CCNA Switching and Network Access Practice Test 26 — 15 Questions

Question 1

Drag and drop the items on the left to match the descriptions on the right.

Question 2

Drag and drop the following steps into the correct order to configure inter-VLAN routing using a router-on-a-stick topology.

Accepted Answer

On the switch, create the necessary VLANs (e.g., VLAN 10 and VLAN 20) using the 'vlan' command.. Inter-VLAN routing via router-on-a-stick requires creating VLANs on the switch, placing access ports in those VLANs, configuring a trunk to the router with the correct native VLAN to avoid mismatch, enabling the physical router interface, and then defining subinterfaces per VLAN with 802.1Q encapsulation and IP addresses. This ensures traffic from different VLANs can be routed.

Question 3

An administrator notices that hosts in VLAN 30 on SW1 cannot communicate with hosts in VLAN 30 on SW2, even though both switches are connected via an 802.1Q trunk. Traffic for VLANs 10 and 20 passes without issues across the same trunk. The trunk is configured to allow all VLANs, and the allowed VLAN list explicitly includes VLAN 30. What is the most likely cause of the problem?

Accepted Answer

The native VLAN is mismatched between SW1 and SW2, and VLAN 30 is the native VLAN on one side.. The most likely cause is a native VLAN mismatch. When the native VLAN is mismatched on an 802.1Q trunk, traffic for the native VLAN is not tagged, so frames from VLAN 30 on one switch are received as untagged frames on the other switch and placed into the switch's configured native VLAN. If the native VLAN on one side is VLAN 30 and on the other side is a different VLAN (e.g., VLAN 1), the hosts in VLAN 30 cannot communicate because the frames are interpreted as belonging to different VLANs. Traffic for VLANs 10 and 20 passes because they are not the native VLAN and are properly tagged.

Answer

The trunk encapsulation is set to ISL on one switch and 802.1Q on the other.

Answer

Spanning Tree Protocol has placed VLAN 30 in a blocking state on the trunk link.

Answer

The switched virtual interface (SVI) for VLAN 30 on SW1 is administratively down.

Question 4

A network engineer connects a new switch to an existing Rapid PVST+ campus network. The new switch is intended to serve as an additional access-layer switch, but after connecting its uplinks, the engineer discovers that the root bridge for VLAN 10 has changed to this new switch, and several access ports on other switches with PortFast and BPDU Guard enabled are now in err-disabled state. Some users report intermittent connectivity loss.

Accepted Answer

The new switch’s bridge priority is lower than the existing root bridge, and it was connected to a port with BPDU Guard enabled.. The new switch's bridge priority is lower (numerically smaller) than the existing root bridge, so it becomes the new root for VLAN 10. When it sends superior BPDUs out its uplinks, the neighboring switch's access ports with PortFast and BPDU Guard enabled receive these BPDUs, triggering err-disable state on those ports, causing connectivity loss.

Answer

The new switch was connected to a port configured as a trunk with a native VLAN mismatch.

Answer

The new switch has PortFast enabled on its uplinks.

Answer

The BPDU Guard feature was globally enabled on all ports, including trunk ports.

Question 5

A network administrator implements a set of spanning-tree enhancements to secure the switching infrastructure. Later, a help desk ticket reports that a user in a remote office cannot connect to any network resources. While investigating, the administrator notices that the switch port connecting the remote office switch to the distribution switch is in a 'root-inconsistent' state and is blocking traffic. Which protection feature, if misapplied, most likely caused this issue?

Accepted Answer

Root Guard. Root Guard is the correct answer because it forces an interface to be a designated port. If a switch receives a superior BPDU (indicating a root bridge with a lower bridge ID) on a Root Guard-enabled port, the port is placed into a 'root-inconsistent' state and blocks traffic to prevent the attached switch from becoming the root bridge. This matches the symptom described: a port in 'root-inconsistent' state blocking traffic after spanning-tree enhancements were applied.

Answer

Loop Guard

Answer

BPDU Guard

Answer

BPDU Filter

Question 6

A network engineer configures an EtherChannel between two switches. Switch A's interface is set with channel-group 1 mode active, while Switch B's identical interface is set with channel-group 1 mode auto. When verifying with show etherchannel summary, the engineer observes that the port-channel interface is down and the physical interfaces are not bundled. What is the most likely cause of the problem?

Accepted Answer

The mode 'auto' is a PAgP negotiation mode that is incompatible with the LACP active mode.. Option B is correct because 'active' is an LACP mode that initiates negotiations, while 'auto' is a PAgP mode that passively waits for PAgP packets. Since LACP and PAgP are incompatible protocols, the interfaces will never negotiate a bundle, leaving the port-channel down. The engineer must use matching protocol modes (e.g., both LACP active/passive or both PAgP desirable/auto) for EtherChannel to form.

Answer

The LACP system priority on the active side must be lower than the auto side.

