CCNA Switching and Network Access Practice Test 7 — 15 Questions

Question 1

You are connected to the multilayer switch SW1. Configure Root Guard on the designated port towards the access switch SW2, Loop Guard on the uplink port towards the distribution switch SW3, and BPDU Guard on the PortFast-enabled port connected to a workstation. After configuration, a superior BPDU is received on the designated port, causing it to be blocked by Root Guard. Later, a BPDU is received on the PortFast port, triggering err-disable state. Identify and resolve these issues.

Accepted Answer

Remove Root Guard from interface Gi0/0 and re-enable interface Gi0/2 with a shutdown/no shutdown sequence.. The root guard feature on Gi0/0 caused the port to enter a root-inconsistent state when a superior BPDU was received. In this scenario, the superior BPDU is considered legitimate, so root guard is unnecessary and should be removed from Gi0/0. The PortFast port Gi0/2 was err-disabled by BPDU Guard because a BPDU was received on a PortFast port; this port must be re-enabled with a shutdown/no shutdown sequence after verifying the attached device.

Answer

Disable BPDU Guard on interface Gi0/2 and increase the root bridge priority on SW1 to prevent superior BPDUs.

Answer

Apply Root Guard to interface Gi0/2 instead of Gi0/0 and configure Loop Guard on Gi0/0.

Answer

Remove Loop Guard from interface Gi0/1 and configure it on Gi0/0 instead, then re-enable Gi0/2 using the 'errdisable recovery cause bpduguard' command.

Question 2

You are connected to SW1. The current configuration on SW1 is: interfaces GigabitEthernet0/1 and GigabitEthernet0/2 are set to channel-group mode passive; Gi0/1 has speed 100, duplex half, and access VLAN 20; Gi0/2 has speed 1000, duplex full, and access VLAN 10. You need to form an LACP EtherChannel between SW1 and SW2. Ensure the channel forms by setting the channel-group mode to active on SW1's member ports. Also correct the speed/duplex mismatch and VLAN mismatch so that the port-channel interface is in the up/up state. Finally, verify the EtherChannel summary shows the channel as a Layer 2 bundle in use.

Accepted Answer

Change channel-group mode to active on both ports, set speed 1000 and duplex full on Gi0/1, set access VLAN 10 on Gi0/1.. To form an LACP EtherChannel, at least one side must be active, and all member ports must have matching speed, duplex, and access VLAN. Gi0/1 currently has speed 100/half and VLAN 20; Gi0/2 has speed 1000/full and VLAN 10. Setting Gi0/1 to speed 1000, duplex full, and access VLAN 10 matches Gi0/2 and allows the channel to form as a Layer 2 bundle.

Answer

Change channel-group mode to passive on both ports, set speed 100 and duplex half on Gi0/2, set access VLAN 20 on Gi0/1.

Answer

Change channel-group mode to desirable on both ports, set speed 1000 and duplex full on Gi0/1, set access VLAN 10 on Gi0/2.

Answer

Change channel-group mode to active on both ports, set speed 100 and duplex half on Gi0/1, set access VLAN 20 on Gi0/2.

Question 3

Which three of the following are unique characteristics of RSTP (802.1w) compared to traditional STP (802.1D)? (Choose three.)

Accepted Answer

RSTP provides faster convergence by actively negotiating port roles using proposal/agreement handshakes.. RSTP (802.1w) differs from traditional STP (802.1D) in three key ways: 1) It uses a proposal/agreement handshake to achieve rapid convergence without waiting for timers. 2) It introduces alternate and backup port roles—alternate ports provide a path to the root bridge via another switch, and backup ports provide a redundant path on the same segment; both are discarding but ready to transition. 3) Edge ports (connected only to end hosts) move directly to the forwarding state, bypassing listening and learning. The incorrect options fail as differences: - Option B (only three timers) is true for both STP and RSTP, so it is not a distinguishing characteristic. - Option C (eliminates BPDUs) is false—RSTP still uses BPDUs but with the Type field set to 2 and includes a flags byte for proposal/agreement. - Option D (root bridge with lower priority) is true for both, so it is not a distinguishing characteristic.

Answer

RSTP uses only three timer values (Hello, Max Age, Forward Delay) that must be identical across all switches.

