CCNA Switching and Network Access Practice Test 10 — 15 Questions

Question 1

Why is PortFast typically enabled on switch ports connected to end devices?

Accepted Answer

To let end-device ports reach forwarding state more quickly. PortFast is enabled so access ports connected to end devices can move to forwarding more quickly instead of waiting through the normal spanning-tree listening and learning transitions. In plain language, it helps a user’s PC, printer, or similar endpoint start communicating sooner after the link comes up. That can reduce delays at startup and prevent certain device timeout problems.

PortFast is not intended as a loop-prevention mechanism by itself, and it should not normally be used carelessly on links to other switches. That is why it is commonly paired with BPDU Guard on edge ports. The correct answer is the one focused on faster transition for end-device access links rather than on unrelated routing or VLAN functions.

Answer

To make access ports participate in OSPF

Answer

To convert all access ports into trunks

Answer

To disable Ethernet addressing on PCs

Question 2

A switchport connected to an IP phone and a PC must carry user traffic and voice traffic separately. Which feature is designed for that purpose on a Cisco access port?

Accepted Answer

Voice VLAN. The correct feature is a voice VLAN. In plain language, a voice VLAN lets the switch treat the IP phone’s traffic differently from the user PC’s traffic even though both devices may be connected through the same physical access port. The phone can tag voice traffic for the voice VLAN while the PC remains in the normal data access VLAN. This is a practical design because it keeps voice traffic logically separate, which helps with policy, QoS, and management.

This is a classic CCNA switching concept because it shows that one physical edge port can still support more than one logical traffic type in a controlled way. A standard access VLAN by itself would not provide the same voice/data separation. EtherChannel, SPAN, and native VLAN concepts solve different problems. The best answer is the feature specifically built to support phones and workstations together on one access connection while keeping their traffic logically distinct.

Answer

EtherChannel

Answer

SPAN

Answer

Native VLAN

Question 3

A switch port should allow an IP phone and attached PC to operate correctly. The phone should place voice traffic in VLAN 200 while the PC remains in VLAN 20. Which configuration approach best supports that design?

Accepted Answer

Configure the port with an access VLAN for data and a voice VLAN for the phone. The best approach is to configure the access VLAN for user data and the voice VLAN separately. In plain language, the PC should remain a normal untagged data endpoint in VLAN 20, while the phone can tag its own voice traffic for VLAN 200. Cisco access-port designs support this exact use case and allow the switch to keep voice and user traffic logically separated without requiring two physical ports.

This is a classic CCNA edge-port design. It is not a general trunking problem, and it does not require EtherChannel or router subinterfaces. The important idea is that one switchport can support an access VLAN and a voice VLAN together in a way designed specifically for IP phones with downstream PCs.

Answer

Configure the port as a routed port with no switchport

Answer

Configure the port as an EtherChannel member

Answer

Use a native VLAN only and disable all tagging

Question 4

A switch interface connected to another switch must carry VLANs 10, 20, and 30 only. Which command best enforces that requirement on the trunk?

Accepted Answer

switchport trunk allowed vlan 10,20,30. The correct command is the one that explicitly sets the allowed VLAN list on the trunk. In plain language, the administrator wants the inter-switch link to carry only the named VLANs instead of every VLAN by default. Cisco trunks can transport multiple VLANs, but that does not mean every VLAN should always be permitted. Restricting the allowed list supports cleaner design and helps reduce unnecessary VLAN transport.

This is a common CCNA switching task because it distinguishes between creating a trunk and controlling what the trunk actually carries. Simply enabling trunking is not enough when the requirement names exact VLANs. The answer must directly restrict the allowed list rather than change the native VLAN or apply an unrelated access-port command.

Answer

switchport access vlan 10,20,30

Answer

switchport mode dynamic auto

Answer

switchport trunk native vlan 10,20,30

Question 5

A port connected to an end-user PC should not send or expect VLAN tags from the endpoint. Which interface type is appropriate on the switch?

