CCNA Switching and Network Access Practice Test 27 — 15 Questions

Question 1

Refer to the exhibit. A network administrator is troubleshooting connectivity issues for hosts on VLAN 50 on SW1. The hosts on VLAN 50 cannot reach any devices outside SW1, even though the trunk link between SW1 and SW2 is up. The administrator issues the 'show interfaces GigabitEthernet0/1 trunk' command on SW1. Based on the output, what is the most likely cause of the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

VLAN 50 is not in the allowed VLAN list on the trunk.. The 'show interfaces GigabitEthernet0/1 trunk' output would list the allowed VLANs on the trunk. If VLAN 50 is not included in the allowed VLAN list, traffic from VLAN 50 will be dropped at the trunk, preventing hosts on SW1 from reaching devices outside SW1. This is the most likely cause because the trunk is up but VLAN 50 traffic is not forwarded.

Answer

The native VLAN on the trunk is misconfigured, causing VLAN 50 traffic to be dropped.

Answer

The trunk is operating in access mode instead of trunk mode, preventing VLAN 50 traffic.

Answer

Spanning tree protocol has blocked the trunk port for VLAN 50, isolating the hosts.

Question 2

Refer to the exhibit. A network engineer is troubleshooting a connectivity issue on SW3. A host connected to the same segment as SW3's GigabitEthernet0/0 interface cannot reach any network resources. The engineer issues the show spanning-tree vlan 10 command and receives the output shown. Based on the output, what is the most likely cause?

Accepted Answer

The interface GigabitEthernet0/0 is in the Blocking state because it received a superior BPDU, making it an alternate port to the root bridge.. The output shows that GigabitEthernet0/0 is in the Blocking state for VLAN 10. In Rapid PVST+ or classic STP, a port enters the Blocking state when it receives a superior BPDU (i.e., a BPDU with a lower bridge ID or lower path cost to the root), causing it to become an alternate (or backup) port rather than a designated or root port. This prevents the host from reaching network resources because the port does not forward traffic.

Answer

GigabitEthernet0/0 is administratively down, which prevents the host from communicating.

Answer

The port is in the Blocking state because the switch detected a loop and moved the port to error-disabled state.

Answer

The port is blocked because SW3 has a lower bridge priority than the root bridge and should be the designated port for that segment.

Question 3

After connecting a new switch to interface GigabitEthernet1/0/1 on a distribution switch, a network engineer notices that the interface is in err-disable state. The engineer checks the configuration and finds that spanning-tree portfast and spanning-tree bpduguard enable are applied to the interface. What is the most likely cause of the err-disable state?

Accepted Answer

Spanning-tree PortFast is enabled on a port that connects to another switch.. PortFast is designed for end-host ports that should not receive BPDUs. When PortFast is enabled on a port connecting to another switch, the switch will immediately transition the port to forwarding state, but if it then receives a BPDU from the connected switch, BPDU Guard will error-disable the port. This is the most common cause of err-disable state when both PortFast and BPDU Guard are configured on an inter-switch link.

Answer

BPDU Guard was incorrectly enabled on a port that should be a trunk link.

Answer

The connected switch is sending BPDUs with a lower bridge priority.

Answer

The port is configured as an access port, but should be a trunk.

Question 4

A network engineer notices that Host A in VLAN 10 (10.10.10.50/24) can successfully ping its default gateway 10.10.10.1, but cannot ping the VLAN 20 SVI (10.20.20.1) or any hosts in VLAN 20. The SVIs for both VLAN 10 and VLAN 20 are in an up/up state, and the switch's trunk ports are correctly allowing both VLANs. What is the most likely cause?

