CCNA Switching and Network Access Practice Test 15 — 15 Questions

Question 1

Which command output would be the best next step to verify whether the port-channel is operational after configuration changes?

Accepted Answer

show etherchannel summary. The best next step is to check EtherChannel status directly. In practical terms, after fixing the member-link configuration, the quickest verification is to inspect the summary output that shows whether the bundle exists and whether the member ports are actively participating. That is more direct than checking unrelated switching or routing tables.

This is a simulation-style 'what do you verify next' question, which is important for realistic CCNA prep.

Answer

show ip ospf neighbor

Answer

show ip route

Answer

show access-lists

Question 2

A wireless client joins the correct SSID and gets an address in the correct employee subnet, but cannot reach only one internal application while everything else works. Which troubleshooting area is the strongest first target?

Accepted Answer

The path or policy specific to that application, since general employee connectivity already works.. The strongest first target is the application path or policy specific to that application because the client already has general connectivity: it joined the correct SSID, authenticated, and obtained an IP address in the employee subnet. A failure limited to one internal application indicates that basic WLAN join, DHCP, and overall routing are working; therefore, ACLs, firewall rules, DNS resolution for that service, or application-specific policies are the likely cause. Option B (SSID broadcast setting) is irrelevant because the client successfully joined the SSID and has connectivity. Option C (voice VLAN on the wired access port) is not a first target because the symptom involves a single data application, not voice, and the client is on the employee subnet, not a voice VLAN. Option D (OSPF router ID on the client) is invalid because client devices do not typically run OSPF; OSPF runs on routers, not wireless clients.

Answer

The SSID broadcast setting, because the client must not be joined correctly.

Answer

The voice VLAN on the wired access port connected to the AP uplink.

Answer

The OSPF router ID on the client device.

Question 3

A client connects to an employee WLAN using 802.1X authentication. The authentication process completes successfully, but the client fails to obtain an IP address via DHCP. What is the most likely cause?

Accepted Answer

The client is being placed into the wrong policy or VLAN after successful authentication.. Even after successful 802.1X authentication, the client may be assigned to the wrong VLAN or policy through RADIUS attributes (such as Tunnel-Type or Cisco AV-pair). If that VLAN lacks a DHCP server or correct subnet, the client will not receive an IP address. The other options describe issues that either prevent association entirely (wrong SSID) or are not typical causes in controller-based WLANs (static IP, AP gateway misconfiguration).

Answer

The WLAN is configured with the wrong SSID, which prevents DHCP packets from being forwarded.

Answer

The client has a static IP address manually configured, causing a DHCP conflict.

Answer

The access point is configured with an incorrect default gateway, preventing DHCP relay.

Question 4

A network administrator has several access points. All APs except one have successfully joined the wireless controller. The administrator verifies the failing AP’s IP address, subnet mask, and controller IP address are correctly configured. What is the most likely reason the AP cannot join the controller?

Accepted Answer

The AP has an incorrect default gateway for its subnet.. The most likely cause is that the AP has an incorrect default gateway. For the AP to reach the controller (which may be on a different subnet), it needs a correct default gateway to route traffic. The other APs joined successfully, eliminating a controller-wide issue. Option B is incorrect because CAPWAP requires an IP address; it does not work without one. Option C is incorrect because CAPWAP uses IP/UDP, not PPP. Option D is unlikely because there is no indication that the controller is at its AP limit; the problem affects only one AP, suggesting an individual misconfiguration.

Answer

CAPWAP can be used only if the AP has no IP address.

Answer

The AP must use PPP instead of Ethernet to reach the controller.

Answer

The controller can support only 14 APs maximum.

Question 5

After a hub was connected to interface Gi0/10, the interface immediately entered errdisable state. The following syslog message was generated: '%PORT_SECURITY-2-PSECURE_VIOLATION: Security violation occurred on interface Gi0/10.' What is the strongest explanation for why Gi0/10 shut down?

Accepted Answer

Port security detected more MAC addresses than allowed on the interface.. The strongest explanation is a port-security violation caused by the switch seeing more secure MAC addresses than the interface allows. In practical terms, a hub or unmanaged device can cause multiple end hosts to appear behind one access port. If the interface is configured with a maximum of one secure MAC address, additional learned MACs trigger the violation action.

