Cisco CCNA (200-301) — All Questions

What does 'trust boundary' mean in a QoS deployment?

• a.The list of SNMP managers permitted to change QoS markings remotely
• b.The maximum bandwidth a policy will permit before dropping packets
• c.The physical demarcation point between the LAN and the service provider's network
• d.The point in the network where incoming QoS markings are accepted rather than overwritten✓

The trust boundary is where the network begins honoring the DSCP or CoS markings on incoming traffic instead of re-marking them. Markings from untrusted devices (like user PCs) are typically reset, while markings from trusted devices (like IP phones) are accepted. Defining the boundary correctly ensures only legitimate traffic gets priority.

Which command on a Cisco device displays the current date and time from the system clock?

• a.show clock✓
• b.show ntp associations, which lists peers instead of local time
• c.show time zone offset only
• d.show calendar sync, which is not a standard IOS command

'show clock' prints the device's current date and time as maintained by the system clock. To see whether that clock is synchronized via NTP, use 'show ntp status'. Accurate local time underpins meaningful log timestamps, certificate validation, and time-based access controls.

Why should management protocols like SNMP and Syslog be sent over a dedicated or protected management path when possible?

• a.Because they require the highest OSPF cost to be reachable
• b.Because they only function correctly on point-to-point serial links
• c.To keep monitoring and log data secure and available even when the data plane is congested or attacked✓
• d.Because they consume more bandwidth than user data and would slow the network Assigning them that highest cost also guarantees they survive any spanning-tree recalculation.

Isolating management traffic (SNMP, Syslog, SSH) on a dedicated or protected path keeps device monitoring and control reachable even during congestion or attacks on the production network. It also limits exposure of sensitive management data. This separation is a core principle of secure network operations.

At what point in a DHCP lease does a client first attempt to renew, entering the RENEWING state?

• a.At 50% of the lease time (timer T1)✓
• b.At 100% of the lease, only after the address expires
• c.At 87.5% of the lease time, when it would begin rebinding
• d.At 25% of the lease, immediately after acknowledgment

A DHCP client tries to renew directly with its server at T1, which is 50% of the lease duration. If that fails, at T2 (about 87.5%) it broadcasts to any server (rebinding), and at 100% the lease expires.

How does a DHCP server ensure a specific host always receives the same IP address?

• a.By adding the address to the pool's exclusion list
• b.By shortening that host's lease time to a few seconds
• c.By enabling DHCP snooping on the access switch
• d.By binding the address to the host's MAC in a reservation✓

A DHCP reservation ties a fixed IP to a client's MAC address, so that host always gets the same lease from the pool. Exclusions merely keep addresses out of the pool, and snooping is a security feature, not an assignment method.

In Cisco NAT terminology, what is an 'outside global' address?

• a.The real registered address of a destination host on the outside network✓
• b.The translated public address representing an inside host
• c.The IP configured on the router's inside NAT interface
• d.The private address of an inside host before translation

The outside global address is the actual public address of a host out on the Internet, as seen by everyone. Inside local is a host's private address, inside global is its translated public address, and outside local is how the outside host appears internally.

Which command marks the interface facing the Internet as the NAT outside interface?

• a.nat outside source, which relates to translation rules
• b.ip nat enable, which is not a valid IOS command
• c.ip nat outside✓
• d.ip nat inside, which designates an internal interface

'ip nat outside' is applied under the interface connected to the public network to identify it as the outside of the translation. The corresponding internal interface is marked with 'ip nat inside'.

A device attached directly to an authoritative reference clock such as GPS operates at which NTP stratum?

• a.Stratum 1✓
• b.Stratum 16, which indicates an unsynchronized clock
• c.Stratum 2, which syncs from a stratum-1 server
• d.Stratum 0, which is the reference clock hardware itself

Stratum 0 is the reference clock hardware (GPS, atomic), and a device directly attached to it becomes stratum 1, the most authoritative network time source. Each additional hop increases the stratum number, and 16 means unsynchronized.

Which command configures a Cisco router to act as an authoritative NTP time source for the network?

