Cisco CCNA 200-301 Questions & Answers

• Question 451:

  Which two practices are recommended for an acceptable security posture in a network? (Choose two.)

  A. Backup device configurations to encrypted USB drives for secure retrieval.

  B. Maintain network equipment in a secure location.

  C. Use a cryptographic keychain to authenticate to network devices.

  D. Place internal email and file servers in a designated DMZ.

  E. Disable unused or unnecessary ports, interfaces and services.

  Correct Answer: CE

• Question 452:

  How does authentication differ from authorization?

  A. Authentication is used to verify a person's identity, and authorization is used to create syslog messages for logins.

  B. Authentication is used to determine what resources a user is allowed to access, and authorization is used to track what equipment is allowed access to the network.

  C. Authentication verifies the identity of a person accessing a network, and authorization determines what resource a user can access.

  D. Authentication is used to record what resource a user accesses, and authorization is used to determine what resources a user can access.

  Correct Answer: C

• Question 453:

  Which command do you enter so that a switch configured with Rapid PVST + listens and learns for a specific time period?

  A. switch(config)#spanning-tree vlan 1 max-age 6

  B. switch(config)#spanning-tree vlan 1 hello-time 10

  C. switch(config)#spanning-tree vlan 1 priority 4096

  D. switch(config)#spanning-tree vlan 1 forward-time 20

  Correct Answer: D

  Forward time : Determines how long each of the listening and learning states last before the port begins forwarding.

  Switch(config)# [ no ] spanning-tree vlan vlan_ID forward-time forward_timeConfigures the forward time of a VLAN. The forward_time value can be from 4 to 30 seconds.

  https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/15-02SG/configuration/guide/config/spantree.html#56177

• Question 454:

  What is a function of Cisco Advanced Malware Protection for a Next-Generation IPS?

  A. authorizing potentially compromised wireless traffic

  B. inspecting specific files and file types for malware

  C. authenticating end users

  D. URL filtering

  Correct Answer: B

  AMP gives you real-time blocking of malware and advanced sandboxing , that is backed up by world class global threat intelligence, to provide rapid detection, containment and removal of advanced malware https://www.cisco.com/c/en/us/products/security/amp-appliances/index.html

• Question 455:

  What is the function of "off-the-shell" switches in a controller-based network?

  A. providing a central view of the deployed network

  B. forwarding packets

  C. making routing decisions

  D. setting packet-handling policies

  Correct Answer: B

• Question 456:

  What is the purpose of the Cisco DNA Center controller?

  A. to securely manage and deploy network devices

  B. to provide Layer 3 services to autonomous access points

  C. to secure physical access to a data center

  D. to scan a network and generate a Layer 2 network diagram

  Correct Answer: A

  Cisco DNA Center is a powerful network controller and management dashboard for secure access to networks and applications. It lets you take charge of your network, optimize your Cisco investment, and lower your IT spending.

  Reference:

  https://www.cisco.com/c/en/us/products/collateral/cloud-systems-management/dna-center/nb-06-dna-center-so-cte-en.html

• Question 457:

  What is the collapsed layer in collapsed core architectures?

  A. core and distribution

  B. distribution and access

  C. core and WAN

  D. access and WAN

  Correct Answer: A

  A collapsed core architecture takes the normal three-tier hierarchical network and collapses it into a two-tier network. In a two-tier network, the function of the switches in the core layer and distribution layer are “collapsed” into a combined core and distribution layer on a single switch

• Question 458:

  Why would VRRP be implemented when configuring a new subnet in a multivendor environment?

  A. when a gateway protocol is required that support more than two Cisco devices for redundancy

  B. to enable normal operations to continue after a member failure without requiring a change In a host ARP cache

  C. to ensure that the spanning-tree forwarding path to the gateway is loop-free

  D. to interoperate normally with all vendors and provide additional security features for Cisco devices

  Correct Answer: B

  VRRP does not provide additonal security features for Cisco devices.

  When VRRP is implemented the virtual mac-addres of the VRRP group remains the same so the host does not need to make an arp request to learn another mac-address for the gateway.

• Question 459:

  What provides centralized control of authentication and roaming In an enterprise network?

  A. a lightweight access point

  B. a firewall

  C. a wireless LAN controller

  D. a LAN switch

  Correct Answer: C

  A wireless LAN (Local Area Network) controller (WLC) is a device that provides centralized control and management of multiple wireless access points (APs) in a wireless network . It is responsible for configuring and monitoring the access points, managing the wireless traffic, and providing security protocols such as authentication and encryption. The WLC also enables seamless roaming between the access points without the need for reauthentication, as it maintains a centralized database of user credentials and authentication information.

  Therefore, in an enterprise network, a wireless LAN controller provides centralized control of authentication and roaming for wireless clients .

• Question 460:

  An engineer has configured the domain name, user name, and password on the local router. What is the next step to complete the configuration tor a Secure Shell access RSA key?

  A. crypto key Import rsa pem

  B. crypto key pubkey-chain rsa

  C. crypto key generate rsa

  D. crypto key zeroize rsa

  Correct Answer: C

  The next step to complete the configuration for a Secure Shell (SSH) access RSA key on the local router is to use the "crypto key generate rsa" command. This command generates an RSA key pair that will be used for SSH encryption and authentication purposes.

  After running this command, the router will prompt for the key modulus size (usually 1024 or 2048 bits) and will generate the RSA key pair. The generated RSA public key will be used for SSH server authentication, and the private key will be stored on the router for secure SSH communication.