CCNA Switching and Network Access Practice Test 15 — 15 Questions

Question 1

A host on a guest WLAN can browse the Internet but cannot reach internal corporate resources, while employees on another SSID can. Which statement best explains why that can be a correct design outcome?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Because guest and employee WLANs can intentionally have different trust levels and access policies.. Guest wireless networks are intentionally isolated from corporate resources through separate trust levels and access policies. Option B is incorrect because guest WLANs can use IP routing, but routing policies restrict which destinations are reachable. Option C is incorrect because inter-VLAN routing is not inherently disabled; it is a design choice to restrict routing between VLANs. Option D is incorrect because SSIDs themselves do not trigger firewall rules; it is the VLAN or group assignment that determines the applied policy.

Answer

Because guest WLANs cannot use IP routing at all.

Answer

Because the guest WLAN is assigned to a different VLAN that uses a different IP subnet, and inter-VLAN routing is inherently disabled for security reasons.

Answer

Because the guest WLAN uses a different SSID that automatically triggers firewall rules that only permit HTTP/HTTPS traffic.

Question 2

A phone and PC share one switchport. The phone registers successfully, but the workstation receives an address from the wrong subnet. Which explanation is strongest?

Accepted Answer

The workstation is likely in the wrong data VLAN even though the phone is in the correct voice VLAN.. The phone and PC share a single switchport configured with separate voice and data VLANs. The phone successfully registers in the voice VLAN, but the workstation receives an IP address from the wrong subnet, indicating it is placed in an incorrect data VLAN. This typically occurs when the switchport's access VLAN (data VLAN) is misconfigured or mismatched with the workstation's expected subnet, while the voice VLAN (often using 802.1Q tagging) is correctly set for the phone.

Answer

If the phone works, the data VLAN must also be correct automatically.

Answer

The problem must be CAPWAP because phones require AP controllers.

Answer

The phone registration proves that DHCP cannot be the issue for the PC.

Question 3

Two switches, SW1 and SW2, are connected via a trunk link. Hosts in VLAN 50 on SW1 cannot communicate with hosts in VLAN 50 on SW2, while hosts in other VLANs communicate normally. What is the most likely cause?

Accepted Answer

VLAN 50 is not allowed on the trunk from SW1.. The strongest explanation is that VLAN 50 is missing from the allowed VLAN list on one side of the trunk. In practical terms, the trunk is up and carrying other VLANs, so the problem is selective rather than total. When one VLAN is omitted from the allowed list, only that VLAN fails while others continue to work normally.

This is a high-value switching troubleshooting pattern because it rewards careful reading of operational output rather than generic trunk theory.

Answer

The native VLAN must be changed to 50 on both switches.

Answer

The trunk must be changed to an access port.

Answer

The switches must run PPP on the uplink.

Question 4

Which command output would be the best next step to verify whether the port-channel is operational after configuration changes?

Accepted Answer

show etherchannel summary. The best next step is to check EtherChannel status directly. In practical terms, after fixing the member-link configuration, the quickest verification is to inspect the summary output that shows whether the bundle exists and whether the member ports are actively participating. That is more direct than checking unrelated switching or routing tables.

This is a simulation-style 'what do you verify next' question, which is important for realistic CCNA prep.

Answer

show ip ospf neighbor

Answer

show ip route

Answer

show access-lists

Question 5

A wireless client joins the correct SSID and gets an address in the correct employee subnet, but cannot reach only one internal application while everything else works. Which troubleshooting area is the strongest first target?

Accepted Answer

The path or policy specific to that application, since general employee connectivity already works.. The strongest first target is the application path or policy specific to that application because the client already has general connectivity: it joined the correct SSID, authenticated, and obtained an IP address in the employee subnet. A failure limited to one internal application indicates that basic WLAN join, DHCP, and overall routing are working; therefore, ACLs, firewall rules, DNS resolution for that service, or application-specific policies are the likely cause. Option B (SSID broadcast setting) is irrelevant because the client successfully joined the SSID and has connectivity. Option C (voice VLAN on the wired access port) is not a first target because the symptom involves a single data application, not voice, and the client is on the employee subnet, not a voice VLAN. Option D (OSPF router ID on the client) is invalid because client devices do not typically run OSPF; OSPF runs on routers, not wireless clients.

Answer

The SSID broadcast setting, because the client must not be joined correctly.

Answer

The voice VLAN on the wired access port connected to the AP uplink.

Answer

The OSPF router ID on the client device.

