CCNA Switching and Network Access Practice Test 12 — 15 Questions

Question 1

PCs in VLAN 30 on SwitchA cannot reach PCs in VLAN 30 on SwitchB. VLAN 30 exists on both switches and all other VLANs work across the same link. Based on the exhibit, what is the most likely cause?

Accepted Answer

VLAN 30 is not allowed on the trunk from SwitchA.. The trunk is up, but VLAN 30 is missing from the allowed list on SwitchA. In plain language, the hallway between the switches is open, but one side is refusing to carry that specific VLAN through the hallway. Since the other VLANs are working, the failure is selective rather than total. That strongly points to an allowed-VLAN problem rather than a broader trunk outage.

This is a classic CCNA switching scenario because it tests whether you can separate trunk health from per-VLAN forwarding. A trunk can be operational and still block one VLAN if that VLAN is not permitted on one side. The native VLAN and encapsulation are not the issue shown here — the mismatch in the allowed list is.

Answer

The native VLAN is mismatched.

Answer

The trunk must use ISL instead of 802.1Q.

Answer

VLAN 30 must be configured as the native VLAN.

Question 2

A port connected to an end host is configured with PortFast and BPDU Guard. What is the most likely result if a small unmanaged switch is connected and starts sending BPDUs?

Accepted Answer

The port is error-disabled by BPDU Guard.. The most likely result is that the port is placed into an err-disabled state by BPDU Guard. In practical terms, PortFast tells the switch to treat the interface like an edge port for a normal endpoint, which is why it starts forwarding quickly. BPDU Guard protects that assumption. If the port suddenly receives a spanning-tree BPDU, the switch treats that as a sign that the port is no longer connected to a simple end device.

This combination is common in enterprise access-layer design because it improves user startup time while still protecting the topology. The correct answer is the one that describes the port being shut down automatically when BPDUs appear unexpectedly.

Answer

The port automatically becomes the root port.

Answer

The port is converted into a trunk.

Answer

The port ignores the BPDU because PortFast disables STP entirely.

Question 3

A switch interface is configured as `dynamic desirable`, and the peer interface is configured as `dynamic auto`. What is the most likely result?

Accepted Answer

The link is likely to become a trunk.. The most likely result is that the link becomes a trunk. In simple terms, `dynamic desirable` actively tries to negotiate a trunk, while `dynamic auto` listens and responds. Because one side is willing to initiate the process, trunking can be established if the rest of the configuration is compatible.

This question tests whether you know the difference between passive and active DTP behavior. The classic failure pairing is auto/auto. Desirable/auto, by contrast, is a normal path to trunk formation.

Answer

The link becomes a routed port.

Answer

All VLANs are deleted from both switches.

Answer

The port is immediately error-disabled.

Question 4

Match each switching feature to its most accurate purpose.

Accepted Answer

STP prevents loops, VTP manages VLANs, EtherChannel aggregates links, Port Security restricts MAC addresses, DTP negotiates trunks, and Rapid PVST+ provides fast per-VLAN convergence.. Which accurately pairs each switching feature with its purpose: Spanning Tree Protocol (STP) prevents loops in a switched network by blocking redundant paths; VLAN Trunking Protocol (VTP) manages the addition, deletion, and renaming of VLANs across the network; EtherChannel aggregates multiple physical links into a single logical link for increased bandwidth and redundancy; Port Security limits the number of MAC addresses allowed on a switch port to prevent unauthorized access; Dynamic Trunking Protocol (DTP) automatically negotiates trunking between switches; and Rapid PVST+ provides fast convergence for each VLAN using multiple spanning tree instances. The other options contain incorrect pairings, such as mixing up STP with VLAN management or EtherChannel with loop prevention.

Answer

STP manages VLANs, VTP prevents loops, EtherChannel restricts MAC addresses, Port Security aggregates links, DTP provides fast per-VLAN convergence, and Rapid PVST+ negotiates trunks.

Answer

STP aggregates links, VTP prevents loops, EtherChannel manages VLANs, Port Security negotiates trunks, DTP restricts MAC addresses, and Rapid PVST+ provides fast per-VLAN convergence.

Answer

STP provides fast per-VLAN convergence, VTP aggregates links, EtherChannel prevents loops, Port Security manages VLANs, DTP restricts MAC addresses, and Rapid PVST+ negotiates trunks.

