CCNA Switching and Network Access Practice Test 27 — 15 Questions

Question 1

After connecting a new switch to interface GigabitEthernet1/0/1 on a distribution switch, a network engineer notices that the interface is in err-disable state. The engineer checks the configuration and finds that spanning-tree portfast and spanning-tree bpduguard enable are applied to the interface. What is the most likely cause of the err-disable state?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Spanning-tree PortFast is enabled on a port that connects to another switch.. PortFast is designed for end-host ports that should not receive BPDUs. When PortFast is enabled on a port connecting to another switch, the switch will immediately transition the port to forwarding state, but if it then receives a BPDU from the connected switch, BPDU Guard will error-disable the port. This is the most common cause of err-disable state when both PortFast and BPDU Guard are configured on an inter-switch link.

Answer

BPDU Guard was incorrectly enabled on a port that should be a trunk link.

Answer

The connected switch is sending BPDUs with a lower bridge priority.

Answer

The port is configured as an access port, but should be a trunk.

Question 2

A network engineer notices that Host A in VLAN 10 (10.10.10.50/24) can successfully ping its default gateway 10.10.10.1, but cannot ping the VLAN 20 SVI (10.20.20.1) or any hosts in VLAN 20. The SVIs for both VLAN 10 and VLAN 20 are in an up/up state, and the switch's trunk ports are correctly allowing both VLANs. What is the most likely cause?

Accepted Answer

The ip routing global configuration command is missing.. Host A can reach its default gateway (10.10.10.1), which is the VLAN 10 SVI, but cannot reach the VLAN 20 SVI (10.20.20.1) or any hosts in VLAN 20. This indicates that Layer 2 connectivity is working (trunk allows both VLANs, SVIs are up/up), but inter-VLAN routing is failing. On a multilayer switch, inter-VLAN routing requires the global command 'ip routing' to enable the switch's IP routing engine; without it, the switch acts as a Layer 2 device only and cannot forward packets between different VLANs.

Answer

The VLAN 20 SVI is administratively shut down.

Answer

The trunk between the access switch and the Layer 3 switch is misconfigured as an access port.

Answer

The default gateway on Host A is configured incorrectly.

Question 3

An EtherChannel between SW1 and SW2 is not forming. The technician runs the show etherchannel summary command on both switches and sees that all configured interfaces are in the 'I' (stand-alone) state. Both switches have their interfaces configured with channel-group 1 mode active. What should the technician check next?

Accepted Answer

Check for a VLAN mismatch on the member interfaces (e.g., mismatched native VLAN or allowed VLAN list).. When both switches are configured with channel-group 1 mode active, they are using LACP (active/active). The 'I' (stand-alone) state indicates the ports are not forming an EtherChannel despite LACP being enabled. A VLAN mismatch—such as differing native VLANs or allowed VLAN lists—can prevent LACP from successfully negotiating the bundle, as the control plane sees a Layer 2 inconsistency and keeps the ports in stand-alone mode.

Answer

Verify that both switches are using the same EtherChannel protocol (LACP or PAgP).

Answer

Check that the speed and duplex settings match on all member interfaces.

Answer

Determine whether Spanning Tree Protocol is blocking one of the ports.

Question 4

After configuring DHCP snooping on VLAN 10 to prevent rogue DHCP servers, all clients in the VLAN stop receiving DHCP offers from the legitimate DHCP server that is connected to port Gi0/1. The administrator verifies the DHCP server is operational and reachable. What should the technician do next?

Accepted Answer

Configure interface Gi0/1 as a DHCP snooping trusted port.. DHCP snooping, by default, treats all ports as untrusted and drops DHCP server messages (OFFER, ACK) received on untrusted ports. Since the legitimate DHCP server is connected to Gi0/1, that port must be explicitly configured as a DHCP snooping trusted port using the 'ip dhcp snooping trust' interface command to allow DHCP server responses to reach clients.

Answer

Enable Dynamic ARP Inspection on VLAN 10.

Answer

Add an ip helper-address on the VLAN 10 SVI pointing to the DHCP server.

Answer

Reconfigure the DHCP server scope to include DHCP Option 82.

Question 5

Refer to the exhibit. A network administrator is troubleshooting connectivity to devices in VLAN 10 on a Layer 3 switch. The administrator issues the show ip interface brief command on SW1 and sees the output displayed. What is the most likely reason that the VLAN 10 SVI is not functioning?

Accepted Answer

No active ports are assigned to VLAN 10.. The VLAN 10 SVI will remain in a down/down state if there are no active ports assigned to VLAN 10, because a Layer 3 switch requires at least one active Layer 2 interface in the VLAN to bring the SVI up. This is a fundamental behavior of Cisco switches: the SVI is operationally down until the VLAN has at least one active port in a non-blocking state. The show ip interface brief output would show the VLAN10 interface as 'down/down' rather than 'administratively down' or 'up/up'.

Answer

The VLAN 10 SVI has been administratively shut down.

Answer

The IP address configured on the VLAN 10 SVI is incorrect for the subnet.

