CCNA VLAN Questions — Page 1 of 3

Multi-Selectmedium

A router is configured as a DHCP server for VLAN 20. Clients on the VLAN can reach the default gateway, but they do not receive leases. Which two configuration issues on the router would directly prevent successful address assignment?

Select 2 answers

A.The excluded-address range removes the entire usable subnet

B.The DHCP pool is missing a dns-server statement

C.The subinterface lacks an ip helper-address

D.There are no available addresses left in the defined pool

AnswersA, D

The network for VLAN 20 is 10.20.20.0/24, which has a usable host range of 10.20.20.1 through 10.20.20.254. An excluded-address command that covers this entire range removes all assignable addresses, leaving the DHCP pool scope effectively empty. This is why no clients can receive an IP address from the server.

Why this answer

The router can serve DHCP locally without an ip helper-address. The real problem is that the excluded-address range consumes every usable host address, leaving the pool with no assignable leases.

Exam trap

A common exam trap is to incorrectly assume that missing optional DHCP parameters, such as the dns-server statement, or the absence of an ip helper-address on the subinterface, will prevent clients from receiving leases. Candidates may also overlook the impact of the excluded-address command consuming the entire subnet range, mistakenly thinking the router’s DHCP service is functioning correctly because clients can ping the gateway. The real issue is that no IP addresses remain available to assign, which is a subtle but critical configuration error that directly causes DHCP lease failures.

Why the other options are wrong

Incorrect because the dns-server statement is optional; its absence does not prevent the DHCP server from assigning IP addresses to clients.

Incorrect because the ip helper-address command is only necessary when forwarding DHCP requests across subnets, not when the router itself is the DHCP server on the VLAN.

Practice this question →

MCQhard

Refer to the exhibit. A network administrator is troubleshooting a trunk link between SW1 and SW2. The trunk on interface GigabitEthernet0/0 on SW1 is not passing traffic, and all VLANs are isolated. The administrator issues the command 'show interfaces GigabitEthernet0/0 trunk' on SW1. What is the most likely cause of the issue?

A.The native VLAN is mismatched between SW1 and SW2.

B.The interface is configured as an access port instead of a trunk.

C.The interface is administratively shut down.

D.The trunk encapsulation is set to ISL on SW1, but the peer switch only supports 802.1Q.

AnswerD

The Encapsulation column shows "isl" while the Status is "not-trunking", which is the classic signature of an encapsulation mismatch. SW1 is sending ISL-framed traffic or negotiating with ISL, but the peer switch supports only 802.1Q, making trunk negotiation impossible. ISL and 802.1Q are fundamentally incompatible: ISL adds a 26-byte header and 4-byte trailer, whereas 802.1Q inserts a 4-byte tag into the Ethernet frame. For a trunk to form, both switches must agree on the exact same encapsulation, and since the peer cannot speak ISL, the link remains operationally "not-trunking".

Why this answer

The 'show interfaces trunk' output on SW1 would show the trunk as up but not passing traffic if the encapsulation is set to ISL while SW2 only supports 802.1Q. Cisco switches default to Dynamic Trunking Protocol (DTP) and may negotiate ISL on older hardware, but if the peer does not support ISL, the trunk fails to form correctly, isolating all VLANs. The mismatch in encapsulation prevents proper frame tagging, causing all VLAN traffic to be dropped.

Exam trap

Cisco often tests the misconception that any trunk encapsulation mismatch will cause the interface to go down or show errors, but in reality the link can remain up while silently dropping all tagged traffic, leading to complete VLAN isolation.

Why the other options are wrong

Native VLAN mismatches can cause traffic to leak between VLANs, but they do not prevent a trunk from becoming operational. The output clearly shows the encapsulation type as ISL, not a native VLAN problem.

Candidates might assume a misconfigured mode causes the issue, but the exhibit confirms the port is in trunk mode ('on' mode).

New learners might equate 'not-trunking' with a shutdown state, but 'admin down' is a distinct status. The port is operationally unable to trunk, not manually disabled.

Practice this question →

Drag & Dropmedium

Drag and drop the following steps into the correct order to implement DHCP services for clients in VLAN 10 using a centralized DHCP server in VLAN 20 and to protect the network with DHCP snooping.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

6Step 6

Why this order

The correct order requires the DHCP server to be configured first so it can respond to requests. Then the IP helper-address is configured on the default gateway interface for VLAN 10 to forward client broadcasts to the server. Next, DHCP snooping is enabled globally, followed by identifying the trusted port to the server (to allow DHCP replies), and then snooping is enabled on the client VLAN.

Finally, a client connection triggers a DHCP transaction that you can verify with the snooping binding table.

Practice this question →

MCQmedium

Two switches are connected by an 802.1Q trunk. CDP reports a native VLAN mismatch. Which issue is most likely to appear because of this?

A.Untagged traffic may be placed into different VLANs on each switch.

B.All tagged traffic on the trunk is dropped immediately.

C.STP is disabled on the trunk link.

D.The trunk automatically converts to an access port.

AnswerA

When two switches have different native VLANs configured on the same 802.1Q trunk, each switch treats untagged frames as belonging to its own locally configured native VLAN. The sending switch places untagged frames into its native VLAN, while the receiving switch places them into its own native VLAN, which may be a different VLAN number. This mismatch causes untagged broadcast, multicast, and unknown unicast traffic to be placed into different VLAN domains on each switch, creating a classic native VLAN mismatch symptom.

Why this answer

A native VLAN mismatch can cause untagged traffic sent on one side to be placed into a different VLAN on the other side. That leads to confusing connectivity issues and can also create security concerns. It does not automatically disable the trunk.

Exam trap

A common exam trap is to believe that a native VLAN mismatch causes the trunk link to shut down or block all traffic. In reality, only untagged traffic is affected, and tagged VLAN traffic continues to pass normally if allowed VLANs match. Another mistake is thinking the trunk automatically converts to an access port, which Cisco switches do not do.

Candidates may also overlook that STP remains enabled and functional despite the mismatch. Focusing only on trunk status without considering untagged traffic behavior leads to incorrect answers.

Why the other options are wrong

This is incorrect because tagged traffic on the trunk is not dropped due to a native VLAN mismatch; tagged frames continue to be forwarded normally if VLANs are allowed on both sides.

This option is wrong since a native VLAN mismatch does not disable Spanning Tree Protocol; STP continues to operate normally on the trunk link.

This is incorrect because Cisco switches do not automatically convert a trunk port to an access port due to a native VLAN mismatch; the trunk remains active.

Practice this question →

PBQhard

You are connected to the console of a Catalyst 2960+ switch named SW2. Configure the switch so that the IP phone connected to interface FastEthernet0/5 receives power via PoE and uses VLAN 150 for voice traffic, while the PC connected through the phone uses VLAN 50 for data. Additionally, the access point connected to interface FastEthernet0/10 must receive PoE and be placed in VLAN 100. Assume the interfaces are already correctly configured as access ports in VLAN 50 and VLAN 100, respectively. Verify your configuration using the appropriate show commands.

Network Topology

Hints

•Use 'switchport voice vlan' to define the voice VLAN on an access port.
•Enable PoE on a port with 'power inline auto'.
•Verify voice VLAN with 'show interfaces switchport' and PoE with 'show power inline'.

A.On interface FastEthernet0/5: switchport voice vlan 150, power inline auto. On interface FastEthernet0/10: power inline auto. Verify with show interfaces switchport and show power inline.

B.On interface FastEthernet0/5: switchport voice vlan 150, power inline auto. On interface FastEthernet0/10: switchport access vlan 100, power inline auto. Verify with show interfaces switchport and show power inline.

C.On interface FastEthernet0/5: switchport voice vlan 150, power inline auto. On interface FastEthernet0/10: power inline auto. Verify with show vlan and show power inline.

D.On interface FastEthernet0/5: switchport voice vlan 150, power inline auto. On interface FastEthernet0/10: power inline auto. Verify with show interfaces trunk and show power inline.

AnswerA

solution

! SW2
configure terminal
interface FastEthernet0/5
switchport voice vlan 150
power inline auto
interface FastEthernet0/10
power inline auto
end

Why this answer

The switch had no voice VLAN or PoE configured on the ports. On FastEthernet0/5, you need to add 'switchport voice vlan 150' to separate voice traffic from data, and 'power inline auto' to enable PoE for the IP phone. On FastEthernet0/10, you only need to enable PoE with 'power inline auto' because the AP already has its access VLAN set.

After configuration, 'show interfaces switchport' will confirm the voice VLAN, and 'show power inline' will verify PoE status.

Exam trap

Avoid adding unnecessary commands like setting the access VLAN on a port that already has it configured. Also, use the correct show command: show interfaces switchport for voice VLAN, not show vlan or show interfaces trunk.

Why the other options are wrong

The error is adding an unnecessary access VLAN command for the AP port, which is not required and could conflict with existing configuration.

The error is using show vlan instead of show interfaces switchport to verify voice VLAN on a port.

The error is using show interfaces trunk, which is for trunk ports, not for verifying voice VLAN on an access port.

Practice this question →

MCQmedium

Two switches are connected by an 802.1Q trunk. Hosts in VLAN 30 cannot communicate across the link, but VLAN 10 works. What is the most likely cause?

A.VLAN 30 is missing from the allowed VLAN list on SW2

B.VLAN 10 must be removed for VLAN 30 to pass

C.The trunk should use ISL instead of 802.1Q

D.The port on SW1 should be changed to access mode

AnswerA

SW2's trunk port has an allowed VLAN list that includes only VLANs 10 and 20, so tagged frames for VLAN 30 are not forwarded from SW1 to SW2. The switchport trunk allowed vlan command acts as a filter, and VLAN 30 is excluded, causing the hosts in VLAN 30 to lose communication across the trunk. To fix the issue, the allowed list on SW2 must be updated to include VLAN 30.

Why this answer

When one VLAN works across a trunk but another does not, the most likely cause is that the failing VLAN is missing from the allowed VLAN list on one or both switches. This is often confirmed by a 'show interfaces trunk' command. Option B is incorrect because removing VLAN 10 would break an already working VLAN and does not address VLAN 30.

Option C is incorrect because both ISL and 802.1Q carry multiple VLANs; the issue is not the encapsulation protocol. Option D is incorrect because changing a trunk port to access mode would disable the trunk entirely, preventing all VLAN traffic.

Exam trap

Beware of confusing native VLAN issues with allowed VLAN list configurations. Native VLAN problems affect untagged traffic, not specific VLANs.

Why the other options are wrong

Removing VLAN 10 from the allowed list would break an already functioning VLAN and would not fix VLAN 30.

Both ISL and 802.1Q support multiple VLANs; the problem is not the trunking protocol but the allowed VLAN list.

Changing a trunk port to access mode would terminate the trunk, preventing all VLAN traffic across the link.

Practice this question →

MCQhard

A switchport connected to another switch should carry VLANs 10, 20, and 30. The interface is operational, but only VLAN 10 works. VLANs 20 and 30 fail. Which explanation is most likely if the port was accidentally configured as an access port in VLAN 10?

A.The interface is carrying only VLAN 10 because an access port does not transport multiple VLANs like a trunk.

B.VLAN 20 and 30 require different IP subnet masks on the switches.

C.Every inter-switch link must use a routed port instead of a trunk.

D.STP blocks all VLANs except VLAN 10 by design.

AnswerA

An access port is configured to carry exactly one VLAN and frames on that link are untagged. A switch-to-switch link that needs to carry VLANs 10, 20, and 30 must be configured as a trunk using 802.1Q tagging, which preserves VLAN membership by inserting a VLAN ID header. Because the port is set to access mode in VLAN 10, it drops or ignores frames from other VLANs, explaining why only VLAN 10 works.

Why this answer

An access port is limited to a single VLAN, so only VLAN 10 traverses the link. Option B is incorrect: IP subnet masks are irrelevant on switchports that operate at Layer 2. Option C is incorrect: inter-switch links typically use trunk ports, not routed ports.

Option D is incorrect: STP does not block based on VLAN IDs; it blocks redundant paths, not specific VLANs.

Exam trap

Be careful not to confuse access port limitations with trunk configuration issues. Always verify the port mode when troubleshooting VLAN connectivity.

Why the other options are wrong

IP subnet masks are Layer 3 concepts and do not affect Layer 2 VLAN propagation across a switchport. The issue here is purely Layer 2, related to the switchport mode (access vs. trunk), not IP addressing. VLANs 20 and 30 would still fail regardless of subnet mask configuration.

Routed ports are Layer 3 interfaces used for routing between networks, not for carrying multiple VLANs. The standard method for carrying multiple VLANs between switches is to use a trunk port, which tags frames with VLAN IDs. A routed port would not solve the issue and would break Layer 2 connectivity.

STP (Spanning Tree Protocol) prevents loops by blocking redundant paths, but it does not selectively block specific VLANs based on their VLAN ID. If STP were blocking VLANs 20 and 30, it would be due to a misconfiguration like PVST+ inconsistencies, not by design. The scenario describes a simple access port misconfiguration, not an STP issue.

Practice this question →

Drag & Drophard

Drag and drop the following steps into the correct order to configure a Cisco IOS-XE router as a DHCP server for a client VLAN and then enable a DHCP relay agent on a different interface to forward client requests to a remote server.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

The correct order for configuring a Cisco IOS-XE router as a DHCP server and relay agent is: first exclude addresses to prevent the DHCP server from leasing reserved IPs, then create and configure the DHCP pool (network, default gateway), next enable DHCP relay on the required interface, and finally verify. Only Option D follows this sequence exactly. Options A, B, and C are incorrect because they either place exclusion after pool creation (A) or enable relay before the pool is fully configured (B and C), which can lead to address conflicts or forwarding issues.

Exam trap

Candidates often mistakenly create the DHCP pool before excluding addresses, leading to the server leasing addresses intended to be reserved. Always configure exclusions first, then the pool, then relay, then verify.

Practice this question →

MCQhard

A switchport is configured as an access port in VLAN 10, but a user plugs in a small unmanaged switch and connects multiple devices behind it. Which security feature most directly limits that behavior at the switchport?

A.Port security

B.OSPF authentication

C.NetFlow

D.NTP

AnswerA

Port security is the correct answer because it operates directly at the switchport to restrict the number of and identity of MAC addresses allowed to send traffic. On an access port in VLAN 10, you can configure a maximum MAC address count and define allowed MACs, triggering protection actions like shutdown or restrict when a violation occurs. This functionality precisely limits endpoint behavior and secures the access layer.

Why this answer

Port security most directly limits that behavior because it can restrict how many MAC addresses are learned on the switchport. In practical terms, if the interface is supposed to support one endpoint but suddenly begins presenting multiple MAC addresses from a downstream mini-switch, port security can detect and react to that change.

This is a classic access-layer control question. VLAN assignment alone does not limit how many devices appear behind the port.

Exam trap

A frequent exam trap is assuming that VLAN assignment alone restricts the number of devices behind a switchport. VLANs only segregate traffic logically and do not prevent multiple MAC addresses from appearing on a port. Another common mistake is selecting unrelated options like OSPF authentication, which secures routing protocol exchanges but does not control Layer 2 access.

NetFlow and NTP are also unrelated to limiting connected devices. The key is recognizing that only port security directly limits how many MAC addresses can be learned on a port, thus controlling the number of connected devices.

Why the other options are wrong

OSPF authentication is unrelated to switchport security; it protects routing protocol exchanges but does not control physical or MAC-level access on a switchport.

NetFlow is a traffic monitoring tool that provides visibility into network flows but does not enforce any limits on the number of devices connected to a switchport.

NTP is used for time synchronization across network devices and does not provide any mechanism to restrict or control devices connected to a switchport.

Practice this question →

Drag & Dropmedium

Drag and drop the following steps into the correct order to configure inter‑VLAN routing between VLANs 10 and 20, using a router‑on‑a‑stick with VLAN 99 as the native VLAN on the trunk link.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

6Step 6

7Step 7

Why this order

The correct order is: first create VLANs on the switch to define the VLAN database. Second, assign switch ports to the appropriate VLANs so that end hosts are placed in their correct broadcast domains. Third, configure the switch port facing the router as an 802.1Q trunk and set the native VLAN to 99 – this allows tagged traffic from multiple VLANs to traverse a single link while matching the native VLAN on both sides.

Fourth, enable the router's physical interface (no shutdown) so that subinterfaces can pass traffic. Next, create subinterfaces for each data VLAN, specifying the correct 802.1Q encapsulation and IP address for each VLAN's default gateway. Finally, configure the native VLAN subinterface with the native keyword to ensure that untagged frames from the trunk are handled correctly and that the native VLAN is explicitly defined on the router.

Practice this question →

PBQmedium

You are connected to SW1 via the console. SW1 is a Layer 2 switch with two redundant links to SW2 (G0/1 and G0/2). The network administrator wants to use both links for load balancing and redundancy by configuring EtherChannel. You need to configure a Layer 2 EtherChannel using LACP on both switches. The port-channel should be in VLAN 1.

Network Topology

Hints

•LACP uses modes active or passive; both sides must be active or one active and one passive.
•The physical interfaces must have the same configuration before being added to the port-channel.
•The port-channel interface inherits the configuration applied to it, not the physical interfaces.

A.interface port-channel 1 switchport mode access switchport access vlan 1 interface range GigabitEthernet0/1-2 channel-group 1 mode active

B.interface port-channel 1 switchport mode trunk switchport trunk allowed vlan 1 interface range g0/1-2 channel-group 1 mode desirable

C.interface port-channel 1 switchport mode access switchport access vlan 1 interface range g0/1-2 channel-group 1 mode passive

D.interface port-channel 1 switchport mode access switchport access vlan 1 interface g0/1 channel-group 1 mode active interface g0/2 channel-group 2 mode active

AnswerA

solution

! SW1
interface GigabitEthernet0/1
channel-group 1 mode active
interface GigabitEthernet0/2
channel-group 1 mode active
interface Port-channel1
switchport mode access
switchport access vlan 1

! SW2
interface GigabitEthernet0/1
channel-group 1 mode active
interface GigabitEthernet0/2
channel-group 1 mode active
interface Port-channel1
switchport mode access
switchport access vlan 1

Why this answer

EtherChannel bundles multiple physical links into a single logical link for load balancing and redundancy. LACP (mode active) negotiates the bundle automatically. The port-channel interface must be configured with the desired switchport settings.

Exam trap

Be careful to distinguish between LACP modes (active/passive) and PAgP modes (desirable/auto). Also, remember that all interfaces in an EtherChannel must use the same channel-group number and have consistent switchport settings. A common mistake is to configure trunk when an access port is needed, or to use passive on both sides, which prevents the bundle from forming.

Why the other options are wrong

Uses PAgP mode 'desirable' instead of LACP mode 'active'. Additionally, configuring trunk is unnecessary for a single VLAN access port.

Using 'passive' on both sides would prevent the EtherChannel from forming because neither side sends LACP packets.

Using different channel-group numbers creates separate EtherChannels, not a single bundle. Both interfaces must be in the same channel-group to form one logical link.

Multi-Selectmedium

Which TWO statements correctly describe the configuration and behavior of a router-on-a-stick setup for inter-VLAN routing?

Select 2 answers

A.Each subinterface on the router must be configured with an IP address that belongs to the corresponding VLAN's subnet.

