CCNA Switching and Network Access Practice Test 19 — 15 Questions

Question 1

A network administrator recently configured BPDU Guard on all access ports of a switch to protect against rogue switches. After the change, users in VLAN 10 report intermittent connectivity issues and frequent link flaps. The administrator checks the switch and notices that several ports are in an err-disabled state. What is the most likely cause of the problem?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

BPDU Guard is enabled on access ports that are receiving BPDUs, causing the ports to go into err-disabled state.. BPDU Guard is configured to protect against rogue switches by placing a port into an err-disabled state upon receiving a BPDU. In this scenario, BPDU Guard is enabled on access ports that are receiving BPDUs (possibly from a rogue switch or misconfiguration), causing the ports to err-disable and flap. PortFast is not required for BPDU Guard to function; the issue is that BPDUs are being received on ports that are not expected to receive them. The intermittent connectivity occurs as ports cycle into err-disabled and are re-enabled.

Answer

Root Guard is preventing the port from becoming a root port.

Answer

Loop Guard has detected a unidirectional link and placed the port into err-disabled state.

Answer

BPDU Guard is globally enabled but not configured on the interface, so the port is err-disabled due to a BPDU received.

Question 2

A network engineer receives a call that users in VLAN 10 on Switch B cannot ping the default gateway, which is a router on a stick connected to Switch A. The engineer checks the Spanning Tree Protocol state on the interface connecting Switch A to Switch B (GigabitEthernet0/1) and finds it is in a root-inconsistent state. Which command output best explains the cause of the issue?

Accepted Answer

Root guard is enabled and the port received a superior BPDU, causing it to become root-inconsistent.. Root guard, when enabled on a port, places that port into a root-inconsistent blocking state if it receives a superior BPDU, preventing the switch from becoming the root bridge. This root-inconsistent state stops forwarding traffic, which explains why users in VLAN 10 cannot reach the default gateway. The port remains physically up but is blocked by spanning tree, so normal interface status would not show a down state, making the root-inconsistent state the key indicator.

Answer

The interface is in err-disable state due to BPDU guard.

Answer

Loop guard is enabled and the port is in a blocking state due to missing BPDUs.

Answer

The port is in a forwarding state but the VLAN is misconfigured.

Question 3

Which TWO of the following statements accurately describe the configuration and behavior of Root Guard, Loop Guard, and BPDU Guard in Rapid PVST+ environments?

Accepted Answer

Root Guard, when enabled on a port, prevents that port from becoming the root port by placing it in a root-inconsistent state if a superior BPDU is received.. Root Guard prevents a port from becoming a root port by placing it in a root-inconsistent (blocking) state upon receiving a superior BPDU, protecting the root bridge placement. Option D is correct because BPDU Guard errdisables a port upon receiving a BPDU, a feature typically applied to access ports to block unauthorized switches. Option B is wrong: Root Guard does not shut down the port; it places it in a blocked state, unlike BPDU Guard's errdisable action. Option C is wrong: Loop Guard does not disable a port when BPDUs stop being received; instead, it moves the port to a loop-inconsistent (blocking) state to guard against unidirectional link failures. Option E is wrong: BPDU Guard errdisables ports, whereas the loop-inconsistent blocking state is used by Loop Guard or Root Guard, not BPDU Guard.

Answer

Root Guard automatically shuts down the port when a superior BPDU is received, similar to BPDU Guard.

Answer

Loop Guard, when enabled, disables a port if BPDUs are no longer received on it, preventing a unidirectional link failure.

Answer

BPDU Guard places the port in a blocking state (loop-inconsistent) when a BPDU is received, similar to Loop Guard.

Question 4

Which TWO statements correctly describe the behavior of Root Guard, Loop Guard, and BPDU Guard in a Rapid PVST+ environment?

