CCNA Switching and Network Access Practice Test 20 — 15 Questions

Question 1

Which TWO statements correctly describe the behavior of PortFast and BPDU Guard on a Cisco switch?

Accepted Answer

PortFast immediately transitions a port from blocking to forwarding state, bypassing listening and learning.. PortFast immediately transitions an access port from blocking to forwarding, bypassing listening and learning (Option A). BPDU Guard errdisables a PortFast-enabled port if any BPDU is received, protecting against accidental loops (Option B). Option C is incorrect because PortFast does not alter BPDU handling; the port still processes BPDUs and reverts to normal STP if one is received. Option D is false because BPDU Guard disables the port entirely rather than ignoring BPDUs. Option E is incorrect because BPDU Guard is typically configured on access ports connected to end devices, not on trunk ports.

Answer

PortFast allows BPDUs to pass through the port normally, but the port remains in forwarding state.

Answer

BPDU Guard prevents the port from becoming a root port or designated port by ignoring superior BPDUs.

Answer

BPDU Guard is typically configured on trunk ports to prevent loops between switches.

Question 2

A network troubleshooter is using Cisco IOS-XE's embedded packet capture feature to capture traffic on an interface and then analyze it in Wireshark to isolate a Layer 2 or Layer 3 fault. Which of the following sequences represents the correct order of steps?

Accepted Answer

Define the capture point with interface and optional filter, start the capture, stop the capture, export the capture file, then analyze in Wireshark.. The correct workflow is to first define the capture point (interface and any filters), then start the capture, stop it when sufficient data is collected, export the captured packets to a file, and finally open that file in Wireshark for analysis. Starting the capture before defining the point, exporting before stopping, or defining the point after stopping all result in an invalid or incomplete capture process.

Answer

Start the capture, define the capture point with interface and filter, stop the capture, export the capture file, then analyze in Wireshark.

Answer

Define the capture point, start the capture, export the capture file, stop the capture, then analyze in Wireshark.

Answer

Start the capture, stop the capture, define the capture point, export the capture file, then analyze in Wireshark.

Question 3

Drag and drop the following steps into the correct order to capture and analyze traffic on IOS-XE using the embedded packet capture feature, and in Wireshark to isolate a Layer 2 or Layer 3 fault.

Accepted Answer

Access privileged EXEC mode, create a capture buffer, associate a capture point, start the capture, stop and export the capture, analyze in Wireshark. For IOS‑XE embedded packet capture, the correct order is: 1) Access privileged EXEC mode (required for all monitor commands), 2) Create a capture buffer, 3) Associate a capture point, 4) Start the capture, 5) Stop the capture, 6) Export the capture, 7) Analyze in Wireshark. Options B, C, and D each violate the required sequence: B starts buffer creation before entering privileged mode, C associates the point before creating the buffer, and D omits the critical 'start' step entirely.

Answer

Create a capture buffer, access privileged EXEC mode, associate a capture point, start the capture, stop and export the capture, analyze in Wireshark

Answer

Access privileged EXEC mode, associate a capture point, create a capture buffer, start the capture, stop and export the capture, analyze in Wireshark

Answer

Access privileged EXEC mode, create a capture buffer, associate a capture point, stop and export the capture, analyze in Wireshark

Question 4

Drag and drop the following steps into the correct order to capture and analyze traffic on IOS-XE using the embedded packet capture feature, and in Wireshark to isolate a Layer 2 or Layer 3 fault.

Accepted Answer

Define the capture interface, apply a filter, start capture, stop capture, export for analysis in Wireshark.. First define the capture interface, then apply a filter, start capture, stop it, and finally export for analysis in Wireshark.

Answer

Apply a filter, define the capture interface, start capture, export for analysis, stop capture.

Answer

Define the capture interface, start capture, apply a filter, stop capture, export for analysis.

Answer

Apply a filter, start capture, define the capture interface, stop capture, export for analysis.

Question 5

Drag and drop the following steps into the correct order to capture and analyze traffic on IOS-XE using the embedded packet capture feature, and in Wireshark to isolate a Layer 2 or Layer 3 fault.

Accepted Answer

Configure the capture point, define the capture buffer, start the capture, stop the capture, export the capture. The correct order for embedded packet capture on IOS-XE is: configure the capture point first (to define the traffic filter), then define the capture buffer, start the capture, stop the capture, and finally export the capture. Starting the capture after configuring both the point and buffer ensures that traffic is captured correctly. Exporting before stopping may result in incomplete data. Only option A follows this correct sequence.

