CCNA Switching and Network Access Practice Test 13 — 15 Questions

Question 1

Which two statements accurately describe WPA2 and WPA3 in wireless security?

Accepted Answer

Both are wireless security standards used to help protect WLAN access and traffic.. WPA2 and WPA3 are wireless security standards used to protect WLAN access and traffic. In practical terms, both are associated with securing wireless communication, but WPA3 is generally positioned as the newer standard with security improvements over WPA2. The key idea at CCNA level is recognizing them as WLAN security standards rather than confusing them with SSIDs, controllers, or radio bands.

You do not need deep protocol internals here. You need the role and relative positioning right.

Answer

Both are names for specific 802.11 radio frequencies.

Answer

WPA2 and WPA3 are types of trunk ports.

Answer

WPA3 eliminates the need for SSIDs.

Question 2

An EtherChannel between two switches is configured for LACP. One switch shows the member interfaces as bundled, while the other shows them as individual interfaces. Which explanation is most likely if both sides are using LACP?

Accepted Answer

The member interface settings do not match closely enough for bundling, even though both sides use LACP.. The most likely explanation is that some other interface settings do not match, even though both sides are using the same EtherChannel protocol. In practical terms, LACP alone is not enough. The candidate member interfaces also need to agree on characteristics such as speed, duplex, switchport mode, allowed VLANs where relevant, and other channel-related settings. If they do not, one side may treat the links as separate instead of bundling them.

This is a common troubleshooting pattern because it tests whether you know that EtherChannel success depends on more than just the negotiation protocol name.

Answer

LACP always requires one side to use PAgP as a backup.

Answer

EtherChannel cannot operate on switch trunks.

Answer

One switch must disable STP before EtherChannel can form.

Question 3

A switchport is configured as an access port in VLAN 10, but a user plugs in a small unmanaged switch and connects multiple devices behind it. Which security feature most directly limits that behavior at the switchport?

Accepted Answer

Port security. Port security most directly limits that behavior because it can restrict how many MAC addresses are learned on the switchport. In practical terms, if the interface is supposed to support one endpoint but suddenly begins presenting multiple MAC addresses from a downstream mini-switch, port security can detect and react to that change.

This is a classic access-layer control question. VLAN assignment alone does not limit how many devices appear behind the port.

Answer

OSPF authentication

Answer

NetFlow

Answer

NTP

Question 4

In a controller-based WLAN, what is the main job of the access point?

Accepted Answer

To provide the radio connection between wireless clients and the network. The main job of the access point is to provide the actual radio connection between wireless clients and the network. In practical terms, the controller may centralize policy and management, but the AP is still the device that transmits and receives the wireless frames in the local area.

This distinction matters because CCNA wireless questions often separate the controller’s management role from the AP’s RF and client-connectivity role.

Answer

To replace the wireless LAN controller entirely

Answer

To act as the default gateway for every wired VLAN

Answer

To perform OSPF route summarization for wireless users

Question 5

Match each wireless term to its most accurate meaning.

Accepted Answer

SSID: The human-readable network name that identifies a wireless network.. SSID is the human-readable network name. BSSID is the unique MAC address of an AP radio. ESSID is the same SSID used across multiple APs in an extended network. Beacons are management frames that advertise the network. Probe requests are sent by clients to find APs. Association is the process of connecting a client to an AP.

Answer

SSID: The unique MAC address assigned to each access point radio.

Answer

SSID: A management frame sent by access points to advertise the network.

Answer

SSID: The process by which a client connects to an access point.

Question 6

A trunk is up between two switches, but traffic for VLAN 40 fails while other VLANs work. Which output item should be checked first?

Accepted Answer

Whether VLAN 40 is included in the allowed VLAN list on the trunk. The first thing to check is whether VLAN 40 appears in the trunk’s allowed VLAN list. In practical terms, this is a selective failure, not a total trunk failure. Since other VLANs are crossing successfully, the link is operational. That strongly suggests one VLAN is being excluded rather than the trunk being generally broken.

This is one of the most common VLAN troubleshooting patterns in switching.

Answer

Whether the router ID matches on both switches

Answer

Whether NetFlow is enabled on the VLAN

Answer

Whether NTP is synchronized on the switches

Question 7

A switch port connected to an edge host immediately transitions to forwarding and then later goes err-disabled after a BPDU is received. Which feature combination most likely produced this behavior?

Accepted Answer

PortFast with BPDU Guard. The most likely combination is PortFast with BPDU Guard. In practical terms, PortFast explains why the port moved quickly into forwarding when the host connected. BPDU Guard explains why the same port later shut down after seeing a BPDU that should not normally appear on an edge port.

This is a very common enterprise edge-port design pattern and a classic exam scenario.

Answer

NetFlow with SNMP traps

Answer

OSPF passive-interface with EUI-64

Answer

WPA3 with CAPWAP

Question 8

A multilayer switch has working SVIs for VLAN 10 and VLAN 20, but traffic between the VLANs fails. Hosts can ping their own gateway interfaces. Which misconfiguration is most strongly suggested if the SVIs themselves are correct?

