CCNA Switching and Network Access Practice Test 7 — 15 Questions

Question 1

A multilayer switch has SVIs for VLAN 10 and VLAN 20. Hosts in both VLANs can reach their local SVI, but they cannot reach each other. Which additional configuration is most likely required?

Accepted Answer

Enable `ip routing` on the multilayer switch.. The most likely missing configuration is `ip routing`. In practical terms, the switch already has Layer 3 gateway interfaces for the VLANs, which is why hosts can reach their local SVI. But inter-VLAN communication still requires the switch to actually route between those VLAN interfaces. Without IP routing enabled, the SVIs can exist and respond locally without forwarding traffic between them.

This is a classic multilayer-switch question because many learners assume that creating SVIs automatically enables inter-VLAN routing. It does not. The device must also be told to behave as a Layer 3 forwarding device across those VLAN interfaces.

Answer

Convert all access ports into trunks.

Answer

Make both VLANs use the same IP subnet.

Answer

Disable spanning tree on both VLANs.

Question 2

Match each Layer 2 protection feature to its most accurate purpose.

Accepted Answer

Storm Control: Limits excessive broadcast, multicast, or unicast traffic to prevent network storms.. Storm Control limits excessive traffic. Port Security limits MAC addresses. DHCP Snooping blocks unauthorized DHCP servers. DAI validates ARP packets. IP Source Guard filters IP traffic based on DHCP snooping. 802.1X authenticates devices before granting access.

Answer

Storm Control: Authenticates devices before granting network access.

Answer

Storm Control: Validates ARP packets to prevent ARP spoofing attacks.

Answer

Storm Control: Filters IP traffic based on DHCP snooping bindings.

Question 3

Two switches should form an EtherChannel with LACP. One side is set to active and the other is set to passive. If the remaining interface settings match, what is the expected result?

Accepted Answer

The EtherChannel should form successfully.. The EtherChannel should form successfully. In practical terms, active mode initiates LACP negotiation and passive mode listens and responds. Because one side is actively starting the negotiation, the bundle can come up if the interfaces also match in operational settings such as speed, duplex, switchport mode, and VLAN characteristics.

This is a classic LACP pairing question. Active/passive works. Passive/passive is the combination that usually fails to start the bundle.

Answer

The EtherChannel fails because both sides must be active.

Answer

The interfaces automatically become routed ports.

Answer

The switches delete the port-channel automatically.

Question 4

Match each trunking term to its most accurate meaning.

Accepted Answer

Trunk: A single physical link carrying multiple VLANs. These pairings match common trunking terms with their accurate definitions in networking.

Question 5

Match each switch protection feature to its most accurate purpose.

Accepted Answer

PortFast: Immediately transitions an access port to forwarding state, bypassing STP listening and learning.. Port security directly controls MAC address usage on a switch port, limiting the number and types of MACs allowed. BPDU Guard disables an edge port if it receives a BPDU, preventing potential loop or rogue switch issues. DHCP Snooping filters untrusted DHCP messages and builds a binding table of valid IP-MAC pairs. Dynamic ARP Inspection validates ARP packets against the DHCP Snooping binding table, ensuring they are legitimate.

Answer

BPDU Guard: Prevents loops by disabling a port if it receives a BPDU, protecting against rogue switches.

Answer

Root Guard: Prevents loops by disabling a port if it receives a superior BPDU, protecting against rogue switches.

Answer

Loop Guard: Prevents loops by disabling a port if it stops receiving BPDUs, protecting against unidirectional links.

Question 6

Two switches are configured for LACP EtherChannel. One side is set to passive and the other side is also set to passive. What is the most likely outcome?

Accepted Answer

The EtherChannel will not form because neither side initiates LACP negotiation.. The EtherChannel will not form because LACP passive mode only listens for negotiation; it does not initiate it. When both sides are set to passive, neither side sends LACP packets, so the bundle cannot be established. This is a deterministic outcome, not merely unlikely.

Answer

The EtherChannel always forms because passive mode is preferred.

Answer

The links automatically become a routed interface.

Answer

The switches delete the bundle configuration automatically.

Question 7

Match each switchport or VLAN term to its most accurate meaning.

Accepted Answer

Access port: A switch port that belongs to a single VLAN and carries untagged traffic for that VLAN.. Access ports are in one VLAN; trunk ports carry multiple VLANs with tags. Switchport mode commands set the port type. VLANs create separate broadcast domains; SVIs provide Layer 3 routing for VLANs.

Answer

Trunk port: A switch port that carries traffic for multiple VLANs and uses 802.1Q tagging to identify each frame's VLAN.

Answer

VLAN: A logical grouping of devices that are on the same broadcast domain, regardless of physical location.

Answer

SVI: A virtual interface on a switch that provides Layer 3 routing for a VLAN.

Question 8

A switch port connected to a workstation is configured with sticky MAC learning and a maximum secure MAC count of 1. What is the main operational benefit of sticky learning in this case?

Accepted Answer

It dynamically learns a secure MAC address and can preserve it if the configuration is saved.. Sticky learning gives the convenience of dynamic discovery while still treating the learned address as a secure port-security entry. In practical terms, the switch can observe the first legitimate MAC address on the port and record it as a secure address without the administrator having to type that address manually. If the running configuration is later saved, that sticky entry can persist after a reload.

This is useful because it balances ease of deployment with access control. The maximum secure MAC count still matters, and port security is still active. Sticky learning does not replace port security; it works within it.

Answer

It disables the maximum secure MAC limit on the interface.

