Ports and who opens the conversation
| Protocol | Transport | Who starts it | v1.1 topic |
|---|---|---|---|
| Console | Serial line, no IP needed | You, cabled to the device | 2.8 |
| Telnet | TCP 23 | The admin’s client | 2.8 |
| SSH | TCP 22 | The admin’s client | 2.8, 4.8 |
| HTTP / HTTPS | TCP 80 / TCP 443 | A browser, toward the device’s web interface | 2.8 |
| TACACS+ | TCP 49 | The device, toward its AAA server | 2.8 |
| RADIUS | UDP 1812 and 1813 | The device, toward its AAA server | 2.8 |
| NTP | UDP 123 | The client, toward its time server | 4.2 |
| SNMP | UDP 161 manager to agent; UDP 162 agent to manager | Both sides, in different message types | 4.4 |
| Syslog | UDP 514 | The device, toward the collector | 4.5 |
| TFTP | UDP 69 | The device, as client of a file server | 4.9 |
| FTP | TCP 21 control, TCP 20 for active-mode data | The device, as client of a file server | 4.9 |
Ports per RFC 5905 (NTP), RFC 3411 and RFC 3416 (SNMP), RFC 5426 (syslog over UDP), RFC 8907 (TACACS+), RFC 2865 and RFC 2866 (RADIUS). Cisco gives Network Access 20% and IP Services 10% of v1.1; spread evenly across their topics, these seven come to roughly 9%, our estimate.
Remote access and a hardened VTY
Topic 2.8 lists the ways into a device: console, Telnet, SSH, HTTP and HTTPS, TACACS+ or RADIUS behind the login, and cloud-managed devices. Topic 4.8 narrows that to one task, setting up SSH. The order you type the commands in matters less than the dependencies between them: the RSA key pair is named from the hostname and domain name, so both must exist first, and the VTY lines need a login method that points at a user database.
In the exhibit, transport input ssh limits those lines to SSH and login local checks the local username list. Point the lines at an AAA method list instead and the same login goes to a TACACS+ or RADIUS server; the protocol split is on TACACS+ vs RADIUS, and password policy and AAA concepts belong to security concepts and VPNs.
SSH access on a lab router (IOS)
hostname EDGE1ip domain-name lab.examplecrypto key generate rsa modulus 2048username netops privilege 15 secret Lab-Only-Secret!line vty 0 4 transport input ssh login local exec-timeout 10 0Lab values: replace the domain name and the secret. Without a hostname other than the default and a domain name, IOS refuses to generate the key.
Syslog severities, most urgent first
| Level | IOS keyword | Meaning |
|---|---|---|
| 0 | emergencies | System unusable |
| 1 | alerts | Action needed immediately |
| 2 | critical | Critical condition |
| 3 | errors | Error condition |
| 4 | warnings | Warning condition |
| 5 | notifications | Normal but significant event |
| 6 | informational | Informational message |
| 7 | debugging | Debug output |
Levels per RFC 5424, section 6.2.1. A severity threshold includes its own level and every lower number: a threshold of warnings (4) delivers levels 0 through 4 and holds back 5 to 7.
NTP, SNMP and file transfer
NTP and the stratum scale
NTP organizes clocks by stratum. A stratum 1 server is attached directly to a reference clock, each step away adds one, and stratum 16 marks a clock that is not synchronized (RFC 5905). The reason the exam bothers is practical: syslog lines from five routers only line up if they share one time source, and certificate checks fail on a clock that has drifted.
SNMP versions
SNMP exposes a device’s counters and settings through its Management Information Base (MIB), each object named by an object identifier (OID). The version carries the security story. SNMPv2c authenticates with a community string that crosses the wire in clear text; SNMPv3 adds the User-based Security Model with three levels, noAuthNoPriv, authNoPriv and authPriv (RFC 3414). The comparison continues on SNMPv2c vs SNMPv3.
TFTP, FTP and their v2.0 successors
Topic 4.9 uses TFTP and FTP for moving IOS images and configuration files; know their ports and the difference in what each protocol sets up before a transfer. On v2.0, topic 4.2 replaces both with SFTP and SCP, which run inside SSH on TCP 22.
QoS tools on the path through one router
- 0000 identify traffic by ACL, protocol or an existing marking
- 0010 write a value such as EF (46) for voice
- 0020 hold a class to a configured rate
- 0030 LLQ gives voice a strict-priority queue inside CBWFQ
Where each topic goes in v2.0
| Subject | v1.1 topic | v2.0 topic |
|---|---|---|
| Management access, local users, AAA client | 2.8 | 4.1 |
| SSH setup | 4.8 | 4.1 (access); SFTP and SCP in 4.2 |
| NTP | 4.2 | Not listed |
| SNMP | 4.4 | 5.4 |
| Syslog | 4.5 | 5.6, reading messages |
| QoS per-hop behavior | 4.7 | Not listed |
| TFTP and FTP | 4.9 | Replaced by SFTP and SCP (4.2) |
Per Cisco’s v1.1 and v2.0 topic pages, checked October 29, 2026; when each list applies is on the version page.
