CCNA Switching and Network Access Practice Test 16 — 15 Questions

Question 1

Exhibit: Users on SW2 in VLAN 30 can reach local devices but not hosts in VLAN 30 on SW1. What is the most likely reason?

Accepted Answer

VLAN 30 is not allowed on the trunk. The trunk is allowing only VLANs 10 and 20. Even though both switches have VLAN 30 defined locally, VLAN 30 traffic cannot cross the trunk unless that VLAN is allowed on the link. Option A is incorrect because the native VLAN (default 1) does not affect tagged VLAN 30 traffic, and native VLAN mismatch causes different issues. Option C is incorrect because VTP is used for VLAN database synchronization, not for forwarding traffic over a trunk; switches do not need to be VTP servers to pass VLAN traffic. Option D is incorrect because spanning tree only blocks redundant paths to prevent loops, not all user VLANs by default.

Answer

The trunk native VLAN is 1 on both sides

Answer

SW2 must run VTP server mode

Answer

Spanning tree blocks all user VLANs by default

Question 2

Exhibit: A switch port connected to an end host is stuck in a blocking state much longer than expected after a reboot. Which configuration change most directly speeds host access while still keeping loop protection elsewhere?

Accepted Answer

Enable PortFast on the access port. PortFast should be enabled on access ports that connect to end devices. It lets the port move to forwarding quickly without waiting through normal STP listening and learning delays. Disabling STP globally removes all loop protection, which contradicts the requirement to keep loop protection elsewhere. Changing the trunk native VLAN is irrelevant to an access port's STP state transition. Adjusting duplex has no effect on STP timers and would not speed up host access.

Answer

Disable STP globally

Answer

Change the trunk native VLAN

Answer

Set the port to half-duplex

Question 3

Exhibit: A wireless client can see the SSID and associates successfully, but it never gets network access. Other users on the same SSID work. Which issue is the best fit?

Accepted Answer

The client failed to obtain a valid IP address from DHCP. Successful association means the radio connection is up. If only one client fails to get network access while others work, the most likely issue is a client-specific addressing problem such as not obtaining a valid DHCP lease. Option A is incorrect because channel width affects all clients, not just one. Option C is incorrect because hiding the SSID does not affect network access after association. Option D is incorrect because WPA2 does not block clients due to NTP; NTP is unrelated to client authentication.

Answer

The AP is advertising the wrong channel width

Answer

The SSID must be changed from broadcast to hidden

Answer

WPA2 automatically blocks clients until NTP is configured

Question 4

Two switches are connected with EtherChannel using LACP. One side is configured with mode active and the other side with mode passive. What happens?

Accepted Answer

The channel forms successfully. LACP forms an EtherChannel when at least one side actively negotiates. Active plus passive is a valid combination, so the bundle comes up if the physical settings match.

Answer

The channel stays down because both sides must be active

Answer

The channel forms only if PAgP is also enabled

Answer

The channel becomes a static Port-Channel

Question 5

Two switches are connected via an IEEE 802.1Q trunk. Hosts in VLAN 30 on opposite sides cannot communicate, yet hosts in VLAN 10 communicate normally. Both switches have VLAN 30 in their VLAN database, and the trunk link is operational. What is the most likely cause?

Accepted Answer

VLAN 30 is pruned or not allowed on one side of the trunk. If a VLAN is not allowed on one side of the trunk, frames for that VLAN are dropped even though other VLANs continue to work. Option A correctly identifies that VLAN 30 is either pruned or missing from the allowed list on one end. Option B is wrong because the native VLAN only affects untagged frames and would not cause the filtering of a tagged VLAN like VLAN 30. Option C is incorrect because STP can block individual VLANs per port, but it does not block all VLANs on a trunk due to a single VLAN’s issue—only the affected VLAN would be blocked. Option D is invalid because converting the trunk to access mode would break all VLAN trunking, including the working VLAN 10.

Answer

The native VLAN must be set to 30

Answer

STP blocks all VLANs on the trunk when one VLAN fails

Answer

The trunk must be changed to access mode for VLAN 30

Question 6

Exhibit: An access switch shows Gi1/0/10 as err-disabled shortly after an IP phone and a workstation are connected through the same wall jack. What is the most likely cause?

Accepted Answer

The port security maximum is too low for the connected devices. With a phone and a PC on the same access port, the switch may legitimately see two MAC addresses. Port security set to a maximum of 1 causes a violation and can place the interface into err-disabled state.

Answer

The native VLAN is missing

Answer

BPDU Guard blocked the port because a workstation was attached

Answer

DHCP snooping denied the voice VLAN

Question 7

Exhibit: A user reports intermittent connectivity after a new switch was connected to an access port. Which feature would have prevented this by immediately disabling the port when a BPDU was received?

Accepted Answer

BPDU Guard. BPDU Guard is the correct answer because it protects PortFast-enabled edge ports by immediately disabling the port upon receiving a BPDU, preventing accidental loops. Root Guard prevents the port from becoming a root port, not from BPDU reception. Loop Guard prevents alternate or root ports from becoming designated due to BPDU loss, unrelated to BPDU reception disabling. UDLD detects unidirectional links but does not disable ports upon BPDU reception.