Accepted Answer

The ip routing global configuration command is missing.. Host A can reach its default gateway (10.10.10.1), which is the VLAN 10 SVI, but cannot reach the VLAN 20 SVI (10.20.20.1) or any hosts in VLAN 20. This indicates that Layer 2 connectivity is working (trunk allows both VLANs, SVIs are up/up), but inter-VLAN routing is failing. On a multilayer switch, inter-VLAN routing requires the global command 'ip routing' to enable the switch's IP routing engine; without it, the switch acts as a Layer 2 device only and cannot forward packets between different VLANs.

Answer

The VLAN 20 SVI is administratively shut down.

Answer

The trunk between the access switch and the Layer 3 switch is misconfigured as an access port.

Answer

The default gateway on Host A is configured incorrectly.

Question 5

An EtherChannel between SW1 and SW2 is not forming. The technician runs the show etherchannel summary command on both switches and sees that all configured interfaces are in the 'I' (stand-alone) state. Both switches have their interfaces configured with channel-group 1 mode active. What should the technician check next?

Accepted Answer

Check for a VLAN mismatch on the member interfaces (e.g., mismatched native VLAN or allowed VLAN list).. When both switches are configured with channel-group 1 mode active, they are using LACP (active/active). The 'I' (stand-alone) state indicates the ports are not forming an EtherChannel despite LACP being enabled. A VLAN mismatch—such as differing native VLANs or allowed VLAN lists—can prevent LACP from successfully negotiating the bundle, as the control plane sees a Layer 2 inconsistency and keeps the ports in stand-alone mode.

Answer

Verify that both switches are using the same EtherChannel protocol (LACP or PAgP).

Answer

Check that the speed and duplex settings match on all member interfaces.

Answer

Determine whether Spanning Tree Protocol is blocking one of the ports.

Question 6

After configuring DHCP snooping on VLAN 10 to prevent rogue DHCP servers, all clients in the VLAN stop receiving DHCP offers from the legitimate DHCP server that is connected to port Gi0/1. The administrator verifies the DHCP server is operational and reachable. What should the technician do next?

Accepted Answer

Configure interface Gi0/1 as a DHCP snooping trusted port.. DHCP snooping, by default, treats all ports as untrusted and drops DHCP server messages (OFFER, ACK) received on untrusted ports. Since the legitimate DHCP server is connected to Gi0/1, that port must be explicitly configured as a DHCP snooping trusted port using the 'ip dhcp snooping trust' interface command to allow DHCP server responses to reach clients.

Answer

Enable Dynamic ARP Inspection on VLAN 10.

Answer

Add an ip helper-address on the VLAN 10 SVI pointing to the DHCP server.

Answer

Reconfigure the DHCP server scope to include DHCP Option 82.

Question 7

Refer to the exhibit. A network administrator is troubleshooting connectivity issues for hosts on VLAN 50 on SW1. The hosts on VLAN 50 cannot reach any devices outside SW1, even though the trunk link between SW1 and SW2 is up. The administrator issues the 'show interfaces GigabitEthernet0/1 trunk' command on SW1. Based on the output, what is the most likely cause of the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

No active ports are assigned to VLAN 10.. The VLAN 10 SVI will remain in a down/down state if there are no active ports assigned to VLAN 10, because a Layer 3 switch requires at least one active Layer 2 interface in the VLAN to bring the SVI up. This is a fundamental behavior of Cisco switches: the SVI is operationally down until the VLAN has at least one active port in a non-blocking state. The show ip interface brief output would show the VLAN10 interface as 'down/down' rather than 'administratively down' or 'up/up'.

Answer

The VLAN 10 SVI has been administratively shut down.

Answer

The IP address configured on the VLAN 10 SVI is incorrect for the subnet.

Answer

The switch ports assigned to VLAN 10 are all configured as trunk ports.

Question 8

A network engineer notices that a newly connected switch-to-switch link is up, but traffic from multiple VLANs is not passing. When issuing the show interfaces trunk command, no trunk ports are listed. Both switch ports are configured with switchport mode dynamic auto. What is the most likely cause?

