200-301 Cisco Certified Network Associate Free Practice Exam Questions (2026 Updated)

Use D for this item. HSRP provides first-hop redundancy by giving a group of routers a shared virtual IP address and virtual MAC address. Hosts use the virtual IP as their default gateway; the active router forwards traffic and the standby router takes over if the active fails. In Cisco CCNA 200-301 v1.1, IP Connectivity questions frequently test the practical boundary between similar features: what the feature does, where it is configured, and what problem it is meant to solve. HSRP is not route load balancing, Layer 2 flooding, or per-packet distribution across routed links. A clean way to validate the answer is to map the wording of the scenario to the actual device function. If the feature supplies addressing, forwarding, authentication, trunking, route selection, or controller communication, the answer must match that function exactly rather than a nearby protocol name.

The matching is based on identifying the attack layer and then choosing the control that blocks that behavior. Dynamic ARP Inspection validates ARP messages against trusted bindings and is used against ARP spoofing or poisoning, a common man-in-the-middle technique on Layer 2 segments. DHCP snooping builds the trusted binding table and blocks unauthorized DHCP server behavior. Port security limits which MAC addresses can use a switchport, reducing exposure to MAC flooding or unauthorized endpoint attachment. Changing the native VLAN or using proper trunk controls helps mitigate VLAN hopping and double-tagging attacks, because the attacker relies on trunk/native VLAN behavior to cross VLAN boundaries. Cisco CCNA v1.1 Network Access includes switch security features such as DHCP snooping, DAI, and port security. The practical approach is not to memorize coordinates in a drag-and-drop map. Identify the malicious mechanism first, then map it to the feature that checks or constrains that exact mechanism.

In this attack, the attacking computer generates frames with two 802.1Q tags. The first tag matches the native VLAN of the trunk port (VLAN 10 in this case), and the second matches the VLAN of a host it wants to attack (VLAN 20).

Pure IPsec protects unicast IP traffic well, but it does not natively carry multicast or broadcast traffic across sites in the way routing protocols and some legacy services may require. GRE can encapsulate many traffic types, including multicast, inside a unicast tunnel. When GRE is combined with IPsec, GRE provides the tunnel that can carry multicast traffic and IPsec provides encryption and integrity protection for the GRE packets. This is why GRE over IPsec is a common design when encrypted site-to-site connectivity must also support routing protocol hellos or multicast-dependent control traffic. ISATAP is an IPv6 transition mechanism, not the answer for encrypted multicast between remote sites. GRE alone carries the traffic but does not encrypt it. Cisco CCNA 200-301 v1.1 Security Fundamentals expects candidates to understand the division of labor: GRE encapsulates; IPsec secures. Therefore, the mechanism that carries multicast between remote sites and supports encryption is GRE over IPsec.

Cisco syslog severity level 5 is notifications, often described as normal but significant operational events. A routing instance flapping fits that category because the device is not necessarily failing completely, but the event is meaningful enough that operations staff should see it. Debug output belongs to severity 7, not notice. An ARP inspection failure is typically treated as a security or error condition, not a routine notification. A device restart can also produce level-5 messages on some Cisco platforms, but in this question set the better match is the routing instance flap because it represents an operational state change that should be logged without implying a critical fault. CCNA v1.1 IP Services includes syslog and device-management behavior, so the exam target is recognizing severity meanings rather than memorizing one message string. The safest interpretation is: notice-level messages report significant but noncritical state changes. A route or routing instance flap is exactly that kind of significant network event.

The correct response is D. The listed choice that matches FHRP operation is the exchange of multicast hello messages between routers. Those hello messages let routers negotiate active, standby, master, or backup roles for a shared default-gateway function. For Cisco CCNA 200-301 v1.1, the important point is the mechanism, not a generic description of the technology. The better conceptual purpose is gateway redundancy, but among these options the multicast hello behaviour is the FHRP-specific answer. When this appears in a network, the symptom normally confirms the answer: the route installed, the state selected, the packet forwarded, the wireless client behaviour, or the management workflow will follow this rule. That is why this answer is the best fit for the scenario and not just a plausible networking term.

