CCNA Switching Network Access Questions — Page 3 of 5

151

MCQmedium

Why is BPDU Guard commonly enabled on PortFast-enabled access ports?

A.To make STP root election happen faster

B.To disable STP permanently on access ports

C.To err-disable a port if it receives unexpected BPDUs

D.To allow only one MAC address on the access port

AnswerC

BPDU Guard is a protective feature used with PortFast on access ports to prevent loops from unauthorized BPDUs. If the port receives any BPDU, which should not occur on an end-node connection, the switch immediately err-disables the interface to stop potential bridging loops. This safeguards the network from misconfigured or malicious devices.

Why this answer

PortFast ports are meant for end devices, not for switches. BPDU Guard protects the LAN by shutting down a PortFast port that unexpectedly starts receiving BPDUs, which usually means an unauthorized switch was connected.

Exam trap

Don't confuse BPDU Guard with PortFast or BPDU filtering; each has distinct roles.

Why the other options are wrong

BPDU Guard is a security feature that err-disables a port upon receiving BPDUs; it does not accelerate root election. Root election speed is influenced by STP timers and bridge priorities, not BPDU Guard.

BPDU Guard does not disable STP permanently; it only reacts to BPDU reception by err-disabling the port. STP remains active on other ports, and the port can be re-enabled after the violation is resolved.

Limiting MAC addresses on a port is the function of port security, not BPDU Guard. BPDU Guard specifically monitors for BPDU frames and takes action if any are received.

Practice this question →

152

Drag & Dropmedium

Drag and drop the following steps into the correct order to configure inter-VLAN routing using a router-on-a-stick topology.

Drag or tap steps into the slots.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Why this order

Inter-VLAN routing via router-on-a-stick requires creating VLANs on the switch, placing access ports in those VLANs, configuring a trunk to the router with the correct native VLAN to avoid mismatch, enabling the physical router interface, and then defining subinterfaces per VLAN with 802.1Q encapsulation and IP addresses. This ensures traffic from different VLANs can be routed.

Practice this question →

153

MCQhard

A trunk link has a native VLAN mismatch between two switches. What is the most likely result?

A.All VLANs except the native VLAN stop forwarding immediately.

B.Untagged frames can be interpreted as belonging to different VLANs on each switch.

C.The trunk automatically converts to an access port.

D.STP is disabled on the trunk until the mismatch is corrected.

AnswerB

With a native VLAN mismatch, each switch places untagged 802.1Q frames into its locally configured native VLAN. For example, if Switch A's native VLAN is 10 and Switch B's is 20, a single untagged frame will be associated with VLAN 10 on one side and VLAN 20 on the other, effectively crossing broadcast domains and potentially exposing traffic to the wrong VLAN. This misclassification can lead to security breaches, routing loops, or connectivity anomalies because VLAN membership is not preserved end-to-end.

Why this answer

Untagged traffic may be placed into different VLANs on each side of the trunk, causing traffic leakage or connectivity problems.

Exam trap

Be careful not to confuse native VLAN mismatches with issues that affect tagged traffic or automatic switch behavior.

Why the other options are wrong

A native VLAN mismatch does not cause all other VLANs to stop forwarding. The trunk continues to forward frames for all VLANs, but untagged frames (native VLAN) are miscommunicated.

A trunk port does not automatically convert to an access port due to a native VLAN mismatch. The trunk remains operational, but the native VLAN mismatch causes problems for untagged traffic.

STP continues to run normally on the trunk link despite a native VLAN mismatch. The mismatch does not disable STP; it only affects the handling of untagged frames.

Practice this question →

154

Drag & Dropmedium

A network troubleshooter is using Cisco IOS-XE's embedded packet capture feature to capture traffic on an interface and then analyze it in Wireshark to isolate a Layer 2 or Layer 3 fault. Which of the following sequences represents the correct order of steps?

Drag or tap steps into the slots.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

The correct workflow is to first define the capture point (interface and any filters), then start the capture, stop it when sufficient data is collected, export the captured packets to a file, and finally open that file in Wireshark for analysis. Starting the capture before defining the point, exporting before stopping, or defining the point after stopping all result in an invalid or incomplete capture process.

Exam trap

Remember that the capture point must be defined before starting the capture, and the capture must be stopped before exporting. Do not confuse the order of these steps.

Practice this question →

155

Multi-Selectmedium

Which two statements accurately describe why organizations use separate employee and guest WLANs?

Select 2 answers

A.They allow different access policies and trust boundaries for different user groups.

B.They help isolate guest access from internal corporate resources.

C.They eliminate the need for wireless security.

D.They make all roaming problems disappear automatically.

E.They replace the need for VLANs or policy controls behind the scenes.

AnswersA, B

Separate WLANs map to distinct security domains, enabling administrators to enforce role-based policies such as 802.1X authentication for employees and PSK access for guests. This segmentation establishes clear trust boundaries, so that device type, user role, or location can determine which network resources are reachable. Without multiple WLANs, all clients might share the same Layer 2 domain, making it impossible to apply differentiated security controls.

Why this answer

Organizations use separate WLANs because different user groups usually require different trust levels, policies, and access rights. In practical terms, employees may need access to internal business systems, while guests usually need a more limited and isolated experience. Separate WLANs make that segmentation and policy enforcement easier.

This is a design and security decision, not just a naming preference.

Exam trap

Avoid assuming that separate WLANs are used for performance improvements or marketing purposes; focus on security and access control.

Why the other options are wrong

Separate WLANs do not eliminate the need for wireless security; both employee and guest WLANs require encryption (e.g., WPA2/WPA3) and authentication mechanisms to protect data in transit and prevent unauthorized access.

Roaming problems, such as handoff delays or authentication re-requirements, are not automatically resolved by having separate WLANs; they depend on factors like controller configuration, AP placement, and roaming protocols (e.g., 802.11r).

Separate WLANs do not replace the need for VLANs or policy controls; in fact, they often rely on VLANs to segregate traffic and on additional policies (e.g., ACLs, firewall rules) to enforce access restrictions between the WLANs and the network.

Practice this question →

156

MCQhard

An administrator connects a new access-layer switch to a distribution switch. The link comes up but remains in a blocking state and does not forward frames. The administrator issues the show command shown in the exhibit. What is the most likely reason the link is blocked?

A.BPDU Guard is enabled on the port, and the new switch's BPDUs caused the port to enter err-disable state.

B.Loop Guard is enabled, and the port has stopped receiving BPDUs, leading to a loop-inconsistent state.

C.Root Guard is configured on the port, and the new access switch is sending superior BPDUs, triggering a root-inconsistent state.

D.The port is configured with PortFast, and the new switch's BPDU triggered a loop, causing the port to err-disable.

AnswerC

Root Guard is the mechanism that enforces the root bridge position by transitioning a port to the 'root-inconsistent' state when a superior BPDU (lower bridge ID) arrives, effectively blocking the port. Because the new access switch is sending superior BPDUs, the port has been placed in a blocked state to prevent it from becoming the root port and usurping the root bridge. The 'show spanning-tree inconsistentports' output confirms this condition, and the port will automatically recover once the superior BPDUs cease, which is consistent with the exhibit.

Why this answer

The link is blocked because Root Guard is configured on the distribution switch port. When the new access-layer switch sends superior BPDUs (with a lower bridge priority), Root Guard transitions the port to a root-inconsistent (blocking) state to protect the current root bridge from being usurped. This prevents the new switch from becoming the root bridge, which would disrupt the spanning-tree topology.

Exam trap

Cisco often tests the distinction between err-disable states (BPDU Guard) and blocking states (Root Guard, Loop Guard), so the trap here is assuming any BPDU-related protection causes err-disable, when Root Guard specifically causes a blocking state without err-disable.

Why the other options are wrong

BPDU Guard results in err-disable, which is not reflected in the show spanning-tree inconsistentports output. The exhibit clearly shows Root Inconsistent, indicating Root Guard, not BPDU Guard.

Loop Guard creates a loop-inconsistent listing, not root-inconsistent. The command output explicitly indicates Root Inconsistent, ruling out Loop Guard.

Without BPDU Guard, PortFast does not react to BPDUs with a blocking state. The exhibit's root-inconsistent inconsistency is specific to Root Guard, not PortFast or BPDU Guard.

Practice this question →

157

MCQmedium

After a switch replacement, users in VLAN 30 cannot reach devices in other VLANs. The replacement switch has a trunk link to the distribution switch that shows as up/up. What is the most likely cause?

A.The native VLAN must be changed to 30

B.VLAN 30 is not permitted on the trunk link

C.The uplink should be configured as an access port

D.STP must be disabled on VLAN 30

AnswerB

The trunk allowed list controls which VLANs traverse the link, and without an explicit 'allowed vlan add 30' statement, frames belonging to VLAN 30 are discarded at the trunk. Because the access switch and distribution switch only carry permitted VLANs, VLAN 30 has no path to the rest of the network. This exactly matches the symptom that only VLAN 30 suffers while other VLANs work normally on the same uplink.

Why this answer

The trunk is up, but VLAN 30 is not allowed on it. Traffic from that VLAN never crosses the uplink, so inter-VLAN reachability fails for users in VLAN 30 even though the local access ports may still look fine.

Exam trap

Ensure you distinguish between management settings and VLAN configuration. Focus on trunk settings when inter-VLAN issues arise.

Why the other options are wrong

Changing the native VLAN to 30 would not resolve the issue because the native VLAN is used for untagged traffic on a trunk, and the problem is that VLAN 30 traffic is not being allowed at all. Additionally, native VLAN mismatch can cause connectivity issues, but it does not specifically prevent only VLAN 30 from reaching other VLANs.

Configuring the uplink as an access port would place it in a single VLAN, preventing traffic from multiple VLANs (including VLAN 30) from traversing the link. Since the switch needs to carry traffic for multiple VLANs, the uplink must remain a trunk port.

Disabling STP on VLAN 30 would be dangerous as it could cause bridging loops and network instability. Moreover, STP does not control whether a VLAN is allowed on a trunk; it only prevents loops. The issue is a missing VLAN in the trunk allowed list, not a spanning-tree problem.

Practice this question →

158

MCQmedium

A switch administrator enters the following commands on interface GigabitEthernet1/0/10: interface g1/0/10 switchport mode access switchport access vlan 30 spanning-tree portfast spanning-tree bpduguard enable A user connects a small managed switch to this port, and the access port immediately changes to an err-disabled state. Which feature caused the port to shut down?

A.PortFast

B.BPDU Guard

C.Access VLAN 30 assignment

D.The interface being in access mode

AnswerB

Correct. BPDU Guard is correct because it is specifically designed to shut down an edge port that should not receive BPDUs. In plain terms, the switch sees evidence that another switch was attached and decides to protect the topology by disabling the port instead of allowing a possible loop or unexpected spanning-tree participation.

Why this answer

BPDU Guard is the feature that caused the shutdown. This question is really about separating two features that are often configured together on user-facing ports: PortFast and BPDU Guard. PortFast helps an edge port come up quickly, which is useful for PCs and phones.

BPDU Guard adds protection by watching for BPDUs on that same port. If a switch is connected where only an end device should exist, the newly connected switch may send BPDUs. The local switch interprets that as a topology risk and disables the port to protect the Layer 2 network.

The clues are the err-disabled state and the fact that another switch was connected. VLAN assignment and access mode are normal here and do not explain the shutdown.

Exam trap

Remember that BPDU Guard, not PortFast, causes a port to shut down when BPDUs are received. PortFast only affects port transition speed.

Why the other options are wrong

PortFast is a feature that allows a port to transition immediately to the forwarding state, bypassing the usual spanning-tree listening and learning phases. It does not cause a port to shut down or enter an err-disabled state; it only speeds up convergence for end-user devices.

Assigning an access VLAN (VLAN 30) simply places the port into a specific broadcast domain for user traffic. It has no mechanism to detect or react to BPDUs, and it does not cause a port to enter an err-disabled state. The port would remain operational regardless of the VLAN assignment.

Configuring a port as an access port is a standard practice for connecting end devices. It does not inherently cause any shutdown or err-disabled condition. The port remains up and forwarding traffic unless another feature, such as BPDU Guard, triggers a protective action.

Practice this question →

159

Multi-Selectmedium

Which TWO statements correctly describe the configuration and verification of EtherChannel with LACP?

Select 2 answers

A.LACP uses the 'active' and 'passive' modes to negotiate an EtherChannel.

B.The 'show etherchannel summary' command displays the channel group number, port-channel interface, member ports, and their status.

C.LACP uses the 'auto' and 'desirable' modes to negotiate an EtherChannel.

D.The 'show etherchannel summary' command shows the LACP system priority for each channel.

E.An EtherChannel can be formed only if all member ports use the same LACP mode.

AnswersA, B

This statement is correct. LACP negotiation relies on two modes: 'active' and 'passive'. An interface in 'active' mode actively sends LACP packets to initiate the link aggregation, while one in 'passive' mode waits for a response and only sends packets after receiving them. For an EtherChannel to form, at least one side must be 'active'; if both sides are 'passive', the channel will not come up because no negotiation is initiated.

Why this answer

LACP (IEEE 802.3ad) uses 'active' and 'passive' modes to negotiate an EtherChannel. Option B is correct because the 'show etherchannel summary' command displays the channel group number, port-channel interface, member ports, and their status flags (e.g., P for in port-channel, S for suspended). Option C is incorrect because 'auto' and 'desirable' are PAgP modes, not LACP modes.

Option D is incorrect because 'show etherchannel summary' does not show LACP system priority; that is displayed with 'show lacp sys-id' or 'show etherchannel detail'. Option E is incorrect because an EtherChannel can be formed with mismatched LACP modes as long as at least one side is 'active'; for example, 'active' + 'passive' works.

Exam trap

Cisco often tests the distinction between LACP modes ('active'/'passive') and PAgP modes ('auto'/'desirable'), and candidates frequently confuse which protocol uses which set of modes.

Why the other options are wrong

LACP does not use 'auto' and 'desirable' modes; those are PAgP modes.

The 'show etherchannel summary' command does not display LACP system priority; that is shown via 'show lacp sys-id' or 'show etherchannel detail'.

An EtherChannel can be formed even if member ports use different LACP modes (e.g., active and passive), as long as at least one side is active.

Practice this question →

160

Multi-Selectmedium

Which two statements accurately describe WPA2 and WPA3 in wireless security?

Select 2 answers

A.Both are wireless security standards used to help protect WLAN access and traffic.

B.WPA3 is the newer standard relative to WPA2.

C.Both are names for specific 802.11 radio frequencies.

D.WPA2 and WPA3 are types of trunk ports.

E.WPA3 eliminates the need for SSIDs.

AnswersA, B

WPA2 and WPA3 are security protocols that provide authentication and encryption for wireless LANs. WPA2 relies on AES-CCMP for data confidentiality, while WPA3 uses AES-GCMP (with 128-bit keys) and mandates Protected Management Frames to strengthen integrity. They both secure the communications between a wireless client and an access point, thereby protecting WLAN access and traffic from eavesdropping, tampering, and unauthorized use.

Why this answer

WPA2 and WPA3 are wireless security standards used to protect WLAN access and traffic. In practical terms, both are associated with securing wireless communication, but WPA3 is generally positioned as the newer standard with security improvements over WPA2. The key idea at CCNA level is recognizing them as WLAN security standards rather than confusing them with SSIDs, controllers, or radio bands.

You do not need deep protocol internals here. You need the role and relative positioning right.

Exam trap

Avoid assuming WPA3 is limited to specific frequency bands or that WPA2 offers superior security features.

Why the other options are wrong

WPA2 and WPA3 are security protocols, not radio frequencies. 802.11 radio frequencies refer to bands like 2.4 GHz and 5 GHz, which are unrelated to security standards.

Trunk ports are a concept in switched networks for carrying multiple VLANs, typically using 802.1Q tagging. WPA2 and WPA3 have nothing to do with switch port configuration.

WPA3 does not eliminate the need for SSIDs; SSIDs are still required to identify and differentiate wireless networks. WPA3 focuses on authentication and encryption, not network identification.

Practice this question →

161

PBQhard

You are connected to R1. The network uses a router-on-a-stick design with a single switch (SW1) and two VLANs (10 and 20). Currently, hosts in VLAN 10 cannot ping hosts in VLAN 20, and the trunk between R1 and SW1 shows a native VLAN mismatch. Examine the provided configuration and output, then apply the necessary corrections to R1 so that inter-VLAN routing works correctly.

Hints

•Check the native VLAN on the trunk — it might not match the switch.
•Examine each subinterface's encapsulation — one may have the wrong VLAN ID.
•Is IP routing enabled? The router needs to forward between VLANs.

A.Change the native VLAN on R1's trunk interface to 99, correct the encapsulation on G0/0.20 to dot1Q 20, and enable IP routing globally.

B.Change the native VLAN on R1's trunk interface to 99, correct the encapsulation on G0/0.20 to dot1Q 20, but do not enable IP routing because it is enabled by default.

C.Change the native VLAN on R1's trunk interface to 1, correct the encapsulation on G0/0.20 to dot1Q 20, and enable IP routing globally.

D.Change the native VLAN on R1's trunk interface to 99, correct the encapsulation on G0/0.10 to dot1Q 10, and enable IP routing globally.