Answer

The switch ports assigned to VLAN 10 are all configured as trunk ports.

Question 6

A network engineer notices that a newly connected switch-to-switch link is up, but traffic from multiple VLANs is not passing. When issuing the show interfaces trunk command, no trunk ports are listed. Both switch ports are configured with switchport mode dynamic auto. What is the most likely cause?

Accepted Answer

Both ports are set to dynamic auto, so neither switch initiates DTP negotiation.. When both switch ports are configured with switchport mode dynamic auto, neither actively initiates Dynamic Trunking Protocol (DTP) negotiation. DTP dynamic auto ports wait for the other side to send DTP frames to form a trunk; since both sides are passive, the link remains in access mode and does not become a trunk, preventing traffic from multiple VLANs from passing.

Answer

There is a native VLAN mismatch between the two switches.

Answer

The connecting cable is a straight-through Ethernet cable rather than a crossover cable.

Answer

One switch lacks a VLAN that exists on the other switch.

Question 7

A host is physically connected to switch port Gi0/3. The technician runs 'show mac address-table' but does not find the host's MAC address for Gi0/3. The port status shows 'up/up', and the host was connected only a few minutes ago. What should the technician do next?

Accepted Answer

Verify the VLAN assignment on Gi0/3 using 'show vlan brief' or 'show interfaces Gi0/3 switchport'.. The most likely reason a newly connected host's MAC address does not appear in the MAC address table is that the switch port is in the wrong VLAN or is administratively configured as an access port in a VLAN that does not match the host's expected VLAN. The 'show vlan brief' command verifies VLAN existence and port membership, while 'show interfaces Gi0/3 switchport' confirms the operational VLAN assignment. Since the port is up/up and the host was connected only minutes ago, the switch should have learned the MAC address via normal flooding; its absence points to a VLAN mismatch or port configuration issue, not a stale table or STP blocking.

Answer

Clear the MAC address table with 'clear mac address-table dynamic' to force immediate relearning.

Answer

Check the STP state of Gi0/3 with 'show spanning-tree interface Gi0/3' to ensure it is not blocking.

Answer

Inspect the ARP cache with 'show ip arp' to check for duplicate IP addresses.

Question 8

A network engineer notices that an uplink port on a distribution switch has moved to a root-inconsistent state and is blocking traffic. The port is configured with Root Guard and is connected to a new access switch. The new access switch has a lower bridge priority than the current root bridge. What is the most likely cause?

Accepted Answer

Root Guard has placed the port into root-inconsistent state because the new switch advertised a superior BPDU.. Root Guard is configured on the uplink port of the distribution switch. When the new access switch advertises a superior BPDU (lower bridge priority than the current root bridge), Root Guard places the port into a root-inconsistent state to prevent the distribution switch from accepting the new switch as the root bridge. This blocks traffic on that port to protect the spanning-tree topology.

Answer

BPDU Guard has errdisabled the port because a BPDU was received on an access port.

Answer

BPDU Filter is blocking inbound BPDUs, causing the switch to fail to detect the topology change and isolate the port.

Answer

Loop Guard has detected a unidirectional link and placed the port in a blocking state to prevent a loop.

Question 9

An IP phone connected to switch port Gi0/4 is working and receiving calls, but the PC connected to the phone's data port cannot obtain an IP address. The technician confirms that interface Gi0/4 has switchport mode access and shows switchport access vlan 10 and switchport voice vlan 100. What should the technician do next?

Accepted Answer

Verify the IP phone's passthrough mode for the PC port.. The PC connected to the IP phone's data port cannot obtain an IP address because the phone's internal switch (passthrough mode) is likely not forwarding traffic from the PC port to the upstream switch. The switch port is correctly configured with access VLAN 10 for data and voice VLAN 100 for voice, so the issue is not with the switch configuration but with the phone's ability to pass data traffic. Verifying the IP phone's passthrough mode ensures the PC port is enabled and forwarding frames to the switch.

Answer

Verify the DHCP scope for VLAN 10 on the DHCP server.

Answer

Verify that CDP is enabled on the IP phone.

Answer

Verify the QoS trust state on the switch port.

Question 10

Refer to the exhibit. A network administrator runs the show vlan brief command on SW2. Interface GigabitEthernet0/2 is intended to be an access port in VLAN 10, but it does not appear in the output. What is the most likely cause?

Accepted Answer

The interface is configured as a trunk port and therefore does not appear under any VLAN in show vlan brief.. The `show vlan brief` command displays only access ports and their assigned VLANs. Trunk ports, which carry multiple VLANs, are not listed in this output. If GigabitEthernet0/2 is configured as a trunk port (e.g., with `switchport mode trunk` or dynamically via DTP), it will not appear under any VLAN in the `show vlan brief` output, even if it is intended to be an access port in VLAN 10.

Answer

The interface is configured with switchport mode dynamic auto and no trunk has been negotiated, causing it to be hidden.

Answer

The interface is administratively shut down, and down ports are excluded from the show vlan brief output.

Answer

VLAN 10 is not active, so the port assigned to it is not displayed in the listing.

