Free 200-301 Practice Test Questions and Answers (2026)

Double-Tagging VLAN Hopping: This attack exploits the way switches process 802.1Q tags on the native VLAN. By changing the native VLAN to an unused ID (not the default VLAN 1), the attacker's double-tagged frames are dropped or misdirected, neutralizing the exploit.

MAC Flooding: While Port Security is a direct mitigation, 802.1x authentication effectively mitigates this by enforcing strict access control. It prevents unauthorized devices (which might run flooding tools like macof) from connecting to the network and injecting frames to overflow the CAM table.

Man-in-the-Middle (MITM): DHCP snooping specifically mitigates MITM attacks caused by rogue DHCP servers (DHCP spoofing). It validates DHCP messages and builds a binding database used to block untrusted DHCP traffic.

Switch Spoofing: This relies on the Dynamic Trunking Protocol (DTP) to negotiate a trunk link. Disabling DTP (using switchport nonegotiate) prevents an attacker from tricking the switch into forming a trunk.

Cisco Systems, Inc., "Layer 2 Security Configuration Guide, Cisco IOS Release 15.0S," Configuring DHCP Snooping, Chapter 2. (Confirms DHCP snooping prevents rogue DHCP servers, a primary vector for MITM).

Cisco Systems, Inc., "VLAN Configuration Guide, Cisco IOS Release 15.1," Configuring VLANs. (Documents the recommendation to change the native VLAN to an unused ID to prevent 802.1Q double-tagging).

Cisco Networking Academy, CCNA Security v2.0 Courseware, Chapter 10: Layer 2 Security. (Explicitly maps DTP disabling to switch spoofing mitigation and 802.1x as an access control measure against flooding/unauthorized access).

S. Yusuf, CCNA Security 210-260 Official Cert Guide, Cisco Press, 2015, pp. 145-148. (Discusses VLAN hopping mitigation and the use of native VLAN tagging/pruning).

The image illustrates a 2.4 GHz Wi-Fi channel allocation plan using the three non-overlapping channels: 1, 6, and 11, which are represented by the three distinct shading patterns. In a proper design, adjacent access points (APs) should use different, non-overlapping channels to prevent interference.

• Zones 3 and 6 are shown as adjacent, but both share the same shading pattern (crosshatch). This indicates they are incorrectly configured to operate on the same channel (e.g., Channel 1).
• This overlap creates significant Cochannel Interference (CCI), where signals from both APs collide. Devices in this area will struggle to differentiate the signals, leading to data corruption, high retransmission rates, and packet loss, which the user experiences as intermittent connectivity.

A. between zones 1 and 2: These zones have different shading (crosshatch vs. double-crosshatch), indicating they use different non-overlapping channels (e.g., 1 and 6). This is a correct design.

B. between zones 2 and 5: These zones have different shading (double-crosshatch vs. diagonal lines), indicating they use different non-overlapping channels (e.g., 6 and 11). This is a correct design.

C. between zones 3 and 4: These zones have different shading (crosshatch vs. double-crosshatch), indicating they use different non-overlapping channels (e.g., 1 and 6). This is a correct design.

Source: Cisco. (2019). Enterprise Mobility 8.5 Design Guide.

Reference: Chapter 2, "WLAN RF Design Considerations," section "Channel Reuse."

Content: This guide details that in the 2.4 GHz band, only channels 1, 6, and 11 are non-overlapping. A fundamental principle of WLAN RF design is to create a channel reuse plan where "no two adjacent cells operate on the same channel." When same-channel cells are adjacent, as shown between zones 3 and 6, it results in co-channel interference, which "limits the performance and capacity" of the network.

Source: Carnegie Mellon University. (2017). 15-441: Networking and the Internet, Lecture 21: Wireless.

Reference: Slide 42-44, "Interference."

Content: This university courseware explains that sources of interference in 802.11 include other APs. It explicitly diagrams how adjacent APs must use different channels (e.g., 1, 6, 11) to avoid interference. When APs on the same channel are too close, their coverage overlaps, and a client in that overlap region cannot reliably communicate, as the CSMA/CA (Carrier Sense Multiple Access with Collision Avoidance) mechanism is compromised.

Source: Gurevitch, A., He, A., & Zhang, J. (2007). The impact of co-channel interference on 802.11n network performance. 2007 IEEE International Conference on Communications.

DOI: https://doi.org/10.1109/ICC.2007.94

Content: This peer-reviewed publication analyzes the effects of CCI. It confirms that as co-channel interference increases (which occurs when same-channel APs are placed near each other), the "packet error rate increases significantly," and overall network throughput is "severely degraded." This degradation manifests to a user as intermittent or dropped connections.