AnswerA

solution

! R1
interface GigabitEthernet0/0
switchport trunk native vlan 99
exit
interface GigabitEthernet0/0.20
encapsulation dot1Q 20
exit
ip routing

Why this answer

The configuration has three issues: 1) The native VLAN on the trunk is VLAN 1, but the switch expects VLAN 99 (common mismatch scenario). 2) Subinterface G0/0.20 uses encapsulation dot1Q 10 instead of 20, causing VLAN 20 traffic to be mis-tagged. 3) The 'ip routing' command is missing globally, so R1 cannot route between subinterfaces. To fix, configure the main interface G0/0 with 'encapsulation dot1Q 99 native' to set the native VLAN to 99, correct the encapsulation on G0/0.20 to 'dot1Q 20', and enable IP routing with 'ip routing'.

Exam trap

Candidates often forget to enable 'ip routing' globally, assuming it is on by default. They may also overlook the native VLAN mismatch or incorrectly use a Layer 2 switchport command instead of 'encapsulation dot1Q 99 native' on the router interface.

Why the other options are wrong

The specific factual error is that IP routing is not enabled by default; it requires the 'ip routing' global command.

The specific factual error is that the native VLAN must match on both sides; changing R1's native VLAN to 1 does not match the switch's native VLAN 99.

The specific factual error is that the subinterface G0/0.20 is associated with VLAN 20, so its encapsulation must be dot1Q 20, not 10.

Practice this question →

162

MCQhard

A network engineer notices that a newly connected switch-to-switch link is up, but traffic from multiple VLANs is not passing. When issuing the show interfaces trunk command, no trunk ports are listed. Both switch ports are configured with switchport mode dynamic auto. What is the most likely cause?

A.There is a native VLAN mismatch between the two switches.

B.The connecting cable is a straight-through Ethernet cable rather than a crossover cable.

C.One switch lacks a VLAN that exists on the other switch.

D.Both ports are set to dynamic auto, so neither switch initiates DTP negotiation.

AnswerD

In dynamic auto mode, a switch port passively waits for DTP negotiation requests. When both ends are dynamic auto, no side initiates the negotiation, so the ports default to access mode. This perfectly matches the symptom: the link is up, but no trunk appears under show interfaces trunk, and multi-VLAN traffic is not passing.

Why this answer

When both switch ports are configured with switchport mode dynamic auto, neither actively initiates Dynamic Trunking Protocol (DTP) negotiation. DTP dynamic auto ports wait for the other side to send DTP frames to form a trunk; since both sides are passive, the link remains in access mode and does not become a trunk, preventing traffic from multiple VLANs from passing.

Exam trap

Cisco often tests the subtle difference between dynamic auto (passive) and dynamic desirable (active) DTP modes, leading candidates to incorrectly assume that two dynamic auto ports will automatically form a trunk.

Why the other options are wrong

Confusing DTP trunk negotiation with the operational consequences of a native VLAN mismatch.

Assuming that a crossover cable is mandatory for switch-to-switch connections, ignoring auto-MDIX.

Mistaking the ability to forward traffic for a specific VLAN with the ability to negotiate a trunk.

Practice this question →

163

MCQhard

Two switches, SW1 and SW2, are connected via a trunk link. Hosts in VLAN 50 on SW1 cannot communicate with hosts in VLAN 50 on SW2, while hosts in other VLANs communicate normally. What is the most likely cause?

A.VLAN 50 is not allowed on the trunk from SW1.

B.The native VLAN must be changed to 50 on both switches.

C.The trunk must be changed to an access port.

D.The switches must run PPP on the uplink.

AnswerA

The trunk between SW1 and SW2 has a configured allowed VLAN list that excludes VLAN 50; any frames tagged for that VLAN are dropped at the trunk interface. Because 802.1Q trunks only forward VLANs explicitly permitted in the `switchport trunk allowed vlan` list, the missing entry prevents VLAN 50 traffic from reaching SW2. This would cause clients in VLAN 50 to lose connectivity across the link.

Why this answer

The strongest explanation is that VLAN 50 is missing from the allowed VLAN list on one side of the trunk. In practical terms, the trunk is up and carrying other VLANs, so the problem is selective rather than total. When one VLAN is omitted from the allowed list, only that VLAN fails while others continue to work normally.

This is a high-value switching troubleshooting pattern because it rewards careful reading of operational output rather than generic trunk theory.

Exam trap

Be careful to distinguish between total trunk failures and selective VLAN issues. Check the allowed VLAN list on trunk links when only one VLAN is affected.

Why the other options are wrong

The native VLAN is used for untagged traffic on a trunk and does not affect the forwarding of tagged frames for other VLANs. Changing the native VLAN to 50 would not resolve the issue because VLAN 50 frames are still tagged and require inclusion in the allowed VLAN list.

An access port can only carry a single VLAN, so changing the trunk to an access port would prevent the link from carrying multiple VLANs, including VLAN 50. The link is intended to carry multiple VLANs, so a trunk is required.

PPP (Point-to-Point Protocol) is a WAN protocol used on serial links, not on Ethernet trunks. Ethernet trunks use 802.1Q or ISL encapsulation, and PPP has no relevance to VLAN trunking issues.

Practice this question →

164

MCQhard

Users report that their PCs take over 30 seconds to obtain IP addresses and reach the network after being powered on. A network technician checks a switch port connected to a PC and observes that the port transitions through blocking, listening, learning, and then forwarding states, taking about 30 seconds to complete. The switch is running standard 802.1D STP. The technician confirms the port is an access port and only connects to a PC. What should the technician do next?

A.Reduce the STP forward delay timer globally on the switch.

B.Enable PortFast on the access port.

C.Disable STP on the access VLAN assigned to the port.

D.Enable Rapid PVST+ on the switch.

AnswerB

PortFast is designed for ports that connect to end hosts. It forces the port to transition directly to the forwarding state, skipping the normal STP listening and learning phases, which is exactly what is needed to eliminate the 30-second boot-time delay.

Why this answer

The 30-second delay is caused by the standard 802.1D STP port states (blocking → listening → learning → forwarding). Since the port is an access port connecting only to a PC (an end host), there is no risk of a bridging loop. Enabling PortFast immediately transitions the port to the forwarding state, bypassing the listening and learning states and eliminating the delay.

Exam trap

Cisco often tests the misconception that disabling STP or changing global timers is acceptable for a single access port, when the correct solution is to use PortFast to bypass the STP states safely only on end-host ports.

Why the other options are wrong

This action is too drastic and impacts all ports, whereas the issue is specific to access ports connected to end devices. PortFast is the standard, safe method for eliminating delay on edge ports.

Candidates might think that turning off STP on a single VLAN is a quick fix, but it removes the safety net against loops and is not a recommended network practice. PortFast provides the immediate-forwarding benefit while preserving STP loop protection.

Candidates often assume that Rapid PVST+ immediately forwards on all access ports, but the edge port behavior must be configured. The scenario explicitly mentions the port is an access port connected only to a PC; the immediate fix is to enable PortFast, not change the entire STP mode.

Practice this question →

165

MCQhard

A phone and PC share one switchport. The phone works, but the PC cannot reach its normal data resources. The switchport voice VLAN is configured, and the access VLAN is incorrect. Which explanation is strongest?

A.The PC is likely in the wrong data VLAN even though the phone still uses the correct voice VLAN.

B.If the phone works, the PC must also work because both use the same VLAN always.

C.The issue must be BGP because phones cannot use VLANs.

D.The access VLAN becomes irrelevant whenever a voice VLAN is configured.

AnswerA

The PC is likely in the wrong data VLAN even though the phone still uses the correct voice VLAN because a single switchport can serve two logical VLANs simultaneously: an access VLAN for untagged data traffic and a voice VLAN for tagged voice traffic. In a typical Cisco IP phone deployment, the phone tags its voice frames with the voice VLAN and passes the PC's untagged frames onto the access VLAN, so the phone's operation only proves the voice VLAN path is healthy. The PC's connectivity depends entirely on the access VLAN configuration—if the access VLAN ID, subnet, or DHCP scope is misconfigured, the PC will fail while the phone continues to work. Thus, the symptom directly points to a data VLAN issue, not a voice VLAN problem.

Why this answer

The switchport is configured with a voice VLAN for the phone and an access VLAN for the PC. If the access VLAN is incorrect, the PC will be placed in the wrong data VLAN, preventing it from reaching its normal data resources, while the phone continues to operate correctly on its designated voice VLAN. This is a common misconfiguration where the data VLAN ID does not match the network segment the PC expects.

Exam trap

Cisco often tests the misconception that a working phone implies the PC is also correctly configured, but the trap here is that voice and data VLANs are independent, so a misconfigured access VLAN only affects the PC.

Why the other options are wrong

This statement is incorrect because the phone and PC can operate on different VLANs on the same port. The phone uses the voice VLAN, while the PC uses the access (data) VLAN. They are not required to use the same VLAN, and misconfiguration of the access VLAN can cause the PC to fail while the phone works.

BGP (Border Gateway Protocol) is a routing protocol used between autonomous systems, not related to VLAN configuration on a switchport. The issue described is about Layer 2 VLAN assignment, not Layer 3 routing. BGP has no role in this scenario.

The access VLAN remains relevant even when a voice VLAN is configured. The access VLAN is used for the PC's data traffic, while the voice VLAN is used for the phone's traffic. If the access VLAN is incorrect, the PC will not be able to communicate on the correct data network.

Practice this question →

166

Multi-Selectmedium

Which TWO statements correctly describe the behavior of Rapid PVST+ in a Layer 2 network?

Select 2 answers

A.Rapid PVST+ runs a separate instance of RSTP for each VLAN.

B.Rapid PVST+ is an enhancement of PVST+ and uses the same timer-based convergence as standard 802.1D.

C.Rapid PVST+ uses the 802.1D standard to compute the spanning tree for each VLAN.

D.PortFast and BPDU Guard are commonly configured on access ports to prevent loops and speed up convergence.

E.Rapid PVST+ uses the 802.1Q trunking protocol to reduce the number of spanning-tree instances.

AnswersA, D

Rapid PVST+ creates a logical RSTP instance for every active VLAN, meaning each VLAN has its own bridge ID, root bridge election, and set of port roles. This per-VLAN separation lets a network engineer assign different root bridges per VLAN, enabling load balancing where traffic for different VLANs follows different spanning-tree paths. The underlying algorithm is 802.1w RSTP, not 802.1D, and because instances are separate, a topology change in one VLAN does not force a reconvergence in other VLANs.

Why this answer

Rapid PVST+ runs a separate instance of RSTP (802.1w) for each VLAN, enabling per-VLAN rapid convergence and load balancing. Option D is correct because PortFast allows access ports to transition to forwarding immediately, while BPDU Guard prevents loops by disabling a port that receives a BPDU. Option B is incorrect because Rapid PVST+ uses RSTP's handshake mechanism, not timer-based convergence like 802.1D.

Option C is wrong: Rapid PVST+ is based on 802.1w, not 802.1D. Option E is false because Rapid PVST+ does not use 802.1Q to reduce instances; it maintains a separate spanning-tree instance per VLAN.

Exam trap

Cisco often tests the distinction between PVST+ (802.1D-based) and Rapid PVST+ (802.1w-based), and the trap here is assuming Rapid PVST+ still relies on timer-based convergence like standard 802.1D, when in fact it uses the faster RSTP handshake mechanism.

Why the other options are wrong

Rapid PVST+ uses RSTP's rapid handshake process, not timer-based convergence like standard 802.1D.

Rapid PVST+ is based on the 802.1w standard (RSTP), not 802.1D.

Rapid PVST+ runs a separate instance per VLAN and does not use 802.1Q to consolidate instances.

Practice this question →

167

MCQhard

A network administrator is troubleshooting connectivity issues in a switched network. Users on VLAN 10 report intermittent connectivity to the server farm. The network uses Rapid PVST+ as the spanning-tree protocol. The administrator examines the switch that is the root bridge for VLAN 10 and notices that one of the uplink interfaces to an access switch is in a blocking state. What is the most likely cause of this issue?

A.Change the port type of Gi0/3 to trunk to allow multiple VLANs.

B.Configure spanning-tree portfast on Gi0/3 to speed up convergence.

C.Check the spanning-tree priority on other switches to ensure the intended root bridge has the lowest priority for VLAN 10.

D.Enable BPDU guard on Gi0/3 to prevent unauthorized switches from affecting the network.

AnswerC

The root bridge is elected based on the lowest bridge priority. If another switch has a lower priority, it becomes the root, causing ports on the current root to block. Verifying and adjusting priorities will ensure the correct root bridge election.

Why this answer

In Rapid PVST+, the root bridge for a VLAN should have all its ports in a forwarding state. If an uplink interface on the root bridge is blocking, it indicates that another switch is being elected as the root bridge for VLAN 10, likely because it has a lower spanning-tree priority. By checking and adjusting the priority on other switches, the administrator can ensure the intended switch becomes the root bridge, resolving the intermittent connectivity caused by suboptimal path selection.

Exam trap

Cisco often tests the misconception that a blocking port on a root bridge indicates a physical or configuration issue with that specific port, when in fact it signals that the switch is not the root bridge due to a lower priority on another switch.

Why the other options are wrong

Changing the port type to trunk does not affect spanning-tree root bridge election or port roles. The blocking state is determined by spanning-tree topology, not by trunk configuration.

Portfast is intended for access ports connected to end devices to bypass listening/learning states; it is not used on uplinks and does not resolve a blocking state caused by spanning-tree topology.

BPDU guard is used on access ports to protect against rogue switches by disabling the port if a BPDU is received. It does not affect root bridge election or port roles on uplinks.

Practice this question →

168

MCQmedium

Which command places a switch port into access mode directly?

A.switchport mode access

B.switchport trunk allowed vlan 10

C.switchport mode dynamic desirable

D.no switchport

AnswerA

The `switchport mode access` command explicitly configures the switch port to operate in a single-VLAN, non-trunking state, satisfying the stem’s requirement to place the port “directly” into access mode without intermediate negotiation. This command immediately disables Dynamic Trunking Protocol (DTP) on the interface, forcing it into a static access role rather than relying on dynamic auto or desirable modes.

Why this answer

A switch port is placed into access mode with the `switchport mode access` command. In plain language, this tells the switch that the interface should behave as a single-VLAN user-facing access port rather than as a trunk or a negotiation-based port. This is the normal choice for an endpoint such as a PC, printer, or IP camera that should belong to one VLAN.

This command matters because it makes the intended role of the interface explicit. That clarity is useful operationally and helps avoid accidental trunking behavior. The correct answer is the command that directly defines the switchport as access rather than assigning a VLAN without setting the role or relying on negotiation.

Exam trap

Be careful not to confuse VLAN assignment or negotiation commands with those that explicitly set port modes.

Why the other options are wrong

The command 'switchport trunk allowed vlan 10' is used on a trunk port to specify which VLANs are allowed to traverse the trunk link. It does not change the port mode to access; instead, it assumes the port is already a trunk. Therefore, it is incorrect for placing a switch port into access mode.

The command 'switchport mode dynamic desirable' enables Dynamic Trunking Protocol (DTP) to actively negotiate trunking with the connected device. This does not directly place the port into access mode; instead, it allows the port to become a trunk if the neighbor agrees. The port remains in a dynamic state until negotiation completes.

The command 'no switchport' converts a Layer 2 switch port into a Layer 3 routed port, which is used for routing between VLANs or connecting to routers. This removes all Layer 2 switching functionality, including VLAN assignment, and is the opposite of placing the port into access mode.

Practice this question →

169

MCQhard

A network engineer is implementing Rapid PVST+ on a Cisco switch. The engineer wants to ensure that a specific interface is immediately placed into the forwarding state when it is connected to an end device, but also wants to prevent the interface from causing a loop if a switch is inadvertently connected. Which feature should be configured on the interface?

A.UplinkFast and BackboneFast

B.PortFast and Root Guard

C.BPDU Filtering and Loop Guard

D.PortFast and BPDU Guard

AnswerD

PortFast transitions the port to forwarding immediately, bypassing listening and learning states. BPDU Guard disables the port if BPDUs are received, preventing loops if a switch is connected. Together, they provide fast connectivity for end devices while safeguarding against accidental switch connections, exactly as required.

Why this answer

PortFast allows an interface to go to forwarding immediately for end devices, while BPDU Guard disables the port if BPDUs are detected, preventing loops from unexpected switches. This combination is ideal for access ports connecting to hosts, ensuring rapid connectivity and network stability.

Exam trap

The trap here is confusing Root Guard with BPDU Guard; Root Guard does not disable the port but rather prevents it from becoming a root port, which is not the desired loop prevention.

Practice this question →

170

MCQhard

A network administrator notices that a switch port connecting to an end-user workstation is flapping between up and down states. The port is configured with PortFast and BPDU Guard. The workstation is replaced with a small unmanaged switch that begins sending BPDUs. What is the expected result on the switch port?

A.The port enters the err-disabled state because BPDU Guard detects the BPDU on a PortFast-enabled port.

B.The port transitions to the blocking state but remains administratively up.

