200-301 Cisco Certified Network Associate Free Practice Exam Questions (2026 Updated)

The exhibit shows an interface configured as trusted for Dynamic ARP Inspection. In a normal access-layer design, trusted DAI ports are not user-facing ports. They are uplinks or infrastructure-facing links where valid ARP replies may arrive, typically toward a router, distribution switch, or another trusted network device. End-user devices such as PCs and ordinary DHCP clients should stay untrusted so the switch can validate their ARP traffic against the DHCP snooping binding database. If an untrusted host sends forged ARP information, DAI can drop it before it poisons neighboring hosts. That is why the device connected to FastEthernet0/1 is expected to be a router in this scenario. Cisco CCNA 200-301 v1.1 places this under IP Services and access-layer security behavior because DHCP snooping and DAI work together to protect Layer 2 addressing. The clue is the ip arp inspection trust interface setting. A trusted port should face infrastructure, not an endpoint, so C is correct.

DHCP dynamically leases IP configuration to clients, and the server can exclude specific addresses from the assignable pool. Exclusions are important because some addresses in the subnet may be reserved for routers, servers, printers, infrastructure interfaces, or static assignments. DHCP leasing means the client receives an address for a defined lease time and must renew it before expiration. Cisco CCNA 200-301 v1.1 IP Services includes DHCP because engineers must understand address pools, default-router options, DNS options, exclusions, and relay behavior. The server, not the client, maintains the pool of assignable addresses. DHCP does not assign addresses forever without renewal. A client can receive DNS server information, but the statement that it can request up to four DNS servers is not the core tested role here. The two correct operational roles are that the DHCP server can exclude addresses from a pool and lease client IP addresses dynamically. Those are A and D.

The verified answer is D. service password-encryption encrypts supported plaintext passwords in the running configuration. It provides basic obfuscation for line passwords and other password fields so casual viewers do not see clear text. Cisco CCNA 200-301 v1.1 places this skill in Security Fundamentals, where the exam expects a working understanding of how the feature behaves on real Cisco networks, not just a memorized command. enable secret protects only the enable secret value, while the other listed commands are not the correct IOS global command. In production, this distinction matters because a misapplied command or design choice usually creates an outage, a security gap, or unnecessary troubleshooting noise. The correct choice matches the control-plane, data-plane, wireless, security, or services behaviour described in the scenario and should be preferred over options that merely sound related.

A First Hop Redundancy Protocol protects the default gateway function for hosts on a subnet. Without FHRP, a host typically points to one router interface as its default gateway. If that router or interface fails, the host loses off-subnet connectivity even if another router is available. FHRP solves that by allowing multiple routers to present a single virtual gateway to the LAN. Depending on the protocol, routers elect active and standby roles or share forwarding. Cisco technologies in this space include HSRP, while VRRP is standards-based and GLBP adds gateway load-balancing behavior. The exam answer is not about sharing configuration data, bridge priorities, or OSPF equal-cost routing. Those are separate functions. Cisco CCNA 200-301 v1.1 tests FHRP under IP Connectivity because a working default gateway is essential to end-to-end routing. The primary purpose is to reduce routing failures by allowing more than one router to represent itself as the default gateway for a network.

Cisco CCNA 200-301 v1.1 Network Fundamentals questions of this type test whether each item is matched to the technology that actually performs that role. The reliable method is to classify each term by operating layer, packet behavior, management function, or security purpose before matching it. Several terms in these items are legitimate Cisco networking concepts, but they become wrong when assigned to the wrong protocol or plane. The mapping retained in the document follows that separation: transport behavior is matched to TCP or UDP, wireless or security terms are matched to their mechanisms, and automation items are matched to the correct API or management model. This matters operationally because troubleshooting fails quickly when a forwarding-plane function is treated as a management-plane feature or when a security control is applied to the wrong threat. The shown mapping is therefore retained as the verified response.

