CCNA Switching and Network Access Practice Test 16 — 15 Questions

Question 1

A network engineer is configuring a new access switch that will connect to a distribution switch. The engineer must ensure that local hosts are placed in the correct VLANs before enabling trunking to the distribution switch to prevent VLAN mismatches and broadcast issues. Drag and drop the steps into the correct order.

Accepted Answer

Create VLANs → Assign access ports → Configure 802.1Q trunks with native VLAN → Verify with show vlan brief and show interfaces trunk. The correct order is to create VLANs first, then assign access ports to those VLANs so local hosts are properly placed and operational. Only then should 802.1Q trunks be configured to extend VLANs to other switches, because trunking before access port assignment could lead to operational inconsistencies. Options B and D would require access ports before VLANs exist, and Option C configures trunks prematurely in this scenario.

Question 2

Which TWO statements are true regarding VLAN configuration, 802.1Q trunking, and the native VLAN?

Accepted Answer

The native VLAN should be changed from the default VLAN 1 to an unused VLAN for security reasons.. Option B is correct because changing the native VLAN from the default VLAN 1 to an unused VLAN is a recommended security best practice to prevent VLAN hopping attacks. Option D is correct because 802.1Q uses a 12-bit VLAN ID field, allowing VLAN IDs from 1 to 4094 (0 and 4095 are reserved). Option A is false: on an 802.1Q trunk, frames in the native VLAN are typically sent untagged. Option C is false: 802.1Q is an IEEE standard, not Cisco proprietary (ISL is Cisco proprietary). Option E is false: the native VLAN does not have to match on both ends; mismatched native VLANs can cause traffic to be misclassified but the trunk will still operate.

Answer

On an 802.1Q trunk, frames in the native VLAN are always tagged with a VLAN ID.

Answer

802.1Q is a Cisco proprietary trunking protocol.

Answer

The native VLAN must be the same on both ends of an 802.1Q trunk for the trunk to operate.

Question 3

Drag and drop the following steps into the recommended order to configure a switch port for a VoIP phone (voice VLAN + data VLAN), an AP trunk, and a PoE-powered IoT device.

Accepted Answer

Enter global configuration mode, then interface configuration mode for the switch port. Configure the port as a trunk, enable the voice VLAN, and finally configure PoE for the IoT device.. Although the switch does not enforce a strict sequence for these commands, the recommended workflow for clarity and consistency is to first enter global configuration mode, then interface configuration mode, then set trunking to support multiple VLANs, assign the voice VLAN, and finally configure PoE. Option D incorrectly omits global configuration mode. Option B places PoE before trunking and voice VLAN, which is less logical. Option C configures the voice VLAN before setting the trunk mode, which can be confusing.

Answer

Enter global configuration mode, then interface configuration mode. Configure PoE for the IoT device, then set the port as a trunk, and finally enable the voice VLAN.

Answer

Enter global configuration mode, then interface configuration mode. Configure the voice VLAN first, then set the port as a trunk, and finally configure PoE for the IoT device.

Answer

Enter interface configuration mode directly, configure the port as a trunk, enable the voice VLAN, and then configure PoE for the IoT device. Global configuration mode is not needed.

Question 4

Drag and drop the following steps into the correct order to configure a switch port for a VoIP phone (voice VLAN + data VLAN), an AP trunk, and a PoE-powered IoT device.

Accepted Answer

Create VLANs, assign data and voice VLANs to the phone port, configure the AP trunk, enable PoE on the IoT port. First create VLANs, then assign data and voice VLANs to the phone port, configure the AP trunk, and lastly enable PoE on the IoT port.

Answer

Enable PoE on the IoT port, create VLANs, configure the AP trunk, assign data and voice VLANs to the phone port

Answer

Create VLANs, enable PoE on the IoT port, assign data and voice VLANs to the phone port, configure the AP trunk

Answer

Configure the AP trunk, create VLANs, assign data and voice VLANs to the phone port, enable PoE on the IoT port

Question 5

Which TWO statements correctly describe the configuration and use of a voice VLAN on a Cisco switch port?