C.The port remains in the forwarding state and simply logs a syslog message about the BPDU.

D.The port automatically becomes a trunk and negotiates with the unmanaged switch.

AnswerA

BPDU Guard is designed to shut down a PortFast-enabled port if it receives a BPDU, which indicates an unauthorized switch is connected. When the unmanaged switch sends BPDUs, the port violates the guard condition and transitions to err-disabled, protecting the spanning-tree topology from potential loops.

Why this answer

BPDU Guard protects PortFast ports by err-disabling them when a BPDU is received. A PortFast port is meant for end hosts, so BPDUs indicate an unauthorized switch, and the guard action prevents a potential Layer 2 loop. The port becomes err-disabled rather than blocking, and it stays down until an administrator recovers it or err-disable recovery is configured.

Exam trap

The trap here is believing BPDU Guard blocks the port in STP terms, when it actually places the interface into the err-disabled state.

Practice this question →

171

MCQeasy

What problem does Spanning Tree Protocol solve in a switched network?

A.IP address exhaustion

B.Layer 2 switching loops

C.Slow DNS lookups

D.Weak wireless encryption

AnswerB

Spanning Tree Protocol (IEEE 802.1D) eliminates Layer 2 switching loops by placing redundant switch ports in a blocking state, leaving a single active loop-free path between hosts. Without STP, broadcast frames cycle endlessly, creating broadcast storms, MAC address flapping, and duplicated unicast frames that severely degrade the switching fabric. Redundant links remain available and are activated automatically if the primary path fails.

Why this answer

STP prevents Layer 2 loops by blocking redundant paths when necessary, which avoids broadcast storms and MAC table instability.

Exam trap

Avoid confusing STP with technologies like EtherChannel, IPsec, or QoS, which address different network concerns.

Why the other options are wrong

Spanning Tree Protocol (STP) operates at Layer 2 and has no mechanism to manage or allocate IP addresses; IP address exhaustion is addressed by protocols like DHCP or IPv6 transition technologies.

DNS lookups are application-layer processes that rely on IP connectivity and name resolution servers; STP does not influence DNS performance or resolution speed.

Wireless encryption is a security feature implemented at the data link layer (e.g., WPA2/3) and is unrelated to STP, which deals with physical topology loop prevention.

Practice this question →

172

MCQmedium

SW1 is the root bridge for VLAN 10. A user switch receives a BPDU on an access port connected to a desk-side unmanaged switch. What should happen if BPDU Guard is enabled on that port?

A.The port transitions to forwarding more quickly

B.The port is moved to err-disabled state

C.The switch elects a new root bridge

D.The port becomes a trunk automatically

AnswerB

When BPDU Guard is enabled on a PortFast edge access port, receiving any BPDU is considered a violation because a legitimate end host should never generate BPDUs. The switch immediately places the port into the err-disabled state, effectively shutting it down to prevent a rogue switch from participating in VLAN 10 spanning tree. This protects the root bridge's topology by blocking the unauthorized device at the access layer.

Why this answer

BPDU Guard is designed to protect edge ports. If a BPDU is received on a PortFast access port, the switch places the interface into the err-disabled state to stop a potential Layer 2 loop or rogue switch.

Exam trap

Remember that BPDU Guard actively disables ports, it doesn't just log or ignore BPDUs.

Why the other options are wrong

PortFast allows a port to transition to forwarding immediately upon link up, but it does not react to BPDU reception. BPDU Guard is a separate feature that disables the port upon receiving a BPDU, not accelerate forwarding.

Receiving a BPDU on a single edge port does not trigger a root bridge election. Root bridge election is based on bridge ID comparison across the entire spanning-tree domain, not on a single BPDU on a port.

BPDU Guard does not change the port mode; it only reacts to BPDU reception by disabling the port. Port mode (access or trunk) is configured separately and is not affected by STP protection features.

Practice this question →

173

Drag & Dropmedium

Drag and drop the following steps into the correct order to configure an LACP EtherChannel on two Cisco switches.

Drag or tap steps into the slots.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

To configure LACP EtherChannel on two Cisco switches, the correct order is: first, enter global configuration mode on both switches (A). Next, create the port-channel interface using the 'interface port-channel' command (B). Finally, assign the physical interfaces to the port-channel using the 'channel-group' command with LACP active mode (D).

Step C ('Set the LACP mode to active on the physical interfaces') is not a separate step because the mode is configured as part of the channel-group command. Therefore, the proper sequence is A, B, D.

Exam trap

A common mistake is to think that the LACP mode must be set separately on the physical interfaces before assigning them to the port-channel. In reality, the 'channel-group' command simultaneously binds the interface to the port-channel and sets the LACP mode, so there is no separate 'mode active' command needed. The correct order is to configure the port-channel interface first, then assign the physical interfaces with the channel-group command.

Practice this question →

174

Matchingmedium

Drag and drop the VLAN/trunking commands and terms on the left to their correct descriptions or functions on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Enables 802.1Q trunking on a switch interface

Assigns an access port to VLAN 10

VLAN that carries untagged traffic on a trunk link; default is VLAN 1

Changes the native VLAN on a trunk to VLAN 99

Uses subinterfaces on a single router interface to route between VLANs

Why these pairings

These pairings match common VLAN/trunking commands and terms to their correct descriptions.

Exam trap

Do not confuse the commands for access and trunk ports. Remember that 'switchport mode access' places the port in access mode, while 'switchport mode trunk' places it in trunk mode. Also, the native VLAN and VLAN 1 are related to trunking and default settings, not to the configuration of an access port.

Practice this question →

175

MCQmedium

Exhibit: A wireless client can see the SSID and associates successfully, but it never gets network access. Other users on the same SSID work. Which issue is the best fit?

A.The AP is advertising the wrong channel width

B.The client failed to obtain a valid IP address from DHCP

C.The SSID must be changed from broadcast to hidden

D.WPA2 automatically blocks clients until NTP is configured

AnswerB

The client successfully completes Layer 2 association and authentication, but without a valid DHCP lease it has no IP address, subnet mask, default gateway, or DNS servers. This leaves the client appearing connected to the Wi-Fi network yet unable to reach any external resources, which is the classic symptom of DHCP failure after association.

Why this answer

Successful association means the radio connection is up. If only one client fails to get network access while others work, the most likely issue is a client-specific addressing problem such as not obtaining a valid DHCP lease. Option A is incorrect because channel width affects all clients, not just one.

Option C is incorrect because hiding the SSID does not affect network access after association. Option D is incorrect because WPA2 does not block clients due to NTP; NTP is unrelated to client authentication.

Exam trap

Don't confuse association issues with post-association network access problems. Ensure you understand the difference between connecting to the SSID and obtaining network access.

Why the other options are wrong

Channel width affects all clients on the AP, not just a single client.

Hiding the SSID only prevents the SSID from being broadcast; it does not impact network access after association.

WPA2 does not require NTP for client authentication; NTP is for time synchronization, not client access control.

Practice this question →

176

MCQmedium

A network engineer checks EtherChannel status on a switch and sees the following output: Group Port-channel Protocol Ports ------+-------------+---------+----------------------------- 1 Po1(SD) LACP Gi1/0/1(s) Gi1/0/2(I) What is the most likely reason the EtherChannel is not forwarding traffic?

A.The member interfaces have mismatched speed or duplex settings

B.The port channel is Layer 3 instead of Layer 2

C.At least one member interface is not bundled correctly, so the logical channel is down

D.LACP requires exactly four links to form a bundle

AnswerC

Correct. This is correct. The logical EtherChannel is down because the physical members are not properly bundled. The status display is telling you that the switch did not build a working aggregated link, so the port-channel cannot carry traffic as intended.

Why this answer

The safest conclusion from this output is that the member interfaces are not successfully participating in the bundle, so the logical port-channel is down. Cisco exam questions often test whether you can read the status flags without overcommitting to a very specific root cause that the exhibit does not explicitly prove. One member is suspended and another is not bundled into the channel correctly, so the EtherChannel never reaches a healthy forwarding state.

In the real world, that can happen because of trunk mismatches, allowed VLAN mismatches, native VLAN problems, inconsistent channel-group settings, or negotiation issues. The key exam skill is recognizing that the bundle itself failed, not guessing one hidden configuration line that is not shown.

Exam trap

Avoid assuming the problem is due to physical layer issues like speed or duplex when the output suggests a configuration mismatch.

Why the other options are wrong

The output shows individual port statuses (s) and (I), which indicate LACP negotiation states, not speed/duplex mismatches. While speed/duplex mismatches can cause EtherChannel issues, the specific flags in the exhibit point to a bundling problem, not a mismatch.

A Layer 3 port-channel can function correctly if configured properly. The output does not indicate any Layer 2 vs Layer 3 mismatch; the problem is that the member interfaces are not successfully bundling into the logical channel, as shown by the (s) and (I) status flags.

LACP does not require exactly four links; it can form bundles with 2 to 8 active links (and up to 16 total with standby). The exhibit shows only two member ports, which is perfectly valid for an EtherChannel.

Practice this question →

177

PBQhard

You are connected to SW1 via the console. SW1 is a Layer 2 switch with two links to SW2 configured as an EtherChannel using LACP. The EtherChannel is not coming up. Interface G0/2 was accidentally configured as an access port in VLAN 10, while G0/1 is configured as a trunk. The administrator wants to use LACP to bundle the links. Troubleshoot and fix the configuration to bring up the EtherChannel.

Hints

•All interfaces in an EtherChannel must have identical configuration.
•Check if the interfaces are in the same VLAN or trunk mode.
•LACP active mode requires matching configurations on both ends.

A.Change interface G0/2 to trunk mode and ensure both interfaces have the same allowed VLAN list.

B.Change interface G0/1 to access VLAN 10 to match G0/2.

C.Remove the access VLAN configuration from G0/2 and leave it as a default switchport (dynamic desirable).

D.Change the EtherChannel mode from LACP to PAgP on both switches.

AnswerA

solution

! SW1
interface GigabitEthernet0/2
no switchport access vlan 10
switchport mode trunk

Why this answer

For an EtherChannel to form, all member interfaces must have matching configuration, including trunk mode and allowed VLANs. Since G0/1 is a trunk and G0/2 is an access port in VLAN 10, the mismatch prevents the EtherChannel from bundling. Changing G0/2 to trunk mode and ensuring both interfaces have the same allowed VLAN list resolves the inconsistency.

Exam trap

200-301 often tests EtherChannel configuration requirements; candidates may focus on the protocol mode but overlook the need for matching trunk/access and VLAN configurations.

Why the other options are wrong

The specific factual error is that changing G0/1 to access VLAN 10 would not resolve the mismatch if the intended configuration is trunking. It would only create a different mismatch if the other side expects trunking.

The specific factual error is that dynamic desirable mode does not ensure trunking; it relies on DTP negotiation, which may fail if the other side is set to trunk. Additionally, the VLAN mismatch (access vs trunk) would still prevent EtherChannel formation.

The specific factual error is that the protocol does not affect the requirement for consistent interface configurations. Both LACP and PAgP require identical VLAN and trunk settings on all member ports.

178

Multi-Selectmedium

Which TWO statements correctly describe aspects of interpreting packet capture output for Layer 2/3 troubleshooting using Wireshark or embedded packet capture on IOS-XE?

Select 2 answers

A.A DHCP Discover packet in a Wireshark capture shows a unicast destination MAC address to the DHCP server.

B.A large number of ARP requests for the same IP address in a packet capture suggests a possible Layer 3 connectivity issue, such as a missing default gateway.

C.A TCP SYN-ACK packet in a capture indicates that the three-way handshake failed and the destination is unreachable.

D.When using embedded packet capture on IOS-XE, you can capture packets on both ingress and egress directions to see if a router is dropping or modifying packets.

E.The TTL value in a captured IP packet always shows the original TTL set by the source host.

AnswersB, D

Repeated ARP requests for the same target IP mean the host is trying to resolve a next-hop MAC but receives no reply. This frequently occurs when the target is down, a firewall silently drops the traffic, or the host's default gateway is misconfigured/unreachable. Because ARP operates at Layer 2 to find a Layer 3 address, the persistence of unanswered requests points to a connectivity failure at or below the IP layer, making it a useful diagnostic clue.

Why this answer

A large number of ARP requests for the same IP address indicates that the device is repeatedly trying to resolve the Layer 3 address to a Layer 2 MAC address, but no device is responding. This often happens when the target IP (e.g., the default gateway) is unreachable or misconfigured, pointing to a Layer 3 connectivity issue. Option D is correct because IOS-XE embedded packet capture supports both ingress and egress capture directions, allowing you to verify whether a router is dropping or modifying packets as they transit.

Option A is incorrect: DHCP Discover is broadcast, not unicast, because the client does not yet know the server’s MAC address. Option C is incorrect: a SYN-ACK is part of a successful three-way handshake (SYN, SYN-ACK, ACK) and indicates the server is reachable; if the handshake failed, you would see only SYN packets or RST packets. Option E is incorrect: the TTL value in a captured packet shows the current TTL after decrementing by each hop; the original TTL is not preserved in the packet.

Exam trap

Cisco often tests the distinction between broadcast and unicast in DHCP and ARP operations, and the trap here is that candidates may assume DHCP Discover is unicast to the server or that a SYN-ACK indicates failure, when in fact it confirms reachability.

Why the other options are wrong

DHCP Discover is always broadcast (destination FF:FF:FF:FF:FF:FF), not unicast, because the client does not know the DHCP server's MAC address.

A TCP SYN-ACK indicates the server received the SYN and is willing to establish the connection; it is part of a successful three-way handshake, not a failure.

The TTL in a captured packet is the value after decrementing at each hop; the original TTL is set by the source but is not preserved in the packet header.

Practice this question →

179

PBQhard

You are connected to SW1 via the console. SW1 is a Layer 2 switch connected to two other switches (SW2 and SW3) via redundant links. All switches run IEEE 802.1D Spanning Tree Protocol. The network administrator wants SW1 to become the root bridge for VLAN 1. Currently, the root bridge is SW2. Configure SW1 to achieve this and ensure that port G0/1, which connects to an end device, immediately transitions to forwarding state upon link up and is protected from BPDU attacks.

Network Topology

Hints

•The 'root primary' macro sets the priority lower than any other switch.
•PortFast allows a port to skip listening/learning states.
•BPDU Guard err-disables the port if a BPDU is received.

A.Configure 'spanning-tree vlan 1 root primary' globally, and on interface G0/1 configure 'spanning-tree portfast' and 'spanning-tree bpduguard enable'.

B.Configure 'spanning-tree vlan 1 priority 4096' globally, and on interface G0/1 configure 'spanning-tree portfast' and 'spanning-tree guard root'.

C.Configure 'spanning-tree vlan 1 root secondary' globally, and on interface G0/1 configure 'spanning-tree portfast' and 'spanning-tree bpduguard enable'.

D.Configure 'spanning-tree vlan 1 priority 32768' globally, and on interface G0/1 configure 'spanning-tree portfast' and 'spanning-tree bpdufilter enable'.

AnswerA

solution

! SW1
spanning-tree vlan 1 root primary
interface GigabitEthernet0/1
spanning-tree portfast
spanning-tree bpduguard enable

Why this answer

The 'spanning-tree vlan 1 root primary' command reduces the bridge priority to 24576 (or lower) to ensure SW1 becomes root for VLAN 1. PortFast on G0/1 speeds up access port convergence, and BPDU Guard protects against rogue switches by disabling the port upon BPDU reception.

Exam trap

Do not confuse 'root primary' with 'root secondary' or manual priority settings. Also, remember that BPDU Guard is for access port security, while Root Guard protects the root bridge position. BPDU Filter suppresses BPDUs and is not a security feature.

Why the other options are wrong

The specific factual error: 'spanning-tree guard root' is a root guard feature, not BPDU guard. Also, manually setting priority to 4096 may not guarantee root if another switch has lower priority.

The specific factual error: 'root secondary' is for backup root, not primary. It sets priority to 28672, which is higher than the default priority of 32768 but not low enough to become root if another switch has a lower priority.

The specific factual error: priority 32768 is default and does not change root status. BPDU filter is not a security feature against BPDU attacks; it suppresses BPDUs entirely.

180

MCQhard

A switch receives superior BPDUs on a port where the design requires that no downstream device ever become the root path for that segment. Which feature is the best fit for that requirement?

AnswerA

Root guard is the correct STP protection mechanism for this scenario. When a port configured with root guard receives a superior BPDU (one advertising a better bridge ID or lower root path cost), it transitions the port to a root-inconsistent state, effectively blocking it. This prevents the port from becoming a root port and stops an unauthorized switch from hijacking the root bridge role, thereby preserving the intended spanning-tree topology.

Why this answer

Root guard is the best fit because it is designed to prevent a port from becoming the path toward a new root bridge when superior BPDUs are received. In practical terms, it protects the intended STP topology by keeping that port from taking on a root-related forwarding role when the design says it should not.

This is different from BPDU Guard, which is more commonly used on edge ports to disable them entirely if BPDUs appear. Root guard is about protecting topology roles, not just edge-port assumptions.

