CCNA Switching Questions — Page 4 of 4

226

Matchingmedium

Match each trunking or switchport term to its most accurate description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

A switch link that can carry multiple VLANs

A switchport that normally belongs to one VLAN for endpoint traffic

The VLAN associated with untagged traffic on an 802.1Q trunk

The setting that restricts which VLANs a trunk may carry

Why these pairings

These terms define how switchports handle VLAN traffic in trunking environments.

Exam trap

Candidates often confuse terms like 'access port' and 'trunk port' or mistake protocols (802.1Q) and properties (native VLAN) for port types. Focus on the function: trunk ports carry multiple VLANs; access ports carry one; 802.1Q is the tagging method; native VLAN is the untagged VLAN on a trunk.

Practice this question →

227

MCQhard

Refer to the exhibit. A network administrator connects an IP phone to interface GigabitEthernet1/0/1 on a Cisco Catalyst switch. The PC connected through the phone works normally on the data VLAN, but the phone cannot obtain an IP address and fails to register with the call server. Which action will resolve the problem?

A.Configure 'switchport trunk allowed vlan 10,20' on interface Gi1/0/1 and change the switchport mode to trunk.

B.Add 'switchport voice vlan 20' on interface GigabitEthernet1/0/1.

C.Issue 'switchport access vlan 20' and 'switchport voice vlan 10' on interface Gi1/0/1.

D.Enable 'switchport port-security mac-address sticky' on the interface and manually add the phone’s MAC address to the access VLAN.

AnswerB

The 'switchport voice vlan 20' command is the correct Cisco IOS configuration for a voice-enabled access port. It leaves VLAN 10 as the default access VLAN for PC data (untagged) while defining VLAN 20 as the voice VLAN for the IP phone. The phone discovers VLAN 20 via CDP or LLDP and tags its voice frames with 802.1Q, keeping voice and data in separate Layer 2 domains and subnets.

Why this answer

The PC works on the data VLAN, but the phone cannot obtain an IP address, indicating the phone is not receiving the correct VLAN assignment. The phone should be placed in the voice VLAN (VLAN 20) using the 'switchport voice vlan 20' command, which allows the switch to tag the phone's traffic with VLAN 20 via CDP/LLDP, enabling it to get an IP from the voice VLAN DHCP server.

Exam trap

Cisco often tests the distinction between 'switchport access vlan' (for data) and 'switchport voice vlan' (for voice), and the trap here is that candidates may confuse which VLAN is assigned to which device, or incorrectly think trunking is required for a phone connection.

Why the other options are wrong

A trunk port does not provide the voice VLAN advertisement mechanism to the phone; the PC would need to send tagged frames, which typical endpoint NICs do not do.

The phone requires access to VLAN 20 for voice services, and the PC must remain in VLAN 10 for data; this configuration does the opposite, failing to meet the requirement.

The phone still cannot learn the voice VLAN; port security does not provide a DHCP address or make the switch advertise VLAN 20 to the phone.

Practice this question →

228

MCQhard

A network engineer notices that an uplink port on a distribution switch has moved to a root-inconsistent state and is blocking traffic. The port is configured with Root Guard and is connected to a new access switch. The new access switch has a lower bridge priority than the current root bridge. What is the most likely cause?

A.BPDU Guard has errdisabled the port because a BPDU was received on an access port.

B.BPDU Filter is blocking inbound BPDUs, causing the switch to fail to detect the topology change and isolate the port.

C.Root Guard has placed the port into root-inconsistent state because the new switch advertised a superior BPDU.

D.Loop Guard has detected a unidirectional link and placed the port in a blocking state to prevent a loop.

AnswerC

Root Guard is designed to prevent the port from becoming a root port. Upon receiving a superior BPDU (lower bridge ID), it places the port in root-inconsistent state, effectively blocking traffic. This directly matches the symptom described.

Why this answer

Root Guard is configured on the uplink port of the distribution switch. When the new access switch advertises a superior BPDU (lower bridge priority than the current root bridge), Root Guard places the port into a root-inconsistent state to prevent the distribution switch from accepting the new switch as the root bridge. This blocks traffic on that port to protect the spanning-tree topology.

Exam trap

Cisco often tests the distinction between Root Guard and BPDU Guard, where candidates confuse the root-inconsistent state with an errdisable state or assume any BPDU-related protection will errdisable the port.

Why the other options are wrong

Candidates mistakenly equate BPDU Guard with any BPDU-induced blocking, but the state 'root-inconsistent' is specific to Root Guard.

Candidates may think that filtering BPDUs leads to port isolation, but BPDU Filter would not trigger a protective state like root-inconsistent.

Candidates often confuse Loop Guard and Root Guard because both can cause inconsistent states, but Loop Guard triggers loop-inconsistent, not root-inconsistent, and is triggered by BPDU loss, not receipt of superior BPDUs.

Practice this question →

229

MCQmedium

A PC connected to switch port Gi0/10 should be in VLAN 20 but receives broadcasts only from VLAN 1. Which switchport setting is most likely wrong?

A.switchport mode trunk

B.switchport access vlan 20 missing or incorrect

C.speed 1000

D.duplex full

AnswerB

The access VLAN assignment on a switchport determines which untagged (native) VLAN the port belongs to. If a PC on interface Gi0/10 should be in VLAN 20 but is not, the most direct cause is that the port is either left in the default VLAN (often VLAN 1) or configured with a different access VLAN via the 'switchport access vlan' command. Without this correct mapping, the PC's frames are forwarded in the wrong broadcast domain and cannot reach VLAN 20 resources. This is the primary configuration that controls the behavior described.

Why this answer

The PC is receiving broadcasts only from VLAN 1, which indicates the switchport is not correctly assigned to VLAN 20. The most likely cause is that the 'switchport access vlan 20' command is missing or incorrect, leaving the port in its default VLAN (VLAN 1). This prevents the PC from participating in VLAN 20 and receiving its broadcasts.

Exam trap

Cisco often tests the misconception that a trunk port is needed for VLAN membership, but for a single end device, an access port with the correct VLAN assignment is required.

Why the other options are wrong

The switchport mode trunk setting is incorrect because a trunk port allows multiple VLANs to pass, while the question indicates that the PC should only receive broadcasts from VLAN 20. Therefore, the issue lies with the access VLAN configuration.

The speed setting of 1000 Mbps (1 Gbps) does not influence VLAN membership or broadcast traffic; it only affects the data transfer rate. Therefore, this option does not address the issue of the PC receiving broadcasts only from VLAN 1.

The duplex setting of the switch port does not influence VLAN membership or broadcast traffic. Therefore, a duplex configuration of 'full' does not affect the ability of a PC to receive broadcasts from VLAN 20.

Practice this question →

230

MCQhard

After connecting a new switch to interface GigabitEthernet1/0/1 on a distribution switch, a network engineer notices that the interface is in err-disable state. The engineer checks the configuration and finds that spanning-tree portfast and spanning-tree bpduguard enable are applied to the interface. What is the most likely cause of the err-disable state?

A.BPDU Guard was incorrectly enabled on a port that should be a trunk link.

B.The connected switch is sending BPDUs with a lower bridge priority.

C.Spanning-tree PortFast is enabled on a port that connects to another switch.

D.The port is configured as an access port, but should be a trunk.

AnswerC

PortFast skips the listening and learning STP states and is designed for end hosts. When combined with BPDU Guard, the switch was instructed to disable the port upon receiving any BPDU. The downstream switch naturally sends BPDUs, causing BPDU Guard to react and place the port in err-disable. Removing PortFast (and leaving BPDU Guard alone, or disabling BPDU Guard on that link) would resolve the issue.

Why this answer

PortFast is designed for end-host ports that should not receive BPDUs. When PortFast is enabled on a port connecting to another switch, the switch will immediately transition the port to forwarding state, but if it then receives a BPDU from the connected switch, BPDU Guard will error-disable the port. This is the most common cause of err-disable state when both PortFast and BPDU Guard are configured on an inter-switch link.

Exam trap

Cisco often tests the misconception that BPDU Guard alone causes err-disable, but the trap here is that PortFast must be enabled for BPDU Guard to trigger err-disable on a port receiving BPDUs from another switch.

Why the other options are wrong

Candidates often associate BPDU Guard exclusively with access ports and assume configuring it on a trunk is itself a misconfiguration, overlooking that PortFast is the real culprit.

Students may confuse root bridge placement with BPDU Guard operation, thinking that a BPDU from a superior switch might cause a port to be disabled, when in fact BPDU Guard is content-agnostic.

Candidates may think that because a link between switches should be a trunk, the access mode misconfiguration is the root cause. However, they miss the fact that BPDU Guard acts on the BPDU regardless of the port mode, and the real misconfiguration is PortFast.

Practice this question →

231

MCQmedium

A switch displays this output: Port Name Status Vlan Fa0/1 connected 10 Fa0/2 connected 10 Fa0/24 connected trunk Which port should be checked first if a user in VLAN 20 cannot reach the distribution switch over the uplink?

A.Fa0/1

B.Fa0/2

C.Fa0/24

D.Any access port in VLAN 1

AnswerC

Fa0/24 is the only port configured as a trunk, which is necessary for carrying traffic from multiple VLANs, including VLAN 20, to the distribution switch over the uplink. When a user in VLAN 20 cannot reach the distribution switch, this trunk port represents the primary path for inter-VLAN communication upstream. Investigating its configuration for allowed VLANs or potential physical layer issues is the logical first step to diagnose the connectivity problem for VLAN 20.

Why this answer

If users in VLAN 20 must cross the uplink, the trunk port is the first place to verify allowed VLANs and tagging.

Exam trap

Don't confuse access ports with trunk ports; only trunk ports can carry multiple VLANs.

Why the other options are wrong

Fa0/1 is connected to VLAN 10, and since the user in VLAN 20 cannot reach the distribution switch, checking this port would not address the issue, as it is not part of the user's VLAN.

Fa0/2 is connected to VLAN 10, which means it cannot facilitate communication for a user in VLAN 20. The issue lies with the trunk port, which is responsible for carrying multiple VLANs, including VLAN 20.

Option D is incorrect because it suggests checking any access port in VLAN 1, which is not relevant to the user's issue in VLAN 20. The problem lies with the trunk port not allowing VLAN 20 traffic, not with access ports in VLAN 1.

Practice this question →

232

MCQhard

A switch trunk is carrying several VLANs, but VLAN 99 traffic is failing. The trunk allowed list includes VLAN 99 on both sides. Which statement best explains why a VLAN can still fail even when it is allowed?

A.Because the VLAN may still be absent, inactive, or otherwise not operational locally even if it is allowed on the trunk

B.Because allowing a VLAN on a trunk automatically disables it

C.Because VLANs can cross trunks only when PAT is enabled

D.Because VLAN 99 must always be the native VLAN

AnswerA

An entry in the trunk's allowed VLAN list only authorizes 802.1Q frames for that VLAN to pass; it does not create or activate the VLAN. If VLAN 99 is absent from the local VLAN database, is administratively shutdown with the 'shutdown vlan' command, or has no active member ports or up SVI, it is not operational locally. Therefore, even though the trunk configuration permits VLAN 99, end-to-end connectivity will fail because the VLAN is not functioning on the switch itself.

Why this answer

A VLAN can still fail across a trunk even when it is allowed because the allowed list is only one part of the overall design. In plain language, a switch may permit the VLAN on the link, but if the VLAN does not actually exist locally, is not active, or if some other trunk characteristic is inconsistent, traffic can still fail. This is an important CCNA troubleshooting principle: one correct line of configuration does not guarantee the full end-to-end condition is correct.

Candidates often stop at the allowed VLAN list because it is visible in common show commands. However, VLAN presence, local status, and other trunk parameters still matter. The best answer is the one recognizing that permission on the trunk does not automatically prove the entire VLAN path is healthy.

Exam trap

A common exam trap is assuming that simply including VLAN 99 in the trunk allowed list guarantees that VLAN 99 traffic will pass. Many candidates stop troubleshooting once they see the VLAN is allowed on the trunk, neglecting to verify if VLAN 99 is actually created and active on each switch. This mistake leads to incorrect conclusions, as the allowed list only controls trunk forwarding permissions, not VLAN existence or operational status.

The exam tests your understanding that VLAN configuration and status are equally critical for successful VLAN traffic flow.

Why the other options are wrong

Incorrect. Allowing a VLAN on a trunk does not disable it; this option contradicts how VLANs and trunks operate in Cisco switches.

Incorrect. Port Address Translation (PAT) is unrelated to VLAN trunking. VLANs do not require PAT to cross trunks.

Incorrect. VLAN 99 does not have to be the native VLAN to function on a trunk. The native VLAN is independent of VLAN allowance and operation.

Practice this question →

233

PBQhard

You are connected to SW1. The network has three switches (SW1, SW2, SW3) running Rapid-PVST+. SW1 should be the root bridge for VLAN 10. PortFast and BPDU Guard must be enabled on all edge ports connected to end hosts. An err-disabled port (G0/1) has occurred due to a BPDU violation on an edge port. Recover the port and ensure it is configured correctly to prevent recurrence.

Network Topology

Hints

•The port is in err-disabled state. You need to manually recover it by cycling the interface.
•After recovery, verify the port is forwarding and still has PortFast and BPDU Guard enabled.
•If the err-disabled condition recurs, the connected device may be sending BPDUs; consider removing BPDU Guard from that port if it is not truly an edge port.

A.Enter interface configuration mode for Gi0/1, issue 'shutdown' followed by 'no shutdown', then configure 'spanning-tree bpduguard disable' on the interface.

B.Enter interface configuration mode for Gi0/1, issue 'shutdown' followed by 'no shutdown', then configure 'spanning-tree portfast' and 'spanning-tree bpduguard enable' on the interface.

C.Enter interface configuration mode for Gi0/1, issue 'shutdown' followed by 'no shutdown', then configure 'spanning-tree guard root' on the interface.

D.Enter interface configuration mode for Gi0/1, issue 'shutdown' followed by 'no shutdown', then verify that the connected device is not a switch or remove it from the network.

AnswerD

solution

! SW1
configure terminal
interface gigabitEthernet 0/1
shutdown
no shutdown
end

Why this answer

The port Gi0/1 is in err-disabled state because BPDU Guard disabled it after receiving a BPDU on a PortFast edge port. First, shut down the interface and then re-enable it with 'no shutdown' to recover from err-disabled. However, to prevent recurrence, the root cause must be addressed: the connected device (likely another switch) should not be sending BPDUs on an edge port.

Optionally, you can disable BPDU Guard on that specific port if it is not truly an edge port, but the task requires PortFast and BPDU Guard on edge ports. The correct fix is to ensure no BPDUs are sent from the downstream device or use 'spanning-tree bpduguard disable' on that port if it is not an edge port (but the task mandates BPDU Guard). Since the scenario requires BPDU Guard, the candidate should recover the port and then verify that the connected device is not a switch (or remove it from the topology).

Exam trap

The exam trap is that candidates may focus on recovering the port (shutdown/no shutdown) but forget to address why the BPDU was received. Simply re-enabling BPDU Guard or reapplying PortFast will not prevent recurrence. The key is to ensure the connected device is not sending BPDUs, either by removing it or reclassifying the port.

Why the other options are wrong

The specific factual error is that BPDU Guard should not be disabled on a port that is supposed to be an edge port with BPDU Guard enabled.

The specific factual error is that simply re-enabling the same features does not prevent recurrence; the source of BPDUs must be removed or the port must be reconfigured as a non-edge port.

The specific factual error is that Root Guard and BPDU Guard serve different purposes; Root Guard does not stop BPDU Guard from disabling the port.

Practice this question →

234

Drag & Dropmedium

Drag and drop the following steps into the correct order to interpret packet capture output for L2/L3 troubleshooting.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

6Step 6

Why this order

The logical troubleshooting sequence for packet capture analysis starts at Layer 2 to verify the data link layer. First, examine the source and destination MAC addresses in the Ethernet header to confirm correct frame delivery. Next, check for ARP requests and responses to ensure proper IP-to-MAC resolution.

Then, analyze the source and destination IP addresses to verify Layer 3 addressing and routing. After that, look for ICMP Destination Unreachable or Time Exceeded messages to identify network path issues. Proceed to inspect transport layer port numbers (TCP/UDP) to identify the service and possible blocking.

Finally, review TCP flags (e.g., SYN, RST, FIN) to understand session state and detect retransmissions or connection issues.

Practice this question →

235

MCQhard

A switch port connected to a user PC is configured as a trunk. The PC cannot communicate normally. What is the best explanation?

A.The port role is wrong because a normal PC-facing switchport should usually be an access port, not a trunk

B.A user PC requires EtherChannel to function

C.Trunk mode disables MAC address learning automatically

D.Trunk mode forces the switch to stop using IP addressing

AnswerA

A normal PC expects to receive and send untagged Ethernet frames in a single VLAN, so the switchport facing it should be an access port assigned to one access VLAN. Configuring it as a trunk makes the switch tag frames with 802.1Q headers, which the PC's NIC typically cannot process, breaking connectivity. Thus the port role is the primary misconfiguration.

