CCNA Switching and Network Access Practice Test 23 — 15 Questions

Question 1

You are connected to SW1 via the console. SW1 is a Layer 2 switch with two redundant links to SW2 (G0/1 and G0/2). The network administrator wants to use both links for load balancing and redundancy by configuring EtherChannel. You need to configure a Layer 2 EtherChannel using LACP on both switches. The port-channel should be in VLAN 1.

Accepted Answer

interface port-channel 1
switchport mode access
switchport access vlan 1
interface range GigabitEthernet0/1-2
channel-group 1 mode active. EtherChannel bundles multiple physical links into a single logical link for load balancing and redundancy. LACP (mode active) negotiates the bundle automatically. The port-channel interface must be configured with the desired switchport settings.

Answer

interface port-channel 1
switchport mode trunk
switchport trunk allowed vlan 1
interface range g0/1-2
channel-group 1 mode desirable

Answer

interface port-channel 1
switchport mode access
switchport access vlan 1
interface range g0/1-2
channel-group 1 mode passive

Answer

interface port-channel 1
switchport mode access
switchport access vlan 1
interface g0/1
channel-group 1 mode active
interface g0/2
channel-group 2 mode active

Question 2

You are connected to SW1 via the console. SW1 is a Layer 2 switch connected to multiple PCs. The network administrator wants to implement port security on port G0/1 to allow only one MAC address and to shut down the port if a violation occurs. Additionally, the administrator wants the MAC address to be learned dynamically and added to the running configuration as sticky. Configure port security on G0/1 accordingly.

Accepted Answer

SW1(config)# interface G0/1
SW1(config-if)# switchport port-security
SW1(config-if)# switchport port-security maximum 1
SW1(config-if)# switchport port-security mac-address sticky
SW1(config-if)# switchport port-security violation shutdown. Port security restricts access by limiting MAC addresses. With sticky learning, the first dynamically learned MAC is saved to the config. If another MAC attempts to connect, the port shuts down, preventing unauthorized access.

Answer

SW1(config)# interface G0/1
SW1(config-if)# switchport port-security
SW1(config-if)# switchport port-security maximum 1
SW1(config-if)# switchport port-security mac-address sticky
SW1(config-if)# switchport port-security violation protect

Answer

SW1(config)# interface G0/1
SW1(config-if)# switchport port-security
SW1(config-if)# switchport port-security maximum 1
SW1(config-if)# switchport port-security mac-address 0000.1111.2222
SW1(config-if)# switchport port-security violation shutdown

Answer

SW1(config)# interface G0/1
SW1(config-if)# switchport port-security
SW1(config-if)# switchport port-security maximum 1
SW1(config-if)# switchport port-security mac-address sticky
SW1(config-if)# switchport port-security violation restrict

Question 3

You are connected to SW1 via the console. SW1 is a Layer 2 switch with an access port G0/1 connected to a server. The network administrator has noticed that the server is sending BPDUs, which could cause network instability. You need to configure PortFast and BPDU Guard on port G0/1 to prevent BPDU-related issues and ensure the port transitions to forwarding state immediately.

Accepted Answer

interface G0/1
spanning-tree portfast
spanning-tree bpduguard enable. PortFast allows an access port to bypass STP listening/learning states, providing immediate connectivity. BPDU Guard protects the network by shutting down the port if a BPDU is received, preventing potential loops from unauthorized switches.

Answer

interface G0/1
spanning-tree portfast
spanning-tree guard root

Answer

interface G0/1
spanning-tree portfast
spanning-tree bpdufilter enable

Answer

interface G0/1
spanning-tree portfast
spanning-tree bpduguard default

Question 4

You are connected to SW1 via the console. SW1 is a Layer 2 switch. Port GigabitEthernet0/1 connects to a PC in VLAN 10, and port GigabitEthernet0/2 connects to a server in VLAN 20. Both ports are currently in VLAN 1. Configure SW1 to assign GigabitEthernet0/1 to VLAN 10 and GigabitEthernet0/2 to VLAN 20, and verify the configuration.

Accepted Answer

interface GigabitEthernet0/1
switchport mode access
switchport access vlan 10
interface GigabitEthernet0/2
switchport mode access
switchport access vlan 20
end
show vlan brief. Access ports carry traffic for a single VLAN. By assigning G0/1 to VLAN 10 and G0/2 to VLAN 20, the PC and server are placed in their respective VLANs.