• a.ntp peer, which forms a symmetric relationship with a peer
• b.ntp server, which points to an upstream time source instead
• c.ntp master✓
• d.clock set, which only sets the local time manually

'ntp master' makes the router an authoritative NTP source so other devices can synchronize to it, useful when no external reference is reachable. 'ntp server' instead configures the router as a client of an upstream server.

Which command enables logging of Syslog messages to the router's internal memory buffer?

• a.logging trap, which sets the severity for a remote server
• b.logging buffered✓
• c.logging host, which points to an external Syslog server
• d.logging console, which sends messages to the console line

'logging buffered' stores log messages in RAM so they can be reviewed later with 'show logging', even without a remote server. Console and remote logging are controlled by separate commands.

What does the command 'logging trap 4' configure a device to send to a Syslog server?

• a.Messages of severity 4 (warnings) and all more severe levels✓
• b.Only the most verbose debugging-level messages
• c.All eight severity levels regardless of the setting
• d.Only messages that are exactly severity level 4

The logging trap level sets a threshold, so 'logging trap 4' forwards warnings (4) plus everything more severe (0 through 3). Lower numbers are more critical, and setting a threshold reduces noise sent to the server.

What is a notable security limitation of SNMPv2c?

• a.It requires TCP and cannot operate over UDP
• b.It provides no mechanism for sending traps to a manager
• c.It is unable to poll device statistics from an agent
• d.It relies on plaintext community strings with no encryption✓

SNMPv2c authenticates only with community strings sent in clear text and offers no encryption, so credentials and data can be captured. SNMPv3 was introduced to add authentication and encryption for secure management.

Which SNMP operation retrieves the value of a single specified object from an agent?

• a.TRAP
• b.SET, which changes an object's value on the agent
• c.INFORM
• d.GET✓

The SNMP GET operation is sent by the manager to read one specified object's value from an agent. TRAP and INFORM are notifications from the agent, and SET writes a new value rather than reading one.

In a QoS policy, what is the difference between classification and marking?

• a.Marking always happens before any classification occurs
• b.They are two names for the same single QoS action
• c.Classification sorts traffic into classes, while marking sets a field like DSCP so downstream devices can honor it✓
• d.Classification drops traffic while marking buffers it for later

Classification identifies and groups traffic (for example, by ACL or protocol), and marking then writes a value such as DSCP or CoS into the packet so other devices trust and act on that class consistently. Classify first, then mark.

Which 3-bit field inside the 802.1Q tag carries the Layer 2 Class of Service (CoS) marking?

• a.The Priority Code Point (802.1p) bits✓
• b.The 12-bit VLAN ID field within the same tag
• c.The DSCP field, which lives in the IP header instead
• d.The EtherType field that follows the tag

The 802.1Q tag includes a 3-bit Priority Code Point (802.1p) that carries the Layer 2 CoS value (0-7) for prioritization on trunks. DSCP is a Layer 3 marking in the IP header, not part of the 802.1Q tag.

Which command forces a Cisco device to accept only SSH version 2 for remote sessions?

• a.crypto key generate rsa, which just creates the key pair
• b.ip ssh version 2✓
• c.transport input ssh, which only limits the VTY protocol
• d.ssh version 2, which is not valid global syntax

'ip ssh version 2' restricts the device to SSHv2, which fixes weaknesses present in version 1. Generating RSA keys and restricting VTY input are separate prerequisites, but they do not by themselves force version 2.

Which command displays the IP addresses the router's DHCP server has leased and the client MAC addresses they map to?

• a.show ip dhcp conflict, which lists duplicate-address problems
• b.show ip dhcp binding✓
• c.show ip dhcp pool, which shows range and utilization only
• d.show running-config, which shows configuration, not leases

'show ip dhcp binding' lists the active bindings, including each leased IP, the client identifier or MAC, and the lease expiration. The pool command shows configuration and utilization, while conflict shows detected address conflicts.

Which command clears all dynamic NAT translations from the router's translation table?

• a.no ip nat
• b.clear ip nat *
• c.clear ip nat translation *✓
• d.reset ip nat, which does not exist in IOS

'clear ip nat translation *' removes all current dynamic translations, which is useful when reconfiguring NAT or freeing stale entries. Static translations are not affected because they are permanently configured.