Cisco CCNA 200-301 Questions & Answers

• Question 71:

  Refer to the exhibit.

  

  The New York router must be configured so that traffic to 2000::1 is sent primarily via the Atlanta site, with a secondary path via Washington that has an administrative distance of 2. Which two commands must be configured on the New York router? (Choose two.)

  A. ipv6 route 2000::1/128 2012::1

  B. ipv6 route 2000::1/128 2012::1 5

  C. ipv6 route 2000::1/128 2012::2

  D. ipv6 route 2000::1/128 2023::2 5

  E. ipv6 route 2000::1/128 2023::3 2

  Correct Answer: AE

• Question 72:

  The clients and DHCP server reside on different subnets. Which command must be used to forward requests and replies between clients on the 10.10.0.1/24 subnet and the DHCP server at 192.168.10.1?

  A. ip route 192.168.10.1

  B. ip dhcp address 192.168.10.1

  C. ip default-gateway 192.168.10.1

  D. ip helper-address 192.168.10.1

  Correct Answer: D

• Question 73:

  Refer to the exhibit.

  

  access-list 10 permit 192.168.0.0 0.0.0.255

  ip nat inside source list 10 pool CCNA overload

  Which command set configures ROUTER-1 to allow Internet access for users on the 192.168.1.0/24 subnet while using 209.165.202.129 for Port Address Translation?

  A. ip nat pool CCNA 192.168.0.0 192.168.1.255 netmask 255.255.255.0

  B. ip nat pool CCNA 209.165.202.129 209.165.202.129 netmask 255.255.255.255

  access-list 10 permit 192.168.1.0 255.255.255.0

  ip nat inside source list 10 pool CCNA overload

  C. ip nat pool CCNA 192.168.0.0 192.168.1.255 netmask 255.255.255.0

  access-list 10 permit 192.168.0.0 255.255.255.0

  ip nat inside source list 10 pool CCNA overload

  D. ip nat pool CCNA 209.165.202.129 209.165.202.129 netmask 255.255.255.255 access-list 10 permit 192.168.1.0 0.0.0.255 ip nat inside source list 10 pool CCNA overload

  Correct Answer: D

  NAT policies perform address translation by translating internal IP addresses to the addresses in a NAT pool.

  The Pool indicates the public addresses you will use to go out the internet. The access list includes the private subnet you will be NATing.

• Question 74:

  Which IP header field is changed by a Cisco device when QoS marking is enabled?

  A. ECN

  B. Header Checksum

  C. Type of Service

  D. DSCP

  Correct Answer: C

• Question 75:

  Which DSCP per-hop forwarding behavior is divided into subclasses based on drop probability?

  A. expedited

  B. default

  C. assured

  D. class-selector

  Correct Answer: C

  The DSCP per-hop forwarding behavior that is divided into subclasses based on drop probability is the Assured Forwarding (AF) behavior. The AF behavior is divided into 4 subclasses (AF1, AF2, AF3, and AF4), each with 3 drop

  probabilities. Each forwarding class provides 3 drop precedences, which allow different levels of drop probability to be assigned to packets with different DSCP values.

  Therefore, the AF behavior is used to provide a differentiated quality of service for network traffic by dividing it into subclasses based on drop probability.

• Question 76:

  Which WPA mode uses PSK authenticaton?

  A. Local

  B. Personal

  C. Enterprise

  D. Client

  Correct Answer: B

  The WPA mode that uses PSK (Pre-Shared Key) authentication is the Personal mode.

  WPA (Wi-Fi Protected Access) is a security protocol used in wireless networks to protect the communication between devices. WPA has two modes of operation: Personal mode and Enterprise mode.

  Personal mode, also known as WPA-PSK (Pre-Shared Key), uses a shared secret key (PSK) to authenticate wireless clients and encrypt network traffic. The PSK is a passphrase or password that is shared between the access point and wireless clients.