Frames for management and QoS
This set alternates command syntax with behavior questions; for the syntax frames, say the command aloud before you look at the options. The area is also a filter on the practice test for management services.
Practice frames written by our editors for study, not Cisco items. The 200-301 exam itself mixes multiple choice, drag-and-drop and lab-style items.
Frame 001 of 017 · 0 answered · 0 ok
Keys
1–5 or A–E pick an option (on choose-N frames they toggle; then Check answer) · ← → previous / next frame · ↑ ↓ move in the frame list
- Frame 001 of 017
Which file transfer protocol is commonly used for simple, lightweight transfers but does not provide authentication or encryption?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Correct: TFTP runs on UDP 69 with no login and no encryption, which keeps it simple for moving IOS images and configs.
Note on B
SFTP runs over SSH, so it authenticates the user and encrypts the transfer.
Note on C
HTTPS encrypts with TLS and normally authenticates the server, so it is neither unauthenticated nor in clear text.
Note on D
SCP copies files over an SSH session, with authentication and encryption.
Best answer: A · why
TFTP is a minimal file transfer protocol on UDP 69: no user login, no directory listing and no encryption. It is still used to copy IOS images and configurations on trusted networks. FTP uses TCP 20 and 21 with clear-text logins, while SFTP and SCP run over SSH and are the secure choices.
- Frame 002 of 017
Which QoS field in the IP header is used by DiffServ to classify and mark packets?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Correct: the 6-bit DSCP field in the old ToS byte carries the DiffServ mark, such as EF (46) for voice.
Note on B
CoS is the 3-bit priority value in an 802.1Q tag, a Layer 2 field, not part of the IP header.
Note on C
ECN uses the remaining 2 bits of that byte to signal congestion; it is not the class marking.
Note on D
TTL limits how many hops a packet can take; QoS does not classify with it.
Best answer: A · why
DiffServ marks packets in the 6-bit DSCP field, the top six bits of the former IPv4 ToS byte (Traffic Class in IPv6). Common values are EF 46 for voice, AF classes such as AF41, and CS values. CoS is the 3-bit priority in the 802.1Q tag, and the last two bits of the byte are ECN.
- Frame 003 of 017
What protocol is used to securely access the configuration of a Cisco router remotely?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Correct: SSH encrypts the whole CLI session, including the login, so it is the standard secure remote access to IOS.
Note on B
HTTP sends everything, including credentials, in clear text.
Note on C
Telnet gives remote CLI access but sends the session and the password unencrypted.
Note on D
TFTP only moves files and has no login or encryption, so it is no way to manage a router.
Best answer: A · why
SSH (TCP 22) encrypts the management session. On IOS it needs a hostname, an ip domain-name, an RSA key (crypto key generate rsa), local or AAA users, ip ssh version 2, and transport input ssh on the vty lines. Telnet and HTTP send credentials in clear text.
- Frame 004 of 017
A network administrator needs to filter syslog messages by severity before sending them to a remote syslog server. Which command is used to configure the minimum severity level of messages that are sent?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
‘logging host’ names the server to send to; it does not set the severity filter.
Note on B
This only displays the log buffer and settings; it does not change what is sent.
Note on C
This belongs to SNMP notifications, a separate mechanism from syslog.
Note on D
Correct: ‘logging trap 4’, for example, sends levels 0 through 4 to the remote server and holds back the rest.
Best answer: D · why
logging trap followed by a level name or number sets the most verbose severity sent to syslog servers; that level and every lower, more severe number are sent. Levels: 0 emergencies, 1 alerts, 2 critical, 3 errors, 4 warnings, 5 notifications, 6 informational, 7 debugging. The server itself is set with logging host.
- Frame 005 of 017
Which characteristic of QoS measures the percentage of packets that fail to reach their destination over a network link?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Bandwidth is the capacity of the link, not how many packets go missing.
Note on B
Delay is the time a packet takes to cross the network, end to end.
Note on C
Correct: loss is the share of packets dropped on the way, usually because queues overflow.
Note on D
Jitter is the variation in delay between packets, which hurts voice and video.
Best answer: C · why
QoS describes traffic by bandwidth, delay (latency), jitter (variation in delay) and loss (packets dropped, usually from congested queues). Voice is commonly planned for one-way delay of 150 ms or less, jitter of 30 ms or less and loss of 1% or less.
- Frame 006 of 017
A router is configured for NTP and needs to be set in peer mode to synchronize its clock with a remote time source. Which command enables the router to operate as an NTP peer with a specified IP address?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
‘ntp server’ puts the router in client mode, so it takes time but never gives it back to that source.