Answer

Root Guard

Answer

Loop Guard

Answer

UDLD

Question 8

Exhibit: Clients can see the corporate SSID but fail authentication after entering valid usernames and passwords. Which issue is the best explanation?

Accepted Answer

The RADIUS path or shared secret is failing. WPA2-Enterprise relies on 802.1X with a RADIUS server. If the RADIUS server is unreachable or the shared secret is wrong, users can see the SSID and attempt to authenticate, but the login process fails. Option A is incorrect because RF channel issues would cause connectivity problems, not authentication failures after association. Option C is incorrect because hiding the SSID is irrelevant to enterprise authentication; the issue is server-side. Option D is incorrect because a voice VLAN is not required for standard client authentication and would not cause login failure.

Answer

The AP is using the wrong RF channel

Answer

The SSID must be hidden for enterprise authentication

Answer

The clients need a voice VLAN assignment first

Question 9

Why is BPDU Guard commonly enabled on PortFast-enabled access ports?

Accepted Answer

To err-disable a port if it receives unexpected BPDUs. PortFast ports are meant for end devices, not for switches. BPDU Guard protects the LAN by shutting down a PortFast port that unexpectedly starts receiving BPDUs, which usually means an unauthorized switch was connected.

Answer

To make STP root election happen faster

Answer

To disable STP permanently on access ports

Answer

To allow only one MAC address on the access port

Question 10

Exhibit: SW2 receives superior BPDUs on both uplinks. One uplink becomes the root port and the other becomes alternate. Which factor is considered first when SW2 chooses the root port?

Accepted Answer

Lowest root path cost. STP chooses the best path to the root bridge based first on the lowest root path cost. If the cost ties, it then checks the sender bridge ID and sender port ID as tie-breakers.

Answer

Lowest local interface MAC address

Answer

Highest duplex setting

Answer

Lowest configured VLAN number

Question 11

Exhibit: SW1 is configured for EtherChannel with LACP, but the bundle does not form. What is the most likely cause?

Accepted Answer

One side is using LACP and the other side is using a static EtherChannel mode. For an LACP EtherChannel to form, both sides must negotiate with LACP using active or passive mode. One side here is set to channel-group mode on, which creates a static channel and does not speak LACP. That mismatch prevents the bundle from forming.

Answer

The interfaces should use PAgP instead of LACP on both ends

Answer

The links must be routed ports before EtherChannel can form

Answer

EtherChannel requires three or more member links

Question 12

Which VLAN is used by default for most switch ports on a new Cisco switch?

Accepted Answer

VLAN 1. On a default Cisco switch, access ports belong to VLAN 1 until changed. Best practice is usually to move user ports away from VLAN 1, but the default is still VLAN 1.

Answer

VLAN 99

Answer

VLAN 1002

Answer

No VLAN until the port is manually assigned

Question 13

Which wireless design objective is achieved by using nonoverlapping channels in adjacent cells?

Accepted Answer

It reduces interference between nearby APs. Using nonoverlapping channels minimizes interference between adjacent APs, improving wireless performance in dense environments. Option A is wrong because nonoverlapping channels have no effect on PoE budget, which is determined by the switch and cable specifications. Option C is wrong because authentication mechanisms operate independently of channel assignment and are still required. Option D is wrong because nonoverlapping channels are used in both the 2.4 GHz and 5 GHz bands, and they do not mandate client use of a specific frequency.

Answer

It increases PoE budget for the access points

Answer

It removes the need for authentication

Answer

It forces all clients to use 5 GHz only

Question 14

Two switches are connected by an 802.1Q trunk. Hosts in VLAN 30 cannot communicate across the link, but VLAN 10 works. What is the most likely cause?

Accepted Answer

VLAN 30 is missing from the allowed VLAN list on SW2. When one VLAN works across a trunk but another does not, the most likely cause is that the failing VLAN is missing from the allowed VLAN list on one or both switches. This is often confirmed by a 'show interfaces trunk' command. Option B is incorrect because removing VLAN 10 would break an already working VLAN and does not address VLAN 30. Option C is incorrect because both ISL and 802.1Q carry multiple VLANs; the issue is not the encapsulation protocol. Option D is incorrect because changing a trunk port to access mode would disable the trunk entirely, preventing all VLAN traffic.

Answer

VLAN 10 must be removed for VLAN 30 to pass

Answer

The trunk should use ISL instead of 802.1Q

Answer

The port on SW1 should be changed to access mode

Question 15

A switchport should allow only one learned MAC address and shut down if a different device is connected later. Which port security violation mode and limit combination best fits that goal?

Accepted Answer

maximum 1 with violation shutdown. The usual setup is maximum 1 MAC address with violation mode shutdown. That way the port is disabled when an unauthorized device appears.

Answer

maximum 10 with violation protect

Answer

maximum 1 with violation restrict and no logging

Answer

maximum unlimited with violation shutdown