CCNA Switching and Network Access Practice Test 14 — 15 Questions

Question 1

A network administrator is troubleshooting connectivity issues in a switched network. Hosts on VLAN 10 connected to SwitchC cannot reach the VLAN 10 gateway, which is connected to SwitchA. The administrator checks the STP status on SwitchC and sees that the port connecting to the root bridge is in a blocking state. The administrator also notices that the VLAN 10 gateway is reachable from SwitchA, but not from SwitchC. What is the most likely cause of this issue?

Accepted Answer

Change the STP priority on SwitchC to a lower value (e.g., 24576) to ensure it is not the root bridge.. The root bridge for VLAN 10 is SwitchA, and SwitchC's port to the root bridge is in a blocking state due to STP. Since the VLAN 10 gateway is reachable from SwitchA but not from SwitchC, the issue is that SwitchC is not the root bridge and its path to the root is blocked, preventing traffic from reaching the gateway. Lowering the STP priority on SwitchC to 24576 would make it the root bridge for VLAN 10, ensuring its port to the gateway is in a forwarding state and restoring connectivity.

Answer

Configure PortFast on interface Gi0/2 to bring it up immediately.

Answer

Enable BPDU Guard on interface Gi0/2 to prevent BPDU attacks.

Answer

Configure the spanning-tree mode to PVST+ instead of Rapid PVST+.

Question 2

A network administrator is troubleshooting connectivity loss in a switched network. All switches run Rapid PVST+. A host connected to an access port on SwitchC can no longer reach the default gateway. The access port is configured with PortFast and BPDU Guard. The administrator checks the interface status and finds it in an err-disabled state. What is the most likely cause of this issue?

Accepted Answer

BPDU Guard detected a BPDU on a PortFast-enabled port and disabled it.. B is correct because BPDU Guard is designed to protect the spanning-tree topology by disabling a PortFast-enabled port if it receives a BPDU, placing the port in err-disabled state. Option A is incorrect: a root bridge election failure would not cause a port to err-disable; loops do not directly trigger this state without BPDU Guard. Option C is incorrect because PortFast and BPDU Guard work with all spanning-tree variants including Rapid PVST+. Option D is incorrect: a trunk misconfiguration alone would not cause err-disable unless BPDU Guard detects a BPDU on a PortFast port.

Answer

The root bridge election failed, causing a loop.

Answer

Rapid PVST+ is not compatible with PortFast.

Answer

The port is configured as a trunk but should be an access port.

Question 3

Which TWO statements correctly describe the behavior of Rapid PVST+ in a Layer 2 network?

Accepted Answer

Rapid PVST+ runs a separate instance of RSTP for each VLAN.. Rapid PVST+ runs a separate instance of RSTP (802.1w) for each VLAN, enabling per-VLAN rapid convergence and load balancing. Option D is correct because PortFast allows access ports to transition to forwarding immediately, while BPDU Guard prevents loops by disabling a port that receives a BPDU. Option B is incorrect because Rapid PVST+ uses RSTP's handshake mechanism, not timer-based convergence like 802.1D. Option C is wrong: Rapid PVST+ is based on 802.1w, not 802.1D. Option E is false because Rapid PVST+ does not use 802.1Q to reduce instances; it maintains a separate spanning-tree instance per VLAN.

Answer

Rapid PVST+ is an enhancement of PVST+ and uses the same timer-based convergence as standard 802.1D.

Answer

Rapid PVST+ uses the 802.1D standard to compute the spanning tree for each VLAN.

Answer

Rapid PVST+ uses the 802.1Q trunking protocol to reduce the number of spanning-tree instances.

Question 4

Which TWO of the following statements about Spanning Tree Protocol (STP) and Rapid PVST+ are true?