A floating static route serves as a backup to a dynamically learned route. To function as a backup, its administrative distance (AD) must be higher than the primary route's AD. The question specifies the primary route is learned via external EIGRP, which has a default AD of 170. Therefore, the floating static route must have an AD greater than 170. The destination LAN on R86 has an IP of 10.80.65.170/29. The correct network address for this is 10.80.65.168 with a subnet mask of 255.255.255.248. The next-hop IP address from R14 is R86's serial interface, 10.73.65.66. Option C correctly combines the network, mask, next-hop, and an AD of 171, which is greater than 170.

A. The network address, mask, and administrative distance are incorrect. An AD of 1 would make this the primary route, not a backup. B. The network address, mask, and next-hop are incorrect. An AD of 89 is lower than EIGRP's AD, so it would not be a floating route. D. The command syntax is invalid. It incorrectly uses a wildcard mask instead of a subnet mask and has an incorrect next-hop address.

1. Cisco Systems, Inc., Cisco IOS IP Routing: Protocol-Independent Command Reference, "ip route" command documentation. This document confirms the syntax ip route prefix mask {ip-address | interface-type interface-number [ip-address]} [distance]. It specifies that distance is the administrative distance for the route.

2. Cisco Systems, Inc., IP Routing: EIGRP Configuration Guide, Cisco IOS Release 15M&T, "EIGRP Administrative Distance". This guide states, "The administrative distance for an external EIGRP route is 170 by default."

3. Odom, W. (2019). CCNA 200-301 Official Cert Guide, Volume 1. Cisco Press. Chapter 15, "Static Routing," section "Floating Static Routes," explains that a floating static route is configured with a higher administrative distance than the dynamic routing protocol it is intended to back up. Table 15-1 lists the default AD for External EIGRP as 170.

The question requires a protocol that supports separate authorization and authentication processes. Terminal Access Controller Access-Control System Plus (TACACS+) is designed with this separation as a core feature. It uses distinct protocol messages and processes for authentication and authorization, allowing these functions to be handled independently, even by different servers. This modularity provides granular control and flexibility. While often used for device administration (including managing wireless APs), its protocol design directly matches the question's explicit requirement for separation. In contrast, RADIUS combines authentication and authorization into a single function, sending authorization details within the authentication acceptance message.

A. RADIUS: This protocol combines authentication and authorization into a single packet exchange (Access-Accept), which contradicts the requirement for separate solutions.

C. 802.1X: This is an IEEE standard for port-based network access control; it is an authentication framework, not a specific AAA protocol itself. It relies on a backend protocol like RADIUS.

D. Kerberos: This is a ticket-based authentication protocol for client/server applications and is not used for AAA functions between a network access device like an AP and a central server.

---

1. Cisco Press. Odom

W. (2020). CCNA 200-301 Official Cert Guide

Volume 2. Cisco Press. In Chapter 23

"Securing Network Devices

" the section "Comparing RADIUS and TACACS+" states

"TACACS+ separates the authentication

authorization

and accounting functions... RADIUS combines the authentication and authorization functions."

2. Official Vendor Documentation. Cisco Systems

(2023). Security Configuration Guide: AAA

Cisco IOS XE Cupertino 17.9.x. Chapter: "Configuring TACACS+". In the "TACACS+ Overview" section

it states

"TACACS+ provides for separate and modular authentication

authorization

and accounting facilities."

3. Official Vendor Documentation. Cisco Systems

(2023). Security Configuration Guide: AAA

Cisco IOS XE Cupertino 17.9.x. Chapter: "Configuring RADIUS". The "RADIUS Overview" section describes the process where the "RADIUS server authenticates the user and returns the configuration information... to the NAS [AP] for delivery to the user." This confirms the combined nature of the authentication and authorization response.

The Cisco DNA Center Overall Health Dashboard provides a high-level, at-a-glance

summary of the network's status. A key feature of this dashboard is to highlight the most

critical problems impacting the network. This includes presenting a list of the top 10

global issues, allowing administrators to quickly identify and prioritize the most

significant problems affecting network devices and clients. The dashboard's primary

purpose is to offer a consolidated view of network and client health scores and to

surface major ongoing issues.

•

B: The Overall Health Dashboard provides summaries and health scores, not

detailed activity logs for a specific number of devices. Detailed logging is

available in other sections of Cisco DNA Center, but it's not the primary function

of this top-level dashboard.

•

C: This is too narrow. The dashboard provides a summary of the entire network's

health, including both wired and wireless devices, as well as clients connected to

them. It is not limited to only wireless devices.

•

D: This is incorrect because the dashboard's focus is on the health of network

devices (routers, switches, access points) and clients, not servers and

workstations. While it assesses device health, it doesn't specifically focus on

CPU usage for end-user computing devices.

/561

1. Cisco DNA Center User Guide, Release 2.3.5: This guide explicitly describes

the main dashboard's features. It states, "The top-10 lists show the problematic

network devices, the top issues that are impacting the health score..."

o Source: Cisco, "Cisco DNA Center User Guide, Release 2.3.5"

o URL: https://www.cisco.com/c/en/us/td/docs/cloud-systemsmanagement/network-automation-and-management/dna-center/2-3-

5/user_guide/b_cisco_dna_center_ug_2_3_5/m_health_dashboard.html

o Reference: See the section "Network Health and Top-10 Issues."

