CCNA Switching and Network Access Practice Test 9 — 15 Questions

Question 1

On an 802.1Q trunk, which VLAN is sent untagged by default on many Cisco switches unless changed?

Accepted Answer

VLAN 1. On many Cisco platforms, VLAN 1 is the default native VLAN. Native VLAN traffic is sent untagged unless the native VLAN is changed.

Answer

VLAN 10

Answer

VLAN 20

Answer

The highest configured VLAN

Question 2

Which two conditions must match on two switch ports before they can successfully form a Layer 2 EtherChannel? (Choose two.)

Accepted Answer

The switchport mode and VLAN settings. Layer 2 EtherChannel members must have compatible Layer 2 configuration. Port mode, VLAN-related settings, speed, and duplex all need to align for the bundle to form correctly.

Answer

The STP root bridge ID on both switches

Answer

The interface description

Answer

The ARP timeout value

Question 3

A non-root switch has two uplinks toward the root bridge. One path has a lower total STP cost than the other. What role will the lower-cost uplink have?

Accepted Answer

Root port. On a non-root switch, the port with the lowest path cost toward the root bridge becomes the root port. The higher-cost uplink would become an alternate (blocked) port. A designated port is found on the upstream switch toward this switch, not on the non-root switch itself. A disabled port is administratively shut down, which does not apply here.

Answer

Alternate port

Answer

Designated port

Answer

Disabled port

Question 4

A PC connected to switch port Gi0/10 should be in VLAN 20 but receives broadcasts only from VLAN 1. Which switchport setting is most likely wrong?

Accepted Answer

switchport access vlan 20 missing or incorrect. The PC is receiving broadcasts only from VLAN 1, which indicates the switchport is not correctly assigned to VLAN 20. The most likely cause is that the 'switchport access vlan 20' command is missing or incorrect, leaving the port in its default VLAN (VLAN 1). This prevents the PC from participating in VLAN 20 and receiving its broadcasts.

Answer

switchport mode trunk

Answer

speed 1000

Answer

duplex full

Question 5

A switch shows this output from the "show interfaces trunk" command:

Gi0/1    on        802.1q    trunking    1
Gi0/2    auto      802.1q    not-trunking  1

Which statement is correct?

Accepted Answer

Gi0/1 is trunking, and Gi0/2 is waiting for DTP negotiation. Gi0/1 is already operating as an 802.1Q trunk. Gi0/2 is in dynamic auto mode, which waits for the other side to actively negotiate trunking.

Answer

Gi0/1 is an access port in VLAN 1

Answer

Gi0/2 is forced to trunk mode

Answer

Neither interface can carry tagged traffic

Question 6

A trunk link has a native VLAN mismatch between two switches. What is the most likely result?

Accepted Answer

Untagged frames can be interpreted as belonging to different VLANs on each switch.. Untagged traffic may be placed into different VLANs on each side of the trunk, causing traffic leakage or connectivity problems.

Answer

All VLANs except the native VLAN stop forwarding immediately.

Answer

The trunk automatically converts to an access port.

Answer

STP is disabled on the trunk until the mismatch is corrected.

Question 7

Which spanning-tree port role receives the best BPDU toward the root bridge on a nonroot switch?

Accepted Answer

Root port. The root port is the port on a nonroot switch with the lowest path cost to the root bridge.

Answer

Designated port

Answer

Alternate port

Answer

Disabled port

Question 8

A switch displays this output:

Port      Name               Status    Vlan
Fa0/1                        connected 10
Fa0/2                        connected 10
Fa0/24                       connected trunk

Which port should be checked first if a user in VLAN 20 cannot reach the distribution switch over the uplink?

Accepted Answer

Fa0/24. If users in VLAN 20 must cross the uplink, the trunk port is the first place to verify allowed VLANs and tagging.

Answer

Fa0/1

Answer

Fa0/2

Answer

Any access port in VLAN 1

Question 9

A switch displays the following output:

Switch# show interfaces trunk

Port        Mode    Encapsulation  Status     Native vlan
Gi1/0/24    on      802.1q         trunking   99

Port        Vlans allowed on trunk
Gi1/0/24    10,20,30

Port        Vlans active in management domain
Gi1/0/24    10,20,30,40

Users in VLAN 40 cannot reach resources across this trunk.

What is the most likely reason?

Accepted Answer

VLAN 40 is not permitted on the trunk. The trunk is not carrying VLAN 40 because VLAN 40 is missing from the allowed VLAN list (only 10, 20, 30 are allowed). Option A is incorrect because spanning tree does not block VLANs by default without evidence of a loop; the output shows no STP blocking. Option B is incorrect because native VLAN only affects tagging, not whether a VLAN can traverse a trunk; all VLANs can cross a trunk if permitted. Option D is incorrect because 802.1Q can carry up to 4094 VLANs, not just three. The key distinction is that a VLAN may be active on the switch but still fail to cross a specific trunk if it is not in the allowed list.

Answer

VLAN 40 is active, so spanning tree must be blocking it

Answer

VLAN 40 is not in the native VLAN, so it cannot cross the trunk

Answer

802.1Q trunks can carry only three VLANs at a time

Question 10

A switch administrator enters the following commands on interface GigabitEthernet1/0/10:

interface g1/0/10
 switchport mode access
 switchport access vlan 30
 spanning-tree portfast
 spanning-tree bpduguard enable

A user connects a small managed switch to this port, and the access port immediately changes to an err-disabled state.

Which feature caused the port to shut down?

