200-301 Cisco Certified Network Associate Free Practice Exam Questions (2026 Updated)

router ospf 120network 10.120.10.0 255.255.255.0 area 0ip route 10.120.10.0 255.255.255.0 fa0/1. Cisco routing logic is deterministic: a router first matches the most specific destination prefix, then uses administrative distance when competing route sources advertise the same prefix, and finally evaluates the protocol metric when multiple paths remain inside the same routing protocol. First-hop redundancy protocols add a separate default-gateway resiliency function for hosts on a LAN. The other choices in this question either point to the wrong route-selection rule, confuse a protocol metric with administrative distance, or apply a Layer 2 concept where a Layer 3 forwarding decision is required. In production, that mistake would create blackholing, asymmetric routing, or a backup path that never activates. Cisco CCNA 200-301 v1.1 tests this because route selection is fundamental to troubleshooting reachability. The selected answer matches the behavior Cisco routers use when forwarding traffic or maintaining gateway redundancy.

R2# configure terminal

R2(config)# interface Ethernet0/0

R2(config-if)# ip ospf priority 255

R2(config-if)# exit

R2(config)# interface Ethernet0/1

R2(config-if)# ip ospf priority 255

R2(config-if)# exit

R2(config)# router ospf 30

R2(config-router)# router-id 10.22.22.22

R2(config-router)# network 10.0.12.0 0.0.0.3 area 0

R2(config-router)# network 10.0.23.0 0.0.0.15 area 0

R2(config-router)# end

R2# copy running-config startup-config

Verification commands:

R2# show ip ospf neighbor

R2# show ip ospf interface Ethernet0/0

R2# show ip ospf interface Ethernet0/1

R2# show ip protocols

The router ospf 30 command creates the locally significant OSPF process requested by the task. The explicit router-id 10.22.22.22 command prevents R2 from dynamically selecting another active interface address as its router ID. The /30 network requires wildcard mask 0.0.0.3, while the /28 network requires 0.0.0.15; placing both prefixes in area 0 enables OSPF on R2’s links toward R1 and R3 and permits neighbor formation when the remaining OSPF parameters match.

The interface command ip ospf priority 255 gives R2 the maximum OSPF interface priority on both broadcast segments. This makes R2 the strongest DR candidate. OSPF DR elections are non-preemptive, so if a DR election has already completed, the election must be restarted by clearing the relevant OSPF processes or resetting the affected interfaces. Cisco documents that OSPF router IDs identify OSPF instances, while the DR and BDR reduce flooding on broadcast networks; OSPF process numbers do not have to match between neighboring routers.

SW-1

SW-1# configure terminal

SW-1(config)# interface Ethernet0/0

SW-1(config-if)# switchport trunk allowed vlan 5,6

SW-1(config-if)# exit

SW-1(config)# interface Ethernet0/1

SW-1(config-if)# switchport trunk native vlan 77

SW-1(config-if)# end

SW-1# copy running-config startup-config

SW-2

SW-2# configure terminal

SW-2(config)# interface Ethernet0/1

SW-2(config-if)# switchport trunk native vlan 77

SW-2(config-if)# exit

SW-2(config)# interface Ethernet0/2

SW-2(config-if)# switchport trunk allowed vlan 6

SW-2(config-if)# end

SW-2# copy running-config startup-config

SW-3

SW-3# configure terminal

SW-3(config)# interface range Ethernet0/0 - 1

SW-3(config-if-range)# channel-group 34 mode active

SW-3(config-if-range)# end

SW-3# copy running-config startup-config

SW-4

SW-4# configure terminal

SW-4(config)# interface range Ethernet0/0 - 1

SW-4(config-if-range)# channel-group 34 mode passive

SW-4(config-if-range)# end

SW-4# copy running-config startup-config

Verification commands:

SW-1# show interfaces trunk

SW-2# show interfaces trunk

SW-3# show etherchannel summary

SW-4# show etherchannel summary

SW-3# show interfaces port-channel 34

SW-4# show interfaces port-channel 34

The command switchport trunk allowed vlan 5,6 replaces the default allowed-VLAN list on SW-1 Ethernet0/0 so that only VLANs 5 and 6 can cross that trunk. The same command with VLAN 6 restricts SW-2 Ethernet0/2 to VLAN 6. Cisco documents that all VLANs are permitted on a trunk by default and that switchport trunk allowed vlan vlan-list defines the permitted list. The native VLAN must match at both ends of an 802.1Q trunk, so VLAN 77 is configured on Ethernet0/1 of both SW-1 and SW-2.