Answer

LACP requires one side to be active and the other passive; two active interfaces will not bundle.

Answer

The physical interfaces must be shut down and then re-enabled after configuring LACP for the bundle to form.

Question 7

Which TWO statements accurately describe 802.1Q trunking and inter-VLAN routing on Cisco switches?

Accepted Answer

802.1Q trunking adds a 4-byte tag that includes a 12-bit VLAN ID field, increasing the maximum frame size.. Option B is correct because 802.1Q trunking inserts a 4-byte tag into the Ethernet frame, which includes a 12-bit VLAN ID field (supporting up to 4094 VLANs). This tag increases the maximum frame size from 1518 bytes to 1522 bytes, which is a key characteristic of 802.1Q encapsulation.

Answer

The native VLAN on a trunk port sends frames with an 802.1Q tag containing VLAN ID 1.

Answer

A trunk port can only forward traffic for one VLAN at a time.

Answer

The native VLAN on a trunk cannot be changed from VLAN 1.

Question 8

Refer to the exhibit. A network administrator is troubleshooting a connectivity issue on switch SW1. Users connected to port Gi0/3 are unable to reach resources in VLAN 30. The administrator issues the show vlan brief command and receives the output shown. What is the most likely cause of the problem?

Accepted Answer

VLAN 30 is administratively shut down.. The 'show vlan brief' output shows VLAN 30 as 'active' but the ports assigned to it are not listed, and the VLAN is not present in the output at all. This indicates that VLAN 30 has been administratively shut down (shutdown command applied under the VLAN configuration mode), which prevents any traffic from being forwarded through that VLAN, even if the switch port Gi0/3 is configured as an access port in VLAN 30. The correct answer is C because an administratively shutdown VLAN will not appear in the 'show vlan brief' output, and all ports assigned to it will be unable to communicate within that VLAN.

Answer

The Gi0/3 port is in an error-disabled state due to port security violations.

Answer

The VLAN 30 SVI is administratively down.

Answer

Spanning Tree Protocol has placed Gi0/3 into a blocking state for VLAN 30.

Question 9

A network technician notices CDP native VLAN mismatch warnings between switches SW1 and SW2 on their trunk link. The technician runs 'show interfaces trunk' on SW1 and sees native VLAN 1, then on SW2 and sees native VLAN 99. Data traffic is currently passing, but the mismatch can cause broadcast loops. What should the technician do next?

Accepted Answer

Configure the native VLAN to match on both ends of the trunk.. The correct action is to configure the native VLAN to match on both ends of the trunk. CDP reports a native VLAN mismatch when the native VLANs differ on the two sides of a trunk link. Although data traffic may still pass because 802.1Q does not tag frames on the native VLAN, the mismatch can cause broadcast loops and security risks, as frames from one native VLAN may be misinterpreted on the other side. Setting both sides to the same native VLAN (e.g., VLAN 1 or VLAN 99) resolves the mismatch and ensures proper Layer 2 behavior.

Answer

Add VLAN 99 to the allowed VLAN list on the trunk interface of SW1.

Answer

Remove the trunk configuration and set both interfaces as access ports in VLAN 1.

Answer

Enable spanning‑tree PortFast on the trunk ports.

Question 10

A technician is troubleshooting a network issue where hosts in VLAN 20 on SW1 cannot communicate with hosts in VLAN 20 on SW2. Both switches are connected by an Ethernet trunk link that is up/up and configured as a trunk. The VLAN databases on both switches include VLAN 20, and the spanning tree for VLAN 20 is in a forwarding state on all ports. Hosts within VLAN 20 on each switch can communicate with each other locally. What is the most likely cause?

Accepted Answer

VLAN 20 is not in the switchport trunk allowed VLAN list on the trunk port between SW1 and SW2.. The most likely cause is that VLAN 20 is not included in the allowed VLAN list on the trunk port between SW1 and SW2. Even though the trunk is up/up and VLAN 20 exists in the VLAN database, the switchport trunk allowed vlan command restricts which VLANs can traverse the trunk. If VLAN 20 is omitted from this list, frames from VLAN 20 will be dropped at the trunk, preventing inter-switch communication for that VLAN.

Answer

The native VLAN is mismatched on the two ends of the trunk.

Answer

VLAN 20 has not been created in the VLAN database on SW2.

Answer

The trunk encapsulation is mismatched between SW1 and SW2.

Question 11

Refer to the exhibit. A network administrator is troubleshooting connectivity issues for hosts on VLAN 50 on SW1. The hosts on VLAN 50 cannot reach any devices outside SW1, even though the trunk link between SW1 and SW2 is up. The administrator issues the 'show interfaces GigabitEthernet0/1 trunk' command on SW1. Based on the output, what is the most likely cause of the issue?

