CCNA Switching and Network Access Practice Test 21 — 15 Questions

Question 1

You are connected to R1, a multilayer switch acting as the STP root for VLAN 10. Configure Root Guard on the designated port facing a downstream switch to prevent a rogue switch from becoming root. Also, enable Loop Guard on the uplink port to prevent STP loops, and configure BPDU Guard on a PortFast-enabled access port. Ensure that if a superior BPDU is received on the Root Guard port, it is blocked, and if a BPDU is received on the BPDU Guard port, it goes err-disabled.

Accepted Answer

The configuration is correct; no changes are needed.. R1 is the STP root for VLAN 10. The downstream port (G0/1) is a designated port, so Root Guard is correctly applied to prevent a superior BPDU from being accepted. The uplink port (G0/0) is a root port, so Loop Guard should be applied there to prevent an STP loop if BPDUs stop arriving. The access port (G0/2) has PortFast and BPDU Guard enabled, which will err-disable the port if a BPDU is received. The current configuration is correct; no changes are needed. If a superior BPDU arrives on G0/1, Root Guard will block the port. If a BPDU arrives on G0/2, BPDU Guard will err-disable it.

Answer

Root Guard should be applied on G0/0 instead of G0/1, and Loop Guard on G0/1 instead of G0/0.

Answer

BPDU Guard should be configured on G0/1 instead of G0/2, and Loop Guard should be removed from G0/0.

Answer

Root Guard should be applied on G0/2 instead of G0/1, and BPDU Guard should be removed from G0/2.

Question 2

You are connected to a multilayer switch MLS1. Configure Root Guard on switchport GigabitEthernet 0/1 (connected to an unauthorized switch) so that if a superior BPDU is received, the port is blocked instead of causing a topology change. Also enable Loop Guard on uplink GigabitEthernet 0/2 (connected to the root bridge) to prevent unidirectional link issues. Finally, enable BPDU Guard on PortFast-enabled access port GigabitEthernet 0/3 (connected to a host) so that if a BPDU is received, the port goes err-disabled. After configuration, a superior BPDU is received on G0/1 and the port is blocked; a BPDU is received on G0/3 and the port goes err-disabled. Verify these protections are active.

Accepted Answer

Root Guard on G0/1, Loop Guard on G0/2, BPDU Guard on G0/3. Root Guard was correctly configured on G0/1, so when a superior BPDU arrived, the port entered root-inconsistent state instead of becoming root port. Loop Guard on G0/2 prevents alternate port from becoming root if BPDUs stop. BPDU Guard on G0/3 correctly triggered err-disable upon receiving a BPDU on a PortFast port. To restore G0/3, use 'shutdown' then 'no shutdown' after removing the BPDU source. Verification commands confirm the protections are working.

Answer

Root Guard on G0/1, UplinkFast on G0/2, BPDU Guard on G0/3

Answer

BPDU Guard on G0/1, Loop Guard on G0/2, Root Guard on G0/3

Answer

Root Guard on G0/1, Loop Guard on G0/2, PortFast on G0/3

Question 3

You are connected to R1, a multilayer switch acting as the STP root for VLAN 10. Configure Root Guard on port GigabitEthernet0/1 (designated port) to protect against superior BPDUs from an unauthorized switch, Loop Guard on uplink GigabitEthernet0/2 to prevent forwarding loops on unidirectional links, and BPDU Guard on PortFast-enabled GigabitEthernet0/3 to shut down the port if a BPDU is received. After configuration, troubleshoot the scenario: a superior BPDU is received on G0/1, causing it to be blocked by Root Guard, and an unauthorized switch sends a BPDU to G0/3, placing it in err-disable state. Verify the final configuration and state.