Question 6

A client connects to an employee WLAN using 802.1X authentication. The authentication process completes successfully, but the client fails to obtain an IP address via DHCP. What is the most likely cause?

Accepted Answer

The client is being placed into the wrong policy or VLAN after successful authentication.. Even after successful 802.1X authentication, the client may be assigned to the wrong VLAN or policy through RADIUS attributes (such as Tunnel-Type or Cisco AV-pair). If that VLAN lacks a DHCP server or correct subnet, the client will not receive an IP address. The other options describe issues that either prevent association entirely (wrong SSID) or are not typical causes in controller-based WLANs (static IP, AP gateway misconfiguration).

Answer

The WLAN is configured with the wrong SSID, which prevents DHCP packets from being forwarded.

Answer

The client has a static IP address manually configured, causing a DHCP conflict.

Answer

The access point is configured with an incorrect default gateway, preventing DHCP relay.

Question 7

A network administrator has several access points. All APs except one have successfully joined the wireless controller. The administrator verifies the failing AP’s IP address, subnet mask, and controller IP address are correctly configured. What is the most likely reason the AP cannot join the controller?

Accepted Answer

The AP has an incorrect default gateway for its subnet.. The most likely cause is that the AP has an incorrect default gateway. For the AP to reach the controller (which may be on a different subnet), it needs a correct default gateway to route traffic. The other APs joined successfully, eliminating a controller-wide issue. Option B is incorrect because CAPWAP requires an IP address; it does not work without one. Option C is incorrect because CAPWAP uses IP/UDP, not PPP. Option D is unlikely because there is no indication that the controller is at its AP limit; the problem affects only one AP, suggesting an individual misconfiguration.

Answer

CAPWAP can be used only if the AP has no IP address.

Answer

The AP must use PPP instead of Ethernet to reach the controller.

Answer

The controller can support only 14 APs maximum.

Question 8

After a hub was connected to interface Gi0/10, the interface immediately entered errdisable state. The following syslog message was generated: '%PORT_SECURITY-2-PSECURE_VIOLATION: Security violation occurred on interface Gi0/10.' What is the strongest explanation for why Gi0/10 shut down?

Accepted Answer

Port security detected more MAC addresses than allowed on the interface.. The strongest explanation is a port-security violation caused by the switch seeing more secure MAC addresses than the interface allows. In practical terms, a hub or unmanaged device can cause multiple end hosts to appear behind one access port. If the interface is configured with a maximum of one secure MAC address, additional learned MACs trigger the violation action.

This is a realistic access-layer security scenario because the port does not fail randomly. It fails because the observed behavior violates the configured policy.

Answer

The interface received a superior BPDU and became the root port.

Answer

The hub forced the interface to become a routed port.

Answer

DHCP snooping always shuts a port when a hub is attached.

Question 9

A user can connect to the employee SSID and receive the correct employee IP subnet, but access to one internal application fails only for that WLAN while wired users succeed. Which troubleshooting area is the strongest first focus?

Accepted Answer

A WLAN-specific policy or filtering rule affecting access to that application. The strongest first focus is the policy or filtering path specific to that WLAN or traffic class. In practical terms, the user has already shown that the correct WLAN join, authentication, and subnet assignment are working. Because wired users succeed and only one application fails from that WLAN, the most likely issue is a WLAN-specific policy, ACL, firewall rule, or path treatment affecting that application.

This is a realistic selective-access troubleshooting scenario and tests whether the candidate narrows the fault domain correctly.

Answer

The SSID broadcast setting

Answer

Whether the access point has a valid hostname

Answer

Whether the client is using PPP instead of Ethernet

Question 10

A user joins the employee SSID successfully and can browse internal resources, but VoIP over Wi-Fi calls fail only while roaming between floors. Which troubleshooting area is the strongest first focus?

Accepted Answer

Roaming behavior and RF transition quality between AP coverage areas. The strongest first focus is roaming and RF transition behavior between AP coverage areas. In practical terms, the user already proved that general WLAN access and internal reachability are working. The failure happens during movement and affects a time-sensitive application. That points to mobility-related behavior rather than basic SSID visibility or simple IP addressing.

This is a realistic wireless troubleshooting item because it narrows the fault domain from the symptom pattern instead of restarting from the basics.

Answer

Whether the SSID name is spelled correctly

Answer

Whether the branch router has PPP enabled

Answer

Whether the user has a static default route on the phone

Question 11

Based on the exhibit, which action is most likely required to allow AP-22 to join the controller successfully?

