Cisco CCNA 200-301 Questions & Answers

• Question 131:

  Which management security process is invoked when a user logs in to a network device using their username and password?

  A. authentication

  B. auditing

  C. accounting

  D. authorization

  Correct Answer: A

• Question 132:

  Refer to the exhibit.

  

  SW1 supports connectivity for a lobby conference room and must be secured. The engineer must limit the connectivity from PC1 to the SW1 and SW2 network. The MAC addresses allowed must be limited to two. Which configuration secures the conference room connectivity?

  A. interface gi1/0/15 switchport port-security switchport port-security maximum 2

  B. interface gi1/0/15 switchport port-security switchport port-security mac-address 0000.abcd.0004vlan 100

  C. interface gi1/0/15 switchport port-security mac-address 0000.abcd.0004 vlan 100

  D. interface gi1/0/15 switchport port-security mac-address 0000.abcd.0004 vlan 100 interface switchport secure-mac limit 2

  Correct Answer: A

• Question 133:

  Refer to the exhibit.

  

  An engineer is updating the management access configuration of switch SW1 to allow secured, encrypted remote configuration. Which two commands or command sequences must the engineer apply to the switch? (Choose two.)

  A. SW1(config)#enable secret ccnaTest123

  B. SW1(config)#username NEW secret R3mote123

  C. SW1(config)#line vty 0 15 SW1(config-line)#transport input ssh

  D. SW1(config)# crypto key generate rsa

  E. SW1(config)# interface f0/1 SW1(confif-if)# switchport mode trunk

  Correct Answer: AC

  SSH test on PT without the enable secret below and it really shows that you can't access:

  Cisco Packet Tracer PC Command Line 1.0

  C:\>ssh -l pablo 10.0.32.2

  Password: xxx

  SW3>

  SW3>enable

  % No password set.

  SW3>

• Question 134:

  Which enhancements were implemented as part of WPA3?

  A. Forward secrecy and SAE in personal mode for secure initial key exchange

  B. 802.1x authentication and AES-128 encryption

  C. AES-64 in personal mode and AES-128 in enterprise mode

  D. TKIP encryption improving WEP and per-packet keying

  Correct Answer: A

  Forward security and SAE in personal mode for secure initial key exchange were implemented as part of WPA3.

• Question 135:

  In an SDN architecture, which function of a network node is centralized on a controller?

  A. Creates the IP routing table

  B. Discards a message due filtering

  C. Makes a routing decision

  D. Provides protocol access for remote access devices

  Correct Answer: C

  A controller, or SDN controller, centralizes the control of the networking devices. The degree of control, and the type of control, varies widely. For instance, the controller can perform all control plane functions (such as making routing decisions) replacing the devices’ distributed control plane.

  Reference: https://www.ciscopress.com/articles/article.asp?p=2995354andseqNum=2#:~:text=A%20controller%2C%20or%20SDN%20controller,the%20devices'%20distributed%20control%20plane

• Question 136:

  Which remote access protocol provides unsecured remote CLI access?

  A. console

  B. Telnet

  C. SSH

  D. Bash

  Correct Answer: B

• Question 137:

  Which device separates networks by security domains?

  A. intrusion protection system

  B. firewall

  C. wireless controller

  D. access point

  Correct Answer: B

• Question 138:

  What is a feature of TFTP?

  A. offers anonymous user login ability

  B. uses two separate connections for control and data traffic

  C. relies on the well-known TCP port 20 to transmit data

  D. provides secure data transfer

  Correct Answer: A

• Question 139:

  Which QoS forwarding per-hop behavior changes a specific value in a packet header to set the class of service for the packet?

  A. shaping

  B. classification

  C. policing

  D. marking

  Correct Answer: D

• Question 140:

  Which per-hop traffic-control feature does an ISP implement to mitigate the potential negative effects of a customer exceeding its committed bandwidth?

  A. policing

  B. queuing

  C. marking

  D. shaping

  Correct Answer: A

  Your ISP sold you a fibre connection with a traffic contract and a guaranteed bandwidth of 10 Mbit, the fibre interface however is capable of sending 100 Mbit per second. Most ISPs will configure policing to drop all traffic above 10 Mbit so that you can't get more bandwidth than what you are paying for. It's also possible that they shape it down to 10 Mbit but shaping means they have to buffer data while policing means they can just throw it away. The 10 Mbit that we pay for is called the CIR (Commited Information Rate).

  Policing would be the most logical answer, as ISP's usually don't take care of your traffic as you would within your own network. If you really need to get that traffic through, fix it on your own equipment (instead of depending on the provider) so that it all fits properly within the bandwidth you pay for.