Answer

RSTP eliminates the need for BPDU messages by using link-local multicast for topology changes.

Answer

RSTP requires the use of a root bridge with a lower bridge priority than any other switch in the network.

Question 4

Which three of the following statements about VLAN Trunking Protocol (VTP) are correct? (Choose three.)

Accepted Answer

A VTP server can create, modify, and delete VLANs, and these changes are propagated to all other switches in the same VTP domain.. All three selected statements are correct: VTP pruning reduces unnecessary broadcast traffic by pruning inactive VLANs from trunk links; a VTP server can create/modify/delete VLANs and propagates changes; transparent mode forwards advertisements but does not synchronize. The three distractors are incorrect: E: VTP version 3 is not backward compatible with version 1 and 2; it requires compatible versions. B: A VTP client cannot create local VLANs; it only synchronizes from the server. F: VTP uses multicast MAC address 0100.0CCC.CCCC for advertisements, not 0180.c200.0000 which is used by other protocols like STP.

Answer

A switch in VTP client mode can create local VLANs that are not advertised to the rest of the domain.

Answer

VTP version 3 supports extended VLANs (1006-4094) and is backward compatible with VTP version 1 and 2.

Answer

VTP advertisements are sent as multicast frames using the destination MAC address 0180.c200.0000.

Question 5

Which three of the following are valid considerations when configuring EtherChannel? (Choose three.)

Accepted Answer

EtherChannel can be configured using either PAgP (Cisco proprietary) or LACP (IEEE 802.3ad) protocols.. The correct statements are A, C, and D. A is true because EtherChannel supports PAgP (Cisco proprietary) and LACP (IEEE 802.3ad). C is true because LACP uses system priority to determine which switch controls which ports are active in the bundle. D is true because all physical interfaces in an EtherChannel must have the same speed and duplex settings. B is false because STP operates on the port-channel interface as a whole, not on individual links. E is false because although up to 16 interfaces can be configured, only 8 can be active simultaneously (the rest are standby). F is false because load balancing can be based on source/destination MAC, IP, or Layer 4 port, not just MAC addresses.

Answer

EtherChannel provides loop prevention by using Spanning Tree Protocol on each individual link within the bundle.

Answer

On a Cisco switch, you can bundle up to 16 interfaces into a single EtherChannel, all of which can be active simultaneously.

Answer

EtherChannel load balancing is always based on source and destination MAC addresses only.

Question 6

Which three of the following correctly describe how a Layer 2 switch handles frames? (Choose three.)

Accepted Answer

If the destination MAC address is broadcast (FFFF.FFFF.FFFF), the switch floods the frame out all ports except the incoming port.. A Layer 2 switch forwards known unicasts only to the associated port (F), floods broadcasts out all ports except the incoming port (A), and dynamically learns MAC addresses from source MACs of frames (B). Unknown unicasts are flooded, not dropped (C is wrong). MAC address table learning relies on source MAC inspection, not CDP (D is wrong). If source and destination MAC are identical, the frame is not forwarded; it is typically dropped (E is wrong).

Answer

If the destination MAC address is unknown (not in the MAC address table), the switch drops the frame to prevent loops.

Answer

The switch updates the MAC address table every 30 seconds by default using CDP advertisements.

Answer

If the source MAC address in a frame matches the destination MAC address, the switch forwards the frame to all ports.

Question 7

Which three of the following are true regarding the configuration and operation of a Cisco switch port in access mode? (Choose three.)

Accepted Answer

An access port belongs to a single VLAN and carries traffic for that VLAN only.. The three correct statements are: 1) An access port belongs to a single VLAN and carries traffic for that VLAN only. 2) By default, all switch ports are in VLAN 1 unless explicitly changed. 3) Voice VLAN can be configured on an access port to carry both data (native VLAN) and voice (voice VLAN) traffic. The other statements are false: The 'switchport mode access' command is not required before assigning a VLAN, though it is recommended to prevent trunking. An access port with a voice VLAN does accept tagged frames for the voice VLAN; it does not drop all tagged frames. Finally, the 'switchport access vlan' command does not automatically create the VLAN; the VLAN must already exist in the VLAN database or be created manually.

Answer

The 'switchport mode access' command is required before assigning a VLAN to the port.