2. Cisco DNA Center Data Sheet: This document outlines the key capabilities,

including Assurance. It mentions that the platform provides "overall network,

client, and application health" and helps to "proactively identify issues" by

highlighting top problems.

o Source: Cisco, "Cisco DNA Center Data Sheet"

o URL: https://www.cisco.com/c/en/us/products/collateral/cloud-systemsmanagement/dna-center/nb-06-dna-center-data-sheet-cte-en.html

o Reference: See the "Cisco DNA Assurance and Analytics" section, which

describes visibility into top issues.

/561

The command spanning-tree vlan forward-time is used to configure the Forward Delay timer for a specific VLAN. In Spanning Tree Protocol (STP) and its variants like Rapid PVST+, the Forward Delay timer dictates the duration a port spends in the listening state and subsequently in the learning state before it can transition to the forwarding state. Each of these states (listening and learning) lasts for the period defined by the forward-time value. Therefore, this command allows an administrator to set the specific time period for these states.

Cisco IOS LAN Switching Command Reference - Spanning-Tree Commands: spanning-tree

[vlan vlan-list] forward-time seconds

"Use the spanning-tree forward-time command in global configuration mode or the

spanning-tree vlan forward-time command in interface configuration mode to set the time

that a Layer 2 port waits before it changes from the listening and learning states to the

forwarding state."

/561

Source: Cisco. (Specific document version varies, e.g., Catalyst 9300 Series Switches, IOS

XE Bengaluru 17.6.x). A general reference can be found in Cisco IOS command references

for switches. Example: Cisco Catalyst 3750 Switch Software Configuration Guide,

12.2(25)SEE - "Configuring STP" section, "STP Timers".

CCNA 200-301 Official Cert Guide, Volume 1 by Wendell Odom (Cisco Press):

Chapter 3: "Spanning Tree Protocol Concepts" discusses STP timers. "Forward Delay: The

number of seconds an interface stays in the listening state, and then the number of seconds

an interface stays in the learning state. Default: 15 seconds."

Source: Odom, W. (2019). CCNA 200-301 Official Cert Guide, Volume 1. Cisco Press.

(Chapter on STP).

Cisco documentation on "Understanding and Configuring Spanning Tree Protocol (STP) on

Catalyst Switches":

This document typically explains the STP timers: "Forward DelayThe time that is spent in

the listening and learning state. The default is 15 seconds."

Source: Cisco Systems, "Understanding and Configuring Spanning Tree Protocol (STP) on

Catalyst Switches" (available on Cisco.com, specific document ID may vary by switch

model and IOS version).

Phishing is a form of social engineering that targets the human element, tricking employees into divulging sensitive information or performing actions that compromise security. While technical controls are part of a defense-in-depth strategy, the most direct and effective program to mitigate successful phishing attacks is user awareness training. This training educates employees on how to recognize the characteristics of phishing emails (e.g., suspicious links, urgent requests, spoofed senders) and what actions to take. By addressing the root cause—human error—organizations can significantly reduce their vulnerability to these attacks.

A. email system patches: Patches address software vulnerabilities, whereas phishing primarily exploits human psychology, not a technical flaw in the email system.

B. physical access control: This secures physical premises and equipment, which is irrelevant to preventing an employee from clicking a malicious link in an email.

C. software firewall enabled on all PCs: A firewall can block malicious connections but does not prevent the user from receiving the phishing email or being deceived by its content.

1. Odom

W. (2019). CCNA 200-301 Official Cert Guide

Volume 2. Cisco Press. In Chapter 22

"Security Fundamentals

" the section on "Mitigating Threats" discusses that user training is a primary method to counter social engineering attacks like phishing.

2. Cisco Networking Academy. (2020). CCNA: Enterprise Networking

Security

and Automation (ENSA) v7.0 Curriculum. Module 3

"Network Security Concepts

" Section 3.4.1

"Best Practices

" identifies user education as a crucial best practice for mitigating social engineering attacks.

3. National Institute of Standards and Technology (NIST). (2003). Special Publication 800-50: Building an Information Technology Security Awareness and Training Program. Section 2.2

"The Importance of Security Awareness and Training

" establishes that a comprehensive training program is essential to help users recognize and respond to threats like phishing.

Link-Local Addresses (FE80::/10): These are mandatory for IPv6 communication and are used for neighbor discovery and housekeeping on a single link. Their scope is strictly limited to the local link ("attached to a single subnet") and they are not routed. In typical vendor implementations (e.g., Cisco IOS), while an interface can hold multiple Global Unicast addresses, it generally supports only one active Link-Local address; configuring a manual Link-Local address overwrites the existing one.