B.The switch port connecting to the router must be configured as an access port in VLAN 1.

C.The native VLAN on the trunk must be the same VLAN as the one used for management traffic.

D.The router's physical interface must be in 'no shutdown' state, but subinterfaces do not require a separate 'no shutdown' command.

E.The router's subinterface for the native VLAN must use the 'encapsulation dot1q <vlan-id> native' command.

AnswersA, D

For the router to route traffic for a VLAN, the subinterface must have an IP address in the same subnet as that VLAN. This allows the router to act as the default gateway for hosts in that VLAN.

Why this answer

Each subinterface is assigned an IP address in the subnet of its corresponding VLAN, enabling the router to act as the default gateway and route between VLANs using 802.1Q tags. Option D is correct because the physical interface must be 'no shutdown' to pass traffic, and subinterfaces inherit this state; they do not have their own shutdown command. Option B is incorrect because the switch port connecting to the router must be configured as a trunk port, not an access port, to carry multiple VLANs.

Option C is incorrect because the native VLAN on the trunk does not have to be the same as the management VLAN; they are separate concepts. Option E is incorrect because the 'encapsulation dot1q <vlan-id> native' command is only needed on the subinterface for the native VLAN to tag or untag frames appropriately; it is not required for all native VLAN configurations (e.g., if the native VLAN is left at default 1, the command may be optional).

Exam trap

The trap here is that candidates often think subinterfaces need a separate 'no shutdown' command, but Cisco tests that the physical interface must be 'no shutdown' and subinterfaces inherit that state, making option D correct.

Why the other options are wrong

The switch port must be a trunk port to carry multiple VLANs, not an access port assigned to VLAN 1.

The native VLAN on the trunk is used for untagged traffic and does not have to match the management VLAN.

The 'encapsulation dot1q <vlan-id> native' command is not always required for the native VLAN; it depends on whether the native VLAN is used for a subinterface.

Practice this question →

PBQhard

You are connected to SW1. Configure an LACP EtherChannel between SW1 and SW2 using interfaces GigabitEthernet0/1 and GigabitEthernet0/2. The port-channel interface must be configured as a trunk allowing VLANs 10, 20, and 30. Currently, the channel is not forming due to a mismatch in speed/duplex and VLAN configuration on SW2. Troubleshoot and resolve the issue so that the EtherChannel comes up as a Layer 2 trunk.

Network Topology

Hints

•Check the speed and duplex settings on SW2's physical interfaces.
•Compare the allowed VLAN list on SW2's physical interfaces to the port-channel trunk.
•Use 'show etherchannel summary' to see if ports are bundled or down.

A.On SW2, configure interfaces GigabitEthernet0/1 and 0/2 with speed 1000, duplex full, and on the port-channel interface, set allowed VLANs to 10,20,30.

B.On SW2, configure interfaces GigabitEthernet0/1 and 0/2 with speed 100, duplex half, and on the port-channel interface, set allowed VLANs to 10,20,30.

C.On SW2, configure interfaces GigabitEthernet0/1 and 0/2 with speed 1000, duplex full, and on the port-channel interface, set allowed VLANs to 10,20.

D.On SW2, configure interfaces GigabitEthernet0/1 and 0/2 with speed 1000, duplex full, and on the port-channel interface, set allowed VLANs to 1-4094.

AnswerA

solution

! SW2
interface gigabitEthernet0/1
speed 1000
duplex full
switchport trunk allowed vlan 10,20,30
interface gigabitEthernet0/2
speed 1000
duplex full
switchport trunk allowed vlan 10,20,30

Why this answer

The EtherChannel is not forming because SW2's interfaces have speed 100 and duplex half, while SW1's interfaces have speed 1000 and duplex full. Additionally, the allowed VLANs on SW2's trunk must include VLAN 30, and this should be configured on the port-channel interface, not the physical interfaces. To fix, on SW2, set the speed to 1000 and duplex to full on Gi0/1 and Gi0/2, then on the port-channel interface, configure allowed VLANs 10,20,30.

After these changes, the channel will come up as a Layer 2 trunk.

Exam trap

The exam trap is that candidates may focus solely on the speed/duplex mismatch and forget to verify the VLAN allowed list on the trunk. Also, they might incorrectly try to match by lowering SW1's settings instead of raising SW2's.

Why the other options are wrong

The specific factual error is that LACP requires all member interfaces to have identical speed and duplex settings; changing SW2 to 100/half does not match SW1's 1000/full.

The specific factual error is that the trunk must allow all required VLANs; omitting VLAN 30 violates the requirement.

The specific factual error is that the configuration does not match the requirement to allow only VLANs 10, 20, and 30; it allows all VLANs instead.

Practice this question →

MCQhard

A switch trunk must carry VLANs 10, 20, and 30, but traffic for VLAN 20 is failing. The trunk allowed list on one side is `10,30`. What is the most likely cause?

A.VLAN 20 is missing from the allowed VLAN list on one side of the trunk.

B.The trunk must be converted to an access port for VLAN 20 to work.

C.VLAN 20 must always be the native VLAN.

D.The switches must both use ISL instead of 802.1Q.

AnswerA

The allowed VLAN list is a per-trunk filter that determines which VLANs are permitted to traverse the link. If VLAN 20 is omitted from the 'switchport trunk allowed vlan' command on either side, frames tagged for VLAN 20 will be discarded at that interface, even though the trunk itself is up. The fix is to explicitly add VLAN 20 to the allowed list on the affected side. Since this is a static configuration error, no other trunk parameter or encapsulation change is needed.

Why this answer

The most likely cause is that VLAN 20 is not in the allowed VLAN list on one side of the trunk. Option B is incorrect because converting the trunk to an access port would block all other VLANs, not just fix VLAN 20. Option C is incorrect because there is no requirement that VLAN 20 must be the native VLAN; native VLAN is unrelated to allowed list filtration.

Option D is incorrect because ISL vs 802.1Q does not affect per-VLAN filtering; the allowed list is a separate configuration independent of the encapsulation type.

Exam trap

Focus on the allowed list configuration, not on VLAN existence or trunk mode. Misconfigurations in allowed lists are a common trap.

Why the other options are wrong

Converting the trunk to an access port would remove all other VLANs, not solve the selective failure for VLAN 20.

There is no requirement that VLAN 20 must be the native VLAN; the native VLAN is used for untagged traffic and is unrelated to the allowed VLAN list.

The encapsulation type (ISL vs 802.1Q) does not affect per-VLAN allowed lists; the issue is purely about the allowed list configuration.

Practice this question →

MCQhard

A network administrator has configured HSRP between RouterA and RouterB for VLAN 10. End hosts using the virtual IP 192.168.1.1 as their default gateway experience intermittent connectivity losses, and pings to 192.168.1.1 often fail. The output of 'show standby brief' on both routers shows the state as Active. What is the most likely cause?

A.The virtual IP address is configured on only one router.

B.The routers are configured with mismatched HSRP authentication methods.

C.The HSRP group number on one router is set to 0.

D.The priority on both routers is configured to the same value.

AnswerB

Mismatched authentication (e.g., MD5 vs. text) causes each router to disregard the other's HSRP hellos. Each then assumes no peers exist and becomes Active, leading to both routers claiming the virtual IP and MAC, which results in ARP table flapping and intermittent connectivity.

Why this answer

When both routers show the HSRP state as Active, a 'dual-active' scenario exists, which causes intermittent connectivity because both routers forward traffic for the virtual IP. Mismatched HSRP authentication methods (e.g., one router using plain-text authentication and the other using MD5) prevent the routers from exchanging proper Hello messages, so they fail to negotiate a single Active router. This is the most likely cause because authentication mismatches break the HSRP adjacency, leading to both routers assuming the Active role.

Exam trap

Cisco often tests the concept that HSRP authentication mismatches cause a dual-active failure, while candidates may incorrectly assume that equal priorities or group number 0 are the root cause.

Why the other options are wrong

A missing virtual IP on one router does not cause both to be Active; the router without the virtual IP cannot claim the Active role for that address.

A group number mismatch does not cause both routers to appear as Active for the same virtual IP; they would be in separate groups.

Equal priority does not lead to multiple Active routers; HSRP uses the interface IP address as a tiebreaker to elect a single Active router.

Practice this question →

MCQhard

A trunk link between two switches is up, but voice phones connected through one access switch no longer receive the correct voice VLAN treatment. Data users still pass traffic. Which area should be checked first?

A.Whether the voice VLAN is being carried and handled correctly across the switching path.

B.Whether OSPFv3 neighbors are fully adjacent on the phone switch ports.

C.Whether the wireless controller has the correct guest SSID.

D.Whether BGP uses a lower metric than the static route.

AnswerA

The correct focus is verifying that the voice VLAN is configured and permitted consistently across the entire switching path: the access ports connected to phones must carry the auxiliary voice VLAN, and the trunk between the switches must include that VLAN in its allowed list without stripping or re-tagging it incorrectly. Because the trunk is up but phones fail selectively, the fault almost certainly lies in voice VLAN propagation or 802.1Q tagging, not in physical connectivity or routing. Checking the voice VLAN's allowed status and native VLAN behavior on the trunk will reveal the misconfiguration.

Why this answer

The first area to check is the end-to-end handling of the voice VLAN across the switching path. In practical terms, the data VLAN can still work while the voice VLAN experiences a forwarding, configuration, or policy problem. Because the phones depend on the correct voice VLAN behavior, that VLAN path should be examined first rather than assuming the whole trunk is broken.

This is a selective-services troubleshooting question. One class of traffic can fail even when ordinary user data still works.

Exam trap

Be cautious not to assume that a general network issue is the cause when only specific traffic types are affected. Focus on the specific VLAN configuration first.

Why the other options are wrong

OSPFv3 is an IPv6 routing protocol and has no role in Layer 2 voice VLAN handling on access ports. The issue is about VLAN assignment and trunking, not routing protocol adjacency.

The scenario involves wired switches and IP phones, not wireless LAN. Guest SSID configuration on a wireless controller is unrelated to voice VLAN treatment on a wired trunk link.

BGP is an exterior routing protocol used for interdomain routing, not for Layer 2 VLAN handling. The symptom is about voice VLAN treatment on a trunk, which is unrelated to BGP metrics or static routes.

Practice this question →

PBQhard

You are connected to R1. Configure HSRP on R1 and R2 so that R1 is the active gateway for VLAN 100 with a virtual IP of 192.0.2.254. R1 should preempt and track its G0/1 interface to decrement priority by 20 if it goes down. Currently, both routers show active for the group, and the virtual IP is incorrectly set. Troubleshoot and fix the configuration on R1 only.

Hints

•Check the virtual IP address in the standby configuration.
•Ensure R1's priority is higher than R2's to become active.
•Preempt must be configured to re-elect after a priority change.

A.Change the virtual IP to 192.0.2.254 and set priority to 110.

B.Change the virtual IP to 192.0.2.254 and remove the track command.

C.Change the virtual IP to 192.0.2.254 and configure preempt on R2.

D.Change the virtual IP to 192.0.2.254 and set priority to 100.

AnswerA

solution

! R1
interface GigabitEthernet0/0.100
standby 1 ip 192.168.100.254
standby 1 priority 110
standby 1 preempt

Why this answer

The issue is that both routers are active because the virtual IP on R1 was 192.168.100.254, which is not in the same subnet as the interface IP (192.0.2.1/24), so HSRP couldn't form a common group. Changing the virtual IP to 192.0.2.254 fixes the subnet mismatch. Additionally, setting R1's priority to 110 ensures it becomes the active router because it has preempt configured, and the higher priority overrides R2's default 100.

The track command remains correct as it reduces priority if G0/1 fails.

Exam trap

Trap: Candidates may focus on the track command or preempt, but the primary issue is the virtual IP mismatch and default priority. Always verify the virtual IP belongs to the same subnet as the interface and adjust priority to ensure the desired active router.

Why the other options are wrong

Removing the track command would prevent R1 from decrementing priority when G0/1 fails, violating the requirement to track the interface.

Configuring preempt on R2 might allow it to take over, but the task only asks to fix R1; the primary issue is the virtual IP mismatch on R1.

Setting priority to 100 (the default) without preempt? Actually, R1 already has preempt, but with equal priority, the highest IP wins, which might be R2, so R1 might not become active. Increasing priority to 110 is required.

Practice this question →

PBQhard

You are connected to a multilayer switch MLS1. Configure FastEthernet0/1 as an access port for an IP phone and a PC, with voice VLAN 20 and data VLAN 10. Also enable PoE on the port. Then verify the configuration using 'show interfaces switchport' and 'show power inline'.

Hints

•The interface currently has 'no switchport' — remove that to make it a Layer 2 port.
•You need to set both access VLAN and voice VLAN using the switchport command.
•PoE is currently disabled globally or per interface — enable it with 'power inline auto'.

A.interface FastEthernet0/1 switchport mode access switchport access vlan 10 switchport voice vlan 20 power inline auto no shutdown

B.interface FastEthernet0/1 no switchport ip address 192.168.1.1 255.255.255.0 power inline auto no shutdown

C.interface FastEthernet0/1 switchport mode trunk switchport trunk allowed vlan 10,20 power inline auto no shutdown

D.interface FastEthernet0/1 switchport mode access switchport access vlan 10 switchport voice vlan 20 power inline never no shutdown

AnswerA

solution

! MLS1
configure terminal
interface FastEthernet0/1
switchport mode access
switchport access vlan 10
switchport voice vlan 20
power inline auto
end

Why this answer

It configures FastEthernet0/1 as an access port with data VLAN 10, voice VLAN 20, and PoE enabled, which is the required setup for an IP phone and PC. Option B is incorrect because 'no switchport' makes the interface a routed port (Layer 3), but it needs to be a Layer 2 access port to support an IP phone and PC. Option C is incorrect because trunk mode is used for switch-to-switch links, not for connecting end devices like an IP phone and PC.

Option D is incorrect because 'power inline never' disables PoE, but the IP phone requires power; it should use 'power inline auto'.

Exam trap

The trap is that candidates may incorrectly use 'no switchport' to make the interface a routed port, or use trunk mode instead of access mode with voice VLAN. Remember that for end devices, the port must be an access port; the voice VLAN is configured separately. Also, ensure PoE is enabled with 'auto', not 'never'.

Why the other options are wrong

'no switchport' creates a routed port, which cannot handle VLANs for an IP phone and PC.

Trunk mode is for inter-switch links, not for end devices; access mode is required.

'power inline never' disables PoE, but the IP phone needs power from the switch.

Practice this question →

PBQmedium

You are connected to R1 via console. R1 is a router that needs to provide DHCP services to hosts on VLAN 10 (192.168.10.0/24) and VLAN 20 (192.168.20.0/24). The router has two subinterfaces on GigabitEthernet0/0: G0/0.10 (192.168.10.1/24) and G0/0.20 (192.168.20.1/24) with 802.1Q encapsulation. Configure R1 as a DHCP server for both VLANs, excluding addresses 192.168.10.1-10 and 192.168.20.1-10, with a lease of 1 day. Ensure DNS server 8.8.8.8 is provided.

Network Topology

Hints

•Use 'ip dhcp excluded-address' to reserve addresses.
•Create DHCP pools with 'network', 'default-router', and 'dns-server'.
•Lease time is in days; use 'lease 1' for 1 day.

A.ip dhcp excluded-address 192.168.10.1 192.168.10.10 ip dhcp excluded-address 192.168.20.1 192.168.20.10 ip dhcp pool VLAN10 network 192.168.10.0 255.255.255.0 default-router 192.168.10.1 dns-server 8.8.8.8 lease 1 ip dhcp pool VLAN20 network 192.168.20.0 255.255.255.0 default-router 192.168.20.1 dns-server 8.8.8.8 lease 1

B.ip dhcp excluded-address 192.168.10.1 192.168.10.10 ip dhcp excluded-address 192.168.20.1 192.168.20.10 ip dhcp pool VLAN10 network 192.168.10.0 /24 default-router 192.168.10.1 dns-server 8.8.8.8 lease 1 0 0 ip dhcp pool VLAN20 network 192.168.20.0 /24 default-router 192.168.20.1 dns-server 8.8.8.8 lease 1 0 0

C.ip dhcp excluded-address 192.168.10.1 192.168.10.10 ip dhcp excluded-address 192.168.20.1 192.168.20.10 ip dhcp pool VLAN10 network 192.168.10.0 255.255.255.0 default-router 192.168.10.1 dns-server 8.8.8.8 lease 24 ip dhcp pool VLAN20 network 192.168.20.0 255.255.255.0 default-router 192.168.20.1 dns-server 8.8.8.8 lease 24

D.ip dhcp excluded-address 192.168.10.1 192.168.10.10 ip dhcp excluded-address 192.168.20.1 192.168.20.10 ip dhcp pool VLAN10 network 192.168.10.0 255.255.255.0 default-router 192.168.10.1 dns-server 8.8.8.8 lease 24 ip dhcp pool VLAN20 network 192.168.20.0 255.255.255.0 default-router 192.168.20.1 dns-server 8.8.8.8 lease 24

AnswerA

solution

! R1
ip dhcp excluded-address 192.168.10.1 192.168.10.10
ip dhcp excluded-address 192.168.20.1 192.168.20.10
ip dhcp pool VLAN10
network 192.168.10.0 255.255.255.0
default-router 192.168.10.1
dns-server 8.8.8.8
lease 1
ip dhcp pool VLAN20
network 192.168.20.0 255.255.255.0
default-router 192.168.20.1
dns-server 8.8.8.8
lease 1

Why this answer

Ly uses `lease 1` for a 1-day lease, dotted decimal subnet masks, and proper DHCP pool settings. Option B incorrectly uses CIDR notation `/24` in the network command, which IOS does not accept. Option C uses `lease 24`, which is interpreted as 24 days, not 1 day.

Option D also incorrectly uses `lease 24`, resulting in a 24-day lease instead of the required 1-day lease.

Exam trap

Be careful with the lease command: the default unit is days, not hours. Also, remember that the network command in DHCP pool configuration requires a subnet mask in dotted decimal format, not CIDR prefix length. Excluded addresses are configured globally, not within the pool.

Why the other options are wrong

The network command in DHCP pool configuration requires a subnet mask in dotted decimal format, not CIDR notation like /24.

The lease command uses days as its unit; `lease 24` sets a 24-day lease, not the required 1 day.

The lease command sets duration in days, so `lease 24` gives a 24-day lease instead of a 1-day lease.

MCQhard

After configuring a trunk port to allow VLAN 40, a technician finds that VLAN 40 is not listed among the VLANs in spanning tree forwarding state in the show interfaces trunk output. What is the most likely cause?

A.The trunk port is using ISL encapsulation, which does not support VLAN 40.

B.The technician omitted the 'add' keyword when adding VLAN 40 to the allowed list, so the trunk no longer permits VLAN 40.

C.VLAN 40 has not been created in the VLAN database on the switch.

D.VTP pruning is enabled, and VLAN 40 is not needed by any downstream neighbor, so it is pruned from this trunk.

AnswerC

A VLAN must be defined in the local VLAN database for the switch to build a spanning-tree instance and forward frames for that VLAN. If it is permitted on the trunk but does not exist, the switch marks it as pruned and it will not appear in the 'VLANs in spanning tree forwarding state' list. This is the exact symptom presented.