Exam trap

A common exam trap is selecting BPDU guard instead of root guard because both involve BPDU handling. BPDU guard disables a port immediately upon receiving any BPDU, which is suitable for edge ports but not for ports where topology control is required. Root guard, on the other hand, only blocks ports that receive superior BPDUs, allowing normal BPDUs from the current root bridge.

Confusing these features can lead to incorrect answers, as BPDU guard does not protect the root path role but rather protects against unauthorized devices on edge ports.

Why the other options are wrong

BPDU guard is incorrect because it disables a port upon receiving any BPDU, which is suitable for edge ports but does not control root path roles or topology changes.

Port security is unrelated to STP root path control; it manages MAC address access on a port and does not affect BPDU processing or root bridge election.

DHCP snooping protects against rogue DHCP servers by filtering DHCP messages and does not interact with STP or root bridge election mechanisms.

Practice this question →

181

MCQhard

Refer to the exhibit. A network engineer notices packet loss and sluggish application performance on a branch-office uplink. While troubleshooting, the engineer executes the show interfaces GigabitEthernet0/1 command on the router. Based on the output, what is the most likely cause of the performance issue?

A.The interface is experiencing excessive collisions due to a duplex mismatch.

B.An upstream device is sending traffic at a rate higher than this interface can transmit, causing the output queue to overflow.

C.The interface is receiving corrupted frames, indicated by the zero input errors on the interface.

D.The output queue is full because its size is too small, and increasing the queue depth will resolve the packet loss.

AnswerB

The output queue is maxed (40/40) and output drops are very high (12450). The 5-minute output rate of 10 Mbps is far below the interface bandwidth of 100 Mbps, yet the queue is overflowing, which indicates microbursts from a faster upstream link overwhelming the slower interface. This is the classic signature of a speed mismatch.

Why this answer

The interface shows a high number of output drops, indicating that the output queue is experiencing congestion and packets are being dropped because the router cannot transmit traffic as fast as it is being received from the upstream device. This causes packet loss and sluggish performance.

Exam trap

Cisco often tests the distinction between output drops (congestion) and input errors (physical layer issues), and the trap here is that candidates may misinterpret 'output drops' as a sign of duplex mismatch or assume that increasing queue depth is a fix, when the real issue is a speed mismatch between incoming and outgoing traffic.

Why the other options are wrong

Candidates sometimes associate packet loss with duplex mismatches, but a duplex mismatch would also show collisions and typically input errors, both of which are zero here.

Zero input errors means no physical-layer receiving problems; the candidate may misinterpret the absence of errors as a sign of some other problem, which is logically incorrect.

Increasing the queue size is a common workaround that masks the real problem, but the underlying mismatch in forwarding rates remains. CCNA candidates may incorrectly focus on the queue size rather than the relationship between the 100 Mb/s interface speed and a faster upstream sender.

Practice this question →

182

MCQmedium

A switchport should automatically disable itself if too many MAC addresses are learned beyond the configured secure limit. Which port-security violation mode causes that behavior?

A.shutdown

B.protect

C.restrict

D.dynamic

AnswerA

In port-security violation mode 'shutdown', the switchport is immediately placed into the error-disabled state upon a MAC address violation. This is the default and most restrictive violation mode, effectively disabling the port until an administrator manually issues the 'shutdown' and 'no shutdown' commands or the port is configured for auto-recovery via errdisable recovery. It fully blocks all traffic and generates a syslog/SNMP message.

Why this answer

Shutdown is the violation mode that error-disables the port. In plain language, when the switch sees a port-security violation under shutdown mode, it reacts by taking the interface out of service rather than simply dropping frames quietly. That behavior is useful when the administrator wants a clear and strong response to unauthorized devices.

This matters because port security has several violation modes and they do not behave the same way. Restrict and protect can keep the interface up, while shutdown is the mode associated with the most visible response.

Exam trap

Be aware that not all port-security violation modes disable the port. Only Shutdown mode does this.

Why the other options are wrong

The 'protect' mode does not disable the port when the secure MAC address limit is exceeded; instead, it drops packets from unknown MAC addresses without generating a notification. This behavior does not match the requirement of the question.

The 'restrict' mode allows traffic to pass but drops packets from unknown MAC addresses, without disabling the port. This does not meet the requirement of automatically disabling the port when the MAC address limit is exceeded.

The 'dynamic' option is incorrect because it does not refer to a specific port-security violation mode that disables the port when the MAC address limit is exceeded. Instead, it implies the dynamic learning of MAC addresses without enforcing a security limit.

Practice this question →

183

MCQhard

A user can connect to the employee SSID and receive the correct employee IP subnet, but access to one internal application fails only for that WLAN while wired users succeed. Which troubleshooting area is the strongest first focus?

A.A WLAN-specific policy or filtering rule affecting access to that application

B.The SSID broadcast setting

C.Whether the access point has a valid hostname

D.Whether the client is using PPP instead of Ethernet

AnswerA

The user successfully associates with the employee SSID and obtains an IP address, proving that physical connectivity, authentication, and DHCP are functioning. A failure isolated to one application on that specific WLAN points to a WLAN-level ACL, application filter, or policy applied on the wireless LAN controller that is dropping or denying that app's traffic. This is consistent with a selective deny rather than an infrastructure fault.

Why this answer

The strongest first focus is the policy or filtering path specific to that WLAN or traffic class. In practical terms, the user has already shown that the correct WLAN join, authentication, and subnet assignment are working. Because wired users succeed and only one application fails from that WLAN, the most likely issue is a WLAN-specific policy, ACL, firewall rule, or path treatment affecting that application.

This is a realistic selective-access troubleshooting scenario and tests whether the candidate narrows the fault domain correctly.

Exam trap

Avoid assuming the problem is with the user's device or general network settings when the issue is isolated to a specific WLAN.

Why the other options are wrong

The SSID broadcast setting does not directly impact the ability of users to connect to an internal application once they are authenticated and assigned an IP address. Since wired users can access the application, the issue is likely related to WLAN-specific configurations rather than SSID visibility.

The access point's hostname does not directly impact application access; it primarily affects network identification and management. Since the issue is specific to WLAN access and not present for wired users, the hostname is unlikely to be the cause.

This option is wrong because the issue pertains to application access over a specific WLAN, not the type of connection (PPP vs. Ethernet). The problem likely lies in WLAN configuration rather than the protocol used by the client device.

Practice this question →

184

MCQmedium

A phone and a PC are attached to the same switchport. The intended data VLAN is VLAN 10, and the phone uses voice VLAN 20. The switchport currently has `switchport voice vlan 20` configured. The phone works, but the PC cannot reach the data network. Which command is most likely missing?

A.switchport mode dynamic auto

B.switchport voice vlan 20

C.switchport access vlan 10

D.spanning-tree guard root

AnswerC

The PC fails to reach the network because it is untagged on the access port while the switchport is likely in its default VLAN 1 or a mismatched VLAN. Issuing 'switchport access vlan 10' explicitly assigns the data VLAN to the port, ensuring the PC's traffic is placed in the correct Layer 2 domain. The phone can still tag its voice traffic with VLAN 20 via the voice VLAN feature, but the access VLAN governs the untagged PC traffic.

Why this answer

When a Cisco IP phone and a PC share one port, the switchport often needs both a data VLAN and a voice VLAN. If the voice VLAN exists but the data access VLAN is wrong or missing, the phone can work while the PC fails.

Exam trap

Ensure both data and voice VLANs are configured when devices share a port. Don't confuse duplex or trunk settings with VLAN issues.

Why the other options are wrong

The phone works but the PC cannot reach the data network, indicating the PC is not in the correct VLAN. 'switchport mode dynamic auto' sets the port to negotiate trunking via DTP, which does not assign a data VLAN to the PC.

The PC cannot reach the data network because the switchport is likely configured as a voice VLAN only, but the data VLAN (access VLAN) is missing. Option B configures the voice VLAN, which is correct for the phone, but does not set the access VLAN for the PC.

The issue is that the PC cannot reach the data network, which is typically configured via the access VLAN. Spanning-tree guard root is unrelated to VLAN assignment; it prevents a switch from becoming the root bridge, not connectivity issues on a specific VLAN.

Practice this question →

185

MCQmedium

Two switches are connected with EtherChannel using LACP. One side is configured with mode active and the other side with mode passive. What happens?

A.The channel forms successfully

B.The channel stays down because both sides must be active

C.The channel forms only if PAgP is also enabled

D.The channel becomes a static Port-Channel

AnswerA

LACP's active/passive mode is a standard, valid combination. The active switch actively sends LACP PDUs (protocol data units) to negotiate the link, while the passive switch listens and responds, allowing the port-channel to form. Since one side is active, the negotiation completes and the EtherChannel becomes operational as a dynamic LACP bundle.

Why this answer

LACP forms an EtherChannel when at least one side actively negotiates. Active plus passive is a valid combination, so the bundle comes up if the physical settings match.

Exam trap

A frequent exam trap is believing that both sides of an LACP EtherChannel must be configured in active mode for the channel to form. This misconception leads to the incorrect assumption that active-passive combinations will fail. In reality, LACP requires only one side to be active to initiate negotiation, while the other side can be passive and respond.

Another trap is confusing LACP with PAgP, expecting that enabling PAgP alongside LACP will help form the channel, which is false because these protocols are incompatible. Understanding these nuances prevents misinterpretation of EtherChannel negotiation behavior on the exam.

Why the other options are wrong

This option is incorrect because both sides do not need to be active. One side active and the other passive is sufficient for LACP negotiation and channel formation.

This option is incorrect because PAgP is a different, Cisco proprietary protocol and does not work alongside LACP. Enabling PAgP does not affect LACP negotiation.

This option is incorrect because configuring one side as active and the other as passive uses LACP negotiation, not a static Port-Channel. Static Port-Channels require manual configuration on both ends without negotiation.

Practice this question →

186

MCQmedium

A network administrator is configuring a Cisco IOS switch port that connects to an IP phone and a PC daisy-chained behind the phone. The administrator wants the PC's data traffic to be untagged on VLAN 20, and the phone's voice traffic to be tagged with VLAN 30. The phone is already configured to use VLAN 30 for voice. Which configuration on the switch port will accomplish this?

A.switchport mode trunk switchport trunk native vlan 20 switchport trunk allowed vlan 30

B.switchport mode trunk switchport trunk native vlan 30 switchport trunk allowed vlan 20

C.switchport mode access switchport access vlan 30 switchport voice vlan 20

D.switchport mode access switchport access vlan 20 switchport voice vlan 30

AnswerD

This configuration sets the port as an access port for data VLAN 20 and uses the voice VLAN 30 for tagged voice traffic. The phone will receive untagged data frames on VLAN 20 and will tag its voice frames with VLAN 30. This is the standard Cisco configuration for a port connecting to an IP phone with a PC behind it.

Why this answer

The correct configuration uses an access port for data VLAN 20 and a voice VLAN 30. This allows the PC to send untagged data frames that are assigned to VLAN 20, while the IP phone tags its voice frames with VLAN 30. This is the standard and recommended approach for connecting an IP phone and PC to a single switch port.

Exam trap

The trap here is confusing the voice VLAN and data VLAN assignments, or incorrectly using a trunk port when an access port with voice VLAN is sufficient.

Practice this question →

187

MCQhard

Two switches are connected using four Gigabit Ethernet interfaces configured as an EtherChannel with LACP. The network administrator notices that only two of the four interfaces are active in the port-channel, and the other two are in a suspended state. Upon further investigation, the administrator finds that the two inactive interfaces correspond to remote interfaces that are configured with the 'on' mode, while the active ones correspond to remote interfaces configured with LACP active/passive. The administrator also verifies that all local interfaces have the same speed, duplex, and VLAN. What is the most likely cause of the suspended interfaces?

A.The interfaces are in err-disabled state due to a spanning-tree loop.

B.The remote switch interfaces corresponding to the suspended local interfaces are configured with the 'on' mode instead of 'active' or 'passive' for LACP.

C.The port-channel interface is shutdown.

D.There is a mismatch in the allowed VLANs on the member interfaces.

AnswerB

When one switch has LACP active/passive and the other has 'on' (static), LACP negotiation fails, and the ports become suspended. Changing the remote switch to 'active' or 'passive' allows LACP to negotiate and bundle the ports.

Why this answer

LACP requires both ends of a link to be configured in either 'active' or 'passive' mode to negotiate an EtherChannel. If some remote interfaces are set to 'on' mode (static EtherChannel), LACP negotiation fails on those links, causing the corresponding local LACP-enabled interfaces to remain in a suspended state. The local switch detects that LACP PDUs are not received on those interfaces and suspends them to prevent misconfiguration.

The other two interfaces with correctly configured remote peers form the EtherChannel successfully.

Exam trap

Cisco often tests the misconception that all interfaces must match in speed, duplex, and VLAN to form an EtherChannel, but the trap here is that the LACP mode mismatch (active/passive vs. on) is the specific cause of suspended interfaces even when other parameters are consistent.

Why the other options are wrong

The exhibit shows the ports as suspended, not err-disabled. Spanning-tree loops typically cause err-disable, not suspension.

The port-channel is up (U), so it is not shutdown.

The scenario explicitly states that all interfaces are configured with the same VLAN, so this is not the cause.

Practice this question →

188

PBQmedium

You are connected to SW1 via console. SW1 is a Layer 2 switch connected to two other switches (SW2 and SW3) via trunk links. The network administrator wants to ensure that SW1 becomes the root bridge for VLAN 10 and VLAN 20. Currently, SW2 is the root for both VLANs. Configure SW1 to become the root bridge for these VLANs using the Cisco-recommended macro STP commands.

Network Topology

Hints

•Use the 'root primary' macro to set the bridge priority to 24576.
•Ensure VLANs 10 and 20 exist on SW1.

A.spanning-tree vlan 10 root primary; spanning-tree vlan 20 root primary

B.spanning-tree vlan 10 root secondary; spanning-tree vlan 20 root secondary

C.spanning-tree vlan 10 priority 4096; spanning-tree vlan 20 priority 4096

D.spanning-tree vlan 10 root; spanning-tree vlan 20 root

AnswerA

solution

! SW1
spanning-tree vlan 10 root primary
spanning-tree vlan 20 root primary

Why this answer

The 'spanning-tree vlan <vlan> root primary' command is the Cisco-recommended macro that sets the bridge priority to 24576, which is lower than the default 32768, making SW1 the root bridge for those VLANs. Option A correctly uses this macro. Option C, while it could achieve the same goal by setting priority to 4096, is not the macro command and would be considered a static configuration; the question specifically asks for the appropriate macro commands.

Option B sets priority to 28672 as a secondary root, and Option D is invalid syntax.

Exam trap

Do not confuse 'root primary' with 'root secondary'. 'root primary' sets priority to 24576 to become root; 'root secondary' sets priority to 28672 to act as backup. Also, remember that the 'root' keyword must be followed by 'primary' or 'secondary'.

Why the other options are wrong

Option B uses 'root secondary', which sets the priority to 28672, making SW1 a backup root, not the primary root bridge.

Option C uses a static priority assignment of 4096, which would also make SW1 root, but the question expects the Cisco-recommended macro command 'root primary'.

Option D uses incomplete syntax 'spanning-tree vlan 10 root' without 'primary' or 'secondary', which is invalid.

189

PBQhard

You are connected to a multilayer switch MLS1. Configure Root Guard on switchport GigabitEthernet 0/1 (connected to an unauthorized switch) so that if a superior BPDU is received, the port is blocked instead of causing a topology change. Also enable Loop Guard on uplink GigabitEthernet 0/2 (connected to the root bridge) to prevent unidirectional link issues. Finally, enable BPDU Guard on PortFast-enabled access port GigabitEthernet 0/3 (connected to a host) so that if a BPDU is received, the port goes err-disabled. After configuration, a superior BPDU is received on G0/1 and the port is blocked; a BPDU is received on G0/3 and the port goes err-disabled. Verify these protections are active.

Hints

•Root Guard is configured per interface under interface configuration mode using 'spanning-tree guard root'.
•Loop Guard is configured per interface using 'spanning-tree guard loop'.
•BPDU Guard is enabled on PortFast ports with 'spanning-tree bpduguard enable'.

A.Root Guard on G0/1, Loop Guard on G0/2, BPDU Guard on G0/3

B.Root Guard on G0/1, UplinkFast on G0/2, BPDU Guard on G0/3

C.BPDU Guard on G0/1, Loop Guard on G0/2, Root Guard on G0/3

D.Root Guard on G0/1, Loop Guard on G0/2, PortFast on G0/3

AnswerA

solution

! MLS1
interface GigabitEthernet0/1
spanning-tree guard root
interface GigabitEthernet0/2
spanning-tree guard loop
interface GigabitEthernet0/3
spanning-tree portfast
spanning-tree bpduguard enable

Why this answer

Root Guard was correctly configured on G0/1, so when a superior BPDU arrived, the port entered root-inconsistent state instead of becoming root port. Loop Guard on G0/2 prevents alternate port from becoming root if BPDUs stop. BPDU Guard on G0/3 correctly triggered err-disable upon receiving a BPDU on a PortFast port.

To restore G0/3, use 'shutdown' then 'no shutdown' after removing the BPDU source. Verification commands confirm the protections are working.