For LACP, active initiates negotiation and passive only responds. Therefore, SW-3 must use channel-group 34 mode active, while SW-4 must use channel-group 34 mode passive. Cisco confirms that active-to-passive forms an EtherChannel, whereas passive-to-passive does not. Because the physical interfaces are already identically configured as trunks, no trunk commands should be replaced during channel creation. The channel-group command creates and binds the physical members to logical Port-Channel 34.

Answer as below configuration:

on R1

conf terminal

interface Loopback0

ip address 10.10.1.1 255.255.255.255

!

interface Loopback1

ip address 192.168.1.1 255.255.255.0

!

interface Ethernet0/0

no shut

ip address 10.10.12.1 255.255.255.0

ip ospf 1 area 0

duplex auto

!

interface Ethernet0/1

no shut

ip address 10.10.13.1 255.255.255.0

ip ospf 1 area 0

duplex auto

!

router ospf 1

router-id 10.10.12.1

network 10.10.1.1 0.0.0.0 area 0

network 192.168.1.0 0.0.0.255 area 0

!

copy run star

---------------------------------------

On R2

conf terminal

interface Loopback0

ip address 10.10.2.2 255.255.255.255

!

interface Loopback1

ip address 192.168.2.2 255.255.255.0

!

interface Ethernet0/0

no shut

ip address 10.10.12.2 255.255.255.0

ip ospf priority 255

ip ospf 1 area 0

duplex auto

!

interface Ethernet0/2

no shut

ip address 10.10.23.2 255.255.255.0

ip ospf priority 255

ip ospf 1 area 0

duplex auto

!

router ospf 1

network 10.10.2.2 0.0.0.0 area 0

network 192.168.2.0 0.0.0.255 area 0

!

copy runs start

-----------------------

On R3

conf ter

interface Loopback0

ip address 10.10.3.3 255.255.255.255

!

interface Loopback1

ip address 192.168.3.3 255.255.255.0

!

interface Ethernet0/1

no shut

ip address 10.10.13.3 255.255.255.0

ip ospf 1 area 0

duplex auto

!

interface Ethernet0/2

no shut

ip address 10.10.23.3 255.255.255.0

ip ospf 1 area 0

duplex auto

!

router ospf 1

network 10.10.3.3 0.0.0.0 area 0

network 192.168.3.0 0.0.0.255 area 0

!

copy run start

!

To configure static routing on R1 to ensure that it prefers the path through R2 to reach only PC1 on R4’s LAN, you need to create a static route for the host 10.0.0.100/8 with a next-hop address of 20.0.0.2, which is the IP address of R2’s interface connected to R1. You also need to assign a lower administrative distance (AD) to this route than the default AD of 1 for static routes, so that it has a higher preference over other possible routes. For example, you can use an AD of 10 for this route. To create this static route, you need to enter the following commands on R1’s console:

R1#configure terminal R1(config)#ip route 10.0.0.100 255.0.0.0 20.0.0.2 10 R1(config)#end

To configure static routing on R1 that ensures that traffic sourced from R1 will take an alternate path through R3 to PC1 in the event of an outage along the primary path, you need to create another static route for the host 10.0.0.100/8 with a next-hop address of 40.0.0.2, which is the IP address of R3’s interface connected to R1. You also need to assign a higher AD to this route than the AD of the primary route, so that it has a lower preference and acts as a backup route. For example, you can use an AD of 20 for this route. This type of static route is also known as a floating static route. To create this static route, you need to enter the following commands on R1’s console:

R1#configure terminal R1(config)#ip route 10.0.0.100 255.0.0.0 40.0.0.2 20 R1(config)#end

To configure default routes on R1 and R3 to the Internet using the least number of hops, you need to create a static route for the network 0.0.0.0/0 with a next-hop address of the ISP’s interface connected to each router respectively. A default route is a special type of static route that matches any destination address and is used when no other specific route is available. The ISP’s interface connected to R1 has an IP address of 10.0.0.4, and the ISP’s interface connected to R3 has an IP address of 50.0.0.4. To create these default routes, you need to enter the following commands on each router’s console:

On R1: R1#configure terminal R1(config)#ip route 0.0.0.0 0.0.0.0 10.0.0.4 R1(config)#end

On R3: R3#configure terminal R3(config)#ip route 0.0.0.0 0.0.0.0 50.0.0.4 R3(config)#end