Why this answer

The best explanation is that the port role is wrong: a PC-facing port should be an access port, not a trunk, because PCs normally send untagged frames and cannot process VLAN tags. Option B is incorrect because EtherChannel is used for link aggregation, not required for a single PC. Option C is wrong because trunk mode does not disable MAC address learning.

Option D is irrelevant, as switches do not stop using IP addressing in trunk mode.

Exam trap

Be careful not to confuse physical link issues with logical configuration mismatches. A trunk port on a user PC is a logical mismatch, not a hardware failure.

Why the other options are wrong

A user PC does not require EtherChannel to function; EtherChannel is a method for bundling multiple physical links into a single logical link, which is not necessary for standard PC connectivity.

Trunk mode does not disable MAC address learning; it actually allows the switch to learn MAC addresses from multiple VLANs. Therefore, a switch port configured as a trunk can still learn MAC addresses normally.

Trunk mode does not disable IP addressing; it allows multiple VLANs to be carried over a single link, and IP addressing is still applicable to the switch interfaces. Therefore, the user PC's inability to communicate is not due to trunk mode disabling IP addressing.

Practice this question →

236

PBQhard

You are connected to SW1 via the console. The network has three switches connected in a triangle: SW1 (G0/1 to SW2 G0/1), SW1 (G0/2 to SW3 G0/1), and SW2 (G0/2 to SW3 G0/2). SW1 is the root bridge. A PC is connected to SW3's G0/3 port, which should be an edge port. However, the PC has been sending BPDUs, causing the port to go err-disabled. Configure SW3 to prevent this in the future: enable PortFast and BPDU Guard on G0/3. Then, verify that the port recovers from err-disabled state and that a specific blocked port on SW2 is identified. Use the provided show output to determine the current state and necessary commands.

Network Topology

Hints

•The err-disabled port must be manually recovered with shutdown/no shutdown.
•PortFast is configured at the interface level.
•BPDU Guard is also configured at the interface level using 'spanning-tree bpduguard enable'.

A.interface g0/3 spanning-tree portfast spanning-tree bpduguard enable shutdown no shutdown

B.interface g0/3 spanning-tree portfast spanning-tree bpduguard enable no shutdown

C.interface g0/3 spanning-tree portfast spanning-tree bpduguard enable end copy running-config startup-config

D.interface g0/3 spanning-tree portfast spanning-tree bpduguard enable shutdown

AnswerA

solution

! SW3
interface GigabitEthernet0/3
spanning-tree portfast
spanning-tree bpduguard enable
shutdown
no shutdown

Why this answer

The PC connected to SW3's G0/3 was sending BPDUs, causing the port to go err-disabled due to BPDU Guard. To prevent this, enable PortFast and BPDU Guard on that interface. First, move to interface configuration mode for G0/3, then issue 'spanning-tree portfast' and 'spanning-tree bpduguard enable'.

After configuration, the port will remain err-disabled until manually recovered by issuing 'shutdown' followed by 'no shutdown'. The blocked port on SW2 is G0/2, as shown by the 'Altn BLK' role/status in its spanning-tree output.

Exam trap

A common trap is forgetting that err-disabled ports require a manual shutdown/no shutdown cycle to recover. Simply enabling BPDU Guard or saving the configuration does not restore the port. Always remember to reset the interface after correcting the cause.

Why the other options are wrong

The err-disabled state requires a manual interface reset (shutdown followed by no shutdown) to recover; a single 'no shutdown' command is insufficient.

Saving the configuration preserves the settings but does not affect the current operational state of the interface; the port stays err-disabled.

The shutdown command disables the interface but does not automatically re-enable it; the err-disabled state is cleared only after a shutdown/no shutdown cycle.

Practice this question →

237

MCQmedium

A controller-based WLAN is deployed across multiple floors. Users can associate to the SSID on both floors, but their experience improves when moving between APs compared with a poorly designed standalone deployment. Which wireless concept is most closely related to that client movement experience?

A.Roaming between access points

B.NetFlow export

C.DHCP snooping

D.Route summarization

AnswerA

In a controller-based WLAN spanning multiple floors, the primary user-centric issue is client mobility. When a wireless client moves from one AP's coverage to another, the controller coordinates the handoff, maintaining the client's session and IP address. This is known as roaming, and controller-based architectures support fast, secure roaming via protocols like 802.11r. Therefore, this is the correct answer.

Why this answer

The concept most closely related is roaming between access points. In practical terms, client mobility experience depends on how smoothly a device can move from one AP coverage area to another while staying on the WLAN. Controller-based designs often help manage this more consistently than fragmented independent configurations.

The key point is that the question is about movement between APs while remaining on the wireless network, not about VLAN trunks or routing protocol neighbors.

Exam trap

Be careful not to confuse network performance improvements like channel bonding with client mobility improvements like roaming.

Why the other options are wrong

NetFlow export is related to network traffic analysis and monitoring, not directly to client movement or experience between access points in a WLAN. It does not address the seamless connectivity aspect of roaming.

DHCP snooping is a security feature that helps prevent unauthorized DHCP servers from distributing IP addresses on a network. It does not directly relate to the user experience of roaming between access points in a WLAN deployment.

Route summarization is a technique used in routing protocols to reduce the size of routing tables by aggregating multiple routes into a single route. It does not pertain to client movement or wireless connectivity between access points.

Practice this question →

238

MCQeasy

Which VLAN is used by default for most switch ports on a new Cisco switch?

A.VLAN 1

B.VLAN 99

C.VLAN 1002

D.No VLAN until the port is manually assigned

AnswerA

On a new Cisco switch, every port is automatically placed in VLAN 1, which is the factory-default VLAN and cannot be deleted or renamed. This default assignment applies to both access and trunk ports, and VLAN 1 also serves as the default native VLAN. Therefore, VLAN 1 is the correct answer for the default switch port VLAN.

Why this answer

On a default Cisco switch, access ports belong to VLAN 1 until changed. Best practice is usually to move user ports away from VLAN 1, but the default is still VLAN 1.

Exam trap

Remember that VLAN 1 is the default VLAN on Cisco switches, despite being discouraged for use in production environments.

Why the other options are wrong

VLAN 99 is not the default VLAN for switch ports on a new Cisco switch; the default is VLAN 1. VLAN 99 is often used in specific configurations but is not the factory default setting.

VLAN 1002 is a reserved VLAN for Token Ring and FDDI, and it is not the default VLAN for switch ports on a new Cisco switch. Most switch ports default to VLAN 1 unless configured otherwise.

This option is incorrect because, by default, Cisco switches assign all ports to VLAN 1, not leaving them unassigned. Every port is part of VLAN 1 unless configured otherwise.

Practice this question →

239

MCQhard

A switch port connected to a workstation is configured with sticky MAC learning and a maximum secure MAC count of 1. What is the main operational benefit of sticky learning in this case?

A.It dynamically learns a secure MAC address and can preserve it if the configuration is saved.

B.It disables the maximum secure MAC limit on the interface.

C.It automatically saves the running configuration to the startup configuration after learning the MAC address.

D.It prevents the port from ever generating a security violation.

AnswerA

Sticky port-security dynamically learns the MAC address of the connected workstation and converts it into a secure MAC address entry in the running configuration. If the configuration is saved to startup-config, the learned address persists across reboots, preventing the need to relearn it. This behavior is characteristic of sticky learning, which combines dynamic learning with static persistence.

Why this answer

Sticky learning gives the convenience of dynamic discovery while still treating the learned address as a secure port-security entry. In practical terms, the switch can observe the first legitimate MAC address on the port and record it as a secure address without the administrator having to type that address manually. If the running configuration is later saved, that sticky entry can persist after a reload.

This is useful because it balances ease of deployment with access control. The maximum secure MAC count still matters, and port security is still active. Sticky learning does not replace port security; it works within it.

Exam trap

Be careful not to confuse sticky learning with allowing multiple MAC addresses or automatic removal of unauthorized addresses.

Why the other options are wrong

Option B is incorrect because sticky MAC learning does not disable the maximum secure MAC limit; it simply allows the switch to learn and retain the MAC address within that limit. The maximum secure MAC count remains enforced regardless of sticky learning.

Sticky learning does not automatically save the running configuration; it only adds the learned MAC to the running configuration, which must be explicitly saved to the startup configuration to persist across reboots.

This option is incorrect because sticky MAC learning does not prevent security violations; it only allows the learned MAC address to be retained across reboots if saved. A security violation can still occur if an unauthorized MAC address is detected on the port.

Practice this question →

240

Multi-Selectmedium

Which TWO commands are required to configure a switch port to support both a desktop PC and a VoIP phone using voice VLAN?

Select 2 answers

A.switchport mode access

B.switchport mode trunk

C.switchport voice vlan <vlan-id>

D.switchport access vlan <vlan-id>

E.switchport port-security maximum 1

AnswersA, C

This command configures the port as an access port, which is required for connecting a desktop PC and a VoIP phone (the phone typically uses the access port for data and a separate voice VLAN).

Why this answer

'switchport mode access,' is required because voice VLAN only operates on an access port. Option C, 'switchport voice vlan <vlan-id>,' is the command that actually assigns the voice VLAN ID. Option B is incorrect because a trunk port would not properly separate voice and data traffic as the phone expects an access port.

Option D is a common data VLAN configuration but is not strictly necessary for voice VLAN operation; the access VLAN can be left as the default or configured separately. Option E is wrong because 'switchport port-security maximum 1' would allow only a single MAC address, while the port must support two devices (the phone and the PC), second MAC being the phone's internal switch.

Exam trap

Candidates often mistakenly include 'switchport access vlan' as one of the two required commands, but the question specifically asks for voice VLAN configuration, not the full port setup.

Why the other options are wrong

Trunk mode is incompatible because the phone expects an access port, and the voice VLAN is tagged internally by the phone, not by switch port trunking.

Configuring an access VLAN is not mandatory for voice VLAN; the question targets only the commands unique to enabling the voice feature.

Limiting the port to one MAC address would block the PC's MAC, breaking dual-device support provided by the phone's internal switch.

Practice this question →

241

MCQeasy

Which wireless design objective is achieved by using nonoverlapping channels in adjacent cells?

A.It increases PoE budget for the access points

B.It reduces interference between nearby APs

C.It removes the need for authentication

D.It forces all clients to use 5 GHz only

AnswerB

Careful channel planning assigns non-overlapping channels (e.g., 1, 6, 11 in 2.4 GHz) to neighboring access points, preventing co-channel and adjacent-channel overlap. Because each AP transmits on a different frequency in a given area, packet collisions and retransmissions are minimized, which reduces interference and improves aggregate throughput.

Why this answer

Using nonoverlapping channels minimizes interference between adjacent APs, improving wireless performance in dense environments. Option A is wrong because nonoverlapping channels have no effect on PoE budget, which is determined by the switch and cable specifications. Option C is wrong because authentication mechanisms operate independently of channel assignment and are still required.

Option D is wrong because nonoverlapping channels are used in both the 2.4 GHz and 5 GHz bands, and they do not mandate client use of a specific frequency.

Exam trap

Avoid confusing interference reduction with bandwidth or range improvements.

Why the other options are wrong

This option is incorrect because using nonoverlapping channels does not impact the Power over Ethernet (PoE) budget for access points; PoE budget is determined by the power supply and the devices connected, not by channel selection.

This option is incorrect because using nonoverlapping channels does not eliminate the need for authentication in wireless networks; authentication is a separate security measure that ensures only authorized users can connect.

This option is wrong because using nonoverlapping channels does not force clients to operate exclusively on the 5 GHz band; it simply allows for better channel management to reduce interference. Clients can still connect on both 2.4 GHz and 5 GHz bands based on their capabilities and network configuration.

Practice this question →

242

PBQhard

You are connected to SW1. The current configurations of interfaces GigabitEthernet0/1 and GigabitEthernet0/2 are as follows: Gi0/1: speed 100, duplex half, switchport access vlan 10 Gi0/2: speed 1000, duplex full, switchport access vlan 20 The port-channel interface 1 does not exist. Configure a LACP EtherChannel between SW1 and SW2 using these two interfaces, with port-channel 1 and mode active on both sides. Ensure the channel forms by resolving any speed/duplex or VLAN mismatches. After configuration, verify with 'show etherchannel summary'.

Network Topology

Hints

•Check speed and duplex consistency between member interfaces.
•All member interfaces must be in the same VLAN.
•The port-channel interface VLAN must match the physical interfaces.

A.The EtherChannel will not form because the physical interfaces have mismatched speed/duplex and VLAN assignments. You must configure both interfaces with the same speed (1000), duplex (full), and access VLAN (10), then apply channel-group 1 mode active on each.

B.The EtherChannel will form successfully because LACP active mode negotiates the channel regardless of speed/duplex or VLAN differences.

C.The EtherChannel will not form because the port-channel interface must be configured with the same VLAN as the physical interfaces, but the physical interfaces can have different speeds.

D.The EtherChannel will form successfully because the port-channel interface inherits the VLAN from the first physical interface added, so no additional configuration is needed.

AnswerA

solution

! SW1
interface GigabitEthernet0/1
speed 1000
duplex full
switchport access vlan 10
channel-group 1 mode active
interface GigabitEthernet0/2
speed 1000
duplex full
switchport access vlan 10
channel-group 1 mode active
interface Port-channel1
switchport access vlan 10

Why this answer

The EtherChannel fails because member interfaces have mismatched speed/duplex (Gi0/1 is 100/half, Gi0/2 is 1000/full) and different VLANs (VLAN 10 vs 20). Additionally, the port-channel interface and physical interfaces must have matching VLAN assignments. To fix, unify both physical interfaces to the same speed (1000), duplex (full), and access VLAN (10).

Then set channel-group mode active on each physical interface. Finally, ensure the port-channel interface also uses VLAN 10. Verify with 'show etherchannel summary' which should show the port-channel as SU (in use).

Exam trap

Cisco exam traps often test the requirement for identical speed, duplex, and VLAN on all EtherChannel member interfaces. Do not assume LACP can negotiate mismatches; it only handles aggregation, not physical or VLAN parameters.

Why the other options are wrong

LACP active mode only enables negotiation, but it does not resolve underlying parameter mismatches. The interfaces must still have consistent speed, duplex, and VLAN configuration.

All member interfaces must have identical speed and duplex settings. Even if VLANs match, speed mismatch will cause the channel to fail.

The port-channel interface is a logical interface that requires its own VLAN configuration. Physical interfaces must have identical VLAN assignments; otherwise, the channel will not form.

Practice this question →

243

Drag & Dropmedium

Drag and drop the following steps into the correct order to capture and analyze traffic for L2/L3 troubleshooting.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

6Step 6

7Step 7

Why this order

The steps follow the logical sequence of a packet capture: first identify the traffic source, then configure a SPAN session to mirror it, connect the capture device, start capture, reproduce the issue, stop capture, and finally analyze the output. Each step must be completed before the next can succeed.

Practice this question →

244

PBQhard

You are connected to a multilayer switch MLSW1. PortFast and BPDU Guard have already been enabled on interface GigabitEthernet0/1, which connects to an end device, and a BPDU received on that interface placed it in the err-disabled state. Configure Rapid PVST+ so that MLSW1 becomes the root bridge for VLAN 10 with a priority of 4096. Recover the interface by re-enabling it. Finally, verify which port is blocking on VLAN 10 by connecting to MLSW2 and executing the appropriate show command.

Network Topology

Hints

•Check the current root priority and adjust with 'spanning-tree vlan <vlan> priority <value>'.
•An err-disabled interface can be recovered by administrative shutdown and no shutdown.
•Look at the spanning-tree topology to find which port is blocking; it will be in 'ALT' role with 'BLK' state.

A.spanning-tree vlan 10 priority 4096; interface GigabitEthernet0/1; shutdown; no shutdown; show spanning-tree vlan 10

B.spanning-tree vlan 10 root primary; interface GigabitEthernet0/1; no shutdown; show spanning-tree vlan 10

C.spanning-tree vlan 10 priority 4096; interface GigabitEthernet0/1; no shutdown; show interfaces status

D.spanning-tree vlan 10 priority 4096; interface GigabitEthernet0/1; shutdown; no shutdown; show running-config

AnswerA

solution

! MLSW1
spanning-tree vlan 10 priority 4096
interface gigabitEthernet 0/1
shutdown
no shutdown

Why this answer

The correct solution sets the spanning-tree priority for VLAN 10 to 4096 on MLSW1, ensuring it becomes the root bridge. PortFast and BPDU Guard are already configured on G0/1, which caused the interface to go err-disabled when a BPDU was received. To recover, you must issue the 'shutdown' followed by 'no shutdown' commands on the interface.

Because MLSW1 is the root bridge, it has no blocking ports; the blocking port (alternate) will be seen on a downstream switch like MLSW2. Therefore, verification must be done on MLSW2 using 'show spanning-tree vlan 10' to view the alternate blocking port. Option A correctly includes all required steps.

Option B uses 'root primary' (priority 24576) instead of the specified 4096, lacks the recovery commands, and verifies on the wrong device. Option C omits the err-disabled recovery and uses the wrong verification command. Option D also verifies with 'show running-config', which does not display STP port roles.