Why this answer

VLAN 40 must exist in the local VLAN database before it can participate in spanning tree on a trunk port. Even if the trunk is configured to allow VLAN 40, if the VLAN has not been created on the switch, the spanning tree protocol will not place it in a forwarding state. The 'show interfaces trunk' output will list only VLANs that are both allowed and existent, so the absence of VLAN 40 in the forwarding state indicates it was never created.

Exam trap

Cisco often tests the distinction between allowing a VLAN on a trunk and actually creating the VLAN in the VLAN database—candidates mistakenly assume that configuring the trunk alone is sufficient for the VLAN to be operational.

Why the other options are wrong

Candidates might associate VLAN support with trunk encapsulation types, but ISL fully supports VLAN 40. This is a distractor.

This is a common operational mistake, but the resulting output would show VLAN 40 missing from the 'Vlans allowed' column, not from the forwarding list.

Candidates might confuse local pruning (due to non-existent VLAN) with VTP pruning. VTP pruning would also require a multi-switch VTP domain and is less likely in a standalone troubleshooting scenario.

Practice this question →

MCQmedium

A client on VLAN 20 must obtain an IPv4 lease from a DHCP server located on VLAN 100. Which feature is required on the Layer 3 interface for VLAN 20?

A.NAT overload

B.DHCP relay

C.Port security

D.Private VLAN

AnswerB

A DHCP relay agent, configured on the VLAN 20 SVI or routed interface, listens for DHCPDISCOVER broadcasts sent by the client. It then forwards the request as a unicast to the DHCP server's IP address while adding the interface's IP address in the giaddr field, which tells the server the correct subnet for allocating an IPv4 address. The server's DHCPOFFER is relayed back to the client, enabling a successful lease across VLANs.

Why this answer

A DHCP relay agent forwards client broadcasts as unicast to the remote server, typically using ip helper-address.

Exam trap

A common exam trap is selecting NAT overload or port security as the required feature for DHCP communication across VLANs. NAT overload is used for IP address translation and does not forward DHCP broadcasts, while port security restricts MAC addresses on switch ports but does not relay DHCP messages. Another trap is confusing private VLANs with DHCP relay; private VLANs isolate Layer 2 domains but do not forward DHCP requests between VLANs.

The key is understanding that DHCP relay is the only feature that forwards DHCP broadcasts as unicast messages across Layer 3 boundaries, enabling clients on VLAN 20 to obtain leases from a DHCP server on VLAN 100.

Why the other options are wrong

NAT overload translates private IP addresses to a public IP for outbound traffic but does not forward DHCP broadcasts between VLANs. It is unrelated to DHCP relay functionality required for inter-VLAN DHCP communication.

Port security restricts which MAC addresses can connect to a switch port but does not forward DHCP broadcasts or relay DHCP messages between VLANs, so it cannot enable DHCP communication across VLANs.

Private VLANs isolate devices within a VLAN for security purposes but do not provide DHCP relay capabilities or forward DHCP requests between VLANs, making this option incorrect.

Practice this question →

MCQhard

A switchport connected to a user workstation is placed in VLAN 30. The administrator also wants to prevent that port from learning more than one MAC address. Which feature should be configured?

A.Port security

B.EtherChannel

C.OSPF passive-interface

D.Native VLAN

AnswerA

Port security is the correct answer because it directly restricts the number of unique MAC addresses that can be learned on a switchport, typically an access port connected to an end-user workstation. By configuring a maximum MAC address count (e.g., `switchport port-security maximum 1`) and violation modes like shutdown or restrict, it mitigates MAC flooding attacks and prevents unauthorized devices from connecting to that specific interface. This feature operates entirely at layer 2 and is designed precisely for securing user-facing switchports.

Why this answer

The correct feature is port security. In practical terms, port security lets the administrator control how many MAC addresses can be learned on a switchport and what happens if that limit is exceeded. That makes it a very natural fit for a user-facing access port where one endpoint is expected and unmanaged extra devices are not.

This is a common access-layer hardening technique. VLAN assignment controls where the traffic belongs, but it does not limit who or what can appear on the port. Port security adds that second layer of control.

Exam trap

Don't confuse VLAN assignment or ACLs with port security; they serve different functions.

Why the other options are wrong

EtherChannel is used to aggregate multiple physical links into a single logical link for increased bandwidth and redundancy, not to limit MAC address learning on a single port. It does not provide any mechanism to restrict the number of MAC addresses learned on a switchport.

OSPF passive-interface is a routing protocol feature used to prevent OSPF from sending hello messages on an interface, typically used on interfaces that do not have OSPF neighbors. It has no effect on MAC address learning or switchport security.

Native VLAN is a concept used on trunk ports to specify the VLAN that carries untagged traffic. It does not control MAC address learning or limit the number of MAC addresses on a switchport.

Practice this question →

MCQhard

PCs in VLAN 40 are not receiving addresses from the centralized DHCP server at 172.16.1.10. What should be configured on the VLAN 40 default gateway interface?

A.ip dhcp excluded-address 10.40.40.1 10.40.40.10

B.ip helper-address 172.16.1.10

C.service dhcp

D.ip default-gateway 172.16.1.10

AnswerB

The ip helper-address command must be applied to the VLAN 40 SVI (interface vlan 40). DHCP clients broadcast DHCPDISCOVER packets, and routers do not forward broadcasts by default; this command converts those broadcasts into unicasts and relays them to the DHCP server at 172.16.1.10. The server then replies with an address appropriate for VLAN 40's subnet, which is why this is the correct fix.

Why this answer

When DHCP clients and the DHCP server are on different subnets, the router interface serving the client subnet must relay broadcasts to the server with the ip helper-address command.

Exam trap

Ensure you understand the difference between DHCP relay and DHCP security features like snooping, as well as local DHCP server configuration.

Why the other options are wrong

The 'ip dhcp excluded-address' command is used on a DHCP server to prevent certain addresses from being assigned, not on a router interface to forward DHCP requests. This command would not help clients in VLAN 40 reach the centralized DHCP server.

The 'service dhcp' command globally enables the DHCP server or relay agent on a Cisco device, but it does not specify where to forward requests. Without the 'ip helper-address' command, DHCP broadcasts will not be forwarded to the server.

The 'ip default-gateway' command is used on a switch to set a default gateway for management purposes, not to forward DHCP broadcasts. It does not provide DHCP relay functionality.

Practice this question →

MCQhard

A multilayer switch has SVIs for VLAN 10 and VLAN 20. Hosts in both VLANs can reach their local SVI, but they cannot reach each other. Which additional configuration is most likely required?

A.Enable `ip routing` on the multilayer switch.

B.Convert all access ports into trunks.

C.Make both VLANs use the same IP subnet.

D.Disable spanning tree on both VLANs.

AnswerA

Without `ip routing`, the switch enforces its default behavior as a Layer 2 device: the SVIs exist with IP addresses but no dynamic or static route is installed to move packets between VLANs. Entering `ip routing` enables the Layer 3 forwarding engine (CEF) and makes the SVIs act as routed gateway interfaces. This is the exact missing command for inter-VLAN forwarding on a multilayer switch.

Why this answer

The most likely missing configuration is `ip routing`. In practical terms, the switch already has Layer 3 gateway interfaces for the VLANs, which is why hosts can reach their local SVI. But inter-VLAN communication still requires the switch to actually route between those VLAN interfaces. Without IP routing enabled, the SVIs can exist and respond locally without forwarding traffic between them.

This is a classic multilayer-switch question because many learners assume that creating SVIs automatically enables inter-VLAN routing. It does not. The device must also be told to behave as a Layer 3 forwarding device across those VLAN interfaces.

Exam trap

Don't assume SVIs automatically enable inter-VLAN routing; IP routing must be explicitly enabled.

Why the other options are wrong

Converting all access ports to trunks is unnecessary and incorrect because host-facing ports should remain access ports assigned to a single VLAN. Trunks are used to carry multiple VLANs between switches, not to connect end hosts. This change would not enable inter-VLAN routing.

Making both VLANs use the same IP subnet would break the fundamental purpose of VLANs, which is to separate broadcast domains and logically segment the network. Hosts in different VLANs must be in different subnets for proper routing; otherwise, they would expect to communicate directly at Layer 2, which is not possible across VLANs.

Disabling Spanning Tree Protocol (STP) on both VLANs would not enable inter-VLAN routing; it would only risk creating Layer 2 loops and broadcast storms. STP is a loop-prevention mechanism and has no role in Layer 3 routing between VLANs.

Practice this question →

MCQhard

A network engineer configures an EtherChannel between two Cisco switches SW1 and SW2 using LACP. After configuration, hosts connected to SW1 report intermittent connectivity to hosts on SW2. The engineer checks the EtherChannel status and sees that the trunk is up but only allows VLAN 1, while the hosts communicate across VLANs 10 and 20. Which command should the engineer apply to both switches to resolve the issue?

A.channel-group 1 mode active

B.switchport trunk allowed vlan 1,10,20

C.lacp rate fast

D.switchport mode trunk

AnswerB

This command ensures that all member ports of the EtherChannel have the same VLAN list. Inconsistent allowed VLANs across member ports can cause traffic to be dropped intermittently. Applying this to all member interfaces on both switches resolves the issue.

Why this answer

The output shows the EtherChannel is up but only VLAN 1 is allowed on the trunk, while the hosts on SW1 and SW2 communicate across VLANs 10 and 20. Applying 'switchport trunk allowed vlan 1,10,20' on both switches ensures all necessary VLANs are permitted over the EtherChannel, resolving the intermittent connectivity caused by dropped traffic for VLANs 10 and 20.

Exam trap

The trap here is that candidates assume the EtherChannel is fully functional once it shows as up/up, overlooking that the trunk's VLAN allowed list must match on both sides to pass traffic for all required VLANs.

Why the other options are wrong

The ports are already configured with LACP active mode, as indicated by the protocol being LACP and the ports being bundled. Reapplying this command does not address the root cause of intermittent connectivity, which is likely due to VLAN mismatch.

The 'lacp rate fast' command changes the LACP packet transmission rate to every second, which is used for faster failure detection. It does not affect VLAN consistency or cause intermittent connectivity; the issue is likely due to VLAN mismatch, not LACP rate.

The ports are already configured as trunk ports (the Po1 is Layer2 and trunking is implied). Reapplying 'switchport mode trunk' does not address the VLAN inconsistency that causes intermittent connectivity.

Practice this question →

MCQmedium

A switch port connected to an end host should forward traffic for one VLAN only and should not negotiate trunking. Which configuration approach best fits that requirement?

A.Configure the interface with `switchport mode access`

B.Configure the interface with `switchport mode trunk`

C.Configure the interface with `switchport mode dynamic desirable`

D.Configure the interface with `no switchport`

AnswerA

Configuring 'switchport mode access' forces the interface to operate in permanent access mode, disabling Dynamic Trunking Protocol (DTP) and ensuring the port carries untagged traffic for only one VLAN—usually VLAN 1 by default unless reassigned with 'switchport access vlan'. This deterministic, secure configuration is exactly what an end host expects, because most host NICs send untagged frames and rely on the switch to place them in the proper broadcast domain. It is the industry-standard best practice for connecting PCs, printers, and other typical end devices.

Why this answer

The best approach is to configure the interface as an access port. In plain language, this tells the switch that the interface is for a normal endpoint and should belong to one VLAN rather than carry multiple VLANs like a trunk. It also avoids reliance on dynamic trunk negotiation, which is usually unnecessary and potentially confusing for a user-facing connection.

This is a standard access-layer design principle. End hosts such as PCs and printers usually connect to access ports, not trunks. That is why the correct answer is the one centered on explicit access-port behavior.

Exam trap

Avoid confusing trunking features with access port requirements. Remember, end devices typically connect via access ports.

Why the other options are wrong

A trunk port is designed to carry traffic for multiple VLANs between switches, not for a single end host. Using switchport mode trunk on an access port would allow multiple VLANs and enable trunk negotiation, violating the requirement.

The dynamic desirable mode actively attempts to form a trunk with the connected device using DTP. This allows trunk negotiation, which contradicts the requirement to not negotiate trunking and to forward traffic for only one VLAN.

The no switchport command converts the Layer 2 switch port into a Layer 3 routed port, which does not operate as a switch port and cannot be assigned to a VLAN. This is used for routing between VLANs, not for connecting an end host to a single VLAN.

Practice this question →

MCQhard

A switch has DHCP snooping enabled and Dynamic ARP Inspection enabled on VLAN 30. A printer with a static IP on VLAN 30 cannot communicate because its ARP packets are being dropped. What is the best fix?

A.Disable DAI on all VLANs globally.

B.Configure a static ARP inspection entry or ARP ACL for the printer.

C.Trust the user-facing printer access port for DHCP snooping and DAI.

D.Change the printer to use a larger MTU.

AnswerB

A printer with a static IP never generates a DHCP lease, so DAI finds no matching binding entry and discards its ARP packets. By configuring a static ARP access-list entry or a static DHCP snooping binding, you give the switch an explicit IP-to-MAC mapping to validate the printer's ARP traffic. This targeted fix resolves the issue without reducing security for other hosts.

Why this answer

DAI relies on trusted bindings. Static-IP devices that are not learned through DHCP often require a static ARP ACL or equivalent trusted binding mechanism.

Exam trap

A common exam trap is to disable Dynamic ARP Inspection entirely or trust the user-facing access port to fix ARP packet drops from static IP devices. Disabling DAI weakens the network’s ARP spoofing protection, which is against best practices and exam expectations. Trusting access ports is too broad and can allow malicious ARP traffic, defeating the purpose of DAI.

The trap is that these options seem easier but compromise security, whereas the correct approach is to configure static ARP inspection entries or ARP ACLs for static IP devices to maintain security and functionality.

Why the other options are wrong

Disabling DAI on all VLANs globally removes ARP spoofing protection network-wide, which is excessive and reduces security unnecessarily. The question requires a targeted fix, so this option is incorrect.

Trusting the user-facing printer access port for DHCP snooping and DAI is too permissive and can allow malicious ARP packets, weakening security. It is not recommended as a best practice or exam answer.

Changing the printer to use a larger MTU does not affect ARP packet validation or DAI behavior. MTU size is unrelated to ARP inspection, so this option is irrelevant and incorrect.

Practice this question →

Multi-Selectmedium

Which TWO statements about 802.1Q trunking, native VLANs, and inter-VLAN routing are correct? (Choose two.)

Select 2 answers

A.802.1Q trunking is a Cisco-proprietary protocol that uses a 4-byte tag to identify VLAN membership.

B.By default, frames belonging to the native VLAN are sent untagged across an 802.1Q trunk.

C.Inter-VLAN routing can be accomplished using a Layer 2 switch configured with VLAN access maps.

D.The native VLAN must be identical on both ends of an 802.1Q trunk to avoid native VLAN mismatch errors.

E.Switches strip the 802.1Q tag from all frames before forwarding them out of a trunk port.

AnswersB, D

On an 802.1Q trunk, the native VLAN is deliberately transmitted without any VLAN tag. The receiving switch assumes that any untagged frame arriving on the trunk belongs to its configured native VLAN, which is why the administrator must ensure the native VLAN matches on both ends. This untagged behavior permits interoperability with devices that do not understand 802.1Q tagging and is enforced by default.

Why this answer

By default, 802.1Q trunking treats the native VLAN (typically VLAN 1) as untagged. Frames in the native VLAN are sent without an 802.1Q tag, allowing interoperability with devices that do not understand trunking. This behavior is defined in IEEE 802.1Q and is essential for backward compatibility.

Exam trap

Cisco often tests the misconception that all frames on a trunk are tagged, but the trap here is that the native VLAN is sent untagged by default, and candidates may incorrectly assume that inter-VLAN routing can be done with a Layer 2 switch alone.

Why the other options are wrong

802.1Q is an open IEEE standard. Cisco-proprietary trunking is Inter-Switch Link (ISL).

Layer 2 switches cannot route between VLANs. Inter-VLAN routing requires a Layer 3 device such as a router or a Layer 3 switch with SVIs.

Trunk ports forward tagged frames so the receiving switch can distinguish VLANs. Removing tags from all frames would defeat the purpose of trunking.

Practice this question →

PBQhard

You are connected to R1 via the console. The network operations center (NOC) has asked you to configure R1 as an NTP client of the NTP server at 192.0.2.10 (reachable via VLAN 100, SVI 192.168.1.1/24). They also need all system messages of level 'debug' (level 7) and higher forwarded to the syslog server at 203.0.113.50. The current configuration shows that NTP is not working (stratum 16) and syslog is only sending critical and higher messages. Fix both issues.

Network Topology

Hints

•Check the source IP of NTP packets; the server may require a specific source address.
•NTP synchronization fails if the router does not have a route to the NTP server; verify connectivity.
•The logging trap level controls which severity messages are sent; 'critical' only sends levels 0-2.

A.Configure 'ntp source Vlan100' and 'logging trap debugging'.

B.Configure 'ntp server 192.0.2.10' and 'logging trap 7'.

C.Configure 'ntp source Vlan100' and 'logging trap warnings'.

D.Configure 'ntp update-calendar' and 'logging trap informational'.

AnswerA

solution

! R1
ntp source Vlan100
logging trap debugging

Why this answer

The NTP client is not synchronizing because there is no source interface specified; the NTP packets may be sourced from an unexpected interface and the server may ignore them. The solution is to configure 'ntp source Vlan100' to ensure NTP packets use the correct source IP. Additionally, the syslog trap level is set to 'critical', which filters out messages with severity lower than critical (like warnings, errors, etc.).

The NOC requires all messages up to debug level; therefore, change the logging trap level to 'debugging' with 'logging trap debugging'.

Exam trap

Do not confuse the NTP server command with the source interface command. The server command specifies the server, but the source interface ensures the correct source IP. For syslog, remember that 'debugging' is the keyword for the lowest severity level; using 'warnings' or 'informational' will exclude debug messages.

Why the other options are wrong

The specific factual error: 'logging trap 7' is not a valid Cisco IOS command; the correct command uses the keyword 'debugging'. Also, the NTP server command alone does not fix the source interface issue.

The specific factual error: 'logging trap warnings' only sends messages with severity 0-4, missing severity 5-7 (notifications, informational, debug).

The specific factual error: 'ntp update-calendar' is not needed for NTP synchronization; the source interface is the key missing piece. 'logging trap informational' does not include debug messages.

Practice this question →

MCQmedium

A switchport is configured as an access port for VLAN 20, but users connected to it cannot reach the default gateway. The switch shows the interface as up/up. Which switch misconfiguration is the most likely cause?

A.The access port is missing a speed command

B.VLAN 20 has not been created on the switch

C.The switch has not enabled VTP transparent mode

D.The port should use DTP desirable mode

AnswerB

When a switchport is configured as an access port in a VLAN that does not exist in the switch's VLAN database, the port will not become active in that VLAN. The switch will not forward traffic for the nonexistent VLAN; the port typically remains in a down or inactive state until the VLAN is created. Creating the VLAN with 'vlan 20' in global configuration mode and assigning it a name is required before the access port can pass traffic for VLAN 20. Even though the port configuration may be accepted, the port will not operate correctly until the VLAN exists.