Exam trap

Trap: Mixing up which protection goes where. Root Guard is for ports that should never become root (e.g., facing unauthorized switches). Loop Guard is for ports that are alternate or root ports (uplinks).

BPDU Guard is for PortFast-enabled access ports. Also, remember that BPDU Guard triggers err-disable, while Root Guard triggers root-inconsistent (blocking) state.

Why the other options are wrong

UplinkFast is not designed to detect or prevent unidirectional links; it only accelerates failover.

The protections are applied to the wrong ports: BPDU Guard should be on access ports, Root Guard on ports facing potential rogue switches, and Loop Guard on uplinks.

PortFast does not prevent BPDU reception; it only skips the listening and learning states. Without BPDU Guard, the port would still process BPDUs and could become a root port.

Practice this question →

190

PBQeasy

You are connected to SW1 via the console. SW1 is a Layer 2 switch connected to multiple PCs. The network administrator wants to implement port security on port G0/1 to allow only one MAC address and to shut down the port if a violation occurs. Additionally, the administrator wants the MAC address to be learned dynamically and added to the running configuration as sticky. Configure port security on G0/1 accordingly.

Network Topology

Hints

•Port security must be enabled on the interface first.
•Sticky MAC automatically adds learned MAC addresses to the running config.
•The violation mode 'shutdown' places the port in err-disabled state.

A.SW1(config)# interface G0/1 SW1(config-if)# switchport port-security SW1(config-if)# switchport port-security maximum 1 SW1(config-if)# switchport port-security mac-address sticky SW1(config-if)# switchport port-security violation shutdown

B.SW1(config)# interface G0/1 SW1(config-if)# switchport port-security SW1(config-if)# switchport port-security maximum 1 SW1(config-if)# switchport port-security mac-address sticky SW1(config-if)# switchport port-security violation protect

C.SW1(config)# interface G0/1 SW1(config-if)# switchport port-security SW1(config-if)# switchport port-security maximum 1 SW1(config-if)# switchport port-security mac-address 0000.1111.2222 SW1(config-if)# switchport port-security violation shutdown

D.SW1(config)# interface G0/1 SW1(config-if)# switchport port-security SW1(config-if)# switchport port-security maximum 1 SW1(config-if)# switchport port-security mac-address sticky SW1(config-if)# switchport port-security violation restrict

AnswerA

solution

! SW1
interface GigabitEthernet0/1
switchport port-security
switchport port-security maximum 1
switchport port-security violation shutdown
switchport port-security mac-address sticky

Why this answer

The requirement is one MAC, sticky learning, and shutdown on violation. The correct sequence enables port security, sets maximum 1, enables sticky MAC learning, and sets violation mode to shutdown. Sticky learning dynamically learns the MAC and writes it into the running configuration as a sticky secure MAC address.

Exam trap

200-301 often tests the difference between violation modes — candidates pick restrict or protect thinking they 'block' traffic, but only shutdown err-disables the port as the question requires.

Why the other options are wrong

The violation mode 'protect' silently drops frames from unknown MACs without disabling the port, which contradicts the requirement to shut down the port.

The 'mac-address' command with a specific address statically assigns that MAC, which is not dynamic. Sticky learning uses the 'mac-address sticky' command to dynamically learn and save the first MAC.

The 'restrict' mode does not disable the port; it only drops offending frames and logs the violation. The requirement explicitly states to shut down the port, which requires the 'shutdown' violation mode.

191

PBQhard

You are connected to Switch1. Configure an LACP EtherChannel between Switch1 and Switch2 using interfaces GigabitEthernet0/1 and GigabitEthernet0/2. The channel must be in active mode on both sides, and the port-channel interface must have VLAN 10 as the access VLAN. The current configuration has a speed/duplex mismatch and inconsistent VLAN assignments preventing the channel from forming. Verify the channel is up using 'show etherchannel summary'.

Network Topology

Hints

•Check that all member interfaces have the same speed and duplex settings.
•Ensure all interfaces (including the port-channel) are in the same VLAN.
•Both sides must use LACP active mode for the channel to form.

A.Set speed auto on Gi0/1 and Gi0/2, set duplex auto on both, change access VLAN on Gi0/2 to 10, change access VLAN on Port-channel1 to 10, and set channel-group mode active on both interfaces.

B.Set speed 1000 on Gi0/1, set duplex full on Gi0/1, change access VLAN on Gi0/1 to 20, change access VLAN on Port-channel1 to 20, and set channel-group mode passive on both interfaces.

C.Set speed 100 on Gi0/2, set duplex half on Gi0/2, change access VLAN on Gi0/1 to 20, change access VLAN on Port-channel1 to 20, and set channel-group mode desirable on both interfaces.

D.Set speed auto on Gi0/1 and Gi0/2, set duplex auto on both, change access VLAN on Gi0/1 to 10, change access VLAN on Port-channel1 to 10, and set channel-group mode active on Gi0/1 and passive on Gi0/2.

AnswerA

solution

! Switch1
interface gigabitethernet0/1
speed auto
duplex auto
channel-group 1 mode active
exit
interface gigabitethernet0/2
speed auto
duplex auto
switchport access vlan 10
channel-group 1 mode active
exit
interface port-channel 1
switchport access vlan 10
end

Why this answer

The EtherChannel is not forming due to three issues: (1) Speed mismatch: Gi0/1 is set to 100 Mbps while Gi0/2 is 1000 Mbps; both must match (e.g., auto). (2) Duplex mismatch: Gi0/1 is half-duplex, Gi0/2 is full-duplex; both must be the same (e.g., full). (3) VLAN mismatch: Gi0/1 is in VLAN 10, Gi0/2 in VLAN 20, and Port-channel1 is in VLAN 1; all access VLANs must be consistent (set to VLAN 10). Additionally, the channel-group mode should be 'active' on both interfaces for LACP. The solution involves setting speed and duplex to auto, changing the access VLAN on Gi0/2 and the port-channel to VLAN 10, and setting channel-group mode to active.

Exam trap

The exam trap here is that candidates may focus only on resolving the speed/duplex and VLAN mismatches but forget to check the LACP mode requirement. Also, they might confuse LACP modes (active/passive) with PAgP modes (desirable/auto). Always verify that the mode matches the protocol and the requirement.

Why the other options are wrong

The specific factual error: passive mode on both sides will not form an LACP EtherChannel because neither side initiates negotiation; at least one side must be active.

The specific factual error: 'desirable' is a PAgP mode; LACP uses 'active' or 'passive'. Using 'desirable' would not form an LACP EtherChannel.

The specific factual error: the requirement explicitly states 'active mode on both sides', so setting one side to passive violates the requirement, even though the channel might still form.

Practice this question →

192

MCQhard

An EtherChannel between two switches is configured for LACP. One switch shows the member interfaces as bundled, while the other shows them as individual interfaces. Which explanation is most likely if both sides are using LACP?

A.The member interface settings do not match closely enough for bundling, even though both sides use LACP.

B.LACP always requires one side to use PAgP as a backup.

C.EtherChannel cannot operate on switch trunks.

D.One switch must disable STP before EtherChannel can form.

AnswerA

LACP negotiation alone does not guarantee bundling; the member interfaces must also share identical physical and logical parameters such as speed, duplex, VLAN membership, native VLAN, and trunk mode. If any of these settings differ, the LACP control plane will detect the mismatch and keep the ports in a standalone state. Thus, even with LACP active on both ends, inconsistent interface configurations prevent the EtherChannel from forming.

Why this answer

The most likely explanation is that some other interface settings do not match, even though both sides are using the same EtherChannel protocol. In practical terms, LACP alone is not enough. The candidate member interfaces also need to agree on characteristics such as speed, duplex, switchport mode, allowed VLANs where relevant, and other channel-related settings. If they do not, one side may treat the links as separate instead of bundling them.

This is a common troubleshooting pattern because it tests whether you know that EtherChannel success depends on more than just the negotiation protocol name.

Exam trap

Don't assume LACP alone ensures bundling; check all interface settings for consistency.

Why the other options are wrong

This option is incorrect because LACP (Link Aggregation Control Protocol) does not require PAgP (Port Aggregation Protocol) as a backup; they are separate protocols. LACP can operate independently without needing PAgP on either side of the EtherChannel.

This option is incorrect because EtherChannel can indeed operate on switch trunks, allowing multiple VLANs to be carried over a single logical link. The issue in the question pertains to LACP configuration mismatches, not trunking capabilities.

This option is incorrect because Spanning Tree Protocol (STP) does not need to be disabled for EtherChannel to form; EtherChannel can operate alongside STP. Disabling STP can lead to network loops and is not a requirement for EtherChannel functionality.

Practice this question →

193

MCQhard

Exhibit: SW2 receives superior BPDUs on both uplinks. One uplink becomes the root port and the other becomes alternate. Which factor is considered first when SW2 chooses the root port?

A.Lowest local interface MAC address

B.Lowest root path cost

C.Highest duplex setting

D.Lowest configured VLAN number

AnswerB

The spanning-tree root port election first compares the cumulative root path cost advertised in each received BPDU. The port with the lowest root path cost to the root bridge is selected as the root port, because it offers the most efficient shortest path toward the root. Only when costs are equal does STP proceed to other tie-breakers such as the sender bridge ID and sender port ID.

Why this answer

STP chooses the best path to the root bridge based first on the lowest root path cost. If the cost ties, it then checks the sender bridge ID and sender port ID as tie-breakers.

Exam trap

Remember that STP prioritizes root path cost first, not bridge or port IDs. Misunderstanding the order of evaluation can lead to incorrect answers.

Why the other options are wrong

This option is wrong because the selection of the root port is based on the lowest root path cost, not the local interface MAC address. The MAC address is not a factor in determining the root port in the Spanning Tree Protocol (STP) process.

This option is wrong because the selection of the root port in Spanning Tree Protocol (STP) is based on the lowest root path cost, not the duplex settings of the interfaces. Duplex settings do not influence the port selection process in STP.

The lowest configured VLAN number is not a factor in determining the root port in Spanning Tree Protocol (STP). The selection process prioritizes path cost, not VLAN configuration.

Practice this question →

194

MCQhard

A network engineer is configuring a new switch port for a VoIP phone that will have a PC daisy-chained behind it. The engineer wants to ensure that voice traffic is tagged with VLAN 100 and data traffic is untagged in VLAN 200. Which configuration should be applied to the switch port?

A.Configure the port as an access port in VLAN 200 and enable voice VLAN 100 with the switchport voice vlan 100 command.

B.Configure the port as a trunk port with native VLAN 200 and allowed VLAN 100.

C.Configure the port as an access port in VLAN 100 and enable voice VLAN 200 with the switchport voice vlan 200 command.

D.Configure the port as a trunk port with native VLAN 100 and allowed VLAN 200.

AnswerA

This configuration sets the port as an access port for data traffic in VLAN 200, while enabling voice VLAN 100 for VoIP traffic. The phone will tag voice traffic with VLAN 100, and the PC's data traffic will be untagged and assigned to VLAN 200. This meets the requirement of tagged voice and untagged data on the same port.

Why this answer

The correct configuration uses the voice VLAN feature on an access port. The port is set to access VLAN 200 for data traffic, and the voice VLAN 100 is enabled. The VoIP phone will tag voice frames with VLAN 100, while the PC's data frames remain untagged and are placed in VLAN 200.

This is the standard Cisco approach for connecting a phone and PC on a single switch port.

Exam trap

The trap here is assuming that a trunk port is required for voice and data separation, when the voice VLAN feature on an access port achieves the same result with simpler configuration.

Practice this question →

195

Drag & Dropmedium

Drag and drop the following steps into the correct order to configure and recover from a BPDU guard violation on a PortFast-enabled access port.

Drag or tap steps into the slots.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

The correct order is: first configure PortFast and BPDU guard on the interface (A). Then connect a switch to trigger a BPDU guard violation (B). Next, perform a shutdown followed by no shutdown to recover from the errdisable state (C).

Finally, verify that the port is forwarding traffic (D). This sequence ensures the violation occurs before recovery, which is the realistic scenario.

Exam trap

The trap is to think recovery must happen first, but the violation must occur to put the port into errdisable before recovery. The correct order is configure, trigger violation, recover, verify.

Practice this question →

196

MCQmedium

Which spanning-tree port role receives the best BPDU toward the root bridge on a nonroot switch?

A.Designated port

B.Alternate port

C.Root port

D.Disabled port

AnswerC

The root port is the switch port with the lowest path cost to the root bridge, making it the interface that receives the best BPDU (lowest root ID, lowest cost, etc.) on a non-root switch. It is the only port role that actively forwards traffic toward the root bridge, and its selection is based on superior spanning tree information. This port is the single forwarding path to the root, which directly matches the question's requirement of receiving the best BPDU toward the root.

Why this answer

The root port is the port on a nonroot switch with the lowest path cost to the root bridge.

Exam trap

Be careful not to confuse port roles. Remember, the root port is specifically for receiving the best BPDU toward the root bridge, not for forwarding or redundancy.

Why the other options are wrong

The designated port is responsible for forwarding traffic to and from a network segment and does not receive the best BPDU toward the root bridge; instead, it sends BPDUs to other ports. Therefore, it cannot be the correct answer for identifying the port role that receives the best BPDU on a nonroot switch.

The alternate port does not receive the best BPDU toward the root bridge; instead, it serves as a backup path to the root bridge when the primary path fails. It is in a blocking state and does not forward traffic.

A Disabled port does not participate in the Spanning Tree Protocol (STP) and does not receive any BPDUs, making it incapable of receiving the best BPDU toward the root bridge.

Practice this question →

197

PBQmedium

You are connected to SW1 via the console. SW1 is a Layer 2 switch connected to router R1 via trunk link G0/1. R1 performs inter-VLAN routing using subinterfaces. VLANs 10, 20, and 30 exist on SW1. Hosts in VLAN 10 (192.168.10.0/24) can ping R1's subinterface, but cannot communicate with hosts in VLAN 20. You suspect the trunk is not allowing VLAN 20 traffic.

Network Topology

Hints

•Check which VLANs are allowed on the trunk.
•The 'allowed vlan' command can be used to add or remove VLANs.
•Verify that VLAN 20 exists on the switch.

A.Configure 'switchport trunk allowed vlan add 20' on SW1's G0/1 interface.

B.Configure 'switchport mode access' on SW1's G0/1 interface.

C.Configure 'switchport trunk native vlan 20' on SW1's G0/1 interface.

D.Configure 'switchport trunk allowed vlan except 20' on SW1's G0/1 interface.

AnswerA

solution

! SW1
interface GigabitEthernet0/1
switchport trunk allowed vlan add 20

Why this answer

The symptom — VLAN 10 hosts can reach R1's subinterface but VLAN 20 hosts cannot communicate — points to VLAN 20 being pruned from the trunk. The correct fix is to add VLAN 20 to the trunk's allowed VLAN list on SW1's G0/1 interface using 'switchport trunk allowed vlan add 20', which preserves existing allowed VLANs while permitting VLAN 20. This restores 802.1Q tagging for VLAN 20 traffic across the trunk to R1.

Exam trap

200-301 often tests the misconception that configuring a native VLAN or changing port mode will fix VLAN reachability — candidates overlook that the allowed VLAN list on a trunk is exclusive once explicitly set and must be amended with the 'add' keyword.

Why the other options are wrong

Access mode carries only a single VLAN, so it would stop inter-VLAN routing entirely.

The native VLAN is for untagged frames; changing it does not add VLAN 20 to the allowed list.

The 'except' keyword excludes the specified VLAN, so it would prevent VLAN 20 from being carried.

198

PBQmedium

You are connected to SW1 via the console. SW1 is a Layer 2 switch with two VLANs: VLAN 10 (Sales) and VLAN 20 (Engineering). A router R1 is connected to port G0/1 on SW1 for inter-VLAN routing. Currently, the router is not routing between VLANs because the trunk is not configured correctly. Configure the switch port as a trunk and ensure the router can route between VLANs using subinterfaces (Router-on-a-Stick).

Network Topology

Hints

•The router expects a trunk link to carry multiple VLANs.
•Allowed VLAN list must include only the VLANs that need routing.
•The switch port must be in trunk mode, not access.

A.Configure the switch port as a trunk with 802.1Q encapsulation and allow VLANs 10 and 20.

B.Configure the switch port as an access port in VLAN 10 and add VLAN 20 as a secondary VLAN.

C.Configure the switch port as a trunk with ISL encapsulation and allow all VLANs.

D.Configure the switch port as a trunk with 802.1Q encapsulation and allow VLANs 1, 10, and 20.

AnswerA

solution

! SW1
interface GigabitEthernet0/1
switchport trunk encapsulation dot1q
switchport mode trunk
switchport trunk allowed vlan 10,20

Why this answer

The switch port was in access mode, which only carries one VLAN. Changing it to trunk with 802.1Q encapsulation allows multiple VLANs to traverse to the router. The allowed VLAN list restricts to VLANs 10 and 20 for security.

Exam trap

The trap is that candidates may confuse trunking with access ports, use outdated encapsulation (ISL), or include unnecessary VLANs like VLAN 1. Always remember that for Router-on-a-Stick, the switch port must be a trunk with 802.1Q and only allow the required VLANs.