Answer

interface GigabitEthernet0/1
switchport mode trunk
switchport trunk allowed vlan 10
interface GigabitEthernet0/2
switchport mode trunk
switchport trunk allowed vlan 20
end
show interfaces trunk

Answer

vlan 10
name PC_VLAN
vlan 20
name Server_VLAN
interface GigabitEthernet0/1
switchport mode access
switchport access vlan 10
interface GigabitEthernet0/2
switchport mode access
switchport access vlan 20
end
show vlan brief

Answer

interface GigabitEthernet0/1
switchport access vlan 10
interface GigabitEthernet0/2
switchport access vlan 20
end
show vlan brief

Question 5

You are connected to SW1 via the console. SW1 is a Layer 2 switch connected to router R1 via trunk port G0/1. The trunk is currently using VLAN 1 as native VLAN, but the network administrator wants to change the native VLAN to VLAN 99 for security. Configure the trunk on G0/1 to use native VLAN 99 and verify.

Accepted Answer

SW1(config)# interface g0/1
SW1(config-if)# switchport trunk native vlan 99
SW1(config-if)# end
SW1# show interfaces trunk. Changing the native VLAN on a trunk prevents VLAN hopping attacks. The native VLAN carries untagged traffic; here it is changed from default VLAN 1 to VLAN 99.

Answer

SW1(config)# interface g0/1
SW1(config-if)# switchport trunk allowed vlan 99
SW1(config-if)# end
SW1# show vlan brief

Answer

SW1(config)# vlan 99
SW1(config-vlan)# name Native
SW1(config-vlan)# exit
SW1(config)# interface g0/1
SW1(config-if)# switchport mode trunk
SW1(config-if)# switchport trunk native vlan 99
SW1(config-if)# end
SW1# show interfaces trunk

Answer

SW1(config)# interface g0/1
SW1(config-if)# switchport trunk native vlan 99
SW1(config-if)# end
SW1# show vlan id 99

Question 6

You are connected to SW1 via the console. SW1 is a Layer 2 switch with two links to SW2: G0/1 and G0/2. The administrator wants to combine these two links into an EtherChannel using LACP. Configure an EtherChannel on SW1 for these ports and verify.

Accepted Answer

interface range g0/1-2
channel-group 1 mode active. The correct answer is A because it applies the LACP 'active' mode to both interfaces in the range, which will dynamically negotiate an EtherChannel with the peer. Option B uses PAgP 'desirable' mode, which is Cisco proprietary and not LACP, failing the requirement for LACP. Option C mixes LACP modes (active on one interface and passive on the other); both member ports must use the same mode (either active/active or passive/passive) to form a channel. Option D attempts to configure the 'channel-group' command on the port-channel interface itself, but this command must be applied to the physical interfaces, not the logical port-channel.

Answer

interface range g0/1-2
channel-group 1 mode desirable

Answer

interface g0/1
channel-group 1 mode active
interface g0/2
channel-group 1 mode passive

Answer

interface port-channel 1
channel-group 1 mode active

Question 7

You are connected to SW1 via the console. SW1 is a Layer 2 switch with three redundant links to SW2: G0/1, G0/2, and G0/3. The network is experiencing loops, and STP is not configured. You need to enable STP and ensure that SW1 becomes the root bridge for VLAN 1. Configure STP on SW1 and set its priority to 4096 for VLAN 1.

Accepted Answer

spanning-tree vlan 1 priority 4096. By setting the STP priority to 4096 for VLAN 1, SW1 has a lower priority than the default, making it the root bridge for that VLAN.

Answer

spanning-tree vlan 1 root primary

Answer

spanning-tree vlan 1 priority 32768

Answer

spanning-tree vlan 1 priority 8192

Question 8

You are connected to SW1 via the console. SW1 is a Layer 2 switch connected to a PC on port G0/1. The network administrator wants to secure the port by allowing only two MAC addresses and enabling sticky MAC learning. Additionally, if a violation occurs, the port should be put into error-disabled state. Configure port security on G0/1 with maximum MAC addresses of 2, sticky learning, and shutdown violation mode.

Accepted Answer

SW1(config-if)# switchport port-security
SW1(config-if)# switchport port-security maximum 2
SW1(config-if)# switchport port-security mac-address sticky
SW1(config-if)# switchport port-security violation shutdown. Port security restricts access based on MAC addresses. The first command, `switchport port-security`, enables port security on the interface. With sticky, learned MACs are saved to the running config; `shutdown` violation mode places the port in error-disable state, requiring manual recovery. Option A includes all required commands in the correct order. Option B uses `restrict`, which drops traffic but does not errdisable. Option C uses `protect`, which drops silently without logging. Option D manually configures a specific MAC instead of enabling sticky learning, so it does not meet the requirement for sticky.