Unique Local Addresses (ULAs): Defined by the prefix FC00::/7 (which includes FD00::/8), these are the IPv6 equivalent of IPv4 private addressing (RFC 1918). They are designed for "exclusive use internally" within a site or organization and are not intended to be routed on the public Internet.

IETF RFC 4291, "IP Version 6 Addressing Architecture," Section 2.5.6 (Link-Local IPv6 Unicast Addresses) and Section 2.8 (A Node's Required Addresses).

IETF RFC 4193, "Unique Local IPv6 Unicast Addresses," Section 3.1 (Format) and Section 1 (Introduction/Applicability).

Cisco Systems, "IPv6 Configuration Guide, Cisco IOS XE Release 3S," Chapter: IPv6 Addressing and Basic Connectivity. (Confirms Link-Local behavior where manual configuration overrides the automatically generated address).

Authentication is the fundamental process of identifying a user or device, typically through credentials, ensuring the entity is who it claims to be (verifies identity). Authorization follows authentication and enforces policies to determine which resources, commands, or services the authenticated entity is permitted to access (verifies access rights). Accounting measures and records the resources a user consumes during their access, such as connection time, data sent/received, or commands issued, for auditing and billing purposes (tracks activity). CoA (Change of Authorization), an extension to the RADIUS protocol (RFC 5176), allows the AAA server (e.g., Cisco ISE) to send unsolicited messages to the Network Access Server (NAS) to dynamically modify the characteristics or permissions of an active session (updates session attributes).

Cisco Systems. "Authentication, Authorization, and Accounting Configuration Guide, Cisco IOS XE 17." Chapter: AAA Overview. Section: "AAA Fundamentals." (Official Cisco Documentation).

Chiba, M., et al. "Dynamic Authorization Extensions to Remote Authentication Dial In User Service (RADIUS)." RFC 5176, Internet Engineering Task Force (IETF), January 2008. Section 1.1 "Applicability" (describes changing session authorization).

Cisco Systems. "Cisco Identity Services Engine Administrator Guide, Release 2.4." Chapter: Change of Authorization. Section: "Understanding Change of Authorization."

The MIB (Management Information Base) is a hierarchical database defining the "variables" (objects) that can be monitored on a device. An SNMP trap is an "unsolicited message" sent by the agent to the manager to alert it of a specific event (like a link going down) without the manager asking for it. The SNMP agent is the software process running on the managed device that "responds to status requests" (Get/Set messages) from the manager. Finally, the SNMP manager (or management station) is the central entity that polls devices and collects data; it "resides on an NMS" (Network Management System).

Case, J., Fedor, M., Schoffstall, M., & Davin, J. (1990). A Simple Network Management Protocol (SNMP). IETF RFC 1157.

Section 3.2.1: Describes the "Management Information Base (MIB)" as a collection of managed objects.

Section 4.1.6: Defines the "Trap-PDU" regarding unsolicited event reporting.

Section 3.1: Discusses the architecture involving "network management stations" (Managers) and "network elements" (Agents).

DOI: https://doi.org/10.17487/RFC1157

Cisco Systems. IP Application Services Configuration Guide, Cisco IOS Release 12.4. "Configuring SNMP Support."

Section "SNMP Overview": Explicitly defines the SNMP manager as running on the NMS and the SNMP agent as residing on the managed device.

Section "SNMP Notifications": Defines traps as unsolicited messages.

Stallings, W. (1999). SNMP, SNMPv2, SNMPv3, and RMON 1 and 2. Addison-Wesley Professional.

Chapter 4: Covers the SNMPv1 architecture, defining the roles of the Manager, Agent, and MIB structure.

Ansible is an agentless tool that utilizes SSH for transport to managed nodes and defines its state using YAML in files called Playbooks. Chef configurations are written in Ruby (DSL) within "Recipes," and its specific "Push Jobs" component listens on TCP port 10002 to execute commands. Puppet stores its configuration code in files known as manifests (using Puppet DSL) and relies on TCP port 8140 for the encrypted communication between the agent and the primary server (Master).

Red Hat Ansible Documentation. "Introduction to Playbooks." Red Hat. Describes YAML usage.

Source: https://docs.ansible.com/ansible/latest/playbook_guide/playbooks_intro.html

Chef Documentation. "Push Jobs - Network Requirements." Progress Chef. Identifies TCP 10002 for command port communication.

Source: https://docs.chef.io/push_jobs/

Puppet Documentation. "System Configuration: Default Ports." Perforce. Confirms TCP 8140 for Puppet Master/Agent traffic.

Source: https://www.puppet.com/docs/puppet/7/system_requirements.html#network-requirements

Cisco DevNet Associate (DEVASC 200-901) Official Cert Guide. Chapter on "Network Automation and Programmability." Compare Ansible (YAML/SSH), Chef (Ruby), and Puppet (Manifests/8140).

Chef Documentation. "Chef Infra Language." Progress Chef. Confirms the use of Ruby for resource definition.

