CCNA Switching and Network Access Practice Test 8 — 15 Questions

Question 1

Which three statements accurately describe the operation of the Spanning Tree Protocol (STP) root bridge election? (Choose three.)

Accepted Answer

All ports on the root bridge are placed in the designated role.. The Spanning Tree Protocol (STP) root bridge election is based on the bridge ID, which combines a configurable priority (default 32768) and the switch's MAC address. The switch with the lowest bridge ID wins the election, making option 1 correct. If priorities are equal, the MAC address serves as the tiebreaker, so the switch with the lowest MAC address is chosen, confirming option 2. Once elected, all ports on the root bridge become designated ports (forwarding), as they are the most efficient paths to the root, making option 3 correct.

Answer

The root bridge election occurs every 30 seconds by default.

Answer

The root bridge priority can be modified using the 'spanning-tree vlan vlan-id root secondary' command to force it to become root.

Answer

The root bridge is always the switch with the highest MAC address.

Question 2

Which of the following statements about VLAN configuration and trunking on a Cisco switch are correct? (Choose all that apply.)

Accepted Answer

Dynamic Trunking Protocol (DTP) can automatically negotiate trunking between two Cisco switches.. The correct statements are: the native VLAN on a trunk carries untagged traffic and must match on both ends; VLAN 1 cannot be deleted; DTP can negotiate trunking; and the 'switchport trunk allowed vlan' command restricts VLANs on a trunk. The incorrect statements are: an access port can carry multiple VLANs (an access port is assigned to a single VLAN only), and a trunk link can only carry VLANs that are globally created on the switch. In practice, a trunk can carry traffic for any VLAN that exists in the local VLAN database; the term 'globally created' is misleading as VLANs are created per switch, not globally. Therefore, both of these options are wrong.

Answer

A trunk link can only carry VLANs that are globally created on the switch.

Answer

A switchport configured as an access port can carry multiple VLANs.

Question 3

Which four of the following are considered best practices for securing switch ports and preventing Layer 2 attacks? (Choose all that apply. There are four correct answers.)

Accepted Answer

Disable unused ports and place them in a shutdown state.. Disabling unused ports and placing them in a shutdown state prevents unauthorized physical access and stops Layer 2 attacks like rogue device connections or VLAN hopping. Enabling PortFast and BPDU guard on ports connecting to end devices speeds up STP convergence and protects against rogue switch loops. DHCP snooping prevents rogue DHCP server attacks by filtering untrusted DHCP messages. Dynamic ARP inspection uses DHCP snooping bindings to validate ARP packets and prevent ARP spoofing. Setting the native VLAN to a higher number is not a best practice; the recommended approach is to change the native VLAN to an unused VLAN on both ends of the trunk and explicitly tag it. MAC address filtering as the sole measure is easily bypassed and must be combined with port security or 802.1X.

Answer

Set the native VLAN to a higher number than the default VLAN 1 on trunk links.

Answer

Use MAC address filtering as the sole security measure to prevent unauthorized access.

Question 4

Drag and drop the following steps into the correct order to configure spanning-tree protection features including BPDU Guard, Root Guard, and Loop Guard on a Cisco switch.

Accepted Answer

Identify edge ports connected to end devices.. The correct order is: (1) Identify edge ports connected to end devices. (2) Configure spanning-tree portfast on those interfaces. (3) Enable BPDU Guard using the spanning-tree portfast bpduguard default global command. (4) Identify ports connected to other switches that should never become the root bridge. (5) Enable Root Guard on those interfaces with spanning-tree guard root. (6) Identify point-to-point non-edge ports susceptible to unidirectional link failures. (7) Enable Loop Guard on those interfaces with spanning-tree guard loop. This sequence first secures edge ports with PortFast and BPDU Guard to prevent accidental network loops and BPDU-based attacks, then applies Root Guard on ports where a superior BPDU should never be received to protect the root bridge placement, and finally implements Loop Guard on non-edge point-to-point links to guard against unidirectional link failures that could cause bridging loops. Identifying the ports before applying configurations ensures proper placement of each protection mechanism.

Question 5

Drag and drop the items on the left to match the descriptions on the right.

