CCNA Switching and Network Access Practice Test 25 — 15 Questions

Question 1

You are connected to SW1 via the console. SW1 is a Layer 2 switch connected to two other switches (SW2 and SW3) via redundant links. All switches run IEEE 802.1D Spanning Tree Protocol. The network administrator wants SW1 to become the root bridge for VLAN 1. Currently, the root bridge is SW2. Configure SW1 to achieve this and ensure that port G0/1, which connects to an end device, immediately transitions to forwarding state upon link up and is protected from BPDU attacks.

Accepted Answer

Configure 'spanning-tree vlan 1 root primary' globally, and on interface G0/1 configure 'spanning-tree portfast' and 'spanning-tree bpduguard enable'.. The 'spanning-tree vlan 1 root primary' command reduces the bridge priority to 24576 (or lower) to ensure SW1 becomes root for VLAN 1. PortFast on G0/1 speeds up access port convergence, and BPDU Guard protects against rogue switches by disabling the port upon BPDU reception.

Answer

Configure 'spanning-tree vlan 1 priority 4096' globally, and on interface G0/1 configure 'spanning-tree portfast' and 'spanning-tree guard root'.

Answer

Configure 'spanning-tree vlan 1 root secondary' globally, and on interface G0/1 configure 'spanning-tree portfast' and 'spanning-tree bpduguard enable'.

Answer

Configure 'spanning-tree vlan 1 priority 32768' globally, and on interface G0/1 configure 'spanning-tree portfast' and 'spanning-tree bpdufilter enable'.

Question 2

Which four of the following are characteristics of Dynamic Trunking Protocol (DTP) and VLAN Trunking Protocol (VTP) used in Cisco switching? (Choose four.)

Accepted Answer

VTP allows synchronization of VLAN information across switches in the same VTP domain.. The four correct statements are: (1) DTP is a Cisco proprietary protocol for negotiating trunk links; (2) VTP synchronizes VLAN information across switches in the same VTP domain; (3) 'switchport mode dynamic desirable' actively sends DTP frames to form a trunk; (4) VTP pruning reduces unnecessary broadcast traffic by limiting flooded traffic to only switches that need the VLAN. The two incorrect statements: VTP transparent mode forwards VTP advertisements but does **not** modify its VLAN database based on received updates—it only passes them through. DTP **cannot** form a trunk when both ends are configured with 'switchport nonegotiate' because that command disables DTP frame transmission entirely, preventing trunk negotiation.

Answer

DTP can form a trunk regardless of whether both ends are configured with 'switchport nonegotiate'.

Answer

VTP transparent mode stores and forwards VTP advertisements but also modifies the VLAN database based on received updates.

Question 3

Which three of the following are correct statements about VLAN configuration and verification on a Cisco switch? (Choose three.)

Accepted Answer

The 'switchport mode access' command places the interface into a non-trunking mode.. The correct statements are: (1) The 'switchport mode access' command places the interface into a non-trunking mode; (2) By default, all ports on a Cisco switch are in VLAN 1; (3) The 'show vlan brief' command displays VLANs that are active on the switch. The remaining statements are false because: VLANs 1002–1005 are reserved for legacy FDDI/Token Ring VLANs, not for user-created VLANs; a VLAN does not need to be manually created before its name can be assigned (assigning a port to a new VLAN can automatically create it, after which you can set its name); and the 'switchport trunk native vlan' command does not restrict the native VLAN to only tagged frames—native VLAN traffic is sent untagged.

Answer

A VLAN must be manually created before its name can be assigned.

Answer

VLANs 1002–1005 are reserved for user-created VLANs.

Answer

The 'switchport trunk native vlan' command restricts the native VLAN to only tagged frames.

Question 4

Drag and drop the switch port configuration commands on the left to the correct descriptions on the right.

Accepted Answer

switchport mode access: Statically sets the port as an access port.. The command 'switchport mode access' statically sets the port as an access port. 'switchport access vlan 10' assigns VLAN 10 as the data VLAN for connected devices. 'switchport voice vlan 20' defines the VLAN used by a Cisco IP phone for voice traffic. 'switchport mode trunk' forces the port into permanent trunking mode. 'switchport trunk allowed vlan 100,200' restricts the trunk to carry only VLANs 100 and 200.

Answer

switchport mode trunk: Restricts the trunk to carry only VLANs 100 and 200.

Answer

switchport trunk allowed vlan 100,200: Forces the port into permanent trunking mode.

Question 5

Drag and drop the following steps into the correct order to configure a switch port for data and voice traffic.

