CCNA Switching and Network Access Practice Test 14 — 15 Questions

Question 1

A user on a wireless guest network can associate successfully, obtains an IP address, but cannot reach the Internet. Which troubleshooting area should be examined first if the WLAN itself is working?

Accepted Answer

The post-association forwarding or policy path, such as guest routing or Internet access policy. If association and addressing are already successful, the first area to examine is the forwarding or policy path beyond simple WLAN join behavior. In practical terms, the client has passed the discovery, authentication, and addressing stages. The problem is now more likely to involve routing, gateway reachability, NAT, firewall policy, or guest-access restrictions rather than the SSID itself.

This question is about understanding which stage of the workflow has already succeeded.

Answer

The SSID broadcast name, because it must be wrong

Answer

The AP radio antenna type only

Answer

OSPFv3 area configuration on the laptop

Question 2

An AP broadcasts the correct SSID, but many clients on one floor experience poor performance while the same SSID works well on another floor. Which category of issue is most strongly suggested first?

Accepted Answer

A radio-frequency or local wireless environment issue on that floor. The issue is location-specific, with performance problems only on one floor. This strongly suggests a local radio frequency (RF) or wireless environment issue such as interference, signal attenuation, or channel congestion on that floor. The SSID is correctly broadcast because clients on other floors connect successfully, so option B (misspelling) is not plausible. Options C and D are unrelated to wireless performance: BGP is a routing protocol not used in basic WLAN deployments, and IPv6 loopback addressing does not affect client connectivity or throughput. Therefore, the most direct and likely first suspect is an RF or environmental issue on that specific floor.

Answer

The SSID name must be misspelled only on that floor

Answer

BGP autonomous system mismatch

Answer

IPv6 loopback addressing on the clients

Question 3

Which two statements accurately describe good design thinking for wireless guest access?

Accepted Answer

Guest access should normally be isolated from internal corporate resources.. Good guest-access design is based on isolation and appropriate policy. In practical terms, guest users should normally be separated from internal corporate resources, and their access should align with the limited purpose of guest connectivity. The goal is not to give them the same trust level as managed internal users.

This is about segmentation and policy, not about disabling the WLAN or eliminating security.

Answer

Guest WLANs should avoid all security to make access easier.

Answer

Guest WLANs should automatically use the same permissions as internal employee WLANs.

Answer

Guest access means the AP no longer needs controller coordination.

Question 4

A switch port configured with PortFast and BPDU Guard receives a BPDU and transitions to an error-disabled state. Which statement best explains why this is considered useful protection?

Accepted Answer

It prevents a port expected to be an edge port from accidentally becoming part of the switching topology and causing loops.. PortFast is used on edge ports to bypass STP listening/learning, but if a BPDU is received, the assumption that the port is an edge port is violated. BPDU Guard then error-disables the port to prevent potential loops or topology disruptions. This protects the network when an edge port unexpectedly connects to another switch, which could cause a bridging loop. The other options describe unrelated features or incorrect mechanisms.

Answer

It increases the port's bandwidth by combining multiple links.

Answer

It automatically enables VLAN trunking on the port.

Answer

It forces the port to use Rapid Spanning Tree Protocol for faster convergence.

Question 5

Which two statements accurately describe CAPWAP in a controller-based WLAN context?

Accepted Answer

It is associated with communication between lightweight APs and the wireless LAN controller.. CAPWAP (Control and Provisioning of Wireless Access Points) is the protocol used between lightweight access points (LAPs) and the wireless LAN controller (WLC) in controller-based WLAN architectures. Options C, D, and E are incorrect: CAPWAP is not an SSID; it is a control and data tunneling protocol, not a security standard like WPA2/WPA3; and it supports both IPv4 and IPv6, not just IPv4 ACL filtering.

Answer

It is the same thing as a client SSID.

Answer

It is a replacement for WPA2 and WPA3.

Answer

It is used only for IPv4 ACL filtering.

Question 6

An EtherChannel uses LACP. One side is configured correctly, but the peer side has a different switchport mode on one of the member links. What is the most likely result?

Accepted Answer

The bundle may fail to form correctly because the member-link settings are inconsistent.. The most likely result is that the bundle will not form cleanly because EtherChannel requires member links to agree on important operational settings. In practical terms, LACP negotiation alone is not enough. The links also need compatible characteristics such as switchport mode, VLAN handling, speed, and duplex where relevant.

This is a common troubleshooting pattern. It tests whether you know that bundle membership depends on configuration consistency, not just on enabling LACP.

Answer

The switch automatically rewrites the peer configuration to match.

Answer

LACP converts the mismatched link into a routed interface automatically.

Answer

The mismatched link is placed in a spanning-tree blocking state.

Question 7

Which two statements accurately describe why organizations use separate employee and guest WLANs?

Accepted Answer

They allow different access policies and trust boundaries for different user groups.. Organizations use separate WLANs because different user groups usually require different trust levels, policies, and access rights. In practical terms, employees may need access to internal business systems, while guests usually need a more limited and isolated experience. Separate WLANs make that segmentation and policy enforcement easier.

This is a design and security decision, not just a naming preference.

Answer

They eliminate the need for wireless security.

Answer

They make all roaming problems disappear automatically.

Answer

They replace the need for VLANs or policy controls behind the scenes.

Question 8

A trunk link between two switches is up, but voice phones connected through one access switch no longer receive the correct voice VLAN treatment. Data users still pass traffic. Which area should be checked first?