Answer as below configuration:

conf t

R1(config)#ntp master 1

R2(config)#ntp server 10.1.2.1

Exit

Router#clock set 00:00:00 jan 1 2019

ip dhcp pool TEST

network 10.1.3.0 255.255.255.0

ip dhcp exluded-address 10.1.3.1 10.1.3.10

R3(config)#int e0/3

R3(config)#int e0/2

ip address dhcp

no shut

crypto key generate RSA

1024

Copy run start

Answer as below configuration:

On R2:

Enable

Conf t

Ip route 192.168.1.0 255.255.255.0 10.10.31.1

On R1:

Enable

Conf t

Ip route 0.0.0.0 0.0.0.0 10.10.13.3

On R2

Ip route 172.20.20.128 255.255.255.128 e0/2

Ip route 172.20.20.128 255.255.255.128 e0/1

On R1

Ip route 192.168.0.0 255.255.255.0 e0/1

Ip route 192.168.0.0 255.255.255.0 10.10.12.2 3

Save all configurations after every router from anyone of these command

Do wr

Or

Copy run start

Answer as below configuration:

on sw1

enable

conf t

vlan 100

name Compute

vlan 200

name Telephony

int e0/1

switchport voice vlan 200

switchport access vlan 100

int e0/0

switchport mode access

do wr

on sw2

Vlan 99

Name Available

Int e0/1

Switchport access vlan 99

do wr

To subnet 172.25.0.0/16 to meet the subnet requirements and maximize the number of hosts, you need to determine how many bits you need to borrow from the host portion of the address to create enough subnets for 32 sites. Since 32 is 2^5, you need to borrow 5 bits, which means your new subnet mask will be /21 or 255.255.248.0. To find the second subnet, you need to add the value of the fifth bit (32) to the third octet of the network address (0), which gives you 172.25.32.0/21 as the second subnet. The first usable IP address in this subnet is 172.25.32.1, and the last usable IP address is 172.25.39.254.

To assign the first usable IP address to e0/0 on Sw101, you need to enter the following commands on the device console:

Sw101#configure terminal Sw101(config)#interface e0/0 Sw101(config-if)#ip address 172.25.32.1 255.255.248.0 Sw101(config-if)#no shutdown Sw101(config-if)#end

To assign the last usable IP address to e0/0 on Sw102, you need to enter the following commands on the device console:

Sw102#configure terminal Sw102(config)#interface e0/0 Sw102(config-if)#ip address 172.25.39.254 255.255.248.0 Sw102(config-if)#no shutdown Sw102(config-if)#end

To subnet an IPv6 GUA to meet the subnet requirements and maximize the number of hosts, you need to determine how many bits you need to borrow from the interface identifier portion of the address to create enough subnets for 32 sites. Since 32 is 2^5, you need to borrow 5 bits, which means your new prefix length will be /69 or ffff:ffff:ffff:fff8::/69 (assuming that your IPv6 GUA has a /64 prefix by default). To find the second subnet, you need to add the value of the fifth bit (32) to the fourth hextet of the network address (0000), which gives you xxxx:xxxx:xxxx:0020::/69 as the second subnet (where xxxx:xxxx:xxxx is your IPv6 GUA prefix). The first and last IPv6 addresses in this subnet are xxxx:xxxx:xxxx:0020::1 and xxxx:xxxx:xxxx:0027:ffff:ffff:ffff:fffe respectively.

To assign an IPv6 GUA using a unique 64-bit interface identifier on e0/0 on Sw101, you need to enter the following commands on the device console (assuming that your IPv6 GUA prefix is 2001:db8::/64):

Sw101#configure terminal Sw101(config)#interface e0/0 Sw101(config-if)#ipv6 address 2001:db8::20::1/69 Sw101(config-if)#no shutdown Sw101(config-if)#end

To assign an IPv6 GUA using a unique 64-bit interface identifier on e0/0 on Sw102, you need to enter the following commands on the device console (assuming that your IPv6 GUA prefix is 2001:db8::/64):

Sw102#configure terminal Sw102(config)#interface e0/0 Sw102(config-if)#ipv6 address 2001:db8::27::fffe/69 Sw102(config-if)#no shutdown Sw102(config-if)#end

Answer as below configuration:

1.- on R3

config terminal

ip route 192.168.1.1 255.255.255.255 209.165.200.229

end

copy running start

2.- on R2

config terminal

ip route 0.0.0.0 0.0.0.0 209.165.202.130

end

copy running start

3.- on R2

config terminal

ipv6 route ::/0 2001:db8:abcd::2

end

copy running start

To configure an LACP EtherChannel and number it as 44, configure it between switches SW1 and SW2 using interfaces Ethernet0/0 and Ethernet0/1 on both sides, configure the EtherChannel as a trunk link, configure the trunk link with 802.1q tags, and configure VLAN ‘MONITORING’ as the untagged VLAN of the EtherChannel, you need to follow these steps:

On both SW1 and SW2, enter the global configuration mode by using the configure terminal command.