Accepted Answer

[CORRECT] Root Guard on G0/1 is correctly configured; when a superior BPDU is received, the port is placed into a root-inconsistent state (BKN* in show spanning-tree) to prevent the switch from becoming root. Loop Guard on G0/2 prevents loops if BPDUs stop arriving due to a unidirectional link. BPDU Guard on G0/3, combined with PortFast, err-disables the port upon receiving any BPDU, as shown by the err-disabled status. To recover, the administrator must manually re-enable the interface after removing the offending device. No additional configuration is required; the existing commands are correct and produce the expected behavior.. The scenario demonstrates three STP protection mechanisms. Root Guard on G0/1 is correctly configured; when a superior BPDU is received, the port is placed into a root-inconsistent state (BKN* in show spanning-tree) to prevent the switch from becoming root. Loop Guard on G0/2 prevents loops if BPDUs stop arriving due to a unidirectional link. BPDU Guard on G0/3, combined with PortFast, err-disables the port upon receiving any BPDU, as shown by the err-disabled status. To recover, the administrator must manually re-enable the interface after removing the offending device. No additional configuration is required; the existing commands are correct and produce the expected behavior.

Answer

Root Guard on G0/1 is incorrectly configured; it should be configured on the root port, not the designated port. Loop Guard on G0/2 is correctly configured. BPDU Guard on G0/3 is correctly configured, but the port should automatically recover from err-disable state after a timeout.

Answer

Root Guard on G0/1 is correctly configured. Loop Guard on G0/2 is incorrectly configured because Loop Guard should be applied to root ports, not uplink ports. BPDU Guard on G0/3 is correctly configured, but the port should be in a blocking state, not err-disabled.

Answer

Root Guard on G0/1 is correctly configured. Loop Guard on G0/2 is correctly configured. BPDU Guard on G0/3 is incorrectly configured because BPDU Guard should be applied to trunk ports, not access ports, and the port should be placed in a root-inconsistent state.

Question 4

You are connected to the multilayer switch SW1. Configure Root Guard on the designated port towards the access switch SW2, Loop Guard on the uplink port towards the distribution switch SW3, and BPDU Guard on the PortFast-enabled port connected to a workstation. After configuration, a superior BPDU is received on the designated port, causing it to be blocked by Root Guard. Later, a BPDU is received on the PortFast port, triggering err-disable state. Identify and resolve these issues.

Accepted Answer

Remove Root Guard from interface Gi0/0 and re-enable interface Gi0/2 with a shutdown/no shutdown sequence.. The issue is that Root Guard was incorrectly applied to the designated port (Gi0/0) which should normally be the root port if a superior BPDU is received. Root Guard blocks the port when a superior BPDU arrives, but this is expected on a designated port; instead, Root Guard should be applied to ports that should never become root ports. In this scenario, the superior BPDU is legitimate (from a root bridge with lower priority), so Root Guard should be removed from Gi0/0. For the PortFast port (Gi0/2), BPDU Guard correctly err-disabled the port upon receiving a BPDU, indicating an unauthorized switch connection. To restore the port, you must shut/no shut the interface and then investigate why a BPDU was received. The solution involves removing Root Guard from Gi0/0 and re-enabling Gi0/2 after verifying the connecting device.

Answer

Disable BPDU Guard on interface Gi0/2 and increase the root bridge priority on SW1 to prevent superior BPDUs.

Answer

Apply Root Guard to interface Gi0/2 instead of Gi0/0 and configure Loop Guard on Gi0/0.

Answer

Remove Loop Guard from interface Gi0/1 and configure it on Gi0/0 instead, then re-enable Gi0/2 using the 'errdisable recovery cause bpduguard' command.

Question 5

You are securing the spanning-tree topology on R1, the root bridge for VLAN 10. Intended configurations: Root Guard on GigabitEthernet1/0/3, Loop Guard on gigabit interfaces 1/0/1 and 1/0/2, and BPDU Guard on all PortFast-enabled interfaces. After initial configuration, a superior BPDU on G1/0/3 blocks the port (expected), and a host on G1/0/5 triggers BPDU Guard, causing err-disable (expected). However, you realize Loop Guard was not applied to the uplinks. Troubleshoot and apply the missing configuration.

Accepted Answer

Configure Loop Guard on G1/0/1 and G1/0/2 with 'spanning-tree guard loop' and recover G1/0/5 from err-disable by issuing 'shutdown' followed by 'no shutdown'.. The candidate must first identify that Root Guard is correctly configured on G1/0/3, causing it to block (BKN*ROOT_Guard) upon receiving a superior BPDU, which is correct behavior. However, the task states to protect the root bridge role; since R1 is already root, Root Guard is appropriate. The err-disabled port G1/0/5 indicates BPDU Guard triggered; this is expected because a host connected to a PortFast port sent a BPDU. To resolve, the candidate should re-enable the port with 'no shutdown' and ensure BPDU Guard is properly applied. Additionally, Loop Guard is missing on uplinks G1/0/1 and G1/0/2; it must be configured with 'spanning-tree guard loop' under each interface. No changes to Root Guard are needed; the blockage is intentional.

