CCNA Switching and Network Access Practice Test 17 — 15 Questions

Question 1

Which wireless design objective is achieved by using nonoverlapping channels in adjacent cells?

Accepted Answer

It reduces interference between nearby APs. Using nonoverlapping channels minimizes interference between adjacent APs, improving wireless performance in dense environments. Option A is wrong because nonoverlapping channels have no effect on PoE budget, which is determined by the switch and cable specifications. Option C is wrong because authentication mechanisms operate independently of channel assignment and are still required. Option D is wrong because nonoverlapping channels are used in both the 2.4 GHz and 5 GHz bands, and they do not mandate client use of a specific frequency.

Answer

It increases PoE budget for the access points

Answer

It removes the need for authentication

Answer

It forces all clients to use 5 GHz only

Question 2

Two switches are connected by an 802.1Q trunk. Hosts in VLAN 30 cannot communicate across the link, but VLAN 10 works. What is the most likely cause?

Accepted Answer

VLAN 30 is missing from the allowed VLAN list on SW2. When one VLAN works across a trunk but another does not, the most likely cause is that the failing VLAN is missing from the allowed VLAN list on one or both switches. This is often confirmed by a 'show interfaces trunk' command. Option B is incorrect because removing VLAN 10 would break an already working VLAN and does not address VLAN 30. Option C is incorrect because both ISL and 802.1Q carry multiple VLANs; the issue is not the encapsulation protocol. Option D is incorrect because changing a trunk port to access mode would disable the trunk entirely, preventing all VLAN traffic.

Answer

VLAN 10 must be removed for VLAN 30 to pass

Answer

The trunk should use ISL instead of 802.1Q

Answer

The port on SW1 should be changed to access mode

Question 3

A switchport should allow only one learned MAC address and shut down if a different device is connected later. Which port security violation mode and limit combination best fits that goal?

Accepted Answer

maximum 1 with violation shutdown. The usual setup is maximum 1 MAC address with violation mode shutdown. That way the port is disabled when an unauthorized device appears.

Answer

maximum 10 with violation protect

Answer

maximum 1 with violation restrict and no logging

Answer

maximum unlimited with violation shutdown

Question 4

SW1 is the root bridge for VLAN 10. A user switch receives a BPDU on an access port connected to a desk-side unmanaged switch. What should happen if BPDU Guard is enabled on that port?

Accepted Answer

The port is moved to err-disabled state. BPDU Guard is designed to protect edge ports. If a BPDU is received on a PortFast access port, the switch places the interface into the err-disabled state to stop a potential Layer 2 loop or rogue switch.

Answer

The port transitions to forwarding more quickly

Answer

The switch elects a new root bridge

Answer

The port becomes a trunk automatically

Question 5

Exhibit: Users report that they can see the corporate SSID but fail authentication immediately after entering credentials. Guest wireless works on the same access point. Which issue is most likely?

Accepted Answer

The RADIUS or AAA server is unreachable for the enterprise WLAN. When clients can see the SSID and associate at Layer 2 but fail right after entering credentials, a broken 802.1X or RADIUS path is a common cause. RF coverage is clearly not the main problem because the SSID is visible and guest service works.

Answer

The AP is using the wrong channel width

Answer

The corporate SSID has a mismatched RADIUS shared secret

Answer

The SSID must be configured as hidden

Question 6

A PC connected to SW1 cannot reach the default gateway. The access port is assigned to VLAN 20, and the switch output shows that VLAN 20 is inactive. What is the most likely cause?

Accepted Answer

VLAN 20 does not exist or is not active on the switch. The port is operationally up, but VLAN 20 is listed as inactive because that VLAN does not exist in the VLAN database. An access port assigned to a missing VLAN will not carry normal user traffic for that VLAN.

Answer

Port security has shut down the interface

Answer

The port must be converted to a trunk

Answer

The default gateway must be configured on the physical switch port

Question 7

Exhibit: Users complain of slow wireless performance in a dense office even though signal strength is strong. Multiple APs are using channels 1, 2, and 3 on 2.4 GHz. Which change is most appropriate?

Accepted Answer

Move to non-overlapping channels such as 1, 6, and 11. In 2.4 GHz, overlapping channels cause co-channel and adjacent-channel interference. The common non-overlapping choices are 1, 6, and 11. Moving away from overlapping channels usually improves performance in a dense deployment.