Accepted Answer

IP routing is not enabled on the multilayer switch.. IP routing is not enabled. The switch can ping SVIs locally because they are directly connected, but without `ip routing`, it cannot forward packets between VLANs. Option B is wrong because different VLANs require different subnets for routing. Option C is wrong because access ports do not need to be trunks; SVIs handle routing at Layer 3. Option D is wrong because the wireless controller does not provide the default gateway for wired VLAN routing; the SVI does.

Answer

Both VLANs need to use the same IP subnet.

Answer

All access ports must be converted into trunks.

Answer

The wireless controller must provide the default gateway.

Question 9

A switch has a root port and an alternate port for the same VLAN. Which statement best explains the operational role of the alternate port?

Accepted Answer

It is a backup path toward the root bridge and normally does not forward while the active root path is healthy.. The alternate port acts as a backup path toward the root bridge and stays in a non-forwarding state under normal conditions. In practical terms, STP keeps it ready in case the active path fails, but it does not allow it to forward frames while the primary root path is healthy. That is how STP preserves redundancy without creating loops.

This question is useful because many learners understand root ports and designated ports but do not clearly understand what the alternate role represents.

Answer

It always forwards traffic at the same time as the root port for load balancing.

Answer

It is the port that elects the root bridge for the VLAN.

Answer

It is a special routed port used for inter-VLAN communication.

Question 10

A user reports that a laptop can connect to the correct SSID but repeatedly fails authentication when joining the WLAN. Which category of issue is most strongly indicated?

Accepted Answer

A security or authentication mismatch related to WLAN access. The strongest indication is a wireless security or authentication mismatch rather than a pure RF coverage problem. In practical terms, the laptop can already see and attempt to join the correct SSID, which means discovery is working. Repeated authentication failure points more directly to credentials, security settings, or authentication-policy alignment than to channel or signal absence.

This question is about recognizing the stage of failure. The client is finding the WLAN, but it is not being accepted onto it.

Answer

A missing OSPF router ID on the access point

Answer

A routed-port mismatch on the switch uplink

Answer

A DHCP relay problem on the client

Question 11

A wireless client can see two SSIDs from the same company: Corp and Guest. Which statement best explains what an SSID represents in this situation?

Accepted Answer

It is the wireless network name presented to clients for a specific WLAN.. An SSID is the name that identifies a specific wireless LAN to clients. In practical terms, Corp and Guest are two different WLAN identifiers presented to users, even if they are broadcast by the same physical access point infrastructure. The SSID tells the client which wireless network it is trying to join.

This matters because people often confuse SSIDs with the access point itself or with the security protocol. The SSID is the network identifier, not the hardware or the encryption standard.

Answer

It is the encryption algorithm securing the WLAN.

Answer

It is the radio antenna inside the AP.

Answer

It is the management IP address of the controller.

Question 12

Which two statements accurately describe a controller-based WLAN compared with a set of independently managed APs?

Accepted Answer

It centralizes management and policy across multiple access points.. A controller-based WLAN centralizes operational control and helps apply policies more consistently across many APs. In practical terms, this improves scalability and reduces the burden of touching each AP individually when changes are needed. The APs still provide the radio service, but they are coordinated under a shared management model.

This question is about architecture, not about claiming that a controller replaces APs or that it removes all other network services.

Answer

It removes the need for access points entirely.

Answer

It replaces the need for DHCP on all client devices.

Answer

It is the same thing as WPA3.

Question 13

A switch receives superior BPDUs on a port where the design requires that no downstream device ever become the root path for that segment. Which feature is the best fit for that requirement?

Accepted Answer

Root guard. Root guard is the best fit because it is designed to prevent a port from becoming the path toward a new root bridge when superior BPDUs are received. In practical terms, it protects the intended STP topology by keeping that port from taking on a root-related forwarding role when the design says it should not.

This is different from BPDU Guard, which is more commonly used on edge ports to disable them entirely if BPDUs appear. Root guard is about protecting topology roles, not just edge-port assumptions.

Answer

BPDU Guard

Answer

Port security

Answer

DHCP Snooping

Question 14

A controller-based WLAN is deployed across multiple floors. Users can associate to the SSID on both floors, but their experience improves when moving between APs compared with a poorly designed standalone deployment. Which wireless concept is most closely related to that client movement experience?

Accepted Answer

Roaming between access points. The concept most closely related is roaming between access points. In practical terms, client mobility experience depends on how smoothly a device can move from one AP coverage area to another while staying on the WLAN. Controller-based designs often help manage this more consistently than fragmented independent configurations.

The key point is that the question is about movement between APs while remaining on the wireless network, not about VLAN trunks or routing protocol neighbors.

Answer

NetFlow export

Answer

DHCP snooping

Answer

Route summarization

Question 15

A switchport connected to another switch should carry multiple VLANs, but it was manually configured as an access port. What is the most likely operational result?

Accepted Answer

The link will not carry multiple VLANs as intended because an access port handles one VLAN only.. An access port is designed to carry only a single VLAN. If the link is intended to carry multiple VLANs, it must be configured as a trunk. The switch will not automatically convert the port to a trunk (B). The port remains a Layer 2 access port, not a routed Layer 3 interface (C). VLANs are not automatically summarized into a single prefix (D). The most likely result is that the link will not carry multiple VLANs as intended.

Answer

The switch automatically converts the access port into a proper trunk.

Answer

The port becomes a routed Layer 3 interface.

Answer

The VLANs are summarized into one prefix automatically.