Accepted Answer

Root Guard is applied to a port that should never become a root port; if a superior BPDU is received, the port is placed into a root-inconsistent state.. Root Guard, applied to a port that should never become a root port, places that port into a root-inconsistent state upon receiving a superior BPDU, blocking traffic to prevent an unauthorized root bridge. Option C is correct because BPDU Guard is typically configured on access ports and error-disables the port if any BPDU is received, protecting against rogue switch connections. Option B is incorrect: when BPDUs stop on a port with Loop Guard, the port is placed into a loop-inconsistent state (blocked), not immediately forwarded, to prevent loops. Option D is incorrect because Root Guard and BPDU Guard are mutually exclusive and cannot be enabled simultaneously on the same port due to conflicting protective behaviors. Option E is incorrect because Loop Guard is effective on any port that is expected to receive BPDUs, including root ports and alternate/backup ports; it is not limited to ports already in a blocking state, and the statement's use of 'only' makes it false.

Answer

Loop Guard is used on root ports to monitor BPDU reception; if BPDUs stop, the port is immediately placed into forwarding mode to maintain connectivity.

Answer

Root Guard and BPDU Guard can be enabled simultaneously on the same port to provide both root protection and BPDU filtering.

Answer

Loop Guard is only effective when configured on ports that are in a blocking state; it prevents them from transitioning to forwarding if BPDUs are not received.

Question 5

Two switches are connected using four Gigabit Ethernet interfaces configured as an EtherChannel with LACP. The network administrator notices that only two of the four interfaces are active in the port-channel, and the other two are in a suspended state. Upon further investigation, the administrator finds that the two inactive interfaces correspond to remote interfaces that are configured with the 'on' mode, while the active ones correspond to remote interfaces configured with LACP active/passive. The administrator also verifies that all local interfaces have the same speed, duplex, and VLAN. What is the most likely cause of the suspended interfaces?

Accepted Answer

The remote switch interfaces corresponding to the suspended local interfaces are configured with the 'on' mode instead of 'active' or 'passive' for LACP.. LACP requires both ends of a link to be configured in either 'active' or 'passive' mode to negotiate an EtherChannel. If some remote interfaces are set to 'on' mode (static EtherChannel), LACP negotiation fails on those links, causing the corresponding local LACP-enabled interfaces to remain in a suspended state. The local switch detects that LACP PDUs are not received on those interfaces and suspends them to prevent misconfiguration. The other two interfaces with correctly configured remote peers form the EtherChannel successfully.

Answer

The interfaces are in err-disabled state due to a spanning-tree loop.

Answer

The port-channel interface is shutdown.

Answer

There is a mismatch in the allowed VLANs on the member interfaces.

Question 6

A network engineer configures an EtherChannel between two Cisco switches SW1 and SW2 using LACP. After configuration, hosts connected to SW1 report intermittent connectivity to hosts on SW2. The engineer checks the EtherChannel status and sees that the trunk is up but only allows VLAN 1, while the hosts communicate across VLANs 10 and 20. Which command should the engineer apply to both switches to resolve the issue?

Accepted Answer

switchport trunk allowed vlan 1,10,20. The output shows the EtherChannel is up but only VLAN 1 is allowed on the trunk, while the hosts on SW1 and SW2 communicate across VLANs 10 and 20. Applying 'switchport trunk allowed vlan 1,10,20' on both switches ensures all necessary VLANs are permitted over the EtherChannel, resolving the intermittent connectivity caused by dropped traffic for VLANs 10 and 20.

Answer

channel-group 1 mode active

Answer

lacp rate fast

Answer

switchport mode trunk

Question 7

Which TWO statements correctly describe the configuration and verification of EtherChannel with LACP?

Accepted Answer

LACP uses the 'active' and 'passive' modes to negotiate an EtherChannel.. LACP (IEEE 802.3ad) uses 'active' and 'passive' modes to negotiate an EtherChannel. Option B is correct because the 'show etherchannel summary' command displays the channel group number, port-channel interface, member ports, and their status flags (e.g., P for in port-channel, S for suspended). Option C is incorrect because 'auto' and 'desirable' are PAgP modes, not LACP modes. Option D is incorrect because 'show etherchannel summary' does not show LACP system priority; that is displayed with 'show lacp sys-id' or 'show etherchannel detail'. Option E is incorrect because an EtherChannel can be formed with mismatched LACP modes as long as at least one side is 'active'; for example, 'active' + 'passive' works.