Accepted Answer

The root bridge in STP is elected based on the lowest bridge ID.. Option A is correct because the root bridge in STP is elected based on the numerically smallest bridge ID (priority + MAC address). Option D is correct because BPDU Guard, when enabled on a PortFast-enabled port, immediately error-disables the port if a BPDU is received, protecting against accidental loops. Option B is incorrect because the root bridge is chosen by the lowest bridge ID, not the highest. Option C is incorrect because PortFast and BPDU Guard are independent features; PortFast does not automatically enable BPDU Guard. Option E is incorrect because both traditional STP (802.1D) and Rapid PVST+ (RSTP-based) use the same root bridge election process—lowest bridge ID.

Answer

The root bridge in STP is elected based on the highest bridge ID.

Answer

PortFast automatically enables BPDU Guard on an interface.

Answer

Rapid PVST+ uses a different root bridge election process than traditional STP.

Question 5

Drag and drop the STP-related terms on the left to their correct descriptions on the right.

Accepted Answer

Root Bridge: The bridge with the lowest bridge ID in the STP topology. These pairings correctly match STP terms with their standard definitions as used in networking certifications.

Question 6

Drag and drop the STP/Rapid PVST+ terms on the left to the correct descriptions on the right.

Accepted Answer

Root bridge: Bridge with the lowest bridge ID in the STP topology. These definitions match standard STP/Rapid PVST+ terminology.

Question 7

A network administrator notices that hosts in VLAN 10 cannot ping the default gateway (192.168.10.1). The switch's SVI for VLAN 10 is configured and the output of the show ip interface brief command shows its status as up/up. An embedded packet capture is configured. The exhibit shows ARP requests from a host to 192.168.10.1 but no ARP reply. Based on the exhibit, what is the most likely cause of the connectivity issue?

Accepted Answer

The switchport connecting the host is not assigned to VLAN 10.. The correct answer is B because the packet capture shows ARP requests from the host but no reply, indicating the switch's VLAN 10 SVI is not receiving the ARP frames. Since the SVI is confirmed up/up, the most likely cause is that the switchport connecting the host is not assigned to VLAN 10, causing the frames to be on a different VLAN. Option A is incorrect because the host's default gateway is correctly set to 192.168.10.1 (the SVI's IP); ARP requests are being sent but not answered. Option C is wrong because an ACL on the SVI would not block ARP (ARP is a Layer 2 protocol not filtered by IP ACLs), and the capture would show a reply if the SVI received the request. Option D is incorrect because the exhibit shows the SVI is up/up, ruling out an administratively down condition.

Answer

The default gateway is configured incorrectly on the host.

Answer

An ACL is applied to the SVI blocking ICMP.

Answer

The SVI is administratively down.

Question 8

A network administrator is troubleshooting an issue where hosts on VLAN 10 cannot ping the default gateway at 192.168.10.1. The router (R1) has an SVI for VLAN 10 with IP 192.168.10.1/24. The administrator captures traffic on the router's G0/0/0 interface (trunk to the switch) and reviews the embedded packet capture output. What is the root cause of the problem?

Accepted Answer

The switch port connecting the host is configured in the wrong VLAN (e.g., VLAN 20 instead of VLAN 10).. The captured traffic on the trunk shows that the router is not receiving any frames tagged with VLAN 10 from the host. If the switch port connecting the host is configured in VLAN 20 instead of VLAN 10, the host's frames will be tagged with VLAN 20 (or remain untagged in the access VLAN 20) and will not reach the router's SVI for VLAN 10, causing the ping to fail. This is the most direct cause given the symptom that the host cannot ping the default gateway.

Answer

The router's SVI for VLAN 10 is administratively down.

Answer

An inbound ACL on the router's SVI is blocking ICMP echo requests from the host.

Answer

The router has ICMP redirects enabled, causing it to ignore the pings.

Question 9

A network engineer is troubleshooting a connectivity issue between two hosts on different VLANs. The engineer captures traffic on an IOS-XE router's GigabitEthernet0/1 interface using embedded packet capture (EPC). The output shows ARP requests from Host A (192.168.1.10) but no ARP replies from Host B (192.168.2.20). What is the most likely cause of this issue?

