CCNA VLAN Questions — Page 2 of 4

MCQmedium

A campus switch has VLANs 10, 20, and 30 configured. Port GigabitEthernet0/5 connects to a server that must send and receive traffic for all three VLANs, and the server's NIC supports 802.1Q tagging. The administrator wants the server to handle VLAN tagging itself. Which configuration on GigabitEthernet0/5 is appropriate?

A.switchport mode access and switchport access vlan 10

B.switchport mode trunk, switchport trunk native vlan 10, and switchport access vlan 20

C.switchport mode trunk and switchport trunk allowed vlan 10,20,30

D.switchport mode dynamic desirable and switchport trunk allowed vlan 10,20,30

AnswerC

A trunk port with the allowed VLAN list permits the server to send and receive tagged frames for VLANs 10, 20, and 30. Because the server NIC supports 802.1Q, it can create and interpret the tags itself, so the switch does not need to assign an access VLAN. This matches the requirement for a single interface carrying multiple VLANs.

Why this answer

When a server NIC performs 802.1Q tagging itself, the switch port must be a trunk so tagged frames for multiple VLANs can pass. Restricting the allowed VLAN list to 10, 20, and 30 limits unnecessary traffic and matches the requirement. A static trunk avoids DTP negotiation issues with a server that does not run DTP.

Exam trap

The trap here is assuming an access port can carry multiple VLANs if the NIC tags frames, but access ports do not forward tagged traffic for other VLANs.

Practice this question →

MCQhard

A network engineer has enabled DHCP snooping on a Catalyst switch to prevent rogue DHCP servers. All access ports in VLAN 10 are untrusted. A router attached to a trunk port on the switch acts as the default gateway for VLAN 10 and is configured with the ip helper-address 10.1.2.5, which points to a remote DHCP server. After enabling DHCP snooping, hosts in VLAN 10 cannot obtain IP addresses; packet captures show DHCPDISCOVER messages are sent, but no DHCPOFFER is received. What is the most likely cause?

A.The router's ip helper-address command is pointing to an incorrect DHCP server IP address.

B.The switch port connecting to the router is not configured as a trusted port for DHCP snooping.

C.The DHCP server is on a different subnet, so the switch needs a switched virtual interface (SVI) in VLAN 10 with an IP address for Layer 3 connectivity.

D.DHCP snooping is dropping DHCPDISCOVER messages because the client access ports are untrusted.

AnswerB

DHCP snooping trusts only designated ports to forward DHCP server messages. Since the router relays the DHCPOFFER onto the trunk port, an untrusted port will cause the switch to discard the offer, resulting in DHCP failure.

Why this answer

DHCP snooping treats all ports as untrusted by default. When a router acting as a DHCP relay is connected to an untrusted trunk port, the switch drops DHCPOFFER messages received from the router because they originate from an untrusted interface. Configuring the trunk port as trusted allows DHCP server responses (OFFER, ACK) to pass through to clients.

Exam trap

Cisco often tests the distinction that DHCP snooping blocks DHCP server messages (OFFER/ACK/NAK) on untrusted ports, not client messages (DISCOVER/REQUEST), leading candidates to incorrectly assume client messages are dropped.

Why the other options are wrong

This distractor exploits the common tendency to blame the helper address configuration first, overlooking the security feature that silently drops the returning DHCPOFFER.

This plays on the misconception that a switch requires an IP address on the client VLAN to facilitate DHCP, when in fact the router acting as the relay agent provides Layer 3 connectivity.

This misinterprets DHCP snooping behavior: it assumes all DHCP traffic is filtered on untrusted ports, overlooking the critical distinction that only server-side messages are blocked, not client requests.

Practice this question →

PBQhard

You are troubleshooting a PC (PC-A) connected to switch SW1, which is connected to router R1. PC-A has an APIPA address (169.254.23.45) and cannot reach the internet (203.0.113.1). You confirm that R1 has a correctly configured DHCP pool for the 192.168.10.0/24 subnet, but the DHCP service is not enabled. The network uses VLAN 10 with subnet 192.168.10.0/24. Verify and correct the configuration on PC-A, SW1, and R1 to restore full connectivity.

Network Topology

Hints

•Check if the DHCP server process is running on R1.
•APIPA addresses (169.254.x.x) indicate DHCP failure.
•The DHCP pool is configured but not yet active.

A.Enable the DHCP service on R1 with the 'service dhcp' command.

B.Configure a default gateway on PC-A with the IP address 192.168.10.1.

C.Change the VLAN on SW1's interface connected to PC-A from VLAN 10 to VLAN 1.

D.Add the 'ip helper-address' command on R1's interface connected to SW1.

AnswerA

solution

! R1
service dhcp

! SW1


! PC-A

Why this answer

The APIPA address (169.254.x.x) indicates that PC-A failed to obtain a DHCP lease. The correct solution is to enable the DHCP service on R1 with 'service dhcp', which is not running despite the configured pool. Option B is incorrect because setting a default gateway on PC-A with a static IP would still require a valid address in the subnet; the APIPA address cannot communicate with 192.168.10.1.

Option C is wrong because the PC-A interface on SW1 is correctly assigned to VLAN 10. Option D is unnecessary since R1 is directly connected to the same subnet, so 'ip helper-address' is only used to forward DHCP broadcasts across router boundaries.

Exam trap

Do not assume that configuring a DHCP pool is sufficient; the DHCP service must be explicitly enabled with 'service dhcp'. Also, remember that APIPA addresses indicate DHCP failure, not just a missing gateway.

Why the other options are wrong

The PC's APIPA address cannot reach the 192.168.10.1 gateway because it is not in the same subnet, so configuring a default gateway alone does not restore connectivity.

Changing the VLAN to VLAN 1 would isolate PC-A from the correct subnet (VLAN 10), breaking connectivity instead of fixing it.

The 'ip helper-address' command is used on interfaces that need to forward DHCP broadcasts to a remote DHCP server; here R1 itself is the DHCP server and is directly attached, so the command is not needed.

Practice this question →

PBQhard

You are connected to R1, a multilayer switch acting as the STP root for VLAN 10. Configure Root Guard on the designated port facing a downstream switch to prevent a rogue switch from becoming root. Also, enable Loop Guard on the uplink port to prevent STP loops, and configure BPDU Guard on a PortFast-enabled access port. Ensure that if a superior BPDU is received on the Root Guard port, it is blocked, and if a BPDU is received on the BPDU Guard port, it goes err-disabled.

Network Topology

Hints

•Root Guard is applied on designated ports to block superior BPDUs.
•Loop Guard is applied on root or alternate ports to prevent loops if BPDUs stop.
•BPDU Guard with PortFast err-disables the port upon receiving any BPDU.

A.The configuration is correct; no changes are needed.

B.Root Guard should be applied on G0/0 instead of G0/1, and Loop Guard on G0/1 instead of G0/0.

C.BPDU Guard should be configured on G0/1 instead of G0/2, and Loop Guard should be removed from G0/0.

D.Root Guard should be applied on G0/2 instead of G0/1, and BPDU Guard should be removed from G0/2.

AnswerA

solution

! R1

Why this answer

R1 is the STP root for VLAN 10. The downstream port (G0/1) is a designated port, so Root Guard is correctly applied to prevent a superior BPDU from being accepted. The uplink port (G0/0) is a root port, so Loop Guard should be applied there to prevent an STP loop if BPDUs stop arriving.

The access port (G0/2) has PortFast and BPDU Guard enabled, which will err-disable the port if a BPDU is received. The current configuration is correct; no changes are needed. If a superior BPDU arrives on G0/1, Root Guard will block the port.

If a BPDU arrives on G0/2, BPDU Guard will err-disable it.