This is a realistic access-layer security scenario because the port does not fail randomly. It fails because the observed behavior violates the configured policy.

Answer

The interface received a superior BPDU and became the root port.

Answer

The hub forced the interface to become a routed port.

Answer

DHCP snooping always shuts a port when a hub is attached.

Question 6

A user can connect to the employee SSID and receive the correct employee IP subnet, but access to one internal application fails only for that WLAN while wired users succeed. Which troubleshooting area is the strongest first focus?

Accepted Answer

A WLAN-specific policy or filtering rule affecting access to that application. The strongest first focus is the policy or filtering path specific to that WLAN or traffic class. In practical terms, the user has already shown that the correct WLAN join, authentication, and subnet assignment are working. Because wired users succeed and only one application fails from that WLAN, the most likely issue is a WLAN-specific policy, ACL, firewall rule, or path treatment affecting that application.

This is a realistic selective-access troubleshooting scenario and tests whether the candidate narrows the fault domain correctly.

Answer

The SSID broadcast setting

Answer

Whether the access point has a valid hostname

Answer

Whether the client is using PPP instead of Ethernet

Question 7

A user joins the employee SSID successfully and can browse internal resources, but VoIP over Wi-Fi calls fail only while roaming between floors. Which troubleshooting area is the strongest first focus?

Accepted Answer

Roaming behavior and RF transition quality between AP coverage areas. The strongest first focus is roaming and RF transition behavior between AP coverage areas. In practical terms, the user already proved that general WLAN access and internal reachability are working. The failure happens during movement and affects a time-sensitive application. That points to mobility-related behavior rather than basic SSID visibility or simple IP addressing.

This is a realistic wireless troubleshooting item because it narrows the fault domain from the symptom pattern instead of restarting from the basics.

Answer

Whether the SSID name is spelled correctly

Answer

Whether the branch router has PPP enabled

Answer

Whether the user has a static default route on the phone

Question 8

Based on the exhibit, which action is most likely required to allow AP-22 to join the controller successfully?

Accepted Answer

Correct the AP's default gateway so it matches the AP's actual subnet and reachability needs.. The correct action is to fix the AP's default gateway so it can reach the controller's subnet. Option B is wrong because APs use Ethernet, not PPP encapsulation, which is used for serial WAN links. Option C is wrong because CAPWAP does not assign IP addresses; DHCP does, but the AP already has a static IP, and removing it would cause it to fall back to DHCP, which may not fix the gateway issue. Option D is wrong because disabling DHCP on the controller would affect all APs and prevent new APs from obtaining addresses, which is not a targeted fix.

Answer

Change the AP from Ethernet to PPP encapsulation.

Answer

Remove the AP IP address so it can obtain an IP address automatically via DHCP.

Answer

Disable DHCP on the controller for all APs.

Question 9

A network administrator notices that a switchport in access mode with PortFast enabled has transitioned to an err-disabled state. What is the most likely cause?

Accepted Answer

BPDU Guard disabled the PortFast-enabled access port after it received a BPDU.. The strongest reason is a BPDU Guard violation on a PortFast-enabled access port. In practical terms, the port was expected to face an end host, not a switching device that emits BPDUs. When BPDUs appeared, the switch treated that as a topology-policy violation and error-disabled the interface to protect the network.

This is one of the most classic access-layer protection patterns on the CCNA exam.

Answer

Port security shut down the port because the VLAN was wrong.

Answer

DHCP snooping disabled the interface because a host requested an address.

Answer

EtherChannel suspended the interface because the bundle was incomplete.

Question 10

Users in VLAN 60 on switch SW2 cannot reach the default gateway located on switch SW1. The trunk between SW1 and SW2 is operational and allows VLAN 60. What is the most likely reason for this issue?