Answer

It automatically saves the running configuration to the startup configuration after learning the MAC address.

Answer

It prevents the port from ever generating a security violation.

Question 9

A switchport connected to a user workstation is placed in VLAN 30. The administrator also wants to prevent that port from learning more than one MAC address. Which feature should be configured?

Accepted Answer

Port security. The correct feature is port security. In practical terms, port security lets the administrator control how many MAC addresses can be learned on a switchport and what happens if that limit is exceeded. That makes it a very natural fit for a user-facing access port where one endpoint is expected and unmanaged extra devices are not.

This is a common access-layer hardening technique. VLAN assignment controls where the traffic belongs, but it does not limit who or what can appear on the port. Port security adds that second layer of control.

Answer

EtherChannel

Answer

OSPF passive-interface

Answer

Native VLAN

Question 10

A switchport on one side of a link is configured as a trunk, but the peer side is configured as an access port. What is the most likely result?

Accepted Answer

The link roles are mismatched, so VLAN traffic will not be handled as intended.. The most likely result is a logical mismatch that prevents VLAN traffic from crossing the link as intended. In practical terms, one side is trying to carry multiple VLANs with tagging behavior, while the other side is treating the connection as a normal one-VLAN endpoint port. That disagreement usually leads to unexpected or failed traffic behavior.

This is a classic switching mismatch scenario. The link may still be physically up, but the two sides do not agree on how the traffic should be handled.

Answer

The access side automatically becomes a routed port.

Answer

Both switches automatically synchronize their switchport settings.

Answer

The mismatch forces OSPF to change router IDs.

Question 11

Match each VLAN or trunk term to its most accurate purpose.

Accepted Answer

Trunk: Carries traffic for multiple VLANs over a single link.. Trunks enable multiple VLANs on one link; VLANs logically segment networks. 802.1Q is the tagging standard; native VLAN is untagged. VTP distributes VLAN database; inter-VLAN routing uses a router or Layer 3 switch to communicate between VLANs.

Answer

VLAN: Provides a method to tag frames for multiple VLANs on a trunk.

Answer

Native VLAN: Used to route traffic between different VLANs.

Answer

802.1Q: Distributes VLAN configuration information across switches.

Question 12

Match each switchport or STP feature to its most accurate purpose.

Accepted Answer

PortFast allows a port to skip listening/learning states.. PortFast allows an edge port to immediately transition to forwarding state, skipping listening and learning. BPDU Guard disables a port if a BPDU is received, enhancing security. Root Guard prevents a port from becoming the root port by error-disabling it upon receiving superior BPDUs. Port Security limits MAC addresses allowed on a switch port.

Answer

UplinkFast provides fast failover for directly connected failures.

Answer

BackboneFast reduces convergence time for indirect failures.

Answer

BPDU Guard disables a port if BPDU is received.

Question 13

Match each wireless concept to its most accurate description.

Accepted Answer

SSID is the network name, BSSID is the AP's MAC, beacon frames advertise the network, probe requests are client discovery, association is joining the network, and authentication verifies identity before association.. SSID is the WLAN name broadcasted to clients, making it synonymous with 'The WLAN name shown to clients.' An access point is the device that bridges wireless clients to the wired network, directly matching 'Device that provides wireless connectivity.' A controller-based WLAN uses a central controller to manage multiple APs, which aligns with 'Design in which centralized devices manage APs.' WPA2 is a security protocol for wireless networks, fitting 'Wireless security standard.' The other concepts (BSSID, beacon frames, etc.) are related but not part of this matching exercise.

Answer

SSID is the AP's MAC, BSSID is the network name, beacon frames are used for client discovery, probe requests advertise the network, association verifies identity, and authentication joins the network.

Answer

SSID is the network name, BSSID is the AP's MAC, beacon frames are used for client discovery, probe requests advertise the network, association verifies identity, and authentication joins the network.

Answer

SSID is the AP's MAC, BSSID is the network name, beacon frames advertise the network, probe requests are client discovery, association verifies identity, and authentication joins the network.

Question 14

A switchport on one side of a link is configured as a trunk, but the peer side is configured as an access port. The physical link is up, but VLAN traffic behaves unexpectedly. What is the most likely cause?

Accepted Answer

The two ends disagree on whether the link is a trunk or an access port.. The most likely cause is a switchport mode mismatch. In practical terms, one side expects the link to carry multiple VLANs with tagging behavior, while the other side treats it as a normal one-VLAN endpoint-style access connection. The physical interface can still come up, but the two ends do not agree on how the traffic should be handled.

This is a classic Layer 2 troubleshooting pattern. The link may not be fully down, but the configuration disagreement causes logical forwarding problems.

Answer

The switches must both use the same hostname.

Answer

The native VLAN must be set to 1 on both sides first.

Answer

The ports need OSPF enabled.

Question 15

Which two statements accurately describe WPA2 and WPA3 in wireless security?

Accepted Answer

Both are wireless security standards used to help protect WLAN access and traffic.. WPA2 and WPA3 are wireless security standards used to protect WLAN access and traffic. In practical terms, both are associated with securing wireless communication, but WPA3 is generally positioned as the newer standard with security improvements over WPA2. The key idea at CCNA level is recognizing them as WLAN security standards rather than confusing them with SSIDs, controllers, or radio bands.

You do not need deep protocol internals here. You need the role and relative positioning right.

Answer

Both are names for specific 802.11 radio frequencies.

Answer

WPA2 and WPA3 are types of trunk ports.

Answer

WPA3 eliminates the need for SSIDs.