To avoid co-channel congestion in the 2.4-GHz band, adjacent access points should use different nonoverlapping channels. In many regulatory domains, the standard 2.4-GHz nonoverlapping channel plan is 1, 6, and 11. Using overlapping channels causes adjacent-channel interference, while using the same channel nearby creates co-channel contention where devices must wait longer to transmit. A single nonoverlapping channel across multiple adjacent APs is still a contention problem. Cisco CCNA 200-301 v1.1 Network Fundamentals includes wireless principles such as RF bands, channels, overlap, and basic design. The goal is not simply to maximize signal strength; it is to provide coverage while minimizing contention and interference. In practice, engineers plan cell size, transmit power, and channel reuse together. For this question, the recommended approach is different nonoverlapping channels. The correct answer is A.

Use A for this item. A switch added to an existing VTP domain must not have a higher revision number than the production database. A lower revision number prevents the old switch from overwriting current VLAN information. In Cisco CCNA 200-301 v1.1, Network Access questions frequently test the practical boundary between similar features: what the feature does, where it is configured, and what problem it is meant to solve. Dynamic trunking settings do not protect the VLAN database, and a higher revision number is exactly the dangerous condition. A clean way to validate the answer is to map the wording of the scenario to the actual device function. If the feature supplies addressing, forwarding, authentication, trunking, route selection, or controller communication, the answer must match that function exactly rather than a nearby protocol name.

The correct response is D. To send CDP information only toward Router C, CDP must remain enabled on the interface facing C and be disabled on the other relevant interfaces. CDP is a Cisco Layer 2 neighbor discovery protocol, so interface-level control determines which neighbors receive advertisements. For Cisco CCNA 200-301 v1.1, the important point is the mechanism, not a generic description of the technology. A global shutdown would stop CDP everywhere, and clearing the table would not change future advertisements. When this appears in a network, the symptom normally confirms the answer: the route installed, the state selected, the packet forwarded, the wireless client behaviour, or the management workflow will follow this rule. That is why this answer is the best fit for the scenario and not just a plausible networking term.

In a two-tier campus design, the core and distribution functions are collapsed into one layer. That collapsed core provides aggregation, Layer 3 boundaries, routing between access-layer blocks, and policy enforcement that would otherwise sit at the distribution layer. The access layer attaches users and endpoints; it is not the collapsed core ' s role. Marking interesting traffic can occur as part of QoS policy, but it is not the defining architectural function. Applying security policies may happen in some designs, but the answer that best describes collapsed-core responsibility is enforcing routing policies. Cisco CCNA 200-301 v1.1 Network Fundamentals expects candidates to compare two-tier and three-tier architectures. In small and medium campus networks, a collapsed core reduces complexity by combining distribution and core into the same devices. The key function in the answer set is routing-policy enforcement. Therefore, A is the best answer.

When two routing protocols advertise a route to the same destination, the router first compares administrative distance. Administrative distance is Cisco IOS’s trust value for the source of routing information. A lower AD is preferred over a higher AD, so an EIGRP internal route with AD 90 is preferred over an OSPF route with AD 110, and both are preferred over a RIP route with AD 120. Metrics are compared only among routes learned from the same routing protocol, not across different protocols. Hop count is a specific metric used by RIP, and DUAL is the algorithm used by EIGRP, not the cross-protocol decision mechanism. This is a core CCNA 200-301 v1.1 IP Connectivity rule: longest prefix match chooses the most specific route first, and administrative distance decides between different routing information sources for the same prefix. Therefore the verified answer is C. Reference: Cisco IOS route selection and administrative distance behavior.

