined by an 802.1Q trunk. One switch is configured with native VLAN 1 on the trunk, the other with native VLAN 99. Spanning tree and CDP are running. What is the consequence of this configuration?

• AThe trunk forms normally and all VLANs pass, because the native VLAN only affects which VLAN carries management traffic and never the forwarding of user data.
• BThe trunk is administratively shut down by the switch as soon as the mismatch is detected through CDP, requiring a manual no shutdown to recover.
• CTraffic from the two native VLANs is merged so that frames in VLAN 1 on one side arrive in VLAN 99 on the other, creating a security and reachability problem.check_circle Correct
• DOnly VLAN 99 is permitted across the link, because the higher native VLAN number always takes precedence and prunes the lower-numbered native VLAN.

Why A is wrong: It is tempting because a native-VLAN mismatch does not bring the physical link down, but the mismatch does affect user data: untagged frames leak between the two different native VLANs.

Why B is wrong: CDP does log a native VLAN mismatch notice, but Cisco switches do not err-disable or shut the trunk for this; the port stays up and continues forwarding, which is what makes the problem subtle.

Why C is correct: Each switch sends its native-VLAN traffic untagged, and the neighbour places received untagged frames into ITS own native VLAN, so VLAN 1 and VLAN 99 traffic is bridged together across the link.

Why D is wrong: There is no rule that a higher native VLAN number wins or prunes another VLAN; native VLAN selection is purely about which VLAN is sent untagged, so this invented precedence is wrong.

A switch port is configured as an access port with switchport access vlan 10 and switchport voice vlan 20, and an IP phone with a PC behind it is connected. How does the switch treat the phone and PC traffic on that single port?

• ABoth the phone and the PC are placed in VLAN 10, and VLAN 20 is used only to reserve bandwidth, with all frames leaving the port untagged.
• BThe PC frames are tagged in VLAN 10 and the phone frames are tagged in VLAN 20, because adding a voice VLAN converts the port into a full 802.1Q trunk for all devices.
• CBoth phone and PC frames are tagged, the phone in VLAN 20 and the PC in VLAN 1, because the default VLAN always overrides the configured access VLAN for data.
• DPC frames are sent untagged in the data VLAN 10, while phone frames are tagged for the voice VLAN 20, even though the port is not a conventional trunk.check_circle Correct

Why A is wrong: It is tempting because the port is an access port, but a voice VLAN is not a bandwidth reservation; the phone is genuinely placed in VLAN 20 and its frames are tagged, so this is wrong.

Why B is wrong: A voice VLAN does carry tagged voice frames, but it does not turn the port into a full trunk; the attached PC still sends and receives untagged data, so tagging the PC traffic is incorrect.

Why C is wrong: The configured access VLAN 10 carries the PC data, not VLAN 1; the default VLAN does not override an explicit switchport access vlan command, so both claims here are wrong.

Why D is correct: An access port with a voice VLAN is a special case: data traffic stays untagged in the access VLAN, and the switch instructs the phone via CDP or LLDP-MED to tag voice frames with VLAN 20.

On an 802.1Q trunk carrying VLANs 1, 10, and 20, where the native VLAN is left at the default, which statement correctly describes how frames are placed on the wire?

• AFrames in VLAN 10 and VLAN 20 carry an 802.1Q tag, while frames in VLAN 1 are sent untagged because VLAN 1 is the native VLAN.check_circle Correct
• BFrames in VLAN 1 carry a tag while VLAN 10 and VLAN 20 frames are untagged, because the lowest-numbered VLAN is always reserved for tagged management traffic.
• CEvery frame, including those in the native VLAN, carries an 802.1Q tag, because a trunk by definition tags all traffic regardless of the native VLAN.
• DAll frames are sent untagged and the receiving switch infers each VLAN from the source MAC address table rather than from any tag in the frame.

