CCNA Switching and Network Access Practice Test 14 — 15 Questions

Question 1

Which two statements accurately describe good design thinking for wireless guest access?

Accepted Answer

Guest access should normally be isolated from internal corporate resources.. Good guest-access design is based on isolation and appropriate policy. In practical terms, guest users should normally be separated from internal corporate resources, and their access should align with the limited purpose of guest connectivity. The goal is not to give them the same trust level as managed internal users.

This is about segmentation and policy, not about disabling the WLAN or eliminating security.

Answer

Guest WLANs should avoid all security to make access easier.

Answer

Guest WLANs should automatically use the same permissions as internal employee WLANs.

Answer

Guest access means the AP no longer needs controller coordination.

Question 2

A switch port configured with PortFast and BPDU Guard receives a BPDU and transitions to an error-disabled state. Which statement best explains why this is considered useful protection?

Accepted Answer

It prevents a port expected to be an edge port from accidentally becoming part of the switching topology and causing loops.. PortFast is used on edge ports to bypass STP listening/learning, but if a BPDU is received, the assumption that the port is an edge port is violated. BPDU Guard then error-disables the port to prevent potential loops or topology disruptions. This protects the network when an edge port unexpectedly connects to another switch, which could cause a bridging loop. The other options describe unrelated features or incorrect mechanisms.

Answer

It increases the port's bandwidth by combining multiple links.

Answer

It automatically enables VLAN trunking on the port.

Answer

It forces the port to use Rapid Spanning Tree Protocol for faster convergence.

Question 3

Which two statements accurately describe CAPWAP in a controller-based WLAN context?

Accepted Answer

It is associated with communication between lightweight APs and the wireless LAN controller.. CAPWAP (Control and Provisioning of Wireless Access Points) is the protocol used between lightweight access points (LAPs) and the wireless LAN controller (WLC) in controller-based WLAN architectures. Options C, D, and E are incorrect: CAPWAP is not an SSID; it is a control and data tunneling protocol, not a security standard like WPA2/WPA3; and it supports both IPv4 and IPv6, not just IPv4 ACL filtering.

Answer

It is the same thing as a client SSID.

Answer

It is a replacement for WPA2 and WPA3.

Answer

It is used only for IPv4 ACL filtering.

Question 4

An EtherChannel uses LACP. One side is configured correctly, but the peer side has a different switchport mode on one of the member links. What is the most likely result?

Accepted Answer

The bundle may fail to form correctly because the member-link settings are inconsistent.. The most likely result is that the bundle will not form cleanly because EtherChannel requires member links to agree on important operational settings. In practical terms, LACP negotiation alone is not enough. The links also need compatible characteristics such as switchport mode, VLAN handling, speed, and duplex where relevant.

This is a common troubleshooting pattern. It tests whether you know that bundle membership depends on configuration consistency, not just on enabling LACP.

Answer

The switch automatically rewrites the peer configuration to match.

Answer

LACP converts the mismatched link into a routed interface automatically.

Answer

The mismatched link is placed in a spanning-tree blocking state.

Question 5

Which two statements accurately describe why organizations use separate employee and guest WLANs?

Accepted Answer

They allow different access policies and trust boundaries for different user groups.. Organizations use separate WLANs because different user groups usually require different trust levels, policies, and access rights. In practical terms, employees may need access to internal business systems, while guests usually need a more limited and isolated experience. Separate WLANs make that segmentation and policy enforcement easier.

This is a design and security decision, not just a naming preference.

Answer

They eliminate the need for wireless security.

Answer

They make all roaming problems disappear automatically.

Answer

They replace the need for VLANs or policy controls behind the scenes.

Question 6

A trunk link between two switches is up, but voice phones connected through one access switch no longer receive the correct voice VLAN treatment. Data users still pass traffic. Which area should be checked first?

