CCNA Switching and Network Access Practice Test 27 — 15 Questions

Question 1

An EtherChannel between SW1 and SW2 is not forming. The technician runs the show etherchannel summary command on both switches and sees that all configured interfaces are in the 'I' (stand-alone) state. Both switches have their interfaces configured with channel-group 1 mode active. What should the technician check next?

Accepted Answer

Check for a VLAN mismatch on the member interfaces (e.g., mismatched native VLAN or allowed VLAN list).. Option C is correct because when both switches are configured with channel-group 1 mode active, they are using LACP (active/active). The 'I' (stand-alone) state indicates the ports are not forming an EtherChannel despite LACP being enabled. A VLAN mismatch—such as differing native VLANs or allowed VLAN lists—can prevent LACP from successfully negotiating the bundle, as the control plane sees a Layer 2 inconsistency and keeps the ports in stand-alone mode.

Answer

Verify that both switches are using the same EtherChannel protocol (LACP or PAgP).

Answer

Check that the speed and duplex settings match on all member interfaces.

Answer

Determine whether Spanning Tree Protocol is blocking one of the ports.

Question 2

After configuring DHCP snooping on VLAN 10 to prevent rogue DHCP servers, all clients in the VLAN stop receiving DHCP offers from the legitimate DHCP server that is connected to port Gi0/1. The administrator verifies the DHCP server is operational and reachable. What should the technician do next?

Accepted Answer

Configure interface Gi0/1 as a DHCP snooping trusted port.. By default, DHCP snooping marks all ports as untrusted, which blocks DHCP server replies (including offers) from those ports. Since the legitimate server is connected to Gi0/1, the port must be explicitly trusted to allow DHCP offers through. This step directly addresses the Layer 2 access control mechanism.

Answer

Enable Dynamic ARP Inspection on VLAN 10.

Answer

Add an ip helper-address on the VLAN 10 SVI pointing to the DHCP server.

Answer

Reconfigure the DHCP server scope to include DHCP Option 82.

Question 3

Refer to the exhibit. A network administrator is troubleshooting connectivity to devices in VLAN 10 on a Layer 3 switch. The administrator issues the show ip interface brief command on SW1 and sees the output displayed. What is the most likely reason that the VLAN 10 SVI is not functioning?

Accepted Answer

No active ports are assigned to VLAN 10.. The exhibit shows the VLAN 10 SVI with Status 'down' and Protocol 'down'. In a Cisco Layer 3 switch, an SVI will only be up/up if the VLAN exists in the VLAN database and at least one active port (access or trunk) belongs to that VLAN and is in the Spanning Tree forwarding state. Since other SVIs (Vlan1, Vlan20) and physical interfaces are up/up, the most likely cause is that no ports are actively assigned to VLAN 10, leaving the VLAN inactive.

Answer

The VLAN 10 SVI has been administratively shut down.

Answer

The IP address configured on the VLAN 10 SVI is incorrect for the subnet.

Answer

The switch ports assigned to VLAN 10 are all configured as trunk ports.

Question 4

A network engineer notices that a newly connected switch-to-switch link is up, but traffic from multiple VLANs is not passing. When issuing the show interfaces trunk command, no trunk ports are listed. Both switch ports are configured with switchport mode dynamic auto. What is the most likely cause?

Accepted Answer

Both ports are set to dynamic auto, so neither switch initiates DTP negotiation.. When both ends of a link are set to switchport mode dynamic auto, neither switch will initiate DTP negotiation. Dynamic auto responds only to DTP requests; it never sends them. Therefore, no DTP messages are exchanged, and both ports silently remain in access mode. This explains why the link is up and passing traffic only for the access VLAN, and no trunk ports appear in the output. Other issues (native VLAN mismatch, straight-through cable, missing VLANs) do not prevent trunk formation—they affect operational behavior or management reporting but would still show a trunk interface if DTP negotiation succeeded.

Answer

There is a native VLAN mismatch between the two switches.

Answer

The connecting cable is a straight-through Ethernet cable rather than a crossover cable.

Answer

One switch lacks a VLAN that exists on the other switch.

Question 5

A host is physically connected to switch port Gi0/3. The technician runs 'show mac address-table' but does not find the host's MAC address for Gi0/3. The port status shows 'up/up', and the host was connected only a few minutes ago. What should the technician do next?

Accepted Answer

Verify the VLAN assignment on Gi0/3 using 'show vlan brief' or 'show interfaces Gi0/3 switchport'.. The MAC address table is learned per VLAN. If the port is assigned to a VLAN different from the one the technician expects, the host's MAC will be learned in that different VLAN and may not appear in the output shown. Checking the VLAN membership with 'show vlan' or 'show interfaces switchport' verifies the Layer 2 broadcast domain, which is the most likely reason the MAC is missing from the expected view.

Answer

Clear the MAC address table with 'clear mac address-table dynamic' to force immediate relearning.