Why the other options are wrong

Access ports cannot carry multiple VLANs; they are assigned to a single VLAN. The concept of secondary VLAN does not exist for access ports.

ISL encapsulation is deprecated in favor of 802.1Q, which is the industry standard. Allowing all VLANs violates the principle of least privilege.

Including VLAN 1 is unnecessary and can be a security concern. The allowed VLAN list should be restricted to only the VLANs that need to be routed.

199

Multi-Selectmedium

A network administrator is configuring a new switch and needs to set up VLANs. The administrator wants to ensure that VLAN 10 is used for voice traffic and VLAN 20 for data traffic on a port connected to an IP phone and a PC. Which two commands are required on the interface to achieve this configuration? (Choose two.)

Select 2 answers

A.switchport mode access

B.switchport voice vlan 10

C.switchport mode trunk

D.switchport trunk encapsulation dot1q

E.switchport access vlan 20

AnswersB, E

This command configures VLAN 10 as the voice VLAN. The IP phone will tag its voice traffic with VLAN 10, while data traffic from the PC remains untagged and is assigned to the access VLAN. This enables proper QoS and segmentation for voice.

Why this answer

To support both voice and data on a single port, the interface must be in access mode with a voice VLAN. The 'switchport access vlan 20' command assigns the data VLAN, and 'switchport voice vlan 10' assigns the voice VLAN. The phone tags voice traffic, while data traffic remains untagged.

Exam trap

The trap here is assuming that a trunk is needed for voice and data; however, Cisco's voice VLAN feature allows an access port to carry both by tagging voice traffic.

Practice this question →

200

MCQmedium

A network administrator is configuring a switch port that connects to a Cisco IP phone, which in turn has a desktop PC attached to its PC port. The administrator wants the phone to be placed in VLAN 100 and the PC in VLAN 200 on the same physical switch port. Which configuration should be applied to the switch port?

A.Configure the port as a trunk port and allow VLAN 100 and VLAN 200 on the trunk.

B.Configure the port as an access port in VLAN 100 and enable the voice VLAN 100 on the port.

C.Configure the port as a dynamic auto port and enable VLAN 100 and VLAN 200 with the switchport trunk allowed vlan command.

D.Configure the port as an access port in VLAN 200 and configure the voice VLAN as 100 using the switchport voice vlan 100 command.

AnswerD

This is the correct configuration for a Cisco IP phone with a PC attached. The access VLAN (200) carries untagged data traffic from the PC, while the voice VLAN (100) carries tagged voice traffic from the phone. The switchport voice vlan command enables the phone to receive its VLAN information via CDP or LLDP-MED and tag voice frames appropriately.

Why this answer

The correct approach uses an access port for the PC data VLAN and the switchport voice vlan command for the phone voice VLAN. This allows the phone to tag voice traffic with VLAN 100 while the PC sends untagged traffic in VLAN 200. The phone learns the voice VLAN through CDP or LLDP-MED and can also pass through the PC data.

Exam trap

The trap here is assuming that a trunk port is required to support both a voice and data VLAN on a single switch port.

Practice this question →

201

Multi-Selectmedium

Which TWO of the following statements accurately describe the configuration and behavior of Root Guard, Loop Guard, and BPDU Guard in Rapid PVST+ environments?

Select 2 answers

A.Root Guard, when enabled on a port, prevents that port from becoming the root port by placing it in a root-inconsistent state if a superior BPDU is received.

B.Root Guard automatically shuts down the port when a superior BPDU is received, similar to BPDU Guard.

C.Loop Guard, when enabled, disables a port if BPDUs are no longer received on it, preventing a unidirectional link failure.

D.BPDU Guard, when enabled, puts the port in an errdisable state if a BPDU is received, which is typically used on access ports to prevent unauthorized switches from connecting.

E.BPDU Guard places the port in a blocking state (loop-inconsistent) when a BPDU is received, similar to Loop Guard.

AnswersA, D

Root Guard, enabled on a designated port, does not prevent the switch from receiving a superior BPDU; instead, it reacts by moving the port into a root-inconsistent state, which blocks all traffic on that port while the superior BPDU continues to arrive. Once the superior BPDUs stop, the port automatically returns to its normal designated role. This behavior keeps an unauthorized switch from becoming the root bridge, but it does not disable the port or require manual intervention.

Why this answer

Root Guard prevents a port from becoming a root port by placing it in a root-inconsistent (blocking) state upon receiving a superior BPDU, protecting the root bridge placement. Option D is correct because BPDU Guard errdisables a port upon receiving a BPDU, a feature typically applied to access ports to block unauthorized switches. Option B is wrong: Root Guard does not shut down the port; it places it in a blocked state, unlike BPDU Guard's errdisable action.

Option C is wrong: Loop Guard does not disable a port when BPDUs stop being received; instead, it moves the port to a loop-inconsistent (blocking) state to guard against unidirectional link failures. Option E is wrong: BPDU Guard errdisables ports, whereas the loop-inconsistent blocking state is used by Loop Guard or Root Guard, not BPDU Guard.

Exam trap

Cisco often tests the distinction between 'shutdown' (errdisable) and 'blocking' (inconsistent state) — candidates confuse BPDU Guard's errdisable behavior with Root Guard's or Loop Guard's blocking behavior, leading them to incorrectly select Option B.

Why the other options are wrong

Root Guard does not shut down the port; it places the port in a root-inconsistent state, which effectively blocks traffic but does not disable the port. BPDU Guard, on the other hand, errdisables the port.

Loop Guard does not disable the port; it places the port into a loop-inconsistent state, blocking traffic on that port until BPDUs are received again. The port remains administratively up.

BPDU Guard errdisables the port, not just blocks it. Loop Guard uses a loop-inconsistent state, which is different from errdisable. BPDU Guard is a more severe reaction.

Practice this question →

202

MCQhard

Exhibit: SW1 is configured for EtherChannel with LACP, but the bundle does not form. What is the most likely cause?

A.The interfaces should use PAgP instead of LACP on both ends

B.One side is using LACP and the other side is using a static EtherChannel mode

C.The links must be routed ports before EtherChannel can form

D.EtherChannel requires three or more member links

AnswerB

The correct explanation is that EtherChannel will not form because the interface configurations are incompatible: one side is running LACP in active mode, which sends LACP PDUs to negotiate a channel, while the other side is configured with a static mode (mode on), which does not send or process LACP PDUs. Without LACP negotiation from both peers, the switch sees no valid LACP partner and refuses to bundle the links. To fix this, both ends must use LACP (active/passive) or both must use static mode.

Why this answer

For an LACP EtherChannel to form, both sides must negotiate with LACP using active or passive mode. One side here is set to channel-group mode on, which creates a static channel and does not speak LACP. That mismatch prevents the bundle from forming.

Exam trap

Ensure both sides of the EtherChannel are set to negotiate with LACP; avoid static channel settings.

Why the other options are wrong

This option is incorrect because the question specifies that LACP is being used, which is incompatible with PAgP. EtherChannel can operate with either LACP or PAgP, but not both simultaneously.

This option is wrong because EtherChannel can form with access ports or trunk ports, and there is no requirement for the interfaces to be routed ports for EtherChannel to function.

EtherChannel can function with as few as two member links; therefore, requiring three or more member links is not a valid reason for the bundle not forming in this scenario.

Practice this question →

203

PBQhard

You are connected to a multilayer switch MLS1. The network has two other switches: SW2 and SW3. The interface GigabitEthernet0/1 already has PortFast and BPDU Guard enabled. Configure MLS1 as the root bridge for VLAN 10 and VLAN 20 using the root primary command. After configuration, verify that the interface is not in err-disabled state and that the root bridge role is correctly assigned.

Network Topology

Hints

•Use spanning-tree vlan root primary to set the switch as root for specified VLANs.
•Verify with show spanning-tree vlan <vlan> to confirm root bridge priority is 24576.
•Check interface status with show interfaces gigabitethernet 0/1 status to ensure it is not err-disabled.

A.Configure 'spanning-tree vlan 10 root primary' and 'spanning-tree vlan 20 root primary' on MLS1. Verify with 'show spanning-tree vlan 10' and 'show interfaces gigabitEthernet0/1 status'.

B.Configure 'spanning-tree vlan 10 root primary' and 'spanning-tree vlan 20 root secondary' on MLS1. Verify with 'show spanning-tree vlan 10' and 'show interfaces gigabitEthernet0/1 status'.

C.Configure 'spanning-tree vlan 10 priority 4096' and 'spanning-tree vlan 20 priority 4096' on MLS1. Verify with 'show spanning-tree vlan 10' and 'show interfaces gigabitEthernet0/1 status'.

D.Configure 'spanning-tree vlan 10 root primary' and 'spanning-tree vlan 20 root primary' on MLS1. Then configure 'spanning-tree portfast default' and 'spanning-tree bpduguard default' globally. Verify with 'show spanning-tree vlan 10' and 'show interfaces gigabitEthernet0/1 status'.

AnswerA

solution

! MLS1
spanning-tree vlan 10 root primary
spanning-tree vlan 20 root primary

Why this answer

The interface Gi0/1 already has PortFast and BPDU Guard configured, so no additional configuration is needed for that step. Using 'spanning-tree vlan 10 root primary' and 'spanning-tree vlan 20 root primary' sets the priority to 24576, ensuring MLS1 becomes root for both VLANs. Verify with 'show spanning-tree vlan 10' to see the priority changed and 'show interfaces gigabitEthernet0/1 status' to confirm the port is not err-disabled.

Exam trap

Do not confuse 'root primary' with 'root secondary' or manual priority settings. The 'root primary' command automatically sets the priority to 24576, which is the recommended value. Also, avoid adding unnecessary global commands when the interface already has the required features configured.

Why the other options are wrong

Using 'root secondary' for VLAN 20 sets priority to 28672, leaving MLS1 as backup root, not the primary root.

Manually setting priority to 4096 is valid but not the recommended method; 'root primary' is simpler and ensures proper value.

Global portfast and bpduguard are not required because the interface is already configured with those features; this adds unnecessary commands.

Practice this question →

204

MCQhard

A switchport on one side of a link is configured as a trunk, but the peer side is configured as an access port. What is the most likely result?

A.The link roles are mismatched, so VLAN traffic will not be handled as intended.

B.The access side automatically becomes a routed port.

C.Both switches automatically synchronize their switchport settings.

D.The mismatch forces OSPF to change router IDs.

AnswerA

This is correct because a switchport configured as trunk on one side and access on the other creates a Layer 2 mismatch: the trunk side expects IEEE 802.1Q-tagged frames for multiple VLANs, while the access side expects untagged frames on a single VLAN. As a result, VLAN traffic is not forwarded consistently—frames tagged by the trunk are often dropped by the access port, and untagged frames from the access side may be mishandled. The link may still go up (depending on DTP settings), but the intended VLAN segmentation and inter-switch trunking behavior are broken.

Why this answer

The most likely result is a logical mismatch that prevents VLAN traffic from crossing the link as intended. In practical terms, one side is trying to carry multiple VLANs with tagging behavior, while the other side is treating the connection as a normal one-VLAN endpoint port. That disagreement usually leads to unexpected or failed traffic behavior.

This is a classic switching mismatch scenario. The link may still be physically up, but the two sides do not agree on how the traffic should be handled.

Exam trap

Don't assume mismatches always result in physical link failure; focus on logical traffic handling issues.

Why the other options are wrong

This option is incorrect because an access port does not automatically convert to a routed port when connected to a trunk port; it remains an access port and will not participate in Layer 3 routing.

This option is wrong because switchport settings do not automatically synchronize between devices; each port retains its configuration independently, leading to a mismatch in link roles.

This option is incorrect because the configuration mismatch between a trunk and an access port does not directly affect OSPF router IDs, which are determined by the OSPF process itself and not by switchport configurations.

Practice this question →

205

MCQhard

A switchport is configured as a trunk on one side and access on the other side of the same physical link. What is the most likely result?

A.The link roles are mismatched, so VLAN traffic will not be handled as intended across the link.

B.The access side automatically becomes a routed port.

C.The switches automatically synchronize their configurations.

D.The mismatch forces OSPF to choose a new router ID.

AnswerA

When one side is a trunk and the peer is an access port, the link's encapsulation expectations conflict: the trunk port transmits 802.1Q-tagged frames while the access port accepts only untagged frames, so the access port typically drops or misplaces that traffic into its native VLAN. This logical mismatch means the VLAN traffic cannot traverse the link correctly, even though the physical link stays up.

Why this answer

A trunk/access mismatch prevents the link from carrying VLAN traffic as intended. Option A correctly identifies this mismatch. Option B is wrong because access ports remain Layer 2 switchports; there is no automatic conversion to a routed port.

Option C fails because switch configurations are never auto-synchronized due to a port role mismatch. Option D is incorrect: OSPF router ID is chosen based on loopback or highest IP address and is unaffected by a Layer 2 port mismatch.

Exam trap

Beware of assuming automatic negotiation fixes all mismatches; DTP cannot resolve a trunk/access mismatch.

Why the other options are wrong

Access ports do not automatically become routed ports; they remain Layer 2 switchports unless explicitly configured with 'no switchport'.

Switches do not automatically synchronize configurations; this is not a feature supported on Cisco switches to resolve mismatches.

OSPF router ID is determined by the highest loopback or IP address, not by Layer 2 port configuration mismatches.

Practice this question →

206

Multi-Selectmedium

Which TWO statements are true regarding VLAN configuration, 802.1Q trunking, and the native VLAN?

Select 2 answers

A.On an 802.1Q trunk, frames in the native VLAN are always tagged with a VLAN ID.

B.The native VLAN should be changed from the default VLAN 1 to an unused VLAN for security reasons.

C.802.1Q is a Cisco proprietary trunking protocol.

D.802.1Q supports up to 4094 VLANs (VLAN IDs 1–4094).

E.The native VLAN must be the same on both ends of an 802.1Q trunk for the trunk to operate.

AnswersB, D

Changing the native VLAN from the default VLAN 1 to an unused VLAN is a Cisco-recommended hardening step because VLAN 1 is well-documented and often carries control-plane traffic such as CDP, VTP, and PAgP. Attackers can exploit the default native VLAN to launch double-tagging (VLAN hopping) attacks, so moving native VLAN to a dedicated unused VLAN reduces the risk of layer 2 traffic being intercepted or misforwarded. Additionally, using an unused VLAN ensures that no legitimate user traffic is accidentally sent untagged on the trunk, which prevents VLAN misclassification.

Why this answer

Changing the native VLAN from the default VLAN 1 to an unused VLAN is a recommended security best practice to prevent VLAN hopping attacks. Option D is correct because 802.1Q uses a 12-bit VLAN ID field, allowing VLAN IDs from 1 to 4094 (0 and 4095 are reserved). Option A is false: on an 802.1Q trunk, frames in the native VLAN are typically sent untagged.

Option C is false: 802.1Q is an IEEE standard, not Cisco proprietary (ISL is Cisco proprietary). Option E is false: the native VLAN does not have to match on both ends; mismatched native VLANs can cause traffic to be misclassified but the trunk will still operate.

Exam trap

Cisco often tests the misconception that 802.1Q is proprietary (it is not) and that native VLAN frames are always tagged (they are untagged by default), leading candidates to incorrectly select options A or C.

Why the other options are wrong

The native VLAN is specifically the VLAN that does not get a tag; all other VLANs are tagged.

802.1Q is an open standard, whereas ISL was Cisco proprietary.

Mismatched native VLANs can lead to security vulnerabilities and misrouting, but the trunk itself may still come up.

Practice this question →

207

PBQhard

You are connected to a multilayer switch MLS1. Configure Root Guard on the designated port facing another switch SW2 to prevent it from becoming root, configure Loop Guard on the uplink port to the core, and configure BPDU Guard on a PortFast-enabled access port. After configuration, a superior BPDU arrives on the designated port—confirm it is blocked by Root Guard. Then, simulate a BPDU on the access port to verify it goes err-disabled due to BPDU Guard.

Hints

•Root Guard is configured per interface under the interface configuration mode.
•Loop Guard uses the same command but with 'loop' keyword.
•BPDU Guard on PortFast ports can be enabled globally or per interface; use per-interface for this task.

A.Root Guard on Gi0/2, Loop Guard on Gi0/1, BPDU Guard on Gi0/0

B.Root Guard on Gi0/1, Loop Guard on Gi0/2, BPDU Guard on Gi0/0

C.Root Guard on Gi0/0, Loop Guard on Gi0/1, BPDU Guard on Gi0/2

D.Root Guard on Gi0/2, Loop Guard on Gi0/0, BPDU Guard on Gi0/1

AnswerA

solution

! MLS1
interface GigabitEthernet0/2
spanning-tree guard root
exit
interface GigabitEthernet0/1
spanning-tree guard loop
exit
interface GigabitEthernet0/0
spanning-tree bpduguard enable
exit

Why this answer

First, Root Guard was applied on Gi0/2 (the designated port) with 'spanning-tree guard root' to prevent SW2 from becoming root. Second, Loop Guard was applied on the uplink Gi0/1 with 'spanning-tree guard loop' to protect against unidirectional links. Third, BPDU Guard was applied on the PortFast-enabled access port Gi0/0 with 'spanning-tree bpduguard enable'.