Answer

An access port will drop any frames that are received with an 802.1Q tag.

Answer

The 'switchport access vlan' command automatically creates the VLAN if it does not already exist in the VLAN database.

Question 8

Which three of the following are functions of the Spanning Tree Protocol (STP) in a switched network? (Choose three.)

Accepted Answer

STP elects a root bridge based on the lowest bridge ID (priority + MAC address).. STP elects a root bridge based on the lowest bridge ID (priority + MAC address), so that statement is correct. STP uses BPDUs to exchange topology information between switches, so that statement is correct. STP prevents loops by placing redundant ports into a blocking state, leaving only one active path between any two network segments, so that statement is correct. The statement about transitioning from blocking to forwarding immediately after the Max Age timer expires is false: a port moves through listening and learning before forwarding. The statement about all ports on a non-root bridge becoming root ports is false: only one port per non-root bridge becomes the root port; others become designated or alternate/blocking. The statement about load-balancing traffic equally across redundant links is false: STP blocks redundant links instead of load-balancing.

Answer

STP transitions a port from blocking to forwarding immediately after the Max Age timer expires.

Answer

STP ensures that all ports on a non-root bridge eventually become root ports.

Answer

STP automatically load-balances traffic across all redundant links equally.

Question 9

Which three of the following are true regarding the operation of Rapid Spanning Tree Protocol (RSTP) compared to classic STP (802.1D)? (Choose three.)

Accepted Answer

RSTP uses proposal/agreement to achieve faster convergence.. RSTP (802.1w) improves on classic STP (802.1D) with three key advancements: (1) It uses a proposal/agreement handshake to quickly transition ports to forwarding, avoiding timer-based convergence. (2) It reduces port states from five (blocking, listening, learning, forwarding, disabled) to three (discarding, learning, forwarding). (3) It introduces alternate and backup port roles for faster failover. The other options are false: UplinkFast is a Cisco proprietary feature, not required by RSTP; RSTP does not use timer-based convergence identical to 802.1D; and RSTP does not eliminate the blocking state—it renames it to discarding and still uses it.

Answer

RSTP requires the use of the UplinkFast feature to speed up convergence.

Answer

RSTP uses timer-based convergence identical to 802.1D.

Answer

RSTP eliminates the blocking state entirely.

Question 10

Which four of the following are characteristics of 802.1Q trunking? (Choose four.)

Accepted Answer

The native VLAN frames are transmitted untagged on the trunk.. 802.1Q trunking uses a single native VLAN per trunk, and frames belonging to that VLAN are transmitted without an 802.1Q tag, allowing interoperability with devices that do not understand trunking. The 802.1Q tag is inserted between the Source MAC address and the EtherType/Length field, adding a 4-byte tag that includes the VLAN ID and priority information. VLAN pruning, such as via VTP pruning or manual configuration, allows a switch to restrict unnecessary VLAN traffic from being sent over a trunk, reducing bandwidth waste. The 802.1Q tag adds 4 bytes to the Ethernet frame, increasing the maximum frame size from 1518 to 1522 bytes. The incorrect options: 802.1Q does not encapsulate the entire frame; it inserts a tag. Dynamic Trunking Protocol (DTP) is a Cisco proprietary protocol and is not required for 802.1Q to function.

Answer

802.1Q encapsulates the entire Ethernet frame with a new header.

Answer

The 802.1Q tag increases the maximum frame size to 1522 bytes.

Answer

Dynamic Trunking Protocol (DTP) is required for 802.1Q to function.

Question 11

Which three options correctly describe the behavior or configuration of EtherChannel? (Choose three.)

Accepted Answer

All interfaces in the EtherChannel must have the same VLAN allowed list or trunk mode.. Options A, C, and E are correct. Option A correctly states that all interfaces in the EtherChannel must have the same VLAN allowed list or trunk mode (or same access VLAN). Option C correctly states that load balancing uses a hash algorithm based on MAC addresses, IP addresses, or port numbers. Option E correctly states that EtherChannel can bundle up to 8 active physical links of the same type. Option B is incorrect because EtherChannel interfaces are configured as a single logical port-channel interface, not as individual switch ports, in the running-config. Option D is incorrect because PAgP is Cisco proprietary, not industry-standard; LACP is the IEEE standard. Option F is incorrect because EtherChannel does not forward traffic out all active links simultaneously; instead, it load balances each frame over a single link.

