Cisco CCNA 200-301 Questions & Answers

• Question 121:

  Which script paradigm does Puppet use?

  A. recipes and cookbooks

  B. playbooks and roles

  C. strings and marionettes

  D. manifests and modules

  Correct Answer: D

• Question 122:

  Which set of methods is supported with the REST API?

  A. GET, PUT, ERASE, CHANGE

  B. GET, POST, MOD, ERASE

  C. GET, PUT, POST, DELETE

  D. GET, POST, ERASE, CHANGE

  Correct Answer: C

• Question 123:

  Which definition describes JWT in regard to REST API security?

  A. an encrypted JSON token that is used for authentication

  B. an encrypted JSON token that is used for authorization

  C. an encoded JSON token that is used to securely exchange information

  D. an encoded JSON token that is used for authentication

  Correct Answer: D

  JSON Web Tokens (JWT) is an open standard for securely transmitting information between parties as a JSON object. In the context of REST API security, JWT is typically used for authentication purposes. It is a compact, URL-safe means of representing claims to be transferred between two parties.

  When a user authenticates with a REST API, the server generates a JWT token that contains user information, such as the user ID and access privileges. The token is then sent to the client, typically in the form of an HTTP header, and is included in subsequent requests to the API.

  The server then validates the token to ensure that it was issued by a trusted authority and that it has not been tampered with. If the token is valid, the server grants access to the requested resources. If the token is invalid or has expired, the server denies access to the resources.

  Therefore, the correct definition of JWT in regard to REST API security is that it is an encoded JSON token that is used for authentication.

• Question 124:

  Refer to the exhibit.

  

  What is identified by the word “switch” within line 2 of the JSON Schema?

  A. array

  B. value

  C. object

  D. key

  Correct Answer: D

  {"name": "John"}

  In this example, "name" is the key and "John" is the value. The value is a string, and it is associated with the key "name".

  Here is another example of a key-value pair in JSON:

  {"age": 30}

  In this example, "age" is the key and 30 is the value. The value is a number, and it is associated with the key "age".

• Question 125:

  Which two wireless security standards use counter mode cipher block chaining Message Authentication Code Protocol for encryption and data integrity? (Choose two.)

  A. Wi-Fi 6

  B. WPA3

  C. WEP

  D. WPA2

  E. WPA

  Correct Answer: BC

• Question 126:

  A network engineer is implementing a corporate SSID for WPA3-Personal security with a PSK. Which encryption cipher must be configured?

  A. CCMP128

  B. GCMP256

  C. CCMP256

  D. GCMP128

  Correct Answer: A

  WPA2 uses CCMP-128 security level with AES-128 cipher suite plus CBC-MAC cipher (personal or enterprise mode).

  WPA3 also uses CCMP-128 security level with AES-128 cipher suite plus CBC-MAC cipher (personal or enterprise mode);

  (or) GCMP-128 security level with AES-128 cipher suite plus GMAC cipher (enterprise mode);

  (or) GCMP-192 security level (called Suite B) with AES-256 cipher suite plus GMAC cipher (enterprise mode).

  In the case the question asked for the AES cipher (not the security level which is also 128 bits), CCMP-128 in this case refers to the 128 bit AES cipher.

  According to RFC 5430, this confusion between cipher and elliptic curve security level is common, which represents the set of encryption ciphers plus the integrity cipher (AES Encryption + MIC CBC-MAC / or MIC GMAC).

• Question 127:

  Why would a network administrator choose to implement automation in a network environment?

  A. To simplify the process of maintaining a consistent configuration state across all devices

  B. To centralize device information storage

  C. To implement centralized user account management

  D. To deploy the management plane separately from the rest of the network

  Correct Answer: A

• Question 128:

  Which two REST API status-code classes represent errors? (Choose two.)

  A. 1XX

  B. 2XX

  C. 3XX

  D. 4XX

  E. 5XX

  Correct Answer: DE

• Question 129:

  Which port security violation mode allows from valid MAC addresses to pass but blocks traffic from invalid MAC addresses?

  A. restrict

  B. shutdown

  C. protect

  D. shutdown VLAN

  Correct Answer: C

• Question 130:

  A customer wants to provide wireless access to contractors using a guest portal on Cisco ISE. The portal is also used by employees. A solution is implemented, but contractors receive a certificate error when they attempt to access the portal. Employees can access the portal without any errors. Which change must be implemented to allow the contractors and employees to access the portal?

  A. Install an Internal CA signed certificate on the Cisco ISE.

  B. Install a trusted third-party certificate on the Cisco ISE.

  C. Install an internal CA signed certificate on the contractor devices.

  D. Install a trusted third-party certificate on the contractor devices.

  Correct Answer: B

  The certificate error experienced by contractors suggests that their devices do not trust the certificate presented by the Cisco ISE for the guest portal. To resolve this, a trusted certificate needs to be installed on the Cisco ISE, which is signed

  by a trusted third-party certificate authority (CA). This ensures that when contractors connect to the guest portal, their devices recognize the certificate as valid and trusted.

  Option A, installing an internal CA signed certificate on the Cisco ISE, would only address certificate errors for devices within the same organization that have the internal CA's root certificate installed as a trusted root. It would not resolve

  certificate errors for external contractors' devices.

  Options C and D involve installing certificates on the contractor devices. However, this would require distributing and configuring certificates on each contractor device individually, which may not be practical or feasible in this scenario. Reference: https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine-software/200295-Install-a-3rd-party-CA-certificate-in-IS.html