Exam trap

Remember that 'spanning-tree vlan <vlan> root primary' sets priority to 24576, not a custom value. Also, err-disabled recovery requires a shutdown followed by no shutdown. Always use 'show spanning-tree vlan <vlan>' to verify port roles, not 'show interfaces status' or 'show running-config'.

Why the other options are wrong

The specific factual error: 'root primary' sets priority to 24576, not 4096. Also, err-disabled recovery requires a shutdown followed by no shutdown.

The specific factual error: err-disabled recovery requires a shutdown before no shutdown. 'show interfaces status' does not display STP port roles.

The specific factual error: 'show running-config' does not display STP port roles or blocking status.

Practice this question →

245

PBQmedium

You are connected to SW1 via console. SW1 is a multilayer switch with SVIs for VLAN 10 (192.168.10.1/24) and VLAN 20 (192.168.20.1/24). Hosts in VLAN 10 and VLAN 20 need to communicate with each other. Currently, inter-VLAN routing is not working. You need to enable routing on SW1 and verify that the SVIs are operational.

Network Topology

Hints

•Check if 'ip routing' is already enabled.
•Verify that the SVIs are up with 'no shutdown'.

A.Enable IP routing using the 'ip routing' global configuration command.

B.Configure a routing protocol such as OSPF or EIGRP on the SVIs.

C.Assign IP addresses to the physical interfaces connected to the hosts.

D.Create a trunk port and connect a router to perform router-on-a-stick.

AnswerA

solution

! SW1
ip routing

Why this answer

The 'ip routing' command enables Layer 3 routing on the multilayer switch, allowing SVIs to route between VLAN 10 and VLAN 20. Option B is unnecessary because directly connected SVIs do not require a routing protocol; routing protocols are only needed for routes learned from other routers, and 'ip routing' must still be enabled. Option C would require converting the physical interfaces to routed ports, which would break the existing Layer 2 VLAN topology and is not the intended solution.

Option D provides an external router-on-a-stick solution but does not enable routing on SW1 itself, which is the required task. Therefore, only option A correctly enables inter-VLAN routing on SW1.

Exam trap

The trap is that many candidates assume SVIs automatically route traffic once they have IP addresses. However, on a multilayer switch, you must explicitly enable IP routing with the 'ip routing' command. Without it, the switch remains a Layer 2 device and SVIs only serve as management interfaces.

Why the other options are wrong

Routing protocols like OSPF or EIGRP are not required for directly connected SVIs; only 'ip routing' is needed to enable Layer 3 routing.

Assigning IP addresses to physical interfaces would convert them to routed ports, breaking the existing Layer 2 VLAN configuration and is not the correct approach.

Using an external router with router-on-a-stick would enable inter-VLAN routing but does not enable routing on SW1 as required.

246

MCQhard

Refer to the exhibit. A network engineer notices that on a four-link EtherChannel bundle between two switches, all traffic from a particular VLAN is being forwarded over only one physical link, while the other three links remain idle. The engineer suspects a load-balancing issue and issues the show etherchannel load-balance command, the output of which is shown. What is the most likely cause of the uneven traffic distribution?

A.The switch is using source‑MAC‑address load balancing, and multiple end hosts are appearing with the same source MAC address.

B.The EtherChannel is misconfigured with an LACP active/passive mode mismatch, forcing only one link to bundle.

C.VLAN pruning on the trunk has removed the VLAN from three of the four member interfaces.

D.Spanning Tree Protocol has blocked three of the four links in the EtherChannel because they form a loop.

AnswerA

The show etherchannel load-balance output confirms the global load‑balancing method is src‑mac. With this method, frames with an identical source MAC always hash to the same physical member link, causing all traffic from hosts sharing that MAC to use only one link.

Why this answer

The output of 'show etherchannel load-balance' indicates the switch is using source-MAC-address load balancing. With this method, all frames from a given source MAC address are hashed to the same physical link. If multiple end hosts in the VLAN are actually behind a single upstream router or firewall that uses the same source MAC address for all traffic (e.g., due to proxy ARP or NAT), then all traffic from that VLAN will be pinned to one link, leaving the other three idle.

Exam trap

Cisco often tests the misconception that load-balancing issues are caused by misconfiguration or STP, when the real problem is the hash algorithm's behavior with a single dominant source MAC address.

Why the other options are wrong

Candidates may think that an LACP problem explains a single active link, but a mismatch would cause the entire EtherChannel to fail, not selectively use one member.

Candidates might mistake an idle member for a pruned VLAN, but pruning would not affect all traffic, only the specific VLAN, and it is not related to the load‑balance method shown.

Candidates may associate an idle link with STP blocking, but an EtherChannel bundle presents one logical link to STP. A blocking state on some members only would indicate a serious configuration error, not the load‑balance method shown.

Practice this question →

247

MCQhard

A switchport connected to another switch is configured as an access port by mistake. Which symptom is most likely in a multi-VLAN design?

A.Only one VLAN is likely to pass correctly, while other VLAN traffic across the link fails

B.The link negotiates as a trunk but drops all VLAN traffic

C.The switch generates excessive broadcasts on all VLANs

D.The switch stops learning MAC addresses entirely

AnswerA

An access port is configured to carry exactly one untagged VLAN, known as the access VLAN. When connected to another switch, that link will only pass traffic belonging to the access VLAN; frames from other VLANs that arrive expecting trunk tagging will be dropped or misclassified. This causes a failure for all other VLANs across that link, because the access port does not support 802.1Q trunking or multi-VLAN tagging.

Why this answer

The most likely symptom is that only one VLAN’s traffic works correctly across the link while traffic for other VLANs fails. In plain language, an access port belongs to one VLAN in normal switching behavior. If an inter-switch link that should carry multiple VLANs is accidentally configured as an access port, the network loses the ability to transport the other VLANs.

The physical link may stay up, which can make the problem seem subtle, but the logical role of the port is wrong.

Exam trap

Be cautious not to confuse physical link status with logical configuration issues. An access port will not drop the link but will restrict traffic to a single VLAN.

Why the other options are wrong

An access port cannot negotiate trunking; it simply forwards only one VLAN's traffic.

Broadcast storms are not caused by an access port misconfiguration.

Practice this question →

248

Multi-Selectmedium

Which TWO statements are true about configuring and verifying VLANs, 802.1Q trunking, native VLAN, and inter-VLAN routing with router-on-a-stick?

Select 2 answers

A.On a router-on-a-stick configuration, each subinterface must be configured with an IP address and the encapsulation dot1Q command to specify the VLAN ID.

B.The native VLAN is always tagged on an 802.1Q trunk link.

C.The command switchport trunk native vlan 10 is used to restrict which VLANs are allowed on a trunk.

D.When configuring a router-on-a-stick, the native VLAN must match on both the switch and the router subinterface to avoid miscommunication.

E.The command show interfaces trunk displays the IP addresses configured on router subinterfaces.

AnswersA, D

In router-on-a-stick, a single physical router interface is divided into logical subinterfaces, each dedicated to a distinct VLAN. For every subinterface, you must assign an IP address that falls within the VLAN's subnet and issue the `encapsulation dot1Q <vlan-id>` command so the router tags outgoing frames and recognizes incoming tagged frames for that VLAN. Without this encapsulation, the router cannot distinguish which VLAN a frame belongs to, breaking inter-VLAN routing.

Why this answer

In a router-on-a-stick configuration, each subinterface must be assigned an IP address and use the encapsulation dot1Q command to associate it with a specific VLAN ID; this enables the router to process tagged frames from multiple VLANs over a single physical link. Option D is also correct because the native VLAN configured on the switchport trunk must match the native VLAN used on the router's subinterface (or physical interface if no subinterface); a mismatch causes the router to mishandle untagged frames because it expects them to belong to the configured native VLAN, leading to communication failures. Option B is wrong because on an 802.1Q trunk, the native VLAN frames are sent untagged, not tagged.

Option C is wrong because the command 'switchport trunk native vlan 10' only changes the native VLAN; it does not restrict which VLANs are allowed—that requires 'switchport trunk allowed vlan'. Option E is wrong because 'show interfaces trunk' shows trunking status, native VLAN, and allowed VLAN lists on switch ports, not IP addresses of router subinterfaces.

Exam trap

Cisco often tests the misconception that the native VLAN is tagged on a trunk, or that the switchport trunk native vlan command controls allowed VLANs, when in fact it only changes which VLAN is untagged.

Why the other options are wrong

The native VLAN is sent untagged to maintain backward compatibility with devices that do not understand 802.1Q tagging.

The command to restrict allowed VLANs is switchport trunk allowed vlan, not the native VLAN command.

To see IP addresses on subinterfaces, use show ip interface brief or show running-config on the router.

Practice this question →

249

MCQhard

A user joins the employee SSID successfully and can browse internal resources, but VoIP over Wi-Fi calls fail only while roaming between floors. Which troubleshooting area is the strongest first focus?

A.Roaming behavior and RF transition quality between AP coverage areas

B.Whether the SSID name is spelled correctly

C.Whether the branch router has PPP enabled

D.Whether the user has a static default route on the phone

AnswerA

The correct focus is roaming behavior and RF transition quality because the symptom is specifically triggered when the user moves between AP coverage areas, such as crossing floor boundaries. Even if the user associates and browses successfully in one location, poor overlap between AP cells, incorrect 802.11r fast transition settings, or sticky client behavior can cause the device to hold onto a weak signal and fail to reassociate to a stronger AP, leading to a loss of connectivity and inability to browse during movement.

Why this answer

The strongest first focus is roaming and RF transition behavior between AP coverage areas. In practical terms, the user already proved that general WLAN access and internal reachability are working. The failure happens during movement and affects a time-sensitive application. That points to mobility-related behavior rather than basic SSID visibility or simple IP addressing.

This is a realistic wireless troubleshooting item because it narrows the fault domain from the symptom pattern instead of restarting from the basics.

Exam trap

Avoid assuming basic connectivity issues when the problem is specific to roaming and affects a time-sensitive application.

Why the other options are wrong

This option is wrong because the spelling of the SSID does not affect the ability to roam between access points; the user is already connected to the SSID and can access internal resources.

This option is wrong because PPP (Point-to-Point Protocol) is not directly related to VoIP performance or roaming issues; it primarily pertains to WAN connections rather than local Wi-Fi network transitions.

This option is wrong because the issue described pertains to roaming and VoIP call quality, which is unrelated to static routing configurations on the user's phone. A static default route would not directly impact the ability to maintain VoIP calls while transitioning between access points.

Practice this question →

250

MCQmedium

Why is PortFast typically enabled on switch ports connected to end devices?

A.To let end-device ports reach forwarding state more quickly

B.To make access ports participate in OSPF

C.To convert all access ports into trunks

D.To disable Ethernet addressing on PCs

AnswerA

PortFast on switch ports connected to end devices (like PCs, printers, servers) allows the port to transition directly from blocking to forwarding state, bypassing the listening and learning states of Spanning Tree Protocol (STP). This is crucial because STP normally takes 30 seconds (or 50 seconds in older implementations) to converge, which can cause delays in DHCP or bootp requests. Since end devices are typically not a loop, PortFast safely accelerates this process, enabling immediate connectivity.

Why this answer

PortFast is enabled so access ports connected to end devices can move to forwarding more quickly instead of waiting through the normal spanning-tree listening and learning transitions. In plain language, it helps a user’s PC, printer, or similar endpoint start communicating sooner after the link comes up. That can reduce delays at startup and prevent certain device timeout problems.

PortFast is not intended as a loop-prevention mechanism by itself, and it should not normally be used carelessly on links to other switches. That is why it is commonly paired with BPDU Guard on edge ports. The correct answer is the one focused on faster transition for end-device access links rather than on unrelated routing or VLAN functions.

Exam trap

Do not confuse PortFast with disabling spanning-tree or improving routing; it specifically speeds up access port transitions.

Why the other options are wrong

This option is incorrect because PortFast does not enable access ports to participate in OSPF; OSPF is a routing protocol that requires Layer 3 interfaces, while PortFast is a feature for Layer 2 switch ports.

This option is wrong because PortFast does not convert access ports into trunk ports; it is designed to bypass the Spanning Tree Protocol (STP) listening and learning states to allow end devices to connect more quickly.

Disabling Ethernet addressing on PCs is not related to the function of PortFast, which is designed to expedite the transition of switch ports to the forwarding state. PortFast does not alter how Ethernet addressing operates on connected devices.

Practice this question →

251

MCQhard

A network administrator connects an IP phone to interface Gi0/1 and a PC to the phone's PC port. Users report that the phone cannot register with the call manager and the PC does not obtain an IP address. The administrator verifies the configuration shown in the exhibit. What is the most likely cause of the problem?

A.The switchport mode should be changed to trunk to allow tagged voice traffic.

B.The voice VLAN is not configured on the interface.

C.The spanning-tree portfast command is blocking the port from forwarding.

D.The access VLAN 10 is incorrect for the data subnet.

AnswerB

In a typical IP phone deployment, the access port must be configured with both an access VLAN for the PC and a separate voice VLAN for the phone. The exhibit shows only `switchport access vlan 10` but lacks `switchport voice vlan`, so the switch cannot identify tagged voice frames from the phone, and the phone fails to obtain an IP address or register. Adding the voice VLAN command instructs the switch to accept 802.1Q-tagged traffic from the phone while keeping PC data untagged on the access VLAN, which resolves the registration failure.

Why this answer

The voice VLAN is not configured on the interface. For an IP phone to communicate with the call manager, the switchport must be configured with a voice VLAN (e.g., 'switchport voice vlan 20') to separate voice traffic from data traffic. Without this command, the phone cannot tag its frames with the appropriate VLAN ID, preventing registration.

Additionally, the PC connected to the phone's PC port relies on the phone to pass untagged data traffic, but without the voice VLAN, the phone may not properly negotiate or forward traffic, causing the PC to fail to obtain an IP address.

Exam trap

Cisco often tests the distinction between access VLAN and voice VLAN, and the trap here is that candidates assume the access VLAN alone is sufficient for both voice and data, overlooking the mandatory 'switchport voice vlan' command required for IP phone operation.

Why the other options are wrong

Cisco best practice for IP phone + PC is an access port with switchport voice vlan, not trunk mode. Trunk mode is more complex and can cause VLAN hopping if misconfigured.

Portfast enables faster convergence, not a blocking action. A blocked port would show no link or constant amber LED, not intermittent connectivity.

Even if VLAN 10 were wrong, the phone’s registration issue would persist because the voice VLAN is still missing. The problem has two symptoms; the voice VLAN omission explains both.

Practice this question →

252

Drag & Dropmedium

Drag and drop the following steps into the correct order to capture and analyze traffic on IOS-XE using the embedded packet capture feature, and in Wireshark to isolate a Layer 2 or Layer 3 fault.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

First define the capture interface, then apply a filter, start capture, stop it, and finally export for analysis in Wireshark.

Exam trap

A common trap is confusing the order of steps, especially applying the filter before defining the interface or starting the capture before applying the filter. Remember that the interface must be defined first, then the filter, then start, then stop, then export.

Practice this question →

253

MCQhard

A switch port connected to an IP phone and a PC should separate voice traffic from data traffic while still using one physical edge connection. Which feature best supports that design?

AnswerA

A voice VLAN is the correct solution because it enables a single access port to carry both IP phone traffic and PC data while keeping them logically distinct. The Cisco IP phone tags its signaling and media frames with the 802.1Q voice VLAN ID, whereas the PC's untagged frames remain in the data VLAN, allowing the switch to apply separate QoS and security policies for each traffic type.

Why this answer

A voice VLAN best supports that design. In practical terms, a Cisco-style voice VLAN allows the switch to carry voice traffic separately from user data even though the phone and PC share the same physical access connection. This is a common enterprise edge design because it lets the phone use one VLAN while the downstream PC uses another.

The key point is separation of traffic types over one edge port, not trunking between switches or link aggregation.

Exam trap

Avoid confusing the purpose of trunk ports and link aggregation with traffic separation on a single edge port.

Why the other options are wrong

EtherChannel is used to aggregate multiple physical links into a single logical link for increased bandwidth and redundancy, but it does not inherently separate voice and data traffic on a single port. It does not address the requirement of managing different traffic types on the same physical connection.

The Native VLAN is used for untagged traffic on a trunk link and does not separate voice and data traffic effectively; it simply allows untagged frames to pass through without any differentiation.

Loop guard is designed to prevent loops in a switched network by blocking ports that receive unexpected BPDUs. It does not facilitate the separation of voice and data traffic on a single physical connection, which is the requirement of the question.

Practice this question →

254

Drag & Dropmedium

Drag and drop the following steps into the correct order to capture and analyze traffic on IOS-XE using the embedded packet capture feature, and in Wireshark to isolate a Layer 2 or Layer 3 fault.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

For IOS‑XE embedded packet capture, the correct order is: 1) Access privileged EXEC mode (required for all monitor commands), 2) Create a capture buffer, 3) Associate a capture point, 4) Start the capture, 5) Stop the capture, 6) Export the capture, 7) Analyze in Wireshark. Options B, C, and D each violate the required sequence: B starts buffer creation before entering privileged mode, C associates the point before creating the buffer, and D omits the critical 'start' step entirely.

