CCNA Switching and Network Access Practice Test 22 — 15 Questions

Question 1

You are connected to Multilayer Switch SW1. Configure LACP EtherChannel between SW1 and SW2 using ports GigabitEthernet0/1 and GigabitEthernet0/2. Ensure the channel is formed and active. The current configuration has mismatched VLAN assignments and speed/duplex settings preventing the channel from coming up. Verify the channel state using 'show etherchannel summary'.

Accepted Answer

Configure both Gi0/1 and Gi0/2 with speed 1000, duplex full, and switchport trunk allowed vlan 10,20,30.. The EtherChannel is down because the two member ports on SW1 have inconsistent configurations. GigabitEthernet0/1 is set to speed 1000 and duplex full with allowed VLANs 10,20, while GigabitEthernet0/2 is set to speed 100 and duplex half with allowed VLAN 30. LACP requires all member ports to have identical speed, duplex, and VLAN allowed lists. To fix, on SW1 configure both Gi0/1 and Gi0/2 with the same speed (1000), duplex (full), and trunk allowed VLANs (10,20,30). The Port-channel interface already has the correct allowed VLANs. After correction, 'show etherchannel summary' should show both ports as bundled (P).

Answer

Configure both Gi0/1 and Gi0/2 with speed 100, duplex half, and switchport trunk allowed vlan 30.

Answer

Configure both Gi0/1 and Gi0/2 with speed 1000, duplex full, and switchport trunk allowed vlan 10,20.

Answer

Configure both Gi0/1 and Gi0/2 with speed 1000, duplex full, and switchport mode access.

Question 2

You are connected to SW1. Configure LACP EtherChannel between SW1 and SW2 using interfaces GigabitEthernet0/1 and GigabitEthernet0/2. Ensure the channel forms and passes traffic for VLAN 10. Troubleshoot and fix any issues preventing the channel from coming up.

Accepted Answer

Configure speed 1000 and duplex full on Gi0/2, change port-channel 1 to switchport mode trunk with allowed vlan 10, and set both Gi0/1 and Gi0/2 to channel-group 1 mode active.. The EtherChannel is not forming because of multiple mismatches: speed (1000 vs 100), duplex (full vs half), and the port-channel interface is configured as Layer3 (no switchport) while the member ports are Layer2 (switchport mode trunk). First, correct the speed and duplex on Gi0/2 to match Gi0/1 (speed 1000, duplex full). Then change the port-channel to switchport mode trunk and set the allowed VLAN. Finally, change the LACP mode on both interfaces to 'active' to initiate negotiation. After these changes, the channel should come up.

Answer

Configure speed 1000 and duplex full on Gi0/2, change port-channel 1 to no switchport, and set both Gi0/1 and Gi0/2 to channel-group 1 mode passive.

Answer

Configure speed 100 and duplex half on Gi0/1 to match Gi0/2, change port-channel 1 to switchport mode trunk with allowed vlan 10, and set both Gi0/1 and Gi0/2 to channel-group 1 mode active.

Answer

Configure speed 1000 and duplex full on Gi0/2, change port-channel 1 to switchport mode access with access vlan 10, and set both Gi0/1 and Gi0/2 to channel-group 1 mode desirable.

Question 3

You are connected to SW1 via the console. SW1 is a Layer 2 switch connected to router R1 via trunk link G0/1. R1 performs inter-VLAN routing using subinterfaces. VLANs 10, 20, and 30 exist on SW1. Hosts in VLAN 10 (192.168.10.0/24) can ping R1's subinterface, but cannot communicate with hosts in VLAN 20. You suspect the trunk is not allowing VLAN 20 traffic.

Accepted Answer

Configure 'switchport trunk allowed vlan add 20' on SW1's G0/1 interface.. Trunks carry traffic for multiple VLANs. The 'switchport trunk allowed vlan' command restricts which VLANs are permitted. Initially, VLAN 20 was not in the allowed list, so traffic was dropped. Adding VLAN 20 to the allowed list resolves the issue.

Answer

Configure 'switchport mode access' on SW1's G0/1 interface.

Answer

Configure 'switchport trunk native vlan 20' on SW1's G0/1 interface.

Answer

Configure 'switchport trunk allowed vlan except 20' on SW1's G0/1 interface.

Question 4

You are connected to SW1, a Layer 2 switch. Port G0/1 connects to a PC in VLAN 10. Management requires that only one MAC address is allowed on this port, and if a violation occurs, the port should shut down and a log message should be generated. Additionally, you need to ensure that the port enables rapidly and does not wait for STP convergence. Currently, the PC has MAC address aaaa.bbbb.cccc.