Accepted Answer

The router's interface does not have an IP address configured in the VLAN 2 subnet.. The router's GigabitEthernet0/1 interface must have an IP address in the same subnet as Host B (192.168.2.20) to act as the default gateway for VLAN 2. Without an IP address in the VLAN 2 subnet, the router cannot respond to ARP requests for that subnet, so Host A's ARP requests for Host B go unanswered. This is the most likely cause because the router performs inter-VLAN routing only when it has an interface (or subinterface) with an IP address in the destination VLAN's subnet.

Answer

The router's interface is configured as an access port instead of a trunk.

Answer

Host A is in a different VLAN than the router's interface.

Answer

The router's interface has a duplex mismatch with the switch.

Question 10

Which TWO statements correctly describe aspects of interpreting packet capture output for Layer 2/3 troubleshooting using Wireshark or embedded packet capture on IOS-XE?

Accepted Answer

A large number of ARP requests for the same IP address in a packet capture suggests a possible Layer 3 connectivity issue, such as a missing default gateway.. Option B is correct because a large number of ARP requests for the same IP address indicates that the device is repeatedly trying to resolve the Layer 3 address to a Layer 2 MAC address, but no device is responding. This often happens when the target IP (e.g., the default gateway) is unreachable or misconfigured, pointing to a Layer 3 connectivity issue. Option D is correct because IOS-XE embedded packet capture supports both ingress and egress capture directions, allowing you to verify whether a router is dropping or modifying packets as they transit. Option A is incorrect: DHCP Discover is broadcast, not unicast, because the client does not yet know the server’s MAC address. Option C is incorrect: a SYN-ACK is part of a successful three-way handshake (SYN, SYN-ACK, ACK) and indicates the server is reachable; if the handshake failed, you would see only SYN packets or RST packets. Option E is incorrect: the TTL value in a captured packet shows the current TTL after decrementing by each hop; the original TTL is not preserved in the packet.

Answer

A DHCP Discover packet in a Wireshark capture shows a unicast destination MAC address to the DHCP server.

Answer

A TCP SYN-ACK packet in a capture indicates that the three-way handshake failed and the destination is unreachable.

Answer

The TTL value in a captured IP packet always shows the original TTL set by the source host.

Question 11

A network administrator has configured Rapid PVST+ on all switches and globally enabled BPDU Guard. After connecting a new access switch to an existing distribution switch, the distribution switch interface goes into err-disabled state. The new switch is configured with PortFast on its uplink port. What is the most likely cause of the err-disabled state?

Accepted Answer

Disable BPDU Guard on the distribution switch interface. The distribution switch interface entered err-disabled because it received a BPDU while BPDU Guard was enabled. BPDU Guard is not automatically enabled with PortFast; it must be explicitly turned on, and the scenario assumes it is active. When a BPDU arrives on a BPDU Guard–enabled port, the switch err-disables it to prevent loops. Disabling BPDU Guard on that interface resolves the condition. Disabling Root Guard (option A) would not stop the BPDU Guard trigger; removing PortFast (option C) would not disable the already-enabled BPDU Guard; and changing the port to access mode (option D) is irrelevant to BPDU Guard behavior.

Answer

Disable Root Guard on the distribution switch interface

Answer

Remove PortFast from the new access switch uplink interface

Answer

Configure the interface as an access port instead of trunk

Question 12

A network engineer notices that a new switch, SW3, was connected to port GigabitEthernet0/1 on SW1, but the port immediately went into an err-disabled state. The network uses Rapid PVST+ with BPDU Guard enabled globally on all access ports. The engineer checks the logs and sees 'bpduguard error detected' messages. What is the most likely cause of the err-disabled state?

Accepted Answer

A BPDU was received on port GigabitEthernet0/1, triggering BPDU Guard.. The err-disabled state is caused by BPDU Guard triggering when a BPDU is received on an access port. Option A is incorrect because BPDU Guard is intentionally enabled on access ports to prevent unauthorized switches from joining the network. Option C is wrong because Root Guard prevents a port from becoming the root, not from receiving BPDUs. Option D is wrong because Loop Guard prevents loops on blocked ports in case of unidirectional links, not relevant to BPDU reception.