Private IPv4 address ranges allow different organizations to reuse the same internal address space without creating global internet conflicts. RFC 1918 reserves 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 for private use. These addresses are not meant to be routed on the public internet. That reuse is one reason enterprises, homes, labs, and cloud networks can all use addresses such as 10.1.1.0 internally. When private hosts need internet access, NAT or another translation design is normally required. Cisco CCNA 200-301 v1.1 includes private addressing and NAT under IP Services because these concepts appear constantly in enterprise networks. The wrong answers imply that private addressing provides direct external reachability or removes the need for NAT, which is exactly backwards. Private addressing conserves public IPv4 space and avoids the need for every internal host to consume a globally unique address. Therefore, A correctly states the function.

The correct response is C and E. A Cisco router acting as a DHCP server must have a DHCP address pool and can use manual bindings when specific addresses must be reserved. The pool defines the scope of addresses and options that clients receive; bindings tie a known client identifier or MAC-related value to an address when deterministic assignment is required. For Cisco CCNA 200-301 v1.1, the important point is the mechanism, not a generic description of the technology. Relay-agent information and smart-relay support relay behaviour, and a database agent is optional persistence rather than the core server configuration being tested. When this appears in a network, the symptom normally confirms the answer: the route installed, the state selected, the packet forwarded, the wireless client behaviour, or the management workflow will follow this rule. That is why this answer is the best fit for the scenario and not just a plausible networking term.

The verified answer is C. 802.1X provides identity-based access control at the access layer. A supplicant authenticates through the switch or AP to an authentication server before receiving network access. Cisco CCNA 200-301 v1.1 places this skill in Security Fundamentals, where the exam expects a working understanding of how the feature behaves on real Cisco networks, not just a memorized command. DAI, DHCP snooping, and native VLAN changes protect Layer 2 infrastructure but do not authenticate user or device identity in the same way. In production, this distinction matters because a misapplied command or design choice usually creates an outage, a security gap, or unnecessary troubleshooting noise. The correct choice matches the control-plane, data-plane, wireless, security, or services behaviour described in the scenario and should be preferred over options that merely sound related.

The verified answer is D. Server virtualization allows multiple operating systems to run independently on one physical host. A hypervisor abstracts CPU, memory, storage, and network resources so each VM behaves like a separate machine. Cisco CCNA 200-301 v1.1 places this skill in Network Fundamentals, where the exam expects a working understanding of how the feature behaves on real Cisco networks, not just a memorized command. VRF and virtual device contexts virtualize network functions, not general-purpose operating systems on a host computer. In production, this distinction matters because a misapplied command or design choice usually creates an outage, a security gap, or unnecessary troubleshooting noise. The correct choice matches the control-plane, data-plane, wireless, security, or services behaviour described in the scenario and should be preferred over options that merely sound related.

A firewall is the device class associated with stateful inspection. Stateful inspection tracks active sessions and uses connection state when deciding whether to permit return traffic or block unexpected packets. For example, if an internal host initiates a TCP session, the firewall can allow matching return traffic because it belongs to a known connection. A Layer 2 switch forwards frames based on MAC addresses and does not inspect transport-layer session state. An access point bridges wireless clients to the wired network, and a wireless controller manages AP behavior and WLAN policy, but neither is the generic stateful-inspection answer in this question. Cisco CCNA 200-301 v1.1 Security Fundamentals requires candidates to know common security device roles: firewall, WSA, AAA server, VPN headend, and access-layer controls. The key phrase is stateful inspection of traffic. That points directly to a firewall. The correct answer is A.

The correct response is C. A firewall checks packets against security policy and, in stateful designs, connection state. It determines whether traffic is legitimate before allowing it between security zones or networks. For Cisco CCNA 200-301 v1.1, the important point is the mechanism, not a generic description of the technology. Layer 2 switches forward frames, load balancers distribute sessions, and LAN controllers manage wireless infrastructure. When this appears in a network, the symptom normally confirms the answer: the route installed, the state selected, the packet forwarded, the wireless client behaviour, or the management workflow will follow this rule. That is why this answer is the best fit for the scenario and not just a plausible networking term.