Accepted Answer

Correct the AP's default gateway so it matches the AP's actual subnet and reachability needs.. The correct action is to fix the AP's default gateway so it can reach the controller's subnet. Option B is wrong because APs use Ethernet, not PPP encapsulation, which is used for serial WAN links. Option C is wrong because CAPWAP does not assign IP addresses; DHCP does, but the AP already has a static IP, and removing it would cause it to fall back to DHCP, which may not fix the gateway issue. Option D is wrong because disabling DHCP on the controller would affect all APs and prevent new APs from obtaining addresses, which is not a targeted fix.

Answer

Change the AP from Ethernet to PPP encapsulation.

Answer

Remove the AP IP address so it can obtain an IP address automatically via DHCP.

Answer

Disable DHCP on the controller for all APs.

Question 12

A network administrator notices that a switchport in access mode with PortFast enabled has transitioned to an err-disabled state. What is the most likely cause?

Accepted Answer

BPDU Guard disabled the PortFast-enabled access port after it received a BPDU.. The strongest reason is a BPDU Guard violation on a PortFast-enabled access port. In practical terms, the port was expected to face an end host, not a switching device that emits BPDUs. When BPDUs appeared, the switch treated that as a topology-policy violation and error-disabled the interface to protect the network.

This is one of the most classic access-layer protection patterns on the CCNA exam.

Answer

Port security shut down the port because the VLAN was wrong.

Answer

DHCP snooping disabled the interface because a host requested an address.

Answer

EtherChannel suspended the interface because the bundle was incomplete.

Question 13

Users in VLAN 60 on switch SW2 cannot reach the default gateway located on switch SW1. The trunk between SW1 and SW2 is operational and allows VLAN 60. What is the most likely reason for this issue?

Accepted Answer

VLAN 60 does not exist locally on SW2.. VLAN 60 has not been created locally on SW2, even though the trunk can carry its traffic. A switch never processes VLAN traffic for a VLAN it doesn't know about; it discards tagged frames from the trunk destined for that VLAN and prevents access ports from assigning frames to it. (A) is correct. (B) is incorrect because native VLAN configuration only affects untagged frames—changing it to 60 is unnecessary for tagged VLAN 60 traffic. (C) is incorrect because the trunk is already configured to allow VLAN 60, so trunk filtering isn't the problem. (D) is incorrect because a default gateway is simply an IP address on a router or Layer 3 switch interface (like SVIs) and does not require a loopback on SW2.

Answer

The native VLAN must be changed to 60 on both switches.

Answer

VLAN 60 is not allowed on the trunk link.

Answer

The default gateway must be configured as a loopback on SW2.

Question 14

A user reports that the corporate SSID is visible and accepts the correct password, but the client always lands in a quarantined remediation network. Which troubleshooting area is strongest?

Accepted Answer

Post-authentication policy, role, or VLAN assignment logic. The strongest troubleshooting area is post-authentication policy or role assignment. The client already sees the SSID and successfully authenticates, so the problem is not RF visibility or password failure. Landing in a remediation network indicates a policy decision after authentication, such as a mismatched VLAN assignment or client role. Option B (hidden SSID) is irrelevant because the SSID is visible. Option C (PPP encapsulation) does not affect post-authentication network placement. Option D (OSPF DR election) is unrelated to client VLAN assignment.

Answer

Whether the SSID is hidden instead of broadcast

Answer

Whether the AP uplink uses PPP encapsulation

Answer

Whether OSPF designated routers are elected correctly

Question 15

Exhibit: After a new switch was connected, the access-layer port went into err-disabled state immediately. Which feature most likely caused this?

Accepted Answer

BPDU Guard. BPDU Guard is the most likely cause because it immediately places a PortFast-enabled port into the err-disabled state upon receiving any BPDU, which is exactly what happens when a new switch is connected to an access port meant for end devices. Root Guard does not err-disable a port; instead, it puts the port into a root-inconsistent state when a superior BPDU is received, preventing the port from becoming a root port but still allowing traffic. UDLD aggressive can cause err-disabled states, but it is specifically designed to detect unidirectional links on fiber connections and requires a delay or misconfiguration, making it less immediate than BPDU Guard in this scenario. Storm control can err-disable a port if traffic exceeds thresholds, but this is not immediate upon connection unless a broadcast storm is already occurring, which is not indicated in the scenario.

Answer

Root Guard

Answer

UDLD aggressive

Answer

Storm control