Exam trap

The trap is that candidates may think changes are needed because they misapply STP protections to the wrong port types. Remember: Root Guard on designated ports, Loop Guard on root/alternate ports, BPDU Guard on PortFast access ports.

Why the other options are wrong

Root Guard is only effective on designated ports; applying it to a root port would not prevent a rogue switch from becoming root. Loop Guard on a designated port is unnecessary and could cause false positives.

BPDU Guard on a trunk port would err-disable it upon receiving a BPDU, which is normal for trunk ports. Loop Guard on the root port is essential for loop prevention; removing it would leave the network vulnerable.

Root Guard on an access port would block the port if a superior BPDU is received, but access ports should not receive BPDUs if PortFast is enabled. BPDU Guard already handles that by err-disabling the port.

Practice this question →

PBQhard

You are connected to a multilayer switch MLS1 via the console. Configure MLS1 so that IP phones connected to interface GigabitEthernet0/1 receive power via PoE, use VLAN 10 for data traffic, and use VLAN 20 for voice traffic, while the access port for an AP on GigabitEthernet0/2 should be placed in VLAN 30 and have PoE disabled. Verify your configuration using appropriate show commands.

Hints

•Voice VLAN is configured with a separate command from the access VLAN.
•PoE can be disabled per interface using 'power inline never'.
•Use 'show interfaces switchport' to see both voice and access VLAN assignments.

A.interface GigabitEthernet0/1 switchport mode access switchport access vlan 10 switchport voice vlan 20 power inline auto ! interface GigabitEthernet0/2 switchport mode access switchport access vlan 30 power inline never

B.interface GigabitEthernet0/1 switchport mode trunk switchport trunk allowed vlan 10,20 power inline auto ! interface GigabitEthernet0/2 switchport mode access switchport access vlan 30 power inline never

C.interface GigabitEthernet0/1 switchport mode access switchport access vlan 20 switchport voice vlan 10 power inline auto ! interface GigabitEthernet0/2 switchport mode access switchport access vlan 30 power inline never

D.interface GigabitEthernet0/1 switchport mode access switchport access vlan 10 switchport voice vlan 20 power inline never ! interface GigabitEthernet0/2 switchport mode access switchport access vlan 30 power inline auto

AnswerA

solution

! MLS1
interface GigabitEthernet0/1
switchport voice vlan 20
power inline auto
interface GigabitEthernet0/2
switchport access vlan 30
power inline never

Why this answer

For the IP phone port (G0/1), you need to enable PoE (power inline auto) and configure the voice VLAN (switchport voice vlan 20) so that the phone uses VLAN 20 for voice and the access VLAN 10 for data. For the AP port (G0/2), you must change the access VLAN to 30 and disable PoE (power inline never) to prevent powering the AP through the switch. Verify with 'show interfaces switchport' to confirm voice VLAN and access VLAN settings, and 'show power inline' to check PoE status.

Exam trap

A common trap is confusing the voice VLAN command with trunking or swapping the access and voice VLANs. Also, remember that IP phones require PoE, while the AP in this scenario does not. Always verify with show commands.

Why the other options are wrong

The specific factual error is that IP phones typically use an access port with a voice VLAN, not a trunk port. Trunking is unnecessary and can cause compatibility issues.

The specific factual error is confusing the access VLAN and voice VLAN assignments. The voice VLAN is configured with 'switchport voice vlan', and the access VLAN with 'switchport access vlan'.

The specific factual error is reversing the PoE settings: 'power inline never' on the phone port and 'power inline auto' on the AP port.

Practice this question →

MCQhard

A network engineer has implemented DHCP snooping on a Cisco switch to prevent unauthorized DHCP servers. The switch's VLAN 100 SVI is configured with ip helper-address to relay DHCP requests to a legitimate server in VLAN 200. Clients in VLAN 100 cannot obtain IP leases, even though the DHCP server is reachable from the switch and has available addresses.

A.The ip helper-address command has been incorrectly applied to VLAN 100 instead of VLAN 200.

B.The switch port that connects to the DHCP server's VLAN is not configured as a trusted DHCP snooping port.

C.DHCP snooping must be disabled globally because it conflicts with the configured DHCP relay agent.

D.The DHCP server lacks a valid default gateway, preventing replies from reaching the relay agent's SVI subnet.

AnswerB

DHCP snooping drops DHCPOFFER and DHCPACK messages received on untrusted ports, since only trusted ports are allowed to accept server-originated replies. The switch port connected to the legitimate DHCP server in VLAN 200 must be explicitly configured as trusted with 'ip dhcp snooping trust'. Without that, the relay agent forwards the client's DISCOVER, but the server's OFFER/ACK are silently discarded, leaving clients without a lease despite the relay configuration.

Why this answer

DHCP snooping treats all switch ports as untrusted by default, which blocks DHCP server messages (OFFER, ACK) from entering the switch. Even though the switch itself can reach the DHCP server, the relayed reply from the server arrives on a port that is not trusted, so DHCP snooping drops the packet before it can be forwarded to the client. Configuring the port connecting to the DHCP server as a trusted port allows the server's responses to pass through the switch, resolving the issue.

Exam trap

Cisco often tests the interaction between DHCP snooping and DHCP relay, where candidates mistakenly think the relay bypasses snooping or that the issue is with the helper-address configuration, rather than the untrusted port blocking the server's unicast reply.

Why the other options are wrong

Many engineers mistakenly think the helper should reside on the server VLAN; however, it must reside on the client-facing L3 interface.

A common misconception is that DHCP relay bypasses snooping, but snooping still inspects the server's unicast response and drops it unless the ingress port is trusted.

Candidates often suspect routing issues, but verified reachability eliminates this. The problem lies in the snooping policy, not IP connectivity.

Practice this question →

MCQmedium

A switch stack is running PVST+. Users on VLAN 40 lose connectivity for roughly 30 seconds every time the uplink on SW2 flaps. Based on the exhibit, which change would most directly improve convergence for this VLAN?

A.Configure spanning-tree mode rapid-pvst.

B.Increase the bridge priority on SW2 for VLAN 40.

C.Disable PortFast on all access ports.

D.Convert the uplink to a routed port.

AnswerA

Configuring `spanning-tree mode rapid-pvst` directly addresses the 30-second connectivity loss by enabling Rapid PVST+ (R-PVST+). PVST+ utilises fixed listening and learning states, contributing to the observed delay during topology changes. R-PVST+ employs a rapid convergence mechanism, such as the Proposal/Agreement (P/A) process, allowing designated and root ports to transition to forwarding much faster, often within sub-seconds. This significantly reduces the reconvergence time for VLAN 40 when SW2's uplink flaps, directly improving user connectivity.

Why this answer

The output shows VLAN 40 is still using the legacy IEEE STP process, which converges much more slowly than Rapid PVST+. Moving the switch to rapid-pvst mode gives VLAN 40 the faster proposal/agreement behavior that typically cuts convergence time from tens of seconds to a few seconds.

Exam trap

A frequent exam trap is selecting options that change the root bridge election or port roles, such as increasing bridge priority, assuming this will speed up convergence. While root bridge placement affects path selection, it does not reduce the inherent delay caused by legacy STP timers. Another trap is disabling PortFast on access ports, which only affects edge port transitions and does not influence uplink link flap recovery times.

Additionally, converting uplinks to routed ports changes the network design and removes STP from those ports, which is not the intended solution for VLAN-specific STP convergence delays. The key mistake is confusing topology optimization with protocol speed improvements.

Why the other options are wrong

Increasing bridge priority changes root bridge election but does not speed up the STP convergence process, so it does not resolve the 30-second connectivity loss.

Disabling PortFast affects only edge ports and does not influence the convergence time of uplink ports or VLANs experiencing link flaps.