10.10.10.5. Cisco routers select forwarding paths by longest-prefix match first, then administrative distance and metric when comparable routes compete. Cisco CCNA 200-301 v1.1 includes this under Network Fundamentals, where the exam expects engineers to recognize the device behavior that actually produces the required outcome. The question is best solved by reading the operational clue rather than choosing a familiar acronym. The wrong choices either do not match the destination, use the wrong next hop, or fail to provide the intended primary/backup behavior. In a production network, the wrong choice would normally create an outage, leave a management or security gap, or send troubleshooting toward the wrong subsystem. The selected answer is the one that matches the control-plane, data-plane, wireless, security, services, or automation mechanism described in the question. That is why it remains the verified answer for this item.

The router forwards traffic based on the best matching route in the routing table. For a destination host such as 10.0.1.5, the router compares available prefixes and selects the route with the longest matching prefix. After selecting the route, it forwards the packet to the next-hop address listed for that route, not necessarily to the final destination directly. In this exhibit, the route that includes 10.0.1.5 points to 10.0.1.50 as the next hop. That makes 10.0.1.50 the Layer 3 neighbor to which the packet is sent next. Cisco CCNA 200-301 v1.1 IP Connectivity expects engineers to read routing output accurately: destination prefix, administrative distance, metric, next-hop address, outgoing interface, and route source all have separate meanings. A loopback label is not a next-hop IP address, and nearby addresses in the same range are not automatically correct. The next hop is the one installed in the matching route entry, so B is correct.

It divides the control-plane and data-plane functions.. Cisco forwarding uses longest-prefix match first, then administrative distance and metric when multiple sources compete. Cisco CCNA 200-301 v1.1 includes this under Automation and Programmability, where the expected skill is identifying the mechanism that actually satisfies the scenario. The wording usually gives the decisive clue: a protocol number, a route prefix, a control-plane role, a wireless security method, or a management command. Wrong choices either do not match the destination prefix, point to the wrong next hop, or fail to create the required primary or backup route. In a real network, selecting the wrong option would usually produce a failed adjacency, broken client connectivity, insecure management access, or an incorrect forwarding path. The selected answer matches the Cisco behavior and configuration model required by the question, so it is retained as the verified answer for this item.

Configure the no lldp tlv-select-management-address command globally on Cat9K-2. Switching behavior is determined by MAC learning, VLAN membership, trunk state, port security, and EtherChannel negotiation. Cisco CCNA 200-301 v1.1 includes this under Network Access, where the expected skill is identifying the mechanism that actually satisfies the scenario. The wording usually gives the decisive clue: a protocol number, a route prefix, a control-plane role, a wireless security method, or a management command. The incorrect choices either alter the wrong interface behavior or confuse access-layer switching with routing or security services. In a real network, selecting the wrong option would usually produce a failed adjacency, broken client connectivity, insecure management access, or an incorrect forwarding path. The selected answer matches the Cisco behavior and configuration model required by the question, so it is retained as the verified answer for this item.

Option C. The answer follows from normal Cisco device behavior and the operating clue in the scenario. Cisco CCNA 200-301 v1.1 includes this under Security Fundamentals, where the expected skill is identifying the mechanism that actually satisfies the scenario. The wording usually gives the decisive clue: a protocol number, a route prefix, a control-plane role, a wireless security method, or a management command. The other options use adjacent terms, wrong-layer behavior, or configuration that would not produce the requested result. In a real network, selecting the wrong option would usually produce a failed adjacency, broken client connectivity, insecure management access, or an incorrect forwarding path. The selected answer matches the Cisco behavior and configuration model required by the question, so it is retained as the verified answer for this item.

Answer B,E is correct: B. maintain network equipment in a secure location; E. Disable unused or unnecessary ports, interfaces and services. A sound security posture begins with reducing exposed attack surfaces and physically protecting infrastructure. Maintaining network equipment in a secure location prevents unauthorized console access, cable tampering, device theft, and rogue hardware insertion. Disabling unused or unnecessary ports, interfaces, and services reduces the number of places an attacker can connect or the number of services that can be exploited. A cryptographic keychain can be useful for routing-protocol authentication, but it is not a broad posture practice compared with physical protection and surface reduction. Placing internal file and email servers in a DMZ is usually not appropriate because a DMZ is for systems intentionally exposed to less-trusted networks. Cisco CCNA 200-301 v1.1 Security Fundamentals emphasizes these baseline controls because they prevent simple access-layer and management-plane compromises before more advanced controls are even considered.