Answer D is the technically correct selection. Badge readers on data-center doors are physical access control. They regulate who can enter protected spaces based on identity, role, and authorization. This aligns with Cisco CCNA 200-301 v1.1 because the exam blueprint requires engineers to recognize operational behaviour from configuration symptoms and topology requirements. RBAC can influence the policy, biometrics can be a factor, and MFA can strengthen authentication, but the control described is physical facility access. Treat the distractors carefully: most are real Cisco terms, but they solve a different problem or operate at a different layer. The selected answer is the one that would be used by an engineer on the device or in the design to produce the outcome stated in the question.

The correct response is A. Wireless LAN controllers centralize enterprise access point management. A WLC pushes WLAN configuration, security policy, RF parameters, and operational control to lightweight APs so administrators do not configure each AP independently. For Cisco CCNA 200-301 v1.1, the important point is the mechanism, not a generic description of the technology. Standalone support, perimeter defense, and device-login authentication are not the primary role of the wireless controller in this scenario. When this appears in a network, the symptom normally confirms the answer: the route installed, the state selected, the packet forwarded, the wireless client behaviour, or the management workflow will follow this rule. That is why this answer is the best fit for the scenario and not just a plausible networking term.

A DHCP client is a host configured to request IP addressing information automatically. It sends DHCP messages to obtain an address lease and related options such as subnet mask, default gateway, DNS server, and lease duration. The server is the device that owns the address pool and assigns addresses. A workstation that requests a domain name for an IP address is using DNS behavior, not DHCP client behavior. A router can relay DHCP messages or host DHCP pools, but it is not described as a DHCP client unless its own interface is configured to obtain an address dynamically. Cisco CCNA 200-301 v1.1 IP Services expects candidates to separate DHCP client, DHCP server, and DHCP relay functions. In the DHCP exchange, the client initiates discovery because it needs configuration. Therefore, the correct definition is a host that is configured to request an IP address automatically.

The global command service password-encryption prevents supported plain-text passwords from being displayed in clear text in the running configuration. After the command is enabled, passwords configured under lines, usernames using the password keyword, and similar legacy password fields are obfuscated with Cisco Type 7 encoding. This is not strong cryptographic protection, but it does stop casual viewing of plain text during show running-config. The enable secret command protects the privileged EXEC password with a stronger hash, but it does not encrypt all plain-text passwords in the configuration. The enable password command creates a less secure privileged password, and the username Cisco password encrypt syntax is not the correct IOS command. CCNA 200-301 v1.1 Security Fundamentals expects candidates to know basic device hardening commands and the difference between enable secret and service password-encryption. The verified answer is B. Reference: Cisco IOS password encryption and secure device-management guidance.

For voice over WLAN, the WLC QoS profile should be Platinum. Cisco wireless QoS profiles map traffic treatment to application sensitivity: Platinum is intended for voice, Gold for video, Silver for best effort, and Bronze for background traffic. Voice is extremely sensitive to delay, jitter, and packet loss, so it requires the highest WLAN QoS treatment available in the controller GUI. Selecting Silver would treat the WLAN like normal best-effort data, which is unacceptable for real-time voice. Gold is better than best effort, but Cisco positions it for video rather than voice. Bronze deliberately gives low-priority treatment to background traffic. This is an IP Services topic because QoS behavior determines how network devices classify, queue, and prioritize traffic. In a CCNA v1.1 context, do not overthink the wireless GUI wording: when the application is voice, choose the controller profile explicitly designed for voice. That profile is Platinum.

The verified answer is A. The default-router command in a Cisco DHCP pool supplies the default gateway option to DHCP clients. Clients receive that address as the router to use for destinations outside their local subnet. Cisco CCNA 200-301 v1.1 places this skill in IP Services, where the exam expects a working understanding of how the feature behaves on real Cisco networks, not just a memorized command. default-gateway is used differently on some switches, ip helper-address relays DHCP, and dns-server supplies name-resolution servers. In production, this distinction matters because a misapplied command or design choice usually creates an outage, a security gap, or unnecessary troubleshooting noise. The correct choice matches the control-plane, data-plane, wireless, security, or services behaviour described in the scenario and should be preferred over options that merely sound related.