Why this answer

If the access port is assigned to VLAN 20 but VLAN 20 does not exist in the VLAN database, traffic is not placed into a usable VLAN and hosts lose connectivity. The port can still appear physically up while forwarding fails at Layer 2.

Exam trap

A common exam trap is assuming that an interface showing up/up means the port is fully functional and correctly forwarding traffic. Candidates may overlook the necessity of creating the VLAN in the switch’s VLAN database. Without VLAN 20 existing, the switch cannot forward traffic for that VLAN, even though the physical link is active.

This leads to confusion because the interface status does not reflect VLAN misconfiguration, causing users to lose connectivity to the default gateway despite the port appearing operational.

Why the other options are wrong

The absence of a speed command on the access port does not prevent VLAN forwarding or connectivity to the default gateway. Speed settings affect physical link parameters but not VLAN membership or Layer 2 forwarding.

VTP transparent mode controls VLAN propagation between switches but does not affect whether a VLAN exists locally. Missing VLANs must be created manually regardless of VTP mode.

DTP desirable mode is used to negotiate trunk links and is irrelevant for access ports, which do not trunk and only carry untagged frames for a single VLAN.

Practice this question →

MCQmedium

A switch interface connects to a user PC and should belong only to VLAN 30. Which command assigns that VLAN after the interface is in access mode?

A.switchport access vlan 30

B.switchport trunk allowed vlan 30

C.encapsulation dot1Q 30

D.ip helper-address 30

AnswerA

This is the correct command to place an interface into VLAN 30 as an access port. When configured on a switchport that is set to access mode, it assigns that single VLAN to the port, allowing the user PC to communicate with other devices in VLAN 30 while isolating it from other VLANs. This is the standard method for connecting end devices like PCs, printers, and IP phones to a switch.

Why this answer

After an interface is placed into access mode, the command used to assign its VLAN is `switchport access vlan 30`. In plain language, this tells the switch which VLAN the endpoint traffic on that access port belongs to. Access mode defines the role of the interface, and the access VLAN command defines the specific VLAN membership for that role.

This distinction matters because some commands change the port’s behavior while others set the VLAN it uses. The correct answer is the one that directly assigns VLAN 30 to the access port rather than modifying a trunk or a native VLAN setting.

Exam trap

Be careful not to confuse commands for trunk ports with those for access ports. Ensure you understand the difference between setting a port mode and assigning a VLAN.

Why the other options are wrong

The command 'switchport trunk allowed vlan 30' is used on trunk ports to specify which VLANs are allowed to traverse the trunk link. It does not assign a VLAN to an access port; instead, it filters VLANs on a trunk, which is not appropriate for a port connected to a single PC.

The command 'encapsulation dot1Q 30' is used on a router subinterface to enable 802.1Q trunking and specify the VLAN for that subinterface. It is not a valid command on a switch access port, and switch ports do not use encapsulation commands for VLAN assignment.

The command 'ip helper-address 30' is used to configure DHCP relay on a router or Layer 3 switch interface, forwarding DHCP broadcasts to a DHCP server. It has nothing to do with VLAN assignment on a switch port.

Practice this question →

MCQhard

PCs in VLAN 30 on SwitchA cannot reach PCs in VLAN 30 on SwitchB. VLAN 30 exists on both switches and all other VLANs work across the same link. Based on the exhibit, what is the most likely cause?

A.VLAN 30 is not allowed on the trunk from SwitchA.

B.The native VLAN is mismatched.

C.The trunk must use ISL instead of 802.1Q.

D.VLAN 30 must be configured as the native VLAN.

AnswerA

VLAN 30 is not included in SwitchA's trunk allowed list, so frames from VLAN 30 are not forwarded over the trunk to SwitchB. Unlike the native VLAN, which is untagged, VLAN 30 must be explicitly permitted with the switchport trunk allowed vlan command on both ends. Without this entry, all VLAN 30 traffic remains isolated to the local switch, preventing PCs on SwitchB from reaching those on SwitchA.

Why this answer

The trunk is up, but VLAN 30 is missing from the allowed list on SwitchA. In plain language, the hallway between the switches is open, but one side is refusing to carry that specific VLAN through the hallway. Since the other VLANs are working, the failure is selective rather than total. That strongly points to an allowed-VLAN problem rather than a broader trunk outage.

This is a classic CCNA switching scenario because it tests whether you can separate trunk health from per-VLAN forwarding. A trunk can be operational and still block one VLAN if that VLAN is not permitted on one side. The native VLAN and encapsulation are not the issue shown here — the mismatch in the allowed list is.

Exam trap

Be careful not to confuse general trunk issues with specific VLAN forwarding problems. Always check the allowed VLAN list when specific VLANs fail to pass.

Why the other options are wrong

The exhibit shows both switches have native VLAN 1 configured, so there is no mismatch. A native VLAN mismatch would cause all VLAN traffic to fail or be misdirected, not just a single VLAN.

Since other VLANs are working across the same trunk, the trunk encapsulation (802.1Q) is functioning correctly. Changing to ISL would not fix the issue and would break connectivity for all VLANs.

A VLAN does not need to be the native VLAN to traverse a trunk; native VLAN is only for untagged traffic. Making VLAN 30 the native VLAN would not solve the problem and could introduce other issues.

Practice this question →

PBQhard

You are troubleshooting a client connectivity issue on PC1, which is connected to switch SW1. PC1 reports that it cannot access the internet, but it can ping its default gateway (192.168.1.1). The network uses VLAN 10 for the client subnet. Examine the following show outputs: On PC1, ipconfig shows IP 192.168.1.10, default gateway 192.168.1.1, DNS server 192.168.1.1. On SW1, show running-config includes 'interface Vlan10' with IP 192.168.1.1 255.255.255.0, but no 'ip dns server' and no 'ip name-server' commands. SW1's show ip route displays a default route via 203.0.113.1. Identify the root cause. Configure the necessary fix on the appropriate device to restore full connectivity.

Network Topology

Hints

•Check DNS configuration on the switch.
•The PC's DNS server is likely the default gateway (switch).
•The switch needs to be configured to forward DNS queries.

A.Configure 'ip dns server' and 'ip name-server 8.8.8.8' on SW1.

B.Configure 'ip default-gateway 192.168.1.1' on SW1.

C.Configure 'ip route 0.0.0.0 0.0.0.0 203.0.113.1' on SW1.

D.Configure 'ip domain-lookup' on SW1.

AnswerA

solution

! SW1
ip name-server 8.8.8.8

Why this answer

PC1 is configured with DNS server 192.168.1.1, which is the switch SW1. However, SW1 lacks DNS forwarding capability. To enable DNS relay on the switch, both the 'ip dns server' command (to activate the DNS forwarder) and 'ip name-server 8.8.8.8' (to point to an upstream resolver) are required.

Option A provides the necessary configuration to restore DNS resolution and internet connectivity.

Exam trap

Do not assume that internet connectivity issues are always routing problems. When a client can ping the gateway but cannot access websites, the issue is often DNS. Also, remember that 'ip name-server' configures DNS servers, while 'ip domain-lookup' only enables the DNS client feature.

Why the other options are wrong

A default gateway is needed only for management traffic from the switch itself, not for DNS forwarding; the switch already communicates with the router via its default route.

A static default route is already present and unrelated to DNS resolution; adding another route would not solve the name resolution failure.

The 'ip domain-lookup' command only enables the DNS client on the switch itself, not DNS forwarding for clients like PC1.

Practice this question →

PBQhard

You are connected to SW1 via the console. The network uses Rapid-PVST+ and you need to ensure that SW1 becomes the root bridge for VLAN 10 and VLAN 20. Additionally, configure PortFast and BPDU Guard on interface GigabitEthernet0/1, which connects to a workstation. After configuration, the workstation is moved and the port goes err-disabled. Diagnose the cause and recover the port without reloading the switch.

Network Topology

Hints

•Use 'spanning-tree vlan <vlan> priority <value>' to set root bridge priority (lower values are preferred).
•A port in err-disabled due to BPDU Guard must be manually recovered with 'shutdown' and 'no shutdown' after removing the BPDU source.
•Check which VLANs the switch is currently root for using 'show spanning-tree'.

A.Configure spanning-tree vlan 10 priority 4096 and spanning-tree vlan 20 priority 4096. Then on interface GigabitEthernet0/1, configure spanning-tree portfast and spanning-tree bpduguard enable. After removing the BPDU source, use 'shutdown' and 'no shutdown' to recover the port.

B.Configure spanning-tree vlan 10,20 root primary and spanning-tree portfast on Gi0/1; then use 'errdisable recovery cause bpduguard' to automatically recover the port.

C.Configure spanning-tree vlan 10,20 priority 0 and spanning-tree bpduguard enable on Gi0/1; then use 'no spanning-tree bpduguard' to recover the port.

D.Configure spanning-tree vlan 10,20 priority 4096 and spanning-tree portfast on Gi0/1; then use 'clear spanning-tree detected-protocols' to recover the port.

AnswerA

solution

! SW1
spanning-tree vlan 10 priority 4096
spanning-tree vlan 20 priority 4096
interface GigabitEthernet0/1
shutdown
no shutdown

Why this answer

SW1 is currently the root for VLAN 10 but not for VLAN 20. To become root for both VLANs, set the spanning-tree priority to a lower value (e.g., 4096) for each VLAN. The port Gi0/1 went err-disabled because it received a BPDU, which is unexpected on a PortFast edge port with BPDU Guard enabled.

To recover, first identify and remove the BPDU source (likely another switch connected to that port), then use 'shutdown' followed by 'no shutdown' on the interface to bring it back up.

Exam trap

Do not confuse 'root primary' with a guaranteed root election; always check for lower priorities. Also, remember that err-disabled ports require manual intervention (shutdown/no shutdown) unless you configure errdisable recovery. BPDU Guard err-disables the port; simply disabling BPDU Guard does not recover it.

Why the other options are wrong

The 'root primary' command does not guarantee root status if another switch has a priority lower than 24576. The question expects manual recovery, not automatic.

Priority 0 is not incorrect but is not the standard recommendation. The recovery method is wrong: disabling BPDU Guard does not clear the err-disabled state.

The command 'clear spanning-tree detected-protocols' does not clear the err-disabled state; it only resets the port's protocol state.

Practice this question →

MCQhard

A network technician is troubleshooting a connectivity issue for a PC connected to switch port Gi1/0/12. The PC can ping its default gateway (192.168.10.1) but cannot ping a server at 192.168.20.10. The switch is configured with VLAN 10 for the access port and is connected to a router-on-a-stick. The technician runs 'show vlan brief' and 'show interfaces trunk' on the switch. What is the most likely cause of the problem?

A.The trunk port Gi1/0/24 is not in trunking mode.

B.The router is missing a subinterface for VLAN 20.

C.The switch port Gi1/0/12 is not assigned to VLAN 10.

D.The PC has a duplicate IP address with the server.

AnswerB

This is the correct answer because the router is configured for router-on-a-stick inter-VLAN routing but only has a subinterface for VLAN 10. Since the router lacks a subinterface with the appropriate 802.1Q encapsulation and an IP address in the VLAN 20 subnet, it simply drops or ignores VLAN 20 frames arriving over the trunk. Even though the switch and trunk are configured correctly, VLAN 20 hosts have no default gateway on the router and therefore cannot route traffic to VLAN 10 or any other network.

Why this answer

The PC can ping its default gateway (192.168.10.1) but not the server at 192.168.20.10, indicating Layer 3 routing is failing between VLANs. Since the switch is configured with VLAN 10 for the access port and uses a router-on-a-stick, the router must have a subinterface for VLAN 20 to route traffic to the server's subnet. The absence of a subinterface for VLAN 20 prevents the router from forwarding packets from VLAN 10 to VLAN 20, making option B correct.

Exam trap

Cisco often tests the misconception that a trunk misconfiguration (option A) is the cause, but the PC's ability to ping the gateway confirms the trunk is working for VLAN 10, so the real issue is the missing subinterface for the destination VLAN.

Why the other options are wrong

The trunk port Gi1/0/24 is in 'on' mode and trunking, as shown in 'show interfaces trunk'. Therefore, the trunk is operational and not the cause of the issue.

The 'show vlan brief' output shows that port Gi1/0/12 is assigned to VLAN 10, so the PC is in the correct VLAN. This is not the issue.

A duplicate IP address would cause connectivity issues to the gateway as well, but the PC can ping the gateway successfully. Therefore, duplicate IP is not the problem.

Practice this question →

MCQhard

A network administrator is troubleshooting a connectivity issue between two remote sites connected via a WAN link. Hosts on VLAN 10 at Site A (192.168.10.0/24) cannot ping the server at Site B (10.10.20.100). The router at Site A has a default route configured with the next-hop IP address 10.10.10.2. The administrator checks the routing table on Router A and notices that the default route is not installed. What is the most likely cause of the problem?

A.The static route for 10.10.20.0/24 is missing from the routing table.

B.The GigabitEthernet0/0 interface is administratively down.

C.The default route is not configured; the gateway of last resort is missing.

D.The next-hop router 10.10.10.2 is unreachable.

AnswerD

A static route with a next-hop IP is only installed in the routing table when that next-hop is reachable. Since the default route is missing from the routing table, the next-hop 10.10.10.2 must be unreachable, making option D the correct diagnosis.

Why this answer

The default route uses a next-hop IP (10.10.10.2) and will only be installed in the routing table if that next-hop is reachable. Since the router’s routing table shows no default route, the most likely cause is that the next-hop 10.10.10.2 is unreachable, preventing the static route from being used. This explains why traffic fails despite the configuration.

Exam trap

Cisco often tests the misconception that a default route alone guarantees connectivity, when in reality the next-hop must be reachable; candidates may overlook verifying the next-hop's availability.

Why the other options are wrong

The routing table shows a static route to 10.10.20.0/24 via 10.10.10.2, so the route is present. The issue is not a missing route.

The interface is shown as directly connected with a local address, indicating it is up and operational. An administratively down interface would show 'administratively down' in the status.

The output shows 'Gateway of last resort is 10.10.10.2 to network 0.0.0.0', confirming the default route is configured.

Practice this question →

PBQhard

You are connected to a Multilayer Switch MLS1. Configure the switch so that interface GigabitEthernet1/0/1 is an access port for VLAN 10, with voice VLAN 110 for an IP phone, and enable PoE. Additionally, interface GigabitEthernet1/0/2 must be an access port for VLAN 20 to connect an AP. Verify the configuration using 'show interfaces switchport' and 'show power inline'.

Network Topology

Hints

•Use 'switchport mode access' to set the port as an access port.
•For the IP phone port, apply both 'switchport access vlan' and 'switchport voice vlan' commands.
•PoE is enabled by default but ensure 'power inline auto' is configured.

A.interface GigabitEthernet1/0/1 switchport mode access switchport access vlan 10 switchport voice vlan 110 power inline auto interface GigabitEthernet1/0/2 switchport mode access switchport access vlan 20

B.interface GigabitEthernet1/0/1 switchport mode trunk switchport trunk allowed vlan 10,110 power inline auto interface GigabitEthernet1/0/2 switchport mode access switchport access vlan 20

C.interface GigabitEthernet1/0/1 switchport mode access switchport access vlan 10 switchport voice vlan 110 power inline never interface GigabitEthernet1/0/2 switchport mode access switchport access vlan 20

D.interface GigabitEthernet1/0/1 switchport mode access switchport access vlan 110 switchport voice vlan 10 power inline auto interface GigabitEthernet1/0/2 switchport mode access switchport access vlan 20

AnswerA

solution

! MLS1
interface GigabitEthernet1/0/1
switchport mode access
switchport access vlan 10
switchport voice vlan 110
power inline auto
exit
interface GigabitEthernet1/0/2
switchport mode access
switchport access vlan 20
exit

Why this answer

It configures Gi1/0/1 as an access port in VLAN 10 with voice VLAN 110 and PoE enabled, and Gi1/0/2 as an access port in VLAN 20. Option B is wrong because it uses 'switchport mode trunk' instead of 'switchport mode access'. For a voice VLAN, the port should be an access port, not a trunk.

Option C is wrong because it disables PoE with 'power inline never', but the IP phone requires power. Option D is wrong because it assigns the access VLAN as 110 and voice VLAN as 10, reversing the intended roles. Verify with 'show interfaces switchport' and 'show power inline'.

Exam trap

Watch out for the difference between access and trunk ports when a voice VLAN is involved. The voice VLAN is configured on an access port, not a trunk. Also, ensure PoE is enabled (auto) and not disabled (never).

Finally, do not confuse the access VLAN with the voice VLAN.

Why the other options are wrong

The specific factual error is using 'switchport mode trunk' instead of 'switchport mode access'. Access ports are used for end devices like IP phones and APs, not trunks.

The specific factual error is using 'power inline never' which disables PoE. The correct command to enable PoE is 'power inline auto'.

The specific factual error is reversing the VLAN assignments: 'switchport access vlan 110' and 'switchport voice vlan 10' instead of the correct order.

Practice this question →

MCQhard

A network technician notices CDP native VLAN mismatch warnings between switches SW1 and SW2 on their trunk link. The technician runs 'show interfaces trunk' on SW1 and sees native VLAN 1, then on SW2 and sees native VLAN 99. Data traffic is currently passing, but the mismatch can cause broadcast loops. What should the technician do next?

A.Add VLAN 99 to the allowed VLAN list on the trunk interface of SW1.

B.Remove the trunk configuration and set both interfaces as access ports in VLAN 1.

C.Enable spanning‑tree PortFast on the trunk ports.

D.Configure the native VLAN to match on both ends of the trunk.

AnswerD

The root cause is a configured native VLAN mismatch (1 vs 99). Changing one switch’s native VLAN to match the other (or setting both to a common VLAN) immediately resolves the CDP warning and eliminates the potential for broadcast loops caused by the mismatch. This is the most direct and least disruptive next step.

Why this answer

The correct action is to configure the native VLAN to match on both ends of the trunk. CDP reports a native VLAN mismatch when the native VLANs differ on the two sides of a trunk link. Although data traffic may still pass because 802.1Q does not tag frames on the native VLAN, the mismatch can cause broadcast loops and security risks, as frames from one native VLAN may be misinterpreted on the other side.

Setting both sides to the same native VLAN (e.g., VLAN 1 or VLAN 99) resolves the mismatch and ensures proper Layer 2 behavior.

Exam trap

Cisco often tests the misconception that data traffic passing means the configuration is fine, but the trap here is that the native VLAN mismatch can still cause serious issues like broadcast loops and security vulnerabilities, even if user data appears to work.

Why the other options are wrong

Common misconception: the warning message implies a VLAN is not allowed, but native VLAN mismatch means the trunk ports disagree on the native VLAN, not that a VLAN is missing from the allowed list.

Over‑reaction: candidates might think a trunk problem requires eliminating the trunk, but the correct approach is to correct the native VLAN parameter on the existing trunk.

Wrong feature: PortFast addresses access port convergence, not VLAN mismatches. Candidates may reach for any familiar command, but it targets the wrong layer and port type.

Practice this question →

MCQhard

A trunk link between two switches is operational, but one side shows a native VLAN mismatch warning. What is the main concern with that condition?

