Cisco 200-301 Online Practice Questions and Exam Preparation

Cisco 200-301 Online Questions & Answers

• Question 381:

  Which QoS mechanism drops packets that exceed a configured rate?

  A. Shaping
  B. Policing
  C. Marking
  D. Queuing
  B. Policing

  ---

  Policing enforces bandwidth limits by dropping or remarking packets that exceed a defined rate. Unlike shaping, policing does not buffer excess traffic.

• Question 382:

  DRAG DROP

  Drag and drop the functions of AAA supporting protocols from the left onto the protocols on the right.

  Select and Place:

  

  

• Question 383:

  Refer to the exhibit.

  

  Packets are flowing from 192.168.10.1 to the destination at IP address 192.168.20.75. Which next hop will the router select for the packet?

  A. 10.10.10.1
  B. 10.10.10.11
  C. 10.10.10.12
  D. 10.10.10.14
  B. 10.10.10.11

• Question 384:

  Which WPA mode uses PSK authenticaton?

  A. Local
  B. Personal
  C. Enterprise
  D. Client
  B. Personal

  ---

  The WPA mode that uses PSK (Pre-Shared Key) authentication is the Personal mode.

  WPA (Wi-Fi Protected Access) is a security protocol used in wireless networks to protect the communication between devices. WPA has two modes of operation: Personal mode and Enterprise mode.

  Personal mode, also known as WPA-PSK (Pre-Shared Key), uses a shared secret key (PSK) to authenticate wireless clients and encrypt network traffic. The PSK is a passphrase or password that is shared between the access point and wireless clients.

  Enterprise mode, also known as WPA-EAP (Extensible Authentication Protocol), uses a RADIUS (Remote Authentication Dial-In User Service) server to authenticate wireless clients. Enterprise mode provides stronger security than Personal mode, but it requires more setup and infrastructure.

  In summary, WPA-Personal mode uses PSK authentication, while WPA-Enterprise mode uses RADIUS server authentication.

• Question 385:

  A customer wants to provide wireless access to contractors using a guest portal on Cisco ISE. The portal is also used by employees. A solution is implemented, but contractors receive a certificate error when they attempt to access the portal. Employees can access the portal without any errors. Which change must be implemented to allow the contractors and employees to access the portal?

  A. Install an Internal CA signed certificate on the Cisco ISE.
  B. Install a trusted third-party certificate on the Cisco ISE.
  C. Install an internal CA signed certificate on the contractor devices.
  D. Install a trusted third-party certificate on the contractor devices.
  B. Install a trusted third-party certificate on the Cisco ISE.

  ---

  The certificate error experienced by contractors suggests that their devices do not trust the certificate presented by the Cisco ISE for the guest portal. To resolve this, a trusted certificate needs to be installed on the Cisco ISE, which is signed by a trusted third-party certificate authority (CA). This ensures that when contractors connect to the guest portal, their devices recognize the certificate as valid and trusted.

  Option A, installing an internal CA signed certificate on the Cisco ISE, would only address certificate errors for devices within the same organization that have the internal CA's root certificate installed as a trusted root. It would not resolve certificate errors for external contractors' devices.

  Options C and D involve installing certificates on the contractor devices. However, this would require distributing and configuring certificates on each contractor device individually, which may not be practical or feasible in this scenario.

  https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine-software/200295-Install-a-3rd-party-CA-certificate-in-IS.html

• Question 386:

  Refer to the exhibit. An engineer assumes a configuration task from a peer Router A must establish an OSPF neighbor relationship with neighbor 172 1 1 1 The output displays the status of the adjacency after 2 hours. What is the next step in the configuration process for the routers to establish an adjacency?

  

  A. Configure router A to use the same MTU size as router B
  B. Set the router B OSPF ID to a nonhost address.
  C. Configure a point-to-point link between router A and router B
  D. Set the router B OSPF ID to the same value as its IP address
  A. Configure router A to use the same MTU size as router B

• Question 387:

  What are two protocols within the IPsec suite? (Choose two.)

  A. 3DES
  B. AES
  C. ESP
  D. TLS
  E. AH
  C. ESP
  E. AH

  ---

  IPsec (Internet Protocol Security) is a suite of protocols used for securing internet protocol (IP) communications. The two protocols within the IPsec suite are:

  Authentication Header (AH): AH provides data authentication and integrity protection for IP packets, but does not provide encryption. AH calculates a hash value over the IP packet and some additional data, and places the result in a new header that is added to the packet.

  Encapsulating Security Payload (ESP): ESP provides both encryption and data authentication for IP packets. ESP encrypts the original IP packet and places it inside a new packet, along with a new ESP header that provides data authentication and integrity protection.

  Both AH and ESP protocols can be used alone or in combination to provide secure communication between two network devices. AH and ESP are often used in conjunction with the Internet Key Exchange (IKE) protocol, which is used to negotiate and establish security associations (SAs) between devices.

• Question 388:

  What is the main purpose of SSH management access?

  A. to enable secured access to the inbound management interface
  B. to allow passwords protected with HTTPS encryption to be sent
  C. to validate management access with username and domain name only
  D. to support DES 56-bit and 3DES (168-bit) ciphers
  A. to enable secured access to the inbound management interface

• Question 389:

  You are configuring your edge routers interface with a public IP address for Internet connectivity. The router needs to obtain the IP address from the service provider dynamically. Which command is needed on interface FastEthernet 0/0 to accomplish this?

  A. ip default-gateway
  B. ip route
  C. ip default-network
  D. ip address dhcp
  E. ip address dynamic
  D. ip address dhcp

  ---

  obtain the IP address from the service provider dynamically means obtaining an IP address from a DHCP server.

• Question 390:

  Refer to the exhibit.

  

  Which switch becomes the root bridge?

  A. SW 1 Bridge Priority - 32768 mac-address 0f:d7:9e:13:ab:82
  B. SW 2 Bridge Priority - 40960 mac-address 05:d8:33:09:8f:89
  C. SW 3 Bridge Priority - 32768 mac-address 01:1c:6c:66:b7:70
  D. SW 4 Bridge Priority - 40960 mac-address 04:44:97:51:63:17
  C. SW 3 Bridge Priority - 32768 mac-address 01:1c:6c:66:b7:70

  ---

  lowest priority, and lowest MAC address