CCNA Switching and Network Access Practice Test 17 — 15 Questions

Question 1

SW1 is the root bridge for VLAN 10. A user switch receives a BPDU on an access port connected to a desk-side unmanaged switch. What should happen if BPDU Guard is enabled on that port?

Accepted Answer

The port is moved to err-disabled state. BPDU Guard is designed to protect edge ports. If a BPDU is received on a PortFast access port, the switch places the interface into the err-disabled state to stop a potential Layer 2 loop or rogue switch.

Answer

The port transitions to forwarding more quickly

Answer

The switch elects a new root bridge

Answer

The port becomes a trunk automatically

Question 2

Exhibit: Users report that they can see the corporate SSID but fail authentication immediately after entering credentials. Guest wireless works on the same access point. Which issue is most likely?

Accepted Answer

The RADIUS or AAA server is unreachable for the enterprise WLAN. When clients can see the SSID and associate at Layer 2 but fail right after entering credentials, a broken 802.1X or RADIUS path is a common cause. RF coverage is clearly not the main problem because the SSID is visible and guest service works.

Answer

The AP is using the wrong channel width

Answer

The corporate SSID has a mismatched RADIUS shared secret

Answer

The SSID must be configured as hidden

Question 3

A PC connected to SW1 cannot reach the default gateway. The access port is assigned to VLAN 20, and the switch output shows that VLAN 20 is inactive. What is the most likely cause?

Accepted Answer

VLAN 20 does not exist or is not active on the switch. The port is operationally up, but VLAN 20 is listed as inactive because that VLAN does not exist in the VLAN database. An access port assigned to a missing VLAN will not carry normal user traffic for that VLAN.

Answer

Port security has shut down the interface

Answer

The port must be converted to a trunk

Answer

The default gateway must be configured on the physical switch port

Question 4

Exhibit: Users complain of slow wireless performance in a dense office even though signal strength is strong. Multiple APs are using channels 1, 2, and 3 on 2.4 GHz. Which change is most appropriate?

Accepted Answer

Move to non-overlapping channels such as 1, 6, and 11. In 2.4 GHz, overlapping channels cause co-channel and adjacent-channel interference. The common non-overlapping choices are 1, 6, and 11. Moving away from overlapping channels usually improves performance in a dense deployment.

Answer

Reduce all AP transmit power to zero

Answer

Change every AP to the same channel for consistency

Answer

Disable WPA2 security

Question 5

Two switches are bundled with LACP, but only one physical link is forwarding traffic in the port-channel. What is the most likely reason?

Accepted Answer

One member interface has a trunk configuration mismatch. For an EtherChannel to form correctly, the member interfaces must match on key settings such as speed, duplex, trunking, and allowed VLAN list. A mismatch keeps one link from bundling even if LACP is enabled on both sides.

Answer

LACP requires exactly one active and one passive side only

Answer

STP blocks all but one interface inside every EtherChannel

Answer

EtherChannel cannot be used on trunk ports

Question 6

After a switch replacement, users in VLAN 30 cannot reach devices in other VLANs. The replacement switch has a trunk link to the distribution switch that shows as up/up. What is the most likely cause?

Accepted Answer

VLAN 30 is not permitted on the trunk link. The trunk is up, but VLAN 30 is not allowed on it. Traffic from that VLAN never crosses the uplink, so inter-VLAN reachability fails for users in VLAN 30 even though the local access ports may still look fine.

Answer

The native VLAN must be changed to 30

Answer

The uplink should be configured as an access port

Answer

STP must be disabled on VLAN 30

Question 7

A phone and a PC are attached to the same switchport. The intended data VLAN is VLAN 10, and the phone uses voice VLAN 20. The switchport currently has `switchport voice vlan 20` configured. The phone works, but the PC cannot reach the data network. Which command is most likely missing?

Accepted Answer

switchport access vlan 10. When a Cisco IP phone and a PC share one port, the switchport often needs both a data VLAN and a voice VLAN. If the voice VLAN exists but the data access VLAN is wrong or missing, the phone can work while the PC fails.

Answer

switchport mode dynamic auto

Answer

switchport voice vlan 20

Answer

spanning-tree guard root

Question 8

Match each STP or switch protection feature to the problem it is mainly designed to prevent.

Accepted Answer

Root Guard: Prevents a switch from becoming root bridge due to rogue BPDUs. STP protection features prevent specific problems: Root Guard protects root bridge election, BPDU Guard prevents loops on access ports, Loop Guard handles BPDU loss, UDLD detects unidirectional links, and PortFast speeds up port transition.

Question 9

A user says the phone connected to a switch port works, but the attached PC does not get network access. What is the most likely switch-side issue?