A.Untagged traffic may be associated with different VLANs on each end of the trunk

B.All tagged VLAN traffic is automatically converted to routed traffic

C.The mismatch forces OSPF adjacency reset on all routers

D.The trunk can carry only one VLAN until the mismatch is cleared

AnswerA

On an IEEE 802.1Q trunk, the native VLAN is the only VLAN whose frames are sent untagged. If the two switches have different native VLANs configured, untagged frames arriving on the trunk are placed into the receiving switch's configured native VLAN, which may be a different VLAN than the one used by the sending switch. This causes the untagged traffic to be silently associated with the wrong VLAN, breaking Layer 2 segmentation and potentially creating a security or bridging loop, while tagged VLAN traffic still works normally.

Why this answer

A native VLAN mismatch can cause untagged traffic to be interpreted as belonging to different VLANs on each end of the trunk. In plain language, the two switches disagree about where untagged frames belong. That can lead to confusing traffic behavior, reachability problems for certain flows, and operational warnings. It is not always a total outage, but it is a design inconsistency that should be corrected.

This matters because trunks carry multiple VLANs, and the native VLAN defines how untagged traffic is handled. If both ends do not agree, the logical treatment of those frames becomes inconsistent. The correct answer is the one that focuses on misclassification of untagged traffic, not on unrelated routing behavior.

Exam trap

Be careful not to confuse native VLAN mismatches with general trunk failures or issues affecting tagged traffic.

Why the other options are wrong

A native VLAN mismatch does not convert tagged traffic into routed traffic. Tagged frames continue to be switched based on their VLAN tags, and the trunk remains a Layer 2 link. The mismatch only affects untagged frames on the native VLAN.

A native VLAN mismatch is a Layer 2 trunking issue and does not directly affect OSPF or any routing protocol. OSPF adjacency is a Layer 3 process and would only be impacted if the mismatch caused connectivity loss for the router interfaces, but the mismatch itself does not force OSPF adjacency resets.

A native VLAN mismatch does not prevent the trunk from carrying other tagged VLANs. Tagged frames for other VLANs are still forwarded correctly because they are not affected by the native VLAN configuration. The trunk can carry multiple VLANs, but the native VLAN traffic is misdirected.

Practice this question →

Multi-Selectmedium

Which four of the following are characteristics of Dynamic Trunking Protocol (DTP) and VLAN Trunking Protocol (VTP) used in Cisco switching? (Choose four.)

Select 4 answers

.DTP is a Cisco proprietary protocol used to negotiate trunking between two switches.

.VTP allows synchronization of VLAN information across switches in the same VTP domain.

.A switch configured with 'switchport mode dynamic desirable' actively attempts to form a trunk using DTP.

.VTP pruning helps reduce unnecessary broadcast traffic by limiting flooded traffic to only switches that need the VLAN.

.VTP transparent mode stores and forwards VTP advertisements but also modifies the VLAN database based on received updates.

.DTP can form a trunk regardless of whether both ends are configured with 'switchport nonegotiate'.

Why this answer

The four correct statements are: (1) DTP is a Cisco proprietary protocol for negotiating trunk links; (2) VTP synchronizes VLAN information across switches in the same VTP domain; (3) 'switchport mode dynamic desirable' actively sends DTP frames to form a trunk; (4) VTP pruning reduces unnecessary broadcast traffic by limiting flooded traffic to only switches that need the VLAN. The two incorrect statements: VTP transparent mode forwards VTP advertisements but does **not** modify its VLAN database based on received updates—it only passes them through. DTP **cannot** form a trunk when both ends are configured with 'switchport nonegotiate' because that command disables DTP frame transmission entirely, preventing trunk negotiation.

Exam trap

Cisco often tests the distinction between DTP modes (dynamic desirable vs. dynamic auto) and the fact that VTP can cause catastrophic VLAN propagation errors if revision numbers are not reset before adding a switch to a production network.

Practice this question →

MCQhard

A switch displays the following output: Switch# show interfaces trunk Port Mode Encapsulation Status Native vlan Gi1/0/24 on 802.1q trunking 99 Port Vlans allowed on trunk Gi1/0/24 10,20,30 Port Vlans active in management domain Gi1/0/24 10,20,30,40 Users in VLAN 40 cannot reach resources across this trunk. What is the most likely reason?

A.VLAN 40 is active, so spanning tree must be blocking it

B.VLAN 40 is not in the native VLAN, so it cannot cross the trunk

C.VLAN 40 is not permitted on the trunk

D.802.1Q trunks can carry only three VLANs at a time

AnswerC

Correct. This is correct. The allowed VLAN list controls which VLANs are transported across the trunk. Because VLAN 40 is absent from that list, users in VLAN 40 cannot use that trunk to reach resources on the far side.

Why this answer

The trunk is not carrying VLAN 40 because VLAN 40 is missing from the allowed VLAN list (only 10, 20, 30 are allowed). Option A is incorrect because spanning tree does not block VLANs by default without evidence of a loop; the output shows no STP blocking. Option B is incorrect because native VLAN only affects tagging, not whether a VLAN can traverse a trunk; all VLANs can cross a trunk if permitted.

Option D is incorrect because 802.1Q can carry up to 4094 VLANs, not just three. The key distinction is that a VLAN may be active on the switch but still fail to cross a specific trunk if it is not in the allowed list.

Exam trap

Ensure you differentiate between VLANs configured on the switch and those allowed on the trunk. Just because a VLAN is active doesn't mean it's allowed on a trunk.

Why the other options are wrong

Spanning Tree Protocol (STP) can block a VLAN if there is a loop, but the output shows VLAN 40 is active in the management domain and not listed as blocked. The explicit absence of VLAN 40 from the allowed VLAN list is the direct cause, not STP.

The native VLAN is only for untagged traffic on an 802.1Q trunk. All other VLANs are tagged and can cross the trunk regardless of the native VLAN. VLAN 40 is not the native VLAN, but that does not prevent it from being carried if permitted.

802.1Q has no limit of three VLANs per trunk; it can support up to 4094 VLANs. The output shows only three VLANs allowed because of configuration, not a protocol limitation.

Practice this question →

MCQhard

A network administrator has configured a DHCP server on VLAN 100 with an IP address of 192.168.100.10/24. Clients on VLAN 200 (192.168.200.0/24) report that they cannot obtain an IP address via DHCP. The router is configured with a DHCP relay on the VLAN 200 interface. The administrator checks the router configuration and verifies that the relay is in place, but clients still fail to get an address. The switch that the router and clients connect to has DHCP snooping enabled. What is the most likely cause of this issue?

A.The DHCP server is on a different subnet and the relay address is incorrect.

B.DHCP snooping is blocking the relay agent because the relay interface is not trusted.

C.The DHCP server is unreachable from the router.

D.The ip helper-address command is missing from the VLAN 200 interface.

AnswerB

The 'show ip dhcp relay information trusted' output shows 'Not configured', which means the relay agent is not trusting the DHCP server's responses. This causes the switch to drop DHCP server responses when DHCP snooping is enabled. The fix is to configure 'ip dhcp relay information trusted' on the interface facing the DHCP server.

Why this answer

The scenario states that DHCP snooping is enabled on the switch. When DHCP snooping is active, it discards DHCP messages received on untrusted ports. The router's VLAN 200 interface, which is configured as a DHCP relay agent, must be configured as a trusted port for DHCP snooping; otherwise, the relayed messages are silently dropped.

Option A is incorrect because the relay address is correctly pointing to the DHCP server's subnet. Option C is too generic and unlikely since the router and switch are directly connected. Option D is incorrect because the relay is verified to be in place.

Therefore, the most likely cause is DHCP snooping blocking the relay agent due to the relay interface not being trusted.

Exam trap

Cisco often tests the misconception that a correctly configured DHCP relay alone guarantees DHCP operation, ignoring that DHCP snooping can silently drop relayed messages if the relay interface is not trusted.

Why the other options are wrong

The relay address 192.168.100.10 is correctly configured to point to the DHCP server on VLAN 100. The issue is not with the relay address being incorrect.

The DHCP server is on the same router (VLAN 100 interface) and is reachable; the relay configuration is correct. The server is not unreachable.

The exhibit shows 'ip helper-address 192.168.100.10' is configured on GigabitEthernet0/1, which is the VLAN 200 interface. The command is present.

Practice this question →

MCQhard

A multilayer switch has SVIs for VLAN 10 and VLAN 20, but hosts in those VLANs still cannot reach each other. The SVIs are up/up. Which additional condition is most likely required?

A.IP routing must be enabled on the multilayer switch

B.Every access port must be converted to a trunk

C.DHCP snooping must be disabled globally

D.The switch must remove all VLAN assignments

AnswerA

IP routing must be enabled globally on the multilayer switch (via the 'ip routing' command) so it can forward packets between the Layer 3 SVIs for VLAN 10 and VLAN 20. Without this, the switch operates only at Layer 2 and will not perform a routing lookup, so frames arriving in one VLAN cannot be forwarded out the other VLAN's SVI. Each SVI must also be up/up and assigned an IP address in a distinct subnet for the routing table to have valid directly connected routes.

Why this answer

If the SVIs are up but inter-VLAN traffic still fails, the most likely missing condition is that IP routing is not enabled on the multilayer switch. In plain language, the switch has the VLAN gateway interfaces present, but it has not been told to behave as a Layer 3 router between them. Without IP routing enabled, the SVIs can exist and still not actually route traffic between VLANs.

This is a classic multilayer-switch design issue because many learners assume the presence of SVIs alone automatically creates routing. In reality, routed forwarding between VLANs still requires the switch to operate as a Layer 3 device. That is why enabling routing is the best answer.

Exam trap

Don't assume SVIs automatically enable routing; IP routing must be explicitly configured.

Why the other options are wrong

Converting all access ports to trunk ports is unnecessary and incorrect for inter-VLAN routing. Access ports belong to a single VLAN, and hosts connect via access ports. Trunk ports are used to carry multiple VLANs between switches, not to connect end hosts.

Changing all ports to trunks would break connectivity for hosts.

DHCP snooping is a security feature that filters DHCP messages and does not affect Layer 3 routing between VLANs. Disabling it would not enable inter-VLAN communication. The issue is routing, not DHCP.

Removing all VLAN assignments would break the network entirely, as hosts would lose their VLAN membership and connectivity. VLANs are essential for segmenting the network; removing them would not solve the routing issue.

Practice this question →

PBQhard

You are connected to R1, a multilayer switch acting as the root bridge for VLAN 10. The network has experienced a loop, and interface GigabitEthernet0/1 on R1 is currently in err-disabled state due to a BPDU guard violation. Configure the switch to recover automatically from err-disable state after 300 seconds, then verify that the interface comes back up.

Hints

•The errdisable recovery command is in global configuration mode.
•Use the 'show errdisable recovery' command to check the current causes and timers.
•The interface will not recover immediately; you can use 'clear errdisable interface Gi0/1' to test manually.

A.Configure 'errdisable recovery cause bpduguard' and 'errdisable recovery interval 300' globally, then verify with 'show interfaces status'.

B.Configure 'spanning-tree portfast bpduguard default' and 'errdisable recovery interval 300' globally, then verify with 'show spanning-tree'.

C.Configure 'errdisable recovery cause all' and 'errdisable recovery interval 300' globally, then verify with 'show errdisable recovery'.

D.Configure 'errdisable recovery cause bpduguard' and 'errdisable recovery interval 300' on interface GigabitEthernet0/1, then verify with 'show interfaces GigabitEthernet0/1'.

AnswerA

solution

! R1
errdisable recovery cause bpduguard
errdisable recovery interval 300

Why this answer

The interface Gi0/1 is in err-disabled state because BPDU Guard detected an unexpected BPDU on a PortFast-enabled access port. To recover automatically, configure errdisable recovery cause bpduguard and set the recovery interval to 300 seconds with errdisable recovery interval 300. After applying these commands, the interface will automatically come out of err-disable state after 300 seconds.

The blocking port on Gi0/2 is expected because R1 is the root bridge and Gi0/2 is an alternate port providing redundancy; no action is needed for that blocking state.

Exam trap

The trap is that candidates may confuse enabling BPDU guard with configuring recovery, or they may think recovery commands are applied per-interface. Remember that errdisable recovery is a global setting, and you must specify the exact cause unless you want to recover from all causes.

Why the other options are wrong

The specific factual error: 'spanning-tree portfast bpduguard default' enables BPDU guard, not recovery. Recovery requires 'errdisable recovery cause bpduguard'.

The specific factual error: Using 'cause all' is not the best practice; the question implies a specific cause. Also, the verification command is correct but the configuration is not precise.

The specific factual error: errdisable recovery is a global configuration command, not interface-specific.

Practice this question →

MCQhard

A switch port should allow an IP phone and attached PC to operate correctly. The phone should place voice traffic in VLAN 200 while the PC remains in VLAN 20. Which configuration approach best supports that design?

A.Configure the port with an access VLAN for data and a voice VLAN for the phone

B.Configure the port as a routed port with no switchport

C.Configure the port as an EtherChannel member

D.Use a native VLAN only and disable all tagging

AnswerA

Cisco IP phones contain a small 3-port switch that places PC traffic on the configured access VLAN while the phone itself uses a distinct voice VLAN advertised via CDP. This design keeps data and voice in separate Layer 2 broadcast domains, allows separate QoS policies and subnets, and works over a single physical cable without a trunk to the desktop. The access VLAN carries untagged PC frames, while the voice VLAN uses 802.1Q tagging on the phone uplink, making coexistence correct.

Why this answer

The best approach is to configure the access VLAN for user data and the voice VLAN separately. In plain language, the PC should remain a normal untagged data endpoint in VLAN 20, while the phone can tag its own voice traffic for VLAN 200. Cisco access-port designs support this exact use case and allow the switch to keep voice and user traffic logically separated without requiring two physical ports.

This is a classic CCNA edge-port design. It is not a general trunking problem, and it does not require EtherChannel or router subinterfaces. The important idea is that one switchport can support an access VLAN and a voice VLAN together in a way designed specifically for IP phones with downstream PCs.

Exam trap

Avoid assuming trunk mode is needed for VLANs; understand access vs. voice VLANs for edge ports.

Why the other options are wrong

A routed port (no switchport) is used for Layer 3 routing between switches or routers, not for connecting end devices like IP phones and PCs. It does not support VLAN assignment or the coexistence of multiple VLANs on a single port, making it unsuitable for this scenario.

EtherChannel is used to aggregate multiple physical links into a single logical link for increased bandwidth and redundancy. It does not provide any mechanism to separate voice and data traffic into different VLANs on a single port, and it is not relevant to the requirement of connecting an IP phone and PC.

Using a native VLAN only and disabling all tagging would place all traffic (voice and data) in the same VLAN, which contradicts the requirement to separate voice into VLAN 200 and data into VLAN 20. The native VLAN is used for untagged traffic on a trunk, but this design requires distinct VLANs with tagging for voice.

Practice this question →

PBQmedium

You are connected to SW1 via the console. SW1 is a Layer 2 switch. Port GigabitEthernet0/1 connects to a PC in VLAN 10, and port GigabitEthernet0/2 connects to a server in VLAN 20. Both ports are currently in VLAN 1. Configure SW1 to assign GigabitEthernet0/1 to VLAN 10 and GigabitEthernet0/2 to VLAN 20, and verify the configuration.

Network Topology

Hints

•Use switchport mode access to configure the port as an access port.
•Use switchport access vlan to assign the VLAN.

A.interface GigabitEthernet0/1 switchport mode access switchport access vlan 10 interface GigabitEthernet0/2 switchport mode access switchport access vlan 20 end show vlan brief

B.interface GigabitEthernet0/1 switchport mode trunk switchport trunk allowed vlan 10 interface GigabitEthernet0/2 switchport mode trunk switchport trunk allowed vlan 20 end show interfaces trunk

C.vlan 10 name PC_VLAN vlan 20 name Server_VLAN interface GigabitEthernet0/1 switchport mode access switchport access vlan 10 interface GigabitEthernet0/2 switchport mode access switchport access vlan 20 end show vlan brief

D.interface GigabitEthernet0/1 switchport access vlan 10 interface GigabitEthernet0/2 switchport access vlan 20 end show vlan brief

AnswerA

solution

! SW1
interface GigabitEthernet0/1
switchport mode access
switchport access vlan 10
interface GigabitEthernet0/2
switchport mode access
switchport access vlan 20

Why this answer

Access ports carry traffic for a single VLAN. By assigning G0/1 to VLAN 10 and G0/2 to VLAN 20, the PC and server are placed in their respective VLANs.

Exam trap

Do not confuse access ports with trunk ports. Access ports are for end devices; trunk ports are for switch-to-switch connections. Also, remember that 'switchport mode access' is required before assigning a VLAN; otherwise, the port may not behave as expected.

Why the other options are wrong

Trunk ports are not appropriate for end devices; they are designed for inter-switch links.

The question does not require creating or naming VLANs; it only asks to assign ports to existing VLANs.

The 'switchport mode access' command is required to explicitly set the port as an access port; otherwise, the port might negotiate trunking.

PBQmedium

You are connected to R1 via the console. R1 is a router that needs to provide DHCP services for hosts on VLAN 10 (192.168.10.0/24) and VLAN 20 (192.168.20.0/24). The DHCP server is located on VLAN 10 at 192.168.10.100, but hosts on VLAN 20 cannot reach it directly. Configure R1 to forward DHCP broadcasts from VLAN 20 to the DHCP server.

Network Topology

Hints

•The helper address should be placed on the interface that receives the DHCP broadcast.
•The helper address is the server's IP address.
•Only one command is needed.

A.interface GigabitEthernet0/0.20 encapsulation dot1Q 20 ip helper-address 192.168.10.100

B.interface GigabitEthernet0/0.10 encapsulation dot1Q 10 ip helper-address 192.168.10.100

C.interface GigabitEthernet0/0.20 encapsulation dot1Q 20 ip dhcp relay information option

D.ip dhcp pool VLAN20 network 192.168.20.0 255.255.255.0 default-router 192.168.20.1

AnswerA

solution

! R1
interface GigabitEthernet0/0.20
ip helper-address 192.168.10.100

Why this answer

The ip helper-address command enables the router to forward UDP broadcasts (including DHCP) to a specific server. Placing it on the VLAN 20 subinterface ensures that DHCP requests from VLAN 20 are unicast to the server on VLAN 10.

Exam trap

The key trap is placing the ip helper-address on the wrong interface. Remember: the helper-address must be on the interface that receives the client's broadcast, not on the server's interface. Also, do not confuse ip helper-address with DHCP server configuration or relay option commands.

Why the other options are wrong

The ip helper-address must be configured on the interface that receives the client broadcasts (VLAN 20), not the server's VLAN.

This command enables relay agent information insertion, not the actual forwarding of DHCP packets to a server.

The question states the DHCP server is at 192.168.10.100, so R1 should relay, not serve.

PBQhard

You are connected to SW1. Configure LACP EtherChannel between SW1 and SW2 using interfaces GigabitEthernet0/1 and GigabitEthernet0/2. Ensure the channel forms and passes traffic for VLAN 10. Troubleshoot and fix any issues preventing the channel from coming up.