Accepted Answer

VLAN 50 is not in the allowed VLAN list on the trunk.. The 'show interfaces GigabitEthernet0/1 trunk' output would list the allowed VLANs on the trunk. If VLAN 50 is not included in the allowed VLAN list, traffic from VLAN 50 will be dropped at the trunk, preventing hosts on SW1 from reaching devices outside SW1. This is the most likely cause because the trunk is up but VLAN 50 traffic is not forwarded.

Answer

The native VLAN on the trunk is misconfigured, causing VLAN 50 traffic to be dropped.

Answer

The trunk is operating in access mode instead of trunk mode, preventing VLAN 50 traffic.

Answer

Spanning tree protocol has blocked the trunk port for VLAN 50, isolating the hosts.

Question 12

Refer to the exhibit. A network engineer is troubleshooting a connectivity issue on SW3. A host connected to the same segment as SW3's GigabitEthernet0/0 interface cannot reach any network resources. The engineer issues the show spanning-tree vlan 10 command and receives the output shown. Based on the output, what is the most likely cause?

Accepted Answer

The interface GigabitEthernet0/0 is in the Blocking state because it received a superior BPDU, making it an alternate port to the root bridge.. The output shows that GigabitEthernet0/0 is in the Blocking state for VLAN 10. In Rapid PVST+ or classic STP, a port enters the Blocking state when it receives a superior BPDU (i.e., a BPDU with a lower bridge ID or lower path cost to the root), causing it to become an alternate (or backup) port rather than a designated or root port. This prevents the host from reaching network resources because the port does not forward traffic.

Answer

GigabitEthernet0/0 is administratively down, which prevents the host from communicating.

Answer

The port is in the Blocking state because the switch detected a loop and moved the port to error-disabled state.

Answer

The port is blocked because SW3 has a lower bridge priority than the root bridge and should be the designated port for that segment.

Question 13

A technician connects a PC to a switch port that has port security enabled with the default maximum of one MAC address and violation mode shutdown. Immediately after connecting, the port goes into the err-disabled state. The technician runs the show interfaces command and sees the port status as err-disabled. What should the technician do next?

Accepted Answer

Configure the port security violation mode to restrict, increase the maximum number of MAC addresses, and then recover the port.. Option A is correct because the port went into err-disabled state due to a port security violation (default maximum of one MAC address was exceeded). To resolve this, the technician must first recover the port (shutdown/no shutdown) or use the 'errdisable recovery cause psecure-violation' command, but the question asks what to do next. The best next step is to configure the violation mode to 'restrict' (which allows traffic from violating MACs but logs them) and increase the maximum MAC addresses to accommodate the PC, then recover the port. This prevents immediate err-disable on future violations while maintaining security.

Answer

Disable port security on the interface.

Answer

Enter the shutdown and no shutdown commands to recover the port, then enable port security with sticky MAC learning.

Answer

Verify the spanning-tree portfast configuration on the interface.

Question 14

After connecting a new switch to interface GigabitEthernet1/0/1 on a distribution switch, a network engineer notices that the interface is in err-disable state. The engineer checks the configuration and finds that spanning-tree portfast and spanning-tree bpduguard enable are applied to the interface. What is the most likely cause of the err-disable state?

Accepted Answer

Spanning-tree PortFast is enabled on a port that connects to another switch.. Option C is correct because PortFast is designed for end-host ports that should not receive BPDUs. When PortFast is enabled on a port connecting to another switch, the switch will immediately transition the port to forwarding state, but if it then receives a BPDU from the connected switch, BPDU Guard will error-disable the port. This is the most common cause of err-disable state when both PortFast and BPDU Guard are configured on an inter-switch link.

Answer

BPDU Guard was incorrectly enabled on a port that should be a trunk link.

Answer

The connected switch is sending BPDUs with a lower bridge priority.

Answer

The port is configured as an access port, but should be a trunk.

Question 15

A network engineer notices that Host A in VLAN 10 (10.10.10.50/24) can successfully ping its default gateway 10.10.10.1, but cannot ping the VLAN 20 SVI (10.20.20.1) or any hosts in VLAN 20. The SVIs for both VLAN 10 and VLAN 20 are in an up/up state, and the switch's trunk ports are correctly allowing both VLANs. What is the most likely cause?

Accepted Answer

The ip routing global configuration command is missing.. Host A can reach its default gateway (10.10.10.1), which is the VLAN 10 SVI, but cannot reach the VLAN 20 SVI (10.20.20.1) or any hosts in VLAN 20. This indicates that Layer 2 connectivity is working (trunk allows both VLANs, SVIs are up/up), but inter-VLAN routing is failing. On a multilayer switch, inter-VLAN routing requires the global command 'ip routing' to enable the switch's IP routing engine; without it, the switch acts as a Layer 2 device only and cannot forward packets between different VLANs.

Answer

The VLAN 20 SVI is administratively shut down.

Answer

The trunk between the access switch and the Layer 3 switch is misconfigured as an access port.

Answer

The default gateway on Host A is configured incorrectly.