Question 5

A switch port connected to a user PC should be placed in VLAN 20 and must not negotiate trunking. Which configuration is the most appropriate?

Accepted Answer

switchport mode access
switchport access vlan 20. The most appropriate configuration is to force the interface into access mode and assign it to VLAN 20. In practical terms, a normal user-facing switch port is supposed to carry one VLAN only. There is no reason to rely on dynamic trunk negotiation for a desktop or laptop connection. Explicit access-port configuration is cleaner, more predictable, and safer.

This is a common switching best-practice question. The wrong answers usually leave room for unwanted trunking behavior or move the interface into a completely different role. The right answer combines the correct port role with the correct VLAN membership.

Answer

switchport mode trunk
switchport trunk native vlan 20

Answer

switchport mode dynamic desirable
switchport trunk allowed vlan 20

Answer

no switchport
ip address 192.168.20.1 255.255.255.0

Question 6

A switch port connected to an IP phone and a PC should separate voice traffic from data traffic while still using one physical edge connection. Which feature best supports that design?

Accepted Answer

Voice VLAN. A voice VLAN best supports that design. In practical terms, a Cisco-style voice VLAN allows the switch to carry voice traffic separately from user data even though the phone and PC share the same physical access connection. This is a common enterprise edge design because it lets the phone use one VLAN while the downstream PC uses another.

The key point is separation of traffic types over one edge port, not trunking between switches or link aggregation.

Answer

EtherChannel

Answer

Native VLAN

Answer

Loop guard

Question 7

Two switches are connected by a trunk. VLAN 50 exists on both switches, but hosts in VLAN 50 cannot communicate across the link. All other VLANs work. Based on the exhibit, what is the most likely cause?

Accepted Answer

VLAN 50 is not allowed on the trunk from SwitchA.. VLAN 50 is missing from the allowed VLAN list on the trunk, which blocks only that VLAN while allowing others. Option B is incorrect: a native VLAN mismatch would affect the native VLAN (usually VLAN 1) or cause STP issues, not specifically VLAN 50. Option C is incorrect: 802.1Q encapsulation supports all VLANs from 1 to 4094, including VLAN 50. Option D is incorrect: VLANs do not need to be the native VLAN to be transported over a trunk; any VLAN can traverse a trunk if it is allowed.

Answer

The native VLAN is mismatched.

Answer

802.1Q cannot carry VLAN 50.

Answer

VLAN 50 must be configured as the native VLAN first.

Question 8

A multilayer switch has SVIs for VLAN 10 and VLAN 20. Hosts in both VLANs can reach their local SVI, but they cannot reach each other. Which additional configuration is most likely required?

Accepted Answer

Enable `ip routing` on the multilayer switch.. The most likely missing configuration is `ip routing`. In practical terms, the switch already has Layer 3 gateway interfaces for the VLANs, which is why hosts can reach their local SVI. But inter-VLAN communication still requires the switch to actually route between those VLAN interfaces. Without IP routing enabled, the SVIs can exist and respond locally without forwarding traffic between them.

This is a classic multilayer-switch question because many learners assume that creating SVIs automatically enables inter-VLAN routing. It does not. The device must also be told to behave as a Layer 3 forwarding device across those VLAN interfaces.

Answer

Convert all access ports into trunks.

Answer

Make both VLANs use the same IP subnet.

Answer

Disable spanning tree on both VLANs.

Question 9

Match each Layer 2 protection feature to its most accurate purpose.

Accepted Answer

Storm Control: Limits excessive broadcast, multicast, or unicast traffic to prevent network storms.. Storm Control limits excessive traffic. Port Security limits MAC addresses. DHCP Snooping blocks unauthorized DHCP servers. DAI validates ARP packets. IP Source Guard filters IP traffic based on DHCP snooping. 802.1X authenticates devices before granting access.

Answer

Storm Control: Authenticates devices before granting network access.

Answer

Storm Control: Validates ARP packets to prevent ARP spoofing attacks.

Answer

Storm Control: Filters IP traffic based on DHCP snooping bindings.

Question 10

Two switches should form an EtherChannel with LACP. One side is set to active and the other is set to passive. If the remaining interface settings match, what is the expected result?