Source: https://docs.chef.io/chef_language/

The IPv6 address block FF00::/8 is reserved for multicast addressing. An IPv6 multicast address is an identifier for a group of interfaces, typically on different nodes. A packet sent to a multicast address is delivered to all interfaces that have joined the corresponding multicast group. This "one-to-many" communication model matches the question's description of sending packets to a group address. The first 8 bits of a multicast address are always 1111 1111, which is FF in hexadecimal.

A. 2000::/3 is the Global Unicast Address (GUA) range, used for public, one-to-one communication, similar to public IPv4 addresses.

B. FC00::/7 is the Unique Local Address (ULA) range, used for private, one-to-one communication within a limited set of sites.

C. FE80::/10 is the Link-Local Unicast Address (LLA) range, used for one-to-one communication on a single local network segment.

---

1. IETF RFC 4291

"IP Version 6 Addressing Architecture":

Section 2.7

"Multicast Addresses": "An IPv6 multicast address is an identifier for a group of interfaces... Multicast addresses are distinguished from unicast addresses by the value of the high-order octet of the addresses. A value of FF (in hexadecimal) for the high-order octet identifies an address as a multicast address." This defines the FF00::/8 block.

Section 2.5.4

"Global Unicast Addresses": Defines the 2000::/3 block.

Section 2.5.6

"Link-Local IPv6 Unicast Addresses": Defines the FE80::/10 block.

2. Cisco Press

CCNA 200-301 Official Cert Guide

Volume 1

by Wendell Odom.

Chapter 27

"Fundamentals of IP Version 6"

Table 27-2 "IPv6 Address Prefixes for Address Types": This table explicitly lists FF00::/8 for Multicast

2000::/3 for Global Unicast

FC00::/7 for Unique Local

and FE80::/10 for Link-Local addresses

directly confirming the correct and incorrect options.

3. IETF RFC 4193

"Unique Local IPv6 Unicast Addresses":

Section 3

"Address Format": This document defines the format for Unique Local Addresses

specifying the FC00::/7 prefix. "The Local IPv6 addresses are created using a pseudo-randomly allocated global ID. They have the following format: | 7 bits |1| 40 bits | 16 bits | 64 bits | | Prefix |L| Global ID | Subnet ID | Interface ID | FC00::/7 prefix..."

Cisco DNA Center is a key component of Cisco's Software-Defined Networking (SDN) architecture for the enterprise. It centralizes network management and leverages automation to significantly accelerate network operations. Features like Zero-Touch Provisioning (ZTP) and Plug and Play (PnP) allow new devices to be deployed and configured automatically, drastically reducing the time and manual effort required compared to traditional, device-by-device CLI configuration. This automation is a fundamental advantage, enabling faster initial network rollouts and subsequent changes.

A. Traditional management is manual and device-by-device, making patch deployment significantly slower than the automated, network-wide capabilities of Cisco DNA Center.

B. Cisco DNA Center typically involves a higher initial capital expenditure (CapEx) for the appliance and licensing compared to traditional management tools.

C. Traditional management scales poorly due to its reliance on manual configuration, whereas DNA Center's automation is specifically designed to enable rapid and large-scale network growth.

1. Odom

W. (2019). CCNA 200-301 Official Cert Guide

Volume 2. Cisco Press. In Chapter 23

"Introduction to Controller-Based Networking

" the section "Comparing Traditional Networks and Controller-Based Networks" explains that traditional networks require manual

per-device configuration

which is slow

while controller-based networks automate these tasks for speed and consistency.

2. Cisco. (2023). Cisco DNA Center Data Sheet. Under the "Automation" feature description

it states

"Automate device deployment... to lower costs and accelerate new service rollouts." This directly contrasts with the slower

manual processes of traditional management. (Document available on Cisco's public website).

3. Cisco. (2020). Cisco DNA Center At-a-Glance. This document highlights the benefit of being able to "Provision thousands of devices in minutes

not hours or days

" which is a direct claim of faster deployment compared to traditional methods. (Document available on Cisco's public website).

The AAA framework consists of three distinct security components:

1. Authentication is the process of verifying a user's identity to ensure they are who they claim to be. The statement "It verifies 'who you are'" is the fundamental definition of this phase. Technical validation of these credentials often occurs via protocols like TACACS+ or RADIUS.
2. Accounting measures and records the resources a user consumes during their session. This includes logging session statistics such as the duration of each connection and collecting data to support User Access Reporting for auditing, billing, or security review.

Cisco Systems. Authentication, Authorization, and Accounting Overview. Cisco IOS Security Configuration Guide, Release 12.2. Section: "AAA Overview". (Defining Authentication as the method to identify users and Accounting as the method to track services for billing/auditing).

Internet Engineering Task Force (IETF). RFC 2903 - Generic AAA Architecture. Section 2. (Defines the modular nature of AAA, identifying Authentication as policy enforcement based on identity and Accounting as the collection of resource consumption data).