Converting the uplink to a routed port removes it from STP but alters network design and does not specifically improve VLAN 40’s STP convergence speed.

Practice this question →

MCQhard

A network engineer receives a call that users in VLAN 10 on Switch B cannot ping the default gateway, which is a router on a stick connected to Switch A. The engineer checks the Spanning Tree Protocol state on the interface connecting Switch A to Switch B (GigabitEthernet0/1) and finds it is in a root-inconsistent state. Which command output best explains the cause of the issue?

A.The interface is in err-disable state due to BPDU guard.

B.Root guard is enabled and the port received a superior BPDU, causing it to become root-inconsistent.

C.Loop guard is enabled and the port is in a blocking state due to missing BPDUs.

D.The port is in a forwarding state but the VLAN is misconfigured.

AnswerB

Root guard is correctly the cause: when a port configured with root guard receives a superior BPDU (i.e., a BPDU that would make the local switch root or change the root bridge), the port is moved to a root-inconsistent state. This blocks all traffic on the port to protect the existing root bridge and prevent a rogue switch from hijacking the spanning tree. The symptom matches exactly—the port is administratively placed in this state, not in err-disable or loop-inconsistent.

Why this answer

Root guard, when enabled on a port, places that port into a root-inconsistent blocking state if it receives a superior BPDU, preventing the switch from becoming the root bridge. This root-inconsistent state stops forwarding traffic, which explains why users in VLAN 10 cannot reach the default gateway. The port remains physically up but is blocked by spanning tree, so normal interface status would not show a down state, making the root-inconsistent state the key indicator.

Exam trap

Candidates often confuse root guard with BPDU guard: BPDU guard err-disables a port upon receiving any BPDU on a PortFast port, while root guard responds to superior BPDUs by placing the port in root-inconsistent state, not err-disable.

Why the other options are wrong

BPDU guard causes an err-disable state, which would show the interface as down or err-disabled, not as root-inconsistent.

Loop guard places a port into loop-inconsistent blocking state when BPDUs stop being received, not when a superior BPDU is received.

A forwarding state would allow traffic; the problem here is that the port is in a blocked state due to root guard, not a misconfigured VLAN.

Practice this question →

PBQhard

You are connected to R1. Configure HSRP so that R1 becomes the active router for VLAN 10, with a virtual IP of 192.168.10.1. Ensure that R1 preempts if it comes back online after a failure. Also, configure R1 to decrement its HSRP priority by 20 if its GigabitEthernet0/1 interface goes down. The current configuration shows both routers as active — identify and fix the issues.

Network Topology

Hints

•Both routers show Active because they have equal priority and no preempt.
•The virtual IP configured is 192.168.10.254 but the task requires 192.168.10.1.
•To ensure R1 is active, set its priority higher than R2's default (100) and enable preempt.

A.Change the virtual IP to 192.168.10.1, set priority to 110, enable preempt, and track interface GigabitEthernet0/1 with decrement 20.

B.Change the virtual IP to 192.168.10.1, set priority to 100, enable preempt, and track interface GigabitEthernet0/1 with decrement 20.

C.Change the virtual IP to 192.168.10.254, set priority to 110, enable preempt, and track interface GigabitEthernet0/1 with decrement 20.

D.Change the virtual IP to 192.168.10.1, set priority to 110, enable preempt, but do not track any interface.

AnswerA

solution

! R1
interface GigabitEthernet0/0.10
standby 10 ip 192.168.10.1
standby 10 priority 110
standby 10 preempt
standby 10 track GigabitEthernet0/1 20

Why this answer

The scenario indicates both routers appear as Active, which is abnormal. This could result from a misconfigured virtual IP or group number mismatch. The required fix is to set the virtual IP to 192.168.10.1, assign R1 a higher priority (110 vs R2's default 100), enable preempt so R1 reclaims active role after failure, and track GigabitEthernet0/1 with a decrement of 20 to lower priority if that interface goes down.

Exam trap

Watch for three common mistakes: (1) forgetting to set a higher priority to win the election, (2) using the wrong virtual IP address, and (3) omitting the track command when required. Also note that preempt alone does not guarantee active status if priorities are equal.

Why the other options are wrong

HSRP election uses priority as the primary tie-breaker; equal priority leads to comparison of primary IP addresses, which may not favor R1.

The virtual IP address must be consistent across all HSRP routers and match the configured gateway; a mismatch prevents proper operation.

Without tracking, R1's priority remains unchanged even if the uplink fails, so R1 would remain active despite losing connectivity, causing traffic black-holing.

Practice this question →

Drag & Dropmedium

Drag and drop the following steps into the correct order to create VLANs, assign access ports, configure 802.1Q trunks, set the native VLAN, and verify with 'show vlan brief' and 'show interfaces trunk'.

Drag or tap steps into the slots.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

VLANs must be created before assigning ports; trunking is configured after access ports; verification is the final step.

Exam trap

Do not confuse the order of VLAN creation and port assignment. VLANs must be created before ports can be assigned to them. Also, native VLAN configuration is part of trunk configuration and should be done after trunk mode is set.

Practice this question →

MCQmedium

A switch displays the following output: Interface Status VLAN Gi1/0/5 connected 20 Gi1/0/6 notconnect 1 Gi1/0/24 trunk trunk Which interface is operating as an access port in VLAN 20?

A.Gi1/0/5

B.Gi1/0/6

C.Gi1/0/24

D.None of the interfaces

AnswerA

The output for Gi1/0/5 shows an interface that is up/connected and explicitly assigned to VLAN 20 as an access port, which exactly matches the requirement stated in the question. The status column indicates the link is active, and the VLAN column confirms membership in VLAN 20, leaving no doubt that this is the correct interface.

Why this answer

The output explicitly shows Gi1/0/5 in VLAN 20 and not operating as a trunk.

Exam trap

Be careful not to confuse trunk ports with access ports or assume interfaces not shown in the output are relevant.

Why the other options are wrong

Gi1/0/6 is an access port in VLAN 1 (the default VLAN), not VLAN 20. The question specifically asks for an interface operating as an access port in VLAN 20, so this option is incorrect.

Gi1/0/24 is configured as a trunk port, which carries traffic for multiple VLANs and is not an access port. Access ports belong to a single VLAN, so this option is incorrect.

Gi1/0/5 is clearly an access port in VLAN 20, so there is an interface that matches the description. Therefore, 'None of the interfaces' is incorrect.

Practice this question →

MCQhard

A network engineer notices that users on VLAN 100 are experiencing intermittent connectivity to the server farm. The switch connecting these users shows no errors on the uplink interface, but the server farm switch reports a high number of input errors on its connected interface. The engineer runs 'show controllers' on the server farm switch. What is the most likely cause of the issue?

A.The interface is configured with the wrong duplex setting.

B.The SFP module is faulty or incompatible with the cable type.

C.The cable is too long, causing attenuation.

D.Auto-negotiation is disabled, causing a speed mismatch.

AnswerB

The 'show controllers' output shows the media type as 1000BaseSX SFP with auto-negotiation off, but the interface is reporting no errors. However, the other switch sees input errors. This points to a hardware issue with the SFP, such as a faulty module or a mismatch between the SFP and the fiber cable (e.g., using a single-mode SFP with multi-mode fiber).

Why this answer

The 'show controllers' command on the server farm switch reveals physical-layer issues such as framing errors, CRC errors, or alignment errors, which are often caused by faulty or incompatible SFP modules. Since the uplink interface on the user switch shows no errors, the problem is isolated to the server farm switch's interface, and a faulty SFP can introduce signal degradation or electrical issues without necessarily causing complete link failure. Option B is correct because SFP incompatibility or defects commonly produce input errors at the physical layer, even when the link appears up.