Answer

LACP uses the 'auto' and 'desirable' modes to negotiate an EtherChannel.

Answer

The 'show etherchannel summary' command shows the LACP system priority for each channel.

Answer

An EtherChannel can be formed only if all member ports use the same LACP mode.

Question 8

Which TWO statements correctly describe EtherChannel configuration and verification with LACP?

Accepted Answer

LACP uses the modes 'active' and 'passive' to negotiate an EtherChannel.. LACP (IEEE 802.3ad) defines two negotiation modes: 'active' (sends LACP frames and initiates negotiation) and 'passive' (responds only to received LACP frames). An EtherChannel forms only when at least one side is in 'active' mode; two 'passive' sides will never negotiate. Option C is correct because the 'show etherchannel summary' command displays the port-channel status as 'SU' (in use, Layer 2) or 'SD' (administratively down/shutdown), not simply 'UP' or 'DOWN'.

Answer

LACP uses the modes 'desirable' and 'auto' to negotiate an EtherChannel.

Answer

The command 'show etherchannel summary' displays the status of each port-channel as UP or DOWN.

Answer

LACP 'active' mode can only form an EtherChannel with another interface in 'active' mode.

Question 9

Drag and drop the following steps into the correct order to create VLANs, assign access ports, configure 802.1Q trunks, set the native VLAN, and verify with 'show vlan brief' and 'show interfaces trunk'.

Accepted Answer

Create VLANs, assign access ports, configure 802.1Q trunks, set native VLAN, verify with 'show vlan brief' and 'show interfaces trunk'. VLANs must be created before assigning ports; trunking is configured after access ports; verification is the final step.

Answer

Assign access ports, create VLANs, configure 802.1Q trunks, set native VLAN, verify with 'show vlan brief' and 'show interfaces trunk'

Answer

Create VLANs, assign access ports, set native VLAN, configure 802.1Q trunks, verify with 'show vlan brief' and 'show interfaces trunk'

Answer

Assign access ports, configure 802.1Q trunks, create VLANs, set native VLAN, verify with 'show vlan brief' and 'show interfaces trunk'

Question 10

Which TWO statements are true regarding VLAN configuration, 802.1Q trunking, and the native VLAN?

Accepted Answer

The native VLAN should be changed from the default VLAN 1 to an unused VLAN for security reasons.. Changing the native VLAN from the default VLAN 1 to an unused VLAN is a recommended security best practice to prevent VLAN hopping attacks. Option D is correct because 802.1Q uses a 12-bit VLAN ID field, allowing VLAN IDs from 1 to 4094 (0 and 4095 are reserved). Option A is false: on an 802.1Q trunk, frames in the native VLAN are typically sent untagged. Option C is false: 802.1Q is an IEEE standard, not Cisco proprietary (ISL is Cisco proprietary). Option E is false: the native VLAN does not have to match on both ends; mismatched native VLANs can cause traffic to be misclassified but the trunk will still operate.

Answer

On an 802.1Q trunk, frames in the native VLAN are always tagged with a VLAN ID.

Answer

802.1Q is a Cisco proprietary trunking protocol.

Answer

The native VLAN must be the same on both ends of an 802.1Q trunk for the trunk to operate.

Question 11

Drag and drop the following steps into the correct order to configure a switch port for a VoIP phone (voice VLAN + data VLAN), an AP trunk, and a PoE-powered IoT device.

Accepted Answer

Create VLANs, assign data and voice VLANs to the phone port, configure the AP trunk, enable PoE on the IoT port. First create VLANs, then assign data and voice VLANs to the phone port, configure the AP trunk, and lastly enable PoE on the IoT port.