Network Topology

Hints

•Check the speed and duplex settings on both member interfaces.
•Verify that the port-channel interface and member ports are both Layer2 or both Layer3.
•Ensure LACP mode is active on at least one side to initiate negotiation.

A.Configure speed 1000 and duplex full on Gi0/2, change port-channel 1 to switchport mode trunk with allowed vlan 10, and set both Gi0/1 and Gi0/2 to channel-group 1 mode active.

B.Configure speed 1000 and duplex full on Gi0/2, change port-channel 1 to no switchport, and set both Gi0/1 and Gi0/2 to channel-group 1 mode passive.

C.Configure speed 100 and duplex half on Gi0/1 to match Gi0/2, change port-channel 1 to switchport mode trunk with allowed vlan 10, and set both Gi0/1 and Gi0/2 to channel-group 1 mode active.

D.Configure speed 1000 and duplex full on Gi0/2, change port-channel 1 to switchport mode access with access vlan 10, and set both Gi0/1 and Gi0/2 to channel-group 1 mode desirable.

AnswerA

solution

! SW1
interface GigabitEthernet0/2
speed 1000
duplex full
channel-group 1 mode active
exit
interface GigabitEthernet0/1
channel-group 1 mode active
exit
interface Port-channel1
switchport
switchport mode trunk
switchport trunk allowed vlan 10
no ip address
end

Why this answer

The EtherChannel is not forming because of multiple mismatches: speed (1000 vs 100), duplex (full vs half), and the port-channel interface is configured as Layer3 (no switchport) while the member ports are Layer2 (switchport mode trunk). First, correct the speed and duplex on Gi0/2 to match Gi0/1 (speed 1000, duplex full). Then change the port-channel to switchport mode trunk and set the allowed VLAN.

Finally, change the LACP mode on both interfaces to 'active' to initiate negotiation. After these changes, the channel should come up.

Exam trap

Watch for mismatches in speed, duplex, and Layer2/Layer3 configuration between member ports and the port-channel interface. Also, ensure LACP mode is active on at least one side to initiate negotiation.

Why the other options are wrong

The specific factual error: The port-channel interface must match the Layer2 configuration of member ports; using no switchport creates a Layer3 interface that cannot trunk VLANs. Additionally, passive mode requires an active partner to form the channel.

The specific factual error: Speed and duplex should be consistent across all member links, but the correct resolution is to correct the misconfigured interface (Gi0/2) to match the working one (Gi0/1), not vice versa.

The specific factual error: Access mode cannot carry multiple VLANs; trunk mode is required for VLAN 10. Additionally, desirable is a PAgP keyword, not LACP. LACP uses active or passive.

Practice this question →

PBQhard

You are securing the spanning-tree topology on R1, the root bridge for VLAN 10. Intended configurations: Root Guard on GigabitEthernet1/0/3, Loop Guard on gigabit interfaces 1/0/1 and 1/0/2, and BPDU Guard on all PortFast-enabled interfaces. After initial configuration, a superior BPDU on G1/0/3 blocks the port (expected), and a host on G1/0/5 triggers BPDU Guard, causing err-disable (expected). However, you realize Loop Guard was not applied to the uplinks. Troubleshoot and apply the missing configuration.

Hints

•Root Guard on the root bridge may cause blocking if a superior BPDU is received; this is correct behavior unless the port should be a root port.
•Loop Guard prevents alternate or root ports from becoming designated in case of unidirectional link failure; it is safe on trunk uplinks.
•BPDU Guard err-disables a PortFast port when a BPDU is received; re-enable with 'no shutdown' after fixing the cause.

A.Remove Root Guard from G1/0/3 and configure it with 'spanning-tree guard loop' to prevent the blockage.

B.Re-enable G1/0/5 with 'no shutdown' and apply 'spanning-tree bpduguard enable' on all PortFast-enabled interfaces to prevent future err-disable.

C.Configure Loop Guard on G1/0/1 and G1/0/2 with 'spanning-tree guard loop' and recover G1/0/5 from err-disable by issuing 'shutdown' followed by 'no shutdown'.

D.Remove BPDU Guard from all PortFast interfaces and configure 'spanning-tree portfast bpdufilter default' to prevent err-disable.

AnswerC

solution

! R1
interface GigabitEthernet1/0/1
spanning-tree guard loop
interface GigabitEthernet1/0/2
spanning-tree guard loop
interface GigabitEthernet1/0/5
shutdown
no shutdown

Why this answer

The candidate must first identify that Root Guard is correctly configured on G1/0/3, causing it to block (BKN*ROOT_Guard) upon receiving a superior BPDU, which is correct behavior. However, the task states to protect the root bridge role; since R1 is already root, Root Guard is appropriate. The err-disabled port G1/0/5 indicates BPDU Guard triggered; this is expected because a host connected to a PortFast port sent a BPDU.

To resolve, the candidate should re-enable the port with 'no shutdown' and ensure BPDU Guard is properly applied. Additionally, Loop Guard is missing on uplinks G1/0/1 and G1/0/2; it must be configured with 'spanning-tree guard loop' under each interface. No changes to Root Guard are needed; the blockage is intentional.

Exam trap

Do not assume that a blocked port due to Root Guard is a problem; it is intentional. Also, do not confuse BPDU Guard with BPDU Filter; BPDU Guard err-disables, while BPDU Filter suppresses BPDUs. Remember that err-disabled ports must be manually re-enabled with 'no shutdown'.

Why the other options are wrong

Root Guard is designed to block a port that receives superior BPDUs, which is exactly what happened. The configuration is correct and should not be removed.

BPDU Guard is correctly configured; the err-disable is expected behavior when a BPDU is received on a PortFast port. The solution is to re-enable the port and ensure the host is not a switch.

BPDU Filter is not a substitute for BPDU Guard; it prevents the port from sending or receiving BPDUs, which can cause bridging loops. The correct action is to re-enable the port, not change the protection mechanism.

Practice this question →

MCQhard

Refer to the exhibit. A network engineer is troubleshooting a connectivity issue on SW3. A host connected to the same segment as SW3's GigabitEthernet0/0 interface cannot reach any network resources. The engineer issues the show spanning-tree vlan 10 command and receives the output shown. Based on the output, what is the most likely cause?

A.GigabitEthernet0/0 is administratively down, which prevents the host from communicating.

B.The port is in the Blocking state because the switch detected a loop and moved the port to error-disabled state.

C.The port is blocked because SW3 has a lower bridge priority than the root bridge and should be the designated port for that segment.

D.The interface GigabitEthernet0/0 is in the Blocking state because it received a superior BPDU, making it an alternate port to the root bridge.

AnswerD

The output explicitly shows role 'Altn' and state 'BLK' for Gi0/0. An alternate port is blocked because it receives better BPDUs on that interface than it can send, providing an alternate path to the root bridge. This is correct STP behavior, and the blocking state prevents the host from communicating.

Why this answer

The output shows that GigabitEthernet0/0 is in the Blocking state for VLAN 10. In Rapid PVST+ or classic STP, a port enters the Blocking state when it receives a superior BPDU (i.e., a BPDU with a lower bridge ID or lower path cost to the root), causing it to become an alternate (or backup) port rather than a designated or root port. This prevents the host from reaching network resources because the port does not forward traffic.

Exam trap

Cisco often tests the distinction between a port being blocked due to normal STP operation (receiving a superior BPDU) versus being error-disabled or administratively down, leading candidates to incorrectly assume a physical or administrative issue.

Why the other options are wrong

Candidates may incorrectly associate the blocked state with an administratively disabled interface.

Candidates often confuse error-disabled state (caused by features like BPDU guard) with the standard STP blocking state.

Candidates may misunderstand the root election process and assume a lower priority switch always becomes designated for all segments, ignoring the Altn role.

Practice this question →

PBQhard

You are connected to SW1 via the console. SW1 is a Layer 2 switch with three redundant links to SW2: G0/1, G0/2, and G0/3. The network is experiencing loops, and STP is not configured. You need to enable STP and ensure that SW1 becomes the root bridge for VLAN 1. Configure STP on SW1 and set its priority to 4096 for VLAN 1.

Network Topology

Hints

•STP uses bridge priority to determine root bridge; lower priority wins.
•The default priority is 32768; setting it to 4096 ensures SW1 becomes root.

A.spanning-tree vlan 1 priority 4096

B.spanning-tree vlan 1 root primary

C.spanning-tree vlan 1 priority 32768

D.spanning-tree vlan 1 priority 8192

AnswerA

solution

! SW1
spanning-tree vlan 1 priority 4096

Why this answer

By setting the STP priority to 4096 for VLAN 1, SW1 has a lower priority than the default, making it the root bridge for that VLAN.

Exam trap

The exam may test your ability to recall the exact command syntax for setting STP priority. Remember that 'spanning-tree vlan <vlan> priority <value>' sets the priority directly, while 'root primary' is a macro that sets it to 24576. Always check the exact value required.

Why the other options are wrong

The 'root primary' macro sets priority to 24576, not 4096.

A priority of 32768 is the default, so it does not guarantee root bridge status.

The requirement is to set priority to exactly 4096, not 8192.

PBQhard

You are connected to SW1. Configure an LACP EtherChannel between SW1 and SW2 using interfaces GigabitEthernet0/1 and GigabitEthernet0/2. Set the channel-group mode to active on both switches. Verify that the port-channel interface is configured with VLAN 100 as an access port. Then, troubleshoot and fix the issue that prevents the EtherChannel from forming due to a mismatched speed on one of the member links. After correction, verify the EtherChannel is up with 'show etherchannel summary'.

Hints

•Check the speed and duplex settings on all member interfaces.
•LACP requires identical speed and duplex on all ports in the channel.
•Use the 'speed' and 'duplex' commands under the interface to match the working member.

A.Set speed 1000 and duplex full on interface GigabitEthernet0/2 of SW1, ensuring the corresponding interface on SW2 has matching settings, then verify with 'show etherchannel summary'.

B.Change the channel-group mode to desirable on both switches and verify with 'show etherchannel summary'.

C.Remove the access VLAN configuration from the port-channel interface and configure it as a trunk port instead.

D.Configure the channel-group mode to passive on SW1 and active on SW2, then verify with 'show etherchannel summary'.

AnswerA

solution

! SW1
interface GigabitEthernet0/2
speed 1000
duplex full

Why this answer

The EtherChannel fails because interface GigabitEthernet0/2 on SW1 has a mismatched speed (likely 100 Mbps) compared to the other member link (1000 Mbps). LACP requires all member ports to have identical speed and duplex. The solution is to set the speed on Gi0/2 to 1000 and duplex to full.

After correction, the port will bundle, and the port-channel will come up. Verification with 'show etherchannel summary' should show both ports as 'P' (bundled) and the port-channel as 'SU' (in use, Layer2).

Exam trap

Do not confuse LACP modes (active/passive) with PAgP modes (desirable/auto). Also, remember that physical parameters like speed and duplex must match across all member ports; logical configurations like VLAN or trunking are separate but must also be consistent. Always verify the root cause before changing unrelated settings.

Why the other options are wrong

The specific factual error is that 'desirable' is a PAgP mode, not LACP. LACP uses 'active' and 'passive' modes.

The specific factual error is that the problem is physical (speed mismatch), not logical (VLAN/trunking). Changing the port type does not address the root cause.

The specific factual error is that the speed mismatch is the root cause, not the LACP mode. Even with correct modes, the EtherChannel will not form if speeds differ.

Practice this question →

Multi-Selectmedium

Which three of the following are correct statements about VLAN configuration and verification on a Cisco switch? (Choose three.)

Select 3 answers

.The 'switchport mode access' command places the interface into a non-trunking mode.

.By default, all ports on a Cisco switch are in VLAN 1.

.The 'show vlan brief' command displays VLANs that are active on the switch.

.VLANs 1002–1005 are reserved for user-created VLANs.

.A VLAN must be manually created before its name can be assigned.

.The 'switchport trunk native vlan' command restricts the native VLAN to only tagged frames.

Why this answer

The correct statements are: (1) The 'switchport mode access' command places the interface into a non-trunking mode; (2) By default, all ports on a Cisco switch are in VLAN 1; (3) The 'show vlan brief' command displays VLANs that are active on the switch. The remaining statements are false because: VLANs 1002–1005 are reserved for legacy FDDI/Token Ring VLANs, not for user-created VLANs; a VLAN does not need to be manually created before its name can be assigned (assigning a port to a new VLAN can automatically create it, after which you can set its name); and the 'switchport trunk native vlan' command does not restrict the native VLAN to only tagged frames—native VLAN traffic is sent untagged.

Exam trap

Candidates often confuse the native VLAN as carrying tagged frames, and mistakenly believe VLANs 1002–1005 are user-configurable, when in fact they are reserved for legacy technologies.

Why the other options are wrong

VLANs 1002–1005 are reserved for legacy FDDI and Token Ring, not user-created VLANs.

The native VLAN on a trunk sends frames untagged; this command sets the native VLAN, not a tagging restriction.

Practice this question →

PBQmedium

You are connected to SW1 via the console. SW1 is a Layer 2 switch. Ports G0/1 and G0/2 are connected to two PCs that should be in VLAN 10 (Sales). Port G0/3 is a trunk link to another switch. The PCs are currently unable to communicate because the ports are in VLAN 1. Configure the switch to place the ports in the correct VLAN and ensure the trunk is properly configured with 802.1Q encapsulation and native VLAN 99.

Network Topology

Hints

•Check the current VLAN assignment on access ports.
•The trunk encapsulation must be set to dot1q for 802.1Q support.
•Native VLAN should match on both ends of the trunk.

A.Create VLAN 10, assign G0/1 and G0/2 as access ports in VLAN 10, configure G0/3 as trunk with encapsulation dot1q and native VLAN 99.

B.Create VLAN 10, assign G0/1 and G0/2 as access ports in VLAN 10, configure G0/3 as trunk with encapsulation isl and native VLAN 99.

C.Create VLAN 10, assign G0/1 and G0/2 as trunk ports in VLAN 10, configure G0/3 as trunk with encapsulation dot1q and native VLAN 99.

D.Create VLAN 10, assign G0/1 and G0/2 as access ports in VLAN 10, configure G0/3 as trunk with encapsulation dot1q and native VLAN 1.

AnswerA

solution

! SW1
interface GigabitEthernet0/1
switchport access vlan 10
interface GigabitEthernet0/2
switchport access vlan 10
interface GigabitEthernet0/3
switchport trunk encapsulation dot1q
switchport trunk native vlan 99

Why this answer

VLAN 10 must be created and the access ports must be explicitly set to access mode with 'switchport mode access' before assigning them to VLAN 10. Assigning the access ports to VLAN 10 places the PCs in the correct broadcast domain. The trunk needed explicit 802.1Q encapsulation and a native VLAN change to 99 for security and consistency.

Exam trap

Be careful to distinguish between access and trunk ports: access ports belong to a single VLAN for end devices, while trunk ports carry multiple VLANs between switches. Also, remember that 802.1Q is the standard trunking protocol, and native VLAN should be changed from default 1 for security.

Why the other options are wrong

The specific factual error is that ISL is a legacy Cisco proprietary trunking protocol, and modern switches default to 802.1Q. The question specifies 802.1Q encapsulation.

The specific factual error is that ports connected to end devices (PCs) should be access ports, not trunk ports. Trunk ports are used for inter-switch links.

The specific factual error is that the native VLAN must be explicitly set to 99. Native VLAN 1 is the default and is often targeted in VLAN hopping attacks.

MCQhard

A technician is troubleshooting a network issue where hosts in VLAN 20 on SW1 cannot communicate with hosts in VLAN 20 on SW2. Both switches are connected by an Ethernet trunk link that is up/up and configured as a trunk. The VLAN databases on both switches include VLAN 20, and the spanning tree for VLAN 20 is in a forwarding state on all ports. Hosts within VLAN 20 on each switch can communicate with each other locally. What is the most likely cause?

A.The native VLAN is mismatched on the two ends of the trunk.

B.VLAN 20 has not been created in the VLAN database on SW2.

C.The trunk encapsulation is mismatched between SW1 and SW2.

D.VLAN 20 is not in the switchport trunk allowed VLAN list on the trunk port between SW1 and SW2.

AnswerD

When a trunk port’s allowed VLAN list explicitly excludes a VLAN, the switch drops all frames tagged for that VLAN, even though the VLAN exists locally and the trunk is active. This results in the described symptom of local intra-VLAN communication working but no cross-switch communication for VLAN 20.

Why this answer

The most likely cause is that VLAN 20 is not included in the allowed VLAN list on the trunk port between SW1 and SW2. Even though the trunk is up/up and VLAN 20 exists in the VLAN database, the switchport trunk allowed vlan command restricts which VLANs can traverse the trunk. If VLAN 20 is omitted from this list, frames from VLAN 20 will be dropped at the trunk, preventing inter-switch communication for that VLAN.

Exam trap

Cisco often tests the distinction between VLAN existence in the database and VLAN permission on a trunk; candidates mistakenly think that if a VLAN is created and spanning tree is forwarding, it must work, but the trunk allowed list is an independent filter that can block traffic.

Why the other options are wrong

Candidates may think that a native VLAN mismatch breaks all trunk functions.

Candidates may assume that a missing VLAN on one switch explains inter-switch failures, ignoring that local communication would also fail.

Candidates might overlook that the trunk link is operational, which implies matching encapsulation.

Practice this question →

MCQhard

A network technician is troubleshooting an inter-VLAN routing issue on a multilayer switch. Hosts on VLAN 10 can reach the SVI for VLAN 10 (10.0.10.1) but cannot reach hosts on VLAN 20. The technician has verified that 'ip routing' is enabled and that the 'show ip route' command displays directly connected routes for both VLANs. No static routes are configured. What should the technician do next?

A.Check the ARP table for entries on VLAN 20.

B.Issue the 'show ip routing' command again to confirm routing is enabled.

C.Configure a default route pointing to the next-hop gateway.

D.Verify the VLAN membership of the destination host on VLAN 20.

AnswerA

The Layer 3 routing table is correct; the problem is likely that the switch lacks a Layer 2 MAC address for the destination host on VLAN 20. Examining the ARP cache will confirm whether the switch can map the destination IP to a MAC address, and if not, will show that ARP resolution is failing, which explains the connectivity break.

Why this answer

The hosts on VLAN 10 can reach the SVI (10.0.10.1) but not hosts on VLAN 20, which indicates that Layer 3 routing is working (ip routing enabled, directly connected routes present). The issue is likely that the switch does not have the MAC address of the destination host in VLAN 20 in its ARP table, so it cannot forward frames to that host. Checking the ARP table for VLAN 20 entries will reveal whether the switch has resolved the Layer 3-to-Layer 2 address mapping for the destination.

Exam trap

Cisco often tests the misconception that if 'ip routing' is enabled and routes are present, inter-VLAN routing should work, but they trap candidates by omitting the critical step of ARP resolution, which is required to deliver frames to the destination host's MAC address.

Why the other options are wrong

This option revisits a step already completed and verified, making it redundant. Candidates might think double-checking routing is safe, but the scenario explicitly states routing is working as expected.

Some candidates might believe inter-VLAN communication requires a default route, but directly connected routes already provide full reachability without static routing. This action is overly drastic and misdirected.