Exam trap

A common mistake is to forget the 'start the capture' step, making the exported file empty; always remember to issue 'monitor capture point start' after association.

Practice this question →

255

MCQmedium

An administrator configures an EtherChannel between SW1 and SW2. The port-channel interfaces are physically up, but the EtherChannel bundle fails to come up. On SW1, the channel-group is set to mode active; on SW2, it is set to mode on. What is the most likely cause?

A.The switch priority values are mismatched

B.One side is using LACP active while the other side is set to on

C.The native VLAN must be VLAN 1 for EtherChannel to form

D.Gi1/0/2 cannot be bundled because interfaces must be in different VLANs

AnswerB

The EtherChannel fails because LACP active mode actively sends LACPDUs to negotiate a bundle, but the opposite side configured with mode on is a static EtherChannel that performs no dynamic negotiation. Since mode on ignores LACP advertisements, the negotiation handshake never completes, leaving both links in their default non-bundled state. To form the bundle, both sides must use either LACP active/passive or both be set to the same static on mode.

Why this answer

EtherChannel requires compatible modes: LACP active mode sends negotiation packets, while 'on' mode disables all negotiation, so the two sides cannot agree and the bundle stays down. Option A is wrong because switch priority values are used in STP root election, not EtherChannel formation. Option C is wrong because the native VLAN does not need to be VLAN 1; it only needs to match on both ends.

Option D is wrong because all member interfaces in an EtherChannel must be in the same VLAN, not different ones.

Exam trap

Ensure both sides of an EtherChannel are set to compatible modes; 'on' mode does not participate in LACP negotiation.

Why the other options are wrong

Switch priority values affect STP root bridge election, not EtherChannel formation. EtherChannel negotiation depends on the channel-group mode (LACP, PAgP, or on), not on switch priority.

EtherChannel does not require native VLAN to be VLAN 1; it can form with any native VLAN as long as both sides match. The issue here is the LACP mode mismatch (active vs. on), not the native VLAN.

EtherChannel does not require interfaces to be in different VLANs; in fact, all interfaces in a bundle must belong to the same VLAN or be configured as trunk ports with the same allowed VLAN list. Option D is incorrect because bundling interfaces in different VLANs would cause a mismatch.

Practice this question →

256

MCQhard

Two switches are connected by a trunk. VLAN 50 exists on both switches, but hosts in VLAN 50 cannot communicate across the link. All other VLANs work. Based on the exhibit, what is the most likely cause?

A.VLAN 50 is not allowed on the trunk from SwitchA.

B.The native VLAN is mismatched.

C.802.1Q cannot carry VLAN 50.

D.VLAN 50 must be configured as the native VLAN first.

AnswerA

On a Cisco trunk, the 'switchport trunk allowed vlan' list on SwitchA determines which VLANs may traverse the link. Even though VLAN 50 is defined on both switches, if SwitchA's trunk interface does not explicitly include VLAN 50 in its allowed list, the switch will not forward VLAN 50 frames across the trunk. You must add VLAN 50 to the allowed list with 'switchport trunk allowed vlan add 50' on SwitchA's trunk port to restore connectivity.

Why this answer

VLAN 50 is missing from the allowed VLAN list on the trunk, which blocks only that VLAN while allowing others. Option B is incorrect: a native VLAN mismatch would affect the native VLAN (usually VLAN 1) or cause STP issues, not specifically VLAN 50. Option C is incorrect: 802.1Q encapsulation supports all VLANs from 1 to 4094, including VLAN 50.

Option D is incorrect: VLANs do not need to be the native VLAN to be transported over a trunk; any VLAN can traverse a trunk if it is allowed.

Exam trap

Ensure you differentiate between general trunk issues and VLAN-specific configurations. Don't confuse access port settings with trunk link issues.

Why the other options are wrong

This option is wrong because a native VLAN mismatch would typically affect all VLANs, not just VLAN 50. Since other VLANs are functioning correctly, it indicates that the native VLAN configuration is not the issue.

802.1Q is a standard that can carry VLANs up to 4096, including VLAN 50. Therefore, the issue of VLAN 50 not communicating is not due to the protocol's inability to carry it.

This option is wrong because VLAN 50 can exist on a trunk without being the native VLAN; it does not need to be configured as such to communicate across the trunk link.

Practice this question →

257

PBQmedium

You are connected to SW1 via the console. SW1 is a Layer 2 switch connected to router R1 via trunk port G0/1. The trunk is currently using VLAN 1 as native VLAN, but the network administrator wants to change the native VLAN to VLAN 99 for security. Configure the trunk on G0/1 to use native VLAN 99 and verify.

Hints

•The native VLAN is configured per trunk interface.
•Use show interfaces trunk to see allowed VLANs and native VLAN.

A.SW1(config)# interface g0/1 SW1(config-if)# switchport trunk native vlan 99 SW1(config-if)# end SW1# show interfaces trunk

B.SW1(config)# interface g0/1 SW1(config-if)# switchport trunk allowed vlan 99 SW1(config-if)# end SW1# show vlan brief

C.SW1(config)# vlan 99 SW1(config-vlan)# name Native SW1(config-vlan)# exit SW1(config)# interface g0/1 SW1(config-if)# switchport mode trunk SW1(config-if)# switchport trunk native vlan 99 SW1(config-if)# end SW1# show interfaces trunk

D.SW1(config)# interface g0/1 SW1(config-if)# switchport trunk native vlan 99 SW1(config-if)# end SW1# show vlan id 99

AnswerA

solution

! SW1
interface GigabitEthernet0/1
switchport trunk native vlan 99

Why this answer

Changing the native VLAN on a trunk prevents VLAN hopping attacks. The native VLAN carries untagged traffic; here it is changed from default VLAN 1 to VLAN 99.

Exam trap

The exam trap is confusing the 'switchport trunk native vlan' command with 'switchport trunk allowed vlan' or thinking that you need to create the VLAN or re-enter trunk mode. Also, ensure you use the correct verification command: 'show interfaces trunk' shows native VLAN, not 'show vlan'.

Why the other options are wrong

The specific factual error is confusing the allowed VLAN list with the native VLAN configuration. The native VLAN is set with 'switchport trunk native vlan', not 'switchport trunk allowed vlan'.

The specific factual error is including extra steps that are not needed. The trunk already exists, so 'switchport mode trunk' is redundant. Creating VLAN 99 is also unnecessary if it already exists or is not required for the native VLAN change.

The specific factual error is using the wrong verification command. 'show interfaces trunk' is needed to see trunk parameters including native VLAN.

258

PBQhard

You are connected to R1, a multilayer switch acting as the STP root for VLAN 10. Configure Root Guard on port GigabitEthernet0/1 (designated port) to protect against superior BPDUs from an unauthorized switch, Loop Guard on uplink GigabitEthernet0/2 to prevent forwarding loops on unidirectional links, and BPDU Guard on PortFast-enabled GigabitEthernet0/3 to shut down the port if a BPDU is received. After configuration, troubleshoot the scenario: a superior BPDU is received on G0/1, causing it to be blocked by Root Guard, and an unauthorized switch sends a BPDU to G0/3, placing it in err-disable state. Verify the final configuration and state.

Network Topology

Hints

•Root Guard is configured with 'spanning-tree guard root' on the interface that should never become a non-designated port. It will block the port if a superior BPDU is received.
•Loop Guard is enabled with 'spanning-tree guard loop' on interfaces where BPDU loss could cause a loop. It prevents the port from transitioning to forwarding if BPDUs stop.
•BPDU Guard is configured with 'spanning-tree bpduguard enable' on PortFast ports. Any BPDU received will error-disable the port, requiring manual recovery with 'shutdown' followed by 'no shutdown'.

A.[CORRECT] Root Guard on G0/1 is correctly configured; when a superior BPDU is received, the port is placed into a root-inconsistent state (BKN* in show spanning-tree) to prevent the switch from becoming root. Loop Guard on G0/2 prevents loops if BPDUs stop arriving due to a unidirectional link. BPDU Guard on G0/3, combined with PortFast, err-disables the port upon receiving any BPDU, as shown by the err-disabled status. To recover, the administrator must manually re-enable the interface after removing the offending device. No additional configuration is required; the existing commands are correct and produce the expected behavior.

B.Root Guard on G0/1 is incorrectly configured; it should be configured on the root port, not the designated port. Loop Guard on G0/2 is correctly configured. BPDU Guard on G0/3 is correctly configured, but the port should automatically recover from err-disable state after a timeout.

C.Root Guard on G0/1 is correctly configured. Loop Guard on G0/2 is incorrectly configured because Loop Guard should be applied to root ports, not uplink ports. BPDU Guard on G0/3 is correctly configured, but the port should be in a blocking state, not err-disabled.

D.Root Guard on G0/1 is correctly configured. Loop Guard on G0/2 is correctly configured. BPDU Guard on G0/3 is incorrectly configured because BPDU Guard should be applied to trunk ports, not access ports, and the port should be placed in a root-inconsistent state.

AnswerA

solution

! R1
interface GigabitEthernet0/1
spanning-tree guard root
interface GigabitEthernet0/2
spanning-tree guard loop
interface GigabitEthernet0/3
spanning-tree portfast
spanning-tree bpduguard enable

Why this answer

The scenario demonstrates three STP protection mechanisms. Root Guard on G0/1 is correctly configured; when a superior BPDU is received, the port is placed into a root-inconsistent state (BKN* in show spanning-tree) to prevent the switch from becoming root. Loop Guard on G0/2 prevents loops if BPDUs stop arriving due to a unidirectional link.

BPDU Guard on G0/3, combined with PortFast, err-disables the port upon receiving any BPDU, as shown by the err-disabled status. To recover, the administrator must manually re-enable the interface after removing the offending device. No additional configuration is required; the existing commands are correct and produce the expected behavior.

Exam trap

Watch out for confusion between Root Guard and BPDU Guard states: Root Guard causes root-inconsistent (BKN*), while BPDU Guard causes err-disable. Also, remember Root Guard is for designated ports, not root ports. Loop Guard can be applied to any port expecting BPDUs, not just root ports.

Why the other options are wrong

The specific factual error: Root Guard is applied to designated ports, not root ports. BPDU Guard does not auto-recover by default.

The specific factual error: Loop Guard is not restricted to root ports; it can be used on any port where BPDUs are expected. BPDU Guard results in err-disable, not blocking.

The specific factual error: BPDU Guard is not limited to access ports; it works on any PortFast-enabled port. The state is err-disable, not root-inconsistent.

Practice this question →

259

MCQhard

A host on a guest WLAN can browse the Internet but cannot reach internal corporate resources, while employees on another SSID can. Which statement best explains why that can be a correct design outcome?

A.Because guest and employee WLANs can intentionally have different trust levels and access policies.

B.Because guest WLANs cannot use IP routing at all.

C.Because the guest WLAN is assigned to a different VLAN that uses a different IP subnet, and inter-VLAN routing is inherently disabled for security reasons.

D.Because the guest WLAN uses a different SSID that automatically triggers firewall rules that only permit HTTP/HTTPS traffic.

AnswerA

Guest and employee WLANs are intentionally configured with different trust levels and access policies. A guest WLAN is typically placed in a less-trusted network zone, with ACLs that permit only outbound internet traffic while blocking access to internal corporate resources. This design is a deliberate security choice, not a technical limitation, because the organization wants visitors to have basic connectivity without exposing sensitive assets.

Why this answer

Guest wireless networks are intentionally isolated from corporate resources through separate trust levels and access policies. Option B is incorrect because guest WLANs can use IP routing, but routing policies restrict which destinations are reachable. Option C is incorrect because inter-VLAN routing is not inherently disabled; it is a design choice to restrict routing between VLANs.

Option D is incorrect because SSIDs themselves do not trigger firewall rules; it is the VLAN or group assignment that determines the applied policy.

Exam trap

A frequent exam trap is to interpret guest WLAN isolation as a misconfiguration, rather than an intentional policy enforcement. Candidates may also incorrectly attribute the restriction to technical limitations like routing being inherently disabled or SSIDs triggering firewall rules.

Why the other options are wrong

Guest WLANs can use IP routing; they are just restricted by policy.

Inter-VLAN routing is not inherently disabled; it is a configurable policy.

SSIDs do not automatically trigger firewall rules; the assigned VLAN determines the policy.

Practice this question →

260

PBQhard

You are connected to R1, a Catalyst 3650 multilayer switch running IOS-XE. Configure Root Guard on all designated ports, Loop Guard on uplink interfaces, and BPDU Guard on all PortFast-enabled ports. Troubleshoot the current issue: one port is receiving a superior BPDU and is being blocked by Root Guard, and a different PortFast port has gone err-disabled after BPDU Guard triggered. Verify that Root Guard is active on port Gi1/0/1, Loop Guard is active on Gi1/0/2, and BPDU Guard is enabled on Gi1/0/3.

Network Topology

Hints

•Root Guard should be on the port that is designated, not receiving superior BPDUs.
•Loop Guard should be on the port that is a root port or alternate root port.
•An err-disabled port must be manually recovered with shutdown/no shutdown.

A.Remove Root Guard from Gi1/0/1 and apply it to Gi1/0/2; remove Loop Guard from Gi1/0/2 and apply it to Gi1/0/1; on Gi1/0/3, issue shutdown then no shutdown; verify Root Guard on Gi1/0/2, Loop Guard on Gi1/0/1, BPDU Guard on Gi1/0/3.

B.Remove Root Guard from Gi1/0/1 and apply it to Gi1/0/2; remove Loop Guard from Gi1/0/2 and apply it to Gi1/0/1; on Gi1/0/3, issue no shutdown; verify Root Guard on Gi1/0/2, Loop Guard on Gi1/0/1, BPDU Guard on Gi1/0/3.

C.Remove Root Guard from Gi1/0/1 and apply it to Gi1/0/2; remove Loop Guard from Gi1/0/2 and apply it to Gi1/0/1; on Gi1/0/3, issue shutdown then no shutdown; verify Root Guard on Gi1/0/1, Loop Guard on Gi1/0/2, BPDU Guard on Gi1/0/3.

D.Remove Root Guard from Gi1/0/1 and apply it to Gi1/0/2; remove Loop Guard from Gi1/0/2 and apply it to Gi1/0/1; on Gi1/0/3, issue shutdown then no shutdown; verify Root Guard on Gi1/0/2, Loop Guard on Gi1/0/2, BPDU Guard on Gi1/0/3.

AnswerA

solution

! R1
interface GigabitEthernet1/0/1
no spanning-tree guard root
spanning-tree guard loop
interface GigabitEthernet1/0/2
no spanning-tree guard loop
spanning-tree guard root
interface GigabitEthernet1/0/3
shutdown
no shutdown

Why this answer

The network requires Root Guard on designated ports, Loop Guard on uplink (root/alternate) ports, and BPDU Guard on PortFast ports. Gi1/0/1 is receiving a superior BPDU and being blocked by Root Guard, indicating Root Guard is misapplied to a non-designated port; it should be moved to the designated port Gi1/0/2. Loop Guard belongs on the uplink port Gi1/0/1, not Gi1/0/2, so the configuration is swapped.

The PortFast port Gi1/0/3 experienced a BPDU Guard violation and is err-disabled; recovering it requires a shutdown followed by a no shutdown command, not just no shutdown. Finally, verification must confirm the correct new placement: Root Guard on Gi1/0/2, Loop Guard on Gi1/0/1, and BPDU Guard on Gi1/0/3.

Exam trap

Be careful not to confuse the purpose of Root Guard and Loop Guard. Root Guard is for designated ports, Loop Guard is for root/alternate ports. Also, remember that an err-disabled port requires a shutdown/no shutdown sequence to recover, not just no shutdown.

Why the other options are wrong

Issuing only 'no shutdown' will not recover an interface from the err-disabled state caused by BPDU Guard; it must be administratively shut down first with 'shutdown', then re-enabled with 'no shutdown'.

The verification step checks Root Guard on Gi1/0/1 and Loop Guard on Gi1/0/2, which is the original incorrect configuration before the swap; after the fix, Root Guard should be on Gi1/0/2 and Loop Guard on Gi1/0/1.

The verification step incorrectly states that Loop Guard is active on Gi1/0/2. After swapping the configurations, Loop Guard is now on Gi1/0/1, not Gi1/0/2, so this option validates the wrong port.

Practice this question →

261

Drag & Dropmedium

Drag and drop the following steps into the correct order to configure a switch port for a VoIP phone (voice VLAN + data VLAN), an AP trunk, and a PoE-powered IoT device.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

First create VLANs, then assign data and voice VLANs to the phone port, configure the AP trunk, and lastly enable PoE on the IoT port.

Exam trap

The trap is that candidates may enable PoE too early or configure trunks before VLANs exist. Remember: VLANs must be created first, then assigned to ports, and PoE is typically enabled last.

Practice this question →

262

MCQmedium

A switch shows this output from the "show interfaces trunk" command: Gi0/1 on 802.1q trunking 1 Gi0/2 auto 802.1q not-trunking 1 Which statement is correct?