Why A is correct: The native VLAN, which defaults to VLAN 1, is the single VLAN transmitted without a tag, so VLAN 10 and VLAN 20 are tagged while native VLAN 1 traffic crosses the trunk untagged.

Why B is wrong: This inverts the rule: the native VLAN (here VLAN 1) is the untagged one, and there is no requirement that the lowest VLAN number be reserved for tagged management, so it is wrong.

Why C is wrong: It is tempting to assume a trunk tags everything, but the defining behaviour of the native VLAN is that its frames are sent untagged, so this statement contradicts how 802.1Q natives work.

Why D is wrong: A trunk must tag non-native VLANs so the neighbour can separate them; VLAN membership is not inferred from source MAC on a trunk, so sending everything untagged would collapse all VLANs together.

A security analyst is documenting an incident in which an unpatched web server was compromised. The server software contained a known coding flaw, the attacker used a publicly released piece of code that takes advantage of that flaw, and the result was full remote access. Using standard security terminology, what is the coding flaw itself best classified as?

• AA threat, because it represents the external party who has the intent and capability to cause harm to the server.
• BAn exploit, because it is the mechanism that takes advantage of the weakness to achieve remote access.
• CA vulnerability, because it is a weakness in the system that could be used to compromise it.check_circle Correct
• DA mitigation, because identifying the flaw is the control that reduces the overall risk to the server.

Why A is wrong: A threat is the potential danger or the actor that could cause harm, such as the attacker; the coding flaw is the internal weakness being targeted, not the source of danger, so the term is misapplied.

Why B is wrong: The exploit is the piece of code or technique that leverages the weakness; the flaw is what gets leveraged, so calling the flaw itself the exploit confuses the weakness with the tool used against it.

Why C is correct: A vulnerability is a weakness or flaw in a system, such as an unpatched coding defect, that an attacker can leverage; the scenario describes exactly such a flaw, so this classification is correct.

Why D is wrong: A mitigation is a countermeasure such as patching or filtering that reduces risk; the flaw is the problem, not the control, so labelling the weakness a mitigation inverts the relationship between the risk and its remedy.

Two corporate offices in different cities must exchange traffic between their internal LANs continuously over the internet, with the tunnel built and maintained by the firewall at each office rather than by any individual host. Which type of IPsec VPN matches this requirement?

• AA remote-access VPN, because each office host runs VPN client software to dial the tunnel up on demand.
• BA clientless SSL VPN, because users reach internal applications through a web browser without any tunnel between the sites.
• CA GRE-only tunnel, because generic routing encapsulation alone provides the encryption and authentication the offices require.
• DA site-to-site VPN, because the firewalls build one permanent tunnel that joins the two LANs transparently to the hosts.check_circle Correct

Why A is wrong: A remote-access VPN is built by individual client devices connecting in, but here the tunnel is maintained by the firewalls for whole LANs, so the per-host client model does not fit the scenario.

Why B is wrong: A clientless SSL VPN gives individual users browser-based access to selected applications and does not join two LANs together, so it cannot provide the always-on inter-site connectivity the offices need.

Why C is wrong: GRE can carry traffic between sites but provides no encryption or authentication by itself, so on its own it does not deliver the secured IPsec protection the requirement implies.

Why D is correct: A site-to-site VPN is established between gateway devices such as firewalls and connects entire networks with a continuously available tunnel, so hosts communicate without running any VPN software, which is exactly what the two offices require.

During an IPsec design review, an engineer must explain which security service guarantees that a packet was not altered while crossing the public internet. Which IPsec function provides this assurance?

• AData integrity, which uses a hash so the receiver can detect whether the packet was modified in transit.check_circle Correct
• BConfidentiality, which scrambles the payload so that an eavesdropper cannot read the contents of the packet.
• CAnti-replay, which assigns sequence numbers so that captured packets cannot be resent later.
• DPeer authentication, which confirms the identity of the remote VPN device before the tunnel is built.