Candidates often jump to VLAN misconfigurations when inter-VLAN communication fails, even when routing is confirmed. The scenario already establishes the VLAN 20 host's location; the next logical layer to inspect is ARP resolution.

Practice this question →

MCQhard

Refer to the exhibit. A network administrator is troubleshooting connectivity to devices in VLAN 10 on a Layer 3 switch. The administrator issues the show ip interface brief command on SW1 and sees the output displayed. What is the most likely reason that the VLAN 10 SVI is not functioning?

A.No active ports are assigned to VLAN 10.

B.The VLAN 10 SVI has been administratively shut down.

C.The IP address configured on the VLAN 10 SVI is incorrect for the subnet.

D.The switch ports assigned to VLAN 10 are all configured as trunk ports.

AnswerA

The SVI for VLAN 10 will not transition to up/up until at least one switch port is in the up/up state and actively assigned to VLAN 10 (either as an access port in that VLAN or as a trunk port that has VLAN 10 allowed and active). With no active member ports, the switch considers the VLAN to have no operational Layer 2 presence, so the SVI's line protocol remains down even though the VLAN exists and is configured with an IP address. This is a standard Cisco IOS behavior: the SVI's status mirrors the presence of an active port in the associated VLAN, not merely the VLAN's existence.

Why this answer

The VLAN 10 SVI will remain in a down/down state if there are no active ports assigned to VLAN 10, because a Layer 3 switch requires at least one active Layer 2 interface in the VLAN to bring the SVI up. This is a fundamental behavior of Cisco switches: the SVI is operationally down until the VLAN has at least one active port in a non-blocking state. The show ip interface brief output would show the VLAN10 interface as 'down/down' rather than 'administratively down' or 'up/up'.

Exam trap

Cisco often tests the subtle distinction between an SVI being 'down/down' due to no active ports in the VLAN versus 'administratively down' due to a shutdown command, and candidates may incorrectly assume a misconfigured IP address or trunk port issue is the cause.

Why the other options are wrong

Candidates often confuse 'down' with 'administratively down', assuming any disabled interface will show 'down'. They need to distinguish the two statuses.

Some candidates think a misconfigured IP address can cause an interface to be down, but status does not reflect IP configuration.

A common misunderstanding is that trunk ports do not make a VLAN active; in reality, a trunk carrying VLAN 10 can activate the SVI as long as the trunk is up/up and the VLAN is not pruned.

Practice this question →

MCQmedium

A switch interface connected to another switch must carry VLANs 10, 20, and 30 only. Which command best enforces that requirement on the trunk?

A.switchport trunk allowed vlan 10,20,30

B.switchport access vlan 10,20,30

C.switchport mode dynamic auto

D.switchport trunk native vlan 10,20,30

AnswerA

The correct command for a trunk interface is `switchport trunk allowed vlan 10,20,30`; it explicitly defines the allowed VLAN list for IEEE 802.1Q tagging. By specifying only VLANs 10, 20, and 30, the administrator ensures that frames from other VLANs are not forwarded across this trunk, providing precise traffic segmentation between the two switches.

Why this answer

The correct command is the one that explicitly sets the allowed VLAN list on the trunk. In plain language, the administrator wants the inter-switch link to carry only the named VLANs instead of every VLAN by default. Cisco trunks can transport multiple VLANs, but that does not mean every VLAN should always be permitted. Restricting the allowed list supports cleaner design and helps reduce unnecessary VLAN transport.

This is a common CCNA switching task because it distinguishes between creating a trunk and controlling what the trunk actually carries. Simply enabling trunking is not enough when the requirement names exact VLANs. The answer must directly restrict the allowed list rather than change the native VLAN or apply an unrelated access-port command.

Exam trap

A common exam trap is selecting commands that do not correctly restrict VLANs on a trunk. For example, using 'switchport access vlan 10,20,30' is invalid because access ports support only one VLAN. Another trap is confusing the native VLAN setting with allowed VLANs; 'switchport trunk native vlan' only defines the untagged VLAN and does not filter VLANs.

Also, relying on dynamic trunk negotiation commands like 'switchport mode dynamic auto' does not restrict VLANs and can lead to trunks carrying all VLANs by default. These mistakes cause VLAN traffic to flow where it shouldn’t, violating design requirements.

Why the other options are wrong

Incorrect because 'switchport access vlan' applies only to access ports and cannot specify multiple VLANs; it does not configure trunk VLANs.

Incorrect because 'switchport mode dynamic auto' controls trunk negotiation but does not limit which VLANs are allowed on the trunk.

Incorrect because 'switchport trunk native vlan' sets only one native VLAN for untagged traffic and does not restrict the allowed VLAN list.

Practice this question →

MCQhard

A network administrator recently configured BPDU Guard on all access ports of a switch to protect against rogue switches. After the change, users in VLAN 10 report intermittent connectivity issues and frequent link flaps. The administrator checks the switch and notices that several ports are in an err-disabled state. What is the most likely cause of the problem?

A.Root Guard is preventing the port from becoming a root port.

B.BPDU Guard is enabled on access ports that are receiving BPDUs, causing the ports to go into err-disabled state.

C.Loop Guard has detected a unidirectional link and placed the port into err-disabled state.

D.BPDU Guard is globally enabled but not configured on the interface, so the port is err-disabled due to a BPDU received.

AnswerB

BPDU Guard is a security feature that intentionally places a PortFast-enabled access port into err-disabled when any BPDU is received, protecting against rogue switches attempting to participate in spanning tree. When an unauthorized device sends BPDUs, the switch immediately disables the port and logs an error, requiring an administrator to manually re-enable it or rely on errdisable recovery. This matches the scenario where access ports receiving BPDUs are error-disabled.

Why this answer

BPDU Guard is configured to protect against rogue switches by placing a port into an err-disabled state upon receiving a BPDU. In this scenario, BPDU Guard is enabled on access ports that are receiving BPDUs (possibly from a rogue switch or misconfiguration), causing the ports to err-disable and flap. PortFast is not required for BPDU Guard to function; the issue is that BPDUs are being received on ports that are not expected to receive them.

The intermittent connectivity occurs as ports cycle into err-disabled and are re-enabled.

Exam trap

A common mistake is believing BPDU Guard requires PortFast to function; in reality, BPDU Guard can be enabled per-interface without PortFast and will err-disable the port when a BPDU is received.

Why the other options are wrong

Root Guard prevents a port from becoming a root port by placing it in a root-inconsistent state, not err-disabled. It does not cause link flaps or err-disable ports.

Loop Guard prevents alternate or root ports from becoming designated in the absence of BPDUs, but it does not err-disable ports. It places ports in a loop-inconsistent state, which is not err-disabled.

The global 'spanning-tree portfast bpduguard default' command only applies BPDU Guard to PortFast-enabled ports. If a port receives a BPDU and is not PortFast, it will not be err-disabled by this global command. The scenario states BPDU Guard was configured on all access ports, implying interface-level configuration.

Practice this question →

PBQmedium

You are connected to SW1 via console. SW1 is a Layer 2 switch with two ports (G0/1 and G0/2) connected to a host. The host should be able to send and receive traffic on VLAN 10 and VLAN 20. Configure the two ports as a trunk link to the host, but ensure that the trunk only carries VLANs 10 and 20, and set the native VLAN to VLAN 99.

Network Topology

Hints

•Use the 'switchport trunk allowed vlan' command to restrict which VLANs are carried.
•The native VLAN must match on both ends of the trunk.

A.interface range gigabitethernet0/1-2 switchport mode trunk switchport trunk allowed vlan 10,20 switchport trunk native vlan 99

B.interface range gigabitethernet0/1-2 switchport mode trunk switchport trunk allowed vlan 10-20 switchport trunk native vlan 99

C.interface range gigabitethernet0/1-2 switchport mode trunk switchport trunk allowed vlan 10,20 switchport native vlan 99

D.interface range gigabitethernet0/1-2 switchport mode trunk switchport trunk allowed vlan 10,20 switchport trunk native vlan 1

AnswerA

solution

! SW1
interface gigabitethernet0/1
switchport mode trunk
switchport trunk allowed vlan 10,20
switchport trunk native vlan 99
interface gigabitethernet0/2
switchport mode trunk
switchport trunk allowed vlan 10,20
switchport trunk native vlan 99

Why this answer

Configuring the ports as trunks allows multiple VLANs. The 'allowed vlan' command restricts the trunk to only VLANs 10 and 20, while 'native vlan 99' sets the untagged VLAN to 99, ensuring proper tagging and avoiding VLAN mismatch.

Exam trap

Watch out for the difference between 'switchport trunk allowed vlan 10,20' (list) and 'switchport trunk allowed vlan 10-20' (range). Also, remember that on a trunk port, the native VLAN command must include the 'trunk' keyword: 'switchport trunk native vlan'. Finally, always verify that the native VLAN is set to the required value, not left at the default.

Why the other options are wrong

The specific factual error is using a range (10-20) instead of a list (10,20), which includes unintended VLANs.

The specific factual error is omitting the 'trunk' keyword in the native VLAN command, which is required for trunk ports.

The specific factual error is setting the native VLAN to 1 instead of 99, which does not meet the requirement.

PBQhard

You are troubleshooting a PC connected to switch SW1. The PC cannot access the internet. SW1 is connected to router R1 via port G0/1. R1 provides default gateway and DHCP services. Analyze the provided show output and fix the connectivity issue so that the PC can ping 8.8.8.8. === Show output from R1 === <pre> R1# show ip interface brief Interface IP-Address OK? Method Status Protocol GigabitEthernet0/0 unassigned YES manual administratively down down GigabitEthernet0/1 10.0.0.1 YES NVRAM up up </pre> === Show output from PC === <pre> C:\> ipconfig Ethernet adapter Ethernet0: Connection-specific DNS Suffix . : IPv4 Address. . . . . . . . . . : 169.254.123.45 Subnet Mask . . . . . . . . . . : 255.255.0.0 Default Gateway . . . . . . . . : </pre> === Show output from SW1 === <pre> SW1# show vlan brief VLAN Name Status Ports ---- -------------------------------- --------- ------------------------------- 1 default active Gi0/1, Gi0/2, Gi0/3 </pre>

Network Topology

Hints

•Check if R1's interface connected to SW1 has an IP address.
•The DHCP pool expects the default gateway to be on the same subnet as the clients.
•APIPA address means the PC did not receive a DHCP offer.

A.Configure R1's interface G0/0 with IP address 192.168.1.1/24 and ensure the interface is not administratively down.

B.Change the VLAN on SW1's port G0/2 to VLAN 10 and configure R1's subinterface G0/0.10 with IP 192.168.1.1/24.

C.Enable DHCP snooping on SW1 and configure the port G0/2 as a trusted port.

D.Configure a static IP address of 192.168.1.10/24 on the PC with default gateway 192.168.1.1.

AnswerA

solution

! R1
interface gigabitethernet0/0
ip address 192.168.1.1 255.255.255.0
no shutdown

Why this answer

The PC's APIPA address (169.254.x.x) indicates DHCP failure. The router's DHCP pool is correctly configured and has a lease, but the show output reveals that R1's interface G0/0 is administratively down and has no IP address. Without a working IP on G0/0, the router cannot serve DHCP or route traffic for VLAN 1, even though both the PC and the router are in the same VLAN.

Option A fixes the root cause by assigning the correct subnet IP and bringing the interface up. Option B is incorrect because moving the PC to a different VLAN or creating subinterfaces does nothing to enable the router's physical interface where DHCP and routing must run. Option C is wrong because DHCP snooping or trust configurations are irrelevant when the router's own interface is down/unaddressed.

Option D is a workaround that only masks the problem; the scenario requires a working DHCP service, and a static IP would not restore the intended design.

Exam trap

This question tests your ability to identify that a router interface must have an IP address in the client subnet for DHCP to work, even if the DHCP pool is correctly configured. Many candidates focus on VLANs or DHCP server settings but overlook the basic requirement of an IP address on the router interface.

Why the other options are wrong

Changing VLANs or using subinterfaces does not solve the problem because the router's physical interface must be up and have an IP address to serve the VLAN.

Enabling DHCP snooping or trust settings on the switch cannot fix a router interface that is administratively down and unassigned.

Assigning a static IP to the PC circumvents but does not resolve the root issue of the router's interface being down, and the scenario requires DHCP.

Practice this question →

Drag & Dropmedium

Drag and drop the following steps into the correct order to configure a router-on-a-stick topology for inter-VLAN routing between VLANs 10 and 20, using 802.1Q trunking with native VLAN 99 for management traffic.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

6Step 6

Why this order

The sequence follows Cisco's best practices: VLANs are created first, then access ports are assigned to them. The switch trunk is configured with 802.1Q encapsulation and the native VLAN set to 99 before the router end. On the router, the physical interface must be enabled before subinterfaces can operate.

The native VLAN subinterface is created first to handle untagged frames, then the data VLAN subinterfaces are configured. This order avoids errors such as missing VLANs, incorrect encapsulation, and physical link down state.

Practice this question →

PBQmedium

You are connected to SW1 via the console. SW1 is a Layer 2 switch with two VLANs: VLAN 10 (Sales) and VLAN 20 (Engineering). Port G0/1 is connected to a sales PC, and port G0/2 is connected to an engineering PC. You need to ensure that each PC is in the correct VLAN. However, the sales PC is currently unable to ping the engineering PC because they are in different VLANs. You have a router R1 connected to SW1 via port G0/3. Configure inter-VLAN routing using Router-on-a-Stick on R1, and ensure SW1's port G0/3 is properly configured as a trunk.

Network Topology

Hints

•Router-on-a-Stick uses subinterfaces on the router with 802.1Q encapsulation.
•The switch port connected to the router must be configured as a trunk to carry multiple VLANs.
•Each subinterface must have an IP address in the respective VLAN's subnet.

A.Configure subinterfaces on R1 with encapsulation dot1Q and assign IP addresses in VLAN 10 and VLAN 20. Configure SW1 interface G0/3 as a trunk port.

B.Configure a routed port on SW1 G0/3 and assign an IP address. Then configure static routes on R1 to reach each VLAN.

C.Configure SW1 interface G0/3 as an access port in VLAN 10. Then configure R1 with a single IP address in VLAN 10 and enable proxy ARP.

D.Configure SW1 interface G0/3 as a trunk port. Then configure R1 with a single IP address on the physical interface and enable VLAN routing using the 'vlan' command.

AnswerA

solution

! R1
interface GigabitEthernet0/0.10
encapsulation dot1Q 10
ip address 192.168.10.1 255.255.255.0
interface GigabitEthernet0/0.20
encapsulation dot1Q 20
ip address 192.168.20.1 255.255.255.0
interface GigabitEthernet0/0
no shutdown

! SW1
interface GigabitEthernet0/3
switchport mode trunk

Why this answer

Router-on-a-Stick allows a single router interface to route between VLANs by using subinterfaces with 802.1Q encapsulation. The switch port must be a trunk to carry the tagged frames. This configuration enables communication between VLAN 10 and VLAN 20.

Exam trap

The key trap is that candidates often forget to configure the switch port as a trunk, or they try to use a routed port on a Layer 2 switch. Also, some may think that a single IP address on the router's physical interface is sufficient, but subinterfaces are mandatory for Router-on-a-Stick.

Why the other options are wrong

Layer 2 switches do not support routed ports; they only support switchport mode access or trunk.

An access port cannot carry multiple VLANs; a trunk is required for Router-on-a-Stick.

Router-on-a-Stick requires subinterfaces; a single IP address on the physical interface only handles one VLAN. The 'vlan' command is not used on routers for inter-VLAN routing.

PBQmedium

You are connected to SW1 via the console. SW1 is a multilayer switch with SVIs for VLANs 10 (192.168.10.1/24) and 20 (192.168.20.1/24). Hosts in VLAN 10 can ping their default gateway (192.168.10.1), but cannot ping hosts in VLAN 20. You suspect IP routing is not enabled or the SVIs are not up.

Hints

•Check if IP routing is enabled globally.
•Verify that the SVIs are up/up.
•Use ping with source to test connectivity between VLANs.

A.Enable IP routing on SW1 with the 'ip routing' global configuration command.

B.Configure a trunk port between SW1 and an external router, then enable routing on the router.

C.Ensure the SVIs are not shut down and have the 'no shutdown' command applied.

D.Add a static route on SW1 pointing to the VLAN 20 subnet via the VLAN 10 SVI.

AnswerA

solution

! SW1
ip routing

Why this answer

A multilayer switch requires 'ip routing' to forward packets between VLANs. Without it, the switch acts as a Layer 2 device. Enabling IP routing allows the SVIs to route traffic between VLANs.

The verification commands confirm routing is active and SVIs are operational.

Exam trap

The trap is that candidates may focus on interface status or static routes, overlooking the fundamental requirement of 'ip routing' on a multilayer switch. Remember that SVIs can be up and pingable, but without IP routing enabled, the switch cannot forward packets between VLANs.

Why the other options are wrong

The specific factual error is that the question states SW1 is a multilayer switch with SVIs, so it can route internally without an external router. The issue is that IP routing is not enabled on the switch itself.

The specific factual error is that the SVIs are already up (hosts can ping the gateway), so 'no shutdown' is not the missing step. The problem is at Layer 3 routing, not Layer 2/3 interface status.

The specific factual error is that directly connected networks do not require static routes; the switch automatically installs them when the SVI is up. The problem is that 'ip routing' is not enabled, so the switch does not use these routes for forwarding.

MCQhard

In a network running STP, SW2 became the root bridge for VLAN 10. Both SW1 and SW2 have the same bridge priority. Why did SW2 become the root?

A.Because SW2 has the lower bridge ID due to the lower MAC address.

B.Because SW2 has the higher VLAN number configured.

C.Because SW2 has more trunk ports than SW1.

D.Because SW2 has the highest bridge priority.

AnswerA

In STP, each switch's bridge ID is composed of a configurable priority (default 32768) and its MAC address, concatenated to form a unique identifier. When SW1 and SW2 have equal bridge priority, the election breaks the tie by comparing the MAC portion, and the numerically lower MAC address wins. Since SW2's MAC is lower, its bridge ID is lower, making it the root bridge for the VLAN.

Why this answer

SW2 became the root bridge because its bridge ID is lower. In practical terms, spanning tree elects the root bridge by comparing bridge IDs, which are based on priority plus MAC address. The device with the lowest bridge ID wins. In the exhibit, both switches use the same priority, so the tie is broken by the lower MAC address.

This is a classic STP interpretation question. Many learners focus only on priority, but if priorities match, the MAC address becomes decisive.

Exam trap

Remember, in STP, lower values are preferred. If priorities match, the MAC address decides the root bridge.

Why the other options are wrong

The VLAN number is not a factor in the STP root bridge election. The election is based solely on bridge ID, which consists of bridge priority and MAC address.

The number of trunk ports does not affect the root bridge election. STP uses bridge ID (priority and MAC address) to determine the root bridge, not port count or type.

The root bridge is elected based on the lowest bridge ID, not the highest. A higher bridge priority (numerically larger) makes a switch less likely to become root.