Accepted Answer

The EtherChannel should form successfully.. The EtherChannel should form successfully. In practical terms, active mode initiates LACP negotiation and passive mode listens and responds. Because one side is actively starting the negotiation, the bundle can come up if the interfaces also match in operational settings such as speed, duplex, switchport mode, and VLAN characteristics.

This is a classic LACP pairing question. Active/passive works. Passive/passive is the combination that usually fails to start the bundle.

Answer

The EtherChannel fails because both sides must be active.

Answer

The interfaces automatically become routed ports.

Answer

The switches delete the port-channel automatically.

Question 11

Two switches are configured for LACP EtherChannel. One side is set to passive and the other side is also set to passive. What is the most likely outcome?

Accepted Answer

The EtherChannel will not form because neither side initiates LACP negotiation.. The EtherChannel will not form because LACP passive mode only listens for negotiation; it does not initiate it. When both sides are set to passive, neither side sends LACP packets, so the bundle cannot be established. This is a deterministic outcome, not merely unlikely.

Answer

The EtherChannel always forms because passive mode is preferred.

Answer

The links automatically become a routed interface.

Answer

The switches delete the bundle configuration automatically.

Question 12

A switch port connected to a workstation is configured with sticky MAC learning and a maximum secure MAC count of 1. What is the main operational benefit of sticky learning in this case?

Accepted Answer

It dynamically learns a secure MAC address and can preserve it if the configuration is saved.. Sticky learning gives the convenience of dynamic discovery while still treating the learned address as a secure port-security entry. In practical terms, the switch can observe the first legitimate MAC address on the port and record it as a secure address without the administrator having to type that address manually. If the running configuration is later saved, that sticky entry can persist after a reload.

This is useful because it balances ease of deployment with access control. The maximum secure MAC count still matters, and port security is still active. Sticky learning does not replace port security; it works within it.

Answer

It disables the maximum secure MAC limit on the interface.

Answer

It automatically saves the running configuration to the startup configuration after learning the MAC address.

Answer

It prevents the port from ever generating a security violation.

Question 13

A switchport connected to a user workstation is placed in VLAN 30. The administrator also wants to prevent that port from learning more than one MAC address. Which feature should be configured?

Accepted Answer

Port security. The correct feature is port security. In practical terms, port security lets the administrator control how many MAC addresses can be learned on a switchport and what happens if that limit is exceeded. That makes it a very natural fit for a user-facing access port where one endpoint is expected and unmanaged extra devices are not.

This is a common access-layer hardening technique. VLAN assignment controls where the traffic belongs, but it does not limit who or what can appear on the port. Port security adds that second layer of control.

Answer

EtherChannel

Answer

OSPF passive-interface

Answer

Native VLAN

Question 14

A switchport on one side of a link is configured as a trunk, but the peer side is configured as an access port. What is the most likely result?

Accepted Answer

The link roles are mismatched, so VLAN traffic will not be handled as intended.. The most likely result is a logical mismatch that prevents VLAN traffic from crossing the link as intended. In practical terms, one side is trying to carry multiple VLANs with tagging behavior, while the other side is treating the connection as a normal one-VLAN endpoint port. That disagreement usually leads to unexpected or failed traffic behavior.

This is a classic switching mismatch scenario. The link may still be physically up, but the two sides do not agree on how the traffic should be handled.

Answer

The access side automatically becomes a routed port.

Answer

Both switches automatically synchronize their switchport settings.

Answer

The mismatch forces OSPF to change router IDs.

Question 15

A switchport on one side of a link is configured as a trunk, but the peer side is configured as an access port. The physical link is up, but VLAN traffic behaves unexpectedly. What is the most likely cause?

Accepted Answer

The two ends disagree on whether the link is a trunk or an access port.. The most likely cause is a switchport mode mismatch. In practical terms, one side expects the link to carry multiple VLANs with tagging behavior, while the other side treats it as a normal one-VLAN endpoint-style access connection. The physical interface can still come up, but the two ends do not agree on how the traffic should be handled.

This is a classic Layer 2 troubleshooting pattern. The link may not be fully down, but the configuration disagreement causes logical forwarding problems.

Answer

The switches must both use the same hostname.

Answer

The native VLAN must be set to 1 on both sides first.

Answer

The ports need OSPF enabled.