CCNA Switching and Network Access Practice Test 19 — 15 Questions

Question 1

Which TWO statements correctly describe aspects of interpreting packet capture output for Layer 2/3 troubleshooting using Wireshark or embedded packet capture on IOS-XE?

Accepted Answer

A large number of ARP requests for the same IP address in a packet capture suggests a possible Layer 3 connectivity issue, such as a missing default gateway.. A large number of ARP requests for the same IP address indicates that the device is repeatedly trying to resolve the Layer 3 address to a Layer 2 MAC address, but no device is responding. This often happens when the target IP (e.g., the default gateway) is unreachable or misconfigured, pointing to a Layer 3 connectivity issue. Option D is correct because IOS-XE embedded packet capture supports both ingress and egress capture directions, allowing you to verify whether a router is dropping or modifying packets as they transit. Option A is incorrect: DHCP Discover is broadcast, not unicast, because the client does not yet know the server’s MAC address. Option C is incorrect: a SYN-ACK is part of a successful three-way handshake (SYN, SYN-ACK, ACK) and indicates the server is reachable; if the handshake failed, you would see only SYN packets or RST packets. Option E is incorrect: the TTL value in a captured packet shows the current TTL after decrementing by each hop; the original TTL is not preserved in the packet.

Answer

A DHCP Discover packet in a Wireshark capture shows a unicast destination MAC address to the DHCP server.

Answer

A TCP SYN-ACK packet in a capture indicates that the three-way handshake failed and the destination is unreachable.

Answer

The TTL value in a captured IP packet always shows the original TTL set by the source host.

Question 2

A network engineer notices that a new switch, SW3, was connected to port GigabitEthernet0/1 on SW1, but the port immediately went into an err-disabled state. The network uses Rapid PVST+ with BPDU Guard enabled globally on all access ports. The engineer checks the logs and sees 'bpduguard error detected' messages. What is the most likely cause of the err-disabled state?

Accepted Answer

A BPDU was received on port GigabitEthernet0/1, triggering BPDU Guard.. The err-disabled state is caused by BPDU Guard triggering when a BPDU is received on an access port. Option A is incorrect because BPDU Guard is intentionally enabled on access ports to prevent unauthorized switches from joining the network. Option C is wrong because Root Guard prevents a port from becoming the root, not from receiving BPDUs. Option D is wrong because Loop Guard prevents loops on blocked ports in case of unidirectional links, not relevant to BPDU reception.

Answer

The port is configured as an access port, but BPDU Guard should be disabled on all access ports.

Answer

Configure Root Guard on the interface to prevent the err-disabled state.

Answer

Enable Loop Guard on the interface to prevent the err-disabled state.

Question 3

A network administrator recently configured BPDU Guard on all access ports of a switch to protect against rogue switches. After the change, users in VLAN 10 report intermittent connectivity issues and frequent link flaps. The administrator checks the switch and notices that several ports are in an err-disabled state. What is the most likely cause of the problem?

Accepted Answer

BPDU Guard is enabled on access ports that are receiving BPDUs, causing the ports to go into err-disabled state.. BPDU Guard is configured to protect against rogue switches by placing a port into an err-disabled state upon receiving a BPDU. In this scenario, BPDU Guard is enabled on access ports that are receiving BPDUs (possibly from a rogue switch or misconfiguration), causing the ports to err-disable and flap. PortFast is not required for BPDU Guard to function; the issue is that BPDUs are being received on ports that are not expected to receive them. The intermittent connectivity occurs as ports cycle into err-disabled and are re-enabled.

Answer

Root Guard is preventing the port from becoming a root port.

Answer

Loop Guard has detected a unidirectional link and placed the port into err-disabled state.

Answer

BPDU Guard is globally enabled but not configured on the interface, so the port is err-disabled due to a BPDU received.

Question 4

A network engineer receives a call that users in VLAN 10 on Switch B cannot ping the default gateway, which is a router on a stick connected to Switch A. The engineer checks the Spanning Tree Protocol state on the interface connecting Switch A to Switch B (GigabitEthernet0/1) and finds it is in a root-inconsistent state. Which command output best explains the cause of the issue?

