Cisco CCNA (200-301) — All Questions

Which ACL statement blocks all ping (ICMP) traffic sourced from network 192.168.1.0/24 to any destination?

• a.deny icmp 192.168.1.0 255.255.255.0 any, using a mask not a wildcard
• b.deny tcp 192.168.1.0 0.0.0.255 any eq echo, referencing the wrong protocol
• c.deny ip 192.168.1.0 0.0.0.255 any, which blocks all IP, not just ICMP
• d.deny icmp 192.168.1.0 0.0.0.255 any✓

Blocking ping requires denying the ICMP protocol from the source /24 (wildcard 0.0.0.255) to any destination. Denying 'ip' would block far more than pings, and ICMP is not carried over TCP.

By default, how many MAC addresses does an interface allow when port security is first enabled?

• a.an unlimited number until manually restricted
• b.2, to allow a phone and a PC automatically
• c.0, which would block every device on the port
• d.1✓

When port security is enabled, the default maximum is a single secure MAC address on the interface. Administrators raise the maximum (for example, to allow an IP phone plus a PC) with the 'switchport port-security maximum' command.

Which command allows a maximum of 3 learned MAC addresses on a port-security-enabled interface?

• a.switchport port-security maximum 3✓
• b.switchport port-security limit 3, using an incorrect keyword
• c.switchport security maximum 3, missing the 'port-' prefix
• d.switchport port-security mac-count 3, which is not valid syntax

The 'switchport port-security maximum 3' command sets the number of MAC addresses the port may learn or be assigned before a violation occurs. It is paired with the base 'switchport port-security' command.

In 802.1X port-based authentication, what is the role of the switch?

• a.The supplicant that requests access to the network
• b.The certificate authority that issues client certificates
• c.The authentication server that validates the credentials
• d.The authenticator that relays credentials between the supplicant and the authentication server✓

In 802.1X the switch is the authenticator: it controls port access and passes EAP messages between the client (supplicant) and a RADIUS authentication server. It does not itself decide whether the credentials are valid.

In 802.1X, which device is the supplicant?

• a.The switch controlling access to the port
• b.The RADIUS server validating the credentials
• c.The wireless LAN controller managing the APs
• d.The end-user client requesting access to the network✓

The supplicant is the endpoint (such as a PC with 802.1X client software) that submits credentials to gain network access. The switch is the authenticator, and the RADIUS server is the authentication server.

Which command enforces a minimum length of 10 characters for all locally configured passwords?

• a.service password min-length 10, which is not valid syntax
• b.enable secret min-length 10, which mixes two commands
• c.security passwords min-length 10✓
• d.password min-length 10, which omits the 'security' keyword

'security passwords min-length 10' sets a global minimum length that new passwords must meet, strengthening credentials against guessing. Existing shorter passwords remain until changed.

What is a security advantage of 'enable secret' over 'enable password'?

• a.It stores the password as a hash rather than as clear or weakly encrypted text✓
• b.It automatically disables Telnet on the VTY lines
• c.It encrypts the entire running configuration file
• d.It permits the use of much longer passwords only

'enable secret' stores the privileged-mode password as a one-way hash, which is far stronger than the reversible, weak encoding used by 'enable password'. If both are set, the secret takes precedence.

An unauthorized person follows an employee through a secured door without badging in. Which attack does this describe?

• a.Tailgating (piggybacking)✓
• b.Shoulder surfing, which observes credentials being entered
• c.Phishing, which uses deceptive electronic messages
• d.Pretexting, which invents a false scenario over the phone

Tailgating (piggybacking) is a physical social-engineering attack in which an attacker slips through a secured entry behind an authorized person. It bypasses badge controls without any technical exploit.

Which malware type encrypts a victim's files and demands payment for the decryption key?

• a.A worm, which self-replicates across networks
• b.Spyware, which quietly harvests user information
• c.Ransomware✓
• d.A rootkit, which hides deep in the operating system

Ransomware encrypts data and extorts the victim for a decryption key. Worms spread by self-replication, rootkits conceal an attacker's presence, and spyware covertly gathers information, each with a different goal.

Besides double-tagging, VLAN hopping can occur through switch spoofing. Which configuration prevents it?

• a.Enabling PortFast globally across all switch ports
• b.Enabling DTP dynamic auto on all of the access ports
• c.Using VLAN 1 as the native VLAN on every trunk
• d.Disabling DTP and manually setting access or trunk mode on every port✓

Switch spoofing exploits DTP to trick a switch into forming a trunk, so disabling DTP with 'switchport nonegotiate' and hardcoding each port's mode stops it. Leaving ports in a dynamic DTP mode is exactly what enables the attack.

Which HTTP method in a REST API is typically used to create a new resource on the server?