Accepted Answer

Access port: Carries traffic for a single VLAN, configured with switchport mode access.. Access ports carry traffic for a single VLAN and are configured with switchport mode access. Voice VLANs are added to an access port with switchport voice vlan to separate voice and data traffic. Trunk ports carry multiple VLANs and are set with switchport mode trunk; allowed VLANs can be restricted with switchport trunk allowed vlan.

Answer

Voice VLAN: Added to a trunk port to prioritize voice traffic.

Answer

Allowed VLANs: Configured with switchport access vlan to restrict VLANs on a trunk.

Question 6

A network engineer connects a new switch to an existing Rapid PVST+ campus network. The new switch is intended to serve as an additional access-layer switch, but after connecting its uplinks, the engineer discovers that the root bridge for VLAN 10 has changed to this new switch, and several access ports on other switches with PortFast and BPDU Guard enabled are now in err-disabled state. Some users report intermittent connectivity loss.

Accepted Answer

The new switch’s bridge priority is lower than the existing root bridge, and it was connected to a port with BPDU Guard enabled.. The new switch has a lower bridge priority, so it becomes the root bridge for VLAN 10, changing the root. As the new root, it sends BPDUs out its designated ports. Any PortFast port with BPDU Guard enabled that receives an unexpected BPDU (even from a legitimate switch) will be placed into err-disabled state. This explains the err-disabled access ports and connectivity loss.

Answer

The new switch was connected to a port configured as a trunk with a native VLAN mismatch.

Answer

The new switch has PortFast enabled on its uplinks.

Answer

The BPDU Guard feature was globally enabled on all ports, including trunk ports.

Question 7

A technician connects a PC to a switch port that has port security enabled with the default maximum of one MAC address and violation mode shutdown. Immediately after connecting, the port goes into the err-disabled state. The technician runs the show interfaces command and sees the port status as err-disabled. What should the technician do next?

Accepted Answer

Configure the port security violation mode to restrict, increase the maximum number of MAC addresses, and then recover the port.. The port entered err-disabled due to a port security violation (the PC's MAC differs from the allowed secure MAC, exceeding the default maximum of 1). Simply recovering the port with shutdown/no shutdown would not fix the underlying problem, as any traffic from the PC would immediately trigger another violation. The technician should first adjust the port security configuration to accommodate the PC: configure the violation mode to restrict (which drops packets from unknown MACs but keeps the port up and logs events) and increase the maximum number of MAC addresses to allow the PC's MAC to be learned. Then recover the port using shutdown/no shutdown (or errdisable recovery). Option A describes this correct approach.

Answer

Disable port security on the interface.

Answer

Enter the shutdown and no shutdown commands to recover the port, then enable port security with sticky MAC learning.

Answer

Verify the spanning-tree portfast configuration on the interface.

Question 8

A network technician is connecting a new access switch to an existing Cisco switch. The technician wants to ensure that the new switch does not become the root bridge for any VLANs. Which command should be configured on the new switch to achieve this?

Accepted Answer

spanning-tree vlan 1-4094 priority 61440. The root bridge election is based on the lowest bridge priority. By setting the priority to the maximum value of 61440, the switch is given the lowest chance of becoming root. This is a common practice for access switches to ensure the core or distribution switches remain root.

Answer

spanning-tree vlan 1-4094 root primary

Answer

spanning-tree portfast default

Answer

spanning-tree vlan 1-4094 root secondary

Question 9

A network administrator is configuring a new Cisco Catalyst switch. The switch needs to support multiple VLANs and provide redundant links to another switch using EtherChannel. The administrator configures two physical interfaces as trunk ports and assigns them to channel-group 1 mode desirable. However, the EtherChannel does not form. Which of the following is the most likely cause?

Accepted Answer

The interfaces are configured with different speed settings.. EtherChannel formation requires consistent configuration on all member interfaces, including speed, duplex, and trunk mode. Mismatched speed settings prevent the channel from bundling, even if other parameters match. The scenario specifies both interfaces are trunk ports, ruling out mode mismatch, but does not mention speed, making speed mismatch the most likely cause. Other inconsistencies like allowed VLAN lists do not prevent formation but can affect traffic.