Accepted Answer

Root guard is enabled and the port received a superior BPDU, causing it to become root-inconsistent.. Root guard, when enabled on a port, places that port into a root-inconsistent blocking state if it receives a superior BPDU, preventing the switch from becoming the root bridge. This root-inconsistent state stops forwarding traffic, which explains why users in VLAN 10 cannot reach the default gateway. The port remains physically up but is blocked by spanning tree, so normal interface status would not show a down state, making the root-inconsistent state the key indicator.

Answer

The interface is in err-disable state due to BPDU guard.

Answer

Loop guard is enabled and the port is in a blocking state due to missing BPDUs.

Answer

The port is in a forwarding state but the VLAN is misconfigured.

Question 5

Which TWO of the following statements accurately describe the configuration and behavior of Root Guard, Loop Guard, and BPDU Guard in Rapid PVST+ environments?

Accepted Answer

Root Guard, when enabled on a port, prevents that port from becoming the root port by placing it in a root-inconsistent state if a superior BPDU is received.. Root Guard prevents a port from becoming a root port by placing it in a root-inconsistent (blocking) state upon receiving a superior BPDU, protecting the root bridge placement. Option D is correct because BPDU Guard errdisables a port upon receiving a BPDU, a feature typically applied to access ports to block unauthorized switches. Option B is wrong: Root Guard does not shut down the port; it places it in a blocked state, unlike BPDU Guard's errdisable action. Option C is wrong: Loop Guard does not disable a port when BPDUs stop being received; instead, it moves the port to a loop-inconsistent (blocking) state to guard against unidirectional link failures. Option E is wrong: BPDU Guard errdisables ports, whereas the loop-inconsistent blocking state is used by Loop Guard or Root Guard, not BPDU Guard.

Answer

Root Guard automatically shuts down the port when a superior BPDU is received, similar to BPDU Guard.

Answer

Loop Guard, when enabled, disables a port if BPDUs are no longer received on it, preventing a unidirectional link failure.

Answer

BPDU Guard places the port in a blocking state (loop-inconsistent) when a BPDU is received, similar to Loop Guard.

Question 6

Which TWO statements correctly describe the behavior of Root Guard, Loop Guard, and BPDU Guard in a Rapid PVST+ environment?

Accepted Answer

Root Guard is applied to a port that should never become a root port; if a superior BPDU is received, the port is placed into a root-inconsistent state.. Root Guard, applied to a port that should never become a root port, places that port into a root-inconsistent state upon receiving a superior BPDU, blocking traffic to prevent an unauthorized root bridge. Option C is correct because BPDU Guard is typically configured on access ports and error-disables the port if any BPDU is received, protecting against rogue switch connections. Option B is incorrect: when BPDUs stop on a port with Loop Guard, the port is placed into a loop-inconsistent state (blocked), not immediately forwarded, to prevent loops. Option D is incorrect because Root Guard and BPDU Guard are mutually exclusive and cannot be enabled simultaneously on the same port due to conflicting protective behaviors. Option E is incorrect because Loop Guard is effective on any port that is expected to receive BPDUs, including root ports and alternate/backup ports; it is not limited to ports already in a blocking state, and the statement's use of 'only' makes it false.

Answer

Loop Guard is used on root ports to monitor BPDU reception; if BPDUs stop, the port is immediately placed into forwarding mode to maintain connectivity.

Answer

Root Guard and BPDU Guard can be enabled simultaneously on the same port to provide both root protection and BPDU filtering.

Answer

Loop Guard is only effective when configured on ports that are in a blocking state; it prevents them from transitioning to forwarding if BPDUs are not received.

Question 7

Two switches are connected using four Gigabit Ethernet interfaces configured as an EtherChannel with LACP. The network administrator notices that only two of the four interfaces are active in the port-channel, and the other two are in a suspended state. Upon further investigation, the administrator finds that the two inactive interfaces correspond to remote interfaces that are configured with the 'on' mode, while the active ones correspond to remote interfaces configured with LACP active/passive. The administrator also verifies that all local interfaces have the same speed, duplex, and VLAN. What is the most likely cause of the suspended interfaces?

