CCNA Switching and Network Access Practice Test 3 — 15 Questions

Question 1

Match each switchport or trunking concept to its most accurate role.

Accepted Answer

Access port. Access port carries traffic for a single VLAN. Trunk port carries traffic for multiple VLANs between switches. Dynamic Desirable and Dynamic Auto are DTP negotiation modes, not port roles. Since the stem asks to match each concept to its role, both A and B are correct.

Answer

Dynamic Desirable

Answer

Dynamic Auto

Question 2

Match each STP-related term or feature to its most accurate function.

Accepted Answer

Bridge ID: A combination of bridge priority and MAC address used to elect the root bridge.. All four options correctly describe STP terms. Bridge ID is a combination of bridge priority and MAC address used to elect the root bridge. Port Cost is a value assigned to each port based on its speed, used to determine the root port on a non-root bridge. Designated Port is the port on a segment with the lowest path cost to the root bridge. Blocking State is an STP port state where the port is logically disabled to prevent loops but can still receive BPDUs.

Question 3

Match each switch security or protection feature to its most accurate purpose.

Accepted Answer

Port Security: Limits the number of MAC addresses allowed on a switch port to prevent MAC flooding attacks.. Port Security is a switch security feature that limits the number of MAC addresses allowed on a switch port to prevent MAC flooding attacks. It does not inspect DHCP, ARP, or BPDU packets. Option A correctly identifies this purpose. Option B describes an overly restrictive behavior that is not accurate for Port Security (it does not block all unknown MAC addresses by default). Option C describes DHCP snooping's function. Option D describes Dynamic ARP Inspection (DAI).

Answer

Port Security: Prevents unauthorized users from connecting to the network by blocking all traffic from unknown MAC addresses.

Answer

Port Security: Prevents DHCP starvation attacks by limiting the number of DHCP requests per second.

Answer

Port Security: Prevents ARP spoofing attacks by validating ARP packets on a port.

Question 4

Match each trunk or VLAN term to its most accurate function.

Accepted Answer

Access port: carries traffic for a single VLAN only, with no tagging.. Access ports carry traffic for one VLAN only; trunk ports carry multiple VLANs using tagging. The native VLAN is untagged on a trunk; VLAN 1 is the default data VLAN, not voice. Therefore, both A and B are correct statements.

Answer

Native VLAN: the VLAN that is tagged on a trunk link by default.

Answer

VLAN 1: the default voice VLAN on Cisco switches.

Question 5

Match each trunking term to its most accurate meaning.

Accepted Answer

Trunk: A single physical link carrying multiple VLANs. Each term is correctly paired: Trunk carries multiple VLANs, Access port is assigned to a single VLAN, 802.1Q is the IEEE VLAN tagging standard, and Native VLAN is the untagged VLAN on a trunk port. These are fundamental definitions in VLAN trunking.

Question 6

Match each switch protection feature to its most accurate purpose.

Accepted Answer

PortFast: Immediately transitions an access port to forwarding state, bypassing STP listening and learning.. PortFast immediately transitions an edge port to forwarding state, bypassing STP listening and learning. BPDU Guard error-disables a port when it receives a BPDU, protecting against rogue switches. Root Guard prevents a port from becoming the root port by placing it into root-inconsistent state if it receives a superior BPDU. Loop Guard prevents alternate or root ports from becoming designated and causing loops when BPDU reception stops.

Answer

Root Guard: Prevents loops by disabling a port if it receives a superior BPDU, protecting against rogue switches.

Answer

Loop Guard: Prevents loops by disabling a port if it stops receiving BPDUs, protecting against unidirectional links.

Question 7

Match each switchport or VLAN term to its most accurate meaning.

Accepted Answer

Access port: A switch port that belongs to a single VLAN and carries untagged traffic for that VLAN.. Access ports belong to a single VLAN and carry untagged traffic. Trunk ports carry traffic for multiple VLANs and use 802.1Q tagging. VLANs are logical groupings of devices in the same broadcast domain. SVIs provide Layer 3 routing for VLANs.

Answer

VLAN: A logical grouping of devices that are on the same broadcast domain, regardless of physical location.

Answer

SVI: A virtual interface on a switch that provides Layer 3 routing for a VLAN.

Question 8

Which statement accurately describes a VLAN or trunk term?

Accepted Answer

Trunk: Carries traffic for multiple VLANs over a single link.. Trunks enable multiple VLANs on one link; VLANs logically segment networks. 802.1Q is the tagging standard; native VLAN is untagged. VTP distributes VLAN database; inter-VLAN routing uses a router or Layer 3 switch to communicate between VLANs.

Answer

VLAN: Provides a method to tag frames for multiple VLANs on a trunk.

Answer

Native VLAN: Used to route traffic between different VLANs.

Answer

802.1Q: Distributes VLAN configuration information across switches.

Question 9

Match each switchport or STP feature to its most accurate purpose.

Accepted Answer

PortFast allows a port to skip listening/learning states.. PortFast allows a switch port to immediately transition to forwarding state, skipping listening and learning, which accurately matches the purpose described. UplinkFast provides fast failover for directly connected failures, such as a root port failure, so the description is correct. BackboneFast reduces convergence time for indirect failures, not directly connected failures, making it incorrect. BPDU Guard disables a port if a BPDU is received, but its primary purpose is to prevent loops and enhance security, not just to disable a port upon BPDU reception; thus, it is not the most accurate match for the given description.