Accepted Answer

Enter interface configuration mode for the desired switch port.. The correct order is: 1) Enter interface configuration mode, because all port-specific commands must be applied under the interface. 2) Set the port as an access port with 'switchport mode access'—a voice VLAN can only be assigned on an access port. 3) Assign the data VLAN with 'switchport access vlan' to ensure proper Layer 2 forwarding for data traffic. 4) Assign the voice VLAN with 'switchport voice vlan' so the IP phone's voice frames are tagged with the voice VLAN. 5) Enable PortFast with 'spanning-tree portfast' to immediately transition the port to forwarding, preventing DHCP timeouts for the phone and host.

Question 6

Drag and drop the following steps into the correct order to interpret packet capture output for L2/L3 troubleshooting.

Accepted Answer

Examine the source and destination MAC addresses in the Ethernet header to verify Layer 2 connectivity.. The logical troubleshooting sequence for packet capture analysis starts at Layer 2 to verify the data link layer. First, examine the source and destination MAC addresses in the Ethernet header to confirm correct frame delivery. Next, check for ARP requests and responses to ensure proper IP-to-MAC resolution. Then, analyze the source and destination IP addresses to verify Layer 3 addressing and routing. After that, look for ICMP Destination Unreachable or Time Exceeded messages to identify network path issues. Proceed to inspect transport layer port numbers (TCP/UDP) to identify the service and possible blocking. Finally, review TCP flags (e.g., SYN, RST, FIN) to understand session state and detect retransmissions or connection issues.

Question 7

Drag and drop the following steps into the correct order to configure Rapid PVST+ with a designated root bridge, PortFast, and BPDU Guard on access ports.

Accepted Answer

Set the spanning-tree mode to Rapid PVST+. 1. Set the spanning-tree mode to Rapid PVST+: This enables Rapid PVST+ globally, a prerequisite for the root primary command to function correctly. 2. Configure the switch as the root bridge for VLAN 1: Lowers the bridge priority to guarantee this switch becomes the root, defining the STP topology. 3. Enter interface configuration mode for the access ports: Prepares the specific ports where PortFast and BPDU Guard are applied. 4. Enable PortFast on the interfaces: Allows immediate transition to forwarding state, bypassing listening/learning phases. 5. Enable BPDU Guard on the interfaces: Protects the network by err-disabling the port if a BPDU is received, which should occur only after PortFast is enabled on access ports.

Question 8

Drag and drop the following steps into the correct order to configure inter‑VLAN routing between VLANs 10 and 20, using a router‑on‑a‑stick with VLAN 99 as the native VLAN on the trunk link.

Accepted Answer

Create VLANs 10, 20, and 99 on the switch (e.g., using the 'vlan' global configuration commands).. The correct order is: first create VLANs on the switch to define the VLAN database. Second, assign switch ports to the appropriate VLANs so that end hosts are placed in their correct broadcast domains. Third, configure the switch port facing the router as an 802.1Q trunk and set the native VLAN to 99 – this allows tagged traffic from multiple VLANs to traverse a single link while matching the native VLAN on both sides. Fourth, enable the router's physical interface (no shutdown) so that subinterfaces can pass traffic. Next, create subinterfaces for each data VLAN, specifying the correct 802.1Q encapsulation and IP address for each VLAN's default gateway. Finally, configure the native VLAN subinterface with the native keyword to ensure that untagged frames from the trunk are handled correctly and that the native VLAN is explicitly defined on the router.

Question 9

Drag and drop the following steps into the correct order to configure BPDU Guard, Loop Guard, and Root Guard on a Cisco switch.

Accepted Answer

Enter global configuration mode using the configure terminal command.. The correct order starts by entering global configuration mode, then globally enabling PortFast on all access ports to allow immediate transition to forwarding state. BPDU Guard is then enabled globally on all PortFast-enabled ports to protect against unauthorized switches. Next, Loop Guard is enabled globally to prevent loops from unidirectional links. Afterwards, the specific uplink interface is selected and Root Guard is applied to prevent a rogue switch from becoming the root bridge. This sequence follows Cisco best practices: apply fast convergence first, then protect the edge with BPDU Guard, apply loop prevention globally, and finally secure core links with Root Guard.

Question 10

Drag and drop the following steps into the correct order to capture and analyze traffic for L2/L3 troubleshooting.

Accepted Answer

Identify the source interface or VLAN to monitor for traffic capture.. The steps follow the logical sequence of a packet capture: first identify the traffic source, then configure a SPAN session to mirror it, connect the capture device, start capture, reproduce the issue, stop capture, and finally analyze the output. Each step must be completed before the next can succeed.