Answer

Reduce all AP transmit power to zero

Answer

Change every AP to the same channel for consistency

Answer

Disable WPA2 security

Question 8

Two switches are bundled with LACP, but only one physical link is forwarding traffic in the port-channel. What is the most likely reason?

Accepted Answer

One member interface has a trunk configuration mismatch. For an EtherChannel to form correctly, the member interfaces must match on key settings such as speed, duplex, trunking, and allowed VLAN list. A mismatch keeps one link from bundling even if LACP is enabled on both sides.

Answer

LACP requires exactly one active and one passive side only

Answer

STP blocks all but one interface inside every EtherChannel

Answer

EtherChannel cannot be used on trunk ports

Question 9

After a switch replacement, users in VLAN 30 cannot reach devices in other VLANs. The replacement switch has a trunk link to the distribution switch that shows as up/up. What is the most likely cause?

Accepted Answer

VLAN 30 is not permitted on the trunk link. The trunk is up, but VLAN 30 is not allowed on it. Traffic from that VLAN never crosses the uplink, so inter-VLAN reachability fails for users in VLAN 30 even though the local access ports may still look fine.

Answer

The native VLAN must be changed to 30

Answer

The uplink should be configured as an access port

Answer

STP must be disabled on VLAN 30

Question 10

A phone and a PC are attached to the same switchport. The intended data VLAN is VLAN 10, and the phone uses voice VLAN 20. The switchport currently has `switchport voice vlan 20` configured. The phone works, but the PC cannot reach the data network. Which command is most likely missing?

Accepted Answer

switchport access vlan 10. When a Cisco IP phone and a PC share one port, the switchport often needs both a data VLAN and a voice VLAN. If the voice VLAN exists but the data access VLAN is wrong or missing, the phone can work while the PC fails.

Answer

switchport mode dynamic auto

Answer

switchport voice vlan 20

Answer

spanning-tree guard root

Question 11

Match each STP or switch protection feature to the problem it is mainly designed to prevent.

Accepted Answer

Root Guard: Prevents a switch from becoming root bridge due to rogue BPDUs. STP protection features prevent specific problems: Root Guard protects root bridge election, BPDU Guard prevents loops on access ports, Loop Guard handles BPDU loss, UDLD detects unidirectional links, and PortFast speeds up port transition.

Question 12

A user says the phone connected to a switch port works, but the attached PC does not get network access. What is the most likely switch-side issue?

Accepted Answer

The access VLAN for the PC is misconfigured. An IP phone can use a voice VLAN while the attached PC uses the access VLAN. If the access VLAN is missing or wrong, the phone may still work while the PC fails.

Answer

The voice VLAN should always match the access VLAN

Answer

PortFast blocks the PC from sending traffic

Answer

The phone requires the switch to be in trunk mode

Question 13

An administrator configures an EtherChannel between SW1 and SW2. The port-channel interfaces are physically up, but the EtherChannel bundle fails to come up. On SW1, the channel-group is set to mode active; on SW2, it is set to mode on. What is the most likely cause?

Accepted Answer

One side is using LACP active while the other side is set to on. EtherChannel requires compatible modes: LACP active mode sends negotiation packets, while 'on' mode disables all negotiation, so the two sides cannot agree and the bundle stays down. Option A is wrong because switch priority values are used in STP root election, not EtherChannel formation. Option C is wrong because the native VLAN does not need to be VLAN 1; it only needs to match on both ends. Option D is wrong because all member interfaces in an EtherChannel must be in the same VLAN, not different ones.

Answer

The switch priority values are mismatched

Answer

The native VLAN must be VLAN 1 for EtherChannel to form

Answer

Gi1/0/2 cannot be bundled because interfaces must be in different VLANs

Question 14

Which STP port state on a classic 802.1D switch listens for BPDUs and prepares to participate in the topology, but does not yet learn MAC addresses?

Accepted Answer

Listening. In classic STP, the listening state processes BPDUs and waits before learning begins. The learning state is when the switch starts populating the MAC table.

Answer

Learning

Answer

Forwarding

Answer

Disabled

Question 15

An engineer wants rapid transition to forwarding on end-user switchports while still protecting the topology from accidental switch connections. Which two STP-related features fit that design?

Accepted Answer

PortFast on user-facing access ports. PortFast improves the user experience on edge ports, and BPDU Guard keeps those ports from becoming unintended switch uplinks.

Answer

Root Guard on every user-facing port instead of PortFast

Answer

Loop Guard on hosts to accelerate DHCP