On both SW1 and SW2, select the two interfaces that will form the EtherChannel by using the interface range ethernet 0/0 - 1 command. This will enter the interface range configuration mode.

On both SW1 and SW2, set the protocol to LACP by using the channel-protocol lacp command.

On both SW1 and SW2, assign the interfaces to an EtherChannel group number 44 by using the channel-group 44 mode active command. This will create a logical interface named Port-channel44 and set the LACP mode to active on both ends. The LACP mode must match on both ends for the EtherChannel to form.

On both SW1 and SW2, exit the interface range configuration mode by using the exit command.

On both SW1 and SW2, enter the Port-channel interface configuration mode by using the interface port-channel 44 command.

On both SW1 and SW2, configure the Port-channel interface as a trunk link by using the switchport mode trunk command.

On both SW1 and SW2, configure the Port-channel interface to use 802.1q tags for VLAN identification by using the switchport trunk encapsulation dot1q command.

On both SW1 and SW2, configure VLAN ‘MONITORING’ as the untagged VLAN of the Port-channel interface by using the switchport trunk native vlan MONITORING command.

On both SW1 and SW2, exit the Port-channel interface configuration mode by using the exit command.

On both SW1 and SW2, save the configuration to NVRAM by using the copy running-config startup-config command.

Answer as below configuration:

on R1

config terminal

ipv6 unicast-routing

inter eth0/1

ip addre 192.168.1.1 255.255.255.240

ipv6 addre 2001:db8:aaaa::1/64

not shut

end

copy running start

on R2

config terminal

ipv6 unicast-routing

inter eth0/1

ip address 192.168.1.14 255.255.255.240

ipv6 address 2001:db8:aaaa::2/64

not shut

end

copy running start

---------------------

for test from R1

ping ipv6 2001:db8:aaaa::1

for test from R2

ping ipv6 2001:db8:aaaa::2

Answer A is the technically correct selection. OM3 and OM4 are both multimode fiber types with a 50-micron core. OM4 supports higher bandwidth and longer distances for some speeds, but both share the 50/125-micron multimode physical profile. This aligns with Cisco CCNA 200-301 v1.1 because the exam blueprint requires engineers to recognize operational behaviour from configuration symptoms and topology requirements. A 9-micron core is single-mode fiber, and 62.5-micron describes older multimode categories. Treat the distractors carefully: most are real Cisco terms, but they solve a different problem or operate at a different layer. The selected answer is the one that would be used by an engineer on the device or in the design to produce the outcome stated in the question.

Answer as below configuration:

Sw1

enbale

config t

Vlan 210

Name FINANCE

Inter e0/1

Switchport access vlan 210

do wr

Sw2

Enable

config t

Vlan 110

Name MARKITING

Int e0/1

Switchport acees vlan 110

do wr

Sw3

Enable

config t

Vlan 110

Name MARKITING

Vlan 210

Name FINANCE

Int e0/0

Switchport access vlan 110

Int e0/1

Switchport access vlan 210

Sw1

Int e0/1

Switchport allowed vlan 210

Sw2

Int e0/2

Switchport trunk allowed vlan 210

Sw3

Int e0/3

Switchport trunk allowed vlan 210

Switchport trunk allowed vlan 210,110

Cisco DNA Center is positioned as a controller and automation platform rather than a simple device-by-device management tool. One major advantage over traditional campus management is extensibility: APIs, integration adapters, and SDKs allow the platform to interact with other IT systems, network domains, and third-party equipment where supported. Cisco CCNA 200-301 v1.1 tests this under Automation and Programmability because controller-based management changes how networks are provisioned and operated. High availability and assurance are valuable DNA Center capabilities, but the question asks for an advantage versus traditional campus device management, and extensibility is the answer that directly describes the platform shift. Autodiscovery can help onboarding, but it is not the broad differentiator stated in the answer set. Traditional management often means engineers manually configure individual devices through CLI sessions or templates. DNA Center abstracts policy and exposes programmable interfaces, making operations more consistent and easier to integrate with external workflows. That is why A is correct.