Answer

Remove Root Guard from G1/0/3 and configure it with 'spanning-tree guard loop' to prevent the blockage.

Answer

Re-enable G1/0/5 with 'no shutdown' and apply 'spanning-tree bpduguard enable' on all PortFast-enabled interfaces to prevent future err-disable.

Answer

Remove BPDU Guard from all PortFast interfaces and configure 'spanning-tree portfast bpdufilter default' to prevent err-disable.

Question 6

You are connected to a multilayer switch MLS1. Configure Root Guard on the designated port facing another switch SW2 to prevent it from becoming root, configure Loop Guard on the uplink port to the core, and configure BPDU Guard on a PortFast-enabled access port. After configuration, a superior BPDU arrives on the designated port—confirm it is blocked by Root Guard. Then, simulate a BPDU on the access port to verify it goes err-disabled due to BPDU Guard.

Accepted Answer

Root Guard on Gi0/2, Loop Guard on Gi0/1, BPDU Guard on Gi0/0. First, Root Guard was applied on Gi0/2 (the designated port) with 'spanning-tree guard root' to prevent SW2 from becoming root. Second, Loop Guard was applied on the uplink Gi0/1 with 'spanning-tree guard loop' to protect against unidirectional links. Third, BPDU Guard was applied on the PortFast-enabled access port Gi0/0 with 'spanning-tree bpduguard enable'. When a superior BPDU arrives on Gi0/2, Root Guard transitions it to a root-inconsistent (blocked) state. If a BPDU is received on Gi0/0, BPDU Guard err-disables the port. Verification shows the blocked state on Gi0/2 and err-disabled on Gi0/0.

Answer

Root Guard on Gi0/1, Loop Guard on Gi0/2, BPDU Guard on Gi0/0

Answer

Root Guard on Gi0/0, Loop Guard on Gi0/1, BPDU Guard on Gi0/2

Answer

Root Guard on Gi0/2, Loop Guard on Gi0/0, BPDU Guard on Gi0/1

Question 7

You are connected to SW1. Two switches, SW1 and SW2, are connected via four GigabitEthernet links. Configure LACP EtherChannel between them using interfaces GigabitEthernet0/1 through GigabitEthernet0/4 on SW1. Set the channel-group mode to active on SW1. The port-channel interface must be configured as a trunk, allowing VLANs 10, 20, 30. However, the EtherChannel is not forming. The current configuration is shown below. Identify and fix the issue, then verify the EtherChannel is operational.

Accepted Answer

Remove 'no switchport' and IP address from Port-channel1, then configure 'switchport mode trunk' and 'switchport trunk allowed vlan 10,20,30'.. The EtherChannel is not forming because the Port-channel1 interface is configured as a Layer 3 interface (no switchport, IP address), while the member interfaces are Layer 2 switchports (switchport mode trunk). This mismatch prevents the channel from bundling. To fix this, configure Port-channel1 as a Layer 2 trunk interface with the same allowed VLANs. The solution: remove the no switchport command and the IP address, then apply switchport mode trunk and switchport trunk allowed vlan 10,20,30. After correction, the ports should bundle and the show etherchannel summary will show the ports as bundled (P) and the port-channel as Layer 2 (S).

Answer

Change the channel-group mode on the member interfaces from active to passive.

Answer

Add the 'switchport nonegotiate' command to the member interfaces.

Answer

Configure the member interfaces with 'channel-group 1 mode on' instead of active.

Question 8

You are connected to SW1. Configure an LACP EtherChannel between SW1 and SW2 using ports GigabitEthernet0/1 and GigabitEthernet0/2. Set the channel-group mode to active on both sides. The port-channel interface should be configured as a trunk allowing VLANs 10, 20, and 30. Initially, the EtherChannel fails to form due to mismatched speed/duplex on one link. Identify and correct the issue, then verify the channel is up and operational.