  Enterprise mode, also known as WPA-EAP (Extensible Authentication Protocol), uses a RADIUS (Remote Authentication Dial-In User Service) server to authenticate wireless clients. Enterprise mode provides stronger security than Personal mode, but it requires more setup and infrastructure.

  In summary, WPA-Personal mode uses PSK authentication, while WPA-Enterprise mode uses RADIUS server authentication.

• Question 77:

  Refer to the exhibit.

  

  This ACL is configured to allow client access only to HTTP, HTTPS, and DNS services via UDP. The new administrator wants to add TCP access to the ONS service. Which configuration updates the ACL efficiently?

  A. no ip access-list extended Services

  ip access-list extended Services

  30 permit tcp 10.0.0.0 0.255.255.255 host 198.51.100.11 eq domain

  B. ip access-list extended Services 35 permit tcp 10.0.0.0 0.255.255.255 host 198.51.100.11 eq domain

  C. ip access-list extended Services permit tcp 10.0.0.0 0.255.255.255 host 198.51.100.11 eq domain

  D. no ip access-list extended Services

  ip access-list extended Services

  permit udp 10.0.0.0 0.255.255.255 any eq 53

  permit tcp 10.0.0.0 0.255.255.255 host 198.51.100.11 eq domain

  deny ip any any log

  Correct Answer: B

• Question 78:

  What is a characteristic of RSA?

  A. It uses preshared keys for encryption.

  B. It is a public-key cryptosystem.

  C. It is a private-key encryption algorithm.

  D. It requires both sides to have identical keys.

  Correct Answer: B

  RSA is a public-key cryptosystem. This means that it uses a pair of keys, one of which is kept private and the other of which is made public. The public key can be distributed to anyone who wants to send encrypted messages to the owner of the private key, while the private key is kept secret and is used by the owner to decrypt messages.

• Question 79:

  Which two VPN technologies are recommended by Cisco for multiple branch offices and large-scale deployments? (Choose two.)

  A. GETVPN

  B. DMVPN

  C. site-to-site VPN

  D. clientless VPN

  E. IPsec remote access

  Correct Answer: AB

  A. GETVPN (Group Encrypted Transport VPN): GETVPN is a Cisco VPN technology that provides secure and scalable VPN connectivity for multiple branch offices and large-scale deployments. It uses a group-based encryption mechanism to encrypt traffic between sites, allowing for efficient and scalable encryption across the network. GETVPN is particularly suitable for deployments with high bandwidth requirements and complex routing environments.

  B. DMVPN (Dynamic Multipoint VPN): DMVPN is another Cisco VPN technology designed for scalable and dynamic VPN deployments. It allows for the creation of secure overlay networks over public or private WAN connections. DMVPN provides efficient and scalable connectivity between multiple branch offices by using a combination of IPsec, GRE (Generic Routing Encapsulation), and NHRP (Next Hop Resolution Protocol). It simplifies the configuration and management of VPN connections, making it well-suited for large-scale deployments.

• Question 80:

  Refer to the exhibit.

  

  A network administrator is configuring a router for user access via SSH. The service-password encryption command has been issued. The configuration must meet these requirements:

  1.

  Create the username as CCUser.

  2.

  Create the password as NA!2$cc.

  3.

  Encrypt the user password.

  What must be configured to meet the requirements?

  A. username CCUser privilege 10 password NA!2$cc

  B. username CCUser privilege 15 password NA!2$cc enable secret 0 NA!2$cc

  C. username CCUser secret NA!2Sce

  D. username CCUser password NA!2$cc enable password level 5 NA!2$cc

  Correct Answer: C

  To create the username as CCUser, create the password as NA!2$cc, and encrypt the user password, option C is the correct configuration.

  Option A only creates the user and sets a plain-text password. Option B sets a privileged level password for enable mode, but it does not create the user or encrypt the password. Option D creates the user and sets a plain-text password but does not encrypt the password. Option C creates the user, sets an encrypted password, and meets all the specified requirements.