An IPv6-enabled router interface joins the all-nodes multicast group FF02::1 and the all-routers multicast group FF02::2. FF02::1 is used to reach all IPv6 nodes on the local link. FF02::2 is used to reach IPv6 routers on the local link. The interface also joins a solicited-node multicast group derived from its IPv6 address, but that specific group is not one of the answer choices. 2000::/3 represents global unicast space, FC00::/7 is unique local addressing, and 2002::/5 or similar values are not the required local multicast groups. The “FF” prefix is the key sign that the address is multicast, while the “02” scope means link-local scope. CCNA 200-301 v1.1 Network Fundamentals expects candidates to identify common IPv6 address types and multicast groups used by Neighbor Discovery and routing functions. Therefore the verified answers are D and E. Reference: Cisco IPv6 multicast addressing and IPv6 interface behavior.

Answer B is the technically correct selection. ARP requests are broadcast frames, so a switch floods them within the VLAN. S1 sends the ARP request out every port in the same VLAN except the port where PC1 sent the frame. This aligns with Cisco CCNA 200-301 v1.1 because the exam blueprint requires engineers to recognize operational behaviour from configuration symptoms and topology requirements. Forwarding only to one interface would require a known unicast destination; dropping it would prevent address resolution. Treat the distractors carefully: most are real Cisco terms, but they solve a different problem or operate at a different layer. The selected answer is the one that would be used by an engineer on the device or in the design to produce the outcome stated in the question.

The verified answer is C and D. RSTP uses discarding, learning, and forwarding port states. Compared with classic STP, RSTP removes the separate listening and blocking names and converges more quickly through proposal and agreement behaviour. Cisco CCNA 200-301 v1.1 places this skill in Network Access, where the exam expects a working understanding of how the feature behaves on real Cisco networks, not just a memorized command. Listening and blocking are associated with 802.1D terminology, and speaking is not an RSTP port state. In production, this distinction matters because a misapplied command or design choice usually creates an outage, a security gap, or unnecessary troubleshooting noise. The correct choice matches the control-plane, data-plane, wireless, security, or services behaviour described in the scenario and should be preferred over options that merely sound related.

The lldp reinit command controls the delay before LLDP reinitializes on an interface. LLDP is a vendor-neutral neighbor discovery protocol, and Cisco IOS exposes several global LLDP timers. lldp timer sets how often LLDP advertisements are sent. lldp holdtime tells the receiving device how long to retain LLDP information before aging it out. lldp tlv-select controls which TLVs are included in advertisements. The question specifically asks for the delay time in seconds for LLDP to initialize, which matches lldp reinit. The option labeled lldp holdtimt is also a typo and refers to the wrong function even if corrected to holdtime. CCNA v1.1 Network Access includes Layer 2 discovery protocols such as CDP and LLDP. The exam often tests command intent rather than full configuration output. Here, the word initialize is the giveaway. Timer means advertisement interval; holdtime means neighbor retention; reinit means initialization delay.

R1 needs a route to the remote LAN 20.20.20.0/24 behind R3. The correct static route uses the next-hop address on the adjacent router, 10.10.10.2. That is why option D is correct. A default gateway command is not the correct fix on a router that is already routing; routers use routes in the routing table, not an end-host default gateway setting, to forward packets. Setting a default network is also not the precise repair because the problem is reachability to one known remote subnet. Using only the exit interface on an Ethernet network is weaker design because the router may need ARP resolution for each destination and can create ambiguity on multiaccess media. A next-hop static route states exactly where R1 must send packets for 20.20.20.0/24. This matches the CCNA 200-301 v1.1 IP Connectivity requirement to configure and verify IPv4 static routes. Reference: Cisco IOS static routing behavior and CCNA 200-301 v1.1 routing objectives.

Controller-based networking reduces configuration complexity by centralizing intent, policy, automation, and visibility. In traditional device-by-device management, engineers often log into individual routers, switches, or controllers and repeat similar commands manually. That increases the chance of drift and human error. A controller-based model centralizes key IT functions, exposes APIs, and can push consistent policy or templates across many devices. It does not inherently increase network bandwidth usage, inflate software costs as a technical benefit, or guarantee fewer network failures in every design. The defensible comparison is operational: centralization and automation reduce complexity and lower the probability of inconsistent configuration. Cisco CCNA 200-301 v1.1 Automation and Programmability includes this topic because modern campus and enterprise management platforms, such as Cisco Catalyst Center, are built around controller-based operations. The two correct benefits are reduced configuration complexity and centralization of management functions. That maps to C and D.