Accepted Answer

Change speed and duplex on Gi0/2 to 1000 and full, then verify with 'show etherchannel summary'.. The EtherChannel fails because GigabitEthernet0/2 has speed 100 and duplex half, while GigabitEthernet0/1 has speed 1000 and duplex full. LACP requires all member ports to have identical speed and duplex settings. To resolve, change the speed and duplex on Gi0/2 to match Gi0/1: 'speed 1000' and 'duplex full'. After correction, the channel will bundle. Verify with 'show etherchannel summary' to see both ports in the 'P' (bundled) state.

Answer

Change the channel-group mode on Gi0/2 to passive, then verify with 'show etherchannel summary'.

Answer

Change the allowed VLANs on the port-channel to include only VLAN 1, then verify with 'show etherchannel summary'.

Answer

Change the port-channel interface to access mode, then verify with 'show etherchannel summary'.

Question 9

You are connected to Switch1. Configure an LACP EtherChannel between Switch1 and Switch2 using interfaces GigabitEthernet0/1 and GigabitEthernet0/2. The channel must be in active mode on both sides, and the port-channel interface must have VLAN 10 as the access VLAN. The current configuration has a speed/duplex mismatch and inconsistent VLAN assignments preventing the channel from forming. Verify the channel is up using 'show etherchannel summary'.

Accepted Answer

Set speed auto on Gi0/1 and Gi0/2, set duplex auto on both, change access VLAN on Gi0/2 to 10, change access VLAN on Port-channel1 to 10, and set channel-group mode active on both interfaces.. The EtherChannel is not forming due to three issues: (1) Speed mismatch: Gi0/1 is set to 100 Mbps while Gi0/2 is 1000 Mbps; both must match (e.g., auto). (2) Duplex mismatch: Gi0/1 is half-duplex, Gi0/2 is full-duplex; both must be the same (e.g., full). (3) VLAN mismatch: Gi0/1 is in VLAN 10, Gi0/2 in VLAN 20, and Port-channel1 is in VLAN 1; all access VLANs must be consistent (set to VLAN 10). Additionally, the channel-group mode should be 'active' on both interfaces for LACP. The solution involves setting speed and duplex to auto, changing the access VLAN on Gi0/2 and the port-channel to VLAN 10, and setting channel-group mode to active.

Answer

Set speed 1000 on Gi0/1, set duplex full on Gi0/1, change access VLAN on Gi0/1 to 20, change access VLAN on Port-channel1 to 20, and set channel-group mode passive on both interfaces.

Answer

Set speed 100 on Gi0/2, set duplex half on Gi0/2, change access VLAN on Gi0/1 to 20, change access VLAN on Port-channel1 to 20, and set channel-group mode desirable on both interfaces.

Answer

Set speed auto on Gi0/1 and Gi0/2, set duplex auto on both, change access VLAN on Gi0/1 to 10, change access VLAN on Port-channel1 to 10, and set channel-group mode active on Gi0/1 and passive on Gi0/2.

Question 10

You are connected to SW1. Configure an LACP EtherChannel between SW1 and SW2 using interfaces GigabitEthernet0/1 and GigabitEthernet0/2. The port-channel interface must be configured as a trunk allowing VLANs 10, 20, and 30. Currently, the channel is not forming due to a mismatch in speed/duplex and VLAN configuration on SW2. Troubleshoot and resolve the issue so that the EtherChannel comes up as a Layer 2 trunk.

Accepted Answer

On SW2, configure interfaces GigabitEthernet0/1 and 0/2 with speed 1000, duplex full, and on the port-channel interface, set allowed VLANs to 10,20,30.. The EtherChannel is not forming because SW2's interfaces have speed 100 and duplex half, while SW1's interfaces have speed 1000 and duplex full. Additionally, the allowed VLANs on SW2's trunk must include VLAN 30, and this should be configured on the port-channel interface, not the physical interfaces. To fix, on SW2, set the speed to 1000 and duplex to full on Gi0/1 and Gi0/2, then on the port-channel interface, configure allowed VLANs 10,20,30. After these changes, the channel will come up as a Layer 2 trunk.

Answer

On SW2, configure interfaces GigabitEthernet0/1 and 0/2 with speed 100, duplex half, and on the port-channel interface, set allowed VLANs to 10,20,30.