Answer

The interfaces are configured with different trunk encapsulation types.

Answer

The interfaces are configured with different VLAN assignments (access vs. trunk).

Answer

The interfaces are configured with different allowed VLAN lists.

Question 10

A network engineer is configuring a new access switch. The security policy requires that when a device is connected to a port, the port must wait for authentication before passing any user traffic. The authentication server is a Cisco ISE appliance using RADIUS, and the endpoint is expected to run an 802.1X supplicant. Which command set on the interface enforces this requirement?

Accepted Answer

authentication port-control auto, dot1x pae authenticator, and mab. Enforcing authentication before traffic flows requires the switch to act as the 802.1X authenticator and to place the port under automatic control. The authentication port-control auto command keeps the port unauthorized until the supplicant authenticates, and dot1x pae authenticator defines the switch role. Adding MAB gives a fallback for devices that lack a supplicant while still requiring authorization.

Answer

authentication port-control force-authorized and dot1x pae authenticator

Answer

dot1x system-auth-control and authentication port-control force-unauthorized

Answer

authentication port-control auto and authentication open

Question 11

A network engineer is troubleshooting a switched network where a host connected to a switch port is experiencing intermittent connectivity. The switch port is configured with PortFast and BPDU Guard. The engineer notices that the port goes into err-disabled state frequently. Which of the following is the most likely cause?

Accepted Answer

The switch port is receiving BPDUs from another switch connected to the same port.. BPDU Guard is a security feature that err-disables a PortFast-enabled port if it receives a BPDU. This typically happens when a switch is connected to a port intended for end hosts. The intermittent connectivity results from the port being disabled and then recovered (if err-disable recovery is configured). The most likely cause is another switch sending BPDUs, triggering the violation. Other issues like duplex mismatch or faulty NIC would not cause err-disabled.

Answer

The host is experiencing a duplex mismatch with the switch port.

Answer

The host is using a faulty network interface card (NIC).

Answer

The host is sending BPDUs, triggering BPDU Guard.

Question 12

Which spanning-tree port state listens for BPDUs and participates in STP, but does not learn MAC addresses yet?

Accepted Answer

Listening. In the classic 802.1D sequence, the listening state processes BPDUs and prepares for forwarding decisions, but it does not populate the MAC address table yet.

Answer

Blocking

Answer

Learning

Answer

Forwarding

Question 13

What is a common requirement for interfaces to successfully bundle into an EtherChannel?

Accepted Answer

All member interfaces must use matching speed, duplex, and trunk/access settings. EtherChannel members must have compatible operational and administrative settings, including speed, duplex, and switchport mode.

Answer

Each interface must belong to a different VLAN

Answer

Only odd-numbered switch ports can be bundled

Answer

Each interface must have a different STP path cost

Question 14

In a router-on-a-stick design, what is configured on the physical router interface connected to the switch?

Accepted Answer

Subinterfaces with 802.1Q encapsulation for each routed VLAN. Router-on-a-stick uses one physical router interface with multiple logical subinterfaces. Each subinterface is associated with a VLAN using 802.1Q encapsulation and gets an IP address for that VLAN. Option A is wrong because IP addresses are configured on subinterfaces, not directly on the physical interface for all VLANs. Option B is wrong because inter-VLAN routing requires a router; the switch alone does not perform inter-VLAN routing in this design. Option D is wrong because serial encapsulation is used for WAN connections, not for VLAN tagging on Ethernet interfaces.

Answer

One IP address for every VLAN on the physical interface itself only

Answer

No subinterfaces; the switch handles all inter-VLAN routing internally

Answer

A serial encapsulation setting for each VLAN

Question 15

A switch receives a unicast frame for a destination MAC address that is not yet in its MAC address table. What does the switch do?

Accepted Answer

Floods the frame out all ports in the same VLAN except the incoming port. An unknown unicast frame is flooded within the VLAN because the switch does not yet know which port leads to the destination MAC. The frame is not sent back out the receiving port.

Answer

Drops the frame immediately

Answer

Sends the frame to the default gateway first

Answer

Converts the frame to a broadcast packet