The correct response is A. A client roaming between APs on the same SSID sends a reassociation request. The frame tells the new AP that the client was previously associated elsewhere and is moving within the ESS. For Cisco CCNA 200-301 v1.1, the important point is the mechanism, not a generic description of the technology. Probe requests discover networks, authentication requests start 802.11 authentication, and association requests are used for an initial association rather than roaming reassociation. When this appears in a network, the symptom normally confirms the answer: the route installed, the state selected, the packet forwarded, the wireless client behaviour, or the management workflow will follow this rule. That is why this answer is the best fit for the scenario and not just a plausible networking term.

TCP and UDP both include checksums, but TCP adds reliability mechanisms that UDP does not provide. TCP uses acknowledgments so the sender knows what data arrived, retransmissions when data is lost, sequencing to put data back in order, and windowing to control the amount of outstanding data. UDP is deliberately simpler. It uses a checksum for error detection, but it does not establish a reliable session, acknowledge every segment, or retransmit lost data at the transport layer. Applications that use UDP can build their own recovery if they need it, but UDP itself does not guarantee delivery. Cisco CCNA 200-301 v1.1 Network Fundamentals expects this distinction to be automatic: TCP is connection-oriented and reliable; UDP is connectionless and best-effort. The other answer choices introduce parity checks or CRC as transport reliability methods, which is not the TCP/UDP comparison being tested. The correct statement is that TCP uses checksum, acknowledgments, and retransmissions, while UDP uses checksums only.

A notice-level syslog message is severity level 5. It reports normal but significant conditions, such as operational state changes that an engineer should know about even when the device is not in a critical failure state. An interface line changing status is a standard example of a significant network event: it can affect reachability, routing adjacencies, and user traffic, but it is not necessarily a severity 0 emergency or severity 1 alert. Cisco CCNA 200-301 v1.1 includes syslog under IP Services because engineers must understand logging destinations and severity levels. A TCP connection teardown or ICMP connection being built is not the typical Cisco device notice-level management event tested here. A certificate expiration may be security-related and can be logged at various severities depending on platform and feature. The simple exam mapping is that notice means noteworthy state change. An interface line status change fits that definition, so C is the best answer.

Routers choose the route with the longest matching prefix before comparing protocol preference for equally specific routes. If the RIP entry contains the longest prefix that includes destination 192.168.12.16, that route is selected even though RIP has a worse administrative distance than OSPF or EIGRP. Administrative distance only becomes the deciding factor when competing routes describe the same prefix length. Cisco CCNA 200-301 v1.1 IP Connectivity repeatedly tests this rule because it is fundamental to forwarding decisions. The router does not load-balance among routes simply because multiple protocols know related networks. It also does not choose EIGRP solely because EIGRP has a lower administrative distance when another route is more specific. The forwarding lookup starts with the destination IP address and finds the most specific matching prefix in the routing table. In this exhibit, the RIP route is the longest prefix inclusive of 192.168.12.16, so A describes the router behavior correctly.

In CRUD terminology, update is the operation that modifies an existing record, table entry, object, or view. Create adds something new, read retrieves existing information, update changes existing information, and delete removes it. Some APIs use replace or patch semantics, but the CRUD term being tested for modification is update. Cisco CCNA 200-301 v1.1 Automation and Programmability includes CRUD because REST APIs and controller-based platforms use these concepts constantly. For example, an HTTP GET commonly maps to read, POST often maps to create, PUT or PATCH may map to update, and DELETE maps to delete. The wording says ' modifies an existing table or view, ' which rules out create and read. Replace is not one of the standard CRUD letters. The correct CRUD operation is update. Therefore, D is correct.

For NAT terminology, the public address that represents an inside host to the outside network is the inside global address. The inside local address is the private address configured on the internal device, commonly from RFC 1918 space. When traffic leaves the inside network, NAT changes the source from inside local to inside global so that the packet can be routed through the outside network. The outside global address is the real address of an external host, not the translated public address used by the inside device. Outside local describes how that external host may appear to the inside network. Cisco CCNA 200-301 v1.1 covers these NAT terms in IP Services because engineers must read translation tables correctly during troubleshooting. The phrase public IP address of a NAT device is often imprecise, but in the context of a translated inside source, the Cisco term being tested is inside global. That is why C is the correct answer.