to provide link redundancy and load balancing. Switching behavior depends on VLAN tagging, trunk negotiation, STP role selection, EtherChannel mode, and whether a protocol is standards-based or Cisco-specific. Cisco CCNA 200-301 v1.1 includes this under Network Access, where the exam expects engineers to recognize the device behavior that actually produces the required outcome. The question is best solved by reading the operational clue rather than choosing a familiar acronym. Incorrect options change existing VLAN reachability, use the wrong negotiation behavior, or apply a feature to the wrong switch function. In a production network, the wrong choice would normally create an outage, leave a management or security gap, or send troubleshooting toward the wrong subsystem. The selected answer is the one that matches the control-plane, data-plane, wireless, security, services, or automation mechanism described in the question. That is why it remains the verified answer for this item.

Cisco CCNA 200-301 v1.1 Network Fundamentals questions of this type test whether each item is matched to the technology that actually performs that role. The reliable method is to classify each term by operating layer, packet behavior, management function, or security purpose before matching it. Several terms in these items are legitimate Cisco networking concepts, but they become wrong when assigned to the wrong protocol or plane. The mapping retained in the document follows that separation: transport behavior is matched to TCP or UDP, wireless or security terms are matched to their mechanisms, and automation items are matched to the correct API or management model. This matters operationally because troubleshooting fails quickly when a forwarding-plane function is treated as a management-plane feature or when a security control is applied to the wrong threat. The shown mapping is therefore retained as the verified response.

Should a monitored port exceeds the maximum administrative value for power, the port is shutdown and err-disabled. Infrastructure services must be identified by their exact function: monitoring, time, address assignment, file transfer, logging, or traffic treatment. Cisco CCNA 200-301 v1.1 includes this under Network Access, where the exam expects engineers to recognize the device behavior that actually produces the required outcome. The question is best solved by reading the operational clue rather than choosing a familiar acronym. The distractors name real services, but those services do not perform the action requested in the prompt. In a production network, the wrong choice would normally create an outage, leave a management or security gap, or send troubleshooting toward the wrong subsystem. The selected answer is the one that matches the control-plane, data-plane, wireless, security, services, or automation mechanism described in the question. That is why it remains the verified answer for this item.

F0/11. Cisco forwarding uses longest-prefix match first, then administrative distance and metric when multiple sources compete. Cisco CCNA 200-301 v1.1 includes this under IP Connectivity, where the expected skill is identifying the mechanism that actually satisfies the scenario. The wording usually gives the decisive clue: a protocol number, a route prefix, a control-plane role, a wireless security method, or a management command. Wrong choices either do not match the destination prefix, point to the wrong next hop, or fail to create the required primary or backup route. In a real network, selecting the wrong option would usually produce a failed adjacency, broken client connectivity, insecure management access, or an incorrect forwarding path. The selected answer matches the Cisco behavior and configuration model required by the question, so it is retained as the verified answer for this item.

Enable Fast Transition and select the FT PSK option.. Wireless operation depends on WLAN identity, AP mode, RF management, client authentication, and controller-based policy enforcement. Cisco CCNA 200-301 v1.1 includes this under Network Access, where the exam expects engineers to recognize the device behavior that actually produces the required outcome. The question is best solved by reading the operational clue rather than choosing a familiar acronym. The distractors confuse WLAN names, authentication, encryption, RF optimization, and controller management functions. In a production network, the wrong choice would normally create an outage, leave a management or security gap, or send troubleshooting toward the wrong subsystem. The selected answer is the one that matches the control-plane, data-plane, wireless, security, services, or automation mechanism described in the question. That is why it remains the verified answer for this item.

traffic shaping. Automation and controller-based networking require separating APIs, management-plane actions, data formats, and centralized control from traditional device-by-device configuration. Cisco CCNA 200-301 v1.1 includes this under IP Services, where the exam expects engineers to recognize the device behavior that actually produces the required outcome. The question is best solved by reading the operational clue rather than choosing a familiar acronym. The wrong options mix northbound and southbound roles, control and data plane functions, or automation outcomes with unrelated technologies. In a production network, the wrong choice would normally create an outage, leave a management or security gap, or send troubleshooting toward the wrong subsystem. The selected answer is the one that matches the control-plane, data-plane, wireless, security, services, or automation mechanism described in the question. That is why it remains the verified answer for this item.