Accepted Answer

switchport port-security; switchport port-security maximum 1; switchport port-security mac-address aaaa.bbbb.cccc; switchport port-security violation shutdown; spanning-tree portfast. Port security limits access to a port based on MAC addresses. The correct sequence must first enable port security with the `switchport port-security` command. Then setting maximum to 1 with a specific MAC ensures only that device can connect. Violation shutdown disables the port if an unauthorized MAC appears. PortFast allows the port to transition to forwarding immediately, which is appropriate for end-user devices. Options B and C use wrong violation modes (restrict or protect) that do not shut the port and may not log. Option D uses correct violation mode but omits PortFast, causing STP delays.

Answer

switchport port-security maximum 1; switchport port-security mac-address aaaa.bbbb.cccc; switchport port-security violation restrict; spanning-tree portfast

Answer

switchport port-security maximum 1; switchport port-security mac-address aaaa.bbbb.cccc; switchport port-security violation protect; spanning-tree portfast

Answer

switchport port-security maximum 1; switchport port-security mac-address aaaa.bbbb.cccc; switchport port-security violation shutdown; no spanning-tree portfast

Question 5

You are connected to SW1 via the console. SW1 is a multilayer switch with SVIs for VLANs 10 (192.168.10.1/24) and 20 (192.168.20.1/24). Hosts in VLAN 10 can ping their default gateway (192.168.10.1), but cannot ping hosts in VLAN 20. You suspect IP routing is not enabled or the SVIs are not up.

Accepted Answer

Enable IP routing on SW1 with the 'ip routing' global configuration command.. A multilayer switch requires 'ip routing' to forward packets between VLANs. Without it, the switch acts as a Layer 2 device. Enabling IP routing allows the SVIs to route traffic between VLANs. The verification commands confirm routing is active and SVIs are operational.

Answer

Configure a trunk port between SW1 and an external router, then enable routing on the router.

Answer

Ensure the SVIs are not shut down and have the 'no shutdown' command applied.

Answer

Add a static route on SW1 pointing to the VLAN 20 subnet via the VLAN 10 SVI.

Question 6

You are connected to SW1, a Layer 2 switch. The network administrator wants to prevent unauthorized switches from being connected to access ports. Port G0/1 is an access port in VLAN 10. You need to configure BPDU Guard on this port to protect against STP loops caused by rogue switches. Additionally, enable PortFast for immediate transition to forwarding.

Accepted Answer

SW1(config-if)# spanning-tree portfast
SW1(config-if)# spanning-tree bpduguard enable. PortFast allows an access port to skip STP listening/learning and transition immediately to forwarding. BPDU Guard protects against STP loops by error-disabling the port if a BPDU is received, which would indicate an unauthorized switch connection.

Answer

SW1(config)# spanning-tree portfast default
SW1(config)# spanning-tree bpduguard default

Answer

SW1(config-if)# spanning-tree portfast
SW1(config-if)# spanning-tree guard root

Answer

SW1(config-if)# spanning-tree portfast
SW1(config-if)# spanning-tree bpduguard disable

Question 7

You are connected to SW1 via console. SW1 is a Layer 2 switch connected to two other switches (SW2 and SW3) via trunk links. The network administrator wants to ensure that SW1 becomes the root bridge for VLAN 10 and VLAN 20. Currently, SW2 is the root for both VLANs. Configure SW1 to become the root bridge for these VLANs using the Cisco-recommended macro STP commands.

Accepted Answer

spanning-tree vlan 10 root primary; spanning-tree vlan 20 root primary. The 'spanning-tree vlan <vlan> root primary' command is the Cisco-recommended macro that sets the bridge priority to 24576, which is lower than the default 32768, making SW1 the root bridge for those VLANs. Option A correctly uses this macro. Option C, while it could achieve the same goal by setting priority to 4096, is not the macro command and would be considered a static configuration; the question specifically asks for the appropriate macro commands. Option B sets priority to 28672 as a secondary root, and Option D is invalid syntax.

Answer

spanning-tree vlan 10 root secondary; spanning-tree vlan 20 root secondary

Answer

spanning-tree vlan 10 priority 4096; spanning-tree vlan 20 priority 4096

Answer

spanning-tree vlan 10 root; spanning-tree vlan 20 root

Question 8

You are connected to SW1 via console. SW1 is a Layer 2 switch with two ports (G0/1 and G0/2) connected to a host. The host should be able to send and receive traffic on VLAN 10 and VLAN 20. Configure the two ports as a trunk link to the host, but ensure that the trunk only carries VLANs 10 and 20, and set the native VLAN to VLAN 99.

