Cisco Updated 200-301 Exam Questions and Answers by nancie

Answer A,B is correct: A. SW(config-if)=switchport port-security mac-address sticky; B. SW(config-if)=switchport port-security violation restrict. Sticky MAC learning lets the switch dynamically learn secure MAC addresses and add them to the running configuration. The restrict violation mode drops unauthorized traffic and generates log/SNMP notifications without shutting down the interface. That exactly matches the requirements: dynamic learning and log messages without disabling the port. A statically configured MAC address fails the dynamic-learning requirement, and violation shutdown would place the interface into err-disabled state. Cisco CCNA 200-301 v1.1 Network Access and Security Fundamentals expect precise understanding of port-security violation modes: protect drops silently, restrict drops and logs, and shutdown disables the port. The corrected answer pair is sticky MAC learning and violation restrict.

software-defined controller for automation of devices and services. Automation questions require recognizing data structures, HTTP methods, APIs, controllers, and the separation of northbound and southbound communication. Cisco CCNA 200-301 v1.1 includes this under Automation and Programmability, where the expected skill is to identify the feature that actually creates the observed behavior or meets the configuration goal. The wording usually contains the decisive clue: a prefix length, a VLAN role, a protocol version, a wireless security standard, or a management-plane function. Distractors mix application-facing and device-facing roles or confuse values, keys, arrays, and objects. In an operational network, choosing the wrong option would typically cause failed connectivity, insecure management, poor wireless behavior, or incorrect forwarding. The selected answer matches the Cisco configuration model and is retained as the verified answer.

Answer A,C is correct: A. AH; C. ESP. AH and ESP are the two protocol headers that belong directly to the IPsec suite. Authentication Header provides integrity and authentication for IP packets, while Encapsulating Security Payload provides confidentiality and can also provide integrity and authentication depending on configuration. AES and 3DES are encryption algorithms used by security protocols, not IPsec protocols themselves. TLS is a separate transport/application security protocol used for services such as HTTPS, not an IPsec suite protocol. Cisco CCNA 200-301 v1.1 Security Fundamentals expects candidates to separate security protocols from cryptographic algorithms. The original AES/TLS answer was wrong because it selected one cipher and one non-IPsec protocol. The corrected answer is AH and ESP because those are the IPsec protocol components used to protect traffic at the IP layer.

Ipv6 address autoconfig. IP services questions require matching the protocol or service to its exact role in monitoring, addressing, traffic treatment, or application access. Cisco CCNA 200-301 v1.1 includes this under Network Fundamentals, where the expected skill is selecting the feature that actually produces the requested network behavior. The wording normally gives the clue: protocol family, address scope, trunk state, route preference, security mode, API method, or controller role. The wrong choices name real services but solve a different operational problem. In production, choosing the wrong option would typically cause failed client access, a broken route, insecure management, or an automation workflow that targets the wrong interface. The selected answer is the Cisco-consistent behavior for this item.