Use A for this item. In a hub-and-spoke WAN, spoke sites communicate through a central hub rather than direct spoke-to-spoke links. This structure lets the hub enforce routing, policy, inspection, and access restrictions between subscriber or branch sites. In Cisco CCNA 200-301 v1.1, Network Fundamentals questions frequently test the practical boundary between similar features: what the feature does, where it is configured, and what problem it is meant to solve. The topology does not inherently provide direct connections between every subscriber; that is closer to full mesh. A clean way to validate the answer is to map the wording of the scenario to the actual device function. If the feature supplies addressing, forwarding, authentication, trunking, route selection, or controller communication, the answer must match that function exactly rather than a nearby protocol name.

Cisco CCNA 200-301 v1.1 expects these items to be matched by function, protocol layer, scope, and operational role rather than by keyword similarity. The reliable method is to identify what each item actually does in a Cisco network: whether it forwards traffic, manages a device, secures access, assigns addressing, identifies a resource, or carries control information. Distractors in this format are usually valid networking terms placed under the wrong category. That is why the retained mapping is important; it keeps protocol behavior, device function, and service purpose aligned. In a real network, mixing these concepts leads to broken routing, failed wireless access, insecure management, or automation calls aimed at the wrong interface. The mapping shown in the document is therefore retained as the Cisco-consistent answer for this item.

hardware resources. Cisco wireless design separates RF behavior, client authentication, encryption, AP operating mode, and controller management. A WLC centralizes WLAN configuration and AP control, while lightweight APs use CAPWAP to register and exchange control/data information with the controller. Security choices such as WPA2/AES and WPA3/SAE are not interchangeable with older mechanisms such as WEP, TKIP, or RC4. RF questions also depend on channel planning: adjacent cells should avoid overlapping channels, and 5-GHz preference features reduce congestion in the 2.4-GHz band. The incorrect options generally confuse AP mode, authentication, encryption, or controller responsibilities. Cisco CCNA 200-301 v1.1 includes these items because wireless failures often come from using the right-looking feature in the wrong part of the WLAN design. The selected answer is the Cisco-consistent configuration or behavior for this wireless scenario.

Answer B,E is correct: B. Select WPA+WPA2 on Layer 2 Security; E. Select 802.1X from under Authentication Key Management. Cisco forwarding uses longest-prefix match first, then administrative distance and metric when multiple sources compete. Cisco CCNA 200-301 v1.1 includes this under Network Access, where the expected skill is identifying the mechanism that actually satisfies the scenario. The wording usually gives the decisive clue: a protocol number, a route prefix, a control-plane role, a wireless security method, or a management command. Wrong choices either do not match the destination prefix, point to the wrong next hop, or fail to create the required primary or backup route. In a real network, selecting the wrong option would usually produce a failed adjacency, broken client connectivity, insecure management access, or an incorrect forwarding path. The selected answer matches the Cisco behavior and configuration model required by the question, so it is retained as the verified answer for this item.

10.56.0.1. Cisco forwarding uses longest-prefix match first, then administrative distance and metric when multiple sources compete. Cisco CCNA 200-301 v1.1 includes this under Network Access, where the expected skill is identifying the mechanism that actually satisfies the scenario. The wording usually gives the decisive clue: a protocol number, a route prefix, a control-plane role, a wireless security method, or a management command. Wrong choices either do not match the destination prefix, point to the wrong next hop, or fail to create the required primary or backup route. In a real network, selecting the wrong option would usually produce a failed adjacency, broken client connectivity, insecure management access, or an incorrect forwarding path. The selected answer matches the Cisco behavior and configuration model required by the question, so it is retained as the verified answer for this item.