Why A is correct: Data integrity uses a hashing algorithm to produce a digest the receiver recomputes and compares, detecting any alteration of the packet en route, which is exactly the assurance the scenario asks about.

Why B is wrong: Confidentiality through encryption hides the contents from observers, but it does not by itself prove the packet was unchanged in transit, so it does not deliver the integrity guarantee the engineer must explain.

Why C is wrong: Anti-replay protection blocks an attacker from re-injecting previously captured packets, but it does not verify that the contents of a single packet were unmodified, so it answers a different question.

Why D is wrong: Peer authentication proves who the other gateway is at tunnel setup, but it says nothing about whether each subsequent packet was tampered with, so it does not provide the in-transit integrity check described.

A router runs inside source NAT so that a workstation in the private LAN can reach a public web server. The workstation holds a private RFC 1918 address, and the router rewrites the source to a registered public address before the packet leaves the WAN interface. Which NAT term describes that registered public address the workstation is translated to?

• AInside local address, because it is the address the router assigns to the inside host before the packet is forwarded to the WAN.
• BOutside global address, because it is the public address that the inside host is given when its traffic crosses to the outside.
• CInside global address, because it is the registered public address that represents the inside host as seen from the outside network.check_circle Correct
• DOutside local address, because it is the public address the inside host presents while communicating with the outside server.

Why A is wrong: The inside local address is the private address the host actually uses inside the network, not the registered public address it is translated to, so this term is the wrong end of the mapping.

Why B is wrong: The outside global address is the real public address of the destination on the outside network, not the address assigned to the translated inside host, so the label is applied to the wrong host.

Why C is correct: The inside global address is exactly the routable public address the router substitutes for the inside host's private address, so outside devices see the inside host by this address.

Why D is wrong: The outside local address is how an outside host appears to devices inside the network, so it does not describe the inside host's own translated public address.

A small office has a single registered public IPv4 address but needs dozens of internal hosts to browse the internet at the same time through one router. The administrator configures inside source NAT with the overload keyword. Which mechanism lets many inside hosts share that one public address simultaneously?

• AThe router assigns each inside host its own public address in turn from a pool, so every active host briefly owns a unique global address.
• BThe router maps inside hosts to the public address by their MAC addresses, using the Layer 2 identifier to keep each conversation separate.
• CThe router fragments each host's traffic and tags every fragment with a host identifier so the single address can carry many sessions.
• DThe router tracks each flow by a unique source port number on the shared public address, so the Layer 4 port distinguishes the conversations.check_circle Correct

Why A is wrong: This describes dynamic NAT drawing from a pool, but with a single public address and the overload keyword there is no pool of addresses to hand out, so it cannot be how the sharing works.

Why B is wrong: NAT operates on Layer 3 and Layer 4 information and MAC addresses are not carried beyond the local segment, so the router cannot use MAC addresses to demultiplex translated flows.

Why C is wrong: NAT does not fragment traffic to multiplex hosts and there is no per-host fragment tag; this invents a mechanism that PAT does not use to share an address.

Why D is correct: Overload, also called PAT, multiplexes many inside hosts onto one public address by giving each translation a distinct source port, so the port number identifies which inside host a returning packet belongs to.

An engineer points several access switches at a router that is itself synchronised to an upstream NTP source. The router is configured to serve time to the switches and to take its own time from the upstream peer. Which statement correctly describes how stratum reflects the router's position in this time hierarchy?

• AThe router advertises a stratum one higher than its upstream source, because each hop away from the reference clock increments the stratum.check_circle Correct
• BThe router advertises stratum 0 to the switches because it is acting as their authoritative time server on the LAN.
• CThe router keeps the same stratum value as its upstream source, since serving time does not change a device's distance from the reference clock.
• DThe router advertises a lower stratum number than its upstream source so the switches treat it as closer to the reference clock.