Answer

Check the STP state of Gi0/3 with 'show spanning-tree interface Gi0/3' to ensure it is not blocking.

Answer

Inspect the ARP cache with 'show ip arp' to check for duplicate IP addresses.

Question 6

A network engineer notices that an uplink port on a distribution switch has moved to a root-inconsistent state and is blocking traffic. The port is configured with Root Guard and is connected to a new access switch. The new access switch has a lower bridge priority than the current root bridge. What is the most likely cause?

Accepted Answer

Root Guard has placed the port into root-inconsistent state because the new switch advertised a superior BPDU.. The port moved to root-inconsistent because Root Guard is enabled. Root Guard detects superior BPDUs (lower bridge ID) and immediately places the port in a broken state (root-inconsistent) to prevent the new switch from becoming the root bridge, thereby blocking traffic. This matches the symptom perfectly. Other features would manifest differently.

Answer

BPDU Guard has errdisabled the port because a BPDU was received on an access port.

Answer

BPDU Filter is blocking inbound BPDUs, causing the switch to fail to detect the topology change and isolate the port.

Answer

Loop Guard has detected a unidirectional link and placed the port in a blocking state to prevent a loop.

Question 7

An IP phone connected to switch port Gi0/4 is working and receiving calls, but the PC connected to the phone's data port cannot obtain an IP address. The technician confirms that interface Gi0/4 has switchport mode access and shows switchport access vlan 10 and switchport voice vlan 100. What should the technician do next?

Accepted Answer

Verify the IP phone's passthrough mode for the PC port.. The switch port is correctly configured with the appropriate access VLAN (10) for data and voice VLAN (100). Since the phone itself is functional, the issue is likely in how the phone tags or forwards the PC's untagged frames. The phone's internal switch must be set to passthrough mode to bridge the PC traffic onto the access VLAN. Verifying this setting will identify if the phone is misconfigured, causing the PC to be placed in the wrong VLAN or isolated.

Answer

Verify the DHCP scope for VLAN 10 on the DHCP server.

Answer

Verify that CDP is enabled on the IP phone.

Answer

Verify the QoS trust state on the switch port.

Question 8

Refer to the exhibit. A network administrator runs the show vlan brief command on SW2. Interface GigabitEthernet0/2 is intended to be an access port in VLAN 10, but it does not appear in the output. What is the most likely cause?

Accepted Answer

The interface is configured as a trunk port and therefore does not appear under any VLAN in show vlan brief.. The show vlan brief command lists only access ports that are statically or dynamically assigned to a VLAN. Trunk ports carry traffic for multiple VLANs and are not displayed in this table. The absence of GigabitEthernet0/2, despite VLAN 10 being active and containing other ports, indicates that the interface is likely operating as a trunk port.

Answer

The interface is configured with switchport mode dynamic auto and no trunk has been negotiated, causing it to be hidden.

Answer

The interface is administratively shut down, and down ports are excluded from the show vlan brief output.

Answer

VLAN 10 is not active, so the port assigned to it is not displayed in the listing.

Question 9

After configuring a trunk port to allow VLAN 40, a technician finds that VLAN 40 is not listed among the VLANs in spanning tree forwarding state in the show interfaces trunk output. What is the most likely cause?

Accepted Answer

VLAN 40 has not been created in the VLAN database on the switch.. Even if a VLAN is included in the trunk's allowed list, the switch cannot forward frames for that VLAN unless it exists in the local VLAN database. A non-existent VLAN is placed in a pruned state and will not appear as forwarding in show interfaces trunk. The allowed-list command worked, but the missing VLAN definition prevents the VLAN from being active on the trunk.

Answer

The trunk port is using ISL encapsulation, which does not support VLAN 40.

Answer

The technician omitted the 'add' keyword when adding VLAN 40 to the allowed list, so the trunk no longer permits VLAN 40.

Answer

VTP pruning is enabled, and VLAN 40 is not needed by any downstream neighbor, so it is pruned from this trunk.

Question 10

A technician is troubleshooting a network-wide broadcast storm that has caused severe performance issues. The technician notices that BPDU guard is globally enabled on the access layer switch, but no ports are in an err-disabled state. All access ports have PortFast enabled. What is the most likely cause?

Accepted Answer

BPDU filter is globally enabled, causing the switch to suppress BPDUs on PortFast ports and preventing BPDU guard from triggering.. When BPDU filter is enabled globally on a switch, it enables PortFast on all access ports and also prevents those ports from sending or receiving BPDUs. If a rogue switch is then connected to such a port, the switch does not detect any BPDU from it, so BPDU guard never triggers despite being enabled globally. This allows the rogue switch to create a bridging loop without STP intervention, leading to a broadcast storm.

Answer

Spanning tree is disabled globally, allowing the rogue switch to create a loop.

Answer

BPDU guard is misconfigured on the wrong ports, so it failed to block the rogue switch.

Answer

Root guard is incorrectly enabled on the access ports, causing the rogue switch to become the root bridge.

