CCNA Switching and Network Access Practice Test 18 — 15 Questions

Question 1

A trunk link between two switches is up, but hosts in VLAN 30 on opposite switches cannot communicate. VLAN 10 works across the same trunk. Which two causes are the most likely?

Accepted Answer

VLAN 30 is not allowed on the trunk on one side. When one VLAN fails but others work across the same trunk, the problem is likely VLAN-specific. VLAN 30 may not exist on one switch or may not be allowed on the trunk. Option C is incorrect because the native VLAN does not need to be 30; a native VLAN mismatch would typically cause connectivity issues on all VLANs, not just VLAN 30. Option D is incorrect because PortFast only affects the speed at which an access port enters the forwarding state and does not impact communication across an already-up trunk.

Answer

The trunk native VLAN should always be 30

Answer

PortFast must be disabled on the access ports in VLAN 30

Question 2

A switch should learn one MAC address on an access port and shut the port down if a second unauthorized device appears. Which two port-security settings support that requirement?

Accepted Answer

switchport port-security maximum 1. Port security enforces how many MAC addresses may be learned on a port and what happens when a violation occurs. 'switchport port-security maximum 1' limits the port to one MAC address, and 'switchport port-security violation shutdown' disables the port if a violation occurs, matching the requirement. 'switchport protected' isolates ports within a switch but does not limit MAC addresses or cause a shutdown. 'switchport nonegotiate' disables DTP negotiation, which is unrelated to port security.

Answer

switchport protected

Answer

switchport nonegotiate

Question 3

A network engineer is troubleshooting connectivity between two hosts in different VLANs on the same switch. Host A in VLAN 10 (10.10.10.5/24) cannot ping Host B in VLAN 20 (10.10.20.5/24). The switch is configured as a router-on-a-stick with a trunk port to an external router. The trunk port is up/up, but inter-VLAN routing fails. What is the most likely cause?

Accepted Answer

The VLANs are not allowed on the trunk; the allowed VLAN list is missing VLAN 10 and 20.. The most likely cause is that the allowed VLAN list on the trunk is missing VLAN 10 and 20. Even though the trunk port is up/up, if the switch's allowed VLAN list has been restricted (for example, using the switchport trunk allowed vlan command) and does not include those VLANs, all frames tagged with VLAN 10 or 20 will be discarded at the trunk. This directly prevents inter-VLAN routing despite the trunk being operational, whereas a native VLAN mismatch only affects untagged traffic and would not impact the tagged frames between the two hosts.

Answer

The trunk port is not in trunking mode; it is in dynamic desirable mode.

Answer

The native VLAN on the switch trunk is VLAN 1, but the router subinterface for VLAN 1 is not configured with the 'native' keyword or is missing.

Answer

The switch ports Gi0/4 and Gi0/5 are in access mode but not assigned to the correct VLANs.

Question 4

Which TWO statements are true about configuring and verifying VLANs, 802.1Q trunking, native VLAN, and inter-VLAN routing with router-on-a-stick?

Accepted Answer

On a router-on-a-stick configuration, each subinterface must be configured with an IP address and the encapsulation dot1Q command to specify the VLAN ID.. In a router-on-a-stick configuration, each subinterface must be assigned an IP address and use the encapsulation dot1Q command to associate it with a specific VLAN ID; this enables the router to process tagged frames from multiple VLANs over a single physical link. Option D is also correct because the native VLAN configured on the switchport trunk must match the native VLAN used on the router's subinterface (or physical interface if no subinterface); a mismatch causes the router to mishandle untagged frames because it expects them to belong to the configured native VLAN, leading to communication failures. Option B is wrong because on an 802.1Q trunk, the native VLAN frames are sent untagged, not tagged. Option C is wrong because the command 'switchport trunk native vlan 10' only changes the native VLAN; it does not restrict which VLANs are allowed—that requires 'switchport trunk allowed vlan'. Option E is wrong because 'show interfaces trunk' shows trunking status, native VLAN, and allowed VLAN lists on switch ports, not IP addresses of router subinterfaces.

Answer

The native VLAN is always tagged on an 802.1Q trunk link.

Answer

The command switchport trunk native vlan 10 is used to restrict which VLANs are allowed on a trunk.

Answer

The command show interfaces trunk displays the IP addresses configured on router subinterfaces.

Question 5

Drag and drop the VLAN/trunking commands and terms on the left to their correct descriptions or functions on the right.

Accepted Answer

switchport mode trunk: Configures an interface to carry multiple VLANs.. These pairings match common VLAN/trunking commands and terms to their correct descriptions.

Question 6

A network administrator has configured a switch port to support a VoIP phone and a desktop PC. Users report that the desktop PC cannot obtain an IP address via DHCP, while the VoIP phone registers successfully. The switch port is up/up, and the desktop is connected to the phone's PC port. What is the most likely cause of the issue?