Exam trap

Cisco often tests the distinction between 'show interfaces' (which shows input errors but not the specific physical-layer cause) and 'show controllers' (which reveals the exact physical-layer errors), leading candidates to mistakenly choose duplex mismatch or cable length issues without recognizing that the command output points to SFP or transceiver problems.

Why the other options are wrong

The 'show controllers' output confirms Full-duplex on both ends, so a duplex mismatch is not the cause. Duplex mismatch would typically cause collisions or CRC errors, which are not indicated here.

While excessive cable length can cause attenuation and errors, the 'show controllers' output does not show specific error counters like symbol errors or FCS errors that would indicate attenuation. The link is up and no errors are reported on this switch, making cable length an unlikely cause.

Speed is set to 1000 Mbps on both ends, and auto-negotiation is off, which is normal for fiber connections. A speed mismatch would prevent the link from coming up or cause constant errors, but the link is up and no errors are reported on this switch.

Practice this question →

Multi-Selecthard

A trunk link between two switches is up, but hosts in VLAN 30 on opposite switches cannot communicate. VLAN 10 works across the same trunk. Which two causes are the most likely?

Select 2 answers

A.VLAN 30 is not allowed on the trunk on one side

B.VLAN 30 may not exist in the VLAN database on the affected switch

C.The trunk native VLAN should always be 30

D.PortFast must be disabled on the access ports in VLAN 30

AnswersA, B

A trunk port has an allowed VLAN list, and both ends must include VLAN 30 in that list for its traffic to cross the link. If one switch's trunk configuration omits VLAN 30 (via the allowed vlan command), the trunk remains up and carries other VLANs, but frames tagged with VLAN 30 are discarded at that port. This mismatch is a frequent cause of a single VLAN failing while the trunk itself appears operational.

Why this answer

When one VLAN fails but others work across the same trunk, the problem is likely VLAN-specific. VLAN 30 may not exist on one switch or may not be allowed on the trunk. Option C is incorrect because the native VLAN does not need to be 30; a native VLAN mismatch would typically cause connectivity issues on all VLANs, not just VLAN 30.

Option D is incorrect because PortFast only affects the speed at which an access port enters the forwarding state and does not impact communication across an already-up trunk.

Exam trap

Don't assume trunk issues affect all VLANs equally; check for VLAN-specific settings.

Why the other options are wrong

The native VLAN ID is not required to match the VLAN that is having connectivity issues; native VLAN is used for untagged traffic on the trunk and does not affect communication for specific VLANs like VLAN 30.

PortFast is used on access ports to speed up the transition to forwarding state and is unrelated to inter-VLAN communication across a trunk. Disabling PortFast would not resolve connectivity issues for VLAN 30 hosts on different switches.

Practice this question →

MCQhard

A switch port is configured with `switchport voice vlan 150` and `switchport access vlan 20`. Which statement best explains the design purpose?

A.It separates voice and data traffic on the same edge port by assigning them to different VLANs.

B.It turns the port into a routed WAN interface.

C.It forces the phone to use CAPWAP before receiving power.

D.It makes VLAN 150 the native VLAN on all trunks automatically.

AnswerA

The `switchport voice vlan 150` command marks the port as a Cisco Unified Communications access port, so it instructs an attached IP phone to tag its voice frames with VLAN 150 while the PC behind the phone remains untagged on the data VLAN. As a result, voice and data traffic share the same physical cable but are isolated into separate Layer 2 broadcast domains, allowing distinct QoS policies, subnets, and security controls to be applied independently.

Why this answer

The design purpose is to let the switch support a phone and an attached workstation on the same physical access port while placing their traffic into different VLANs. In practical terms, the phone can use the voice VLAN while the user's data traffic uses the access VLAN. This is a common enterprise edge design for IP telephony.

The key idea is role separation on one port, not trunking the port as a normal inter-switch link.

Exam trap

Avoid confusing voice VLAN configurations with trunking or prioritization settings.

Why the other options are wrong

The commands `switchport voice vlan 150` and `switchport access vlan 20` are used on a Layer 2 switch port, not a routed interface. A routed WAN interface would require `no switchport` and an IP address configuration, which is not present here.

CAPWAP (Control and Provisioning of Wireless Access Points) is a protocol used for wireless LAN controller and access point communication, not for voice VLAN configuration. The voice VLAN feature is unrelated to CAPWAP.

The `switchport voice vlan` command only affects the specific access port where it is configured, not all trunk ports. The native VLAN on trunks is configured separately with `switchport trunk native vlan`.

Practice this question →

PBQhard

You are connected to WLC-1 via the management interface (192.168.1.100/24). The wireless network 'CustomerNet' uses WPA3-Personal, but clients are failing to associate. The SSID is hidden and the correct VLAN is 30. Configure the WLAN and SSID parameters to allow successful client associations and verify the configuration.

Network Topology

Hints

•Remember to create the interface before assigning it to the WLAN.
•WPA3-Personal uses a pre-shared key (PSK) but the command is 'security wpa3'.
•The SSID broadcast must be enabled ('broadcast-ssid enable') for clients to discover it.

A.Create a new interface 'vlan30' with VLAN 30, then create a new WLAN with SSID 'CustomerNet', set security to WPA3-Personal, enable SSID broadcast, and assign the 'vlan30' interface.

B.Modify the existing GuestNet WLAN: change security to WPA3-Personal, enable SSID broadcast, and change the interface to 'guest' (VLAN 20).

C.Create a new WLAN with SSID 'CustomerNet', set security to WPA2-PSK, enable SSID broadcast, and assign the 'guest' interface (VLAN 20).

D.Modify the GuestNet WLAN: change security to WPA3-Personal, keep SSID broadcast disabled, and change the interface to a new interface mapped to VLAN 30.

AnswerA

solution

! WLC-1
config terminal
interface customer
vlan 30
ip address 192.168.30.1 255.255.255.0
exit
wlan 3
ssid CustomerNet
broadcast-ssid enable
security wpa3
security wpa akm psk set-key ascii 0 CiscoSecure123
interface customer
no shutdown
end

Why this answer

The GuestNet WLAN (ID 2) currently uses WPA2 with PSK, but clients expect WPA3-Personal. Additionally, the SSID is hidden (broadcast disabled) and the interface is set to guest (VLAN 20) instead of the required VLAN 30. To fix, create a new WLAN (or modify WLAN 2) to use WPA3-Personal, enable SSID broadcast, and assign it to a new interface mapped to VLAN 30.

Configure the interface first, then apply to the WLAN.

Exam trap

A common trap is to assume that modifying the existing WLAN is sufficient, but you must also ensure the correct VLAN interface exists and is assigned. Additionally, candidates often forget that a hidden SSID must be broadcast for clients to discover it, especially when clients are failing to associate.

Why the other options are wrong

The specific factual error is that the interface remains set to 'guest' (VLAN 20) instead of being changed to VLAN 30 as required.

The specific factual errors are using WPA2-PSK (clients expect WPA3-Personal) and assigning the wrong VLAN (20 instead of 30).

The specific factual error is that the SSID broadcast remains disabled, which means clients cannot see the SSID and will not attempt to associate.

Practice this question →

PBQhard

You are connected to R1. Configure DHCP services so that hosts on VLAN 10 (192.168.10.0/24) can obtain IP addresses from R1. Additionally, configure the switch SW1 to prevent rogue DHCP server attacks on that VLAN. The current configuration has a misconfigured helper-address and an excluded-address range that is too broad.

Network Topology

Hints

•The helper-address should point to the DHCP server itself, not an external address.
•The excluded-address range is too wide; leave room for hosts to get IPs.
•On the switch, only the port connecting to the legitimate DHCP server should be trusted.