Question 11

Refer to the exhibit. A network engineer notices that on a four-link EtherChannel bundle between two switches, all traffic from a particular VLAN is being forwarded over only one physical link, while the other three links remain idle. The engineer suspects a load-balancing issue and issues the show etherchannel load-balance command, the output of which is shown. What is the most likely cause of the uneven traffic distribution?

Accepted Answer

The switch is using source‑MAC‑address load balancing, and multiple end hosts are appearing with the same source MAC address.. The exhibit shows the load-balancing method is 'src-mac'. When source-MAC-based hashing is used, all frames with the same source MAC address egress the same physical member link. If multiple end hosts are behind a router or proxy and appear with identical source MAC, the hash algorithm always selects the same link, leaving the other links in the bundle idle.

Answer

The EtherChannel is misconfigured with an LACP active/passive mode mismatch, forcing only one link to bundle.

Answer

VLAN pruning on the trunk has removed the VLAN from three of the four member interfaces.

Answer

Spanning Tree Protocol has blocked three of the four links in the EtherChannel because they form a loop.

Question 12

Users report that their PCs take over 30 seconds to obtain IP addresses and reach the network after being powered on. A network technician checks a switch port connected to a PC and observes that the port transitions through blocking, listening, learning, and then forwarding states, taking about 30 seconds to complete. The switch is running standard 802.1D STP. The technician confirms the port is an access port and only connects to a PC. What should the technician do next?

Accepted Answer

Enable PortFast on the access port.. The correct next action is to enable PortFast on the access port. PortFast allows a port to immediately transition to the forwarding state, bypassing the listening and learning phases, which is safe because the port connects only to an end device and cannot create a bridging loop. This directly resolves the 30-second boot-time delay without making network-wide changes.

Answer

Reduce the STP forward delay timer globally on the switch.

Answer

Disable STP on the access VLAN assigned to the port.

Answer

Enable Rapid PVST+ on the switch.

Question 13

A network engineer notices that a root port on a switch has transitioned to a loop-inconsistent state. The port was previously receiving BPDUs normally, but after a suspected unidirectional fiber cut, it no longer receives BPDUs. What is the most likely cause?

Accepted Answer

Loop Guard is active on the root port and transitioned it to loop-inconsistent state upon BPDU loss.. Loop Guard is an STP enhancement that monitors the reception of BPDUs on a blocked port. When BPDUs stop arriving (due to a unidirectional link failure), Loop Guard moves the port to loop-inconsistent state, preventing it from transitioning to the forwarding state and thus avoiding a switching loop.

Answer

BPDU Guard is enabled on the port, causing it to be placed in error-disabled state.

Answer

UDLD has detected a unidirectional link and has shut down the port.

Answer

Root Guard is preventing the port from transitioning to designated forwarding after losing BPDUs.

Question 14

Refer to the exhibit. A network administrator is troubleshooting a trunk link between SW1 and SW2. The trunk on interface GigabitEthernet0/0 on SW1 is not passing traffic, and all VLANs are isolated. The administrator issues the command 'show interfaces GigabitEthernet0/0 trunk' on SW1. What is the most likely cause of the issue?

Accepted Answer

The trunk encapsulation is set to ISL on SW1, but the peer switch only supports 802.1Q.. The 'show interfaces GigabitEthernet0/0 trunk' output explicitly displays encapsulation 'isl' and status 'not-trunking'. This indicates that the port is configured for ISL encapsulation, but the trunk is not operational. Since the peer switch only supports 802.1Q, the encapsulation mismatch prevents the trunk from forming, causing the traffic isolation.

Answer

The native VLAN is mismatched between SW1 and SW2.

Answer

The interface is configured as an access port instead of a trunk.

Answer

The interface is administratively shut down.

Question 15

A network technician is troubleshooting an inter-VLAN routing issue on a multilayer switch. Hosts on VLAN 10 can reach the SVI for VLAN 10 (10.0.10.1) but cannot reach hosts on VLAN 20. The technician has verified that 'ip routing' is enabled and that the 'show ip route' command displays directly connected routes for both VLANs. No static routes are configured. What should the technician do next?

Accepted Answer

Check the ARP table for entries on VLAN 20.. Because the switch has directly connected routes for both VLANs and routing is enabled, the Layer 3 forwarding logic is intact. The failure from VLAN 10 hosts to VLAN 20 hosts suggests that the switch cannot resolve the destination host's MAC address on VLAN 20, preventing Layer 2 frame encapsulation. Checking the ARP table with 'show ip arp' or similar will reveal whether the destination IPv4 address has a valid MAC entry on the correct VLAN interface. This targets Layer 2—the most likely remaining failure point after Layer 3 has been verified.

Answer

Issue the 'show ip routing' command again to confirm routing is enabled.

Answer

Configure a default route pointing to the next-hop gateway.

Answer

Verify the VLAN membership of the destination host on VLAN 20.