Accepted Answer

VLAN 60 does not exist locally on SW2.. VLAN 60 has not been created locally on SW2, even though the trunk can carry its traffic. A switch never processes VLAN traffic for a VLAN it doesn't know about; it discards tagged frames from the trunk destined for that VLAN and prevents access ports from assigning frames to it. (A) is correct. (B) is incorrect because native VLAN configuration only affects untagged frames—changing it to 60 is unnecessary for tagged VLAN 60 traffic. (C) is incorrect because the trunk is already configured to allow VLAN 60, so trunk filtering isn't the problem. (D) is incorrect because a default gateway is simply an IP address on a router or Layer 3 switch interface (like SVIs) and does not require a loopback on SW2.

Answer

The native VLAN must be changed to 60 on both switches.

Answer

VLAN 60 is not allowed on the trunk link.

Answer

The default gateway must be configured as a loopback on SW2.

Question 11

A user reports that the corporate SSID is visible and accepts the correct password, but the client always lands in a quarantined remediation network. Which troubleshooting area is strongest?

Accepted Answer

Post-authentication policy, role, or VLAN assignment logic. The strongest troubleshooting area is post-authentication policy or role assignment. The client already sees the SSID and successfully authenticates, so the problem is not RF visibility or password failure. Landing in a remediation network indicates a policy decision after authentication, such as a mismatched VLAN assignment or client role. Option B (hidden SSID) is irrelevant because the SSID is visible. Option C (PPP encapsulation) does not affect post-authentication network placement. Option D (OSPF DR election) is unrelated to client VLAN assignment.

Answer

Whether the SSID is hidden instead of broadcast

Answer

Whether the AP uplink uses PPP encapsulation

Answer

Whether OSPF designated routers are elected correctly

Question 12

Exhibit: After a new switch was connected, the access-layer port went into err-disabled state immediately. Which feature most likely caused this?

Accepted Answer

BPDU Guard. BPDU Guard is the most likely cause because it immediately places a PortFast-enabled port into the err-disabled state upon receiving any BPDU, which is exactly what happens when a new switch is connected to an access port meant for end devices. Root Guard does not err-disable a port; instead, it puts the port into a root-inconsistent state when a superior BPDU is received, preventing the port from becoming a root port but still allowing traffic. UDLD aggressive can cause err-disabled states, but it is specifically designed to detect unidirectional links on fiber connections and requires a delay or misconfiguration, making it less immediate than BPDU Guard in this scenario. Storm control can err-disable a port if traffic exceeds thresholds, but this is not immediate upon connection unless a broadcast storm is already occurring, which is not indicated in the scenario.

Answer

Root Guard

Answer

UDLD aggressive

Answer

Storm control

Question 13

A switchport is configured as an access port for VLAN 20, but users connected to it cannot reach the default gateway. The switch shows the interface as up/up. Which switch misconfiguration is the most likely cause?

Accepted Answer

VLAN 20 has not been created on the switch. If the access port is assigned to VLAN 20 but VLAN 20 does not exist in the VLAN database, traffic is not placed into a usable VLAN and hosts lose connectivity. The port can still appear physically up while forwarding fails at Layer 2.

Answer

The access port is missing a speed command

Answer

The switch has not enabled VTP transparent mode

Answer

The port should use DTP desirable mode

Question 14

A two-switch EtherChannel bundle is configured with LACP. One side uses active mode on both member links, while the other side uses passive mode on both member links. What is the result?

Accepted Answer

The bundle forms successfully. LACP forms a channel when at least one side actively sends negotiation frames. Active-to-passive works. Passive-to-passive would fail, but that is not the case here.

Answer

The links remain individual because both sides must use active

Answer

The bundle forms only if PAgP is also enabled

Answer

The channel comes up but forwards only one VLAN

Question 15

Exhibit: A switch interface connected to an IP phone and PC is configured as an access port in VLAN 10. The PC works, but the phone does not register. What additional configuration is most likely needed?

Accepted Answer

switchport voice vlan <voice-vlan-id>. An IP phone commonly requires a voice VLAN so tagged voice traffic is separated from the data VLAN used by the attached PC. Without a voice VLAN, the PC can still work on the access VLAN while the phone fails to register properly.

Answer

switchport trunk encapsulation dot1q

Answer

channel-group 1 mode active

Answer

ip helper-address on the switchport