Answer

On SW2, configure interfaces GigabitEthernet0/1 and 0/2 with speed 1000, duplex full, and on the port-channel interface, set allowed VLANs to 10,20.

Answer

On SW2, configure interfaces GigabitEthernet0/1 and 0/2 with speed 1000, duplex full, and on the port-channel interface, set allowed VLANs to 1-4094.

Question 11

You are connected to SW1. The current configurations of interfaces GigabitEthernet0/1 and GigabitEthernet0/2 are as follows:

Gi0/1: speed 100, duplex half, switchport access vlan 10
Gi0/2: speed 1000, duplex full, switchport access vlan 20

The port-channel interface 1 does not exist. Configure a LACP EtherChannel between SW1 and SW2 using these two interfaces, with port-channel 1 and mode active on both sides. Ensure the channel forms by resolving any speed/duplex or VLAN mismatches. After configuration, verify with 'show etherchannel summary'.

Accepted Answer

The EtherChannel will not form because the physical interfaces have mismatched speed/duplex and VLAN assignments. You must configure both interfaces with the same speed (1000), duplex (full), and access VLAN (10), then apply channel-group 1 mode active on each.. The EtherChannel fails because member interfaces have mismatched speed/duplex (Gi0/1 is 100/half, Gi0/2 is 1000/full) and different VLANs (VLAN 10 vs 20). Additionally, the port-channel interface and physical interfaces must have matching VLAN assignments. To fix, unify both physical interfaces to the same speed (1000), duplex (full), and access VLAN (10). Then set channel-group mode active on each physical interface. Finally, ensure the port-channel interface also uses VLAN 10. Verify with 'show etherchannel summary' which should show the port-channel as SU (in use).

Answer

The EtherChannel will form successfully because LACP active mode negotiates the channel regardless of speed/duplex or VLAN differences.

Answer

The EtherChannel will not form because the port-channel interface must be configured with the same VLAN as the physical interfaces, but the physical interfaces can have different speeds.

Answer

The EtherChannel will form successfully because the port-channel interface inherits the VLAN from the first physical interface added, so no additional configuration is needed.

Question 12

You are connected to SW1. A LACP EtherChannel between SW1 and SW2 has already been configured using interfaces GigabitEthernet0/1 and GigabitEthernet0/2 with channel-group 1 mode active on both sides and assigned to VLAN 100. However, the channel is not forming because of a speed/duplex mismatch. The correct interface settings for this network are speed 1000 and duplex full. Interface GigabitEthernet0/1 is already configured with these settings. Only interface GigabitEthernet0/2 needs to be corrected. Identify the configuration change needed to resolve the mismatch and verify the EtherChannel is up with 'show etherchannel summary'.

Accepted Answer

Configure interface GigabitEthernet0/2 with 'speed 1000' and 'duplex full', then verify the EtherChannel is up.. The EtherChannel is not forming because GigabitEthernet0/2 is configured with speed 100 and duplex half, while GigabitEthernet0/1 is speed 1000 and duplex full. LACP requires all member ports to have identical speed and duplex settings. To fix this, configure GigabitEthernet0/2 with speed 1000 and duplex full, matching GigabitEthernet0/1. After correction, the ports should bundle in Port-channel1 and show as bundled (P) in 'show etherchannel summary'.

Answer

Configure interface GigabitEthernet0/1 with 'speed 100' and 'duplex half', then verify the EtherChannel is up.

Answer

Configure interface GigabitEthernet0/2 with 'speed auto' and 'duplex auto', then verify the EtherChannel is up.

Answer

Configure interface GigabitEthernet0/2 with 'channel-group 1 mode active' and 'switchport access vlan 100', then verify the EtherChannel is up.

Question 13

You are connected to SW1. Configure an LACP EtherChannel between SW1 and SW2 using interfaces GigabitEthernet0/1 and GigabitEthernet0/2. Set the channel-group mode to active on both switches. Verify that the port-channel interface is configured with VLAN 100 as an access port. Then, troubleshoot and fix the issue that prevents the EtherChannel from forming due to a mismatched speed on one of the member links. After correction, verify the EtherChannel is up with 'show etherchannel summary'.