Answer

Define the capture buffer, configure the capture point, start the capture, export the capture, stop the capture

Answer

Configure the capture point, start the capture, define the capture buffer, stop the capture, export the capture

Answer

Define the capture buffer, start the capture, configure the capture point, stop the capture, export the capture

Question 6

Drag and drop the following steps into the correct order to capture and analyze traffic on IOS-XE using the embedded packet capture feature, then export to Wireshark to isolate a Layer 2 or Layer 3 fault.

Accepted Answer

Enter privileged EXEC mode, define the capture buffer, specify the interface and direction, start the capture, stop the capture, export the capture to a .pcap file, transfer the file, and analyze in Wireshark.. First enter privileged mode, then define the capture buffer, specify the interface and direction, start the capture, stop it after collecting data, export to a .pcap file, then transfer and analyze in Wireshark.

Answer

Enter global configuration mode, define the capture buffer, specify the interface and direction, start the capture, stop the capture, export the capture to a .pcap file, transfer the file, and analyze in Wireshark.

Answer

Enter privileged EXEC mode, specify the interface and direction, define the capture buffer, start the capture, stop the capture, export the capture to a .pcap file, transfer the file, and analyze in Wireshark.

Answer

Enter privileged EXEC mode, define the capture buffer, specify the interface and direction, start the capture, export the capture to a .pcap file, stop the capture, transfer the file, and analyze in Wireshark.

Question 7

What is the correct order of steps to capture and analyze traffic on IOS-XE using the embedded packet capture feature, and in Wireshark to isolate a Layer 2 or Layer 3 fault?

Accepted Answer

Define the capture point with interface and optional filter, then start the capture, stop it, and export the capture file for analysis in Wireshark.. The correct order for embedded packet capture on IOS-XE is to first define the capture point with the desired interface and optional filter, then start the capture, stop it after capturing the needed traffic, and finally export the file for analysis in Wireshark. Option A accurately reflects this sequence. Option B fails because the capture must be defined before starting. Option C fails because exporting should occur after stopping the capture. Option D fails because analysis is performed externally, not on the router.

Answer

Start the capture immediately, then define the capture point with interface and filter, stop the capture, and export the file for analysis.

Answer

Define the capture point, start the capture, export the file, and then stop the capture.

Answer

Define the capture point, start the capture, stop it, then analyze the capture directly on the router without exporting.

Question 8

Which TWO statements accurately describe the use of packet capture tools for troubleshooting Layer 2/3 issues?

Accepted Answer

A packet capture that shows frames with the same source and destination MAC addresses but different 802.1Q VLAN tags indicates a possible trunk misconfiguration.. Frames with identical source and destination MAC addresses but different 802.1Q VLAN tags indicate the same device is reachable on multiple VLANs, which commonly results from a misconfigured trunk (e.g., native VLAN mismatch or inconsistent allowed VLAN lists). Option D is correct because seeing ICMP echo requests leave a router but no echo replies return suggests the reply is blocked or dropped at some intermediate Layer 3 hop, pointing to a routing problem rather than a Layer 2 issue. Option A is wrong: ARP requests without replies point to a Layer 2 problem (e.g., unreachable destination or filtering), not a Layer 3 routing issue. Option C is wrong: ICMP echo requests without replies could have many causes (ACLs, firewalls, routing) – a switching loop would typically generate excessive broadcasts, not just missing replies. Option E is wrong: TCP SYN without SYN-ACK typically indicates a Layer 4 filtering or unreachable server issue, or possibly a Layer 3 routing problem, not a pure Layer 1 physical fault.

Answer

A packet capture that shows ARP requests with no ARP replies indicates a Layer 3 routing issue.

Answer

A packet capture that shows ICMP echo requests but no echo replies confirms a Layer 2 switching loop.

Answer

A packet capture that shows TCP SYN packets with no SYN-ACK replies indicates a Layer 1 physical issue.

Question 9

Drag and drop the following steps into the correct order to configure Root Guard on designated ports, Loop Guard on non-designated ports, and BPDU Guard on PortFast ports, and to recover a port that enters err-disabled due to a BPDU guard violation.

Accepted Answer

1. Configure Root Guard on designated ports. 2. Configure Loop Guard on non-designated ports. 3. Configure BPDU Guard on PortFast ports. 4. To recover a port that enters err-disabled due to BPDU Guard violation, manually shut and no shut the interface.. Root Guard on designated, Loop Guard on non-designated, then BPDU Guard on PortFast; recovery requires interface reset after violation.