A.Gi0/1 is an access port in VLAN 1

B.Gi0/1 is trunking, and Gi0/2 is waiting for DTP negotiation

C.Gi0/2 is forced to trunk mode

D.Neither interface can carry tagged traffic

AnswerB

The output shows Gi0/1 with DTP mode 'on' and the operational state 'trunking' with 802.1Q encapsulation, meaning it is actively carrying tagged frames for multiple VLANs. Gi0/2 is in 'auto' mode, a passive DTP setting that neither initiates nor advertises trunking but listens for DTP frames from its neighbor. If the neighbor is set to 'on' or 'desirable', Gi0/2 will successfully negotiate and become a trunk as well; until then, it remains in a waiting/negotiation state.

Why this answer

Gi0/1 is already operating as an 802.1Q trunk. Gi0/2 is in dynamic auto mode, which waits for the other side to actively negotiate trunking.

Exam trap

Beware of confusing 'on' with access mode and misunderstanding dynamic auto's capability to negotiate trunking.

Why the other options are wrong

This option is incorrect because Gi0/1 is configured as a trunk port, not an access port, and it is actively trunking VLANs. Access ports do not participate in VLAN tagging and would not show trunking status.

This option is incorrect because Gi0/2 is set to 'auto' for trunking, meaning it is not forced into trunk mode but is instead waiting for Dynamic Trunking Protocol (DTP) negotiation to determine if it should become a trunk port.

This option is incorrect because Gi0/1 is configured as a trunk port and can carry tagged traffic, while Gi0/2 is in a state waiting for DTP negotiation, which means it can potentially become a trunk port as well.

Practice this question →

263

MCQhard

A network engineer notices that a new switch, SW3, was connected to port GigabitEthernet0/1 on SW1, but the port immediately went into an err-disabled state. The network uses Rapid PVST+ with BPDU Guard enabled globally on all access ports. The engineer checks the logs and sees 'bpduguard error detected' messages. What is the most likely cause of the err-disabled state?

A.The port is configured as an access port, but BPDU Guard should be disabled on all access ports.

B.A BPDU was received on port GigabitEthernet0/1, triggering BPDU Guard.

C.Configure Root Guard on the interface to prevent the err-disabled state.

D.Enable Loop Guard on the interface to prevent the err-disabled state.

AnswerB

BPDU Guard is a security feature that deliberately places a port into an err-disabled state when a BPDU is received on a port where BPDU Guard is enabled, typically on an access port configured with PortFast. The port GigabitEthernet0/1 transitioning to err-disabled indicates that it received an unexpected BPDU, which suggests another switch was connected to that port. By immediately error-disabling the port, BPDU Guard prevents the unauthorized device from participating in spanning tree and disrupting the topology. This explanation directly matches the observed behavior and is the correct root cause.

Why this answer

The err-disabled state is caused by BPDU Guard triggering when a BPDU is received on an access port. Option A is incorrect because BPDU Guard is intentionally enabled on access ports to prevent unauthorized switches from joining the network. Option C is wrong because Root Guard prevents a port from becoming the root, not from receiving BPDUs.

Option D is wrong because Loop Guard prevents loops on blocked ports in case of unidirectional links, not relevant to BPDU reception.

Exam trap

Cisco often tests the confusion between BPDU Guard, Root Guard, and Loop Guard; candidates may incorrectly attribute the err-disable to Root Guard or Loop Guard, but the true cause is receiving a BPDU on a BPDU-Guard-enabled port.

Why the other options are wrong

BPDU Guard is designed to be enabled on access ports to protect against unauthorized switches, so disabling it on all access ports would defeat its purpose.

Root Guard prevents a port from becoming the root bridge, but does not block BPDU reception that causes err-disable with BPDU Guard.

Loop Guard detects and prevents loops on blocked ports due to unidirectional links, not related to the BPDU Guard err-disable mechanism.

Practice this question →

264

MCQmedium

PCs in VLAN 30 on SwitchA cannot reach servers in VLAN 30 on SwitchB. All other VLANs work across the trunk. What is the most likely cause?

A.The native VLAN is mismatched between the switches.

B.VLAN 30 should be configured as the native VLAN on both ends.

C.SwitchB must use ISL instead of 802.1Q.

D.VLAN 30 is not allowed on the trunk from SwitchA.

AnswerD

This is correct because the exhibit explicitly shows that VLAN 30 is absent from the allowed VLAN list on the trunk interface on SwitchA. For 802.1Q trunking, a VLAN must be permitted on both sides of the link; if it is missing from SwitchA's allowed list, that switch will not forward frames for VLAN 30 onto the trunk, breaking connectivity to the servers. The other VLANs are allowed and therefore work, isolating the issue to the missing VLAN 30 entry.

Why this answer

The trunk is up and carrying multiple VLANs, but VLAN 30 is missing from the allowed list on one side. Since SwitchA and SwitchB both need to permit VLAN 30 on the trunk, if SwitchA's allowed VLAN list does not include VLAN 30, traffic for that VLAN cannot cross. Native VLAN mismatch or ISL vs 802.1Q issues would affect all VLANs, not just VLAN 30.

Thus, the most likely cause is that VLAN 30 is not allowed on the trunk from SwitchA.

Exam trap

Be cautious of assuming native VLAN mismatches or protocol issues when the problem is specific to the allowed VLAN list.

Why the other options are wrong

This option is wrong because a native VLAN mismatch would typically affect all VLANs across the trunk, not just VLAN 30. In this scenario, only VLAN 30 is experiencing connectivity issues, indicating a different problem.

This option is wrong because configuring VLAN 30 as the native VLAN does not directly affect the ability of PCs in VLAN 30 on SwitchA to communicate with servers in VLAN 30 on SwitchB, especially if VLAN 30 is already properly configured on both switches.

SwitchB using ISL instead of 802.1Q is not relevant to the connectivity issue between VLAN 30 on SwitchA and SwitchB. The problem is likely due to VLAN 30 not being allowed on the trunk, not the encapsulation method used.

Practice this question →

265

Multi-Selectmedium

Which two statements accurately describe good design thinking for wireless guest access?

Select 2 answers

A.Guest access should normally be isolated from internal corporate resources.

B.Guest access policies should usually reflect lower trust than employee access.

C.Guest WLANs should avoid all security to make access easier.

D.Guest WLANs should automatically use the same permissions as internal employee WLANs.

E.Guest access means the AP no longer needs controller coordination.

AnswersA, B

Guest access should normally be isolated from internal corporate resources because guests are untrusted endpoints. In a proper design, guest traffic is placed in a separate VLAN or VRF, and a firewall or access control list (ACL) restricts it to internet-only connectivity, blocking any reachability to internal subnets, servers, or employee devices. This segmentation prevents compromised or malicious guest devices from pivoting into the corporate network.

Why this answer

Good guest-access design is based on isolation and appropriate policy. In practical terms, guest users should normally be separated from internal corporate resources, and their access should align with the limited purpose of guest connectivity. The goal is not to give them the same trust level as managed internal users.

This is about segmentation and policy, not about disabling the WLAN or eliminating security.

Exam trap

Don't assume guest access should mirror internal access policies; guests should have more restricted access.

Why the other options are wrong

This option is wrong because good design thinking for guest access requires implementing security measures to protect the network and its resources, even for guests. Completely avoiding security compromises the network's integrity and exposes it to potential threats.

This option is wrong because guest WLANs should have distinct permissions to ensure that guests do not have access to sensitive internal resources, which could lead to security breaches.

This option is wrong because guest access typically requires controller coordination to manage policies, monitoring, and security effectively, ensuring that guest traffic is properly segmented and controlled.

Practice this question →

266

Drag & Dropmedium

Drag and drop the following steps into the correct order to configure Root Guard on designated ports, Loop Guard on non-designated ports, and BPDU Guard on PortFast ports, and to recover a port that enters err-disabled due to a BPDU guard violation.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Root Guard on designated, Loop Guard on non-designated, then BPDU Guard on PortFast; recovery requires interface reset after violation.

Exam trap

Candidates often confuse the port roles for Root Guard and Loop Guard, or think that disabling the protection feature will recover an err-disabled port. Remember: Root Guard is for designated ports, Loop Guard for non-designated, and BPDU Guard for PortFast. Err-disabled recovery requires manual reset or global errdisable recovery configuration.

Practice this question →

267

MCQhard

A switchport connected to another switch should carry multiple VLANs, but it was manually configured as an access port. What is the most likely operational result?

A.The link will not carry multiple VLANs as intended because an access port handles one VLAN only.

B.The switch automatically converts the access port into a proper trunk.

C.The port becomes a routed Layer 3 interface.

D.The VLANs are summarized into one prefix automatically.

AnswerA

An access port is configured to carry exactly one untagged VLAN—the port's assigned access VLAN—and it strips or rejects tags on ingress/egress. Therefore, traffic from multiple VLANs cannot traverse this inter-switch link, and frames from VLANs other than the access VLAN are dropped or not forwarded as intended. To support multiple VLANs between switches, the port must be configured as a trunk using switchport mode trunk.

Why this answer

An access port is designed to carry only a single VLAN. If the link is intended to carry multiple VLANs, it must be configured as a trunk. The switch will not automatically convert the port to a trunk (B).

The port remains a Layer 2 access port, not a routed Layer 3 interface (C). VLANs are not automatically summarized into a single prefix (D). The most likely result is that the link will not carry multiple VLANs as intended.

Exam trap

Beware of confusing automatic port mode changes with manual configurations. Access ports do not auto-convert to trunk mode.

Why the other options are wrong

Switches do not automatically convert an access port to a trunk; manual configuration is required.

An access port remains a Layer 2 interface; it does not become a routed Layer 3 interface.

VLANs operate at Layer 2 and are not automatically summarized into a single prefix; that would be a routing function.

Practice this question →

268

MCQhard

A port connected to an end host is configured with PortFast and BPDU Guard. What is the most likely result if a small unmanaged switch is connected and starts sending BPDUs?

A.The port is error-disabled by BPDU Guard.

B.The port automatically becomes the root port.

C.The port is converted into a trunk.

D.The port ignores the BPDU because PortFast disables STP entirely.

AnswerA

BPDU Guard is a PortFast enhancement that places the port into the errdisable state whenever a BPDU is received on an edge port. Since PortFast assumes the port connects to an end host, any incoming BPDU signals a potential bridging loop or switch misconfiguration. The switch immediately shuts down the port to protect the spanning-tree topology, overriding any normal STP processing that might otherwise occur.

Why this answer

The most likely result is that the port is placed into an err-disabled state by BPDU Guard. In practical terms, PortFast tells the switch to treat the interface like an edge port for a normal endpoint, which is why it starts forwarding quickly. BPDU Guard protects that assumption. If the port suddenly receives a spanning-tree BPDU, the switch treats that as a sign that the port is no longer connected to a simple end device.

This combination is common in enterprise access-layer design because it improves user startup time while still protecting the topology. The correct answer is the one that describes the port being shut down automatically when BPDUs appear unexpectedly.

Exam trap

Remember, BPDU Guard disables the port, it doesn't use spanning-tree states like blocking or learning.

Why the other options are wrong

This option is wrong because a port configured with PortFast and BPDU Guard will not automatically become the root port when it receives BPDUs; instead, it will be error-disabled due to BPDU Guard's protection mechanism.

This option is wrong because a port configured with PortFast does not automatically convert to a trunk port when it receives BPDUs; instead, it remains in access mode. BPDU Guard will cause the port to be error-disabled upon receiving BPDUs, preventing any trunking behavior.

This option is wrong because PortFast does not disable Spanning Tree Protocol (STP) entirely; it merely allows the port to transition to the forwarding state immediately without participating in STP calculations. BPDUs are still processed, and BPDU Guard will take action if they are received.

Practice this question →

269

MCQhard

A network engineer notices that Host A in VLAN 10 (10.10.10.50/24) can successfully ping its default gateway 10.10.10.1, but cannot ping the VLAN 20 SVI (10.20.20.1) or any hosts in VLAN 20. The SVIs for both VLAN 10 and VLAN 20 are in an up/up state, and the switch's trunk ports are correctly allowing both VLANs. What is the most likely cause?

A.The ip routing global configuration command is missing.

B.The VLAN 20 SVI is administratively shut down.

C.The trunk between the access switch and the Layer 3 switch is misconfigured as an access port.

D.The default gateway on Host A is configured incorrectly.

AnswerA

The 'ip routing' global configuration command is what enables IPv4 forwarding between VLANs on a multilayer switch. With SVIs created and IP addresses assigned, the switch can answer pings to those addresses for local subnet traffic, but it will not route packets between VLANs unless 'ip routing' is enabled. Since Host A can successfully ping 10.10.10.1 (its own SVI gateway) but fails to reach Host B on VLAN 20, the missing command precisely explains the failure: the switch is essentially acting as a host on each VLAN rather than a router.

Why this answer

Host A can reach its default gateway (10.10.10.1), which is the VLAN 10 SVI, but cannot reach the VLAN 20 SVI (10.20.20.1) or any hosts in VLAN 20. This indicates that Layer 2 connectivity is working (trunk allows both VLANs, SVIs are up/up), but inter-VLAN routing is failing. On a multilayer switch, inter-VLAN routing requires the global command 'ip routing' to enable the switch's IP routing engine; without it, the switch acts as a Layer 2 device only and cannot forward packets between different VLANs.

Exam trap

Cisco often tests the distinction between a switch operating as a Layer 2 device versus a Layer 3 device, and the trap here is that candidates assume SVIs in an up/up state automatically provide inter-VLAN routing, forgetting the mandatory 'ip routing' command.

Why the other options are wrong

Candidates may overlook the explicit mention that the SVIs are up/up, mistakenly thinking a shut SVI could be the problem.

Trunk misconfiguration is a common inter-VLAN issue, but the scenario explicitly says the trunks are working properly, making this answer invalid.

The successful ping to the default gateway proves the gateway is correct. Without 'ip routing', the switch can't forward packets from VLAN 10 to VLAN 20, but it can respond to local VLAN requests.

Practice this question →

270

Drag & Dropmedium

Drag and drop the following steps into the correct order to configure Root Guard on a designated port, Loop Guard on a non-designated port, and BPDU Guard on a PortFast port, along with the recovery steps when a port enters err-disabled state.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

The order follows the logical sequence: enter config mode, then configure each guard feature on its respective port, and finally set the errdisable recovery to automatically re-enable ports after a BPDU Guard violation.

Exam trap

The trap is that candidates may think the order of configuring the guards is arbitrary, but the question explicitly requires a specific sequence. Pay close attention to the order in which features are listed in the stem.

Practice this question →

271

PBQhard

You are connected to R1. The network consists of R1, SW1, and two hosts (Host-A on VLAN 10, Host-B on VLAN 20). SW1 has two access ports (one per VLAN) and a trunk to R1. Configure R1 for router-on-a-stick inter-VLAN routing. The current configuration has a native VLAN mismatch and a missing subinterface for VLAN 20. Fix these issues so that Host-A and Host-B can ping each other.

Hints

•Check if all required subinterfaces are present.
•Examine the native VLAN on the trunk.
•Verify that IP routing is enabled globally.

A.Configure interface G0/0.20 with encapsulation dot1Q 20 and IP address 192.168.20.1 255.255.255.0, set native VLAN to 1 on the trunk, and enable ip routing.

B.Configure interface G0/0.20 with encapsulation dot1Q 20 and IP address 192.168.20.1 255.255.255.0, set native VLAN to 99 on the trunk, and enable ip routing.

C.Configure interface G0/0.20 with encapsulation dot1Q 20 and IP address 192.168.20.1 255.255.255.0, set native VLAN to 1 on the trunk, but do not enable ip routing.

D.Configure interface G0/0.20 with encapsulation dot1Q 20 and IP address 192.168.20.1 255.255.255.0, set native VLAN to 99 on the trunk, and do not enable ip routing.

AnswerA

solution

! R1
configure terminal
interface GigabitEthernet0/0.20
encapsulation dot1Q 20
ip address 192.168.20.1 255.255.255.0
exit
interface GigabitEthernet0/0
no encapsulation dot1Q 99
exit
ip routing
end

Why this answer

The native VLAN mismatch exists: R1 expects native VLAN 99, but SW1 likely uses native VLAN 1 (default). This causes CDP/STP issues but not directly inter-VLAN routing; however, for proper operation, set native VLAN to 1 on R1. Additionally, the subinterface for VLAN 20 is missing, so traffic from VLAN 20 cannot be routed.

Finally, 'ip routing' is disabled, preventing any inter-VLAN routing. Solution: change native VLAN on trunk to 1, create subinterface G0/0.20 with encapsulation dot1Q 20 and IP 192.168.20.1/24, and enable ip routing.

Exam trap

Be careful to identify all issues in the scenario. Candidates often focus only on the missing subinterface and forget to check the native VLAN mismatch and the global 'ip routing' command. Always verify that routing is enabled and that native VLANs match on both ends of the trunk.

Why the other options are wrong

The native VLAN mismatch is not resolved; the switch likely uses native VLAN 1, so R1 should also use 1 or both sides must be configured consistently.

IP routing is disabled by default on Cisco routers; it must be explicitly enabled for the router to perform routing functions.