Answer

SW1(config-if)# switchport port-security
SW1(config-if)# switchport port-security maximum 2
SW1(config-if)# switchport port-security mac-address sticky
SW1(config-if)# switchport port-security violation restrict

Answer

SW1(config-if)# switchport port-security
SW1(config-if)# switchport port-security maximum 2
SW1(config-if)# switchport port-security mac-address sticky
SW1(config-if)# switchport port-security violation protect

Answer

SW1(config-if)# switchport port-security
SW1(config-if)# switchport port-security maximum 2
SW1(config-if)# switchport port-security mac-address 0000.1111.2222
SW1(config-if)# switchport port-security violation shutdown

Question 9

You are connected to SW1 via the console. SW1 is a Layer 2 switch with two VLANs (10 - Sales, 20 - Engineering). Port G0/1 is connected to a PC in VLAN 10, and port G0/2 is connected to a PC in VLAN 20. The switch needs to be configured to allow inter-VLAN communication using an external router connected to port G0/3. Currently, the PCs cannot communicate across VLANs. Configure the switch to support Router-on-a-Stick with VLAN 10 as the native VLAN on the trunk.

Accepted Answer

Configure G0/1 as access VLAN 10, G0/2 as access VLAN 20, G0/3 as trunk with native VLAN 10, and allow VLANs 10 and 20 on the trunk.. Access ports assign PCs to their respective VLANs. The trunk port carries multiple VLANs to the router, and setting the native VLAN to 10 ensures untagged frames on the trunk belong to VLAN 10, which the router's subinterface for VLAN 10 will handle as untagged.

Answer

Configure G0/1 as access VLAN 10, G0/2 as access VLAN 20, G0/3 as trunk with native VLAN 1, and allow VLANs 10 and 20 on the trunk.

Answer

Configure G0/1 as access VLAN 10, G0/2 as access VLAN 20, G0/3 as trunk with native VLAN 10, but do not allow VLAN 10 on the trunk.

Answer

Configure G0/1 as trunk with native VLAN 10, G0/2 as trunk with native VLAN 20, G0/3 as trunk with native VLAN 10, and allow VLANs 10 and 20 on all trunks.

Question 10

You are connected to SW1 via the console. SW1 is a Layer 2 switch connected to two other switches (SW2 and SW3) via redundant links. All switches run IEEE 802.1D Spanning Tree Protocol. The network administrator wants SW1 to become the root bridge for VLAN 1. Currently, the root bridge is SW2. Configure SW1 to achieve this and ensure that port G0/1, which connects to an end device, immediately transitions to forwarding state upon link up and is protected from BPDU attacks.

Accepted Answer

Configure 'spanning-tree vlan 1 root primary' globally, and on interface G0/1 configure 'spanning-tree portfast' and 'spanning-tree bpduguard enable'.. The 'spanning-tree vlan 1 root primary' command reduces the bridge priority to 24576 (or lower) to ensure SW1 becomes root for VLAN 1. PortFast on G0/1 speeds up access port convergence, and BPDU Guard protects against rogue switches by disabling the port upon BPDU reception.

Answer

Configure 'spanning-tree vlan 1 priority 4096' globally, and on interface G0/1 configure 'spanning-tree portfast' and 'spanning-tree guard root'.

Answer

Configure 'spanning-tree vlan 1 root secondary' globally, and on interface G0/1 configure 'spanning-tree portfast' and 'spanning-tree bpduguard enable'.

Answer

Configure 'spanning-tree vlan 1 priority 32768' globally, and on interface G0/1 configure 'spanning-tree portfast' and 'spanning-tree bpdufilter enable'.

Question 11

Which three of the following are unique characteristics of RSTP (802.1w) compared to traditional STP (802.1D)? (Choose three.)

Accepted Answer

RSTP edge ports transition directly to the forwarding state with no delay.. RSTP (802.1w) differs from traditional STP (802.1D) in three key ways: 
1) It uses a proposal/agreement handshake to achieve rapid convergence without waiting for timers. 
2) It introduces alternate and backup port roles—alternate ports provide a path to the root bridge via another switch, and backup ports provide a redundant path on the same segment; both are discarding but ready to transition. 
3) Edge ports (connected only to end hosts) move directly to the forwarding state, bypassing listening and learning.