Option D. OSPF operation depends on area membership, network type, timers, router ID, priority, and whether a DR/BDR election occurs. Cisco CCNA 200-301 v1.1 includes this under IP Connectivity, where the expected skill is identifying the mechanism that actually satisfies the scenario. The wording usually gives the decisive clue: a protocol number, a route prefix, a control-plane role, a wireless security method, or a management command. Incorrect choices either use the wrong OSPF role, omit a required adjacency condition, or apply a setting that does not affect the stated behavior. In a real network, selecting the wrong option would usually produce a failed adjacency, broken client connectivity, insecure management access, or an incorrect forwarding path. The selected answer matches the Cisco behavior and configuration model required by the question, so it is retained as the verified answer for this item.

Cisco CCNA 200-301 v1.1 Network Access questions of this type test whether each protocol, component, address type, or management concept is matched to its correct operating role. The safe method is to classify every item by function: what it does, where it operates, and what problem it solves. Several distractors are usually valid networking terms, but they belong to a different layer or a different operational workflow. The shown mapping keeps those boundaries straight and avoids assigning a feature to the wrong technology. In practice, this same skill is required when troubleshooting because confusing a management-plane function with a forwarding-plane function, or a wireless security feature with an authentication feature, leads to incorrect fixes. The mapping shown in the file is therefore retained and explained as the verified selection.

192.168.0.4. Cisco forwarding uses longest-prefix match first, then administrative distance and metric when multiple sources compete. Cisco CCNA 200-301 v1.1 includes this under IP Services, where the expected skill is identifying the mechanism that actually satisfies the scenario. The wording usually gives the decisive clue: a protocol number, a route prefix, a control-plane role, a wireless security method, or a management command. Wrong choices either do not match the destination prefix, point to the wrong next hop, or fail to create the required primary or backup route. In a real network, selecting the wrong option would usually produce a failed adjacency, broken client connectivity, insecure management access, or an incorrect forwarding path. The selected answer matches the Cisco behavior and configuration model required by the question, so it is retained as the verified answer for this item.

Answer B,C is correct: B. RSA token; C. CA that grants certificates. Security fundamentals require distinguishing identity, authorization, accounting, encryption, inspection, and physical protection. Cisco CCNA 200-301 v1.1 includes this under Security Fundamentals, where the exam expects engineers to recognize the device behavior that actually produces the required outcome. The question is best solved by reading the operational clue rather than choosing a familiar acronym. The incorrect choices apply a security term in the wrong control category or protect a different part of the system. In a production network, the wrong choice would normally create an outage, leave a management or security gap, or send troubleshooting toward the wrong subsystem. The selected answer is the one that matches the control-plane, data-plane, wireless, security, services, or automation mechanism described in the question. That is why it remains the verified answer for this item.

ipv6 address 2001:DB8:0:1:C601:42FF:FE0F:7/64. Cisco routers select forwarding paths by longest-prefix match first, then administrative distance and metric when comparable routes compete. Cisco CCNA 200-301 v1.1 includes this under IP Connectivity, where the exam expects engineers to recognize the device behavior that actually produces the required outcome. The question is best solved by reading the operational clue rather than choosing a familiar acronym. The wrong choices either do not match the destination, use the wrong next hop, or fail to provide the intended primary/backup behavior. In a production network, the wrong choice would normally create an outage, leave a management or security gap, or send troubleshooting toward the wrong subsystem. The selected answer is the one that matches the control-plane, data-plane, wireless, security, services, or automation mechanism described in the question. That is why it remains the verified answer for this item.

Cisco CCNA 200-301 v1.1 Network Fundamentals questions of this type test whether each item is matched to the technology that actually performs that role. The reliable method is to classify each term by operating layer, packet behavior, management function, or security purpose before matching it. Several terms in these items are legitimate Cisco networking concepts, but they become wrong when assigned to the wrong protocol or plane. The mapping retained in the document follows that separation: transport behavior is matched to TCP or UDP, wireless or security terms are matched to their mechanisms, and automation items are matched to the correct API or management model. This matters operationally because troubleshooting fails quickly when a forwarding-plane function is treated as a management-plane feature or when a security control is applied to the wrong threat. The shown mapping is therefore retained as the verified response.