Accepted Answer

Set speed 1000 and duplex full on interface GigabitEthernet0/2 of SW1, ensuring the corresponding interface on SW2 has matching settings, then verify with 'show etherchannel summary'.. The EtherChannel fails because interface GigabitEthernet0/2 on SW1 has a mismatched speed (likely 100 Mbps) compared to the other member link (1000 Mbps). LACP requires all member ports to have identical speed and duplex. The solution is to set the speed on Gi0/2 to 1000 and duplex to full. After correction, the port will bundle, and the port-channel will come up. Verification with 'show etherchannel summary' should show both ports as 'P' (bundled) and the port-channel as 'SU' (in use, Layer2).

Answer

Change the channel-group mode to desirable on both switches and verify with 'show etherchannel summary'.

Answer

Remove the access VLAN configuration from the port-channel interface and configure it as a trunk port instead.

Answer

Configure the channel-group mode to passive on SW1 and active on SW2, then verify with 'show etherchannel summary'.

Question 14

You are connected to SW1. An EtherChannel between SW1 and SW2 using LACP must be established on interfaces GigabitEthernet0/1 and GigabitEthernet0/2. Currently, the channel is not forming. Inspect the provided configuration and output, then apply the necessary commands on SW1 to resolve the issue and bring up the Port-Channel interface.

Accepted Answer

Configure both interfaces with speed 1000, duplex full, and switchport access vlan 1.. The EtherChannel failed because the two member interfaces on SW1 have mismatched speed (Gi0/1: 1000 Mbps, Gi0/2: 100 Mbps) and duplex (Gi0/1: full, Gi0/2: half), and their native VLANs differ (Gi0/1: VLAN 1, Gi0/2: VLAN 10). LACP requires all bundled ports to have identical speed, duplex, and VLAN configuration. To fix, on SW1 configure both interfaces with consistent settings: set speed 1000, duplex full, and switchport access vlan 1 (or a common trunk native VLAN). Also ensure both sides use the same LACP mode (both active or active/passive); here SW2's Gi0/2 is passive, which is acceptable with SW1's active, so the primary issue is the mismatched physical and VLAN parameters. After correction, the channel will form.

Answer

Change the LACP mode on SW1's Gi0/2 from active to passive.

Answer

Configure both interfaces with speed 100, duplex half, and switchport access vlan 10.

Answer

Remove the switchport access vlan command from both interfaces and configure them as trunk ports with native vlan 1.

Question 15

You are connected to SW1. The current configuration on SW1 is: interfaces GigabitEthernet0/1 and GigabitEthernet0/2 are set to channel-group mode passive; Gi0/1 has speed 100, duplex half, and access VLAN 20; Gi0/2 has speed 1000, duplex full, and access VLAN 10. You need to form an LACP EtherChannel between SW1 and SW2. Ensure the channel forms by setting the channel-group mode to active on SW1's member ports. Also correct the speed/duplex mismatch and VLAN mismatch so that the port-channel interface is in the up/up state. Finally, verify the EtherChannel summary shows the channel as a Layer 2 bundle in use.

Accepted Answer

Change channel-group mode to active on both ports, set speed 1000 and duplex full on Gi0/1, set access VLAN 10 on Gi0/2.. The EtherChannel fails because both member ports are set to mode passive, preventing LACP negotiation. Additionally, Gi0/1 has speed 100/duplex half while Gi0/2 has speed 1000/duplex full—a mismatch that causes one port to be suspended. Finally, the VLANs differ (10 vs 20), which also prevents bundling. The solution: change the channel-group mode to active on both ports, set consistent speed (1000) and duplex (full) on Gi0/1, and set the same access VLAN (10) on Gi0/2. After these corrections, the port-channel should form and show as (SU) in the summary.

Answer

Change channel-group mode to passive on both ports, set speed 100 and duplex half on Gi0/2, set access VLAN 20 on Gi0/1.

Answer

Change channel-group mode to desirable on both ports, set speed 1000 and duplex full on Gi0/1, set access VLAN 10 on Gi0/2.

Answer

Change channel-group mode to active on both ports, set speed 100 and duplex half on Gi0/1, set access VLAN 20 on Gi0/2.

CCNA Switching and Network Access Practice Test 21 — 15 Questions

Exhibit

CCNA Switching and Network Access Practice Test 21 — 15 Questions

Exhibit