Accepted Answer

Whether the voice VLAN is being carried and handled correctly across the switching path.. The first area to check is the end-to-end handling of the voice VLAN across the switching path. In practical terms, the data VLAN can still work while the voice VLAN experiences a forwarding, configuration, or policy problem. Because the phones depend on the correct voice VLAN behavior, that VLAN path should be examined first rather than assuming the whole trunk is broken.

This is a selective-services troubleshooting question. One class of traffic can fail even when ordinary user data still works.

Answer

Whether OSPFv3 neighbors are fully adjacent on the phone switch ports.

Answer

Whether the wireless controller has the correct guest SSID.

Answer

Whether BGP uses a lower metric than the static route.

Question 7

A network engineer is configuring an EtherChannel between two switches. After applying the configuration, the port-channel fails to form. What is the most likely reason?

Accepted Answer

The member links use different switchport modes, so the channel cannot form correctly.. The port-channel is not forming because the two member interfaces are not configured consistently. In practical terms, EtherChannel requires important characteristics to align across candidate member links. Here, one interface is a trunk and the other is configured as an access port, so the channel cannot be built cleanly.

This is a classic EtherChannel consistency problem. The protocol alone is not enough if the member-link settings disagree.

Answer

LACP requires both interfaces to use different channel-group numbers.

Answer

The interfaces must both be configured for PPP.

Answer

The bundle fails because BGP is not enabled on the switch.

Question 8

A client can join a corporate SSID and authenticate successfully, but it consistently loses connectivity when moving between floors. Which area is most strongly suggested for deeper investigation?

Accepted Answer

Roaming and RF behavior between AP coverage areas. The strongest area for deeper investigation is wireless mobility and RF behavior between the AP coverage areas involved. In practical terms, the client can already authenticate and use the WLAN initially, so the issue is more likely tied to movement, signal transition, channel behavior, or roaming-related operation rather than basic SSID existence or initial authentication alone.

This is a mobility-troubleshooting question, not a simple association problem.

Answer

Whether the SSID is visible at all

Answer

Whether the host has a BGP autonomous system number

Answer

Whether the switch uses a smaller wildcard mask

Question 9

A switch port is configured with `switchport voice vlan 150` and `switchport access vlan 20`. Which statement best explains the design purpose?

Accepted Answer

It separates voice and data traffic on the same edge port by assigning them to different VLANs.. The design purpose is to let the switch support a phone and an attached workstation on the same physical access port while placing their traffic into different VLANs. In practical terms, the phone can use the voice VLAN while the user's data traffic uses the access VLAN. This is a common enterprise edge design for IP telephony.

The key idea is role separation on one port, not trunking the port as a normal inter-switch link.

Answer

It turns the port into a routed WAN interface.

Answer

It forces the phone to use CAPWAP before receiving power.

Answer

It makes VLAN 150 the native VLAN on all trunks automatically.

Question 10

A switch receives BPDUs on a user-facing port configured as an edge port, but instead of just blocking the port role it fully error-disables it. Which protection feature most likely explains that behavior?

Accepted Answer

BPDU Guard. BPDU Guard most likely explains that behavior. In practical terms, BPDU Guard is used to protect ports that are expected to face ordinary endpoints, not other switches. If BPDUs appear on such a port, the device treats that as a serious topology-policy violation and shuts the port down.

This is different from features that merely influence spanning-tree role choice without fully error-disabling the interface.

Answer

Root guard

Answer

Port security

Answer

DHCP snooping

Question 11

A phone and PC share one switchport. The phone works, but the PC cannot reach its normal data resources. The switchport voice VLAN is configured, and the access VLAN is incorrect. Which explanation is strongest?

Accepted Answer

The PC is likely in the wrong data VLAN even though the phone still uses the correct voice VLAN.. The switchport is configured with a voice VLAN for the phone and an access VLAN for the PC. If the access VLAN is incorrect, the PC will be placed in the wrong data VLAN, preventing it from reaching its normal data resources, while the phone continues to operate correctly on its designated voice VLAN. This is a common misconfiguration where the data VLAN ID does not match the network segment the PC expects.

