200-301 CCNA practice questions: Network Access

C is correct. Topic 2.6. Cisco documents FlexConnect as the capability of an access point to put wireless client traffic directly on the network at the access point (local switching) instead of centralizing it to the controller, and describes FlexConnect access points as able to switch client data traffic locally and perform client authentication locally when their connection to the controller is lost. That is exactly the branch survivability the requirement asks for. Monitor and sniffer are the non-client-serving modes, and local mode is the default centrally switched mode in which client traffic is carried in the CAPWAP tunnel to the controller.
↗ Cisco 200-301 CCNA v1.1 Exam Topics — Section 2: Network Access

D is correct. Topic 2.1.c and 2.2.a. With router-on-a-stick each subinterface matches one VLAN tag through encapsulation dot1Q. Cisco documents that a trunk port carries the traffic of multiple VLANs and that a packet whose VLAN ID matches the native VLAN is sent untagged while all other VLANs are tagged. An access port delivers only untagged frames of a single VLAN, so Gi0/0.20 never receives a frame carrying tag 20. Making the switch port a trunk that allows both VLANs is the only change that feeds both subinterfaces; by default a trunk allows VLANs 1 to 4094, so the allowed list only has to be trimmed for hygiene.
↗ Cisco 200-301 CCNA v1.1 Exam Topics — Section 2: Network Access

A is correct. Topic 2.5.a and 2.5.b. Cisco defines the Rapid PVST+ roles as root (a forwarding port elected for the spanning-tree topology), designated (a forwarding port elected for every switched LAN segment), alternate (a blocked port providing an alternate path to the root bridge) and backup (a blocked port in a loopback configuration). The states map to behavior as follows: discarding or blocking forwards nothing and learns nothing, learning does not forward but does learn addresses, and forwarding does both. So Altn/BLK on Gi1/0/2 means a loop-free standby path toward the root that is ready to be unblocked if the root port fails.
↗ Cisco 200-301 CCNA v1.1 Exam Topics — Section 2: Network Access

A is correct. Topic 2.8. Cisco's comparison of the two AAA protocols states that TACACS+ uses TCP while RADIUS uses UDP, that TACACS+ encrypts the entire body of the packet while RADIUS encrypts only the password in the access-request packet, and that TACACS+ uses the AAA architecture, which separates authentication, authorization and accounting, whereas RADIUS combines authentication and authorization and therefore makes it difficult to decouple them. Per-command authorization is the classic consequence of that separation. The transport for the CLI session is a separate decision: Telnet is clear text, so SSH is the encrypted choice.
↗ Cisco 200-301 CCNA v1.1 Exam Topics — Section 2: Network Access

C is correct. Topic 2.2.a. The show interfaces trunk output is read as three narrowing lists: what the administrator allowed, which of those VLANs are allowed and active (they exist locally and are not shut down), and which of those are in the spanning-tree forwarding state and not pruned. VLAN 20 drops out at the second list, so the fault is on SW1 itself: the VLAN has to be created in the VLAN database (vlan 20) or brought out of shutdown before the trunk can carry it. Allowing a VLAN on a trunk never creates it. By default a trunk allows VLANs 1 to 4094, so appearing in the first list proves nothing about the VLAN existing.
↗ Cisco 200-301 CCNA v1.1 Exam Topics — Section 2: Network Access