Question 11

Drag and drop the following steps into the correct order to configure Rapid PVST+ on SW1, make it the root bridge, and enable PortFast with BPDU Guard on all access ports.

Accepted Answer

Enter global configuration mode on SW1 using the command configure terminal.. The correct order begins by entering global configuration mode, then enabling Rapid PVST+ so that subsequent spanning-tree commands operate under that mode. Next, the switch is designated as the root bridge for VLAN 1 using 'spanning-tree vlan 1 root primary', which sets a superior bridge priority. After the root election is influenced, PortFast is applied to all access interfaces to transition them directly into forwarding state. Finally, BPDU Guard is enabled globally to protect all PortFast-enabled ports; if a BPDU is received on such a port, it is immediately put into err-disabled state, preventing potential loops. Each step builds on the previous one: enabling Rapid PVST+ must precede root setup, root selection should be completed before any access-port optimization, and BPDU Guard is applied last to secure the already-accelerated ports.

Question 12

Drag and drop the following steps into the correct order to configure a router-on-a-stick topology for inter-VLAN routing between VLANs 10 and 20, using 802.1Q trunking with native VLAN 99 for management traffic.

Accepted Answer

Create VLANs 10, 20, and 99 on the switch.. The sequence follows Cisco's best practices: VLANs are created first, then access ports are assigned to them. The switch trunk is configured with 802.1Q encapsulation and the native VLAN set to 99 before the router end. On the router, the physical interface must be enabled before subinterfaces can operate. The native VLAN subinterface is created first to handle untagged frames, then the data VLAN subinterfaces are configured. This order avoids errors such as missing VLANs, incorrect encapsulation, and physical link down state.

Question 13

Drag and drop the following steps into the correct order to configure a Cisco switch access port with a data VLAN and a voice VLAN.

Accepted Answer

Enter global configuration mode (configure terminal). First, enter global configuration mode with 'configure terminal'. Next, select the interface using 'interface GigabitEthernet0/1'. Then, set the port to access mode with 'switchport mode access' to prevent trunk negotiation. After that, assign the data VLAN with 'switchport access vlan 10'. Finally, assign the voice VLAN with 'switchport voice vlan 20'. This order ensures the interface is properly configured before VLAN assignment and prevents DTP from creating a trunk.

Question 14

Drag and drop the following steps into the correct order to configure spanning-tree protection features including BPDU Guard, Root Guard, and Loop Guard on a Cisco switch.

Accepted Answer

Identify edge ports connected to end devices.. The correct order is: (1) Identify edge ports connected to end devices. (2) Configure spanning-tree portfast on those interfaces. (3) Enable BPDU Guard using the spanning-tree portfast bpduguard default global command. (4) Identify ports connected to other switches that should never become the root bridge. (5) Enable Root Guard on those interfaces with spanning-tree guard root. (6) Identify point-to-point non-edge ports susceptible to unidirectional link failures. (7) Enable Loop Guard on those interfaces with spanning-tree guard loop. This sequence first secures edge ports with PortFast and BPDU Guard to prevent accidental network loops and BPDU-based attacks, then applies Root Guard on ports where a superior BPDU should never be received to protect the root bridge placement, and finally implements Loop Guard on non-edge point-to-point links to guard against unidirectional link failures that could cause bridging loops. Identifying the ports before applying configurations ensures proper placement of each protection mechanism.

Question 15

A network administrator connects an IP phone to interface Gi0/1 and a PC to the phone's PC port. Users report that the phone cannot register with the call manager and the PC does not obtain an IP address. The administrator verifies the configuration shown in the exhibit. What is the most likely cause of the problem?

Accepted Answer

The voice VLAN is not configured on the interface.. The voice VLAN is not configured on the interface. For an IP phone to communicate with the call manager, the switchport must be configured with a voice VLAN (e.g., 'switchport voice vlan 20') to separate voice traffic from data traffic. Without this command, the phone cannot tag its frames with the appropriate VLAN ID, preventing registration. Additionally, the PC connected to the phone's PC port relies on the phone to pass untagged data traffic, but without the voice VLAN, the phone may not properly negotiate or forward traffic, causing the PC to fail to obtain an IP address.

Answer

The switchport mode should be changed to trunk to allow tagged voice traffic.

Answer

The spanning-tree portfast command is blocking the port from forwarding.

Answer

The access VLAN 10 is incorrect for the data subnet.