Router2(config)#ntp master 4. If Router1 is configured as an NTP client using the ntp server command, Router2 must provide time as an NTP server. On Cisco IOS, the command ntp master with an optional stratum value configures a router to act as an authoritative NTP source for other devices. The command ntp server points a device toward another time source; it does not make that device the server for Router1. Cisco CCNA 200-301 v1.1 IP Services requires candidates to separate NTP client configuration from NTP server behavior. In this scenario, Router1 already references 192.168.0.3 as its time source. Router2 must therefore be configured as the local master clock, and stratum 4 is a valid configured stratum. The correct configuration is ntp master 4.

Add either the ip nat {inside|outside} command under both interfaces.. IP services must be selected by their exact operational role: addressing, translation, time, monitoring, logging, redundancy, or traffic treatment. Cisco CCNA 200-301 v1.1 includes this under IP Services, where the expected skill is identifying the mechanism that actually satisfies the scenario. The wording usually gives the decisive clue: a protocol number, a route prefix, a control-plane role, a wireless security method, or a management command. The wrong options name real services or commands, but they solve a different infrastructure problem. In a real network, selecting the wrong option would usually produce a failed adjacency, broken client connectivity, insecure management access, or an incorrect forwarding path. The selected answer matches the Cisco behavior and configuration model required by the question, so it is retained as the verified answer for this item.

switchport trunk allowed vlan add 104. The keyword add appends a VLAN to the existing allowed VLAN list without replacing the current list. That is the critical detail in the prompt: the engineer must insert the new VLAN without modifying anything previously configured. A command that specifies only VLAN 104 replaces the existing allowed list with VLAN 104, which can interrupt traffic for existing VLANs. The all option allows every VLAN and changes the policy more broadly than requested. Cisco CCNA 200-301 v1.1 Network Access expects engineers to understand the operational difference between setting a trunk allowed list and adding to it. On production trunks, using the wrong command can remove active VLANs and create an outage. The safe command is switchport trunk allowed vlan add 104.

Option B. Cisco routers select forwarding paths by longest-prefix match first, then administrative distance and metric when comparable routes compete. Cisco CCNA 200-301 v1.1 includes this under Security Fundamentals, where the exam expects engineers to recognize the device behavior that actually produces the required outcome. The question is best solved by reading the operational clue rather than choosing a familiar acronym. The wrong choices either do not match the destination, use the wrong next hop, or fail to provide the intended primary/backup behavior. In a production network, the wrong choice would normally create an outage, leave a management or security gap, or send troubleshooting toward the wrong subsystem. The selected answer is the one that matches the control-plane, data-plane, wireless, security, services, or automation mechanism described in the question. That is why it remains the verified answer for this item.

Trust the IP phone markings on SW1 and mark traffic entering SW2 at SW2.. IP services must be selected by their exact operational role: addressing, translation, time, monitoring, logging, redundancy, or traffic treatment. Cisco CCNA 200-301 v1.1 includes this under IP Services, where the expected skill is identifying the mechanism that actually satisfies the scenario. The wording usually gives the decisive clue: a protocol number, a route prefix, a control-plane role, a wireless security method, or a management command. The wrong options name real services or commands, but they solve a different infrastructure problem. In a real network, selecting the wrong option would usually produce a failed adjacency, broken client connectivity, insecure management access, or an incorrect forwarding path. The selected answer matches the Cisco behavior and configuration model required by the question, so it is retained as the verified answer for this item.

Cisco CCNA 200-301 v1.1 Network Fundamentals questions of this type test whether each item is matched to the technology that actually performs that role. The reliable method is to classify each term by operating layer, packet behavior, management function, or security purpose before matching it. Several terms in these items are legitimate Cisco networking concepts, but they become wrong when assigned to the wrong protocol or plane. The mapping retained in the document follows that separation: transport behavior is matched to TCP or UDP, wireless or security terms are matched to their mechanisms, and automation items are matched to the correct API or management model. This matters operationally because troubleshooting fails quickly when a forwarding-plane function is treated as a management-plane feature or when a security control is applied to the wrong threat. The shown mapping is therefore retained as the verified response.