Option C. Switching behavior depends on VLAN tagging, trunk negotiation, STP role selection, EtherChannel mode, and whether a protocol is standards-based or Cisco-specific. Cisco CCNA 200-301 v1.1 includes this under Network Access, where the exam expects engineers to recognize the device behavior that actually produces the required outcome. The question is best solved by reading the operational clue rather than choosing a familiar acronym. Incorrect options change existing VLAN reachability, use the wrong negotiation behavior, or apply a feature to the wrong switch function. In a production network, the wrong choice would normally create an outage, leave a management or security gap, or send troubleshooting toward the wrong subsystem. The selected answer is the one that matches the control-plane, data-plane, wireless, security, services, or automation mechanism described in the question. That is why it remains the verified answer for this item.

Cisco CCNA 200-301 v1.1 Network Fundamentals questions of this type test whether each item is matched to the technology that actually performs that role. The reliable method is to classify each term by operating layer, packet behavior, management function, or security purpose before matching it. Several terms in these items are legitimate Cisco networking concepts, but they become wrong when assigned to the wrong protocol or plane. The mapping retained in the document follows that separation: transport behavior is matched to TCP or UDP, wireless or security terms are matched to their mechanisms, and automation items are matched to the correct API or management model. This matters operationally because troubleshooting fails quickly when a forwarding-plane function is treated as a management-plane feature or when a security control is applied to the wrong threat. The shown mapping is therefore retained as the verified response.

Option C. Cisco forwarding uses longest-prefix match first, then administrative distance and metric when multiple sources compete. Cisco CCNA 200-301 v1.1 includes this under Network Fundamentals, where the expected skill is identifying the mechanism that actually satisfies the scenario. The wording usually gives the decisive clue: a protocol number, a route prefix, a control-plane role, a wireless security method, or a management command. Wrong choices either do not match the destination prefix, point to the wrong next hop, or fail to create the required primary or backup route. In a real network, selecting the wrong option would usually produce a failed adjacency, broken client connectivity, insecure management access, or an incorrect forwarding path. The selected answer matches the Cisco behavior and configuration model required by the question, so it is retained as the verified answer for this item.

Answer B,C is correct: B. A matching permit statement is too high in the access test; C. A matching permit statement is too broadly defined. The answer follows directly from normal Cisco device behavior and the wording of the scenario. Cisco CCNA 200-301 v1.1 includes this under Security Fundamentals, where the exam expects engineers to recognize the device behavior that actually produces the required outcome. The question is best solved by reading the operational clue rather than choosing a familiar acronym. The other choices are either adjacent technologies, wrong-layer functions, or settings that would not produce the stated result. In a production network, the wrong choice would normally create an outage, leave a management or security gap, or send troubleshooting toward the wrong subsystem. The selected answer is the one that matches the control-plane, data-plane, wireless, security, services, or automation mechanism described in the question. That is why it remains the verified answer for this item.

Option A. Switching behavior is determined by MAC learning, VLAN membership, trunk state, port security, and EtherChannel negotiation. Cisco CCNA 200-301 v1.1 includes this under Network Access, where the expected skill is identifying the mechanism that actually satisfies the scenario. The wording usually gives the decisive clue: a protocol number, a route prefix, a control-plane role, a wireless security method, or a management command. The incorrect choices either alter the wrong interface behavior or confuse access-layer switching with routing or security services. In a real network, selecting the wrong option would usually produce a failed adjacency, broken client connectivity, insecure management access, or an incorrect forwarding path. The selected answer matches the Cisco behavior and configuration model required by the question, so it is retained as the verified answer for this item.