The correct response is C. FHRPs improve availability by providing automatic default-gateway redundancy. If the active gateway fails, another router can take over the virtual IP and MAC so hosts keep using the same default gateway. For Cisco CCNA 200-301 v1.1, the important point is the mechanism, not a generic description of the technology. They do not primarily reduce management overhead, reduce ARP, or perform proportional load balancing in every implementation. When this appears in a network, the symptom normally confirms the answer: the route installed, the state selected, the packet forwarded, the wireless client behaviour, or the management workflow will follow this rule. That is why this answer is the best fit for the scenario and not just a plausible networking term.

The WLAN component mapping follows the normal Cisco wireless architecture. The wireless LAN controller is the device that centrally manages lightweight access points. An access point is the radio device that gives wireless clients connectivity into the wired infrastructure. A service port is used for out-of-band management of the WLC. A dynamic interface is mapped to WLANs and client VLANs so wireless client traffic can be placed into the correct wired network. The virtual interface supports controller functions such as mobility management and internal controller operations, depending on the platform and software release. The exam point is straightforward: APs provide RF access, WLCs centralize control, and controller interfaces define management and client-data handling. CCNA 200-301 v1.1 Network Access expects candidates to identify these WLC components rather than treat the controller as a single generic box. The existing drag-and-drop answer aligns with Cisco wireless controller terminology. Reference: Cisco Wireless LAN Controller interface and WLAN architecture documentation.

The correct response is A and B. Static IPv6 host routes use a /128 prefix to identify one exact loopback destination. On the New York router, the Atlanta loopback route points toward Atlanta and the Washington loopback route points toward Washington through the appropriate next-hop addresses. For Cisco CCNA 200-301 v1.1, the important point is the mechanism, not a generic description of the technology. Routes using the wrong next hop or serial interface do not precisely satisfy both host reachability requirements. When this appears in a network, the symptom normally confirms the answer: the route installed, the state selected, the packet forwarded, the wireless client behaviour, or the management workflow will follow this rule. That is why this answer is the best fit for the scenario and not just a plausible networking term.

Router-on-a-stick inter-VLAN routing uses router subinterfaces, one logical subinterface per VLAN. For VLAN 20 on Ethernet0/0, the subinterface should be Ethernet0/0.20, followed by 802.1Q encapsulation for VLAN 20 and the gateway IP address for that VLAN. The physical interface normally remains without an IP address, while each subinterface receives its own VLAN-tagged configuration. The command encapsulation dot1q 20 tells the router to expect and send frames tagged for VLAN 20 on that subinterface. The IP address 10.20.20.1 255.255.255.0 then becomes the default gateway address for hosts in VLAN 20. Option A incorrectly configures encapsulation and IP addressing under the physical Ethernet0/0 interface. Option C misses the encapsulation command, so the router would not associate the subinterface with VLAN 20. Option D is only a plain routed interface configuration. Cisco CCNA 200-301 v1.1 includes this as a foundational VLAN routing pattern. The correct command set is option B.

The verified answer is D. In a virtualized server environment, virtual machines connect through a software switch provided by the hypervisor. The hypervisor uplinks that virtual switch to the physical network through one or more physical NICs on the host server. Cisco CCNA 200-301 v1.1 places this skill in Network Fundamentals, where the exam expects a working understanding of how the feature behaves on real Cisco networks, not just a memorized command. VMs do not normally connect wirelessly, and they are not each cabled directly to a physical switch. In production, this distinction matters because a misapplied command or design choice usually creates an outage, a security gap, or unnecessary troubleshooting noise. The correct choice matches the control-plane, data-plane, wireless, security, or services behaviour described in the scenario and should be preferred over options that merely sound related.

The verified answer is C. A Layer 2 switch floods an unknown unicast frame when the destination MAC address is missing from its MAC address table. The flood is limited to ports in the same VLAN and excludes the ingress port where the frame arrived. Cisco CCNA 200-301 v1.1 places this skill in Network Access, where the exam expects a working understanding of how the feature behaves on real Cisco networks, not just a memorized command. The switch does not drop the frame immediately, send it back out the receiving port, or wait for the aging timer to expire. In production, this distinction matters because a misapplied command or design choice usually creates an outage, a security gap, or unnecessary troubleshooting noise. The correct choice matches the control-plane, data-plane, wireless, security, or services behaviour described in the scenario and should be preferred over options that merely sound related.