National Institute of Standards and Technology (NIST). NIST SP 800-12 Rev. 1: An Introduction to Information Security. Chapter 15, "Identification and Authentication". (Provides the standard definition that authentication verifies the identity of a user, process, or device).

Monitor mode is designed for network surveillance; the AP does not serve clients but scans all channels to collect statistics on air quality, detect interference (IDS/IPS), and track the location of RFID tags using RSSI.

Sniffer mode dedicates the AP's radio to a specific frequency (channel) to capture raw 802.11 frames. These captured packets are encapsulated and forwarded to a remote station running analysis software (packet analyzers like Wireshark) for detailed debugging.

Sensor mode (often associated with Cisco Service Assurance or Active Sensors) allows the AP to function as a client device. It runs synthetic tests to generate performance analytics and verify network services (DHCP, DNS, web), enabling engineers to troubleshoot client experiences remotely without being onsite.

Cisco Systems. Cisco Wireless Controller Configuration Guide, Release 8.10, "Chapter: Access Point Modes." Section: Monitor Mode. (Describes scanning all channels, rogue detection, and location tracking).

Cisco Systems. Cisco Wireless Controller Configuration Guide, Release 8.10, "Chapter: Access Point Modes." Section: Sniffer Mode. (Describes capturing packets on a specific channel and forwarding to a remote device).

Cisco Systems. Cisco Aironet Active Sensor Solution Guide, "Overview of Cisco Aironet Active Sensor." (Details the sensor's role in measuring wireless performance, running synthetic tests, and troubleshooting remotely as a client).

OfficeExtend Access Points (OEAPs) are designed for teleworkers and securely tunnel all corporate SSID traffic back to the Wireless LAN Controller (WLC) over the internet. This ensures that corporate data remains within the enterprise network security perimeter. FlexConnect APs, typically deployed in branch offices, offer the flexibility of local switching. In local switching mode, client data traffic for specified WLANs is terminated at the AP and switched onto the local wired network, rather than being tunneled back to the WLC. This local switching capability is a primary differentiator from OfficeExtend, which mandates tunneling for corporate traffic.

A: OfficeExtend APs commonly support personal SSIDs for local internet access at the remote user's location; they are not unsupported. B: OfficeExtend APs rely on secure DTLS-encrypted CAPWAP tunnels to transport traffic to the WLC; they do support and use DTLS. D: FlexConnect APs do not necessarily require deployment behind a NAT router; they can function in various routed network topologies without NAT.

1. Cisco, "Enterprise Mobility 8.5 Design Guide - OfficeExtend Access Points"

Specific Section/Content: "All traffic to and from the remote wireless clients on enterprise

SSIDs is tunneled through the CAPWAP tunnel between the OEAP and the Cisco WLC.

Traffic from personal SSIDs is NATed locally to the user-™ s home network." This supports

the OfficeExtend part of option C regarding tunneling enterprise traffic.

URL: (A general search for "Enterprise Mobility 8.5 Design Guide Cisco" will lead to Cisco's

documentation. Direct deep links are often unstable, but the content is found within chapters

discussing AP modes.) For example, a similar statement is found in various WLC

Configuration Guides.

Example from a WLC Configuration Guide (similar content): Cisco Wireless LAN Controller

(WLC) Configuration Guide, Release 8.5 - OfficeExtend Access Points. "All traffic to and

from the remote wireless clients on enterprise SSIDs is tunneled through the CAPWAP

tunnel between the OEAP and the Cisco WLC." (Available on Cisco.com)

2. Cisco, "Enterprise Mobility 8.5 Design Guide - FlexConnect"

Specific Section/Content: "The FlexConnect APs can switch client data traffic locally... When

they are connected to the controller (connected mode), they can also tunnel traffic back to

the controller." This supports the FlexConnect part of option C, highlighting its capability for

local switching (terminating traffic locally).

URL: (As above, search for "Enterprise Mobility 8.5 Design Guide Cisco" or "FlexConnect

Deployment Guide Cisco".)

Example from a WLC Configuration Guide (similar content): Cisco Wireless LAN Controller

(WLC) Configuration Guide, Release 8.5 - FlexConnect. "FlexConnect access points can

switch client data traffic locally and perform client authentication locally..." (Available on

Cisco.com)

3. Cisco, "FlexConnect Deployment Guide for Cisco Wireless LAN Controllers"

Specific Section/Content: "FlexConnect APs can switch client data traffic locally... When

they are connected to the controller, they can also tunnel traffic back to the controller." This

confirms FlexConnect's local switching capability.