ip route 172.21.34.0 255.255.255.128 10.73.65.66. Cisco routers select forwarding paths by longest-prefix match first, then administrative distance and metric when comparable routes compete. Cisco CCNA 200-301 v1.1 includes this under IP Connectivity, where the exam expects engineers to recognize the device behavior that actually produces the required outcome. The question is best solved by reading the operational clue rather than choosing a familiar acronym. The wrong choices either do not match the destination, use the wrong next hop, or fail to provide the intended primary/backup behavior. In a production network, the wrong choice would normally create an outage, leave a management or security gap, or send troubleshooting toward the wrong subsystem. The selected answer is the one that matches the control-plane, data-plane, wireless, security, services, or automation mechanism described in the question. That is why it remains the verified answer for this item.

ipv6 route ::/0 2001:db8:1234:2::1 2. A floating static default route must use the IPv6 default prefix ::/0 and an administrative distance higher than the current preferred default route. A ::/128 route is a host route to the unspecified address and is not a default route. An administrative distance of 1 would be the normal static-route distance and would not behave as a backup to another static default route. Cisco CCNA 200-301 v1.1 IP Connectivity expects candidates to understand both the IPv6 default route syntax and the purpose of the final distance value. The corrected command uses ipv6 route ::/0 toward 2001:db8:1234:2::1 with a higher administrative distance. That keeps the route out of the routing table while the primary default route is valid and installs it only when the primary route fails.

correlates user activity with network events. Automation and controller-based networking require separating APIs, management-plane actions, data formats, and centralized control from traditional device-by-device configuration. Cisco CCNA 200-301 v1.1 includes this under Security Fundamentals, where the exam expects engineers to recognize the device behavior that actually produces the required outcome. The question is best solved by reading the operational clue rather than choosing a familiar acronym. The wrong options mix northbound and southbound roles, control and data plane functions, or automation outcomes with unrelated technologies. In a production network, the wrong choice would normally create an outage, leave a management or security gap, or send troubleshooting toward the wrong subsystem. The selected answer is the one that matches the control-plane, data-plane, wireless, security, services, or automation mechanism described in the question. That is why it remains the verified answer for this item.

Answer A,B is correct: A. WPA2; B. WPA3. CCMP is the AES-based encryption and integrity mechanism associated with modern Wi-Fi security. WPA2 introduced AES-CCMP as the strong replacement for TKIP, and WPA3 continues to use strong AES-based protection while improving authentication with SAE in personal mode. WEP is obsolete and uses RC4, not CCMP. WPA originally used TKIP/MIC as its transitional protection. Wi-Fi 6 is an 802.11ax performance standard, not itself a security protocol. Cisco CCNA 200-301 v1.1 Network Access requires engineers to separate wireless standards from wireless security standards and to distinguish TKIP, CCMP, AES, WEP, WPA2, and WPA3. The original WPA3/WEP answer was wrong because WEP cannot provide CCMP encryption or integrity. The corrected choices are WPA2 and WPA3.

PUT. Automation questions depend on recognizing controllers, APIs, data formats, HTTP methods, and cloud-service characteristics. Cisco CCNA 200-301 v1.1 includes this under Automation and Programmability, where the expected skill is identifying the mechanism that actually satisfies the scenario. The wording usually gives the decisive clue: a protocol number, a route prefix, a control-plane role, a wireless security method, or a management command. The wrong options mix controller functions with data-plane forwarding or confuse API operations with unrelated management terms. In a real network, selecting the wrong option would usually produce a failed adjacency, broken client connectivity, insecure management access, or an incorrect forwarding path. The selected answer matches the Cisco behavior and configuration model required by the question, so it is retained as the verified answer for this item.

Cisco CCNA 200-301 v1.1 Network Fundamentals questions of this type test whether each item is matched to the technology that actually performs that role. The reliable method is to classify each term by operating layer, packet behavior, management function, or security purpose before matching it. Several terms in these items are legitimate Cisco networking concepts, but they become wrong when assigned to the wrong protocol or plane. The mapping retained in the document follows that separation: transport behavior is matched to TCP or UDP, wireless or security terms are matched to their mechanisms, and automation items are matched to the correct API or management model. This matters operationally because troubleshooting fails quickly when a forwarding-plane function is treated as a management-plane feature or when a security control is applied to the wrong threat. The shown mapping is therefore retained as the verified response.

