Free 200-301 Exam Braindumps
Cisco Certified Network Associate (CCNA) Questions 641–645 (page: 130)

Updated On: 10-Feb-2026

Refer to the exhibit. A network administrator must permit SSH access to remotely manage routers in a network. The operations team resides on the 10.20.1.0/25 network. Which command will accomplish this task?

  1. access-list 2699 permit udp 10.20.1.0 0.0.0.255
  2. no access-list 2699 deny tcp any 10.20.1.0 0.0.0.127 eq 22
  3. access-list 2699 permit tcp any 10.20.1.0 0.0.0.255 eq 22
  4. no access-list 2699 deny ip any 10.20.1.0 0.0.0.255

Answer(s): D

Explanation:

Already a statement is there in last to allow SSH Traffic for network 10.20.1.0 0.0.0.127, but Second statement says deny ip any 10.20.1.0 0.0.0.255, so how it will work once it is denied. So the right answer is remove the --- no access-list 2699 deny ip any 10.20.1.0 0.0.0.255.



A port security violation has occurred on a switch port due to the maximum MAC address count being exceeded. Which command must be configured to increment the security-violation count and forward an SNMP trap?

  1. switchport port-security violation access
  2. switchport port-security violation protect
  3. switchport port-security violation restrict
  4. switchport port-security violation shutdown

Answer(s): C


Reference:

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/25ew/configuration/guide/conf/port_sec.html



What is a practice that protects a network from VLAN hopping attacks?

  1. Enable dynamic ARP inspection
  2. Configure an ACL to prevent traffic from changing VLANs
  3. Change native VLAN to an unused VLAN ID
  4. Implement port security on internet-facing VLANs

Answer(s): C



Where does a switch maintain DHCP snooping information?

  1. In the CAM table
  2. In the frame forwarding database
  3. In the MAC address table
  4. In the binding database

Answer(s): D



A network administrator must configure SSH for remote access to router R1. The requirement is to use a public and private key pair to encrypt management traffic to and from the connecting client. Which configuration, when applied, meets the requirements?

  1. R1#enable R1#configure terminal R1(config)#ip domain-name cisco.com R1(config)#crypto key generate ec keysize 1024
  2. R1#enable R1#configure terminal R1(config)#ip domain-name cisco.com R1(config)#crypto key generate ec keysize 2048
  3. R1#enable R1#configure terminal R1(config)#ip domain-name cisco.com R1(config)#crypto key encrypt rsa name myKey
  4. R1#enable R1#configure terminal R1(config)#ip domain-name cisco.com R1(config)#crypto key generate rsa modulus 1024

Answer(s): D



Viewing page 130 of 281
Viewing questions 646 - 650 out of 1395 questions


Post your Comments and Discuss Cisco 200-301 exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!