Accepted Answer

interface range gigabitethernet0/1-2
switchport mode trunk
switchport trunk allowed vlan 10,20
switchport trunk native vlan 99. Configuring the ports as trunks allows multiple VLANs. The 'allowed vlan' command restricts the trunk to only VLANs 10 and 20, while 'native vlan 99' sets the untagged VLAN to 99, ensuring proper tagging and avoiding VLAN mismatch.

Answer

interface range gigabitethernet0/1-2
switchport mode trunk
switchport trunk allowed vlan 10-20
switchport trunk native vlan 99

Answer

interface range gigabitethernet0/1-2
switchport mode trunk
switchport trunk allowed vlan 10,20
switchport native vlan 99

Answer

interface range gigabitethernet0/1-2
switchport mode trunk
switchport trunk allowed vlan 10,20
switchport trunk native vlan 1

Question 9

You are connected to SW1 via console. SW1 is a multilayer switch with SVIs for VLAN 10 (192.168.10.1/24) and VLAN 20 (192.168.20.1/24). Hosts in VLAN 10 and VLAN 20 need to communicate with each other. Currently, inter-VLAN routing is not working. You need to enable routing on SW1 and verify that the SVIs are operational.

Accepted Answer

Enable IP routing using the 'ip routing' global configuration command.. The 'ip routing' command enables Layer 3 routing on the multilayer switch, allowing SVIs to route between VLAN 10 and VLAN 20. Option B is unnecessary because directly connected SVIs do not require a routing protocol; routing protocols are only needed for routes learned from other routers, and 'ip routing' must still be enabled. Option C would require converting the physical interfaces to routed ports, which would break the existing Layer 2 VLAN topology and is not the intended solution. Option D provides an external router-on-a-stick solution but does not enable routing on SW1 itself, which is the required task. Therefore, only option A correctly enables inter-VLAN routing on SW1.

Answer

Configure a routing protocol such as OSPF or EIGRP on the SVIs.

Answer

Assign IP addresses to the physical interfaces connected to the hosts.

Answer

Create a trunk port and connect a router to perform router-on-a-stick.

Question 10

You are connected to SW1 via console. SW1 is a Layer 2 switch connected to SW2 via three links (G0/1, G0/2, G0/3) that should form an EtherChannel using LACP. Currently, the interfaces are configured as access ports in VLAN 1. Configure the three interfaces as a LACP EtherChannel trunk that carries VLANs 1-100, and ensure the port-channel interface is operational.

Accepted Answer

interface port-channel 1
 switchport mode trunk
 switchport trunk allowed vlan 1-100
interface range g0/1-3
 channel-group 1 mode active
 switchport mode trunk. The port-channel interface is created and configured as a trunk with allowed VLANs. Physical interfaces are assigned to the channel-group with LACP active mode, which negotiates the EtherChannel with the peer. The trunk is then operational for VLANs 1-100.

Answer

interface port-channel 1
 switchport mode trunk
 switchport trunk allowed vlan 1-100
interface range g0/1-3
 channel-group 1 mode passive
 switchport mode trunk

Answer

interface port-channel 1
 switchport mode access
 switchport access vlan 1
interface range g0/1-3
 channel-group 1 mode active
 switchport mode trunk

Answer

interface port-channel 1
 switchport mode trunk
 switchport trunk allowed vlan 1-100
interface range g0/1-3
 channel-group 1 mode on
 switchport mode trunk

Question 11

You are connected to SW1 via console. SW1 is a Layer 2 switch. Port G0/1 connects to a PC that should be allowed only one MAC address. Currently, the port is configured with default settings. You need to enable port security on G0/1, set the maximum MAC addresses to 1, configure the port to shut down if a violation occurs, and ensure that the first learned MAC address is sticky (i.e., saved to the running config).

Accepted Answer

interface G0/1
switchport port-security
switchport port-security maximum 1
switchport port-security violation shutdown
switchport port-security mac-address sticky. Enabling port security and setting maximum MAC addresses to 1 limits the port to one device. The violation shutdown mode disables the port if another MAC attempts to use it. Sticky MAC learning dynamically learns the first MAC and saves it to the running configuration.

Answer

interface G0/1
switchport port-security
switchport port-security maximum 1
switchport port-security violation protect
switchport port-security mac-address sticky

Answer

interface G0/1
switchport port-security
switchport port-security maximum 2
switchport port-security violation shutdown
switchport port-security mac-address sticky

Answer

interface G0/1
switchport port-security
switchport port-security maximum 1
switchport port-security violation shutdown
switchport port-security mac-address 0000.1111.2222

Question 12

You are connected to SW1 via the console. SW1 is a Layer 2 switch. Ports G0/1 and G0/2 are connected to two PCs that should be in VLAN 10 (Sales). Port G0/3 is a trunk link to another switch. The PCs are currently unable to communicate because the ports are in VLAN 1. Configure the switch to place the ports in the correct VLAN and ensure the trunk is properly configured with 802.1Q encapsulation and native VLAN 99.