A.On R1, change the helper-address to 192.168.10.1 and the excluded-address range to 192.168.10.1 192.168.10.10. On SW1, enable DHCP snooping globally and for VLAN 10, and set interface G0/1 as trusted.

B.On R1, change the helper-address to 192.168.10.255 and the excluded-address range to 192.168.10.1 192.168.10.10. On SW1, enable DHCP snooping globally and for VLAN 10, and set all ports as trusted.

C.On R1, change the helper-address to 192.168.10.1 and the excluded-address range to 192.168.10.1 192.168.10.254. On SW1, enable DHCP snooping globally and for VLAN 10, and set interface G0/1 as untrusted.

D.On R1, change the helper-address to 192.168.10.1 and the excluded-address range to 192.168.10.1 192.168.10.10. On SW1, enable DHCP snooping globally and for VLAN 10, and set interface G0/1 as untrusted.

AnswerA

solution

! R1
configure terminal
no ip dhcp excluded-address 192.168.10.1 192.168.10.254
ip dhcp excluded-address 192.168.10.1 192.168.10.10
interface GigabitEthernet0/0.10
no ip helper-address 10.0.0.2
ip helper-address 192.168.10.1
end

! SW1
configure terminal
ip dhcp snooping
ip dhcp snooping vlan 10
interface GigabitEthernet0/1
ip dhcp snooping trust
interface GigabitEthernet0/2
no ip dhcp snooping limit rate 10
ip dhcp snooping limit rate 15
end

Why this answer

The helper-address on R1's subinterface points to 10.0.0.2 instead of the DHCP server's IP (R1 itself, which is the server). The excluded-address range excludes all addresses in the subnet, preventing any host from getting an IP. The fix: change helper-address to 192.168.10.1 (loopback or interface IP of R1), and narrow the excluded range to the first 10 addresses (or just the gateway).

On SW1, enable DHCP snooping globally and for VLAN 10, and mark the port facing R1 (G0/1) as trusted; other ports should be untrusted to block rogue servers.

Exam trap

Watch out for two common traps: (1) The helper-address must be the DHCP server's unicast IP, not a broadcast address. (2) DHCP snooping trusted ports are for server connections; untrusted ports are for clients. Misplacing these will break DHCP or security.

Why the other options are wrong

The helper-address must be a unicast IP address of the DHCP server, not a broadcast address. Additionally, only ports connected to legitimate DHCP servers should be trusted; all other ports must be untrusted to block rogue servers.

The excluded-address range should only reserve a few addresses (e.g., for the gateway and static assignments), not the entire subnet. The port connected to the DHCP server must be trusted to allow DHCP server messages; untrusted ports block such messages.

DHCP snooping requires that ports connected to legitimate DHCP servers be configured as trusted. Untrusted ports are for client-facing ports where rogue servers might appear; they drop DHCP server messages.

Practice this question →

PBQhard

You are managing a Cisco WLC (WLC-1) with IP 10.10.10.10. A wireless client reports it can see the SSID 'CorpNet' but fails to associate. The SSID is configured for WPA3, but the client only supports WPA2. Additionally, the WLAN is mapped to VLAN 100, but the AP is on VLAN 10, causing a mismatch. Your task: reconfigure the WLAN to use WPA2-PSK with AES encryption, correct the VLAN assignment to 10, and ensure the SSID is hidden. Also, verify that management access via the WLC web UI is restricted to the 192.168.1.0/24 subnet.

Network Topology

Hints

•The client cannot join because WPA3 is required but the client only supports WPA2.
•The WLAN is on VLAN 100, but the AP is on VLAN 10 — this mismatch prevents client traffic from being properly bridged.
•Management access is open to all; restrict it to the subnet that contains your admin workstation.

A.Change security to WPA2-PSK with AES, disable PMF, map WLAN to management interface (VLAN 10), disable SSID broadcast, restrict HTTP/HTTPS access to 192.168.1.0/24.

B.Change security to WPA2-PSK with TKIP, enable PMF, map WLAN to VLAN 100, enable SSID broadcast, restrict HTTP access to 192.168.1.0/24.

C.Change security to WPA3-PSK with AES, disable PMF, map WLAN to VLAN 10, disable SSID broadcast, restrict HTTP/HTTPS access to 10.10.10.0/24.

D.Change security to WPA2-PSK with AES, enable PMF, map WLAN to VLAN 10, enable SSID broadcast, restrict HTTP/HTTPS access to 192.168.1.0/24.

AnswerA

solution

! WLC-1
config wlan 1
no security wpa3
security wpa2
security wpa2 akm psk
security wpa2 encryption aes
no security wpa3 pmf
interface VLAN10
no broadcast-ssid
end
config management
management http subnet 192.168.1.0 255.255.255.0
management https subnet 192.168.1.0 255.255.255.0
end

Why this answer

The client cannot associate because the WLAN requires WPA3 (PMF required) but the client only supports WPA2. Also, the WLAN is mapped to VLAN 100, but the AP is on VLAN 10, causing a VLAN mismatch that prevents client traffic from reaching the correct subnet. The SSID is broadcast (visible), and management access is open to all subnets.

To fix: change the WLAN security to WPA2-PSK with AES, disable PMF, map the WLAN to the management interface (VLAN 10), disable SSID broadcast, and restrict HTTP/HTTPS access to subnet 192.168.1.0/24.

Exam trap

The exam trap is that candidates may overlook the VLAN mismatch or the requirement to disable PMF when switching from WPA3 to WPA2. Also, they might forget to restrict both HTTP and HTTPS, or confuse the management subnet with the WLC IP address. Always verify client capabilities and VLAN assignments.

Why the other options are wrong

The specific factual error: TKIP is deprecated and not used with WPA2-PSK; PMF must be disabled for WPA2-only clients; VLAN 100 is incorrect; SSID broadcast should be disabled; HTTPS access must also be restricted.

The specific factual error: WPA3-PSK requires PMF and is incompatible with WPA2-only clients; the allowed subnet for management is 192.168.1.0/24, not 10.10.10.0/24.

The specific factual error: PMF is not supported by all WPA2 clients and can cause association issues; SSID broadcast should be disabled to hide the SSID.

Practice this question →

MCQhard

A network technician is troubleshooting a router-on-a-stick configuration. R1 has sub-interface G0/0.10 with encapsulation dot1q 10 and IP 192.168.10.1/24, and sub-interface G0/0.20 with encapsulation dot1q 20 and IP 192.168.20.1/24. Hosts in VLAN 10 cannot reach hosts in VLAN 20. The physical interface G0/0 is up and no shutdown. Both sub-interfaces show up/up. What should the technician do next?

A.Verify the switch port connected to R1 is configured as a trunk and allows VLANs 10 and 20.

B.Verify the encapsulation dot1Q numbers on the sub-interfaces match the VLAN assignments.

C.Verify the default gateway settings on hosts in VLANs 10 and 20.

D.Check the physical interface G0/0 for interface errors or duplex mismatches.

AnswerA

This directly addresses the most probable cause: a missing or misconfigured trunk on the switch side. Even with router sub-interfaces up/up, the link must be a trunk carrying the correct VLANs for inter-VLAN routing to function.

Why this answer

The router-on-a-stick configuration requires the switch port connecting to R1 to be configured as a trunk port that permits VLANs 10 and 20. Even though the router sub-interfaces are correctly configured with encapsulation dot1q and IP addresses, if the switch port is in access mode or does not allow the specific VLANs, frames from VLAN 10 or 20 will be dropped by the switch, preventing inter-VLAN routing. The next logical step is to verify the switch port configuration with commands like 'show interfaces trunk' or 'show running-config interface <port>'.