A remote access VPN allows individual users to connect securely to internal company resources over an untrusted network such as the Internet. The user runs a VPN client or uses a supported remote-access method, authenticates, and receives encrypted tunnel access to permitted internal services. That is different from a site-to-site VPN, which connects two networks such as branch and headquarters. The answer choice about multiple users simultaneously is too vague and does not identify the remote-access purpose. The option saying it is used exclusively while already on the internal network is wrong; the point is remote connectivity. Cisco CCNA 200-301 v1.1 Security Fundamentals covers VPN concepts because engineers must distinguish remote-access VPNs, site-to-site VPNs, IPsec, and tunneling behavior. The best definition is that remote access VPN allows users to access internal company network resources through a secure tunnel. The correct answer is D.

The core layer in a three-tier campus design is built for fast, resilient transport between distribution blocks. Its job is to provide uninterrupted forwarding and timely data transfer between layers. It should avoid unnecessary policy complexity because heavy filtering, packet inspection, or endpoint attachment belongs elsewhere in the architecture. The access layer connects end-user devices. The distribution layer commonly provides aggregation, routing boundaries, policy enforcement, and summarization. The core should stay highly available and efficient so the rest of the campus has stable backbone connectivity. Cisco CCNA 200-301 v1.1 Network Fundamentals tests the access, distribution, and core roles because good troubleshooting depends on knowing where functions should live. The core is not the place to police edge traffic or inspect packets for malicious activity in the basic three-tier model. The two correct core functions are uninterrupted forwarding service and timely data transfer between layers.

The correct command is ipv6 address 2001:DB8:5:112::/64 eui-64. The wording says the address is generated from a specified IPv6 prefix and the interface MAC address. That is exactly what the eui-64 keyword does: it derives the 64-bit interface identifier from the MAC address and combines it with the configured /64 prefix. The ipv6 address autoconfig command also can create an address, but it learns the prefix from Router Advertisement messages through SLAAC; the prefix is not explicitly specified in the command. DHCPv6 would request addressing information from a DHCPv6 server, and the link-local option shown is not a global unicast address built from the stated prefix. Cisco CCNA v1.1 Network Fundamentals includes IPv6 address types and address configuration methods, and this question tests precise IOS syntax. When the prefix is typed in the command and the MAC-derived interface ID is required, choose the static EUI-64 form, not autoconfig.

DNS lets applications use names instead of forcing users and software to work directly with IP addresses. A client can ask for the address associated with a hostname, and DNS returns the resource records needed to reach that service. DNS can also map one name to multiple IP addresses, which supports simple distribution, redundancy, or service design depending on the record type and client behavior. It does not encrypt WAN traffic by default, and it does not secure IP addresses merely by hiding them behind fully qualified domain names. DNS is hierarchical, not flat, which is why the root, top-level domains, authoritative zones, and host records can scale globally. Cisco CCNA 200-301 v1.1 covers DNS under IP Services because name resolution is required for many network operations, including management access, web services, and application connectivity. The two valid roles here are enabling applications to identify resources by name and allowing a hostname to be associated with more than one IP address.

It identifies a WLAN. Wireless operation depends on WLAN identity, AP mode, RF management, client authentication, and controller-based policy enforcement. Cisco CCNA 200-301 v1.1 includes this under Network Access, where the exam expects engineers to recognize the device behavior that actually produces the required outcome. The question is best solved by reading the operational clue rather than choosing a familiar acronym. The distractors confuse WLAN names, authentication, encryption, RF optimization, and controller management functions. In a production network, the wrong choice would normally create an outage, leave a management or security gap, or send troubleshooting toward the wrong subsystem. The selected answer is the one that matches the control-plane, data-plane, wireless, security, services, or automation mechanism described in the question. That is why it remains the verified answer for this item.

The verified answer is C. logging trap 4 sends warning severity messages and all more severe syslog messages to the server. Syslog severity numbers become more severe as the number decreases, so level 4 includes emergencies, alerts, critical, errors, and warnings. Cisco CCNA 200-301 v1.1 places this skill in IP Services, where the exam expects a working understanding of how the feature behaves on real Cisco networks, not just a memorized command. Level 5 would include notices but is not limited to warning and error conditions; levels 2 and 3 omit warnings. In production, this distinction matters because a misapplied command or design choice usually creates an outage, a security gap, or unnecessary troubleshooting noise. The correct choice matches the control-plane, data-plane, wireless, security, or services behaviour described in the scenario and should be preferred over options that merely sound related.