Answer

1. Configure BPDU Guard on PortFast ports. 2. Configure Loop Guard on non-designated ports. 3. Configure Root Guard on designated ports. 4. To recover a port that enters err-disabled due to BPDU Guard violation, re-enable BPDU Guard on the port.

Answer

1. Configure Loop Guard on non-designated ports. 2. Configure Root Guard on designated ports. 3. Configure BPDU Guard on PortFast ports. 4. To recover a port that enters err-disabled due to BPDU Guard violation, configure errdisable recovery cause bpduguard.

Answer

1. Configure Root Guard on designated ports. 2. Configure BPDU Guard on PortFast ports. 3. Configure Loop Guard on non-designated ports. 4. To recover a port that enters err-disabled due to BPDU Guard violation, remove BPDU Guard from the port.

Question 10

Drag and drop the following steps into the correct order to configure Root Guard on designated ports, Loop Guard on non-designated ports, and BPDU Guard on PortFast ports, and then recover a port that enters err-disabled state.

Accepted Answer

1. Configure Root Guard on designated ports. 2. Configure Loop Guard on non-designated ports. 3. Configure BPDU Guard on PortFast ports. 4. Enable errdisable recovery globally. 5. Re-enable the err-disabled port manually.. Only option A correctly follows the sequence of configuring Root Guard on designated ports, Loop Guard on non-designated ports, BPDU Guard on PortFast ports, then enabling errdisable recovery globally, and finally manually re-enabling the port. Option B assigns Loop Guard to designated ports and Root Guard to non-designated ports, which is incorrect. Option C correctly assigns protections but starts with BPDU Guard, deviating from the specified order. Option D assigns Root Guard to non-designated ports and Loop Guard to designated ports, which is incorrect.

Answer

1. Configure Loop Guard on designated ports. 2. Configure Root Guard on non-designated ports. 3. Configure BPDU Guard on PortFast ports. 4. Re-enable the err-disabled port manually. 5. Enable errdisable recovery globally.

Answer

1. Configure BPDU Guard on PortFast ports. 2. Configure Root Guard on designated ports. 3. Configure Loop Guard on non-designated ports. 4. Re-enable the err-disabled port manually. 5. Enable errdisable recovery globally.

Answer

1. Configure Root Guard on non-designated ports. 2. Configure Loop Guard on designated ports. 3. Configure BPDU Guard on PortFast ports. 4. Enable errdisable recovery globally. 5. Re-enable the err-disabled port manually.

Question 11

Drag and drop the following steps into the correct order to configure Root Guard on a designated port, Loop Guard on a non-designated port, and BPDU Guard on a PortFast port, along with the recovery steps when a port enters err-disabled state.

Accepted Answer

1. Enter global configuration mode. 2. Configure Root Guard on the designated port. 3. Configure Loop Guard on the non-designated port. 4. Configure BPDU Guard on the PortFast-enabled port. 5. Configure errdisable recovery for BPDU Guard.. The order follows the logical sequence: enter config mode, then configure each guard feature on its respective port, and finally set the errdisable recovery to automatically re-enable ports after a BPDU Guard violation.

Answer

1. Enter global configuration mode. 2. Configure BPDU Guard on the PortFast-enabled port. 3. Configure Root Guard on the designated port. 4. Configure Loop Guard on the non-designated port. 5. Configure errdisable recovery for BPDU Guard.

Answer

1. Enter global configuration mode. 2. Configure Loop Guard on the non-designated port. 3. Configure Root Guard on the designated port. 4. Configure BPDU Guard on the PortFast-enabled port. 5. Configure errdisable recovery for BPDU Guard.

Answer

1. Enter global configuration mode. 2. Configure Root Guard on the designated port. 3. Configure BPDU Guard on the PortFast-enabled port. 4. Configure Loop Guard on the non-designated port. 5. Configure errdisable recovery for BPDU Guard.

Question 12

Drag and drop the following steps into the correct order to configure Root Guard on designated ports, Loop Guard on non-designated ports, and BPDU Guard on PortFast ports, and then recover a port that enters err-disabled due to BPDU Guard.