Note on B
Correct: symmetric active mode lets the two devices synchronize each other, whichever has the better clock.
Note on C
This turns on NTP authentication; it does not define any time source.
Note on D
‘ntp master’ makes the router an authoritative source from its own clock, with no remote peer.
Best answer: B · why
IOS NTP modes: ntp server followed by an address makes the router a client of that server, ntp peer sets symmetric mode where the two devices can sync each other, and ntp master makes the router serve time from its own clock. show ntp associations shows each configured server or peer.
- Frame 007 of 017
Which command would you use to configure a router to act as an authoritative NTP time source?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
‘ntp source’ picks the interface whose address NTP packets use; it does not create a time source.
Note on B
‘ntp server’ points the router at a server, which makes it a client.
Note on C
Correct: ‘ntp master’, optionally with a stratum such as ‘ntp master 3’, makes the router serve time from its own clock.
Note on D
‘clock set’ changes the software clock by hand, and it takes no ‘ntp’ keyword.
Best answer: C · why
ntp master with an optional stratum (default 8) makes the router an authoritative NTP server based on its internal clock, which is useful in a lab or isolated network. In production, routers usually point at better sources with ntp server, and ntp source sets which interface address the packets use.
- Frame 008 of 017
Which authentication method provides stronger security than password-based authentication for SSH access to network devices?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
TACACS+ centralizes login checks, but the user still types a password unless keys or certificates are added.
Note on B
Correct: the user proves possession of a private key that never crosses the network, so there is no reusable password to steal.
Note on C
Telnet never encrypts the session, so it cannot be stronger than SSH, however the password is stored.
Note on D
PAP sends the password in a recoverable form, and RADIUS adds no strength to that method.
Best answer: B · why
With SSH public-key authentication, the device stores the user’s public key and the client proves it holds the matching private key. Nothing reusable is sent, which defeats password guessing and capture. TACACS+ and RADIUS centralize authentication but, with PAP or plain passwords, still depend on a password.
- Frame 009 of 017
Which syslog facility is typically used for messages generated by the system’s authorization system?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
KERN is reserved for operating-system kernel messages.
Note on B
Correct: the auth facility (code 4) carries security and authorization events such as logins and failed checks.
Note on C
USER is the generic facility for user-level programs, not the security subsystem.
Note on D
DAEMON covers background system services, not authorization.
Best answer: B · why
Syslog facilities (RFC 5424) label the source of a message: kern 0, user 1, daemon 3, auth 4, authpriv 10, and local0 to local7 as 16 to 23. Security and authorization messages use auth or authpriv. Cisco devices send with facility local7 by default, changed with logging facility.
- Frame 010 of 017Choose 3
Which three of the following are uses of SNMP? (Choose three.)
Choose 3 options, then Check answer. Open the note under any option to see why.
Note on A
Mapping private addresses to public ones is NAT, a router function unrelated to device monitoring.
Note on B
Correct. Agents send unsolicited traps or informs to the manager when an event such as a link going down occurs.
Note on C
Resolving names to IP addresses is the job of DNS, not SNMP.
Note on D
Correct. A manager with write access can change values in a device’s MIB with SNMP set requests.
Note on E
Correct. The manager polls agents with get requests to read MIB values such as interface counters or CPU load.
Best answers: B, D and E · why
SNMP lets a network management station read and change data on managed devices. The manager sends get requests to read MIB objects and set requests to change them, usually on UDP port 161. Agents also send unsolicited traps or acknowledged informs to the manager, on UDP port 162, when something happens. Address translation and name resolution belong to NAT and DNS.
- Frame 011 of 017
A network engineer wants to ensure that during periods of high traffic, email packets are queued rather than discarded. Which traffic management technique should be configured on the network device?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Correct: shaping holds traffic above the rate in a buffer and sends it later, so email waits instead of being dropped.
Note on B
Policing drops or re-marks traffic above the rate on the spot, which is exactly what should be avoided here.
Note on C
Marking only labels packets with DSCP or CoS; it does not decide whether they are queued or dropped.
Note on D
Classification sorts traffic into classes, a first step that neither buffers nor drops anything.
Best answer: A · why
Policing and shaping both enforce a rate. A policer drops or re-marks the excess immediately; a shaper queues it and sends it as capacity frees up, adding delay but avoiding loss. Shaping is applied outbound. Classification and marking only identify traffic so that later tools can act on it.
- Frame 012 of 017
Which QoS queuing mechanism allocates bandwidth fairly among different flows based on packet size and arrival time?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Correct: WFQ shares the link among flows, using packet size and arrival time so that small, low-volume flows are not starved.
Note on B
Priority queuing always empties the higher queue first, which is the opposite of fair sharing.
Note on C
Custom queuing cycles through queues by configured byte counts; it does not track individual flows.