Answer

BackboneFast reduces convergence time for indirect failures.

Answer

BPDU Guard disables a port if BPDU is received.

Question 10

Match each wireless concept to its most accurate description.

Accepted Answer

SSID is the network name, BSSID is the AP's MAC, beacon frames advertise the network, probe requests are client discovery, association is joining the network, and authentication verifies identity before association.. Ly matches each wireless concept to its description: SSID is the network name, BSSID is the AP's MAC address, beacon frames advertise the network, probe requests are sent by clients to discover networks, association is the process of joining a network, and authentication occurs before association to verify identity. Options B, C, and D contain incorrect pairings, such as swapping SSID and BSSID, misstating the roles of beacon frames and probe requests, or reversing the order of authentication and association.

Answer

SSID is the AP's MAC, BSSID is the network name, beacon frames are used for client discovery, probe requests advertise the network, association verifies identity, and authentication joins the network.

Answer

SSID is the network name, BSSID is the AP's MAC, beacon frames are used for client discovery, probe requests advertise the network, association verifies identity, and authentication joins the network.

Answer

SSID is the AP's MAC, BSSID is the network name, beacon frames advertise the network, probe requests are client discovery, association verifies identity, and authentication joins the network.

Question 11

A client can join a secure employee SSID, but traffic is consistently placed into a guest-style restricted path. Which area should be investigated first?

Accepted Answer

The policy, role, or VLAN mapping applied after successful authentication.. The strongest first area to investigate is the mapping between the authenticated user or WLAN and the policy or VLAN that is applied afterward. In practical terms, the client is joining successfully, so the issue is not basic RF visibility or initial authentication. The clue is that the wrong access policy is being applied after the join process.

This is a highly realistic wireless policy troubleshooting scenario because the failure happens after successful connectivity setup.

Answer

Whether the client can see the SSID at all.

Answer

Whether the RADIUS server is returning a guest VLAN attribute.

Answer

Whether OSPF area 0 is configured on the client.

Question 12

Which technology matches the description: 'Delivers power to devices over Ethernet (PoE)'?

Accepted Answer

PoE (Power over Ethernet). PoE (Power over Ethernet) is the technology that delivers electrical power over Ethernet cables, matching description E. RSTP (Rapid Spanning Tree Protocol) manages Layer 2 loops, 802.1X controls port-based network access authentication, and VLAN Trunking (802.1Q) carries multiple VLANs over a single link—none of these handle power delivery.

Answer

RSTP (Rapid Spanning Tree Protocol)

Answer

802.1X (Port-Based Network Access Control)

Answer

VLAN Trunking (802.1Q)

Question 13

Which two STP facts are correct? Choose two.

Accepted Answer

The root bridge is elected using the lowest bridge ID. STP prevents Layer 2 loops by placing some ports into a non-forwarding role. The root bridge is chosen by the lowest bridge ID, and all ports on the root bridge itself are designated ports for their segments.

Answer

A lower path cost makes a port less likely to become root port

Answer

All blocked ports are designated ports

Question 14

Two switches are connected with an EtherChannel using LACP. The bundle stays down and the physical interfaces show individual links, not a port-channel member state. Which two conditions must match on both sides for the channel to form successfully?

Accepted Answer

The member interfaces must have compatible speed and duplex settings. LACP active/passive is valid, but the interfaces still have to match operationally and be configured compatibly for the same bundle. Speed, duplex, trunking, and channel protocol consistency all matter.

Answer

The trunk native VLAN must always be VLAN 1

Answer

The STP priority values on both switches must be identical

Question 15

Which TWO statements correctly describe the configuration and behavior of a router-on-a-stick setup for inter-VLAN routing?

Accepted Answer

Each subinterface on the router must be configured with an IP address that belongs to the corresponding VLAN's subnet.. Option A is correct because in a router-on-a-stick design each subinterface acts as the default gateway for one VLAN, so it must be assigned an IP address from that VLAN's subnet (e.g., 192.168.10.1/24 for VLAN 10) to route traffic between VLANs. Option D is correct because the physical router interface must be enabled with 'no shutdown' for the subinterfaces to pass traffic, while subinterfaces are logical interfaces that inherit the physical interface's operational state and do not have their own shutdown/no shutdown state. Option B is wrong because the switch port facing the router must be an 802.1Q trunk carrying multiple VLANs, not an access port in VLAN 1. Option C is wrong because the native VLAN does not have to match the management VLAN; it only must match on both ends of the trunk. Option E is wrong because the native VLAN is specified with 'encapsulation dot1q <vlan-id> native' only on the subinterface that carries untagged traffic, and this is not a mandatory requirement for every router-on-a-stick configuration.

Answer

The switch port connecting to the router must be configured as an access port in VLAN 1.

Answer

The native VLAN on the trunk must be the same VLAN as the one used for management traffic.

Answer

The router's subinterface for the native VLAN must use the 'encapsulation dot1q <vlan-id> native' command.