Accepted Answer

BPDU Guard. BPDU Guard is the feature that caused the shutdown. This question is really about separating two features that are often configured together on user-facing ports: PortFast and BPDU Guard. PortFast helps an edge port come up quickly, which is useful for PCs and phones. BPDU Guard adds protection by watching for BPDUs on that same port. If a switch is connected where only an end device should exist, the newly connected switch may send BPDUs. The local switch interprets that as a topology risk and disables the port to protect the Layer 2 network. The clues are the err-disabled state and the fact that another switch was connected. VLAN assignment and access mode are normal here and do not explain the shutdown.

Answer

PortFast

Answer

Access VLAN 30 assignment

Answer

The interface being in access mode

Question 11

A network engineer checks EtherChannel status on a switch and sees the following output:

Group  Port-channel  Protocol  Ports
------+-------------+---------+-----------------------------
1      Po1(SD)      LACP      Gi1/0/1(s) Gi1/0/2(I)

What is the most likely reason the EtherChannel is not forwarding traffic?

Accepted Answer

At least one member interface is not bundled correctly, so the logical channel is down. The safest conclusion from this output is that the member interfaces are not successfully participating in the bundle, so the logical port-channel is down. Cisco exam questions often test whether you can read the status flags without overcommitting to a very specific root cause that the exhibit does not explicitly prove. One member is suspended and another is not bundled into the channel correctly, so the EtherChannel never reaches a healthy forwarding state. In the real world, that can happen because of trunk mismatches, allowed VLAN mismatches, native VLAN problems, inconsistent channel-group settings, or negotiation issues. The key exam skill is recognizing that the bundle itself failed, not guessing one hidden configuration line that is not shown.

Answer

The member interfaces have mismatched speed or duplex settings

Answer

The port channel is Layer 3 instead of Layer 2

Answer

LACP requires exactly four links to form a bundle

Question 12

A user connects a small unmanaged switch to an access port, and the port immediately transitions to err-disabled. Which feature most likely caused this behavior?

Accepted Answer

BPDU Guard. BPDU Guard is the correct answer because it is specifically designed to protect access ports configured with PortFast. When an unauthorized switch is connected to such a port, BPDU Guard detects the incoming BPDU and immediately places the port into err-disabled state, preventing potential loops or topology changes. UDLD aggressive detects unidirectional links but does not cause err-disabled due to BPDU reception. Root guard blocks ports that attempt to become the root bridge by placing them in root-inconsistent state (not err-disabled). Loop guard prevents alternate/root ports from becoming designated in the absence of BPDUs, putting the port into loop-inconsistent state, again not err-disabled.

Answer

UDLD aggressive

Answer

Root guard

Answer

Loop guard

Question 13

Clients in VLAN 30 are not receiving addresses from the DHCP server located in VLAN 99. Which configuration change should be made on the Layer 3 interface for VLAN 30?

Accepted Answer

Add ip helper-address 10.99.99.20 under interface Vlan30.. The DHCP server is on a different subnet, so the client broadcast messages from VLAN 30 will not naturally cross the Layer 3 boundary. In simple terms, the clients are asking for an address by shouting on their own floor of the building, but the server lives on another floor and cannot hear that broadcast directly. The router or Layer 3 switch must relay the request for them. On Cisco devices, that relay function is usually configured with `ip helper-address` on the interface that receives the client broadcasts.

Here, that receiving interface is Vlan30, because that is the default gateway for the clients in VLAN 30. Pointing `ip helper-address` to 10.99.99.20 tells the Layer 3 device to forward DHCP requests to the remote server. DHCP snooping trust is a separate security feature, trunk mode is unrelated to an SVI, and `ip default-gateway` is not the correct solution for relaying DHCP across subnets.

Answer

Add ip dhcp snooping trust under interface Vlan30.

Answer

Add switchport mode trunk under interface Vlan30.

Answer

Add ip default-gateway 10.99.99.20 under interface Vlan30.

Question 14

PCs in VLAN 30 on SwitchA cannot reach servers in VLAN 30 on SwitchB. All other VLANs work across the trunk. What is the most likely cause?

Accepted Answer

VLAN 30 is not allowed on the trunk from SwitchA.. The trunk is up and carrying multiple VLANs, but VLAN 30 is missing from the allowed list on one side. Since SwitchA and SwitchB both need to permit VLAN 30 on the trunk, if SwitchA's allowed VLAN list does not include VLAN 30, traffic for that VLAN cannot cross. Native VLAN mismatch or ISL vs 802.1Q issues would affect all VLANs, not just VLAN 30. Thus, the most likely cause is that VLAN 30 is not allowed on the trunk from SwitchA.

Answer

The native VLAN is mismatched between the switches.

Answer

VLAN 30 should be configured as the native VLAN on both ends.

Answer

SwitchB must use ISL instead of 802.1Q.

Question 15

A multilayer switch must route traffic between VLAN 10 and VLAN 20. Which condition is required for that to happen?

Accepted Answer

SVIs for the VLANs plus Layer 3 routing enabled on the switch. Inter-VLAN routing on a multilayer switch depends on having functional Layer 3 gateway interfaces for the VLANs and routing enabled on the switch. In plain language, the switch needs a routed brain for each VLAN, usually in the form of SVIs, and it must actually be operating as a Layer 3 device rather than only as a pure Layer 2 switch. Without those conditions, traffic may switch inside a VLAN but cannot be routed between different VLANs.

This is a core CCNA design idea because people often assume creating VLANs alone automatically gives them inter-VLAN communication. In reality, VLANs create separation, and routing is what reconnects them under controlled conditions. A trunk between switches can carry VLAN traffic, but it does not itself perform Layer 3 routing between the VLANs. The correct answer is the requirement that makes the switch act as the gateway between VLANs.

Answer

All ports in both VLANs configured as trunks

Answer

A separate OSPF process on every access port

Answer

Port security disabled on every edge port