Note on D
FIFO sends packets in arrival order from one queue, with no notion of flows.
Best answer: A · why
Weighted Fair Queuing sorts traffic into flows automatically and schedules by a virtual finish time that depends on packet size and arrival, so light flows get through quickly and heavy flows share the rest. CBWFQ extends this with configured classes, and LLQ adds a strict-priority queue for voice.
- Frame 013 of 017
Which command configures a Cisco router to send syslog messages to a server at 10.20.30.40?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
IOS has no ‘syslog host’ command; remote logging starts with the ‘logging’ keyword.
Note on B
‘logging server’ is not the IOS syntax for a remote collector.
Note on C
Correct: ‘logging host 10.20.30.40’ (or the short ‘logging 10.20.30.40’) sends syslog messages to that server over UDP 514.
Note on D
‘log-server’ is not an IOS command.
Best answer: C · why
logging host followed by an address (older IOS also accepts logging followed by the address) sends syslog messages to a remote server, by default over UDP 514. logging trap sets the severity sent, logging source-interface fixes the source address, and service timestamps adds dates to messages.
- Frame 014 of 017
Which of the following commands will configure an SSH server on a Cisco router in a secure manner?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
IOS has no ‘ip ssh enable’; the SSH server starts once an RSA key pair exists.
Note on B
SSH version 1 has known weaknesses, so forcing it is the insecure choice.
Note on C
There is no ‘ip ssh incoming’ command; incoming SSH is allowed with ‘transport input ssh’ on the vty lines.
Note on D
Correct: it restricts the server to SSHv2, which fixes the protocol flaws of version 1.
Best answer: D · why
The IOS SSH server comes up when an RSA key exists (crypto key generate rsa, with a hostname and ip domain-name set). ip ssh version 2 disables the weaker version 1. The vty lines then need login local or AAA and transport input ssh, so that Telnet is refused.
- Frame 015 of 017
Which command displays detailed NTP association information, including delay, offset, jitter, and reachability statistics for each configured NTP peer on a Cisco router?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
This is not the IOS command for per-peer details; delay and offset per peer come from the associations view.
Note on B
The status view reports the router’s own sync state and stratum, and this filter narrows it further to one line.
Note on C
Correct: the detail form prints every peer’s reach, delay, offset, dispersion and jitter, plus its mode and stratum.
Note on D
On IOS, peers are listed by the associations command, not by this one.
Best answer: C · why
show ntp associations lists each server or peer with stratum, reach, delay, offset and dispersion; adding detail gives full per-peer data such as jitter, mode and timestamps. show ntp status reports whether the router itself is synchronized, to which source and at what stratum.
- Frame 016 of 017
A network administrator needs to configure a router interface as an NTP client to synchronize with an NTP server at 10.1.1.1. Which command should be used?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
‘clock set’ sets the time by hand and takes no NTP server address.
Note on B
‘ntp master’ makes the router a time source, the opposite of a client.
Note on C
Correct: ‘ntp server 10.1.1.1’ makes the router a client that synchronizes to that server.
Note on D
IOS has no ‘ntp client’ command; client mode comes from ‘ntp server’.
Best answer: C · why
In IOS, ntp server 10.1.1.1 is a global command that makes the device an NTP client of that server; once synchronized it can also serve time downstream. show ntp status should then report it synchronized, and show ntp associations marks the chosen server with an asterisk.
- Frame 017 of 017
Which term describes the classification level in Quality of Service (QoS) marking?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Correct: CoS is the 3-bit priority value in the 802.1Q tag that marks a frame’s class, from 0 to 7.
Note on B
Stratum is NTP’s distance from a reference clock, not a QoS mark.
Note on C
Administrative distance ranks routing sources; it has nothing to do with marking traffic.
Note on D
A mnemonic is the code at the end of an IOS syslog message tag, such as UPDOWN, not a QoS term.
Best answer: A · why
Class of Service is the 3-bit priority field in the 802.1Q tag, values 0 to 7, used to mark frame priority at Layer 2 (voice usually 5). At Layer 3 the same job is done by DSCP in the IP header, and switches can map between the two at trust boundaries.
Management and QoS, briefly
Does the CCNA expect QoS configuration?
Not on v1.1: topic 4.7 asks you to explain per-hop behavior such as classification, marking, queuing, policing and shaping. The v2.0 list drops QoS altogether.
Is Telnet still on the exam?
Yes, by name. v1.1 topic 2.8 lists Telnet among the management access methods, alongside SSH, console and HTTPS, so know its port and where it fits among them.
Which SNMP security level should a lab use?
authPriv, the SNMPv3 level that both authenticates and encrypts. The other two levels exist mostly for compatibility and troubleshooting.
Concepts in this study area
- SNMPv2c vs SNMPv3Managers, agents, MIBs, traps, communities and USM levels.