Answer

The port is configured as an access port, but BPDU Guard should be disabled on all access ports.

Answer

Configure Root Guard on the interface to prevent the err-disabled state.

Answer

Enable Loop Guard on the interface to prevent the err-disabled state.

Question 13

A network administrator recently configured BPDU Guard on all access ports of a switch to protect against rogue switches. After the change, users in VLAN 10 report intermittent connectivity issues and frequent link flaps. The administrator checks the switch and notices that several ports are in an err-disabled state. What is the most likely cause of the problem?

Accepted Answer

BPDU Guard is enabled on access ports that are receiving BPDUs, causing the ports to go into err-disabled state.. BPDU Guard is configured to protect against rogue switches by placing a port into an err-disabled state upon receiving a BPDU. In this scenario, BPDU Guard is enabled on access ports that are receiving BPDUs (possibly from a rogue switch or misconfiguration), causing the ports to err-disable and flap. PortFast is not required for BPDU Guard to function; the issue is that BPDUs are being received on ports that are not expected to receive them. The intermittent connectivity occurs as ports cycle into err-disabled and are re-enabled.

Answer

Root Guard is preventing the port from becoming a root port.

Answer

Loop Guard has detected a unidirectional link and placed the port into err-disabled state.

Answer

BPDU Guard is globally enabled but not configured on the interface, so the port is err-disabled due to a BPDU received.

Question 14

A network engineer receives a call that users in VLAN 10 on Switch B cannot ping the default gateway, which is a router on a stick connected to Switch A. The engineer checks the Spanning Tree Protocol state on the interface connecting Switch A to Switch B (GigabitEthernet0/1) and finds it is in a root-inconsistent state. Which command output best explains the cause of the issue?

Accepted Answer

Root guard is enabled and the port received a superior BPDU, causing it to become root-inconsistent.. Root guard, when enabled on a port, places that port into a root-inconsistent blocking state if it receives a superior BPDU, preventing the switch from becoming the root bridge. This root-inconsistent state stops forwarding traffic, which explains why users in VLAN 10 cannot reach the default gateway. The port remains physically up but is blocked by spanning tree, so normal interface status would not show a down state, making the root-inconsistent state the key indicator.

Answer

The interface is in err-disable state due to BPDU guard.

Answer

Loop guard is enabled and the port is in a blocking state due to missing BPDUs.

Answer

The port is in a forwarding state but the VLAN is misconfigured.

Question 15

Which TWO of the following statements accurately describe the configuration and behavior of Root Guard, Loop Guard, and BPDU Guard in Rapid PVST+ environments?

Accepted Answer

Root Guard, when enabled on a port, prevents that port from becoming the root port by placing it in a root-inconsistent state if a superior BPDU is received.. Option A is correct because Root Guard prevents a port from becoming a root port by placing it in a root-inconsistent (blocking) state upon receiving a superior BPDU, protecting the root bridge placement. Option D is correct because BPDU Guard errdisables a port upon receiving a BPDU, a feature typically applied to access ports to block unauthorized switches. Option B is wrong: Root Guard does not shut down the port; it places it in a blocked state, unlike BPDU Guard's errdisable action. Option C is wrong: Loop Guard does not disable a port when BPDUs stop being received; instead, it moves the port to a loop-inconsistent (blocking) state to guard against unidirectional link failures. Option E is wrong: BPDU Guard errdisables ports, whereas the loop-inconsistent blocking state is used by Loop Guard or Root Guard, not BPDU Guard.

Answer

Root Guard automatically shuts down the port when a superior BPDU is received, similar to BPDU Guard.

Answer

Loop Guard, when enabled, disables a port if BPDUs are no longer received on it, preventing a unidirectional link failure.

Answer

BPDU Guard places the port in a blocking state (loop-inconsistent) when a BPDU is received, similar to Loop Guard.

CCNA Switching and Network Access Practice Test 14 — 15 Questions

Exhibit

CCNA Switching and Network Access Practice Test 14 — 15 Questions

Exhibit