Accepted Answer

1. Configure Root Guard on designated ports. 2. Configure Loop Guard on non-designated ports. 3. Configure BPDU Guard on PortFast ports. 4. Recover a port in err-disabled state due to BPDU Guard by shutting it down and re-enabling it.. The correct order begins with Root Guard on designated ports to prevent them from becoming root ports upon receiving superior BPDUs. Next, Loop Guard is applied to non-designated ports (alternate/backup) to protect against unidirectional link failures. Then, BPDU Guard is placed on PortFast-enabled ports to shut them down if a BPDU is received, preventing rogue switch connections. Finally, recovery from BPDU Guard err-disable requires a manual interface reset (shutdown/no shutdown) because the errdisable cause 'bpduguard' has no automatic timeout.

Answer

1. Configure BPDU Guard on designated ports. 2. Configure Root Guard on non-designated ports. 3. Configure Loop Guard on PortFast ports. 4. Recover a port in err-disabled state by reloading the switch.

Answer

1. Configure Loop Guard on designated ports. 2. Configure BPDU Guard on non-designated ports. 3. Configure Root Guard on PortFast ports. 4. Recover a port in err-disabled state by waiting for the errdisable timeout.

Answer

1. Configure Root Guard on non-designated ports. 2. Configure Loop Guard on designated ports. 3. Configure BPDU Guard on all ports. 4. Recover a port in err-disabled state by removing BPDU Guard configuration.

Question 13

Which TWO statements correctly describe the configuration and effect of Root Guard and BPDU Guard on a Cisco switch?

Accepted Answer

Root Guard is configured on a per-port basis and causes the port to become root-inconsistent if a superior BPDU is received.. Root Guard is configured per interface using the 'spanning-tree guard root' command. When a port with Root Guard enabled receives a superior BPDU (one that would cause the switch to become a non-root bridge), the port is placed into a root-inconsistent state, effectively blocking traffic on that port and preventing the switch from accepting a new root bridge from that direction. This protects the spanning-tree topology from unauthorized or misconfigured switches attempting to become the root bridge. Option D is correct because BPDU Guard is commonly enabled on ports with PortFast (typically access ports connected to end devices). When a BPDU is received on such a port, BPDU Guard places the port into errdisable state, preventing potential bridging loops that could result from an unauthorized switch connecting to the network. Option B is incorrect because BPDU Guard does not prevent loops by disabling a trunk port; it is typically used on access ports (often with PortFast) and disables the port upon receiving any BPDU, not just on trunk ports. Option C is incorrect because Root Guard places the port into root-inconsistent state (not errdisable) when a superior BPDU is received; BPDU Guard uses errdisable. Option E is incorrect because neither Root Guard nor BPDU Guard filters BPDUs; Root Guard reacts to superior BPDUs by blocking the port, and BPDU Guard reacts to any BPDU by disabling the port. Both features allow BPDUs to be processed but then take action based on the received BPDUs.

Answer

BPDU Guard prevents loops by disabling a trunk port that receives a BPDU from an unauthorized switch.

Answer

Root Guard places a port in errdisable state when a superior BPDU is received.

Answer

Both Root Guard and BPDU Guard filter BPDUs to prevent them from being processed by the switch CPU.

Question 14

Drag and drop the following steps into the correct order to configure an LACP EtherChannel on Cisco IOS-XE switches.

Accepted Answer

Enter global configuration mode, create the port-channel interface, configure channel-group mode active on each physical interface, verify the configuration.. First, enter global config mode. Then create the port-channel interface. Next, configure the channel-group mode on each physical interface to active for LACP. Finally, verify the configuration.

Answer

Create the port-channel interface, enter global configuration mode, configure channel-group mode active on each physical interface, verify the configuration.

Answer

Enter global configuration mode, configure channel-group mode active on each physical interface, create the port-channel interface, verify the configuration.

Answer

Create the port-channel interface, configure channel-group mode active on each physical interface, enter global configuration mode, verify the configuration.

Question 15

Drag and drop the following steps into the correct order to configure an LACP EtherChannel on two Cisco switches using active mode.

Accepted Answer

Create the port-channel interface, configure its properties, then assign physical interfaces with channel-group active mode.. First create the logical port-channel interface and configure its properties, then assign physical interfaces to it using channel-group with active mode to initiate LACP negotiation.

Answer

Assign physical interfaces with channel-group active mode, then create the port-channel interface and configure its properties.

Answer

Configure physical interfaces with channel-group passive mode, then create the port-channel interface.

Answer

Create the port-channel interface, assign physical interfaces with channel-group desirable mode, then configure properties.