Two errors: native VLAN mismatch persists and IP routing is disabled, so packets cannot be routed between VLANs.

Practice this question →

272

MCQhard

A network engineer has configured an LACP EtherChannel between Switch1 and Switch2 by assigning interfaces to channel-group 1 with the mode passive on both switches. The engineer issues the show etherchannel summary command on Switch1 and sees the output below. The Port-channel interface remains down. Which action resolves the issue?

A.Configure the switchport mode as trunk on both sides.

B.Change the mode on one switch to active.

C.Verify that the native VLAN matches on both sides of the trunk.

D.Correct the speed and duplex settings on the member ports.

AnswerB

In LACP, passive mode interfaces only respond to received PDUs; they never initiate LACP negotiation. Since both switches are configured with passive mode, no LACP PDUs are exchanged, and the ports remain in a standalone (I) state. Changing one switch to active makes it actively send LACP PDUs, which prompts the passive peer to reply and complete the negotiation, allowing the member ports to bundle into the Port-channel. This directly fixes the root cause of the failure.

Why this answer

When both switches are configured with LACP mode passive, neither switch initiates the negotiation process because passive mode only responds to incoming LACP packets. By changing one side to active mode, that switch will actively send LACP packets, allowing the EtherChannel to form. The Port-channel interface remains down due to this negotiation failure, not because of VLAN or physical mismatch issues.

Exam trap

Cisco often tests the LACP mode interaction by setting both sides to passive, leading candidates to incorrectly focus on trunking, VLAN, or physical layer issues instead of recognizing that LACP requires at least one side to be active.

Why the other options are wrong

The show output indicates Layer 2 mode is already active, and trunking isn’t required for bundling. The issue is LACP protocol negotiation, not interface mode.

The Port-channel would still form even with a native VLAN mismatch; it would not be down (SD) and ports would not be stand-alone (I) solely because of VLAN mismatch.

The flags in the output (I, SD) are not consistent with a speed/duplex problem, and the explicit configuration of passive mode on both sides is the known root cause.

Practice this question →

273

MCQhard

A PC connected to SW1 cannot reach the default gateway. The access port is assigned to VLAN 20, and the switch output shows that VLAN 20 is inactive. What is the most likely cause?

A.Port security has shut down the interface

B.VLAN 20 does not exist or is not active on the switch

C.The port must be converted to a trunk

D.The default gateway must be configured on the physical switch port

AnswerB

VLAN 20 must exist in the switch's VLAN database and be enabled (not shutdown) for the access port to forward frames. The exhibit's output indicates VLAN 20 is inactive, so the switch will not deliver the PC's frames to the default gateway in that VLAN. As a result, the PC cannot reach the gateway even if its IP address and gateway settings are correct.

Why this answer

The port is operationally up, but VLAN 20 is listed as inactive because that VLAN does not exist in the VLAN database. An access port assigned to a missing VLAN will not carry normal user traffic for that VLAN.

Exam trap

Ensure the VLAN is created and active in the VLAN database when troubleshooting connectivity issues.

Why the other options are wrong

This option is wrong because the question specifies that the PC cannot reach the default gateway due to VLAN issues, not because of port security settings. Port security would typically result in the interface being in an error-disabled state, which is not indicated here.

This option is incorrect because converting the port to a trunk would not resolve the issue of the PC not reaching the default gateway if VLAN 20 is not configured or active. The problem lies in the VLAN configuration, not the port type.

This option is incorrect because the default gateway is typically configured on the device (e.g., a router or PC) rather than on the switch port itself. The issue in the question pertains to VLAN configuration, not gateway settings.

Practice this question →

274

PBQmedium

You are connected to SW1, a Layer 2 switch. Port G0/1 connects to a PC in VLAN 10. Management requires that only one MAC address is allowed on this port, and if a violation occurs, the port should shut down and a log message should be generated. Additionally, you need to ensure that the port enables rapidly and does not wait for STP convergence. Currently, the PC has MAC address aaaa.bbbb.cccc.

Network Topology

Hints

•Port security must be enabled first.
•Use the 'mac-address' command to specify the allowed MAC.
•PortFast bypasses STP listening/learning for access ports.

A.switchport port-security; switchport port-security maximum 1; switchport port-security mac-address aaaa.bbbb.cccc; switchport port-security violation shutdown; spanning-tree portfast

B.switchport port-security maximum 1; switchport port-security mac-address aaaa.bbbb.cccc; switchport port-security violation restrict; spanning-tree portfast

C.switchport port-security maximum 1; switchport port-security mac-address aaaa.bbbb.cccc; switchport port-security violation protect; spanning-tree portfast

D.switchport port-security maximum 1; switchport port-security mac-address aaaa.bbbb.cccc; switchport port-security violation shutdown; no spanning-tree portfast

AnswerA

solution

! SW1
interface GigabitEthernet0/1
switchport port-security
switchport port-security maximum 1
switchport port-security mac-address aaaa.bbbb.cccc
switchport port-security violation shutdown
spanning-tree portfast

Why this answer

Port security limits access to a port based on MAC addresses. The correct sequence must first enable port security with the `switchport port-security` command. Then setting maximum to 1 with a specific MAC ensures only that device can connect.

Violation shutdown disables the port if an unauthorized MAC appears. PortFast allows the port to transition to forwarding immediately, which is appropriate for end-user devices. Options B and C use wrong violation modes (restrict or protect) that do not shut the port and may not log.

Option D uses correct violation mode but omits PortFast, causing STP delays.

Exam trap

The key trap is confusing the three port security violation modes: shutdown (disables port + logs), restrict (drops traffic + logs but port stays up), and protect (drops traffic silently, no log). Also, remember that PortFast is needed for immediate forwarding on access ports.

Why the other options are wrong

The specific factual error: 'restrict' does not disable the port; it only filters traffic and logs the violation, but the port remains operational.

The specific factual error: 'protect' silently drops unauthorized traffic without logging or disabling the port.

The specific factual error: PortFast is required to bypass STP convergence; without it, the port will wait for STP to transition, causing delay.

275

MCQhard

After configuring DHCP snooping on VLAN 10 to prevent rogue DHCP servers, all clients in the VLAN stop receiving DHCP offers from the legitimate DHCP server that is connected to port Gi0/1. The administrator verifies the DHCP server is operational and reachable. What should the technician do next?

A.Enable Dynamic ARP Inspection on VLAN 10.

B.Configure interface Gi0/1 as a DHCP snooping trusted port.

C.Add an ip helper-address on the VLAN 10 SVI pointing to the DHCP server.

D.Reconfigure the DHCP server scope to include DHCP Option 82.

AnswerB

DHCP snooping treats all ports as untrusted by default and drops DHCP server messages (OFFER, ACK) that arrive on untrusted ports. The DHCP server is connected to interface Gi0/1, so the switch is currently dropping its valid reply. By configuring Gi0/1 as a DHCP snooping trusted port, the switch will forward DHCP offers and acknowledgments from that port, allowing clients on VLAN 10 to obtain addresses while still protecting against rogue DHCP servers on other ports.

Why this answer

DHCP snooping, by default, treats all ports as untrusted and drops DHCP server messages (OFFER, ACK) received on untrusted ports. Since the legitimate DHCP server is connected to Gi0/1, that port must be explicitly configured as a DHCP snooping trusted port using the 'ip dhcp snooping trust' interface command to allow DHCP server responses to reach clients.

Exam trap

Cisco often tests the default behavior of DHCP snooping where all ports are untrusted, and the trap is that candidates may think the issue is a routing problem (ip helper-address) or a server-side configuration (Option 82) rather than recognizing the need to mark the server-facing port as trusted.

Why the other options are wrong

Misunderstanding that DAI controls DHCP traffic rather than ARP packets.

Assuming DHCP snooping introduces routing changes or that the server is on a different subnet.

Confusing DHCP snooping with DHCP relay agent functionality and option 82 insertion.

Practice this question →

276

Multi-Selectmedium

Which TWO switch port configurations are required when connecting a Cisco IP phone and a desktop PC to a single access port?

Select 2 answers

A.Configure the port as a trunk and allow both VLANs.

B.Use the 'switchport voice vlan' command to assign a dedicated voice VLAN.

C.Disable spanning tree on the port to prevent voice delays.

D.Apply 'mls qos trust cos' on the interface to preserve voice packet markings.

E.Configure the port as a routed port with an IP address for management.

AnswersB, D

The 'switchport voice vlan' command is the correct method because it configures an access port to carry both data and voice while keeping them logically separate. The Cisco IP phone uses CDP or LLDP to learn the configured voice VLAN, tags all voice frames with that VLAN's 802.1Q header, and passes the PC's untagged traffic in the access VLAN. This preserves the normal access port behavior for the connected PC while ensuring voice traffic is segmented for QoS and security.

Why this answer

The 'switchport voice vlan' command assigns a dedicated VLAN for voice traffic, allowing the IP phone to tag its packets with the voice VLAN ID while the PC remains in the native (data) VLAN. Option D is correct because 'mls qos trust cos' preserves the Layer 2 Class of Service (CoS) markings from the IP phone, ensuring voice packets receive appropriate QoS treatment across the network. Option A is incorrect because a trunk port is not required—the access port with the voice VLAN command handles both VLANs without trunking.

Option C is incorrect because disabling Spanning Tree Protocol (STP) is not a recommended practice and does not prevent voice delays; STP is essential for loop prevention and can be tuned with PortFast instead. Option E is incorrect because the port must remain a Layer 2 access port, not a routed port, to support both the PC and IP phone.

Exam trap

Cisco often tests the misconception that a trunk port is needed to carry both voice and data VLANs, but the correct approach uses a single access port with the 'switchport voice vlan' command to handle both VLANs without trunking.

Why the other options are wrong

Using a trunk port for a single device connection is unnecessary and violates standard access port design; it would also require the phone to support trunking, which is not the typical Cisco IP phone configuration.

STP does not introduce significant delays in normal operation, and disabling it risks broadcast storms and network loops.

Access ports operate at Layer 2; converting to a routed port would prevent the phone and PC from communicating within their respective VLANs.

Practice this question →

277

MCQhard

A network engineer notices that after adding a new switch to the network, a different switch unexpectedly becomes the STP root bridge, disrupting all VLANs. The new switch has the default priority (32768) but has a lower MAC address than all existing switches. What is the most likely cause?

A.The new switch is running PVST+ while the existing switches use Rapid PVST+

B.Root Guard is enabled on the new switch’s uplink ports facing the existing root

C.The existing root bridge has a bridge priority lower than the default value of 32768

D.The new switch was added with a bridge priority of 4096

AnswerC

If the existing root bridge’s priority is less than 32768 (e.g., 4096 or 0), its Bridge ID is lower than the new switch’s default 32768 + lower MAC. STP always elects the switch with the lowest Bridge ID as the root bridge. Thus, despite the new switch’s lower MAC, the manually lowered priority keeps the existing switch as root.

Why this answer

The existing root bridge has a bridge priority lower than the default value of 32768, so even though the new switch has the default priority, its lower MAC address does not make it the root. STP elects the root bridge based on the lowest bridge ID (priority + MAC address). Since the existing root already has a lower priority, it remains the root.

The new switch's lower MAC address only becomes a tiebreaker when priorities are equal, which is not the case here.

Exam trap

Cisco often tests the misconception that a lower MAC address alone can cause a root bridge change, but the trap here is that candidates forget the bridge priority is compared first, so a switch with default priority cannot outrank an existing root with a manually lowered priority.

Why the other options are wrong

Candidates may think that STP version incompatibility disrupts root election, but both versions use the same BPDU format and root election rules.

Candidates often associate Root Guard with preventing a switch from becoming the root. However, it does not cause another switch to become root; it just protects the network from unexpected superior BPDUs.

Candidates may confuse the symptom and think that a low priority on the new switch causes the problem, but this would make the new switch the root, not another switch.

Practice this question →

278

MCQhard

Two switches are connected via an IEEE 802.1Q trunk. Hosts in VLAN 30 on opposite sides cannot communicate, yet hosts in VLAN 10 communicate normally. Both switches have VLAN 30 in their VLAN database, and the trunk link is operational. What is the most likely cause?

A.VLAN 30 is pruned or not allowed on one side of the trunk

B.The native VLAN must be set to 30

C.STP blocks all VLANs on the trunk when one VLAN fails

D.The trunk must be changed to access mode for VLAN 30

AnswerA

VLAN 30 is either pruned via VTP pruning or excluded by the switchport trunk allowed vlan list on at least one of the interconnected switches. Because the 802.1Q trunk carries VLAN 10 successfully, the physical link and trunk parameters are operational, but VLAN 30's frames are deliberately filtered before crossing the trunk, so hosts in VLAN 30 experience complete connectivity loss while VLAN 10 remains unaffected.

Why this answer

If a VLAN is not allowed on one side of the trunk, frames for that VLAN are dropped even though other VLANs continue to work. Option A correctly identifies that VLAN 30 is either pruned or missing from the allowed list on one end. Option B is wrong because the native VLAN only affects untagged frames and would not cause the filtering of a tagged VLAN like VLAN 30.

Option C is incorrect because STP can block individual VLANs per port, but it does not block all VLANs on a trunk due to a single VLAN’s issue—only the affected VLAN would be blocked. Option D is invalid because converting the trunk to access mode would break all VLAN trunking, including the working VLAN 10.

Exam trap

Ensure you check the trunk configuration for allowed VLANs, not just VLAN existence or port assignments.

Why the other options are wrong

The native VLAN setting only governs untagged traffic on the trunk, not the tagged frames of VLAN 30, so it cannot fix a missing allowed VLAN.

STP does not globally block all VLANs on a trunk; per‑VLAN spanning tree can block individual VLANs, but a single VLAN failure would not cause the trunk to block all traffic.

Changing the trunk to access mode would restrict the link to a single VLAN, breaking VLAN 10 connectivity as well, which contradicts the working state of VLAN 10.

Practice this question →

279

Multi-Selectmedium

Which TWO statements correctly describe the configuration and use of a voice VLAN on a Cisco switch port?

Select 2 answers

A.The voice VLAN is configured using the 'switchport mode trunk' command.

B.When a voice VLAN is configured, the switch port operates in two VLANs: one for data and one for voice traffic.

C.The voice VLAN must be the same as the native VLAN on the trunk link.

D.The IP phone uses CDP or LLDP to learn the voice VLAN ID from the switch.

E.The data VLAN and voice VLAN must be in the same IP subnet.

AnswersB, D

With a voice VLAN configured, a single physical switchport simultaneously carries data and voice traffic by operating as an access port for the data VLAN and accepting tagged frames on the voice VLAN. The switch sets the port to 'switchport mode access' with 'switchport access vlan' for data and 'switchport voice vlan' for voice, so the port effectively bridges two separate VLANs. This is why a PC connected through an IP phone still gets an untagged data VLAN assignment while the phone's traffic is tagged with the voice VLAN ID.

Why this answer

When a voice VLAN is configured on a Cisco switch port, the port operates in two separate VLANs simultaneously: one for data traffic (the access VLAN) and one for voice traffic (the voice VLAN). This is achieved using the 'switchport voice vlan' command, which allows the switch to tag voice frames with the voice VLAN ID while leaving data frames untagged (or tagged with the access VLAN). This separation ensures that voice traffic receives appropriate QoS treatment and is isolated from data traffic.

Exam trap

Cisco often tests the misconception that a voice VLAN requires trunking or that the voice VLAN must match the native VLAN, but in reality, a voice VLAN is configured on an access port using the 'switchport voice vlan' command, and the native VLAN concept applies only to trunk ports.

Why the other options are wrong

Trunk mode is used to carry multiple VLANs, but for a single access port with voice, the port remains in access mode and uses the voice VLAN feature.

The native VLAN is used for untagged traffic on a trunk, while the voice VLAN is a specific VLAN that carries tagged voice traffic from the phone.

They are separate VLANs and usually belong to different subnets for logical separation and management.

Practice this question →

280

PBQeasy

You are connected to SW1, a Layer 2 switch. The network administrator wants to prevent unauthorized switches from being connected to access ports. Port G0/1 is an access port in VLAN 10. You need to configure BPDU Guard on this port to protect against STP loops caused by rogue switches. Additionally, enable PortFast for immediate transition to forwarding.

Hints

•PortFast should be applied to access ports to reduce STP convergence time.
•BPDU Guard disables the port if a BPDU is received.
•Both commands are under the interface configuration.

A.SW1(config-if)# spanning-tree portfast SW1(config-if)# spanning-tree bpduguard enable

B.SW1(config)# spanning-tree portfast default SW1(config)# spanning-tree bpduguard default

C.SW1(config-if)# spanning-tree portfast SW1(config-if)# spanning-tree guard root

D.SW1(config-if)# spanning-tree portfast SW1(config-if)# spanning-tree bpduguard disable

AnswerA

solution

! SW1
interface GigabitEthernet0/1
spanning-tree portfast
spanning-tree bpduguard enable

Why this answer

PortFast allows an access port to skip STP listening/learning and transition immediately to forwarding. BPDU Guard protects against STP loops by error-disabling the port if a BPDU is received, which would indicate an unauthorized switch connection.