• a.OPTIONS, which lists the methods a resource supports
• b.GET, which only retrieves an existing resource
• c.POST✓
• d.DELETE, which removes an existing resource

POST is conventionally used to create a new resource, often returning the new object's identifier. GET reads data without changing it, DELETE removes resources, and OPTIONS reports which methods are allowed.

In a REST API, which method fully replaces an existing resource with a new representation?

• a.PATCH, which applies only a partial update
• b.POST, which is generally used to create a new resource
• c.GET, which retrieves the resource without altering it
• d.PUT✓

PUT replaces the entire target resource with the supplied representation, making it idempotent. PATCH modifies only part of a resource, POST typically creates, and GET only reads.

A REST API call returns HTTP status code 200. What does this indicate?

• a.The requested resource could not be found
• b.The request succeeded✓
• c.Authentication was required but not provided
• d.The server encountered an internal error

A 200 (OK) status means the request was processed successfully and the response contains the expected data. The 2xx family signals success, while 4xx indicates client errors and 5xx indicates server errors.

A REST API returns HTTP status code 401. What does it mean?

• a.A new resource was created as a result of the request
• b.The destination server is temporarily unavailable
• c.The request completed successfully with data returned
• d.Authentication is required or the supplied credentials failed✓

A 401 (Unauthorized) response indicates the client must authenticate or that the provided credentials were rejected. It is distinct from 403 (forbidden), where the identity is known but access is still denied.

Which data format uses indentation (whitespace) rather than braces to denote structure and is common in Ansible playbooks?

• a.JSON, which relies on braces and brackets for structure
• b.CSV, which separates flat records with commas
• c.YAML✓
• d.XML, which delimits every element with paired tags

YAML uses indentation to represent hierarchy, making it very human-readable, which is why Ansible playbooks are written in it. JSON uses braces and brackets, and XML wraps data in tags.

Which data-encoding format uses opening and closing tags to delimit every element?

• a.CSV, which uses commas to separate simple fields
• b.XML✓
• c.JSON, which uses key/value pairs inside braces
• d.YAML, which uses indentation to show hierarchy

XML (eXtensible Markup Language) wraps each piece of data between matching opening and closing tags, producing a verbose but strictly structured document. NETCONF, for example, encodes its data in XML.

In an SDN architecture, what does the controller's northbound interface (API) connect to?

• a.Applications and orchestration or automation tools✓
• b.The out-of-band console ports of the devices
• c.The forwarding ASICs inside each switch
• d.The physical network devices in the data plane

The northbound interface exposes APIs so applications and orchestration systems can express intent to the controller. The southbound interface, by contrast, is what the controller uses to program the network devices.

Which configuration-management tools traditionally use an agent-based, pull model with a central master server?

• a.Puppet and Chef✓
• b.Terraform and raw YAML files
• c.Ansible and plain Bash scripting
• d.NETCONF and RESTCONF protocols

Puppet and Chef historically install an agent on each managed node that periodically pulls its desired configuration from a master. Ansible differs by being agentless and pushing configuration over SSH.

Which protocol uses SSH as its transport and XML-encoded data to configure network devices programmatically?

• a.RESTCONF, which runs over HTTP instead of SSH
• b.SNMP, which is chiefly used for monitoring devices
• c.Syslog, which only carries event log messages
• d.NETCONF✓

NETCONF runs over SSH and exchanges configuration and state data encoded in XML, supporting reliable, transactional changes. RESTCONF offers similar functionality but over HTTP using JSON or XML.

What is the main function of a network controller such as Cisco Catalyst Center (formerly DNA Center) in intent-based networking?

• a.It replaces every physical switch with a virtual appliance
• b.It serves only as the network's central DHCP server
• c.It merely stores periodic backups of device configs
• d.It translates business intent into device configurations and monitors assurance centrally✓

An intent-based controller lets operators express high-level intent, which it renders into specific device configurations, then continuously verifies the network is meeting that intent through assurance and telemetry. It centralizes automation and monitoring rather than replacing hardware.

To which subnet does the host 10.50.20.130 with a /25 mask belong?

• a.10.50.20.129
• b.10.50.20.0
• c.10.50.20.255
• d.10.50.20.128✓

A /25 mask (255.255.255.128) splits the /24 into two subnets, .0 and .128, each with a block size of 128. The host .130 falls in the .128-.255 block, so its network address is 10.50.20.128.

On a Cisco Wireless LAN Controller, which interface handles in-band management and by default sources CAPWAP communication with APs?

• a.The virtual interface
• b.The management interface✓
• c.A dynamic interface, which simply maps to a client VLAN
• d.The service port

The WLC management interface carries in-band management traffic and, by default, sources the CAPWAP tunnels to the access points. The virtual interface supports client processes like web auth, and dynamic interfaces map to client VLANs.