CCNA Switching and Network Access Practice Test 4 — 15 Questions

Question 1

A network administrator is troubleshooting connectivity issues in a switched network. Hosts on VLAN 10 connected to SwitchC cannot reach the VLAN 10 gateway, which is connected to SwitchA. The administrator checks the STP status on SwitchC and sees that the port connecting to the root bridge is in a blocking state. The administrator also notices that the VLAN 10 gateway is reachable from SwitchA, but not from SwitchC. What is the most likely cause of this issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the spanning-tree mode to PVST+ instead of Rapid PVST+.. The issue is that the port connecting to the root bridge is in a blocking state. In Rapid PVST+, if the root bridge is using PVST+, incompatibility can cause ports to be blocked. Configuring the spanning-tree mode to PVST+ on all switches ensures consistent STP operation, allowing the port to transition to forwarding and restoring connectivity.

Answer

Configure PortFast on interface Gi0/2 to bring it up immediately.

Answer

Change the STP priority on SwitchC to a lower value (e.g., 24576) to ensure it is not the root bridge.

Answer

Enable BPDU Guard on interface Gi0/2 to prevent BPDU attacks.

Question 2

Drag and drop the STP-related terms on the left to their correct descriptions on the right.

Accepted Answer

Root Bridge: The bridge with the lowest bridge ID in the STP topology. All four pairings are correct. The root bridge has the lowest bridge ID. A designated port is the port on a segment with the best path to the root bridge. Blocking state prevents data forwarding to avoid loops. BPDUs are frames exchanged by switches to share STP information.

Question 3

Drag and drop the STP/Rapid PVST+ terms on the left to the correct descriptions on the right.

Accepted Answer

Root bridge: Bridge with the lowest bridge ID in the STP topology. All four terms are correctly matched to their standard definitions in STP and Rapid PVST+. The root bridge is indeed the switch with the lowest bridge ID. A designated port provides the best path to the root bridge on a given segment. An alternate port (used in Rapid PVST+) offers a backup path to the root bridge and is placed in blocking state. An edge port connects to end devices and transitions directly to forwarding without going through STP states.

Question 4

A network administrator notices that hosts in VLAN 10 cannot ping the default gateway (192.168.10.1). The switch's SVI for VLAN 10 is configured and the output of the show ip interface brief command shows its status as up/up. An embedded packet capture is configured. The exhibit shows ARP requests from a host to 192.168.10.1 but no ARP reply. Based on the exhibit, what is the most likely cause of the connectivity issue?

Accepted Answer

The switchport connecting the host is not assigned to VLAN 10.. The packet capture shows ARP requests from the host but no reply, indicating the switch's VLAN 10 SVI is not receiving the ARP frames. Since the SVI is confirmed up/up, the most likely cause is that the switchport connecting the host is not assigned to VLAN 10, causing the frames to be on a different VLAN. Option A is incorrect because the host's default gateway is correctly set to 192.168.10.1 (the SVI's IP); ARP requests are being sent but not answered. Option C is wrong because an ACL on the SVI would not block ARP (ARP is a Layer 2 protocol not filtered by IP ACLs), and the capture would show a reply if the SVI received the request. Option D is incorrect because the exhibit shows the SVI is up/up, ruling out an administratively down condition.

Answer

The default gateway is configured incorrectly on the host.

Answer

An ACL is applied to the SVI blocking ICMP.

Answer

The SVI is administratively down.

Question 5

What action should be taken to resolve the err-disabled state?

Accepted Answer

Disable BPDU Guard on the distribution switch interface. The distribution switch interface entered err-disabled because it received a BPDU while BPDU Guard was enabled. BPDU Guard is not automatically enabled with PortFast; it must be explicitly turned on, and the scenario assumes it is active. When a BPDU arrives on a BPDU Guard–enabled port, the switch err-disables it to prevent loops. Disabling BPDU Guard on that interface resolves the condition. Disabling Root Guard (option A) would not stop the BPDU Guard trigger; removing PortFast (option C) would not disable the already-enabled BPDU Guard; and changing the port to access mode (option D) is irrelevant to BPDU Guard behavior.

Answer

Disable Root Guard on the distribution switch interface

Answer

Remove PortFast from the new access switch uplink interface

Answer

Configure the interface as an access port instead of trunk

Question 6

Drag and drop the PortFast and BPDU protection commands on the left to the correct descriptions on the right.