URL: (Search on Cisco.com for "FlexConnect Deployment Guide")

4. Cisco, "Cisco Aironet 600 Series OfficeExtend Access Points Configuration Guide, Cisco

IOS Release 15.2(2)JA"

Specific Section/Content: "The OEAP provides transparent, secure access to the corporate

network for remote workers. It connects to the controller in the enterprise network through a

secure CAPWAP tunnel over the Internet." and "Traffic from the corporate SSID is tunneled

back to the enterprise controller, while traffic from the personal SSID is NATed locally to the

user-™ s home network." This refutes option A and supports the tunneling aspect of

OfficeExtend for corporate traffic.

URL: (Search on Cisco.com for the specific guide name.)

Task 1: IPv4 Subnetting

1. Requirement: 32 sites from 172.25.0.0/16.
2. Calculation: To get 32 subnets, 5 bits are required ($2^5 = 32$).
3. New Prefix: The original /16 prefix + 5 subnet bits = /21.
4. Subnet Mask: A /21 mask is 255.255.248.0.
5. Second Subnet: The subnets increment by 8 in the third octet (e.g., 172.25.0.0, 172.25.8.0, 172.25.16.0...). The "second subnet" is 172.25.8.0/21.
6. IPs:

• First Usable (Sw101): 172.25.8.1
• Last Usable (Sw102): 172.25.15.254 (Broadcast is 172.25.15.255).

Task 2: IPv6 Subnetting

(Note: The provided question omits the IPv6 prefix. This solution assumes the standard documentation prefix 2001:db8:acad::/48 as per RFC 3849.)

1. Requirement: 32 sites from 2001:db8:acad::/48.
2. Calculation: Standard IPv6 design allocates a /64 for each subnet to support SLAAC. The /48 prefix provides 16 bits for subnetting (64 - 48), which is more than enough for 32 sites.
3. Second Subnet: We assign subnets sequentially.

• First Subnet: 2001:db8:acad:0::/64
• Second Subnet: 2001:db8:acad:1::/64

1. IPs: Per convention for a point-to-point link, the first and second usable addresses (::1 and ::2) are assigned.

• Sw101: 2001:db8:acad:1::1/64
• Sw102: 2001:db8:acad:1::2/64

Internet Engineering Task Force (IETF) RFC 1918: Address Allocation for Private Internets (February 1996). Section 3 specifies 172.16.0.0/12 as a private address range, which contains the 172.25.0.0/16 network used in this problem.

Internet Engineering Task Force (IETF) RFC 4291: IP Version 6 Addressing Architecture (February 2006). Section 2.5.1, "Interface Identifiers," establishes the 64-bit length for interface identifiers, making the /64 prefix the standard for link subnets.

Internet Engineering Task Force (IETF) RFC 3849: IPv6 Address Prefix for Documentation (July 2004). This standard reserves the 2001:DB8::/32 prefix block for use in documentation and examples, justifying the assumption of the 2001:DB8:ACAD::/48 prefix.

Cisco Systems, Inc.: IP Addressing: GUA Configuration Guide, Cisco IOS XE (Release 17). This official vendor documentation details the use of the ipv6 address [ipv6-address/prefix-length] command structure for manually assigning Global Unicast Addresses to an interface.

Cisco Systems, Inc.: IP Addressing: IPv4 Configuration Guide, Cisco IOS (Release 15.M&T). This vendor documentation details the use of the ip address [ip-address] [subnet-mask] command for configuring IPv4 addresses on a switch interface.

Dynamic ARP Inspection (DAI) is a Layer 2 security feature that mitigates ARP-based attacks. A common man-in-the-middle (MITM) attack on a local network is ARP poisoning (or spoofing), where an attacker sends falsified ARP messages to associate their MAC address with the IP address of a legitimate host, like the default gateway. This redirects traffic through the attacker's machine. DAI prevents this by intercepting all ARP packets on untrusted ports and verifying them against a trusted database of IP-to-MAC address bindings, typically built by DHCP snooping. If an ARP packet contains an invalid binding, it is dropped, thwarting the MITM attack.

A. worm: A worm is self-replicating malware. DAI does not inspect or prevent the execution of malicious code; it only validates Layer 2 ARP packets.

B. malware: This is a broad term for malicious software. DAI is not an anti-malware solution; it is a specific network security feature for ARP validation.

C. DDoS: A Distributed Denial of Service attack overwhelms a target with traffic. DAI operates at Layer 2 to validate addresses, not to mitigate high-volume traffic attacks.

1. Cisco Systems

Inc. (2023). Security Configuration Guide

Cisco IOS XE Bengaluru 17.6.x (Catalyst 9300 Switches). "Information About Dynamic ARP Inspection" section. The document states

"Dynamic ARP inspection is a security feature that validates Address Resolution Protocol (ARP) packets in a network. [...] Dynamic ARP inspection prevents malicious users from exploiting the insecure nature of the ARP protocol." It further details how this prevents man-in-the-middle attacks.

2. Odom

W. (2019). CCNA 200-301 Official Cert Guide

Volume 1. Cisco Press. Chapter 13

"Switch Security Configuration

" in the section "Preventing ARP Poisoning with Dynamic ARP Inspection

" it is explained: "The specific attack is called ARP poisoning... The goal of the attack is to create a man-in-the-middle (MITM) attack." (p. 398).