Accepted Answer

The switchport access vlan should be changed to the data VLAN to match the subnet expected by the desktop.. The desktop PC obtains its IP address from the data VLAN, but the switch port's access VLAN is likely misconfigured to the voice VLAN. Changing the access VLAN to the correct data VLAN places the PC in the proper subnet and allows DHCP to function. Option A is unnecessary because a voice-access port does not need to be a trunk. Option C would break the VoIP phone without fixing the PC's VLAN assignment. Option D is irrelevant; PortFast speeds up STP convergence and does not block DHCP.

Answer

The switchport mode access should be changed to switchport mode trunk to allow both vlans.

Answer

The switchport voice vlan should be removed because the desktop cannot use it.

Answer

The spanning-tree portfast should be disabled to prevent DHCP delays.

Question 7

Which TWO commands are required to configure a switch port to support both a desktop PC and a VoIP phone using voice VLAN?

Accepted Answer

switchport mode access. 'switchport mode access,' is required because voice VLAN only operates on an access port. Option C, 'switchport voice vlan <vlan-id>,' is the command that actually assigns the voice VLAN ID. Option B is incorrect because a trunk port would not properly separate voice and data traffic as the phone expects an access port. Option D is a common data VLAN configuration but is not strictly necessary for voice VLAN operation; the access VLAN can be left as the default or configured separately. Option E is wrong because 'switchport port-security maximum 1' would allow only a single MAC address, while the port must support two devices (the phone and the PC), second MAC being the phone's internal switch.

Answer

switchport mode trunk

Answer

switchport access vlan <vlan-id>

Answer

switchport port-security maximum 1

Question 8

Which TWO switch port configurations are required when connecting a Cisco IP phone and a desktop PC to a single access port?

Accepted Answer

Use the 'switchport voice vlan' command to assign a dedicated voice VLAN.. The 'switchport voice vlan' command assigns a dedicated VLAN for voice traffic, allowing the IP phone to tag its packets with the voice VLAN ID while the PC remains in the native (data) VLAN. Option D is correct because 'mls qos trust cos' preserves the Layer 2 Class of Service (CoS) markings from the IP phone, ensuring voice packets receive appropriate QoS treatment across the network. Option A is incorrect because a trunk port is not required—the access port with the voice VLAN command handles both VLANs without trunking. Option C is incorrect because disabling Spanning Tree Protocol (STP) is not a recommended practice and does not prevent voice delays; STP is essential for loop prevention and can be tuned with PortFast instead. Option E is incorrect because the port must remain a Layer 2 access port, not a routed port, to support both the PC and IP phone.

Answer

Configure the port as a trunk and allow both VLANs.

Answer

Disable spanning tree on the port to prevent voice delays.

Answer

Configure the port as a routed port with an IP address for management.

Question 9

Drag and drop the port configuration commands/technologies on the left to their corresponding descriptions on the right.

Accepted Answer

switchport mode access: Sets the interface as a nontrunking access port. These are common Cisco IOS commands used for port configuration, each with a specific function.

Question 10

A network administrator is troubleshooting connectivity issues in a switched network. Users on VLAN 10 report intermittent connectivity to the server farm. The network uses Rapid PVST+ as the spanning-tree protocol. The administrator examines the switch that is the root bridge for VLAN 10 and notices that one of the uplink interfaces to an access switch is in a blocking state. What is the most likely cause of this issue?

Accepted Answer

Check the spanning-tree priority on other switches to ensure the intended root bridge has the lowest priority for VLAN 10.. In Rapid PVST+, the root bridge for a VLAN should have all its ports in a forwarding state. If an uplink interface on the root bridge is blocking, it indicates that another switch is being elected as the root bridge for VLAN 10, likely because it has a lower spanning-tree priority. By checking and adjusting the priority on other switches, the administrator can ensure the intended switch becomes the root bridge, resolving the intermittent connectivity caused by suboptimal path selection.

Answer

Change the port type of Gi0/3 to trunk to allow multiple VLANs.

Answer

Configure spanning-tree portfast on Gi0/3 to speed up convergence.

Answer

Enable BPDU guard on Gi0/3 to prevent unauthorized switches from affecting the network.

Question 11

A network administrator is troubleshooting connectivity loss in a switched network. All switches run Rapid PVST+. A host connected to an access port on SwitchC can no longer reach the default gateway. The access port is configured with PortFast and BPDU Guard. The administrator checks the interface status and finds it in an err-disabled state. What is the most likely cause of this issue?