Accepted Answer

The remote switch interfaces corresponding to the suspended local interfaces are configured with the 'on' mode instead of 'active' or 'passive' for LACP.. LACP requires both ends of a link to be configured in either 'active' or 'passive' mode to negotiate an EtherChannel. If some remote interfaces are set to 'on' mode (static EtherChannel), LACP negotiation fails on those links, causing the corresponding local LACP-enabled interfaces to remain in a suspended state. The local switch detects that LACP PDUs are not received on those interfaces and suspends them to prevent misconfiguration. The other two interfaces with correctly configured remote peers form the EtherChannel successfully.

Answer

The interfaces are in err-disabled state due to a spanning-tree loop.

Answer

The port-channel interface is shutdown.

Answer

There is a mismatch in the allowed VLANs on the member interfaces.

Question 8

A network engineer configures an EtherChannel between two Cisco switches SW1 and SW2 using LACP. After configuration, hosts connected to SW1 report intermittent connectivity to hosts on SW2. The engineer checks the EtherChannel status and sees that the trunk is up but only allows VLAN 1, while the hosts communicate across VLANs 10 and 20. Which command should the engineer apply to both switches to resolve the issue?

Accepted Answer

switchport trunk allowed vlan 1,10,20. The output shows the EtherChannel is up but only VLAN 1 is allowed on the trunk, while the hosts on SW1 and SW2 communicate across VLANs 10 and 20. Applying 'switchport trunk allowed vlan 1,10,20' on both switches ensures all necessary VLANs are permitted over the EtherChannel, resolving the intermittent connectivity caused by dropped traffic for VLANs 10 and 20.

Answer

channel-group 1 mode active

Answer

lacp rate fast

Answer

switchport mode trunk

Question 9

Which TWO statements correctly describe the configuration and verification of EtherChannel with LACP?

Accepted Answer

LACP uses the 'active' and 'passive' modes to negotiate an EtherChannel.. LACP (IEEE 802.3ad) uses 'active' and 'passive' modes to negotiate an EtherChannel. Option B is correct because the 'show etherchannel summary' command displays the channel group number, port-channel interface, member ports, and their status flags (e.g., P for in port-channel, S for suspended). Option C is incorrect because 'auto' and 'desirable' are PAgP modes, not LACP modes. Option D is incorrect because 'show etherchannel summary' does not show LACP system priority; that is displayed with 'show lacp sys-id' or 'show etherchannel detail'. Option E is incorrect because an EtherChannel can be formed with mismatched LACP modes as long as at least one side is 'active'; for example, 'active' + 'passive' works.

Answer

LACP uses the 'auto' and 'desirable' modes to negotiate an EtherChannel.

Answer

The 'show etherchannel summary' command shows the LACP system priority for each channel.

Answer

An EtherChannel can be formed only if all member ports use the same LACP mode.

Question 10

Which TWO statements correctly describe EtherChannel configuration and verification with LACP?

Accepted Answer

LACP uses the modes 'active' and 'passive' to negotiate an EtherChannel.. LACP (IEEE 802.3ad) defines two negotiation modes: 'active' (sends LACP frames and initiates negotiation) and 'passive' (responds only to received LACP frames). An EtherChannel forms only when at least one side is in 'active' mode; two 'passive' sides will never negotiate. Option C is correct because the 'show etherchannel summary' command displays the port-channel status as 'SU' (in use, Layer 2) or 'SD' (administratively down/shutdown), not simply 'UP' or 'DOWN'.

Answer

LACP uses the modes 'desirable' and 'auto' to negotiate an EtherChannel.

Answer

The command 'show etherchannel summary' displays the status of each port-channel as UP or DOWN.

Answer

LACP 'active' mode can only form an EtherChannel with another interface in 'active' mode.

Question 11

Drag and drop the steps into the recommended configuration order for setting up VLANs, assigning access ports, configuring 802.1Q trunking with a non-default native VLAN, and verifying the setup on a Cisco IOS-XE switch.

Accepted Answer

1. Create VLANs, 2. Configure trunking with non-default native VLAN, 3. Assign access ports to VLANs, 4. Verify configuration. After creating VLANs, the recommended order is to configure trunking with a non-default native VLAN before assigning access ports. This ensures the trunk is ready with the correct native VLAN, preventing mismatches and allowing the switch to carry traffic for the new VLANs. Options B and D fail because VLANs must exist first. Option A places trunking last, which is not the best practice.