Accepted Answer

The access VLAN for the PC is misconfigured. An IP phone can use a voice VLAN while the attached PC uses the access VLAN. If the access VLAN is missing or wrong, the phone may still work while the PC fails.

Answer

The voice VLAN should always match the access VLAN

Answer

PortFast blocks the PC from sending traffic

Answer

The phone requires the switch to be in trunk mode

Question 10

An administrator configures an EtherChannel between SW1 and SW2. The port-channel interfaces are physically up, but the EtherChannel bundle fails to come up. On SW1, the channel-group is set to mode active; on SW2, it is set to mode on. What is the most likely cause?

Accepted Answer

One side is using LACP active while the other side is set to on. EtherChannel requires compatible modes: LACP active mode sends negotiation packets, while 'on' mode disables all negotiation, so the two sides cannot agree and the bundle stays down. Option A is wrong because switch priority values are used in STP root election, not EtherChannel formation. Option C is wrong because the native VLAN does not need to be VLAN 1; it only needs to match on both ends. Option D is wrong because all member interfaces in an EtherChannel must be in the same VLAN, not different ones.

Answer

The switch priority values are mismatched

Answer

The native VLAN must be VLAN 1 for EtherChannel to form

Answer

Gi1/0/2 cannot be bundled because interfaces must be in different VLANs

Question 11

Which STP port state on a classic 802.1D switch listens for BPDUs and prepares to participate in the topology, but does not yet learn MAC addresses?

Accepted Answer

Listening. In classic STP, the listening state processes BPDUs and waits before learning begins. The learning state is when the switch starts populating the MAC table.

Answer

Learning

Answer

Forwarding

Answer

Disabled

Question 12

An engineer wants rapid transition to forwarding on end-user switchports while still protecting the topology from accidental switch connections. Which two STP-related features fit that design?

Accepted Answer

PortFast on user-facing access ports. PortFast improves the user experience on edge ports, and BPDU Guard keeps those ports from becoming unintended switch uplinks.

Answer

Root Guard on every user-facing port instead of PortFast

Answer

Loop Guard on hosts to accelerate DHCP

Question 13

A trunk link between two switches is up, but hosts in VLAN 30 on opposite switches cannot communicate. VLAN 10 works across the same trunk. Which two causes are the most likely?

Accepted Answer

VLAN 30 is not allowed on the trunk on one side. When one VLAN fails but others work across the same trunk, the problem is likely VLAN-specific. VLAN 30 may not exist on one switch or may not be allowed on the trunk. Option C is incorrect because the native VLAN does not need to be 30; a native VLAN mismatch would typically cause connectivity issues on all VLANs, not just VLAN 30. Option D is incorrect because PortFast only affects the speed at which an access port enters the forwarding state and does not impact communication across an already-up trunk.

Answer

The trunk native VLAN should always be 30

Answer

PortFast must be disabled on the access ports in VLAN 30

Question 14

A switch should learn one MAC address on an access port and shut the port down if a second unauthorized device appears. Which two port-security settings support that requirement?

Accepted Answer

switchport port-security maximum 1. Port security enforces how many MAC addresses may be learned on a port and what happens when a violation occurs. 'switchport port-security maximum 1' limits the port to one MAC address, and 'switchport port-security violation shutdown' disables the port if a violation occurs, matching the requirement. 'switchport protected' isolates ports within a switch but does not limit MAC addresses or cause a shutdown. 'switchport nonegotiate' disables DTP negotiation, which is unrelated to port security.

Answer

switchport protected

Answer

switchport nonegotiate

Question 15

A network engineer is troubleshooting connectivity between two hosts in different VLANs on the same switch. Host A in VLAN 10 (10.10.10.5/24) cannot ping Host B in VLAN 20 (10.10.20.5/24). The switch is configured as a router-on-a-stick with a trunk port to an external router. The trunk port is up/up, but inter-VLAN routing fails. What is the most likely cause?

Accepted Answer

The VLANs are not allowed on the trunk; the allowed VLAN list is missing VLAN 10 and 20.. The most likely cause is that the allowed VLAN list on the trunk is missing VLAN 10 and 20. Even though the trunk port is up/up, if the switch's allowed VLAN list has been restricted (for example, using the switchport trunk allowed vlan command) and does not include those VLANs, all frames tagged with VLAN 10 or 20 will be discarded at the trunk. This directly prevents inter-VLAN routing despite the trunk being operational, whereas a native VLAN mismatch only affects untagged traffic and would not impact the tagged frames between the two hosts.

Answer

The trunk port is not in trunking mode; it is in dynamic desirable mode.

Answer

The native VLAN on the switch trunk is VLAN 1, but the router subinterface for VLAN 1 is not configured with the 'native' keyword or is missing.

Answer

The switch ports Gi0/4 and Gi0/5 are in access mode but not assigned to the correct VLANs.