Accepted Answer

Access port. The appropriate interface type is an access port. In plain language, a normal user PC is expected to connect to one VLAN and send ordinary untagged Ethernet frames. The switch associates that traffic with the configured access VLAN. This is different from a trunk, which is designed to carry multiple VLANs and commonly uses tagging to preserve VLAN identity across the link. Routed ports are Layer 3 interfaces used for routing between VLANs, not for attaching a single end-user PC. Port-channel interfaces aggregate multiple physical links for redundancy and bandwidth, but they do not determine whether VLAN tagging is used; the underlying port mode (access or trunk) still applies. Therefore, access port is the only correct choice for an untagged, single-VLAN end-device connection.

Answer

Trunk port

Answer

Routed port

Answer

Port-channel interface

Question 6

A trunk between two switches is up, but users in VLAN 40 cannot communicate across it. The output shows both sides allow VLAN 40. What is another likely trunk-related cause to check next?

Accepted Answer

Native VLAN mismatch between the two trunk ends. If VLAN 40 is allowed on both ends and the trunk is up, a native VLAN mismatch is still worth checking because trunk problems are not limited to the allowed VLAN list. In plain language, the link may be carrying traffic, but if the two switches disagree on how untagged traffic should be treated, behavior can still become unpredictable. Native VLAN mismatches are a well-known source of warnings and unexpected traffic handling on 802.1Q trunks.

That does not mean every VLAN problem is caused by the native VLAN, but once the obvious allowed-list issue has been ruled out, it becomes a logical next trunk-specific item to verify.

Answer

Missing router ID in OSPF

Answer

Incorrect NTP source interface

Answer

Lack of PAT overload on the WAN router

Question 7

Which command places a switch interface into trunking mode directly instead of relying on negotiation?

Accepted Answer

switchport mode trunk. The direct command is `switchport mode trunk`. In plain language, this tells the switch to behave as a trunk port rather than waiting to negotiate that role through DTP. That makes the administrative intent clear and avoids ambiguity. In many production environments, explicit configuration is preferred because it is easier to understand and troubleshoot than relying on negotiation behavior.

This is a core CCNA switching idea because trunks and access ports serve very different purposes. The wrong answers either describe negotiation states or commands that relate to other aspects of VLAN behavior. The best answer is the one that directly forces the interface into trunk mode instead of merely suggesting or passively waiting for trunking.

Answer

switchport access vlan 10

Answer

switchport mode dynamic auto

Answer

spanning-tree portfast

Question 8

A switch trunk is carrying several VLANs, but VLAN 99 traffic is failing. The trunk allowed list includes VLAN 99 on both sides. Which statement best explains why a VLAN can still fail even when it is allowed?

Accepted Answer

Because the VLAN may still be absent, inactive, or otherwise not operational locally even if it is allowed on the trunk. A VLAN can still fail across a trunk even when it is allowed because the allowed list is only one part of the overall design. In plain language, a switch may permit the VLAN on the link, but if the VLAN does not actually exist locally, is not active, or if some other trunk characteristic is inconsistent, traffic can still fail. This is an important CCNA troubleshooting principle: one correct line of configuration does not guarantee the full end-to-end condition is correct.

Candidates often stop at the allowed VLAN list because it is visible in common show commands. However, VLAN presence, local status, and other trunk parameters still matter. The best answer is the one recognizing that permission on the trunk does not automatically prove the entire VLAN path is healthy.

Answer

Because allowing a VLAN on a trunk automatically disables it

Answer

Because VLANs can cross trunks only when PAT is enabled

Answer

Because VLAN 99 must always be the native VLAN

Question 9

A switchport should automatically disable itself if too many MAC addresses are learned beyond the configured secure limit. Which port-security violation mode causes that behavior?

Accepted Answer

shutdown. Shutdown is the violation mode that error-disables the port. In plain language, when the switch sees a port-security violation under shutdown mode, it reacts by taking the interface out of service rather than simply dropping frames quietly. That behavior is useful when the administrator wants a clear and strong response to unauthorized devices.

This matters because port security has several violation modes and they do not behave the same way. Restrict and protect can keep the interface up, while shutdown is the mode associated with the most visible response.

Answer

protect

Answer

restrict

Answer

dynamic

Question 10

Match each trunking or switchport term to its most accurate description.