When a superior BPDU arrives on Gi0/2, Root Guard transitions it to a root-inconsistent (blocked) state. If a BPDU is received on Gi0/0, BPDU Guard err-disables the port. Verification shows the blocked state on Gi0/2 and err-disabled on Gi0/0.

Exam trap

Do not confuse the purposes of Root Guard, Loop Guard, and BPDU Guard. Root Guard blocks superior BPDUs on designated ports; Loop Guard prevents loops on root/alternate ports; BPDU Guard err-disables PortFast ports upon BPDU reception. Pay attention to port roles: designated, root, and access.

Why the other options are wrong

Root Guard is intended for ports that should not become root; applying it on the uplink would block legitimate superior BPDUs from the core. Loop Guard on the designated port would not protect against unidirectional links on the uplink.

Root Guard on an access port is unnecessary and would not prevent the switch from becoming root via other ports. BPDU Guard on the designated port would disable it instead of blocking the BPDU.

Loop Guard on an access port does not protect against unidirectional links on the uplink. BPDU Guard on the uplink would err-disable the core connection if a BPDU is received, which is undesirable.

Practice this question →

208

MCQhard

A network engineer is configuring a switch port for a new wireless access point that will support multiple SSIDs mapped to different VLANs. The AP will be powered by PoE and will tag traffic for each SSID. Which configuration on the switch port is most appropriate?

A.Configure the port as a trunk port and set the native VLAN to VLAN 1, allowing all VLANs.

B.Configure the port as a trunk port, set the native VLAN to the AP management VLAN, and allow the SSID VLANs on the trunk.

C.Configure the port as an access port in the management VLAN and use 802.1X authentication for the SSIDs.

D.Configure the port as an access port in the management VLAN and enable voice VLAN for the SSIDs.

AnswerB

This is the correct configuration for an AP supporting multiple SSIDs. The AP management traffic is typically untagged and placed in the native VLAN, while each SSID's traffic is tagged with its respective VLAN. The trunk allows multiple VLANs to traverse the link. This setup enables the AP to map each SSID to a different VLAN and tag frames accordingly.

Why this answer

For an access point supporting multiple SSIDs, the switch port should be configured as a trunk. The native VLAN is used for untagged management traffic from the AP, while each SSID's traffic is tagged with its corresponding VLAN. Allowing only the necessary VLANs on the trunk is a best practice.

This configuration ensures proper segmentation and security.

Exam trap

The trap here is assuming an access port with voice VLAN can handle multiple SSIDs, or that allowing all VLANs is acceptable.

Practice this question →

209

MCQhard

An administrator notices that hosts in VLAN 30 on SW1 cannot communicate with hosts in VLAN 30 on SW2, even though both switches are connected via an 802.1Q trunk. Traffic for VLANs 10 and 20 passes without issues across the same trunk. The trunk is configured to allow all VLANs, and the allowed VLAN list explicitly includes VLAN 30. What is the most likely cause of the problem?

A.The native VLAN is mismatched between SW1 and SW2, and VLAN 30 is the native VLAN on one side.

B.The trunk encapsulation is set to ISL on one switch and 802.1Q on the other.

C.Spanning Tree Protocol has placed VLAN 30 in a blocking state on the trunk link.

D.The switched virtual interface (SVI) for VLAN 30 on SW1 is administratively down.

AnswerA

A native VLAN mismatch causes one switch to send untagged frames for VLAN 30 while the other expects tagged frames, so the receiving switch cannot associate the untagged traffic with VLAN 30, leading to a communication failure only for that VLAN.

Why this answer

The most likely cause is a native VLAN mismatch. When the native VLAN is mismatched on an 802.1Q trunk, traffic for the native VLAN is not tagged, so frames from VLAN 30 on one switch are received as untagged frames on the other switch and placed into the switch's configured native VLAN. If the native VLAN on one side is VLAN 30 and on the other side is a different VLAN (e.g., VLAN 1), the hosts in VLAN 30 cannot communicate because the frames are interpreted as belonging to different VLANs.

Traffic for VLANs 10 and 20 passes because they are not the native VLAN and are properly tagged.

Exam trap

Cisco often tests the native VLAN mismatch scenario by describing a trunk that works for most VLANs but fails for one specific VLAN, leading candidates to incorrectly suspect STP blocking or SVI issues instead of recognizing the native VLAN mismatch.

Why the other options are wrong

This would cause a complete trunk failure, not a failure limited to a single VLAN.

STP would not randomly block one VLAN on a point-to-point trunk while the rest are forwarding; this is not a typical behavior.

Layer 2 switching within the same VLAN does not require an SVI; an SVI is only needed for routing between VLANs or management.

Practice this question →

210

MCQhard

Exhibit: A switch interface connected to an IP phone and PC is configured as an access port in VLAN 10. The PC works, but the phone does not register. What additional configuration is most likely needed?

A.switchport trunk encapsulation dot1q

B.switchport voice vlan <voice-vlan-id>

C.channel-group 1 mode active

D.ip helper-address on the switchport

AnswerB

This command configures a dedicated voice VLAN on an access port connected to an IP phone. It allows the phone to tag voice traffic with the specified VLAN ID while the attached PC remains untagged in the access VLAN, enabling separate QoS policies and subnets for voice and data. This is the standard Cisco configuration for a single switchport carrying both phone and PC traffic.

Why this answer

An IP phone commonly requires a voice VLAN so tagged voice traffic is separated from the data VLAN used by the attached PC. Without a voice VLAN, the PC can still work on the access VLAN while the phone fails to register properly.

Exam trap

Don't confuse portfast or trunk mode with the need for a voice VLAN. Focus on the specific requirements of IP phones.

Why the other options are wrong

This option is incorrect because the question specifies an access port configuration, which does not require trunk encapsulation. Access ports do not use trunking protocols like dot1q, as they are meant for single VLAN traffic only.

This option is wrong because the channel-group command is used for configuring EtherChannel, which is not relevant to the issue of the IP phone not registering on an access port. The problem lies in the VLAN configuration for voice traffic, not in link aggregation.

The 'ip helper-address' command is used to forward DHCP requests from clients to a DHCP server, but it does not address the registration issue of the IP phone in this scenario, which is related to VLAN configuration.

Practice this question →

211

MCQhard

A host is physically connected to switch port Gi0/3. The technician runs 'show mac address-table' but does not find the host's MAC address for Gi0/3. The port status shows 'up/up', and the host was connected only a few minutes ago. What should the technician do next?

A.Clear the MAC address table with 'clear mac address-table dynamic' to force immediate relearning.

B.Verify the VLAN assignment on Gi0/3 using 'show vlan brief' or 'show interfaces Gi0/3 switchport'.

C.Check the STP state of Gi0/3 with 'show spanning-tree interface Gi0/3' to ensure it is not blocking.

D.Inspect the ARP cache with 'show ip arp' to check for duplicate IP addresses.

AnswerB

The switch learns MAC addresses per VLAN. If Gi0/3 is in an unexpected VLAN, the MAC address will be learned in that VLAN's table and not visible in the default or expected VLAN view. Checking the VLAN membership directly confirms whether the host is in the correct Layer 2 broadcast domain.

Why this answer

The most likely reason a newly connected host's MAC address does not appear in the MAC address table is that the switch port is in the wrong VLAN or is administratively configured as an access port in a VLAN that does not match the host's expected VLAN. The 'show vlan brief' command verifies VLAN existence and port membership, while 'show interfaces Gi0/3 switchport' confirms the operational VLAN assignment. Since the port is up/up and the host was connected only minutes ago, the switch should have learned the MAC address via normal flooding; its absence points to a VLAN mismatch or port configuration issue, not a stale table or STP blocking.

Exam trap

Cisco often tests the misconception that a missing MAC address is due to STP blocking or a stale table, when in fact the port being 'up/up' and recently connected makes VLAN misconfiguration the most logical first step to troubleshoot.

Why the other options are wrong

This is a drastic action that does not address a VLAN mismatch; the same symptom would recur.

Jumping to STP before confirming basic Layer 2 VLAN membership is not the most efficient next step.

This option confuses Layer 2 MAC learning with Layer 3 ARP resolution, and does not help locate the MAC entry in the address table.

Practice this question →

212

MCQmedium

Hosts in VLAN 10 need to communicate with hosts in VLAN 20. What is required for that communication to work?

A.A DHCP server

B.A DNS server

C.A Layer 3 routing function

D.A second access switch

AnswerC

Layer 3 routing is the required mechanism because VLANs represent separate broadcast domains and distinct IP subnets. A router or multilayer switch must inspect the destination IP address, perform a route lookup, and rewrite the frame's MAC addresses before forwarding the packet to the destination VLAN. Without this IP-level forwarding decision, frames remain confined to their originating Layer 2 domain, so no traffic can cross the VLAN boundary.

Why this answer

Traffic between VLANs must be routed. A router or multilayer switch provides the Layer 3 function needed for inter-VLAN communication.

Exam trap

Do not confuse trunk links or access ports with routing functions; they serve different purposes in VLAN configurations.

Why the other options are wrong

A DHCP server is not required for communication between VLANs; it only assigns IP addresses to devices within a network. VLAN communication requires routing, which a DHCP server does not provide.

A DNS server is not required for VLAN communication, as DNS resolves domain names to IP addresses, which does not facilitate inter-VLAN routing. Communication between VLANs requires Layer 3 routing, not name resolution.

A second access switch is not required for VLAN communication; VLANs can communicate through a Layer 3 device such as a router or a Layer 3 switch. The existing switch infrastructure can handle VLANs without needing additional switches.

Practice this question →

213

MCQhard

A multilayer switch must route traffic between VLAN 10 and VLAN 20. Which condition is required for that to happen?

A.SVIs for the VLANs plus Layer 3 routing enabled on the switch

B.All ports in both VLANs configured as trunks

C.A separate OSPF process on every access port

D.Port security disabled on every edge port

AnswerA

On a multilayer switch, inter-VLAN routing is accomplished by creating a Switch Virtual Interface (SVI) for each VLAN and assigning each SVI an IP address in its respective subnet. These SVIs act as the default gateway for hosts in their VLAN, and the switch must have IP routing globally enabled with 'ip routing' so it can forward packets between the SVIs at Layer 3. This is the standard method for inter-VLAN routing on a multilayer switch, as opposed to using an external router or router-on-a-stick.

Why this answer

Inter-VLAN routing on a multilayer switch depends on having functional Layer 3 gateway interfaces for the VLANs and routing enabled on the switch. In plain language, the switch needs a routed brain for each VLAN, usually in the form of SVIs, and it must actually be operating as a Layer 3 device rather than only as a pure Layer 2 switch. Without those conditions, traffic may switch inside a VLAN but cannot be routed between different VLANs.

This is a core CCNA design idea because people often assume creating VLANs alone automatically gives them inter-VLAN communication. In reality, VLANs create separation, and routing is what reconnects them under controlled conditions. A trunk between switches can carry VLAN traffic, but it does not itself perform Layer 3 routing between the VLANs. The correct answer is the requirement that makes the switch act as the gateway between VLANs.

Exam trap

Don't confuse trunking with routing; trunk ports carry VLAN traffic but don't route it.

Why the other options are wrong

This option is wrong because configuring all ports as trunks does not facilitate inter-VLAN routing; SVIs and Layer 3 routing are necessary for that functionality.

This option is wrong because OSPF is a routing protocol used for dynamic routing, and access ports do not participate in routing processes. Routing between VLANs requires SVIs and Layer 3 capabilities, not OSPF on access ports.

Port security being disabled on every edge port is not a requirement for routing traffic between VLANs; it pertains to security configurations rather than routing functionality. VLAN routing can occur regardless of port security settings.

Practice this question →

214

PBQhard

You are connected to switch SW1. The network uses Rapid-PVST+ and SW1 has been accidentally configured with a low spanning-tree priority, causing it to become the root bridge for VLAN 10 even though it should not be. Additionally, an edge port connected to a server is repeatedly receiving BPDUs, causing it to go into err-disabled state. Configure SW1 so that it is never the root bridge for VLAN 10, and configure the edge port so that it automatically recovers from err-disabled state after 300 seconds. Finally, verify that SW1 is not the root bridge for VLAN 10.

Network Topology

Hints

•To prevent a switch from becoming root, set its priority to a value higher than the current root's priority (e.g., 32768).
•The errdisable recovery cause command enables automatic recovery; the interval command sets the timeout.
•After configuration, verify with 'show spanning-tree vlan 10' that the bridge ID priority is not the lowest.

A.spanning-tree vlan 10 priority 36864; errdisable recovery cause bpduguard; errdisable recovery interval 300; show spanning-tree vlan 10

B.spanning-tree vlan 10 priority 4096; errdisable recovery cause bpduguard; errdisable recovery interval 300; show spanning-tree vlan 10

C.spanning-tree vlan 10 root secondary; errdisable recovery cause bpduguard; errdisable recovery interval 300; show spanning-tree vlan 10

D.spanning-tree vlan 10 priority 32768; errdisable recovery cause all; errdisable recovery interval 300; show spanning-tree vlan 10

AnswerA

solution

! SW1
no spanning-tree vlan 10 priority 4096
spanning-tree vlan 10 priority 32768
errdisable recovery cause bpduguard
errdisable recovery interval 300

Why this answer

The issue is that SW1 has the spanning-tree priority for VLAN 10 set to 4096, which makes it the root bridge. To prevent this, you must set the priority higher than the current root bridge's priority (e.g., 32768 or higher). Additionally, the edge port (G0/1) is in err-disabled state because it received a BPDU while PortFast was enabled (BPDU Guard triggered).

To automatically recover from err-disabled, you need to configure errdisable recovery cause bpduguard and set the interval to 300 seconds. After configuration, verify with 'show spanning-tree vlan 10' that SW1 is no longer the root and 'show errdisable recovery' to confirm the recovery settings.

Exam trap

Students often confuse the priority values: lower priority is better to become root. To prevent a switch from becoming root, set its priority higher than the current root's. Also, remember that 'root secondary' sets a low priority (28672) and does not prevent root election.

For errdisable recovery, use the specific cause (bpduguard) rather than 'all'.

Why the other options are wrong

The priority 4096 is too low and would still result in SW1 being the root bridge.

The 'root secondary' command does not prevent the switch from becoming root; it only makes it the backup root.

Using 'cause all' is not the best practice; the requirement is to recover from bpduguard specifically.

Practice this question →

215

MCQhard

Refer to the exhibit. A network administrator runs the show vlan brief command on SW2. Interface GigabitEthernet0/2 is intended to be an access port in VLAN 10, but it does not appear in the output. What is the most likely cause?

A.The interface is configured with switchport mode dynamic auto and no trunk has been negotiated, causing it to be hidden.

B.The interface is administratively shut down, and down ports are excluded from the show vlan brief output.

C.The interface is configured as a trunk port and therefore does not appear under any VLAN in show vlan brief.

D.VLAN 10 is not active, so the port assigned to it is not displayed in the listing.

AnswerC

show vlan brief only displays ports that are in access mode. Trunk ports are not included because they belong to all VLANs allowed on the trunk. The output shows VLAN 10 with members Gi0/9–Gi0/11 but not Gi0/2, confirming it is not an access port.

Why this answer

The `show vlan brief` command displays only access ports and their assigned VLANs. Trunk ports, which carry multiple VLANs, are not listed in this output. If GigabitEthernet0/2 is configured as a trunk port (e.g., with `switchport mode trunk` or dynamically via DTP), it will not appear under any VLAN in the `show vlan brief` output, even if it is intended to be an access port in VLAN 10.

Exam trap

Cisco often tests the distinction between access and trunk port behavior in `show vlan brief` output, trapping candidates who assume all switchports appear in the VLAN listing regardless of mode.

Why the other options are wrong

Confusion about how dynamic trunking protocol (DTP) modes interact with VLAN membership display.

Misconception that only operational interfaces are shown in VLAN membership tables.

Overlooking the explicit 'active' status and port list for VLAN 10 in the output.

Practice this question →

216

MCQhard

A network engineer is troubleshooting connectivity between two hosts in different VLANs on the same switch. Host A in VLAN 10 (10.10.10.5/24) cannot ping Host B in VLAN 20 (10.10.20.5/24). The switch is configured as a router-on-a-stick with a trunk port to an external router. The trunk port is up/up, but inter-VLAN routing fails. What is the most likely cause?

A.The trunk port is not in trunking mode; it is in dynamic desirable mode.

B.The native VLAN on the switch trunk is VLAN 1, but the router subinterface for VLAN 1 is not configured with the 'native' keyword or is missing.

C.The VLANs are not allowed on the trunk; the allowed VLAN list is missing VLAN 10 and 20.

D.The switch ports Gi0/4 and Gi0/5 are in access mode but not assigned to the correct VLANs.

AnswerC

When an allowed VLAN list on a trunk is configured and does not include VLAN 10 and VLAN 20, all tagged frames from those VLANs are dropped, causing inter-VLAN routing failure even though the trunk is up/up.