Accepted Answer

When a voice VLAN is configured, the switch port operates in two VLANs: one for data and one for voice traffic.. Option B is correct because when a voice VLAN is configured on a Cisco switch port, the port operates in two separate VLANs simultaneously: one for data traffic (the access VLAN) and one for voice traffic (the voice VLAN). This is achieved using the 'switchport voice vlan' command, which allows the switch to tag voice frames with the voice VLAN ID while leaving data frames untagged (or tagged with the access VLAN). This separation ensures that voice traffic receives appropriate QoS treatment and is isolated from data traffic.

Answer

The voice VLAN is configured using the 'switchport mode trunk' command.

Answer

The voice VLAN must be the same as the native VLAN on the trunk link.

Answer

The data VLAN and voice VLAN must be in the same IP subnet.

Question 6

Which of the following sequences correctly configures and verifies PortFast and BPDU Guard on a Cisco IOS-XE switch interface, and then recovers after a BPDU guard violation?

Accepted Answer

Enter global configuration mode, then interface configuration mode, enable PortFast, enable BPDU Guard, verify with show commands, and recover by shutting down and no shutting down the interface.. First enter global config, then the specific interface, enable PortFast, then BPDU Guard; verification confirms settings; recovery after error-disable requires administrative shutdown and no shutdown.

Question 7

Drag and drop the following steps into the correct order to configure RSTP and enable PortFast with BPDU Guard on a switch port, then verify the state transitions.

Accepted Answer

Configure RSTP mode globally, then enable PortFast on the interface, then enable BPDU Guard on the interface, then verify the port state transitions.. Correct order: First configure RSTP globally because interface commands like PortFast and BPDU Guard depend on the spanning-tree mode being set. Next enable PortFast on the interface to immediately transition to forwarding. Then enable BPDU Guard as a protective feature for PortFast ports. Finally verify state transitions. Other orders are incorrect: enabling PortFast or BPDU Guard before setting RSTP mode may cause the commands to be rejected or not take effect; enabling BPDU Guard before PortFast is not typical because BPDU Guard is designed to protect PortFast ports.

Question 8

Drag and drop the following steps into the correct order to configure and recover from a BPDU guard violation on a PortFast-enabled access port in RSTP.

Accepted Answer

Configure PortFast and BPDU guard on the interface.. Configure PortFast and BPDU guard on the access port. Then trigger a violation by connecting an unauthorized switch, which causes the port to error-disable. Diagnose by checking the error-disabled status. To recover, first remove the offending device, then cycle the port with shutdown and no shutdown; otherwise the port will immediately go error-disabled again.

Question 9

Drag and drop the following steps into the correct order to configure PortFast and BPDU Guard on a switch interface, then verify and recover after a BPDU guard error-disable event.

Accepted Answer

Enter global configuration mode, then interface configuration mode, enable PortFast, enable BPDU Guard, verify with 'show spanning-tree interface <int> detail', and recover by issuing 'shutdown' followed by 'no shutdown'.. The order is global config, interface, PortFast, BPDU Guard, then verification; recovery after a BPDU guard event requires clearing the error-disable state by cycling the interface.

Question 10

Drag and drop the following steps into the correct order to configure and recover from a BPDU guard violation on a PortFast-enabled access port.

Accepted Answer

Configure PortFast and BPDU guard on the interface.. PortFast and BPDU guard are configured first; violation is induced; recovery requires an interface shutdown/no shutdown; verification confirms the fix.

Question 11

Drag and drop the following steps into the correct order to configure PortFast and BPDU Guard on a switch access port, and then recover after a BPDU Guard error-disable event.