Accepted Answer

Both ports are set to dynamic auto, so neither switch initiates DTP negotiation.. When both switch ports are configured with switchport mode dynamic auto, neither actively initiates Dynamic Trunking Protocol (DTP) negotiation. DTP dynamic auto ports wait for the other side to send DTP frames to form a trunk; since both sides are passive, the link remains in access mode and does not become a trunk, preventing traffic from multiple VLANs from passing.

Answer

There is a native VLAN mismatch between the two switches.

Answer

The connecting cable is a straight-through Ethernet cable rather than a crossover cable.

Answer

One switch lacks a VLAN that exists on the other switch.

Question 9

A host is physically connected to switch port Gi0/3. The technician runs 'show mac address-table' but does not find the host's MAC address for Gi0/3. The port status shows 'up/up', and the host was connected only a few minutes ago. What should the technician do next?

Accepted Answer

Verify the VLAN assignment on Gi0/3 using 'show vlan brief' or 'show interfaces Gi0/3 switchport'.. The most likely reason a newly connected host's MAC address does not appear in the MAC address table is that the switch port is in the wrong VLAN or is administratively configured as an access port in a VLAN that does not match the host's expected VLAN. The 'show vlan brief' command verifies VLAN existence and port membership, while 'show interfaces Gi0/3 switchport' confirms the operational VLAN assignment. Since the port is up/up and the host was connected only minutes ago, the switch should have learned the MAC address via normal flooding; its absence points to a VLAN mismatch or port configuration issue, not a stale table or STP blocking.

Answer

Clear the MAC address table with 'clear mac address-table dynamic' to force immediate relearning.

Answer

Check the STP state of Gi0/3 with 'show spanning-tree interface Gi0/3' to ensure it is not blocking.

Answer

Inspect the ARP cache with 'show ip arp' to check for duplicate IP addresses.

Question 10

A network engineer notices that an uplink port on a distribution switch has moved to a root-inconsistent state and is blocking traffic. The port is configured with Root Guard and is connected to a new access switch. The new access switch has a lower bridge priority than the current root bridge. What is the most likely cause?

Accepted Answer

Root Guard has placed the port into root-inconsistent state because the new switch advertised a superior BPDU.. Root Guard is configured on the uplink port of the distribution switch. When the new access switch advertises a superior BPDU (lower bridge priority than the current root bridge), Root Guard places the port into a root-inconsistent state to prevent the distribution switch from accepting the new switch as the root bridge. This blocks traffic on that port to protect the spanning-tree topology.

Answer

BPDU Guard has errdisabled the port because a BPDU was received on an access port.

Answer

BPDU Filter is blocking inbound BPDUs, causing the switch to fail to detect the topology change and isolate the port.

Answer

Loop Guard has detected a unidirectional link and placed the port in a blocking state to prevent a loop.

Question 11

An IP phone connected to switch port Gi0/4 is working and receiving calls, but the PC connected to the phone's data port cannot obtain an IP address. The technician confirms that interface Gi0/4 has switchport mode access and shows switchport access vlan 10 and switchport voice vlan 100. What should the technician do next?

Accepted Answer

Verify the IP phone's passthrough mode for the PC port.. The PC connected to the IP phone's data port cannot obtain an IP address because the phone's internal switch (passthrough mode) is likely not forwarding traffic from the PC port to the upstream switch. The switch port is correctly configured with access VLAN 10 for data and voice VLAN 100 for voice, so the issue is not with the switch configuration but with the phone's ability to pass data traffic. Verifying the IP phone's passthrough mode ensures the PC port is enabled and forwarding frames to the switch.

Answer

Verify the DHCP scope for VLAN 10 on the DHCP server.

Answer

Verify that CDP is enabled on the IP phone.

Answer

Verify the QoS trust state on the switch port.

Question 12

Refer to the exhibit. A network administrator runs the show vlan brief command on SW2. Interface GigabitEthernet0/2 is intended to be an access port in VLAN 10, but it does not appear in the output. What is the most likely cause?