Why this answer

The most likely cause is that the allowed VLAN list on the trunk is missing VLAN 10 and 20. Even though the trunk port is up/up, if the switch's allowed VLAN list has been restricted (for example, using the switchport trunk allowed vlan command) and does not include those VLANs, all frames tagged with VLAN 10 or 20 will be discarded at the trunk. This directly prevents inter-VLAN routing despite the trunk being operational, whereas a native VLAN mismatch only affects untagged traffic and would not impact the tagged frames between the two hosts.

Exam trap

A common trap is assuming an up/up trunk automatically passes traffic for all VLANs, overlooking that the allowed VLAN list can be manually pruned and must include every VLAN that needs to traverse the trunk.

Why the other options are wrong

Dynamic desirable mode can still form a trunk if the other side is willing; the trunk is already up/up, so the port mode is not the issue.

A native VLAN mismatch or missing native subinterface only affects untagged frames; the hosts in VLAN 10 and VLAN 20 send tagged traffic, so this would not break their routing.

The hosts' access port configurations would prevent intra-VLAN communication if misassigned, but the question describes an inter-VLAN routing failure through the trunk, not a problem with the access ports themselves.

Practice this question →

217

MCQhard

A user on a wireless guest network can associate successfully, obtains an IP address, but cannot reach the Internet. Which troubleshooting area should be examined first if the WLAN itself is working?

A.The post-association forwarding or policy path, such as guest routing or Internet access policy

B.The SSID broadcast name, because it must be wrong

C.The AP radio antenna type only

D.OSPFv3 area configuration on the laptop

AnswerA

Since the client has already associated and obtained an IP address (implied by 'can associate successfully'), the failure point must be downstream of L2 association. The post-association path encompasses the WLAN-to-VLAN mapping, firewall rules, NAT, ACLs, or default gateway routing that determines guest Internet access. If any of these policy constructs is misconfigured or missing, the client will sit with a valid IP but no usable connectivity.

Why this answer

If association and addressing are already successful, the first area to examine is the forwarding or policy path beyond simple WLAN join behavior. In practical terms, the client has passed the discovery, authentication, and addressing stages. The problem is now more likely to involve routing, gateway reachability, NAT, firewall policy, or guest-access restrictions rather than the SSID itself.

This question is about understanding which stage of the workflow has already succeeded.

Exam trap

Avoid assuming issues with association or IP assignment when these steps have already succeeded.

Why the other options are wrong

The SSID broadcast name is not relevant in this scenario because the user has already associated successfully and obtained an IP address, indicating that the SSID is correct and functioning.

The AP radio antenna type does not directly impact a user's ability to obtain an IP address or reach the Internet after successful association. This option is irrelevant since the user is already connected to the network.

OSPFv3 area configuration is related to routing protocols and is not directly relevant to a user's inability to access the Internet on a guest network after successfully associating. The issue is likely related to network policies or forwarding paths rather than routing configurations on the user's device.

Practice this question →

218

MCQmedium

On an 802.1Q trunk, which VLAN is sent untagged by default on many Cisco switches unless changed?

A.VLAN 10

B.VLAN 20

C.VLAN 1

D.The highest configured VLAN

AnswerC

By default, Cisco switches configure VLAN 1 as the native VLAN on an 802.1Q trunk. Frames in the native VLAN are transmitted without a VLAN tag, while all other VLANs carry a 802.1Q tag. This default behavior ensures that control-plane traffic like CDP, VTP, and DTP, which typically run on VLAN 1, can traverse the trunk without tagging.

Why this answer

On many Cisco platforms, VLAN 1 is the default native VLAN. Native VLAN traffic is sent untagged unless the native VLAN is changed.

Exam trap

Be cautious not to confuse commonly used VLANs in practice with the default native VLAN set by Cisco.

Why the other options are wrong

VLAN 10 is not the default untagged VLAN on Cisco switches; instead, VLAN 1 is typically used for this purpose unless configured otherwise. Therefore, selecting VLAN 10 would be incorrect in the context of the question.

VLAN 20 is not the default untagged VLAN on Cisco switches; instead, VLAN 1 is typically sent untagged on 802.1Q trunks unless configured otherwise. Therefore, selecting VLAN 20 does not align with the standard behavior of Cisco switch configurations.

This option is incorrect because the default untagged VLAN on many Cisco switches is VLAN 1, not the highest configured VLAN. The highest configured VLAN can vary based on the network setup and does not have a default status in this context.

Practice this question →

219

MCQhard

A multilayer switch has working SVIs for VLAN 10 and VLAN 20, but traffic between the VLANs fails. Hosts can ping their own gateway interfaces. Which misconfiguration is most strongly suggested if the SVIs themselves are correct?

A.IP routing is not enabled on the multilayer switch.

B.Both VLANs need to use the same IP subnet.

C.All access ports must be converted into trunks.

D.The wireless controller must provide the default gateway.

AnswerA

The correct answer is that IP routing is not enabled globally on the multilayer switch. Even with SVIs for VLAN 10 and 20 created and hosts able to ping their respective gateways, the switch will not forward packets between VLANs unless the `ip routing` global configuration command has been issued. Without this command, the switch functions as a Layer 2 device; it has SVI interfaces but no Layer 3 forwarding table to route traffic from one subnet to another. To fix this, you must enable IP routing and, if needed, configure static routes or a dynamic routing protocol.

Why this answer

IP routing is not enabled. The switch can ping SVIs locally because they are directly connected, but without `ip routing`, it cannot forward packets between VLANs. Option B is wrong because different VLANs require different subnets for routing.

Option C is wrong because access ports do not need to be trunks; SVIs handle routing at Layer 3. Option D is wrong because the wireless controller does not provide the default gateway for wired VLAN routing; the SVI does.

Exam trap

Remember that SVIs alone do not enable inter-VLAN routing; IP routing must be explicitly enabled on the switch.

Why the other options are wrong

Different VLANs must use different IP subnets for routing; using the same subnet would break Layer 3 separation.

Access ports remain as access ports; inter-VLAN routing requires SVIs with routing enabled, not trunk conversion of access ports.

The default gateway for each VLAN is the SVI IP address; a wireless controller is irrelevant to Layer 3 forwarding between wired VLANs.

Practice this question →

220

MCQmedium

Exhibit: Users report that they can see the corporate SSID but fail authentication immediately after entering credentials. Guest wireless works on the same access point. Which issue is most likely?

A.The AP is using the wrong channel width

B.The RADIUS or AAA server is unreachable for the enterprise WLAN

C.The corporate SSID has a mismatched RADIUS shared secret

D.The SSID must be configured as hidden

AnswerB

WPA2-Enterprise requires the AP to forward EAP frames from the client to a RADIUS/AAA server for authentication. If that server is unreachable, clients can still discover the SSID and associate at Layer 2, but the 802.1X exchange times out because no Access-Request ever receives a response. The guest WLAN is unaffected because it does not depend on AAA, isolating the fault to the enterprise WLAN's backend.

Why this answer

When clients can see the SSID and associate at Layer 2 but fail right after entering credentials, a broken 802.1X or RADIUS path is a common cause. RF coverage is clearly not the main problem because the SSID is visible and guest service works.

Exam trap

Be careful not to confuse visibility and connectivity issues with authentication problems. The SSID is visible, so focus on authentication-related configurations.

Why the other options are wrong

The AP using the wrong channel width would not cause immediate authentication failures; it typically affects connectivity or performance rather than authentication processes. Since the guest wireless works, the channel width is likely not the issue.

A mismatched RADIUS shared secret would cause authentication failures, but guest wireless works on the same access point, indicating the AP itself is functional; the more likely cause is that the RADIUS server is completely unreachable, not just a shared secret mismatch.

Configuring the SSID as hidden would not cause immediate authentication failures; users would simply not see the SSID unless they manually entered it. The issue described involves users seeing the SSID but failing authentication, indicating a problem beyond SSID visibility.

Practice this question →

221

MCQhard

Two switches are connected by a trunk. VLAN 50 exists on both switches, but traffic still fails across the link. The allowed VLAN list is correct. Which additional item should be checked next?

A.Check for a trunk mismatch such as native VLAN inconsistency or other trunk-parameter problems.

B.Reset OSPF process IDs on both switches.

C.Add ip helper-address under every access interface.

D.Disable the MAC address table.

AnswerA

A trunk with VLAN 50 allowed on both ends is only a prerequisite for Layer 2 connectivity; native VLAN mismatch or an inconsistent allowed VLAN list can still cause VLAN 50 frames to be tagged with the wrong VLAN ID or dropped entirely. Verifying trunk encapsulation (802.1Q), trunk mode (desirable/trunk), and especially native VLAN consistency is the correct next step because these parameters govern whether frames in VLAN 50 are correctly forwarded across the link.

Why this answer

After confirming that the VLAN exists on both switches and is allowed on the trunk, another important item to verify is whether the trunk itself is actually operational with the expected encapsulation and whether there is a native VLAN or other trunk inconsistency. In plain language, just because the VLAN is listed does not guarantee the trunk is healthy in every relevant way. Trunking problems can still occur because of broader configuration mismatches.

This question is about disciplined troubleshooting. Once the obvious allowed-list issue is ruled out, the next step is to keep checking other trunk-related characteristics rather than jumping immediately to unrelated routing or service features. The correct answer is the one that stays grounded in trunk-specific verification.

Exam trap

Don't jump to unrelated issues like spanning tree or IP configuration when the problem is clearly trunk-related.

Why the other options are wrong

Resetting OSPF process IDs does not address VLAN traffic issues over a trunk link, as OSPF is a routing protocol and unrelated to Layer 2 VLAN configurations.

Adding an ip helper-address is irrelevant to VLAN traffic issues across a trunk link, as this command is used for forwarding DHCP requests, not for resolving VLAN connectivity problems.

Disabling the MAC address table would not resolve VLAN traffic issues across a trunk link, as it pertains to Layer 2 forwarding and would disrupt normal switch operations, leading to further connectivity problems.

Practice this question →

222

MCQhard

A network administrator is troubleshooting an issue where hosts on VLAN 10 cannot ping the default gateway at 192.168.10.1. The router (R1) has an SVI for VLAN 10 with IP 192.168.10.1/24. The administrator captures traffic on the router's G0/0/0 interface (trunk to the switch) and reviews the embedded packet capture output. What is the root cause of the problem?

A.The router's SVI for VLAN 10 is administratively down.

B.The switch port connecting the host is configured in the wrong VLAN (e.g., VLAN 20 instead of VLAN 10).

C.An inbound ACL on the router's SVI is blocking ICMP echo requests from the host.

D.The router has ICMP redirects enabled, causing it to ignore the pings.

AnswerB

The router is sending ARP requests, but the host never receives them because the switch port is in a different VLAN. This prevents the router from learning the host's MAC address, causing the ping to fail.

Why this answer

The captured traffic on the trunk shows that the router is not receiving any frames tagged with VLAN 10 from the host. If the switch port connecting the host is configured in VLAN 20 instead of VLAN 10, the host's frames will be tagged with VLAN 20 (or remain untagged in the access VLAN 20) and will not reach the router's SVI for VLAN 10, causing the ping to fail. This is the most direct cause given the symptom that the host cannot ping the default gateway.

Exam trap

Cisco often tests the distinction between Layer 2 and Layer 3 issues, and the trap here is that candidates assume the problem is on the router (e.g., ACL or interface state) when the packet capture reveals that the traffic never reaches the router's SVI due to a VLAN mismatch on the switch access port.

Why the other options are wrong

The SVI is operational, so this cannot be the root cause.

The router receives the ICMP requests, so an inbound ACL would have dropped them before they reached the capture buffer.

ICMP redirects do not prevent the router from responding to pings; they only send redirect messages when appropriate.

Practice this question →

223

PBQhard

You are connected to Multilayer Switch SW1. Configure LACP EtherChannel between SW1 and SW2 using ports GigabitEthernet0/1 and GigabitEthernet0/2. Ensure the channel is formed and active. The current configuration has mismatched VLAN assignments and speed/duplex settings preventing the channel from coming up. Verify the channel state using 'show etherchannel summary'.

Network Topology

Hints

•Check that both physical ports have identical speed and duplex settings.
•Ensure the allowed VLAN list on each member port matches the Port-channel interface.
•Use 'show etherchannel summary' to see if ports are in a suspended (D) or bundled (P) state.

A.Configure both Gi0/1 and Gi0/2 with speed 1000, duplex full, and switchport trunk allowed vlan 10,20,30.

B.Configure both Gi0/1 and Gi0/2 with speed 100, duplex half, and switchport trunk allowed vlan 30.

C.Configure both Gi0/1 and Gi0/2 with speed 1000, duplex full, and switchport trunk allowed vlan 10,20.

D.Configure both Gi0/1 and Gi0/2 with speed 1000, duplex full, and switchport mode access.

AnswerA

solution

! SW1
interface GigabitEthernet0/1
switchport trunk allowed vlan 10,20,30
exit
interface GigabitEthernet0/2
speed 1000
duplex full
switchport trunk allowed vlan 10,20,30
exit

Why this answer

The EtherChannel is down because the two member ports on SW1 have inconsistent configurations. GigabitEthernet0/1 is set to speed 1000 and duplex full with allowed VLANs 10,20, while GigabitEthernet0/2 is set to speed 100 and duplex half with allowed VLAN 30. LACP requires all member ports to have identical speed, duplex, and VLAN allowed lists.

To fix, on SW1 configure both Gi0/1 and Gi0/2 with the same speed (1000), duplex (full), and trunk allowed VLANs (10,20,30). The Port-channel interface already has the correct allowed VLANs. After correction, 'show etherchannel summary' should show both ports as bundled (P).

Exam trap

The exam trap is that candidates often focus only on speed/duplex mismatches and forget that VLAN allowed lists must also match. Additionally, they may assume that the Port-channel interface inherits settings from member ports, but in fact, the member ports must match the Port-channel configuration.

Why the other options are wrong

The specific factual error is that LACP requires all member ports to have identical configurations, and this option does not align with the existing Port-channel configuration.

The specific factual error is that the VLAN allowed list must match across all member ports and the Port-channel interface; omitting VLAN 30 will cause inconsistency.

The specific factual error is that LACP requires consistent switchport mode (access or trunk) across all member ports and the Port-channel interface.

Practice this question →

224

MCQeasy

A junior administrator at a branch office connects a new Cisco IP phone to switch port FastEthernet0/12. The phone must receive power from the switch, and a PC will later be daisy-chained to the phone's PC port. The switch must also ensure the voice traffic is carried in VLAN 50 while data traffic stays in VLAN 10. Which configuration on the interface accomplishes these requirements?

A.switchport mode access, switchport access vlan 50, switchport voice vlan 10, and power inline auto

B.switchport mode access, switchport access vlan 10, switchport voice vlan 50, and power inline auto

C.switchport mode trunk, switchport trunk native vlan 10, switchport trunk allowed vlan 50, and power inline never

D.switchport mode dynamic auto, switchport access vlan 10, switchport voice vlan 50, and power inline auto

AnswerB

This configuration places the port in access mode for data in VLAN 10, tags voice frames with VLAN 50 using the voice VLAN command, and enables PoE delivery to the phone with power inline auto. The phone receives power and both voice and data traffic are properly segmented, which is the standard Cisco IP telephony deployment on a switch access port.

Why this answer

An access port with a data VLAN and a separate voice VLAN is the standard way to connect a Cisco IP phone that also provides a PC port. Enabling power inline auto supplies PoE so the phone powers up, and the voice VLAN command causes the phone to tag its voice frames into VLAN 50 while the attached PC remains in VLAN 10.

Exam trap

The trap here is assuming a trunk is required to carry both voice and data, when a single access port with the voice vlan command already separates the two traffic types.

Practice this question →

225

MCQhard

A user reports that the corporate SSID is visible and accepts the correct password, but the client always lands in a quarantined remediation network. Which troubleshooting area is strongest?

A.Post-authentication policy, role, or VLAN assignment logic

B.Whether the SSID is hidden instead of broadcast

C.Whether the AP uplink uses PPP encapsulation

D.Whether OSPF designated routers are elected correctly

AnswerA

This symptom occurs after the client has successfully authenticated, meaning the fault lies in how the AP or controller authorizes the session. Post-authentication policies, role assignments, or VLAN selection determine which network segment and access level the client receives. If that logic misapplies, the client can have valid credentials yet be placed in the wrong VLAN or denied services, exactly matching the described behavior.

Why this answer

The strongest troubleshooting area is post-authentication policy or role assignment. The client already sees the SSID and successfully authenticates, so the problem is not RF visibility or password failure. Landing in a remediation network indicates a policy decision after authentication, such as a mismatched VLAN assignment or client role.

Option B (hidden SSID) is irrelevant because the SSID is visible. Option C (PPP encapsulation) does not affect post-authentication network placement. Option D (OSPF DR election) is unrelated to client VLAN assignment.

Exam trap

Don't confuse initial connectivity problems with post-authentication issues. Focus on what happens after the connection is established.

Why the other options are wrong

A hidden SSID would prevent the SSID from appearing, but the user reports the SSID is visible, so this does not match the symptom.

PPP encapsulation on an AP uplink concerns Layer 2 framing, not the post-authentication VLAN or policy assignment that causes quarantine.

OSPF designated router election occurs at Layer 3 within routing, while the issue is about client VLAN placement after authentication, which is a Layer 2 access-control function.

Practice this question →