CCNA Switching and Network Access Practice Test 11 — 15 Questions

Question 1

Exhibit: After a new switch was connected, the access-layer port went into err-disabled state immediately. Which feature most likely caused this?

Accepted Answer

BPDU Guard. BPDU Guard is the most likely cause because it immediately places a PortFast-enabled port into the err-disabled state upon receiving any BPDU, which is exactly what happens when a new switch is connected to an access port meant for end devices. Root Guard does not err-disable a port; instead, it puts the port into a root-inconsistent state when a superior BPDU is received, preventing the port from becoming a root port but still allowing traffic. UDLD aggressive can cause err-disabled states, but it is specifically designed to detect unidirectional links on fiber connections and requires a delay or misconfiguration, making it less immediate than BPDU Guard in this scenario. Storm control can err-disable a port if traffic exceeds thresholds, but this is not immediate upon connection unless a broadcast storm is already occurring, which is not indicated in the scenario.

Answer

Root Guard

Answer

UDLD aggressive

Answer

Storm control

Question 2

A switchport is configured as an access port for VLAN 20, but users connected to it cannot reach the default gateway. The switch shows the interface as up/up. Which switch misconfiguration is the most likely cause?

Accepted Answer

VLAN 20 has not been created on the switch. If the access port is assigned to VLAN 20 but VLAN 20 does not exist in the VLAN database, traffic is not placed into a usable VLAN and hosts lose connectivity. The port can still appear physically up while forwarding fails at Layer 2.

Answer

The access port is missing a speed command

Answer

The switch has not enabled VTP transparent mode

Answer

The port should use DTP desirable mode

Question 3

A two-switch EtherChannel bundle is configured with LACP. One side uses active mode on both member links, while the other side uses passive mode on both member links. What is the result?

Accepted Answer

The bundle forms successfully. LACP forms a channel when at least one side actively sends negotiation frames. Active-to-passive works. Passive-to-passive would fail, but that is not the case here.

Answer

The links remain individual because both sides must use active

Answer

The bundle forms only if PAgP is also enabled

Answer

The channel comes up but forwards only one VLAN

Question 4

Exhibit: A switch interface connected to an IP phone and PC is configured as an access port in VLAN 10. The PC works, but the phone does not register. What additional configuration is most likely needed?

Accepted Answer

switchport voice vlan <voice-vlan-id>. An IP phone commonly requires a voice VLAN so tagged voice traffic is separated from the data VLAN used by the attached PC. Without a voice VLAN, the PC can still work on the access VLAN while the phone fails to register properly.

Answer

switchport trunk encapsulation dot1q

Answer

channel-group 1 mode active

Answer

ip helper-address on the switchport

Question 5

Exhibit: Users on SW2 in VLAN 30 can reach local devices but not hosts in VLAN 30 on SW1. What is the most likely reason?

Accepted Answer

VLAN 30 is not allowed on the trunk. The trunk is allowing only VLANs 10 and 20. Even though both switches have VLAN 30 defined locally, VLAN 30 traffic cannot cross the trunk unless that VLAN is allowed on the link. Option A is incorrect because the native VLAN (default 1) does not affect tagged VLAN 30 traffic, and native VLAN mismatch causes different issues. Option C is incorrect because VTP is used for VLAN database synchronization, not for forwarding traffic over a trunk; switches do not need to be VTP servers to pass VLAN traffic. Option D is incorrect because spanning tree only blocks redundant paths to prevent loops, not all user VLANs by default.

Answer

The trunk native VLAN is 1 on both sides

Answer

SW2 must run VTP server mode

Answer

Spanning tree blocks all user VLANs by default

Question 6

Exhibit: A switch port connected to an end host is stuck in a blocking state much longer than expected after a reboot. Which configuration change most directly speeds host access while still keeping loop protection elsewhere?

Accepted Answer

Enable PortFast on the access port. PortFast should be enabled on access ports that connect to end devices. It lets the port move to forwarding quickly without waiting through normal STP listening and learning delays. Disabling STP globally removes all loop protection, which contradicts the requirement to keep loop protection elsewhere. Changing the trunk native VLAN is irrelevant to an access port's STP state transition. Adjusting duplex has no effect on STP timers and would not speed up host access.

Answer

Disable STP globally

Answer

Change the trunk native VLAN

Answer

Set the port to half-duplex

Question 7

Exhibit: A wireless client can see the SSID and associates successfully, but it never gets network access. Other users on the same SSID work. Which issue is the best fit?

Accepted Answer

The client failed to obtain a valid IP address from DHCP. Successful association means the radio connection is up. If only one client fails to get network access while others work, the most likely issue is a client-specific addressing problem such as not obtaining a valid DHCP lease. Option A is incorrect because channel width affects all clients, not just one. Option C is incorrect because hiding the SSID does not affect network access after association. Option D is incorrect because WPA2 does not block clients due to NTP; NTP is unrelated to client authentication.

Answer

The AP is advertising the wrong channel width

Answer

The SSID must be changed from broadcast to hidden

Answer

WPA2 automatically blocks clients until NTP is configured

Question 8

Two switches are connected with EtherChannel using LACP. One side is configured with mode active and the other side with mode passive. What happens?