Exam trap

Cisco often tests the misconception that as long as the router sub-interfaces are up/up and have correct encapsulation, inter-VLAN routing should work, leading candidates to overlook the switch trunk configuration as the root cause.

Why the other options are wrong

Candidates may think the encapsulation numbers might be swapped, but the stem confirms they are correctly assigned to the respective VLAN IDs.

Many candidates jump to end-host configuration, assuming the router is fully reachable because interfaces are up/up, but the trunk is the prerequisite for any communication between VLANs.

Candidates might think any communication loss warrants a physical layer check, but here the symptoms point strongly toward a Layer 2 trunking issue.

Practice this question →

MCQhard

An IP phone connected to switch port Gi0/4 is working and receiving calls, but the PC connected to the phone's data port cannot obtain an IP address. The technician confirms that interface Gi0/4 has switchport mode access and shows switchport access vlan 10 and switchport voice vlan 100. What should the technician do next?

A.Verify the DHCP scope for VLAN 10 on the DHCP server.

B.Verify that CDP is enabled on the IP phone.

C.Verify the QoS trust state on the switch port.

D.Verify the IP phone's passthrough mode for the PC port.

AnswerD

The IP phone acts as a switch; if the phone's PC port is not configured to pass traffic untagged on the correct VLAN (passthrough mode), the PC's frames will be dropped or placed in the wrong VLAN. Checking this setting directly addresses the path from PC to switch.

Why this answer

The PC connected to the IP phone's data port cannot obtain an IP address because the phone's internal switch (passthrough mode) is likely not forwarding traffic from the PC port to the upstream switch. The switch port is correctly configured with access VLAN 10 for data and voice VLAN 100 for voice, so the issue is not with the switch configuration but with the phone's ability to pass data traffic. Verifying the IP phone's passthrough mode ensures the PC port is enabled and forwarding frames to the switch.

Exam trap

Cisco often tests the misconception that a working phone implies all features are functional, but the PC port is a separate logical path that can be independently disabled or misconfigured.

Why the other options are wrong

Assumes the switch port configuration alone guarantees proper VLAN delivery to the PC, ignoring the phone's role as a transparent bridge.

Confuses the mechanism for voice VLAN assignment with the requirement for data passthrough; CDP's role is only for the phone's own voice VLAN, not for the PC's data VLAN.

Misapplies QoS as a potential cause for a connectivity issue; it is a quality-of-service feature and does not block DHCP or initial network access.

Practice this question →

MCQeasy

A network technician is connecting a new access switch to an existing distribution switch. The access switch will carry multiple VLANs. The technician wants to ensure that the link becomes a trunk automatically if the other side is set to desirable mode. Which command should be configured on the access switch port?

A.switchport mode dynamic auto

B.switchport mode dynamic desirable

C.switchport mode access

D.switchport nonegotiate

AnswerA

Dynamic auto mode allows the port to become a trunk if the other side initiates trunking. If the distribution switch is set to desirable mode, it will actively attempt to form a trunk, and the access switch port in dynamic auto mode will respond and become a trunk. This meets the requirement of automatic trunk formation.

Why this answer

The switchport mode dynamic auto command places the port in a passive trunking state where it will become a trunk if the other side actively negotiates. When the distribution switch is set to dynamic desirable, it will initiate trunking, and the access switch will respond. This allows the link to form a trunk automatically without manual intervention.

Exam trap

The trap here is confusing dynamic auto with dynamic desirable, or thinking that nonegotiate still allows automatic trunking.

Practice this question →

MCQeasy

A network administrator is configuring a Cisco switch. The switch has a management VLAN 99 with IP address 10.10.99.5/24 and default gateway 10.10.99.1. The administrator wants to verify that the switch can reach a server at 10.10.99.100. Which command should be used on the switch to test reachability?

A.show ip route

B.show ip interface brief

C.traceroute 10.10.99.100

D.ping 10.10.99.100

AnswerD

The ping command on a Cisco switch sends ICMP echo requests to the specified IP address and reports replies, directly testing reachability. Since the switch has an IP address in the same subnet as the server, the ping will be sourced from VLAN 99 interface and should succeed if connectivity exists. This is the standard method to verify Layer 3 connectivity from a switch.

Why this answer

To verify reachability to a specific IP address from a Cisco switch, the ping command is the correct tool. It sends ICMP echo requests and waits for replies, providing immediate feedback on whether the destination is reachable. Other commands like show ip interface brief or show ip route only display configuration or routing information and do not test actual connectivity.

Exam trap

The trap here is confusing the display of routing or interface information with an active connectivity test.

Practice this question →

MCQhard

A switchport on one side of a link is configured as a trunk, but the peer side is configured as an access port. The physical link is up, but VLAN traffic behaves unexpectedly. What is the most likely cause?

A.The two ends disagree on whether the link is a trunk or an access port.

B.The switches must both use the same hostname.

C.The native VLAN must be set to 1 on both sides first.

D.The ports need OSPF enabled.

AnswerA

A switchport in trunk mode encapsulates frames with 802.1Q tags and expects to receive tagged frames, while an access port transmits and receives only untagged frames in a single VLAN. When one end is a trunk and the other is an access port, the access port will drop tagged frames or treat them as invalid, and the trunk port may not accept the untagged frames sent by the access side. This role mismatch prevents proper VLAN segmentation and causes the link to fail at Layer 2.

Why this answer

The most likely cause is a switchport mode mismatch. In practical terms, one side expects the link to carry multiple VLANs with tagging behavior, while the other side treats it as a normal one-VLAN endpoint-style access connection. The physical interface can still come up, but the two ends do not agree on how the traffic should be handled.

This is a classic Layer 2 troubleshooting pattern. The link may not be fully down, but the configuration disagreement causes logical forwarding problems.

Exam trap

Be cautious of assuming all VLAN issues are due to allowed lists or STP. Consider mode mismatches when the link is physically up but traffic is disrupted.

Why the other options are wrong

OSPF is a Layer 3 routing protocol used for exchanging routes between routers, not for resolving Layer 2 switchport mismatches. This issue is purely about trunk/access configuration, which is unrelated to OSPF.

While native VLAN mismatch can cause issues on a trunk link, the primary problem here is that one side is configured as access, not trunk. Even if native VLAN is set to 1 on both sides, the access port will still not process tagged frames correctly.

Hostnames are purely for identification and have no impact on switchport operation or VLAN tagging. The trunk/access mismatch is a Layer 2 configuration issue independent of hostnames.

Practice this question →

PBQhard

You are connected to SW1. A LACP EtherChannel between SW1 and SW2 has already been configured using interfaces GigabitEthernet0/1 and GigabitEthernet0/2 with channel-group 1 mode active on both sides and assigned to VLAN 100. However, the channel is not forming because of a speed/duplex mismatch. The correct interface settings for this network are speed 1000 and duplex full. Interface GigabitEthernet0/1 is already configured with these settings. Only interface GigabitEthernet0/2 needs to be corrected. Identify the configuration change needed to resolve the mismatch and verify the EtherChannel is up with 'show etherchannel summary'.

Network Topology

Hints

•Check the speed and duplex settings on both member interfaces.
•LACP requires all ports in the channel to have identical configuration.
•Use the 'show interfaces status' command to quickly see speed/duplex mismatches.

A.Configure interface GigabitEthernet0/2 with 'speed 1000' and 'duplex full', then verify the EtherChannel is up.

B.Configure interface GigabitEthernet0/1 with 'speed 100' and 'duplex half', then verify the EtherChannel is up.

C.Configure interface GigabitEthernet0/2 with 'speed auto' and 'duplex auto', then verify the EtherChannel is up.

D.Configure interface GigabitEthernet0/2 with 'channel-group 1 mode active' and 'switchport access vlan 100', then verify the EtherChannel is up.