The incorrect options fail as differences: 
- Option C (root bridge with lower priority) is true for both STP and RSTP, so it is not a distinguishing characteristic. 
- Option E (only three timers) is also true for both; RSTP uses the same three timers (Hello, Max Age, Forward Delay). 
- Option F (eliminates BPDUs) is false—RSTP still uses BPDUs but with the Type field set to 2 and includes a flags byte for proposal/agreement.

Answer

RSTP eliminates the need for BPDU messages by using link-local multicast for topology changes.

Answer

RSTP uses only three timer values (Hello, Max Age, Forward Delay) that must be identical across all switches.

Answer

RSTP requires the use of a root bridge with a lower bridge priority than any other switch in the network.

Question 12

Which three of the following statements about VLAN Trunking Protocol (VTP) are correct? (Choose three.)

Accepted Answer

VTP pruning helps reduce unnecessary broadcast traffic on trunk links by pruning VLANs that are not active on any downstream switch.. All three selected statements are correct: VTP pruning reduces unnecessary broadcast traffic by pruning inactive VLANs from trunk links; a VTP server can create/modify/delete VLANs and propagates changes; transparent mode forwards advertisements but does not synchronize. The three distractors are incorrect. D: VTP version 3 is not backward compatible with version 1 and 2; it requires compatible versions. E: A VTP client cannot create local VLANs; it only synchronizes from the server. F: VTP uses multicast MAC address 0100.0CCC.CCCC for advertisements, not 0180.c200.0000 which is used by other protocols like STP.

Answer

VTP version 3 supports extended VLANs (1006-4094) and is backward compatible with VTP version 1 and 2.

Answer

A switch in VTP client mode can create local VLANs that are not advertised to the rest of the domain.

Answer

VTP advertisements are sent as multicast frames using the destination MAC address 0180.c200.0000.

Question 13

Which three of the following are valid considerations when configuring EtherChannel? (Choose three.)

Accepted Answer

All physical interfaces in an EtherChannel must have the same speed and duplex settings.. All three correct statements (A, B, C) are valid considerations when configuring EtherChannel. Option D is incorrect because load balancing can be based on source/destination IP, MAC, or Layer 4 port, not just MAC addresses. Option E is false because although up to 16 interfaces can be in a port channel, only 8 can be active simultaneously (the remaining are in standby). Option F is false because STP operates on the port-channel interface as a whole, not on individual links within the bundle.

Answer

EtherChannel load balancing is always based on source and destination MAC addresses only.

Answer

On a Cisco switch, you can bundle up to 16 interfaces into a single EtherChannel, all of which can be active simultaneously.

Answer

EtherChannel provides loop prevention by using Spanning Tree Protocol on each individual link within the bundle.

Question 14

Which three of the following correctly describe how a Layer 2 switch handles frames? (Choose three.)

Accepted Answer

If the destination MAC address is broadcast (FFFF.FFFF.FFFF), the switch floods the frame out all ports except the incoming port.. A Layer 2 switch forwards known unicasts only to the associated port (A), floods broadcasts out all ports except the incoming port (B), and dynamically learns MAC addresses from source MACs of frames (D). Unknown unicasts are flooded, not dropped (C is wrong). MAC address table learning relies on source MAC inspection, not CDP (E is wrong). If source and destination MAC are identical, the frame is not forwarded; it is typically dropped (F is wrong).

Answer

If the source MAC address in a frame matches the destination MAC address, the switch forwards the frame to all ports.

Answer

The switch updates the MAC address table every 30 seconds by default using CDP advertisements.

Answer

If the destination MAC address is unknown (not in the MAC address table), the switch drops the frame to prevent loops.

Question 15

Which three of the following are true regarding the configuration and operation of a Cisco switch port in access mode? (Choose three.)

Accepted Answer

An access port belongs to a single VLAN and carries traffic for that VLAN only.. An access port is configured to belong to a single VLAN and carries traffic for that VLAN only. By default, all switch ports are placed in VLAN 1. The 'switchport mode access' command is not strictly required before assigning a VLAN; however, for a port to operate as a dedicated access port, the command is necessary to prevent it from forming a trunk via DTP. Option 5 is incorrect because an access port with a voice VLAN does accept tagged frames for the voice VLAN; it does not drop all tagged frames. Option 6 is incorrect because the 'switchport access vlan' command does not automatically create the VLAN; the VLAN must already exist in the VLAN database or be created manually.

Answer

An access port will drop any frames that are received with an 802.1Q tag.

Answer

The 'switchport access vlan' command automatically creates the VLAN if it does not already exist in the VLAN database.

Answer

The 'switchport mode access' command is required before assigning a VLAN to the port.