Accepted Answer

The channel forms successfully. LACP forms an EtherChannel when at least one side actively negotiates. Active plus passive is a valid combination, so the bundle comes up if the physical settings match.

Answer

The channel stays down because both sides must be active

Answer

The channel forms only if PAgP is also enabled

Answer

The channel becomes a static Port-Channel

Question 9

Two switches are connected via an IEEE 802.1Q trunk. Hosts in VLAN 30 on opposite sides cannot communicate, yet hosts in VLAN 10 communicate normally. Both switches have VLAN 30 in their VLAN database, and the trunk link is operational. What is the most likely cause?

Accepted Answer

VLAN 30 is pruned or not allowed on one side of the trunk. If a VLAN is not allowed on one side of the trunk, frames for that VLAN are dropped even though other VLANs continue to work. Option A correctly identifies that VLAN 30 is either pruned or missing from the allowed list on one end. Option B is wrong because the native VLAN only affects untagged frames and would not cause the filtering of a tagged VLAN like VLAN 30. Option C is incorrect because STP can block individual VLANs per port, but it does not block all VLANs on a trunk due to a single VLAN’s issue—only the affected VLAN would be blocked. Option D is invalid because converting the trunk to access mode would break all VLAN trunking, including the working VLAN 10.

Answer

The native VLAN must be set to 30

Answer

STP blocks all VLANs on the trunk when one VLAN fails

Answer

The trunk must be changed to access mode for VLAN 30

Question 10

Exhibit: An access switch shows Gi1/0/10 as err-disabled shortly after an IP phone and a workstation are connected through the same wall jack. What is the most likely cause?

Accepted Answer

The port security maximum is too low for the connected devices. With a phone and a PC on the same access port, the switch may legitimately see two MAC addresses. Port security set to a maximum of 1 causes a violation and can place the interface into err-disabled state.

Answer

The native VLAN is missing

Answer

BPDU Guard blocked the port because a workstation was attached

Answer

DHCP snooping denied the voice VLAN

Question 11

Exhibit: A user reports intermittent connectivity after a new switch was connected to an access port. Which feature would have prevented this by immediately disabling the port when a BPDU was received?

Accepted Answer

BPDU Guard. BPDU Guard is the correct answer because it protects PortFast-enabled edge ports by immediately disabling the port upon receiving a BPDU, preventing accidental loops. Root Guard prevents the port from becoming a root port, not from BPDU reception. Loop Guard prevents alternate or root ports from becoming designated due to BPDU loss, unrelated to BPDU reception disabling. UDLD detects unidirectional links but does not disable ports upon BPDU reception.

Answer

Root Guard

Answer

Loop Guard

Answer

UDLD

Question 12

Exhibit: Clients can see the corporate SSID but fail authentication after entering valid usernames and passwords. Which issue is the best explanation?

Accepted Answer

The RADIUS path or shared secret is failing. WPA2-Enterprise relies on 802.1X with a RADIUS server. If the RADIUS server is unreachable or the shared secret is wrong, users can see the SSID and attempt to authenticate, but the login process fails. Option A is incorrect because RF channel issues would cause connectivity problems, not authentication failures after association. Option C is incorrect because hiding the SSID is irrelevant to enterprise authentication; the issue is server-side. Option D is incorrect because a voice VLAN is not required for standard client authentication and would not cause login failure.

Answer

The AP is using the wrong RF channel

Answer

The SSID must be hidden for enterprise authentication

Answer

The clients need a voice VLAN assignment first

Question 13

Why is BPDU Guard commonly enabled on PortFast-enabled access ports?

Accepted Answer

To err-disable a port if it receives unexpected BPDUs. PortFast ports are meant for end devices, not for switches. BPDU Guard protects the LAN by shutting down a PortFast port that unexpectedly starts receiving BPDUs, which usually means an unauthorized switch was connected.

Answer

To make STP root election happen faster

Answer

To disable STP permanently on access ports

Answer

To allow only one MAC address on the access port

Question 14

Exhibit: SW2 receives superior BPDUs on both uplinks. One uplink becomes the root port and the other becomes alternate. Which factor is considered first when SW2 chooses the root port?

Accepted Answer

Lowest root path cost. STP chooses the best path to the root bridge based first on the lowest root path cost. If the cost ties, it then checks the sender bridge ID and sender port ID as tie-breakers.

Answer

Lowest local interface MAC address

Answer

Highest duplex setting

Answer

Lowest configured VLAN number

Question 15

Exhibit: SW1 is configured for EtherChannel with LACP, but the bundle does not form. What is the most likely cause?

Accepted Answer

One side is using LACP and the other side is using a static EtherChannel mode. For an LACP EtherChannel to form, both sides must negotiate with LACP using active or passive mode. One side here is set to channel-group mode on, which creates a static channel and does not speak LACP. That mismatch prevents the bundle from forming.

Answer

The interfaces should use PAgP instead of LACP on both ends

Answer

The links must be routed ports before EtherChannel can form

Answer

EtherChannel requires three or more member links