Exam trap

Be careful to distinguish between interface-level and global commands for PortFast and BPDU Guard. Also, remember that BPDU Guard uses 'bpduguard enable' (not 'disable') and is different from Root Guard ('guard root').

Why the other options are wrong

The specific factual error is that global commands affect all ports, not a single interface.

The specific factual error is confusing Root Guard with BPDU Guard; they serve different purposes.

The specific factual error is using the 'disable' keyword instead of 'enable' to activate BPDU Guard.

281

MCQeasy

Which STP port state on a classic 802.1D switch listens for BPDUs and prepares to participate in the topology, but does not yet learn MAC addresses?

A.Listening

B.Learning

C.Forwarding

D.Disabled

AnswerA

In the classic 802.1D listening state, a port is still blocked from forwarding user data, but it is actively listening to incoming BPDUs to determine the network topology. During this 15-second forward-delay interval, the switch does not learn MAC addresses from the frames it receives, and it cannot send user traffic. Only after this state does the port move to learning.

Why this answer

In classic STP, the listening state processes BPDUs and waits before learning begins. The learning state is when the switch starts populating the MAC table.

Exam trap

Do not confuse the listening state with the learning state; remember that listening involves BPDU processing without MAC address learning.

Why the other options are wrong

In the listening state, a switch port listens for BPDUs but does not learn MAC addresses. The learning state is the next step where the port begins to learn MAC addresses from incoming frames while still not forwarding traffic.

In the Forwarding state, the switch port has already learned MAC addresses and is forwarding data frames, whereas the question specifies a state that does not yet learn MAC addresses.

The Disabled port state does not listen for BPDUs, learn MAC addresses, or forward frames; it is administratively shut down and has no participation in STP topology.

Practice this question →

282

MCQhard

A switch interface is configured as `dynamic desirable`, and the peer interface is configured as `dynamic auto`. What is the most likely result?

A.The link is likely to become a trunk.

B.The link becomes a routed port.

C.All VLANs are deleted from both switches.

D.The port is immediately error-disabled.

AnswerA

Dynamic desirable is the most proactive DTP mode; it actively sends DTP frames to initiate trunk negotiation. When the remote switch port is configured as dynamic auto, it passively listens and responds to DTP, allowing the two switches to agree on trunking and place the link into trunk mode. Therefore, this pairing is a valid and expected way to form a trunk.

Why this answer

The most likely result is that the link becomes a trunk. In simple terms, `dynamic desirable` actively tries to negotiate a trunk, while `dynamic auto` listens and responds. Because one side is willing to initiate the process, trunking can be established if the rest of the configuration is compatible.

This question tests whether you know the difference between passive and active DTP behavior. The classic failure pairing is auto/auto. Desirable/auto, by contrast, is a normal path to trunk formation.

Exam trap

Be careful not to confuse DTP modes with Spanning Tree Protocol states or assume passive modes prevent trunking.

Why the other options are wrong

This option is wrong because a switch interface configured as `dynamic desirable` and its peer as `dynamic auto` will negotiate a trunk link, not a routed port. Routed ports are typically configured explicitly and not through dynamic negotiation.

This option is wrong because configuring a switch interface as `dynamic desirable` and `dynamic auto` does not lead to the deletion of VLANs; it instead allows for trunk negotiation between the switches.

Practice this question →

283

MCQhard

Refer to the exhibit. An engineer configured PortFast on interface GigabitEthernet0/1, which connects to a server that does not participate in spanning tree. However, the port remains in the listening state for the full forward delay period before transitioning to forwarding. The engineer issues the show spanning-tree vlan 10 detail command. Based on the output, what is the most likely cause?

A.The port is configured as a trunk, so PortFast is not active.

B.BPDU Guard is enabled on the port, causing it to block.

C.The forward delay timer is set too high, and PortFast cannot override it.

D.The server is sending BPDUs, causing the port to lose its PortFast state.

AnswerA

PortFast is only effective on access ports. The exhibit shows ‘Edge port: no (default) portfast: no (default)’ despite the engineer enabling PortFast, indicating the port is operating as a trunk (or not an access port). Therefore, PortFast has no effect and the normal STP listening/learning states apply.

Why this answer

PortFast is designed to immediately transition a port to the forwarding state, bypassing the listening and learning states. However, PortFast is only effective on access ports; if the interface is configured as a trunk port, PortFast is automatically disabled by the switch. The output of 'show spanning-tree vlan 10 detail' would confirm the port is a trunk, explaining why it still goes through the full forward delay.

Exam trap

Cisco often tests the misconception that PortFast works on any port type, but the trap here is that PortFast is only effective on access ports, and trunk ports automatically disable PortFast regardless of configuration.

Why the other options are wrong

The port is not in an err-disabled state; BPDU Guard causes the port to be shut down, not to stay in listening.

Misunderstanding that PortFast bypasses timers completely on access ports; the high forward delay is irrelevant if PortFast were active.

The assumption that the server is sending BPDUs is contradicted by the output showing zero BPDUs received.

Practice this question →

284

Drag & Dropmedium

Drag and drop the following steps into the correct order to configure and recover from a BPDU guard violation on a PortFast-enabled access port in RSTP.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Configure PortFast and BPDU guard on the access port. Then trigger a violation by connecting an unauthorized switch, which causes the port to error-disable. Diagnose by checking the error-disabled status.

To recover, first remove the offending device, then cycle the port with shutdown and no shutdown; otherwise the port will immediately go error-disabled again.

Exam trap

Do not confuse the order: configuration must precede the violation. Also, recovery requires removing the rogue switch before bouncing the interface; failing to do so will cause the port to trip again.

Practice this question →

285

PBQhard

You are connected to R1, a multilayer switch acting as the STP root for VLAN 10. Configure Root Guard on port GigabitEthernet0/1 (designated port) to protect against superior BPDUs from an unauthorized switch, Loop Guard on uplink GigabitEthernet0/2 to prevent loops, and BPDU Guard on PortFast-enabled GigabitEthernet0/3. After configuration, a superior BPDU arrives on G0/1, blocking the port; verify the Root Guard state and ensure BPDU Guard triggers err-disable on G0/3.

Network Topology

Hints

•Root Guard is applied on ports that should never become root; use 'spanning-tree guard root'.
•Loop Guard prevents alternate or root ports from becoming designated when BPDUs stop; use 'spanning-tree guard loop' on uplinks.
•BPDU Guard combined with PortFast err-disables a port upon BPDU reception; enable with 'spanning-tree bpduguard enable' under the interface.

A.G0/1 is in root-inconsistent state; G0/3 is in err-disabled state.

B.G0/1 is in blocking state; G0/3 is in err-disabled state.

C.G0/1 is in root-inconsistent state; G0/3 is in blocking state.

D.G0/1 is in err-disabled state; G0/3 is in root-inconsistent state.

AnswerA

solution

! R1
interface GigabitEthernet0/1
spanning-tree guard root
interface GigabitEthernet0/2
spanning-tree guard loop
interface GigabitEthernet0/3
spanning-tree bpduguard enable

Why this answer

Root Guard is needed on the designated port (G0/1) to prevent an unauthorized switch from becoming root by sending superior BPDUs. Loop Guard on the uplink (G0/2) prevents loops if BPDUs stop arriving. BPDU Guard on PortFast ports (G0/3) immediately err-disables them upon BPDU reception.

The configuration uses 'spanning-tree guard root' on G0/1, 'spanning-tree guard loop' on G0/2, and 'spanning-tree bpduguard enable' on G0/3. Verification shows G0/1 blocked by root-inconsistent state and G0/3 in err-disabled state.

Exam trap

Do not confuse the states caused by Root Guard (root-inconsistent) and BPDU Guard (err-disable). Also, remember that Root Guard is applied to designated ports, not root or alternate ports.

Why the other options are wrong

Root Guard uses a specific 'root-inconsistent' state, not the generic 'blocking' state.

BPDU Guard triggers err-disable, not blocking. Blocking is an STP state, not an error state.

Root Guard and BPDU Guard have different effects: root-inconsistent vs. err-disable. Mixing them up is a common error.

Practice this question →

286

MCQhard

A user connects a Cisco IP Phone with a PC attached to the phone's PC port to switch interface GigabitEthernet0/5. The PC obtains an IP address and can reach the network, but the phone displays "Configuring IP" and never registers. Based on the exhibit outputs, what is the most likely cause?

A.The switchport must be configured as a trunk to support voice VLANs.

B.VLAN 20 has not been created in the switch's VLAN database.

C.The native VLAN on the trunk ports between the switch and the DHCP server is incorrectly set to VLAN 10.

D.The phone is manually configured to use VLAN 10 for voice traffic instead of VLAN 20.

AnswerB

The 'show vlan brief' output lists only VLANs 1 and 10. VLAN 20 does not exist, so the switch discards any tagged frames arriving on the port with VLAN ID 20, causing the phone's DHCP/TFTP communication to fail.

Why this answer

The PC obtains an IP address and can reach the network, indicating that the access VLAN (likely VLAN 1 or the native VLAN) is functioning. However, the phone displays 'Configuring IP' and never registers, which means it cannot obtain an IP address on its voice VLAN. The most likely cause is that VLAN 20, which is configured as the voice VLAN on the switchport, has not been created in the switch's VLAN database.

Without the VLAN existing, the switch cannot forward traffic or DHCP requests for that VLAN, leaving the phone stuck in the IP configuration phase.

Exam trap

Cisco often tests the distinction between configuring a voice VLAN on an interface and actually creating that VLAN in the global VLAN database; candidates mistakenly assume that referencing a VLAN in interface configuration automatically creates it.

Why the other options are wrong

Voice VLANs operate on access ports by tagging voice traffic while keeping PC traffic untagged in the data VLAN. A trunk is not required.

Native VLAN mismatches on trunks would affect both data and voice VLANs if both were allowed. The PC works, ruling out a general trunk issue.

The phone would work if it was sending voice traffic on the data VLAN (10), because VLAN 10 exists. The phone failing indicates a missing voice VLAN, not a misconfiguration on the phone.

Practice this question →

287

MCQmedium

Exhibit: Users complain of slow wireless performance in a dense office even though signal strength is strong. Multiple APs are using channels 1, 2, and 3 on 2.4 GHz. Which change is most appropriate?

A.Reduce all AP transmit power to zero

B.Move to non-overlapping channels such as 1, 6, and 11

C.Change every AP to the same channel for consistency

D.Disable WPA2 security

AnswerB

In the 2.4 GHz ISM band, adjacent channel interference is unavoidable if channels are spaced closer than 25 MHz, so planning APs on the three non-overlapping channels 1, 6, and 11 ensures that overlapping coverage cells do not transmit on the same or partially overlapping frequencies. This eliminates co-channel and adjacent-channel contention, allowing the CSMA/CA medium access protocol to work efficiently and restoring throughput for users.

Why this answer

In 2.4 GHz, overlapping channels cause co-channel and adjacent-channel interference. The common non-overlapping choices are 1, 6, and 11. Moving away from overlapping channels usually improves performance in a dense deployment.

Exam trap

Avoid assuming that increasing power or adding more APs will solve interference issues without considering channel overlap.

Why the other options are wrong

Reducing all AP transmit power to zero would completely disable the wireless network, making it impossible for users to connect or experience any performance, which does not address the issue of slow performance in a dense office environment.

Changing every AP to the same channel would lead to co-channel interference, exacerbating the slow wireless performance issue rather than resolving it. In a dense office environment, this configuration would reduce overall throughput and increase contention among devices.

Disabling WPA2 security would not address the issue of slow wireless performance in a dense office environment; instead, it would compromise network security and potentially allow unauthorized access, worsening the situation.

Practice this question →

288

MCQhard

A Layer 2 switch port connected to an end host should move to forwarding quickly but also shut down if a BPDU is received. Which pair of features best supports that design?

A.PortFast and BPDU Guard

B.Root Guard and UDLD

C.Loop Guard and native VLAN

D.Port security and EtherChannel

AnswerA

PortFast immediately transitions an access port to the forwarding state, bypassing the listening and learning STP states so the end host can start sending traffic without delay. BPDU Guard protects the STP topology by disabling any PortFast port that receives a BPDU, which indicates an unauthorized switch or bridge has been connected. Together they are the required configuration for a trusted edge port attached to a single end host.

Why this answer

PortFast and BPDU Guard are the right pair. In plain language, PortFast makes an edge port usable quickly for a real end device, while BPDU Guard protects that same port by shutting it down if spanning-tree control traffic appears unexpectedly.

This is a classic access-layer design. PortFast improves usability, and BPDU Guard improves safety. The best answer combines both functions.

Exam trap

Be careful not to confuse BPDU Guard with Root Guard or Loop Guard, as they serve different purposes in spanning tree protection.

Why the other options are wrong

Root Guard and UDLD do not directly address the requirement for a port to quickly transition to forwarding while shutting down upon receiving a BPDU. Root Guard is used to prevent a port from becoming a root port, while UDLD is for detecting unidirectional links.

Loop Guard and native VLAN do not directly address the requirement for a port to quickly transition to forwarding while shutting down upon receiving a BPDU. Loop Guard is designed to prevent loops by keeping a port in a loop-inconsistent state, and native VLAN is related to VLAN tagging, not port state management.

Port security and EtherChannel do not directly address the need for a switch port to quickly transition to forwarding mode while also shutting down upon receiving a BPDU. Port security focuses on limiting MAC addresses and EtherChannel is used for link aggregation, neither of which fulfill the specific requirements of this question.

Practice this question →

289

MCQhard

A network administrator has configured a switch port to support a VoIP phone and a desktop PC. Users report that the desktop PC cannot obtain an IP address via DHCP, while the VoIP phone registers successfully. The switch port is up/up, and the desktop is connected to the phone's PC port. What is the most likely cause of the issue?

A.The switchport mode access should be changed to switchport mode trunk to allow both vlans.

B.The switchport access vlan should be changed to the data VLAN to match the subnet expected by the desktop.

C.The switchport voice vlan should be removed because the desktop cannot use it.

D.The spanning-tree portfast should be disabled to prevent DHCP delays.

AnswerB

In a typical IP phone daisy-chain topology, the desktop connects to the phone's PC port, and the switch sends all untagged desktop frames into the port's configured access VLAN. If that access VLAN is incorrectly set to, say, the native VLAN or a different number, the desktop's DHCP DISCOVER will not arrive at the DHCP server for its expected data subnet, leaving it without an IP address. Correctly changing the switchport access vlan to the data VLAN ensures the desktop's untagged traffic is placed in the proper L2 domain, allowing the DHCP server to respond with an appropriate address.

Why this answer

The desktop PC obtains its IP address from the data VLAN, but the switch port's access VLAN is likely misconfigured to the voice VLAN. Changing the access VLAN to the correct data VLAN places the PC in the proper subnet and allows DHCP to function. Option A is unnecessary because a voice-access port does not need to be a trunk.

Option C would break the VoIP phone without fixing the PC's VLAN assignment. Option D is irrelevant; PortFast speeds up STP convergence and does not block DHCP.

Exam trap

Cisco often tests the misconception that the PC uses the voice VLAN or that the port must be a trunk, when in reality the phone handles the VLAN separation internally and the switch port remains an access port with a separate voice VLAN.

Why the other options are wrong

The current configuration uses access mode with voice vlan, which is correct for a phone+PC setup. Trunk mode is unnecessary and could break the phone's untagged traffic expectations.

The voice vlan is correctly configured for the phone; the problem is with the data vlan assignment for the desktop.

Portfast is beneficial for host ports; disabling it would worsen the issue by introducing STP convergence delays.

Practice this question →

290

MCQhard

Based on the exhibit, which action is most likely required to allow AP-22 to join the controller successfully?

A.Correct the AP's default gateway so it matches the AP's actual subnet and reachability needs.

B.Change the AP from Ethernet to PPP encapsulation.

C.Remove the AP IP address so it can obtain an IP address automatically via DHCP.

D.Disable DHCP on the controller for all APs.

AnswerA

The AP's IP address and its default gateway must reside in the same Layer 3 subnet; the exhibit shows a mismatch, so the AP cannot route CAPWAP discovery or join messages toward the wireless LAN controller. With an incorrect gateway, the AP's forwarding table sends management traffic to a non-existent or unreachable next hop, effectively isolating the AP from the controller. Correcting the gateway to match the actual subnet and reachability path restores proper IP routing and allows the AP to complete the join process.

Why this answer

The correct action is to fix the AP's default gateway so it can reach the controller's subnet. Option B is wrong because APs use Ethernet, not PPP encapsulation, which is used for serial WAN links. Option C is wrong because CAPWAP does not assign IP addresses; DHCP does, but the AP already has a static IP, and removing it would cause it to fall back to DHCP, which may not fix the gateway issue.

Option D is wrong because disabling DHCP on the controller would affect all APs and prevent new APs from obtaining addresses, which is not a targeted fix.

Exam trap

Avoid assuming resets or updates fix network configuration issues; focus on Layer 3 settings like gateways.

Why the other options are wrong

APs use Ethernet frames, not PPP encapsulation; PPP is used for serial links.

CAPWAP does not assign IP addresses; DHCP handles that, but removing the AP's IP does not correct the gateway mismatch.