Practice this question →

Drag & Dropmedium

Drag and drop the following steps into the correct order to configure a Cisco IOS-XE router as a DHCP server for a VLAN 10 subnet and enable DHCP relay for a remote client on VLAN 20.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

The correct sequence is to globally exclude IP addresses first, preventing the DHCP server from assigning reserved addresses. Then define the DHCP pool for VLAN 10 with network parameters, enable DHCP relay on the VLAN 20 interface so it forwards requests to the server, and finally verify the service is functioning. Options that place relay before pool or exclusions after pool misorder these essential configuration steps and deviate from recommended practice.

Exam trap

Many learners mistakenly think DHCP relay must be enabled before pool creation or that exclusions are a sub‑mode command inside the pool; in fact, exclusions are configured globally and should be defined before the pool to avoid accidental assignment of excluded IPs.

Practice this question →

MCQhard

A network engineer has enabled DHCP snooping on a Catalyst switch to prevent rogue DHCP servers. All access ports in VLAN 10 are untrusted. A router attached to a trunk port on the switch acts as the default gateway for VLAN 10 and is configured with the ip helper-address 10.1.2.5, which points to a remote DHCP server. After enabling DHCP snooping, hosts in VLAN 10 cannot obtain IP addresses; packet captures show DHCPDISCOVER messages are sent, but no DHCPOFFER is received. What is the most likely cause?

A.The router's ip helper-address command is pointing to an incorrect DHCP server IP address.

B.The switch port connecting to the router is not configured as a trusted port for DHCP snooping.

C.The DHCP server is on a different subnet, so the switch needs a switched virtual interface (SVI) in VLAN 10 with an IP address for Layer 3 connectivity.

D.DHCP snooping is dropping DHCPDISCOVER messages because the client access ports are untrusted.

AnswerB

DHCP snooping trusts only designated ports to forward DHCP server messages. Since the router relays the DHCPOFFER onto the trunk port, an untrusted port will cause the switch to discard the offer, resulting in DHCP failure.

Why this answer

DHCP snooping treats all ports as untrusted by default. When a router acting as a DHCP relay is connected to an untrusted trunk port, the switch drops DHCPOFFER messages received from the router because they originate from an untrusted interface. Configuring the trunk port as trusted allows DHCP server responses (OFFER, ACK) to pass through to clients.

Exam trap

Cisco often tests the distinction that DHCP snooping blocks DHCP server messages (OFFER/ACK/NAK) on untrusted ports, not client messages (DISCOVER/REQUEST), leading candidates to incorrectly assume client messages are dropped.

Why the other options are wrong

This distractor exploits the common tendency to blame the helper address configuration first, overlooking the security feature that silently drops the returning DHCPOFFER.

This plays on the misconception that a switch requires an IP address on the client VLAN to facilitate DHCP, when in fact the router acting as the relay agent provides Layer 3 connectivity.

This misinterprets DHCP snooping behavior: it assumes all DHCP traffic is filtered on untrusted ports, overlooking the critical distinction that only server-side messages are blocked, not client requests.

Practice this question →

PBQhard

You are troubleshooting a PC (PC-A) connected to switch SW1, which is connected to router R1. PC-A has an APIPA address (169.254.23.45) and cannot reach the internet (203.0.113.1). You confirm that R1 has a correctly configured DHCP pool for the 192.168.10.0/24 subnet, but the DHCP service is not enabled. The network uses VLAN 10 with subnet 192.168.10.0/24. Verify and correct the configuration on PC-A, SW1, and R1 to restore full connectivity.

Network Topology

Hints

•Check if the DHCP server process is running on R1.
•APIPA addresses (169.254.x.x) indicate DHCP failure.
•The DHCP pool is configured but not yet active.

A.Enable the DHCP service on R1 with the 'service dhcp' command.

B.Configure a default gateway on PC-A with the IP address 192.168.10.1.

C.Change the VLAN on SW1's interface connected to PC-A from VLAN 10 to VLAN 1.

D.Add the 'ip helper-address' command on R1's interface connected to SW1.

AnswerA

solution

! R1
service dhcp

! SW1


! PC-A

Why this answer

The APIPA address (169.254.x.x) indicates that PC-A failed to obtain a DHCP lease. The correct solution is to enable the DHCP service on R1 with 'service dhcp', which is not running despite the configured pool. Option B is incorrect because setting a default gateway on PC-A with a static IP would still require a valid address in the subnet; the APIPA address cannot communicate with 192.168.10.1.

Option C is wrong because the PC-A interface on SW1 is correctly assigned to VLAN 10. Option D is unnecessary since R1 is directly connected to the same subnet, so 'ip helper-address' is only used to forward DHCP broadcasts across router boundaries.

Exam trap

Do not assume that configuring a DHCP pool is sufficient; the DHCP service must be explicitly enabled with 'service dhcp'. Also, remember that APIPA addresses indicate DHCP failure, not just a missing gateway.

Why the other options are wrong

The PC's APIPA address cannot reach the 192.168.10.1 gateway because it is not in the same subnet, so configuring a default gateway alone does not restore connectivity.

Changing the VLAN to VLAN 1 would isolate PC-A from the correct subnet (VLAN 10), breaking connectivity instead of fixing it.

The 'ip helper-address' command is used on interfaces that need to forward DHCP broadcasts to a remote DHCP server; here R1 itself is the DHCP server and is directly attached, so the command is not needed.

Practice this question →

PBQhard

You are connected to R1, a multilayer switch acting as the STP root for VLAN 10. Configure Root Guard on the designated port facing a downstream switch to prevent a rogue switch from becoming root. Also, enable Loop Guard on the uplink port to prevent STP loops, and configure BPDU Guard on a PortFast-enabled access port. Ensure that if a superior BPDU is received on the Root Guard port, it is blocked, and if a BPDU is received on the BPDU Guard port, it goes err-disabled.

Network Topology

Hints

•Root Guard is applied on designated ports to block superior BPDUs.
•Loop Guard is applied on root or alternate ports to prevent loops if BPDUs stop.
•BPDU Guard with PortFast err-disables the port upon receiving any BPDU.

A.The configuration is correct; no changes are needed.

B.Root Guard should be applied on G0/0 instead of G0/1, and Loop Guard on G0/1 instead of G0/0.

C.BPDU Guard should be configured on G0/1 instead of G0/2, and Loop Guard should be removed from G0/0.

D.Root Guard should be applied on G0/2 instead of G0/1, and BPDU Guard should be removed from G0/2.

AnswerA

solution

! R1

Why this answer

R1 is the STP root for VLAN 10. The downstream port (G0/1) is a designated port, so Root Guard is correctly applied to prevent a superior BPDU from being accepted. The uplink port (G0/0) is a root port, so Loop Guard should be applied there to prevent an STP loop if BPDUs stop arriving.

The access port (G0/2) has PortFast and BPDU Guard enabled, which will err-disable the port if a BPDU is received. The current configuration is correct; no changes are needed. If a superior BPDU arrives on G0/1, Root Guard will block the port.

If a BPDU arrives on G0/2, BPDU Guard will err-disable it.

Exam trap

The trap is that candidates may think changes are needed because they misapply STP protections to the wrong port types. Remember: Root Guard on designated ports, Loop Guard on root/alternate ports, BPDU Guard on PortFast access ports.

Why the other options are wrong

Root Guard is only effective on designated ports; applying it to a root port would not prevent a rogue switch from becoming root. Loop Guard on a designated port is unnecessary and could cause false positives.

BPDU Guard on a trunk port would err-disable it upon receiving a BPDU, which is normal for trunk ports. Loop Guard on the root port is essential for loop prevention; removing it would leave the network vulnerable.

Root Guard on an access port would block the port if a superior BPDU is received, but access ports should not receive BPDUs if PortFast is enabled. BPDU Guard already handles that by err-disabling the port.

Practice this question →

PBQhard

You are connected to a multilayer switch MLS1 via the console. Configure MLS1 so that IP phones connected to interface GigabitEthernet0/1 receive power via PoE, use VLAN 10 for data traffic, and use VLAN 20 for voice traffic, while the access port for an AP on GigabitEthernet0/2 should be placed in VLAN 30 and have PoE disabled. Verify your configuration using appropriate show commands.

Hints

•Voice VLAN is configured with a separate command from the access VLAN.
•PoE can be disabled per interface using 'power inline never'.
•Use 'show interfaces switchport' to see both voice and access VLAN assignments.

A.interface GigabitEthernet0/1 switchport mode access switchport access vlan 10 switchport voice vlan 20 power inline auto ! interface GigabitEthernet0/2 switchport mode access switchport access vlan 30 power inline never

B.interface GigabitEthernet0/1 switchport mode trunk switchport trunk allowed vlan 10,20 power inline auto ! interface GigabitEthernet0/2 switchport mode access switchport access vlan 30 power inline never

C.interface GigabitEthernet0/1 switchport mode access switchport access vlan 20 switchport voice vlan 10 power inline auto ! interface GigabitEthernet0/2 switchport mode access switchport access vlan 30 power inline never

D.interface GigabitEthernet0/1 switchport mode access switchport access vlan 10 switchport voice vlan 20 power inline never ! interface GigabitEthernet0/2 switchport mode access switchport access vlan 30 power inline auto

AnswerA

solution

! MLS1
interface GigabitEthernet0/1
switchport voice vlan 20
power inline auto
interface GigabitEthernet0/2
switchport access vlan 30
power inline never

Why this answer

For the IP phone port (G0/1), you need to enable PoE (power inline auto) and configure the voice VLAN (switchport voice vlan 20) so that the phone uses VLAN 20 for voice and the access VLAN 10 for data. For the AP port (G0/2), you must change the access VLAN to 30 and disable PoE (power inline never) to prevent powering the AP through the switch. Verify with 'show interfaces switchport' to confirm voice VLAN and access VLAN settings, and 'show power inline' to check PoE status.

Exam trap

A common trap is confusing the voice VLAN command with trunking or swapping the access and voice VLANs. Also, remember that IP phones require PoE, while the AP in this scenario does not. Always verify with show commands.

Why the other options are wrong

The specific factual error is that IP phones typically use an access port with a voice VLAN, not a trunk port. Trunking is unnecessary and can cause compatibility issues.

The specific factual error is confusing the access VLAN and voice VLAN assignments. The voice VLAN is configured with 'switchport voice vlan', and the access VLAN with 'switchport access vlan'.

The specific factual error is reversing the PoE settings: 'power inline never' on the phone port and 'power inline auto' on the AP port.

Practice this question →

MCQhard

A network engineer has implemented DHCP snooping on a Cisco switch to prevent unauthorized DHCP servers. The switch's VLAN 100 SVI is configured with ip helper-address to relay DHCP requests to a legitimate server in VLAN 200. Clients in VLAN 100 cannot obtain IP leases, even though the DHCP server is reachable from the switch and has available addresses.

A.The ip helper-address command has been incorrectly applied to VLAN 100 instead of VLAN 200.

B.The switch port that connects to the DHCP server's VLAN is not configured as a trusted DHCP snooping port.

C.DHCP snooping must be disabled globally because it conflicts with the configured DHCP relay agent.

D.The DHCP server lacks a valid default gateway, preventing replies from reaching the relay agent's SVI subnet.

AnswerB

DHCP snooping drops DHCPOFFER and DHCPACK messages received on untrusted ports, since only trusted ports are allowed to accept server-originated replies. The switch port connected to the legitimate DHCP server in VLAN 200 must be explicitly configured as trusted with 'ip dhcp snooping trust'. Without that, the relay agent forwards the client's DISCOVER, but the server's OFFER/ACK are silently discarded, leaving clients without a lease despite the relay configuration.

Why this answer

DHCP snooping treats all switch ports as untrusted by default, which blocks DHCP server messages (OFFER, ACK) from entering the switch. Even though the switch itself can reach the DHCP server, the relayed reply from the server arrives on a port that is not trusted, so DHCP snooping drops the packet before it can be forwarded to the client. Configuring the port connecting to the DHCP server as a trusted port allows the server's responses to pass through the switch, resolving the issue.

Exam trap

Cisco often tests the interaction between DHCP snooping and DHCP relay, where candidates mistakenly think the relay bypasses snooping or that the issue is with the helper-address configuration, rather than the untrusted port blocking the server's unicast reply.

Why the other options are wrong

Many engineers mistakenly think the helper should reside on the server VLAN; however, it must reside on the client-facing L3 interface.

A common misconception is that DHCP relay bypasses snooping, but snooping still inspects the server's unicast response and drops it unless the ingress port is trusted.

Candidates often suspect routing issues, but verified reachability eliminates this. The problem lies in the snooping policy, not IP connectivity.

Practice this question →

MCQmedium

A switch stack is running PVST+. Users on VLAN 40 lose connectivity for roughly 30 seconds every time the uplink on SW2 flaps. Based on the exhibit, which change would most directly improve convergence for this VLAN?

A.Configure spanning-tree mode rapid-pvst.

B.Increase the bridge priority on SW2 for VLAN 40.

C.Disable PortFast on all access ports.

D.Convert the uplink to a routed port.

AnswerA

Configuring `spanning-tree mode rapid-pvst` directly addresses the 30-second connectivity loss by enabling Rapid PVST+ (R-PVST+). PVST+ utilises fixed listening and learning states, contributing to the observed delay during topology changes. R-PVST+ employs a rapid convergence mechanism, such as the Proposal/Agreement (P/A) process, allowing designated and root ports to transition to forwarding much faster, often within sub-seconds. This significantly reduces the reconvergence time for VLAN 40 when SW2's uplink flaps, directly improving user connectivity.

Why this answer

The output shows VLAN 40 is still using the legacy IEEE STP process, which converges much more slowly than Rapid PVST+. Moving the switch to rapid-pvst mode gives VLAN 40 the faster proposal/agreement behavior that typically cuts convergence time from tens of seconds to a few seconds.

Exam trap

A frequent exam trap is selecting options that change the root bridge election or port roles, such as increasing bridge priority, assuming this will speed up convergence. While root bridge placement affects path selection, it does not reduce the inherent delay caused by legacy STP timers. Another trap is disabling PortFast on access ports, which only affects edge port transitions and does not influence uplink link flap recovery times.

Additionally, converting uplinks to routed ports changes the network design and removes STP from those ports, which is not the intended solution for VLAN-specific STP convergence delays. The key mistake is confusing topology optimization with protocol speed improvements.

Why the other options are wrong

Increasing bridge priority changes root bridge election but does not speed up the STP convergence process, so it does not resolve the 30-second connectivity loss.

Disabling PortFast affects only edge ports and does not influence the convergence time of uplink ports or VLANs experiencing link flaps.

Converting the uplink to a routed port removes it from STP but alters network design and does not specifically improve VLAN 40’s STP convergence speed.

Practice this question →

MCQhard

A network engineer receives a call that users in VLAN 10 on Switch B cannot ping the default gateway, which is a router on a stick connected to Switch A. The engineer checks the Spanning Tree Protocol state on the interface connecting Switch A to Switch B (GigabitEthernet0/1) and finds it is in a root-inconsistent state. Which command output best explains the cause of the issue?

A.The interface is in err-disable state due to BPDU guard.

B.Root guard is enabled and the port received a superior BPDU, causing it to become root-inconsistent.

C.Loop guard is enabled and the port is in a blocking state due to missing BPDUs.

D.The port is in a forwarding state but the VLAN is misconfigured.

AnswerB

Root guard is correctly the cause: when a port configured with root guard receives a superior BPDU (i.e., a BPDU that would make the local switch root or change the root bridge), the port is moved to a root-inconsistent state. This blocks all traffic on the port to protect the existing root bridge and prevent a rogue switch from hijacking the spanning tree. The symptom matches exactly—the port is administratively placed in this state, not in err-disable or loop-inconsistent.

Why this answer

Root guard, when enabled on a port, places that port into a root-inconsistent blocking state if it receives a superior BPDU, preventing the switch from becoming the root bridge. This root-inconsistent state stops forwarding traffic, which explains why users in VLAN 10 cannot reach the default gateway. The port remains physically up but is blocked by spanning tree, so normal interface status would not show a down state, making the root-inconsistent state the key indicator.

Exam trap

Candidates often confuse root guard with BPDU guard: BPDU guard err-disables a port upon receiving any BPDU on a PortFast port, while root guard responds to superior BPDUs by placing the port in root-inconsistent state, not err-disable.

Why the other options are wrong

BPDU guard causes an err-disable state, which would show the interface as down or err-disabled, not as root-inconsistent.

Loop guard places a port into loop-inconsistent blocking state when BPDUs stop being received, not when a superior BPDU is received.

A forwarding state would allow traffic; the problem here is that the port is in a blocked state due to root guard, not a misconfigured VLAN.

Practice this question →

PBQhard

You are connected to R1. Configure HSRP so that R1 becomes the active router for VLAN 10, with a virtual IP of 192.168.10.1. Ensure that R1 preempts if it comes back online after a failure. Also, configure R1 to decrement its HSRP priority by 20 if its GigabitEthernet0/1 interface goes down. The current configuration shows both routers as active — identify and fix the issues.

Network Topology

Hints

•Both routers show Active because they have equal priority and no preempt.
•The virtual IP configured is 192.168.10.254 but the task requires 192.168.10.1.
•To ensure R1 is active, set its priority higher than R2's default (100) and enable preempt.

A.Change the virtual IP to 192.168.10.1, set priority to 110, enable preempt, and track interface GigabitEthernet0/1 with decrement 20.

B.Change the virtual IP to 192.168.10.1, set priority to 100, enable preempt, and track interface GigabitEthernet0/1 with decrement 20.

C.Change the virtual IP to 192.168.10.254, set priority to 110, enable preempt, and track interface GigabitEthernet0/1 with decrement 20.

D.Change the virtual IP to 192.168.10.1, set priority to 110, enable preempt, but do not track any interface.

AnswerA

solution

! R1
interface GigabitEthernet0/0.10
standby 10 ip 192.168.10.1
standby 10 priority 110
standby 10 preempt
standby 10 track GigabitEthernet0/1 20

Why this answer

The scenario indicates both routers appear as Active, which is abnormal. This could result from a misconfigured virtual IP or group number mismatch. The required fix is to set the virtual IP to 192.168.10.1, assign R1 a higher priority (110 vs R2's default 100), enable preempt so R1 reclaims active role after failure, and track GigabitEthernet0/1 with a decrement of 20 to lower priority if that interface goes down.

Exam trap

Watch for three common mistakes: (1) forgetting to set a higher priority to win the election, (2) using the wrong virtual IP address, and (3) omitting the track command when required. Also note that preempt alone does not guarantee active status if priorities are equal.

Why the other options are wrong

HSRP election uses priority as the primary tie-breaker; equal priority leads to comparison of primary IP addresses, which may not favor R1.

The virtual IP address must be consistent across all HSRP routers and match the configured gateway; a mismatch prevents proper operation.

Without tracking, R1's priority remains unchanged even if the uplink fails, so R1 would remain active despite losing connectivity, causing traffic black-holing.

Practice this question →

Drag & Dropmedium

Drag and drop the following steps into the correct order to create VLANs, assign access ports, configure 802.1Q trunks, set the native VLAN, and verify with 'show vlan brief' and 'show interfaces trunk'.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

VLANs must be created before assigning ports; trunking is configured after access ports; verification is the final step.

Exam trap

Do not confuse the order of VLAN creation and port assignment. VLANs must be created before ports can be assigned to them. Also, native VLAN configuration is part of trunk configuration and should be done after trunk mode is set.

Practice this question →