Accepted Answer

BPDU Guard detected a BPDU on a PortFast-enabled port and disabled it.. B is correct because BPDU Guard is designed to protect the spanning-tree topology by disabling a PortFast-enabled port if it receives a BPDU, placing the port in err-disabled state. Option A is incorrect: a root bridge election failure would not cause a port to err-disable; loops do not directly trigger this state without BPDU Guard. Option C is incorrect because PortFast and BPDU Guard work with all spanning-tree variants including Rapid PVST+. Option D is incorrect: a trunk misconfiguration alone would not cause err-disable unless BPDU Guard detects a BPDU on a PortFast port.

Answer

The root bridge election failed, causing a loop.

Answer

Rapid PVST+ is not compatible with PortFast.

Answer

The port is configured as a trunk but should be an access port.

Question 12

Which TWO statements correctly describe the behavior of Rapid PVST+ in a Layer 2 network?

Accepted Answer

Rapid PVST+ runs a separate instance of RSTP for each VLAN.. Rapid PVST+ runs a separate instance of RSTP (802.1w) for each VLAN, enabling per-VLAN rapid convergence and load balancing. Option D is correct because PortFast allows access ports to transition to forwarding immediately, while BPDU Guard prevents loops by disabling a port that receives a BPDU. Option B is incorrect because Rapid PVST+ uses RSTP's handshake mechanism, not timer-based convergence like 802.1D. Option C is wrong: Rapid PVST+ is based on 802.1w, not 802.1D. Option E is false because Rapid PVST+ does not use 802.1Q to reduce instances; it maintains a separate spanning-tree instance per VLAN.

Answer

Rapid PVST+ is an enhancement of PVST+ and uses the same timer-based convergence as standard 802.1D.

Answer

Rapid PVST+ uses the 802.1D standard to compute the spanning tree for each VLAN.

Answer

Rapid PVST+ uses the 802.1Q trunking protocol to reduce the number of spanning-tree instances.

Question 13

Which TWO of the following statements about Spanning Tree Protocol (STP) and Rapid PVST+ are true?

Accepted Answer

The root bridge in STP is elected based on the lowest bridge ID.. The root bridge in STP is elected based on the numerically smallest bridge ID (priority + MAC address). Option D is correct because BPDU Guard, when enabled on a PortFast-enabled port, immediately error-disables the port if a BPDU is received, protecting against accidental loops. Option B is incorrect because the root bridge is chosen by the lowest bridge ID, not the highest. Option C is incorrect because PortFast and BPDU Guard are independent features; PortFast does not automatically enable BPDU Guard. Option E is incorrect because both traditional STP (802.1D) and Rapid PVST+ (RSTP-based) use the same root bridge election process—lowest bridge ID.

Answer

The root bridge in STP is elected based on the highest bridge ID.

Answer

PortFast automatically enables BPDU Guard on an interface.

Answer

Rapid PVST+ uses a different root bridge election process than traditional STP.

Question 14

A network administrator is troubleshooting an issue where hosts on VLAN 10 cannot ping the default gateway at 192.168.10.1. The router (R1) has an SVI for VLAN 10 with IP 192.168.10.1/24. The administrator captures traffic on the router's G0/0/0 interface (trunk to the switch) and reviews the embedded packet capture output. What is the root cause of the problem?

Accepted Answer

The switch port connecting the host is configured in the wrong VLAN (e.g., VLAN 20 instead of VLAN 10).. The captured traffic on the trunk shows that the router is not receiving any frames tagged with VLAN 10 from the host. If the switch port connecting the host is configured in VLAN 20 instead of VLAN 10, the host's frames will be tagged with VLAN 20 (or remain untagged in the access VLAN 20) and will not reach the router's SVI for VLAN 10, causing the ping to fail. This is the most direct cause given the symptom that the host cannot ping the default gateway.

Answer

The router's SVI for VLAN 10 is administratively down.

Answer

An inbound ACL on the router's SVI is blocking ICMP echo requests from the host.

Answer

The router has ICMP redirects enabled, causing it to ignore the pings.

Question 15

A network engineer is troubleshooting a connectivity issue between two hosts on different VLANs. The engineer captures traffic on an IOS-XE router's GigabitEthernet0/1 interface using embedded packet capture (EPC). The output shows ARP requests from Host A (192.168.1.10) but no ARP replies from Host B (192.168.2.20). What is the most likely cause of this issue?

Accepted Answer

The router's interface does not have an IP address configured in the VLAN 2 subnet.. The router's GigabitEthernet0/1 interface must have an IP address in the same subnet as Host B (192.168.2.20) to act as the default gateway for VLAN 2. Without an IP address in the VLAN 2 subnet, the router cannot respond to ARP requests for that subnet, so Host A's ARP requests for Host B go unanswered. This is the most likely cause because the router performs inter-VLAN routing only when it has an interface (or subinterface) with an IP address in the destination VLAN's subnet.

Answer

The router's interface is configured as an access port instead of a trunk.

Answer

Host A is in a different VLAN than the router's interface.

Answer

The router's interface has a duplex mismatch with the switch.