Accepted Answer

The interface is configured as a trunk port and therefore does not appear under any VLAN in show vlan brief.. The `show vlan brief` command displays only access ports and their assigned VLANs. Trunk ports, which carry multiple VLANs, are not listed in this output. If GigabitEthernet0/2 is configured as a trunk port (e.g., with `switchport mode trunk` or dynamically via DTP), it will not appear under any VLAN in the `show vlan brief` output, even if it is intended to be an access port in VLAN 10.

Answer

The interface is configured with switchport mode dynamic auto and no trunk has been negotiated, causing it to be hidden.

Answer

The interface is administratively shut down, and down ports are excluded from the show vlan brief output.

Answer

VLAN 10 is not active, so the port assigned to it is not displayed in the listing.

Question 13

After configuring a trunk port to allow VLAN 40, a technician finds that VLAN 40 is not listed among the VLANs in spanning tree forwarding state in the show interfaces trunk output. What is the most likely cause?

Accepted Answer

VLAN 40 has not been created in the VLAN database on the switch.. VLAN 40 must exist in the local VLAN database before it can participate in spanning tree on a trunk port. Even if the trunk is configured to allow VLAN 40, if the VLAN has not been created on the switch, the spanning tree protocol will not place it in a forwarding state. The 'show interfaces trunk' output will list only VLANs that are both allowed and existent, so the absence of VLAN 40 in the forwarding state indicates it was never created.

Answer

The trunk port is using ISL encapsulation, which does not support VLAN 40.

Answer

The technician omitted the 'add' keyword when adding VLAN 40 to the allowed list, so the trunk no longer permits VLAN 40.

Answer

VTP pruning is enabled, and VLAN 40 is not needed by any downstream neighbor, so it is pruned from this trunk.

Question 14

A technician is troubleshooting a network-wide broadcast storm that has caused severe performance issues. The technician notices that BPDU guard is globally enabled on the access layer switch, but no ports are in an err-disabled state. All access ports have PortFast enabled. What is the most likely cause?

Accepted Answer

BPDU filter is globally enabled, causing the switch to suppress BPDUs on PortFast ports and preventing BPDU guard from triggering.. BPDU guard places a port in err-disabled state upon receiving a BPDU, but BPDU filter globally enabled on PortFast ports suppresses both sending and receiving BPDUs. Since BPDU filter prevents BPDUs from being received, BPDU guard never triggers, allowing a rogue switch to participate in spanning tree and potentially cause a broadcast storm.

Answer

Spanning tree is disabled globally, allowing the rogue switch to create a loop.

Answer

BPDU guard is misconfigured on the wrong ports, so it failed to block the rogue switch.

Answer

Root guard is incorrectly enabled on the access ports, causing the rogue switch to become the root bridge.

Question 15

Refer to the exhibit. A network engineer notices that on a four-link EtherChannel bundle between two switches, all traffic from a particular VLAN is being forwarded over only one physical link, while the other three links remain idle. The engineer suspects a load-balancing issue and issues the show etherchannel load-balance command, the output of which is shown. What is the most likely cause of the uneven traffic distribution?

Accepted Answer

The switch is using source‑MAC‑address load balancing, and multiple end hosts are appearing with the same source MAC address.. The output of 'show etherchannel load-balance' indicates the switch is using source-MAC-address load balancing. With this method, all frames from a given source MAC address are hashed to the same physical link. If multiple end hosts in the VLAN are actually behind a single upstream router or firewall that uses the same source MAC address for all traffic (e.g., due to proxy ARP or NAT), then all traffic from that VLAN will be pinned to one link, leaving the other three idle.

Answer

The EtherChannel is misconfigured with an LACP active/passive mode mismatch, forcing only one link to bundle.

Answer

VLAN pruning on the trunk has removed the VLAN from three of the four member interfaces.

Answer

Spanning Tree Protocol has blocked three of the four links in the EtherChannel because they form a loop.