Answer

If the phone works, the PC must also work because both use the same VLAN always.

Answer

The issue must be BGP because phones cannot use VLANs.

Answer

The access VLAN becomes irrelevant whenever a voice VLAN is configured.

Question 12

A wireless client can associate to the correct corporate SSID and authenticate successfully, but receives an address from the guest network instead of the employee network. Which troubleshooting area is strongest?

Accepted Answer

Incorrect WLAN-to-role or VLAN mapping after successful authentication.. The client successfully authenticates to the corporate SSID but receives an IP address from the guest network, indicating that the authentication phase is working correctly. The issue lies in the post-authentication mapping: the WLAN is likely mapped to the wrong VLAN or role (e.g., a RADIUS server attribute or local VLAN assignment is misconfigured), causing the client to be placed in the guest VLAN instead of the employee VLAN. This is a common misconfiguration in WLAN-to-VLAN or WLAN-to-role mapping after successful 802.1X authentication.

Answer

The client must be using the wrong subnet mask manually.

Answer

The AP must be missing PPP encapsulation.

Answer

The issue is that STP root election failed.

Question 13

A host on a guest WLAN can browse the Internet but cannot reach internal corporate resources, while employees on another SSID can. Which statement best explains why that can be a correct design outcome?

Accepted Answer

Because guest and employee WLANs can intentionally have different trust levels and access policies.. Guest wireless networks are intentionally isolated from corporate resources through separate trust levels and access policies. Option B is incorrect because guest WLANs can use IP routing, but routing policies restrict which destinations are reachable. Option C is incorrect because inter-VLAN routing is not inherently disabled; it is a design choice to restrict routing between VLANs. Option D is incorrect because SSIDs themselves do not trigger firewall rules; it is the VLAN or group assignment that determines the applied policy.

Answer

Because guest WLANs cannot use IP routing at all.

Answer

Because the guest WLAN is assigned to a different VLAN that uses a different IP subnet, and inter-VLAN routing is inherently disabled for security reasons.

Answer

Because the guest WLAN uses a different SSID that automatically triggers firewall rules that only permit HTTP/HTTPS traffic.

Question 14

A phone and PC share one switchport. The phone registers successfully, but the workstation receives an address from the wrong subnet. Which explanation is strongest?

Accepted Answer

The workstation is likely in the wrong data VLAN even though the phone is in the correct voice VLAN.. The phone and PC share a single switchport configured with separate voice and data VLANs. The phone successfully registers in the voice VLAN, but the workstation receives an IP address from the wrong subnet, indicating it is placed in an incorrect data VLAN. This typically occurs when the switchport's access VLAN (data VLAN) is misconfigured or mismatched with the workstation's expected subnet, while the voice VLAN (often using 802.1Q tagging) is correctly set for the phone.

Answer

If the phone works, the data VLAN must also be correct automatically.

Answer

The problem must be CAPWAP because phones require AP controllers.

Answer

The phone registration proves that DHCP cannot be the issue for the PC.

Question 15

Two switches, SW1 and SW2, are connected via a trunk link. Hosts in VLAN 50 on SW1 cannot communicate with hosts in VLAN 50 on SW2, while hosts in other VLANs communicate normally. What is the most likely cause?

Accepted Answer

VLAN 50 is not allowed on the trunk from SW1.. The strongest explanation is that VLAN 50 is missing from the allowed VLAN list on one side of the trunk. In practical terms, the trunk is up and carrying other VLANs, so the problem is selective rather than total. When one VLAN is omitted from the allowed list, only that VLAN fails while others continue to work normally.

This is a high-value switching troubleshooting pattern because it rewards careful reading of operational output rather than generic trunk theory.

Answer

The native VLAN must be changed to 50 on both switches.

Answer

The trunk must be changed to an access port.

Answer

The switches must run PPP on the uplink.