Cisco CCNA (200-301) — All Questions

A standard IPv4 ACL is applied to filter traffic. On which criterion can a standard ACL match?

• a.Source and destination IP plus port
• b.Source IP address only✓
• c.Destination MAC address
• d.Application-layer payload

Standard IPv4 ACLs (numbered 1-99 and 1300-1999) filter based only on the source IP address. Extended ACLs are required to match source and destination addresses, protocols, and port numbers. Because standard ACLs are less granular, they are typically placed close to the destination to avoid blocking too much traffic.

DHCP snooping classifies switch ports as trusted or untrusted. What happens to a DHCP server reply (DHCPOFFER) received on an untrusted port?

• a.It is forwarded normally
• b.It is tagged and logged only
• c.It is dropped✓
• d.It is rate-limited but allowed

DHCP snooping treats ports facing hosts as untrusted and drops server-sourced messages like DHCPOFFER and DHCPACK arriving on them, preventing rogue DHCP servers. Only trusted ports, typically uplinks toward legitimate DHCP servers, may forward these replies. The feature also builds a binding table that Dynamic ARP Inspection uses.

A switch port is configured with port security in the default violation mode. When an unauthorized MAC address exceeds the maximum, what is the result?

• a.The port is err-disabled and shut down (shutdown mode)✓
• b.The port drops only the offending frames but stays up
• c.The port allows the traffic but sends a Syslog
• d.The port reboots the switch

The default port-security violation mode is shutdown, which places the port in the err-disabled state and requires administrative recovery (or errdisable recovery) when a violation occurs. The 'protect' mode silently drops unknown traffic, while 'restrict' drops it and increments counters plus sends notifications. This limits which MAC addresses can use a port.

Which wireless security standard introduces Simultaneous Authentication of Equals (SAE) to replace the pre-shared key handshake and protect against offline dictionary attacks?

• a.WEP
• b.WPA
• c.WPA2
• d.WPA3✓

WPA3 replaces the WPA2 four-way handshake with SAE (Simultaneous Authentication of Equals), a dragonfly key exchange that resists offline dictionary attacks even with weak passwords. It also adds forward secrecy. WEP and WPA are legacy and cryptographically broken, while WPA2 relies on AES-CCMP but remains vulnerable to some offline attacks.