Accepted Answer

Whether the voice VLAN is being carried and handled correctly across the switching path.. The first area to check is the end-to-end handling of the voice VLAN across the switching path. In practical terms, the data VLAN can still work while the voice VLAN experiences a forwarding, configuration, or policy problem. Because the phones depend on the correct voice VLAN behavior, that VLAN path should be examined first rather than assuming the whole trunk is broken.

This is a selective-services troubleshooting question. One class of traffic can fail even when ordinary user data still works.

Answer

Whether OSPFv3 neighbors are fully adjacent on the phone switch ports.

Answer

Whether the wireless controller has the correct guest SSID.

Answer

Whether BGP uses a lower metric than the static route.

Question 9

A network engineer is configuring an EtherChannel between two switches. After applying the configuration, the port-channel fails to form. What is the most likely reason?

Accepted Answer

The member links use different switchport modes, so the channel cannot form correctly.. The port-channel is not forming because the two member interfaces are not configured consistently. In practical terms, EtherChannel requires important characteristics to align across candidate member links. Here, one interface is a trunk and the other is configured as an access port, so the channel cannot be built cleanly.

This is a classic EtherChannel consistency problem. The protocol alone is not enough if the member-link settings disagree.

Answer

LACP requires both interfaces to use different channel-group numbers.

Answer

The interfaces must both be configured for PPP.

Answer

The bundle fails because BGP is not enabled on the switch.

Question 10

A client can join a corporate SSID and authenticate successfully, but it consistently loses connectivity when moving between floors. Which area is most strongly suggested for deeper investigation?

Accepted Answer

Roaming and RF behavior between AP coverage areas. The strongest area for deeper investigation is wireless mobility and RF behavior between the AP coverage areas involved. In practical terms, the client can already authenticate and use the WLAN initially, so the issue is more likely tied to movement, signal transition, channel behavior, or roaming-related operation rather than basic SSID existence or initial authentication alone.

This is a mobility-troubleshooting question, not a simple association problem.

Answer

Whether the SSID is visible at all

Answer

Whether the host has a BGP autonomous system number

Answer

Whether the switch uses a smaller wildcard mask

Question 11

Match each WLAN term to its correct description.

Accepted Answer

WLAN. A WLAN (Wireless Local Area Network) enables wireless device connectivity. A Mobility Group is a logical grouping of wireless LAN controllers that facilitate seamless roaming across access points. Roaming refers to the movement of a wireless client from one access point to another without losing connectivity. Fast Roaming implements the 802.11r standard to minimize authentication delays during roaming transitions.

Question 12

A switch port is configured with `switchport voice vlan 150` and `switchport access vlan 20`. Which statement best explains the design purpose?

Accepted Answer

It separates voice and data traffic on the same edge port by assigning them to different VLANs.. The design purpose is to let the switch support a phone and an attached workstation on the same physical access port while placing their traffic into different VLANs. In practical terms, the phone can use the voice VLAN while the user's data traffic uses the access VLAN. This is a common enterprise edge design for IP telephony.

The key idea is role separation on one port, not trunking the port as a normal inter-switch link.

Answer

It turns the port into a routed WAN interface.

Answer

It forces the phone to use CAPWAP before receiving power.

Answer

It makes VLAN 150 the native VLAN on all trunks automatically.

Question 13

A switch receives BPDUs on a user-facing port configured as an edge port, but instead of just blocking the port role it fully error-disables it. Which protection feature most likely explains that behavior?

Accepted Answer

BPDU Guard. BPDU Guard most likely explains that behavior. In practical terms, BPDU Guard is used to protect ports that are expected to face ordinary endpoints, not other switches. If BPDUs appear on such a port, the device treats that as a serious topology-policy violation and shuts the port down.

This is different from features that merely influence spanning-tree role choice without fully error-disabling the interface.

Answer

Root guard

Answer

Port security

Answer

DHCP snooping

Question 14

A phone and PC share one switchport. The phone works, but the PC cannot reach its normal data resources. The switchport voice VLAN is configured, and the access VLAN is incorrect. Which explanation is strongest?

Accepted Answer

The PC is likely in the wrong data VLAN even though the phone still uses the correct voice VLAN.. The switchport is configured with a voice VLAN for the phone and an access VLAN for the PC. If the access VLAN is incorrect, the PC will be placed in the wrong data VLAN, preventing it from reaching its normal data resources, while the phone continues to operate correctly on its designated voice VLAN. This is a common misconfiguration where the data VLAN ID does not match the network segment the PC expects.

Answer

If the phone works, the PC must also work because both use the same VLAN always.

Answer

The issue must be BGP because phones cannot use VLANs.

Answer

The access VLAN becomes irrelevant whenever a voice VLAN is configured.

Question 15

A wireless client can associate to the correct corporate SSID and authenticate successfully, but receives an address from the guest network instead of the employee network. Which troubleshooting area is strongest?

Accepted Answer

Incorrect WLAN-to-role or VLAN mapping after successful authentication.. The client successfully authenticates to the corporate SSID but receives an IP address from the guest network, indicating that the authentication phase is working correctly. The issue lies in the post-authentication mapping: the WLAN is likely mapped to the wrong VLAN or role (e.g., a RADIUS server attribute or local VLAN assignment is misconfigured), causing the client to be placed in the guest VLAN instead of the employee VLAN. This is a common misconfiguration in WLAN-to-VLAN or WLAN-to-role mapping after successful 802.1X authentication.

Answer

The client must be using the wrong subnet mask manually.

Answer

The AP must be missing PPP encapsulation.

Answer

The issue is that STP root election failed.