Question 11

After configuring a trunk port to allow VLAN 40, a technician finds that VLAN 40 is not listed among the VLANs in spanning tree forwarding state in the show interfaces trunk output. What is the most likely cause?

Accepted Answer

VLAN 40 has not been created in the VLAN database on the switch.. VLAN 40 must exist in the local VLAN database before it can participate in spanning tree on a trunk port. Even if the trunk is configured to allow VLAN 40, if the VLAN has not been created on the switch, the spanning tree protocol will not place it in a forwarding state. The 'show interfaces trunk' output will list only VLANs that are both allowed and existent, so the absence of VLAN 40 in the forwarding state indicates it was never created.

Answer

The trunk port is using ISL encapsulation, which does not support VLAN 40.

Answer

The technician omitted the 'add' keyword when adding VLAN 40 to the allowed list, so the trunk no longer permits VLAN 40.

Answer

VTP pruning is enabled, and VLAN 40 is not needed by any downstream neighbor, so it is pruned from this trunk.

Question 12

A technician is troubleshooting a network-wide broadcast storm that has caused severe performance issues. The technician notices that BPDU guard is globally enabled on the access layer switch, but no ports are in an err-disabled state. All access ports have PortFast enabled. What is the most likely cause?

Accepted Answer

BPDU filter is globally enabled, causing the switch to suppress BPDUs on PortFast ports and preventing BPDU guard from triggering.. BPDU guard places a port in err-disabled state upon receiving a BPDU, but BPDU filter globally enabled on PortFast ports suppresses both sending and receiving BPDUs. Since BPDU filter prevents BPDUs from being received, BPDU guard never triggers, allowing a rogue switch to participate in spanning tree and potentially cause a broadcast storm.

Answer

Spanning tree is disabled globally, allowing the rogue switch to create a loop.

Answer

BPDU guard is misconfigured on the wrong ports, so it failed to block the rogue switch.

Answer

Root guard is incorrectly enabled on the access ports, causing the rogue switch to become the root bridge.

Question 13

Refer to the exhibit. A network engineer notices that on a four-link EtherChannel bundle between two switches, all traffic from a particular VLAN is being forwarded over only one physical link, while the other three links remain idle. The engineer suspects a load-balancing issue and issues the show etherchannel load-balance command, the output of which is shown. What is the most likely cause of the uneven traffic distribution?

Accepted Answer

The switch is using source‑MAC‑address load balancing, and multiple end hosts are appearing with the same source MAC address.. The output of 'show etherchannel load-balance' indicates the switch is using source-MAC-address load balancing. With this method, all frames from a given source MAC address are hashed to the same physical link. If multiple end hosts in the VLAN are actually behind a single upstream router or firewall that uses the same source MAC address for all traffic (e.g., due to proxy ARP or NAT), then all traffic from that VLAN will be pinned to one link, leaving the other three idle.

Answer

The EtherChannel is misconfigured with an LACP active/passive mode mismatch, forcing only one link to bundle.

Answer

VLAN pruning on the trunk has removed the VLAN from three of the four member interfaces.

Answer

Spanning Tree Protocol has blocked three of the four links in the EtherChannel because they form a loop.

Question 14

Users report that their PCs take over 30 seconds to obtain IP addresses and reach the network after being powered on. A network technician checks a switch port connected to a PC and observes that the port transitions through blocking, listening, learning, and then forwarding states, taking about 30 seconds to complete. The switch is running standard 802.1D STP. The technician confirms the port is an access port and only connects to a PC. What should the technician do next?

Accepted Answer

Enable PortFast on the access port.. The 30-second delay is caused by the standard 802.1D STP port states (blocking → listening → learning → forwarding). Since the port is an access port connecting only to a PC (an end host), there is no risk of a bridging loop. Enabling PortFast immediately transitions the port to the forwarding state, bypassing the listening and learning states and eliminating the delay.

Answer

Reduce the STP forward delay timer globally on the switch.

Answer

Disable STP on the access VLAN assigned to the port.

Answer

Enable Rapid PVST+ on the switch.

Question 15

A network engineer notices that a root port on a switch has transitioned to a loop-inconsistent state. The port was previously receiving BPDUs normally, but after a suspected unidirectional fiber cut, it no longer receives BPDUs. What is the most likely cause?

Accepted Answer

Loop Guard is active on the root port and transitioned it to loop-inconsistent state upon BPDU loss.. Loop Guard is a Spanning Tree Protocol (STP) enhancement that prevents alternate or root ports from becoming designated forwarding ports when BPDUs are no longer received. When a unidirectional fiber cut causes BPDU loss on a root port, Loop Guard transitions the port to the loop-inconsistent state, blocking traffic until BPDUs are received again. This matches the scenario exactly, making option B correct.

Answer

BPDU Guard is enabled on the port, causing it to be placed in error-disabled state.

Answer

UDLD has detected a unidirectional link and has shut down the port.

Answer

Root Guard is preventing the port from transitioning to designated forwarding after losing BPDUs.