Answer

1. Create VLANs, 2. Assign access ports to VLANs, 3. Configure trunking with non-default native VLAN, 4. Verify configuration

Answer

1. Assign access ports to VLANs, 2. Create VLANs, 3. Configure trunking with non-default native VLAN, 4. Verify configuration

Answer

1. Configure trunking with non-default native VLAN, 2. Create VLANs, 3. Assign access ports to VLANs, 4. Verify configuration

Question 12

Drag and drop the following steps into the correct order to create VLANs, assign access ports, configure 802.1Q trunks, set the native VLAN, and verify with 'show vlan brief' and 'show interfaces trunk'.

Accepted Answer

Create VLANs, assign access ports, configure 802.1Q trunks, set native VLAN, verify with 'show vlan brief' and 'show interfaces trunk'. VLANs must be created before assigning ports; trunking is configured after access ports; verification is the final step.

Answer

Assign access ports, create VLANs, configure 802.1Q trunks, set native VLAN, verify with 'show vlan brief' and 'show interfaces trunk'

Answer

Create VLANs, assign access ports, set native VLAN, configure 802.1Q trunks, verify with 'show vlan brief' and 'show interfaces trunk'

Answer

Assign access ports, configure 802.1Q trunks, create VLANs, set native VLAN, verify with 'show vlan brief' and 'show interfaces trunk'

Question 13

Which TWO statements are true regarding VLAN configuration, 802.1Q trunking, and the native VLAN?

Accepted Answer

The native VLAN should be changed from the default VLAN 1 to an unused VLAN for security reasons.. Changing the native VLAN from the default VLAN 1 to an unused VLAN is a recommended security best practice to prevent VLAN hopping attacks. Option D is correct because 802.1Q uses a 12-bit VLAN ID field, allowing VLAN IDs from 1 to 4094 (0 and 4095 are reserved). Option A is false: on an 802.1Q trunk, frames in the native VLAN are typically sent untagged. Option C is false: 802.1Q is an IEEE standard, not Cisco proprietary (ISL is Cisco proprietary). Option E is false: the native VLAN does not have to match on both ends; mismatched native VLANs can cause traffic to be misclassified but the trunk will still operate.

Answer

On an 802.1Q trunk, frames in the native VLAN are always tagged with a VLAN ID.

Answer

802.1Q is a Cisco proprietary trunking protocol.

Answer

The native VLAN must be the same on both ends of an 802.1Q trunk for the trunk to operate.

Question 14

Drag and drop the following steps into the correct order to configure a switch port for a VoIP phone (voice VLAN + data VLAN), an AP trunk, and a PoE-powered IoT device.

Accepted Answer

Create VLANs, assign data and voice VLANs to the phone port, configure the AP trunk, enable PoE on the IoT port. First create VLANs, then assign data and voice VLANs to the phone port, configure the AP trunk, and lastly enable PoE on the IoT port.

Answer

Enable PoE on the IoT port, create VLANs, configure the AP trunk, assign data and voice VLANs to the phone port

Answer

Create VLANs, enable PoE on the IoT port, assign data and voice VLANs to the phone port, configure the AP trunk

Answer

Configure the AP trunk, create VLANs, assign data and voice VLANs to the phone port, enable PoE on the IoT port

Question 15

Which TWO statements correctly describe the configuration and use of a voice VLAN on a Cisco switch port?

Accepted Answer

When a voice VLAN is configured, the switch port operates in two VLANs: one for data and one for voice traffic.. When a voice VLAN is configured on a Cisco switch port, the port operates in two separate VLANs simultaneously: one for data traffic (the access VLAN) and one for voice traffic (the voice VLAN). This is achieved using the 'switchport voice vlan' command, which allows the switch to tag voice frames with the voice VLAN ID while leaving data frames untagged (or tagged with the access VLAN). This separation ensures that voice traffic receives appropriate QoS treatment and is isolated from data traffic.

Answer

The voice VLAN is configured using the 'switchport mode trunk' command.

Answer

The voice VLAN must be the same as the native VLAN on the trunk link.

Answer

The data VLAN and voice VLAN must be in the same IP subnet.