Accepted Answer

Enter global configuration mode, then interface configuration mode, enable PortFast, enable BPDU Guard, and after an error-disable event, manually re-enable the interface using the 'shutdown' command followed by the 'no shutdown' command.. The correct order starts with global and interface configuration mode, then enabling PortFast, followed by BPDU Guard. After an error-disable event due to BPDU Guard, the proper manual recovery is to first issue the 'shutdown' command on the interface, then issue the 'no shutdown' command; simply using 'no shutdown' alone will not clear the errdisable state.

Question 12

Drag and drop the following steps into the correct order to configure and recover from a BPDU Guard violation on a PortFast-enabled access port using Cisco IOS-XE CLI commands.

Accepted Answer

1. Enter global configuration mode. 2. Configure spanning-tree portfast default. 3. Enter interface configuration mode. 4. Configure spanning-tree bpduguard enable. 5. Exit to privileged EXEC mode. 6. Verify errdisable state. 7. Enter interface configuration mode. 8. Issue shutdown command. 9. Issue no shutdown command.. The correct sequence (A) configures PortFast globally, then enables BPDU Guard per interface, and recovers manually with shutdown/no shutdown. Option B attempts recovery with a non-existent 'clear spanning-tree bpduguard' command. Option C incorrectly uses 'spanning-tree portfast bpduguard default' which is a global command applied in interface mode, causing a syntax error. Option D uses 'errdisable recovery cause bpduguard' in privileged EXEC mode, but this command is a global configuration command and does not manually recover the port; it enables automatic recovery after a timer.

Question 13

Drag and drop the following steps into the correct order to configure PortFast and BPDU Guard on a Cisco switch interface, then recover after a BPDU violation.

Accepted Answer

Enable PortFast, then enable BPDU Guard, then configure recovery. First enable PortFast to allow immediate transition to forwarding, then enable BPDU Guard to protect against BPDU reception. Recovery steps are configured last to automatically restore the port after a violation.

Answer

Enable BPDU Guard, then enable PortFast, then configure recovery

Answer

Configure recovery, then enable PortFast, then enable BPDU Guard

Answer

Enable PortFast, configure recovery, then enable BPDU Guard

Question 14

Drag and drop the following steps into the correct order to configure PortFast and BPDU Guard on a Cisco switch interface, then recover from a BPDU guard violation.

Accepted Answer

Enter interface configuration mode for the desired port, then configure spanning-tree portfast and spanning-tree bpduguard enable, then exit. After a BPDU guard violation, re-enable the interface using the shutdown and no shutdown commands.. The correct configuration sequence applies PortFast and BPDU Guard directly in interface configuration mode with 'spanning-tree portfast' and 'spanning-tree bpduguard enable'. After a BPDU guard violation disables the port, manual recovery requires re-enabling the interface with 'shutdown' followed by 'no shutdown' (or configuring errdisable recovery). The other options incorrectly use global defaults, Root Guard, or false automatic recovery intervals.

Question 15

Which TWO statements correctly describe the behavior of PortFast and BPDU Guard on a Cisco switch?

Accepted Answer

PortFast immediately transitions a port from blocking to forwarding state, bypassing listening and learning.. PortFast immediately transitions an access port from blocking to forwarding, bypassing listening and learning (Option A). BPDU Guard errdisables a PortFast-enabled port if any BPDU is received, protecting against accidental loops (Option B). Option C is incorrect because PortFast does not alter BPDU handling; the port still processes BPDUs and reverts to normal STP if one is received. Option D is false because BPDU Guard disables the port entirely rather than ignoring BPDUs. Option E is incorrect because BPDU Guard is typically configured on access ports connected to end devices, not on trunk ports.

Answer

PortFast allows BPDUs to pass through the port normally, but the port remains in forwarding state.

Answer

BPDU Guard prevents the port from becoming a root port or designated port by ignoring superior BPDUs.

Answer

BPDU Guard is typically configured on trunk ports to prevent loops between switches.