Disabling DHCP on the controller would break all APs, not just AP-22, and does not address the gateway issue.

Practice this question →

291

MCQhard

Exhibit: An access switch shows Gi1/0/10 as err-disabled shortly after an IP phone and a workstation are connected through the same wall jack. What is the most likely cause?

A.The native VLAN is missing

B.The port security maximum is too low for the connected devices

C.BPDU Guard blocked the port because a workstation was attached

D.DHCP snooping denied the voice VLAN

AnswerB

With a Cisco IP phone and a PC behind it, the switchport must learn two MAC addresses (phone and PC) on the same port. If the port-security maximum is set to 1, the second MAC address triggers a violation and the default violation mode (shutdown) places the interface into err-disabled state. The fix is to raise the maximum to at least 2 and optionally use sticky MAC addresses.

Why this answer

With a phone and a PC on the same access port, the switch may legitimately see two MAC addresses. Port security set to a maximum of 1 causes a violation and can place the interface into err-disabled state.

Exam trap

Be cautious of assuming all err-disabled states are due to STP or VLAN issues; port security is a frequent cause.

Why the other options are wrong

The native VLAN being missing would not directly cause a port to go err-disabled when connecting an IP phone and workstation; it typically results in VLAN mismatches or communication issues rather than disabling the port.

BPDU Guard is designed to protect against loops by disabling ports that receive Bridge Protocol Data Units (BPDUs). In this scenario, the port is err-disabled due to port security violations, not because of BPDU Guard activation.

DHCP snooping denying the voice VLAN would typically result in the IP phone failing to receive an IP address, rather than causing the port to go err-disabled. The err-disabled state is more likely due to port security violations when multiple devices are connected.

Practice this question →

292

MCQmedium

Exhibit: A user reports intermittent connectivity after a new switch was connected to an access port. Which feature would have prevented this by immediately disabling the port when a BPDU was received?

A.Root Guard

B.Loop Guard

C.BPDU Guard

D.UDLD

AnswerC

BPDU Guard is the correct protection mechanism because it is designed specifically for PortFast-enabled access ports. When a legitimate BPDU is received on such a port, BPDU Guard immediately err-disables the interface to prevent a potential bridging loop, which explains the intermittent connectivity: the new device is sending BPDUs and triggering the shutdown each time.

Why this answer

BPDU Guard is the correct answer because it protects PortFast-enabled edge ports by immediately disabling the port upon receiving a BPDU, preventing accidental loops. Root Guard prevents the port from becoming a root port, not from BPDU reception. Loop Guard prevents alternate or root ports from becoming designated due to BPDU loss, unrelated to BPDU reception disabling.

UDLD detects unidirectional links but does not disable ports upon BPDU reception.

Exam trap

Be cautious not to confuse BPDU Guard with other guard features like Root Guard or Loop Guard, which serve different purposes.

Why the other options are wrong

Root Guard prevents a port from being elected as root port, not from receiving BPDUs on an access port.

Loop Guard prevents loops caused by BPDU loss on blocked ports, not from BPDU reception on access ports.

UDLD detects unidirectional links but does not disable a port when a BPDU is received.

Practice this question →

293

PBQhard

You are connected to a single switch, SW1, which is a Cisco Catalyst 2960 running Cisco IOS. Configure port GigabitEthernet0/1 as an access port for a Cisco IP phone and a PC on the same VLAN (Voice VLAN 20, Data VLAN 10). The switch must provide PoE to the phone. Additionally, configure GigabitEthernet0/2 as an access port for a wireless access point (AP) that requires PoE. Verify both configurations using the appropriate show commands. The current running-config is incomplete; you must add the necessary commands.

Hints

•Voice VLAN is configured with a separate command on the interface.
•PoE may be disabled; use 'power inline auto' to enable it.
•Use 'show interfaces switchport' to confirm voice VLAN assignment.

A.interface GigabitEthernet0/1 switchport mode access switchport access vlan 10 switchport voice vlan 20 power inline auto interface GigabitEthernet0/2 switchport mode access switchport access vlan 10 power inline auto

B.interface GigabitEthernet0/1 switchport mode trunk switchport trunk allowed vlan 10,20 power inline auto interface GigabitEthernet0/2 switchport mode access switchport access vlan 10 power inline auto

C.interface GigabitEthernet0/1 switchport mode access switchport access vlan 10 switchport voice vlan 20 power inline never interface GigabitEthernet0/2 switchport mode access switchport access vlan 10 power inline auto

D.interface GigabitEthernet0/1 switchport mode access switchport access vlan 20 switchport voice vlan 10 power inline auto interface GigabitEthernet0/2 switchport mode access switchport access vlan 10 power inline auto

AnswerA

solution

! SW1
configure terminal
interface gigabitEthernet 0/1
switchport voice vlan 20
power inline auto
exit
interface gigabitEthernet 0/2
power inline auto
end
write memory

Why this answer

The configuration was missing the voice VLAN assignment on Gi0/1 and PoE settings on both ports. For Gi0/1, the command 'switchport voice vlan 20' is required to separate voice traffic from data traffic. For both Gi0/1 and Gi0/2, PoE must be enabled; by default 'power inline auto' is set, but since the ports show 'off', they may have been disabled.

The solution ensures PoE is enabled with 'power inline auto' and sets the voice VLAN correctly. Verification with 'show interfaces switchport' should show 'Voice VLAN: 20' and 'show power inline' should show 'auto' for both ports.

Exam trap

Candidates often confuse the need for a trunk port when multiple VLANs are involved, but the voice VLAN feature allows an access port to carry both data and voice traffic. Also, remember that 'power inline auto' is the default but may need to be explicitly configured if disabled. Always verify with 'show interfaces switchport' to see the voice VLAN and 'show power inline' to see PoE status.

Why the other options are wrong

The specific factual error is that trunk ports are used to carry multiple VLANs between switches, not for connecting end devices like phones and PCs. The correct method is to use an access port with a voice VLAN.

The specific factual error is that 'power inline never' explicitly disables PoE, which would prevent the phone from powering on. The correct command is 'power inline auto' to enable PoE detection and delivery.

The specific factual error is that the VLAN numbers are reversed. The access VLAN should be the data VLAN (10), and the voice VLAN should be 20. Swapping them would place data traffic in VLAN 20 and voice in VLAN 10, which is not the intended configuration.

Practice this question →

294

MCQmedium

A switchport connected to an IP phone and a PC must carry user traffic and voice traffic separately. Which feature is designed for that purpose on a Cisco access port?

A.Voice VLAN

B.EtherChannel

C.SPAN

D.Native VLAN

AnswerA

A voice VLAN is the correct feature because it lets a single access switchport carry both an IP phone's 802.1Q-tagged voice frames and the PC's untagged data frames in the native/configured access VLAN. The phone is configured to tag its media with the Voice VLAN ID while leaving PC traffic untagged, enabling logical separation of voice and data on one physical port.

Why this answer

The correct feature is a voice VLAN. In plain language, a voice VLAN lets the switch treat the IP phone’s traffic differently from the user PC’s traffic even though both devices may be connected through the same physical access port. The phone can tag voice traffic for the voice VLAN while the PC remains in the normal data access VLAN. This is a practical design because it keeps voice traffic logically separate, which helps with policy, QoS, and management.

This is a classic CCNA switching concept because it shows that one physical edge port can still support more than one logical traffic type in a controlled way. A standard access VLAN by itself would not provide the same voice/data separation. EtherChannel, SPAN, and native VLAN concepts solve different problems. The best answer is the feature specifically built to support phones and workstations together on one access connection while keeping their traffic logically distinct.

Exam trap

Be cautious not to confuse VLAN-related terms. Understand that voice VLAN is specifically designed for separating voice and data traffic on access ports.

Why the other options are wrong

EtherChannel is a technology used to combine multiple physical links into a single logical link for increased bandwidth and redundancy, but it does not separate user and voice traffic on a switchport. Therefore, it does not fulfill the requirement of carrying voice and user traffic separately.

SPAN (Switched Port Analyzer) is used for monitoring and capturing traffic on a switch port, not for separating user and voice traffic. It does not provide the necessary functionality to handle VLANs for voice and data traffic on a single port.

The Native VLAN is used for untagged traffic on a trunk port and does not separate voice and user traffic on an access port. It is not designed to handle the specific requirements of carrying both voice and data traffic separately.

Practice this question →

295

Drag & Dropmedium

Drag and drop the following steps into the correct order to configure a Cisco switch access port with a data VLAN and a voice VLAN.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Why this order

First, enter global configuration mode with 'configure terminal'. Next, select the interface using 'interface GigabitEthernet0/1'. Then, set the port to access mode with 'switchport mode access' to prevent trunk negotiation.

After that, assign the data VLAN with 'switchport access vlan 10'. Finally, assign the voice VLAN with 'switchport voice vlan 20'. This order ensures the interface is properly configured before VLAN assignment and prevents DTP from creating a trunk.

Practice this question →

296

Multi-Selectmedium

A switch should learn one MAC address on an access port and shut the port down if a second unauthorized device appears. Which two port-security settings support that requirement?

Select 2 answers

A.switchport port-security maximum 1

B.switchport port-security violation shutdown

C.switchport protected

D.switchport nonegotiate

AnswersA, B

The 'switchport port-security maximum 1' command under interface configuration enables port security and caps the number of learned secure MAC addresses to exactly one. Once a single device's MAC address is dynamically learned and stored in the secure MAC table, any additional source MAC address seen on the port is treated as a violation, triggering the configured violation action. This is the precise command needed to satisfy the requirement of learning only one MAC address, as it directly enforces the numerical limit on secure MAC entries.

Why this answer

Port security enforces how many MAC addresses may be learned on a port and what happens when a violation occurs. 'switchport port-security maximum 1' limits the port to one MAC address, and 'switchport port-security violation shutdown' disables the port if a violation occurs, matching the requirement. 'switchport protected' isolates ports within a switch but does not limit MAC addresses or cause a shutdown. 'switchport nonegotiate' disables DTP negotiation, which is unrelated to port security.

Exam trap

Be careful not to confuse the different port security violation modes. Only the shutdown mode will disable the port.

Why the other options are wrong

The 'switchport protected' command is used to isolate ports within a VLAN (private VLAN edge), preventing communication between protected ports. It does not limit MAC addresses or trigger port shutdown upon violation.

The 'switchport nonegotiate' command disables Dynamic Trunking Protocol (DTP) negotiation, preventing the port from becoming a trunk. It does not limit MAC addresses or enforce violation actions, so it cannot meet the requirement to learn one MAC and shut down on a second unauthorized device.

Practice this question →

297

MCQhard

A user reports that a laptop can connect to the correct SSID but repeatedly fails authentication when joining the WLAN. Which category of issue is most strongly indicated?

A.A security or authentication mismatch related to WLAN access

B.A missing OSPF router ID on the access point

C.A routed-port mismatch on the switch uplink

D.A DHCP relay problem on the client

AnswerA

The client can see and associate with the SSID, but the authentication exchange fails because of mismatched security parameters—such as an incorrect pre-shared key, incompatible WPA version, or an EAP/RADIUS misconfiguration on the WLAN profile. In 802.1X or WPA2/WPA3 PSK, the four-way handshake must complete before the client is granted access; when authentication credentials or cipher suites differ between client and AP, the handshake aborts, causing repeated association attempts and a visible SSID but no successful connection.

Why this answer

The strongest indication is a wireless security or authentication mismatch rather than a pure RF coverage problem. In practical terms, the laptop can already see and attempt to join the correct SSID, which means discovery is working. Repeated authentication failure points more directly to credentials, security settings, or authentication-policy alignment than to channel or signal absence.

This question is about recognizing the stage of failure. The client is finding the WLAN, but it is not being accepted onto it.

Exam trap

A common exam trap is selecting options related to routing protocols or DHCP relay issues when a client fails to authenticate on a WLAN. Candidates may incorrectly assume that IP configuration problems or routing mismatches cause authentication failures. However, authentication occurs before IP assignment, so DHCP or OSPF issues cannot cause repeated authentication failures.

This trap distracts from the correct focus on wireless security settings and credentials, which are the root cause when a client sees the SSID but cannot authenticate.

Why the other options are wrong

Incorrect. OSPF router IDs are relevant to routing protocols and do not affect wireless client authentication or SSID association processes.

Incorrect. Routed-port mismatches on switch uplinks affect wired network traffic forwarding but do not cause wireless authentication failures at the client level.

Incorrect. DHCP relay problems affect IP address assignment after authentication; since the client fails authentication repeatedly, DHCP issues are not the cause.

Practice this question →

298

PBQmedium

You are connected to SW1 via the console. SW1 is a Layer 2 switch with two VLANs (10 - Sales, 20 - Engineering). Port G0/1 is connected to a PC in VLAN 10, and port G0/2 is connected to a PC in VLAN 20. The switch needs to be configured to allow inter-VLAN communication using an external router connected to port G0/3. Currently, the PCs cannot communicate across VLANs. Configure the switch to support Router-on-a-Stick with VLAN 10 as the native VLAN on the trunk.

Network Topology

Hints

•Remember to set the trunk port encapsulation if needed (though modern switches default to dot1q).
•The native VLAN on the trunk must match what the router expects.
•Use switchport mode access for ports connecting to end devices.

A.Configure G0/1 as access VLAN 10, G0/2 as access VLAN 20, G0/3 as trunk with native VLAN 10, and allow VLANs 10 and 20 on the trunk.

B.Configure G0/1 as access VLAN 10, G0/2 as access VLAN 20, G0/3 as trunk with native VLAN 1, and allow VLANs 10 and 20 on the trunk.

C.Configure G0/1 as access VLAN 10, G0/2 as access VLAN 20, G0/3 as trunk with native VLAN 10, but do not allow VLAN 10 on the trunk.

D.Configure G0/1 as trunk with native VLAN 10, G0/2 as trunk with native VLAN 20, G0/3 as trunk with native VLAN 10, and allow VLANs 10 and 20 on all trunks.

AnswerA

solution

! SW1
vlan 10
name Sales
vlan 20
name Engineering
interface GigabitEthernet0/1
switchport mode access
switchport access vlan 10
interface GigabitEthernet0/2
switchport mode access
switchport access vlan 20
interface GigabitEthernet0/3
switchport mode trunk
switchport trunk native vlan 10

Why this answer

Access ports assign PCs to their respective VLANs. The trunk port carries multiple VLANs to the router, and setting the native VLAN to 10 ensures untagged frames on the trunk belong to VLAN 10, which the router's subinterface for VLAN 10 will handle as untagged.

Exam trap

A common trap is to leave the native VLAN as the default VLAN 1 or to forget that the native VLAN must be explicitly allowed on the trunk. Also, candidates may incorrectly configure PC-facing ports as trunks instead of access ports. Always verify the native VLAN matches the router's untagged subinterface and that the allowed VLAN list includes all necessary VLANs.

Why the other options are wrong

The native VLAN must match the VLAN that the router's subinterface handles as untagged. Setting it to VLAN 1 violates the requirement.

The trunk must carry all VLANs that need inter-VLAN communication. Excluding VLAN 10 prevents its traffic from reaching the router.

PCs are end devices that expect untagged frames; they should be connected to access ports, not trunk ports.

299

MCQhard

Refer to the exhibit. A network engineer is troubleshooting an EtherChannel on R1 that is not passing traffic. The output of the show etherchannel summary command is displayed. What is the most likely cause?

A.The local switch is configured with LACP passive while the remote switch is set to LACP active.

B.One side is configured with LACP active and the other side is configured with mode 'on' (static).

C.The remote switch is configured with PAgP desirable while the local switch uses LACP.

D.The port-channel member interfaces are configured as access ports, preventing LACP from negotiating.

AnswerB

With LACP active on one side and mode 'on' on the fabric peer, the 'on' port forces an EtherChannel statically and never transmits LACP PDUs, so the active LACP port never receives a response and cannot move the member port to a bundled state. The port-channel interface may still be administratively up and declared up (SU) because it exists in configuration, but the physical member ports remain in a down (D) state because no LACP negotiation completed. This exact combination produces the (D) flags on member ports while the port-channel itself remains up, making it the correct cause.

Why this answer

The 'show etherchannel summary' output shows the port-channel is down (flags indicate 'D' for down), and the most common cause when one side is configured with LACP active and the other with mode 'on' (static) is a protocol mismatch. LACP active expects to negotiate with another LACP-enabled port, but static mode 'on' forces the link up without negotiation, causing the EtherChannel to fail to form. This mismatch prevents the exchange of LACP frames, leaving the bundle in an error-disabled or non-functional state.

Exam trap

Cisco often tests the misconception that LACP passive/active is incompatible, but the real trap is confusing static mode 'on' (which disables negotiation) with LACP modes, leading candidates to overlook the protocol mismatch between LACP and static configuration.

Why the other options are wrong

LACP passive is not incompatible with LACP active.

PAgP/LACP mismatch leads to suspended state, not down; the exhibit's (D) indicates the link is not up, which points to LACP negotiation failure rather than protocol mismatch.

LACP negotiation is independent of the access/trunk configuration.

Practice this question →