Cisco CCNA 200-301 v1.1 Network Fundamentals questions of this type test whether each item is matched to the technology that actually performs that role. The reliable method is to classify each term by operating layer, packet behavior, management function, or security purpose before matching it. Several terms in these items are legitimate Cisco networking concepts, but they become wrong when assigned to the wrong protocol or plane. The mapping retained in the document follows that separation: transport behavior is matched to TCP or UDP, wireless or security terms are matched to their mechanisms, and automation items are matched to the correct API or management model. This matters operationally because troubleshooting fails quickly when a forwarding-plane function is treated as a management-plane feature or when a security control is applied to the wrong threat. The shown mapping is therefore retained as the verified response.

Option B. OSPF operation depends on area membership, network type, timers, router ID, priority, and whether a DR/BDR election occurs. Cisco CCNA 200-301 v1.1 includes this under IP Connectivity, where the expected skill is identifying the mechanism that actually satisfies the scenario. The wording usually gives the decisive clue: a protocol number, a route prefix, a control-plane role, a wireless security method, or a management command. Incorrect choices either use the wrong OSPF role, omit a required adjacency condition, or apply a setting that does not affect the stated behavior. In a real network, selecting the wrong option would usually produce a failed adjacency, broken client connectivity, insecure management access, or an incorrect forwarding path. The selected answer matches the Cisco behavior and configuration model required by the question, so it is retained as the verified answer for this item.

via 10.0.0.2. Cisco routing logic is deterministic: a router first matches the most specific destination prefix, then uses administrative distance when competing route sources advertise the same prefix, and finally evaluates the protocol metric when multiple paths remain inside the same routing protocol. First-hop redundancy protocols add a separate default-gateway resiliency function for hosts on a LAN. The other choices in this question either point to the wrong route-selection rule, confuse a protocol metric with administrative distance, or apply a Layer 2 concept where a Layer 3 forwarding decision is required. In production, that mistake would create blackholing, asymmetric routing, or a backup path that never activates. Cisco CCNA 200-301 v1.1 tests this because route selection is fundamental to troubleshooting reachability. The selected answer matches the behavior Cisco routers use when forwarding traffic or maintaining gateway redundancy.

username CCUser password NA!2Scc enable password level 5 NA!2$cc. Cisco routing logic is deterministic: a router first matches the most specific destination prefix, then uses administrative distance when competing route sources advertise the same prefix, and finally evaluates the protocol metric when multiple paths remain inside the same routing protocol. First-hop redundancy protocols add a separate default-gateway resiliency function for hosts on a LAN. The other choices in this question either point to the wrong route-selection rule, confuse a protocol metric with administrative distance, or apply a Layer 2 concept where a Layer 3 forwarding decision is required. In production, that mistake would create blackholing, asymmetric routing, or a backup path that never activates. Cisco CCNA 200-301 v1.1 tests this because route selection is fundamental to troubleshooting reachability. The selected answer matches the behavior Cisco routers use when forwarding traffic or maintaining gateway redundancy.

Answer D is the technically correct selection. Virtual machines are operating system instances decoupled from the physical server hardware. The hypervisor presents virtual CPU, memory, disk, and NIC resources so multiple VMs can run on one host. This aligns with Cisco CCNA 200-301 v1.1 because the exam blueprint requires engineers to recognize operational behaviour from configuration symptoms and topology requirements. The VM does not manage host resources itself, and the physical server can run multiple OS instances concurrently through virtualization. Treat the distractors carefully: most are real Cisco terms, but they solve a different problem or operate at a different layer. The selected answer is the one that would be used by an engineer on the device or in the design to produce the outcome stated in the question.