Why A is correct: Stratum measures hops from the reference clock and each device adds one when it synchronises, so the router serves the switches at a stratum exactly one greater than the upstream peer it follows.

Why B is wrong: Stratum 0 is reserved for a reference clock such as an atomic or GPS source, not for an ordinary router serving time, so the router cannot advertise stratum 0.

Why C is wrong: A device that synchronises to a source increments the stratum by one before serving it, so the router does not keep the upstream's value but is one stratum further away.

Why D is wrong: Stratum increases with distance from the reference, so a synchronised router has a higher, not lower, stratum than the source it learned time from.

A network engineer is documenting how a traditional distributed network differs from an SDN architecture that separates the control plane from the data plane. In the SDN model, which function does the centralised controller take over from the individual forwarding devices?

• APhysically rewriting frames and pushing packets out of egress interfaces at line rate
• BStoring the MAC address table and performing per-frame hardware lookups inside the ASIC
• CGenerating link-state hello packets on every interface to keep neighbour adjacencies alive
• DBuilding the forwarding logic and reachability decisions, then programming the resulting state down to the switchescheck_circle Correct

Why A is wrong: Tempting because the controller manages forwarding, but actually moving frames out of interfaces at line rate is the data plane function that stays on each switch, not the controller.

Why B is wrong: Per-frame ASIC lookups against the MAC table are data plane operations performed locally on the switch hardware, so this is not what the controller centralises.

Why C is wrong: This describes a traditional distributed control protocol running independently on each device, which is exactly the per-device behaviour an SDN controller replaces rather than performs on their behalf.

Why D is correct: Separating the control plane means the controller computes routing and forwarding intelligence centrally and pushes the resulting forwarding state to the devices, which keep only the data plane.

An automation engineer is mapping the API tiers of a controller-based SDN solution. A custom orchestration application needs to request network services from the controller without knowing how the controller talks to the underlying switches. Which API does the application use?

• AA northbound API, typically a REST interface, that the application uses to consume controller servicescheck_circle Correct
• BA southbound API such as NETCONF or OpenFlow that the controller uses to program the devices
• CAn east-west API used to synchronise state between two peer controllers in a cluster
• DA southbound API such as RESTCONF that pushes configuration straight from the application to each switch

Why A is correct: Northbound APIs sit above the controller and let applications request abstracted network services, usually over REST, without dealing with device-level protocols.

Why B is wrong: Southbound APIs face the network devices below the controller, so an application asking the controller for services would not call them directly.

Why C is wrong: East-west APIs handle controller-to-controller communication for redundancy and scale, not an application requesting services from a single controller.

Why D is wrong: This bypasses the controller entirely and mislabels a device-facing protocol, whereas the application is meant to interact only with the controller through the northbound tier.

A campus is migrating to a Cisco SD-Access fabric. An engineer must explain the relationship between the underlay and the overlay to the operations team. Which description correctly distinguishes the two?

• AThe underlay is the logical tunnelled topology, while the overlay is the physical cabling that carries user data directly
• BThe underlay is the physical IP transport providing reachability, while the overlay is the virtual network of tunnels that carries user traffic on top of itcheck_circle Correct
• CThe underlay and the overlay are two names for the same physical IP transport, used interchangeably by vendors
• DThe underlay carries encapsulated endpoint traffic in VXLAN, while the overlay only exchanges routing protocol hellos between switches

Why A is wrong: This reverses the two terms; the logical tunnelled topology is the overlay and the physical IP transport is the underlay.

Why B is correct: The underlay provides device-to-device IP reachability and the overlay is the virtualised tunnelled network, such as VXLAN, that carries endpoint traffic across that transport.

Why C is wrong: They are distinct layers, not synonyms; treating them as interchangeable misses the core idea that the overlay is virtual and rides on the underlay.

Why D is wrong: VXLAN-encapsulated endpoint traffic rides in the overlay, not the underlay, so this swaps the encapsulation role and misstates what each layer carries.