Accepted Answer

spanning-tree portfast: Enables PortFast on an interface. The correct matches are:
- 'spanning-tree portfast' is an interface-level command that enables PortFast on a specific port, reducing the forwarding delay.
- 'spanning-tree portfast default' is a global command that enables PortFast on all access ports by default.
- 'spanning-tree bpduguard enable' is an interface-level command that enables BPDU guard, which errdisables the port if a BPDU is received.
- 'spanning-tree bpduguard default' is a global command that enables BPDU guard on all PortFast-enabled ports.
These commands are correctly paired with their descriptions. Note that 'spanning-tree portfast bpduguard' is a single command that enables both features on an interface, but it is not one of the required matches.

Question 7

A network engineer is troubleshooting a connectivity issue between two switches, SW1 and SW2, which are connected via four GigabitEthernet links configured as an LACP EtherChannel. Hosts on VLAN 10 connected to SW1 can ping the management IP of SW2, but cannot reach hosts on VLAN 10 connected to SW2. The engineer runs the show etherchannel summary command on SW1 and observes that Gi0/0/3 is not bundled in the EtherChannel while the other three links are. What is the most likely cause of the problem?

Accepted Answer

The interface Gi0/0/3 has a different LACP port priority or is configured with 'channel-group 1 mode passive' while the other ports use 'active'.. The issue is that hosts on VLAN 10 can ping the management IP of SW2 but cannot reach other hosts on the same VLAN. This indicates Layer 2 connectivity is broken for data traffic, while Layer 3 (management) traffic works. Since the EtherChannel uses LACP, if one member port (Gi0/0/3) has a different LACP port priority or is in 'passive' mode while others are 'active', LACP negotiation will fail on that link, causing it to be excluded from the channel. The remaining three ports may still form the EtherChannel, but the missing link can cause load-balancing issues or, more critically, if the channel requires all four links for STP to forward traffic on VLAN 10, the VLAN may be blocked or the port-channel may not pass data correctly for that VLAN.

Answer

The interface Gi0/0/3 is in err-disabled state due to a spanning-tree BPDU guard violation.

Answer

The port-channel interface is down (not in use), causing all member ports to be stand-alone.

Answer

The switch is running out of MAC addresses for the EtherChannel, so one port cannot be added.

Question 8

Which EtherChannel mode actively negotiates using LACP?

Accepted Answer

active. EtherChannel modes: active/passive for LACP, desirable/auto for PAgP, on for static, and interface port-channel creates the logical interface.

Answer

desirable

Answer

auto

Answer

on

Question 9

Drag and drop the steps into the recommended configuration order for setting up VLANs, assigning access ports, configuring 802.1Q trunking with a non-default native VLAN, and verifying the setup on a Cisco IOS-XE switch.

Accepted Answer

1. Create VLANs, 2. Configure trunking with non-default native VLAN, 3. Assign access ports to VLANs, 4. Verify configuration. After creating VLANs, the recommended order is to configure trunking with a non-default native VLAN before assigning access ports. This ensures the trunk is ready with the correct native VLAN, preventing mismatches and allowing the switch to carry traffic for the new VLANs. Options B and D fail because VLANs must exist first. Option A places trunking last, which is not the best practice.

Answer

1. Create VLANs, 2. Assign access ports to VLANs, 3. Configure trunking with non-default native VLAN, 4. Verify configuration

Answer

1. Assign access ports to VLANs, 2. Create VLANs, 3. Configure trunking with non-default native VLAN, 4. Verify configuration

Answer

1. Configure trunking with non-default native VLAN, 2. Create VLANs, 3. Assign access ports to VLANs, 4. Verify configuration

Question 10

Arrange the following steps in a valid configuration order. Note: VLANs must be created first, verification last. The access-port assignment and trunk configuration (steps B and C) can be performed in any order after VLAN creation.

Accepted Answer

Create VLANs using 'vlan' command in global configuration mode. The correct sequence is A (Create VLANs), C (Configure 802.1Q trunking with native VLAN), B (Assign access ports to VLANs), D (Verify). VLANs must exist before any VLAN-based configuration. Trunk configuration must precede access port assignment because the trunk must be operational and carry the native VLAN before ports are assigned to VLANs to ensure proper VLAN propagation. Verification is always the final step.

Question 11

Drag and drop the following steps into the correct order (recommended best-practice workflow) to configure VLANs, assign access ports, enable 802.1Q trunking, set the native VLAN, and verify the configuration on a Cisco switch running IOS-XE.