3. Carnegie Mellon University

Software Engineering Institute. (2010). CERT® Oracle® Secure Coding Standard for Java™. Addison-Wesley. In the section "ENV03-J. Do not rely on the default behavior of standard input

output

and error streams

" the text mentions ARP spoofing as a classic example of a man-in-the-middle attack that can be used to intercept network traffic. While not about DAI directly

it authoritatively classifies ARP spoofing as a MITM attack.

To enable connectivity to a remote network, a router requires a route in its routing table. This question requires configuring a static route on router R1 to reach the 172.25.25.0/24 network. The correct Cisco IOS command syntax is ip route .

In this scenario:

- The destination network is 172.25.25.0.

- The subnet mask is 255.255.255.0.

- The next-hop IP address, from R1's perspective, is the IP address of R2's directly connected interface, which is 192.168.2.2.

Therefore, the command ip route 172.25.25.0 255.255.255.0 192.168.2.2 correctly configures the static route on R1.

A. This command contains multiple syntax errors in the network address and mask. It also incorrectly uses R1's own IP address as the next-hop, which is invalid.

B. This command has syntax errors in the destination network address and uses a /32 mask (255.255.255.255), which is incorrect for routing to the /24 network.

D. This command is syntactically valid but logically incorrect because it specifies R1's own IP address (192.168.2.1) as the next hop. A router cannot route traffic to itself.

---

1. Cisco Systems

Inc. (2023). IP Routing: BGP Command Reference. "ip route" command documentation. This official reference details the command syntax ip route prefix mask {ip-address | interface-type interface-number [ip-address]}

confirming the required parameters for a next-hop static route.

2. Odom

W. (2019). CCNA 200-301 Official Cert Guide

Volume 1. Cisco Press. Chapter 13

"Implementing Static IPv4 Routing

" Section "Configuring IPv4 Static Routes

" pp. 387-389. This section explicitly describes the configuration syntax and provides examples

stating that the command requires the destination prefix

mask

and either the next-hop IP address or an exit interface.

3. University of Washington

Department of Electrical & Computer Engineering. (n.d.). EE 450 Lab 3: Static Routing. This course material demonstrates the configuration of static routes using the ip route command format in a lab environment

reinforcing the correct syntax and application.

The provided interface configuration includes the commands lldp transmit and lldp

receive. These commands enable the Link Layer Discovery Protocol (LLDP) on the

interface, which is the appropriate vendor-neutral standard for discovering third-party

devices. However, for these interface-level commands to be active, LLDP must first be

enabled globally on the router. The prompt's statement that "Neighbor discovery is

disabled" indicates that the global configuration command, lldp run, has not been

issued. Therefore, enabling LLDP globally is the necessary action to make the existing

interface configuration functional and complete.

/561

•

B. Disable autonegotiation: While it is a best practice to disable autonegotiation

(no negotiation auto) when speed and duplex are manually configured to prevent

physical layer issues, it does not address the core issue of enabling the neighbor

discovery protocol mentioned in the prompt.

•

C. Disable Cisco Discovery Protocol on the interface: Disabling the

proprietary Cisco Discovery Protocol (CDP) on an ISP-facing link is a crucial

security best practice. However, this action hardens the interface; it doesn't

enable the intended LLDP functionality, which is the primary task needed to

"complete the configuration" for neighbor discovery.

•

D. Enable LLDP-MED on the ISP device: LLDP-MED (Media Endpoint

Discovery) is an extension for voice and video endpoints (e.g., IP phones), not

for router-to-router links. Furthermore, the configuration would be on the ISP's

equipment, which the engineer does not control.

•

Cisco IOS XE Software Configuration Guide: "By default, LLDP is disabled

globally. To use LLDP on the device, you must enable it globally by using the lldp

run command... After you enable LLDP globally, all interfaces that support LLDP

are automatically enabled for both transmitting and receiving LLDP packets."

This confirms that lldp run is a prerequisite for the interface commands to

function.

o Source: Cisco, "Configuring LLDP, LLDP-MED, and Wired Location,"

Cisco IOS XE Gibraltar 16.12.x (Catalyst 9500 Switches). URL:

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9500/software/

release/16-

12/configuration_guide/if/b_1612_if_config_guide_c9500/configuring_lldp_

lldp_med_and_wired_location.html (Refer to the "Enabling LLDP" section).

•

IETF RFC for LLDP: The standard itself defines the operational state of the

protocol, which device vendors like Cisco implement with global and interface-

level controls.

o Source: IEEE, "IEEE Standard for Local and metropolitan area networks--

Link Layer Discovery Protocol," IEEE 802.1AB-2016. URL:

/561

https://ieeexplore.ieee.org/document/7433915 (DOI:

10.1109/IEEESTD.2016.7433915).

/561