Accepted Answer

Trunk port: Carries traffic for multiple VLANs using tagging. These terms define how switchports handle VLAN traffic in trunking environments.

Question 11

A switchport connected to another switch is configured as an access port by mistake. Which symptom is most likely in a multi-VLAN design?

Accepted Answer

Only one VLAN is likely to pass correctly, while other VLAN traffic across the link fails. The most likely symptom is that only one VLAN’s traffic works correctly across the link while traffic for other VLANs fails. In plain language, an access port belongs to one VLAN in normal switching behavior. If an inter-switch link that should carry multiple VLANs is accidentally configured as an access port, the network loses the ability to transport the other VLANs.

The physical link may stay up, which can make the problem seem subtle, but the logical role of the port is wrong.

Answer

The link negotiates as a trunk but drops all VLAN traffic

Answer

The switch generates excessive broadcasts on all VLANs

Answer

The switch stops learning MAC addresses entirely

Question 12

A Layer 2 switch port connected to an end host should move to forwarding quickly but also shut down if a BPDU is received. Which pair of features best supports that design?

Accepted Answer

PortFast and BPDU Guard. PortFast and BPDU Guard are the right pair. In plain language, PortFast makes an edge port usable quickly for a real end device, while BPDU Guard protects that same port by shutting it down if spanning-tree control traffic appears unexpectedly.

This is a classic access-layer design. PortFast improves usability, and BPDU Guard improves safety. The best answer combines both functions.

Answer

Root Guard and UDLD

Answer

Loop Guard and native VLAN

Answer

Port security and EtherChannel

Question 13

A trunk link between two switches is operational, but one side shows a native VLAN mismatch warning. What is the main concern with that condition?

Accepted Answer

Untagged traffic may be associated with different VLANs on each end of the trunk. A native VLAN mismatch can cause untagged traffic to be interpreted as belonging to different VLANs on each end of the trunk. In plain language, the two switches disagree about where untagged frames belong. That can lead to confusing traffic behavior, reachability problems for certain flows, and operational warnings. It is not always a total outage, but it is a design inconsistency that should be corrected.

This matters because trunks carry multiple VLANs, and the native VLAN defines how untagged traffic is handled. If both ends do not agree, the logical treatment of those frames becomes inconsistent. The correct answer is the one that focuses on misclassification of untagged traffic, not on unrelated routing behavior.

Answer

All tagged VLAN traffic is automatically converted to routed traffic

Answer

The mismatch forces OSPF adjacency reset on all routers

Answer

The trunk can carry only one VLAN until the mismatch is cleared

Question 14

A multilayer switch has SVIs for VLAN 10 and VLAN 20, but hosts in those VLANs still cannot reach each other. The SVIs are up/up. Which additional condition is most likely required?

Accepted Answer

IP routing must be enabled on the multilayer switch. If the SVIs are up but inter-VLAN traffic still fails, the most likely missing condition is that IP routing is not enabled on the multilayer switch. In plain language, the switch has the VLAN gateway interfaces present, but it has not been told to behave as a Layer 3 router between them. Without IP routing enabled, the SVIs can exist and still not actually route traffic between VLANs.

This is a classic multilayer-switch design issue because many learners assume the presence of SVIs alone automatically creates routing. In reality, routed forwarding between VLANs still requires the switch to operate as a Layer 3 device. That is why enabling routing is the best answer.

Answer

Every access port must be converted to a trunk

Answer

DHCP snooping must be disabled globally

Answer

The switch must remove all VLAN assignments

Question 15

Which command places a switch port into access mode directly?

Accepted Answer

switchport mode access. A switch port is placed into access mode with the `switchport mode access` command. In plain language, this tells the switch that the interface should behave as a single-VLAN user-facing access port rather than as a trunk or a negotiation-based port. This is the normal choice for an endpoint such as a PC, printer, or IP camera that should belong to one VLAN.

This command matters because it makes the intended role of the interface explicit. That clarity is useful operationally and helps avoid accidental trunking behavior. The correct answer is the command that directly defines the switchport as access rather than assigning a VLAN without setting the role or relying on negotiation.

Answer

switchport trunk allowed vlan 10

Answer

switchport mode dynamic desirable

Answer

no switchport