Answer

EtherChannel interfaces are configured as individual switch ports in the running-config.

Answer

PAgP is an industry-standard protocol for forming EtherChannels.

Answer

EtherChannel provides redundancy by forwarding traffic out all active links simultaneously.

Question 12

Which three of the following are true about the operation of DHCP snooping? (Choose three.)

Accepted Answer

DHCP snooping builds a binding database of trusted DHCP clients.. DHCP snooping is a security feature that builds and maintains a DHCP snooping binding database by monitoring DHCP messages exchanged on trusted and untrusted ports. It prevents rogue DHCP servers and DHCP starvation attacks by filtering DHCP messages based on the trust state of the interface. The binding database records the IP address, MAC address, VLAN, and port information for each DHCP client that successfully obtains a lease through a trusted DHCP server.

Answer

DHCP snooping is enabled globally and requires no per-VLAN configuration.

Answer

DHCP snooping automatically blocks all BOOTP traffic.

Answer

DHCP snooping only works with DHCPv6.

Question 13

Which three statements accurately describe the operation of the Spanning Tree Protocol (STP) root bridge election? (Choose three.)

Accepted Answer

The switch with the lowest bridge ID (priority + MAC address) becomes the root bridge.. The Spanning Tree Protocol (STP) root bridge election is based on the bridge ID, which combines a configurable priority (default 32768) and the switch's MAC address. The switch with the lowest bridge ID wins the election, making option 1 correct. If priorities are equal, the MAC address serves as the tiebreaker, so the switch with the lowest MAC address is chosen, confirming option 2. Once elected, all ports on the root bridge become designated ports (forwarding), as they are the most efficient paths to the root, making option 3 correct.

Answer

The root bridge is always the switch with the highest MAC address.

Answer

The root bridge priority can be modified using the 'spanning-tree vlan vlan-id root secondary' command to force it to become root.

Answer

The root bridge election occurs every 30 seconds by default.

Question 14

Which of the following statements about VLAN configuration and trunking on a Cisco switch are correct? (Choose all that apply.)

Accepted Answer

The native VLAN on a trunk link is used for untagged traffic and should match on both ends of the link.. The correct statements are: the native VLAN on a trunk carries untagged traffic and must match on both ends; VLAN 1 cannot be deleted; DTP can negotiate trunking; and the 'switchport trunk allowed vlan' command restricts VLANs on a trunk. The incorrect statements are: an access port can carry multiple VLANs (an access port is assigned to a single VLAN only), and a trunk link can only carry VLANs that are globally created on the switch. In practice, a trunk can carry traffic for any VLAN that exists in the local VLAN database; the term 'globally created' is misleading as VLANs are created per switch, not globally. Therefore, both of these options are wrong.

Answer

A switchport configured as an access port can carry multiple VLANs.

Answer

A trunk link can only carry VLANs that are globally created on the switch.

Question 15

Which four of the following are considered best practices for securing switch ports and preventing Layer 2 attacks? (Choose all that apply. There are four correct answers.)

Accepted Answer

Enable PortFast and BPDU guard on all ports that connect to end devices.. Disabling unused ports and placing them in a shutdown state prevents unauthorized physical access and stops Layer 2 attacks like rogue device connections or VLAN hopping. Enabling PortFast and BPDU guard on ports connecting to end devices speeds up STP convergence and protects against rogue switch loops. DHCP snooping prevents rogue DHCP server attacks by filtering untrusted DHCP messages. Dynamic ARP inspection uses DHCP snooping bindings to validate ARP packets and prevent ARP spoofing. Setting the native VLAN to a higher number is not a best practice; the recommended approach is to change the native VLAN to an unused VLAN on both ends of the trunk and explicitly tag it. MAC address filtering as the sole measure is easily bypassed and must be combined with port security or 802.1X.

Answer

Use MAC address filtering as the sole security measure to prevent unauthorized access.

Answer

Set the native VLAN to a higher number than the default VLAN 1 on trunk links.

CCNA Switching and Network Access Practice Test 7 — 15 Questions

Exhibit

CCNA Switching and Network Access Practice Test 7 — 15 Questions

Exhibit