Accepted Answer

Create VLAN 10, assign G0/1 and G0/2 as access ports in VLAN 10, configure G0/3 as trunk with encapsulation dot1q and native VLAN 99.. VLAN 10 must be created and the access ports must be explicitly set to access mode with 'switchport mode access' before assigning them to VLAN 10. Assigning the access ports to VLAN 10 places the PCs in the correct broadcast domain. The trunk needed explicit 802.1Q encapsulation and a native VLAN change to 99 for security and consistency.

Answer

Create VLAN 10, assign G0/1 and G0/2 as access ports in VLAN 10, configure G0/3 as trunk with encapsulation isl and native VLAN 99.

Answer

Create VLAN 10, assign G0/1 and G0/2 as trunk ports in VLAN 10, configure G0/3 as trunk with encapsulation dot1q and native VLAN 99.

Answer

Create VLAN 10, assign G0/1 and G0/2 as access ports in VLAN 10, configure G0/3 as trunk with encapsulation dot1q and native VLAN 1.

Question 13

You are connected to SW1 via the console. SW1 is a Layer 2 switch with two VLANs: VLAN 10 (Sales) and VLAN 20 (Engineering). A router R1 is connected to port G0/1 on SW1 for inter-VLAN routing. Currently, the router is not routing between VLANs because the trunk is not configured correctly. Configure the switch port as a trunk and ensure the router can route between VLANs using subinterfaces (Router-on-a-Stick).

Accepted Answer

Configure the switch port as a trunk with 802.1Q encapsulation and allow VLANs 10 and 20.. The switch port was in access mode, which only carries one VLAN. Changing it to trunk with 802.1Q encapsulation allows multiple VLANs to traverse to the router. The allowed VLAN list restricts to VLANs 10 and 20 for security.

Answer

Configure the switch port as an access port in VLAN 10 and add VLAN 20 as a secondary VLAN.

Answer

Configure the switch port as a trunk with ISL encapsulation and allow all VLANs.

Answer

Configure the switch port as a trunk with 802.1Q encapsulation and allow VLANs 1, 10, and 20.

Question 14

You are connected to SW1 via the console. SW1 is a Layer 2 switch with two links to SW2 configured as an EtherChannel using LACP. The EtherChannel is not coming up. Interface G0/2 was accidentally configured as an access port in VLAN 10, while G0/1 is configured as a trunk. The administrator wants to use LACP to bundle the links. Troubleshoot and fix the configuration to bring up the EtherChannel.

Accepted Answer

Change interface G0/2 to trunk mode and ensure both interfaces have the same allowed VLAN list.. The EtherChannel was down because interface G0/2 was an access port in VLAN 10, while G0/1 was a trunk. For LACP to bundle the links, all member interfaces must have the same configuration, including VLAN and trunk settings. Changing G0/2 to trunk mode resolved the issue.

Answer

Change interface G0/1 to access VLAN 10 to match G0/2.

Answer

Remove the access VLAN configuration from G0/2 and leave it as a default switchport (dynamic desirable).

Answer

Change the EtherChannel mode from LACP to PAgP on both switches.

Question 15

You are connected to SW1 via the console. SW1 is a Layer 2 switch with two VLANs: VLAN 10 (Sales) and VLAN 20 (Engineering). Port G0/1 is connected to a sales PC, and port G0/2 is connected to an engineering PC. You need to ensure that each PC is in the correct VLAN. However, the sales PC is currently unable to ping the engineering PC because they are in different VLANs. You have a router R1 connected to SW1 via port G0/3. Configure inter-VLAN routing using Router-on-a-Stick on R1, and ensure SW1's port G0/3 is properly configured as a trunk.

Accepted Answer

Configure subinterfaces on R1 with encapsulation dot1Q and assign IP addresses in VLAN 10 and VLAN 20. Configure SW1 interface G0/3 as a trunk port.. Router-on-a-Stick allows a single router interface to route between VLANs by using subinterfaces with 802.1Q encapsulation. The switch port must be a trunk to carry the tagged frames. This configuration enables communication between VLAN 10 and VLAN 20.

Answer

Configure a routed port on SW1 G0/3 and assign an IP address. Then configure static routes on R1 to reach each VLAN.

Answer

Configure SW1 interface G0/3 as an access port in VLAN 10. Then configure R1 with a single IP address in VLAN 10 and enable proxy ARP.

Answer

Configure SW1 interface G0/3 as a trunk port. Then configure R1 with a single IP address on the physical interface and enable VLAN routing using the 'vlan' command.