AnswerA

solution

! SW1
interface GigabitEthernet0/2
speed 1000
duplex full
end
show etherchannel summary

Why this answer

The EtherChannel is not forming because GigabitEthernet0/2 is configured with speed 100 and duplex half, while GigabitEthernet0/1 is speed 1000 and duplex full. LACP requires all member ports to have identical speed and duplex settings. To fix this, configure GigabitEthernet0/2 with speed 1000 and duplex full, matching GigabitEthernet0/1.

After correction, the ports should bundle in Port-channel1 and show as bundled (P) in 'show etherchannel summary'.

Exam trap

The trap is that candidates may overlook the speed/duplex mismatch and focus only on the LACP mode or VLAN configuration. Always verify that all physical parameters match before troubleshooting EtherChannel formation.

Why the other options are wrong

The specific factual error is that the question implies the correct configuration should use speed 1000 and duplex full, not downgrade to 100/half. Also, LACP requires identical settings, but the goal is to match the higher speed.

The specific factual error is that auto-negotiation does not guarantee matching settings when one side is manually configured. The mismatch would persist.

The specific factual error is that the question explicitly states a speed/duplex mismatch prevents the channel from forming, and this option does not correct that mismatch.

Practice this question →

PBQhard

You are connected to a multilayer switch SW1 via console. SW1 has an IP phone and an access point connected to interfaces GigabitEthernet0/1 and GigabitEthernet0/2 respectively. Configure the access ports so that the IP phone receives a voice VLAN (VLAN 110) and PoE priority critical, and the access point receives PoE priority high. Verify your configuration using show interfaces switchport and show power inline.

Network Topology

Hints

•Voice VLAN is configured under the access port interface with the 'switchport voice vlan' command.
•PoE priority is set per interface using 'power inline priority'.
•Use 'show interfaces switchport' to verify voice VLAN assignment.

A.interface GigabitEthernet0/1 switchport mode access switchport access vlan 10 switchport voice vlan 110 power inline priority critical ! interface GigabitEthernet0/2 switchport mode access power inline priority high

B.interface GigabitEthernet0/1 switchport mode trunk switchport trunk allowed vlan 10,110 power inline priority critical ! interface GigabitEthernet0/2 switchport mode access power inline priority high

C.interface GigabitEthernet0/1 switchport mode access switchport access vlan 110 switchport voice vlan 10 power inline priority critical ! interface GigabitEthernet0/2 switchport mode access power inline priority high

D.interface GigabitEthernet0/1 switchport mode access switchport access vlan 10 switchport voice vlan 110 power inline priority high ! interface GigabitEthernet0/2 switchport mode access power inline priority critical

AnswerA

solution

! SW1
interface GigabitEthernet0/1
switchport voice vlan 110
power inline priority critical
exit
interface GigabitEthernet0/2
power inline priority high
end

Why this answer

The IP phone requires a voice VLAN configured with the switchport voice vlan command. PoE priority is set per interface using power inline priority. For the phone, the priority is critical; for the AP, it is high.

Verification with show interfaces switchport confirms voice VLAN, and show power inline shows priority settings.

Exam trap

The exam trap is mixing up the voice VLAN and access VLAN assignments, or confusing PoE priority levels. Remember that the voice VLAN is configured with switchport voice vlan, not as the access VLAN. Also, note that IP phones typically use access ports with voice VLAN, not trunks.

PoE priority critical is reserved for critical devices like phones, while high is for other important devices like APs.

Why the other options are wrong

The specific factual error is using trunk mode for an IP phone port instead of access mode with voice VLAN.

The specific factual error is reversing the VLAN assignments: the access VLAN should be data, and the voice VLAN should be voice.

The specific factual error is swapping the PoE priority values: the phone should be critical, the AP high.

Practice this question →

100

MCQhard

Refer to the exhibit. A network engineer expects SW1 to be the root bridge for VLAN 1, but the show spanning-tree vlan 1 output on SW2 shows that SW2 is the root. What is the most likely cause of this issue?

A.SW1 is configured with a priority of 32769 but has a higher MAC address than SW2.

B.Spanning tree is disabled on SW1 for VLAN 1.

C.SW1 has a bridge priority of 4096, but BPDU guard is configured on SW2's port to SW1, causing the port to be err-disabled.

D.The trunk link between SW1 and SW2 is down.

AnswerD

The missing root port and the fact that SW2 sees itself as root confirm that SW2 is not receiving any BPDUs from SW1. This is exactly the behavior when the inter-switch trunk is physically down, breaking the spanning-tree topology.

Why this answer

If the trunk link between SW1 and SW2 is down, SW2 will not receive BPDUs from SW1. Without BPDUs, SW2 assumes it is the root bridge for VLAN 1 (since every switch defaults to root for its own VLANs). This explains why SW2's show spanning-tree output shows itself as root, even if SW1 has a lower bridge priority.

Exam trap

Cisco often tests the misconception that a lower priority always guarantees root bridge status, but the trap here is that a failed link prevents BPDU exchange, causing the switch with the higher bridge ID to become root by default.

Why the other options are wrong

Candidates focus on the matching priority numbers and overlook the missing root port that indicates a complete loss of BPDUs.

Candidates may assume no BPDUs means STP is off, but the intended root designation suggests STP is on and a physical disconnect is the primary suspect.

Candidates recall that BPDU guard can block ports, but they fail to differentiate between a missing port due to err-disable and a missing port due to a physically down link, which looks identical in this output.

Practice this question →

101

PBQhard

You are connected to SW1. Two switches, SW1 and SW2, are connected via four GigabitEthernet links. Configure LACP EtherChannel between them using interfaces GigabitEthernet0/1 through GigabitEthernet0/4 on SW1. Set the channel-group mode to active on SW1. The port-channel interface must be configured as a trunk, allowing VLANs 10, 20, 30. However, the EtherChannel is not forming. The current configuration is shown below. Identify and fix the issue, then verify the EtherChannel is operational.

Network Topology

Hints

•Compare the Layer 2/Layer 3 status of the port-channel interface with the member interfaces.
•Check the 'show etherchannel summary' flags: 'SD' means Layer 3 and down; 'SU' means Layer 2 and up.
•The port-channel interface must match the operational mode (Layer 2) of the member switchports.

A.Remove 'no switchport' and IP address from Port-channel1, then configure 'switchport mode trunk' and 'switchport trunk allowed vlan 10,20,30'.

B.Change the channel-group mode on the member interfaces from active to passive.

C.Add the 'switchport nonegotiate' command to the member interfaces.

D.Configure the member interfaces with 'channel-group 1 mode on' instead of active.

AnswerA

solution

! SW1
interface Port-channel1
no ip address 192.168.1.1 255.255.255.0
no no switchport
switchport mode trunk
switchport trunk allowed vlan 10,20,30

Why this answer

The EtherChannel is not forming because the Port-channel1 interface is configured as a Layer 3 interface (no switchport, IP address), while the member interfaces are Layer 2 switchports (switchport mode trunk). This mismatch prevents the channel from bundling. To fix this, configure Port-channel1 as a Layer 2 trunk interface with the same allowed VLANs.

The solution: remove the no switchport command and the IP address, then apply switchport mode trunk and switchport trunk allowed vlan 10,20,30. After correction, the ports should bundle and the show etherchannel summary will show the ports as bundled (P) and the port-channel as Layer 2 (S).

Exam trap

The exam trap is that candidates often focus on LACP modes or trunk negotiation but overlook the Layer 2/Layer 3 mismatch between the port-channel interface and member interfaces. Always ensure the port-channel interface is configured as either Layer 2 or Layer 3 to match the member ports.

Why the other options are wrong

The specific factual error: The problem is a Layer 2/Layer 3 mismatch, not the LACP mode. Active mode is valid and commonly used.