The correct response is D. With default DNS lookup behaviour, Cisco IOS attempts to resolve unrecognized text or hostnames. If a name server is not explicitly configured, the device may try a broadcast-style lookup attempt while translating the entered string. For Cisco CCNA 200-301 v1.1, the important point is the mechanism, not a generic description of the technology. It does not start a ping automatically or ask the user to type an IP address first. When this appears in a network, the symptom normally confirms the answer: the route installed, the state selected, the packet forwarded, the wireless client behaviour, or the management workflow will follow this rule. That is why this answer is the best fit for the scenario and not just a plausible networking term.

Use C for this item. Overlapping Wi-Fi channels cause contention and interference, which reduces wireless performance. Clients and APs sharing overlapping spectrum must wait, retransmit, or deal with corrupted frames. In Cisco CCNA 200-301 v1.1, Network Access questions frequently test the practical boundary between similar features: what the feature does, where it is configured, and what problem it is meant to solve. Overlapping channels do not inherently change SSID visibility or create encryption exposure, but they do degrade throughput and reliability. A clean way to validate the answer is to map the wording of the scenario to the actual device function. If the feature supplies addressing, forwarding, authentication, trunking, route selection, or controller communication, the answer must match that function exactly rather than a nearby protocol name.

Use D for this item. A switch builds its MAC address table from ingress traffic. When a frame enters a port, the switch records the source MAC address and the receiving interface in the table. In Cisco CCNA 200-301 v1.1, Network Access questions frequently test the practical boundary between similar features: what the feature does, where it is configured, and what problem it is meant to solve. DTP and VTP serve trunk negotiation and VLAN database functions, and egress traffic is not how the switch learns the source location. A clean way to validate the answer is to map the wording of the scenario to the actual device function. If the feature supplies addressing, forwarding, authentication, trunking, route selection, or controller communication, the answer must match that function exactly rather than a nearby protocol name.

A Layer 2 switch floods a frame with an unknown destination MAC address out all ports in the same VLAN except the port where the frame entered. That behavior is not a fault; it is normal Ethernet switching. The switch learns from the source MAC address of incoming frames, not from the unknown destination. If the destination MAC is already in the MAC address table, the frame is forwarded only out the associated port. If it is missing, the switch must treat the traffic as unknown unicast and flood within the VLAN so the destination has a chance to receive it. The switch does not drop the frame just because the destination is unknown, and it does not send it only to the CPU for learning. Cisco CCNA v1.1 Network Access covers switching fundamentals, including MAC learning, forwarding, filtering, and flooding. The decisive detail is the VLAN boundary: flooding is limited to the same VLAN and excludes the ingress port.

When configuring VLAN trunking between a Cisco switch and a third-party switch, use IEEE 802.1Q. It is the open standard for VLAN tagging on Ethernet trunks. Cisco ISL was Cisco-proprietary and is obsolete on modern platforms. IEEE 802.1p relates to Class of Service marking inside the Ethernet header, not trunk encapsulation for interswitch VLAN transport. DSCP is an IP-layer QoS marking, not a Layer 2 VLAN trunking method. Cisco CCNA 200-301 v1.1 Network Access expects candidates to know that 802.1Q inserts a VLAN tag so multiple VLANs can traverse one physical trunk link. The native VLAN is carried untagged by default, while other VLANs are tagged. In multivendor networks, standards-based encapsulation is mandatory. Therefore, the action is to configure IEEE 802.1Q. The correct answer is B.

Cisco WLC WPA2-PSK configuration supports a pre-shared key entered either as ASCII text or as a hexadecimal key. ASCII is the human-readable passphrase format administrators normally use, while hexadecimal is the raw key representation. Base64, binary, and decimal are not the WLC PSK input formats for this configuration task. This question is easy to miss because it is asking about the selectable key formats in the Cisco Wireless LAN Controller GUI, not about the WPA2 cipher itself. Under CCNA 200-301 v1.1 Network Access, candidates are expected to recognize basic WLAN security configuration elements, including WPA2, PSK, SSID, and wireless controller settings. In practice, using ASCII simplifies administration, while hexadecimal is useful when a precise key value must be supplied. The verified choices are therefore A and E. Reference: Cisco Wireless LAN Controller WLAN security configuration guidance for WPA/WPA2 pre-shared keys.