Accepted Answer

Create VLANs globally, assign access ports, configure trunking with native VLAN, verify configuration. The recommended best-practice workflow for VLAN configuration on a Cisco IOS-XE switch is: first, create the VLANs globally using the 'vlan ' command so they exist in the VLAN database. Next, assign access ports to the appropriate VLANs using 'switchport access vlan ' to ensure end-device connectivity. Then configure trunking on the required interfaces with 'switchport mode trunk' and set the native VLAN via 'switchport trunk native vlan '; this order prevents accidental VLAN propagation across the trunk before access ports are correctly placed. Finally, verify the configuration with 'show vlan brief' and 'show interfaces trunk'. Only option A follows this exact sequence. Options B, C, and D each violate the recommended order by either assigning access ports before VLAN creation, configuring trunking prematurely, or placing trunking before access port assignment.

Answer

Assign access ports, create VLANs globally, configure trunking with native VLAN, verify configuration

Answer

Configure trunking with native VLAN, create VLANs globally, assign access ports, verify configuration

Answer

Create VLANs globally, configure trunking with native VLAN, assign access ports, verify configuration

Question 12

Drag and drop the following steps into the correct order to configure VLANs, assign access ports, set up 802.1Q trunks with a native VLAN, and verify the configuration using show commands.

Accepted Answer

1. Create VLANs using the 'vlan' command in global config mode. 2. Assign access ports to VLANs using 'switchport access vlan'. 3. Configure trunk ports with 'switchport mode trunk' and set native VLAN with 'switchport trunk native vlan'. 4. Verify with 'show vlan brief', 'show interfaces trunk', and 'show interfaces switchport'.. The only correct order is option A. VLANs must be created first before any port assignment or trunk configuration. Access port assignment and trunk port configuration are independent and can be done in any order after VLANs are created, but both must come before verification. Options B, C, and D each place a step (access assignment, trunk configuration, or verification) before VLAN creation, which is invalid.

Answer

1. Assign access ports to VLANs using 'switchport access vlan'. 2. Create VLANs using the 'vlan' command. 3. Configure trunk ports with 'switchport mode trunk' and set native VLAN. 4. Verify with 'show vlan brief' and 'show interfaces trunk'.

Answer

1. Configure trunk ports with 'switchport mode trunk' and set native VLAN. 2. Create VLANs using the 'vlan' command. 3. Assign access ports to VLANs. 4. Verify with 'show interfaces trunk' and 'show vlan brief'.

Answer

1. Verify with 'show vlan brief' and 'show interfaces trunk'. 2. Create VLANs. 3. Assign access ports. 4. Configure trunk ports.

Question 13

Drag and drop the following steps into the correct order to configure VLANs, assign access ports, set up 802.1Q trunking with a native VLAN, and verify the configuration on a Cisco IOS-XE switch.

Accepted Answer

Create VLANs in global configuration mode. VLAN creation precedes port assignment; trunking configuration follows access port assignment; verification is last.

Question 14

You need to configure a new switch. According to Cisco’s recommended workflow, you should assign access ports to their VLANs before configuring trunk links to ensure that end devices are functional before inter-switch connectivity is tested. Drag and drop the following steps into the correct order to configure VLANs, assign access ports, set up 802.1Q trunking with a native VLAN, and verify the configuration on a Cisco switch running IOS-XE.

Accepted Answer

Create VLANs, assign access ports, configure trunk with native VLAN, verify with show commands. All four sequences are correct because Cisco switches automatically create VLANs when ports are assigned to them, and the default native VLAN (VLAN 1) exists by default. Therefore, the order of creating VLANs, assigning access ports, and configuring trunk can vary. Verification can be done at the end. Each option follows Cisco best practices in that end devices are functional before inter-switch connectivity is tested, as access ports are assigned before or after VLAN creation, and trunk configuration is performed after VLANs exist. Hence, options A, B, C, and D are all valid.

Question 15

A network engineer is configuring a new access switch that will connect to a distribution switch. The engineer must ensure that local hosts are placed in the correct VLANs before enabling trunking to the distribution switch to prevent VLAN mismatches and broadcast issues. Drag and drop the steps into the correct order.

Accepted Answer

Create VLANs → Assign access ports → Configure 802.1Q trunks with native VLAN → Verify with show vlan brief and show interfaces trunk. The correct order is to create VLANs first, then assign access ports to those VLANs so local hosts are properly placed and operational. Only then should 802.1Q trunks be configured to extend VLANs to other switches, because trunking before access port assignment could lead to operational inconsistencies. Options B and D would require access ports before VLANs exist, and Option C configures trunks prematurely in this scenario.

Answer

Assign access ports → Create VLANs → Configure 802.1Q trunks with native VLAN → Verify with show vlan brief and show interfaces trunk

Answer

Create VLANs → Configure 802.1Q trunks with native VLAN → Assign access ports → Verify with show vlan brief and show interfaces trunk

Answer

Configure 802.1Q trunks with native VLAN → Create VLANs → Assign access ports → Verify with show vlan brief and show interfaces trunk