Cisco CCNA 200-301 Questions & Answers

• Question 571:

  Which service is missing when RADIUS is selected to provide management access to the WLC?

  A. authorization

  B. authentication

  C. accounting

  D. confidentiality

  Correct Answer: C

  When RADIUS is used to provide management access to a Wireless LAN Controller (WLC), the service that is missing is accounting. RADIUS primarily handles authentication and authorization for network access. Authentication verifies the identity of the user or device, while authorization determines the level of access granted to the authenticated entity. However, accounting, which involves tracking and recording of network resource usage, is not typically provided by RADIUS in the context of management access to a WLC.

• Question 572:

  Refer to the exhibit. Which two commands must be configured on router R1 to enable the router to accept secure remote-access connections? (Choose two.)

  

  A. ip ssh pubkey-chain

  B. username cisco password 0 cisco

  C. crypto key generate rsa

  D. transport input telnet

  E. login console

  Correct Answer: AC

  Option A (ip ssh pubkey-chain) enables SSH connections using public key authentication, which is a more secure method compared to password-based authentication. Option C (crypto key generate rsa) generates an RSA key pair that is used for encryption and authentication purposes when establishing secure connections, such as SSH. The other options are not directly related to enabling secure remote-access connections:

  B. username cisco password 0 cisco - This command creates a local user account with the username "cisco" and a plaintext password. However, it does not enable secure remote-access connections.

  D. transport input telnet - This command allows telnet access to the router, but telnet is not a secure protocol.

  E. login console - This command enables console line authentication, but it is not specific to remote-access connections or providing security for them.

• Question 573:

  Refer to the exhibit. An access-list is required to permit traffic from any host on interface Gi0/0 and deny traffic from interface Gi0/1. Which access list must be applied?

  

  A. ip access-list standard 99 permit 10.100.100.0 0.0.0.255 deny 192.168.0.0 0.0.255.255

  B. ip access-list standard 99 permit 10.100.100.0 0.0.0.255 deny 192.168.0.0 0.255.255.255

  C. ip access-list standard 199 permit 10.100.100.0 0.0.0.255 deny 192.168.0.0 0.255.255.255

  D. ip access-list standard 199 permit 10.100.100.0 0.0.0.255 deny 192.168.0.0 0.0.255.255

  Correct Answer: A

• Question 574:

  Which QoS traffic handling technique retains excess packets in a queue and reschedules these packets for later transmission when the configured maximum bandwidth has been surpassed?

  A. traffic policing

  B. weighted random early detection

  C. traffic prioritization

  D. traffic shaping

  Correct Answer: D

  Reference: https://www.cisco.com/c/en/us/support/docs/quality-of-service-qos/qos-policing/19645-policevsshape.html

• Question 575:

  A network engineer is configuring a switch so that it is remotely reachable via SSH. The engineer has already configured the host name on the router. Which additional command must the engineer configure before entering the command to generate the RSA key?

  A. password password

  B. ip ssh authentication-retries 2

  C. ip domain-name domain

  D. crypto key generate rsa modulus 1024

  Correct Answer: C

  https://www.cisco.com/c/en/us/solutions/small-business/resource-center/networking/how-to-setup-network-switch.html

• Question 576:

  Which command implies the use of SNMPv3?

  A. snmp-server user

  B. snmp-server host

  C. snmp-server enable traps

  D. snmp-server community

  Correct Answer: A

  "Device(config)# snmp-server user user1 group1 v3 auth md5 password123 priv des passwd123654"

  (Added a new user named "user1" to the SNMPv3 group "group1". User is configured for authentication (auth) using MD5 hashing algorithm with password "password123". In addition, user also has privacy (priv) enabled using the DES encryption algorithm with the privacy password "passwd123654".)

  There are several authentication and privacy algorithms available for SNMPv3, such as MD5, SHA, DES, AES, and others.

• Question 577:

  R1 as an NTP server must have:

  1.

  NTP authentication enabled

  2.

  NTP packets sourced from Interface loopback 0

  3.

  NTP stratum 2

  4.

  NTP packets only permitted to client IP 209.165.200.225

  How should R1 be configured?

  A. ntp authenticate ntp authentication-key 2 sha1 CISCO123 ntp source Loopback0 ntp access-group server-only 10 ntp master 2 ! access-list 10 permit udp host 209.165.200.225 any eq 123

  B. ntp authenticate ntp authentication-key 2 md5 CISCO123 ntp interface Loopback0 ntp access-group server-only 10 ntp stratum 2 ! access-list 10 permit 209.165.200.225

  C. ntp authenticate ntp authentication-key 2 md5 CISCO123 ntp source Loopback0 ntp access-group server-only 10 ntp master 2 ! access-list 10 permit 209.165.200.225

  D. ntp authenticate ntp authentication-key 2 md5 CISCO123 ntp source Loopback0 ntp access-group server-only 10 ntp stratum 2 ! access-list 10 permit udp host 209.165.200.225 any eq 123

  Correct Answer: C

• Question 578:

  Refer to the exhibit. Which two commands must be added to update the configuration of router R1 so that it accepts only encrypted connections? (Choose two.)

  

  A. transport input ssh

  B. username CNAC secret R!41!3705926@

  C. crypto key generate rsa 1024

  D. line vty 0 4

  E. ip ssh version 2

  Correct Answer: AC

  The default setting on switch/router to accept remote access is telnet.

  Crypto key is not yet generated.

  "...configuration of router R1 so that it accepts ONLY encrypted connections..."

• Question 579:

  Refer to the exhibit. Which command configures OSPF on the point-to-point link between routers R1 and R2?

  

  A. router-id 10.0.0.15

  B. neighbor 10.1.2.0 cost 180

  C. network 10.0.0.0 0.0.0.255 area 0

  D. ip ospf priority 100

  Correct Answer: C

• Question 580:

  Refer to the exhibit.

  

  Which next-hop IP address does Router1 use for packets destined to host 10.10.13.158?

  A. 10.10.10.9

  B. 10.10.10.5

  C. 10.10.11.2

  D. 10.10.12.2

  Correct Answer: A

  144/28 145-158 (Broadcast 159)

  The options below do not cover 10.10.13.158.

  128/28 129-142 (Broadcast 143)

  160/29 161-166 (Broadcast 167)

  208/29 209-214 (Broadcast 215)