Answer

Enable PoE on the IoT port, create VLANs, configure the AP trunk, assign data and voice VLANs to the phone port

Answer

Create VLANs, enable PoE on the IoT port, assign data and voice VLANs to the phone port, configure the AP trunk

Answer

Configure the AP trunk, create VLANs, assign data and voice VLANs to the phone port, enable PoE on the IoT port

Question 12

Which TWO statements correctly describe the configuration and use of a voice VLAN on a Cisco switch port?

Accepted Answer

When a voice VLAN is configured, the switch port operates in two VLANs: one for data and one for voice traffic.. When a voice VLAN is configured on a Cisco switch port, the port operates in two separate VLANs simultaneously: one for data traffic (the access VLAN) and one for voice traffic (the voice VLAN). This is achieved using the 'switchport voice vlan' command, which allows the switch to tag voice frames with the voice VLAN ID while leaving data frames untagged (or tagged with the access VLAN). This separation ensures that voice traffic receives appropriate QoS treatment and is isolated from data traffic.

Answer

The voice VLAN is configured using the 'switchport mode trunk' command.

Answer

The voice VLAN must be the same as the native VLAN on the trunk link.

Answer

The data VLAN and voice VLAN must be in the same IP subnet.

Question 13

Drag and drop the following steps into the correct order to configure and recover from a BPDU guard violation on a PortFast-enabled access port in RSTP.

Accepted Answer

Configure PortFast and BPDU guard on the interface.. Configure PortFast and BPDU guard on the access port. Then trigger a violation by connecting an unauthorized switch, which causes the port to error-disable. Diagnose by checking the error-disabled status. To recover, first remove the offending device, then cycle the port with shutdown and no shutdown; otherwise the port will immediately go error-disabled again.

Question 14

Drag and drop the following steps into the correct order to configure and recover from a BPDU guard violation on a PortFast-enabled access port.

Accepted Answer

Configure PortFast and BPDU guard on the interface.. The correct order is: first configure PortFast and BPDU guard on the interface (A). Then connect a switch to trigger a BPDU guard violation (B). Next, perform a shutdown followed by no shutdown to recover from the errdisable state (C). Finally, verify that the port is forwarding traffic (D). This sequence ensures the violation occurs before recovery, which is the realistic scenario.

Question 15

Drag and drop the following steps into the correct order to configure and recover from a BPDU Guard violation on a PortFast-enabled access port using Cisco IOS-XE CLI commands.

Accepted Answer

1. Enter global configuration mode. 2. Configure spanning-tree portfast default. 3. Enter interface configuration mode. 4. Configure spanning-tree bpduguard enable. 5. Exit to privileged EXEC mode. 6. Verify errdisable state. 7. Enter interface configuration mode. 8. Issue shutdown command. 9. Issue no shutdown command.. Only Option A correctly lists the steps to configure and manually recover from a BPDU Guard violation on a PortFast-enabled port. Option B is invalid because the command 'clear spanning-tree bpduguard' does not exist; the proper recovery is shutdown/no shutdown. Option C incorrectly applies the global command 'spanning-tree portfast bpduguard default' in interface mode; it should be used in global configuration mode. Option D includes an unnecessary 'Enter interface configuration mode' step after the global recovery command and does not reflect the correct sequence for automatic recovery.

Answer

1. Enter global configuration mode. 2. Configure spanning-tree portfast default. 3. Enter interface configuration mode. 4. Configure spanning-tree bpduguard enable. 5. Exit to privileged EXEC mode. 6. Issue clear spanning-tree bpduguard command. 7. Verify port is up.

Answer

1. Enter global configuration mode. 2. Configure spanning-tree portfast default. 3. Enter interface configuration mode. 4. Configure spanning-tree portfast bpduguard default. 5. Exit to privileged EXEC mode. 6. Verify errdisable state. 7. Enter interface configuration mode. 8. Issue shutdown command. 9. Issue no shutdown command.

Answer

1. Enter global configuration mode. 2. Configure spanning-tree portfast default. 3. Enter interface configuration mode. 4. Configure spanning-tree bpduguard enable. 5. Exit to privileged EXEC mode. 6. Issue errdisable recovery cause bpduguard command. 7. Wait for timer. 8. Verify port is up.