The specific factual error: 'switchport nonegotiate' affects trunk negotiation, not EtherChannel bundling.

The specific factual error: The mode change does not fix the interface type mismatch; the port-channel must be Layer 2 to match the member ports.

Practice this question →

102

MCQhard

A user on VLAN 10 reports that they cannot ping the default gateway at 192.168.10.1 from their PC with IP 192.168.10.50/24. The switch interface connecting to the PC is up/up, and the PC shows a valid IP configuration. What is the most likely cause of this connectivity failure?

A.Change the switchport mode to trunk to allow VLAN 10 traffic.

B.Configure an SVI for VLAN 10 with an IP address in the 192.168.10.0/24 subnet.

C.Change the PC's IP address to a different subnet, such as 192.168.20.0/24.

D.Recreate VLAN 10 and reassign the port to it.

AnswerB

The switch must provide a Layer 3 interface in VLAN 10 to serve as the default gateway for PCs in the 192.168.10.0/24 subnet. An SVI (interface vlan 10) with an IP address from that subnet creates a routable interface on the multilayer switch. This allows hosts in VLAN 10 to send traffic to other subnets, as their default gateway points to that SVI. Without this SVI, the PC has no gateway to route its traffic beyond its local segment.

Why this answer

The PC and default gateway are on the same subnet (192.168.10.0/24), but the switch lacks a Layer 3 interface for VLAN 10. Without an SVI (Switch Virtual Interface) configured with an IP address in that subnet, the switch cannot route traffic to the gateway or respond to ARP requests from the PC, breaking connectivity even though the access port is up/up.

Exam trap

Cisco often tests the misconception that a VLAN alone provides Layer 3 connectivity, when in fact an SVI or a separate router-on-a-stick configuration is required for inter-VLAN routing and default gateway functionality.

Why the other options are wrong

A trunk port is used to carry multiple VLANs between switches, not to connect an end device like a PC. Configuring the switchport as trunk would break connectivity because the PC expects an access port.

Changing the PC's IP subnet would not resolve the issue because the PC would still need a default gateway on its new subnet. The root cause is the missing SVI on the switch, not the PC's IP address.

Recreating VLAN 10 and reassigning the port does not address the missing SVI. The VLAN already exists and the port is correctly assigned; the issue is at Layer 3, not Layer 2.

Practice this question →

103

MCQmedium

A network engineer is troubleshooting a connectivity issue between two hosts on different VLANs. The engineer captures traffic on an IOS-XE router's GigabitEthernet0/1 interface using embedded packet capture (EPC). The output shows ARP requests from Host A (192.168.1.10) but no ARP replies from Host B (192.168.2.20). What is the most likely cause of this issue?

A.The router's interface is configured as an access port instead of a trunk.

B.The router's interface does not have an IP address configured in the VLAN 2 subnet.

C.Host A is in a different VLAN than the router's interface.

D.The router's interface has a duplex mismatch with the switch.

AnswerB

For inter-VLAN routing, the router must have an IP address in each VLAN's subnet to act as the default gateway and respond to ARP requests. Without an IP in VLAN 2, it cannot reply to ARP requests for 192.168.2.20.

Why this answer

The router's GigabitEthernet0/1 interface must have an IP address in the same subnet as Host B (192.168.2.20) to act as the default gateway for VLAN 2. Without an IP address in the VLAN 2 subnet, the router cannot respond to ARP requests for that subnet, so Host A's ARP requests for Host B go unanswered. This is the most likely cause because the router performs inter-VLAN routing only when it has an interface (or subinterface) with an IP address in the destination VLAN's subnet.

Exam trap

Cisco often tests the misconception that a router automatically routes between VLANs if it is connected to a switch via a trunk, but the router must have an IP address in each VLAN's subnet to respond to ARP and forward traffic.

Why the other options are wrong

The router's interface is a routed port, not a switchport; access/trunk concepts apply to switch interfaces. Even if it were a switch interface, the issue is about ARP replies, which require Layer 3 addressing, not trunking.

ARP requests are Layer 2 broadcasts; if the router's interface is in the same VLAN as Host A, it will receive the request. The problem is that the router does not reply, indicating it lacks an IP in the destination subnet.

Duplex mismatch causes CRC errors and collisions, but ARP requests would still be received and could be replied to. The capture shows clean ARP requests with no replies, pointing to a Layer 3 issue, not physical layer.

Practice this question →

104

MCQhard

A switch port connected to a user PC should be placed in VLAN 20 and must not negotiate trunking. Which configuration is the most appropriate?

A.switchport mode access switchport access vlan 20

B.switchport mode trunk switchport trunk native vlan 20

C.switchport mode dynamic desirable switchport trunk allowed vlan 20

D.no switchport ip address 192.168.20.1 255.255.255.0

AnswerA

This is the correct configuration for a host port. `switchport mode access` unconditionally sets the interface as a nontrunking Layer 2 access port, disabling Dynamic Trunking Protocol (DTP) and preventing the port from becoming a trunk. The `switchport access vlan 20` command then statically assigns the port to VLAN 20, so the connected PC’s untagged frames are carried in that VLAN, exactly matching the requirement.

Why this answer

The most appropriate configuration is to force the interface into access mode and assign it to VLAN 20. In practical terms, a normal user-facing switch port is supposed to carry one VLAN only. There is no reason to rely on dynamic trunk negotiation for a desktop or laptop connection. Explicit access-port configuration is cleaner, more predictable, and safer.

This is a common switching best-practice question. The wrong answers usually leave room for unwanted trunking behavior or move the interface into a completely different role. The right answer combines the correct port role with the correct VLAN membership.

Exam trap

Avoid assuming 'auto' mode is always safe; it can lead to unintended trunking.

Why the other options are wrong

This configuration makes the port a trunk port, which is used to carry multiple VLANs between switches, not for a single user PC. The 'switchport trunk native vlan 20' command sets the native VLAN for untagged traffic on the trunk, but the port still actively negotiates trunking via DTP, violating the requirement to not negotiate trunking.

The 'switchport mode dynamic desirable' command actively attempts to form a trunk with the connected device via DTP, which contradicts the requirement to not negotiate trunking. Additionally, 'switchport trunk allowed vlan 20' only restricts which VLANs are allowed on the trunk, but the port is still in trunking mode, not an access port.

The 'no switchport' command converts the Layer 2 switch port into a Layer 3 routed interface, which cannot be assigned to a VLAN. This configuration is used for routing between VLANs or connecting to routers, not for connecting a user PC to a specific VLAN.

Practice this question →

105

PBQhard

You are connected to the Cisco WLC (WLC-1) via its management IP 192.168.1.10. The wireless network 'CorpNet' is configured but clients cannot associate. Troubleshoot and resolve the issue: clients report 'Association failed' and the SSID is not visible in site surveys. Ensure that after your fix, the SSID is broadcast, WPA3 is used, and the WLAN is mapped to VLAN 20. Also, verify the WLC management interface is accessible over HTTPS.

Network Topology

Hints

•Check if the WLAN is enabled and broadcasting the SSID.
•Verify that the WLAN is mapped to a user VLAN, not the management interface.
•Ensure HTTPS is enabled for web management access.

A.Enable the WLAN, set Broadcast SSID to Enabled, create a dynamic interface for VLAN 20 and map the WLAN to it, and enable the HTTPS server.

B.Enable the WLAN, set Broadcast SSID to Enabled, change the interface to the management interface, and enable the HTTPS server.

C.Enable the WLAN, keep Broadcast SSID Disabled for security, create a dynamic interface for VLAN 20 and map the WLAN to it, and enable the HTTPS server.

D.Enable the WLAN, set Broadcast SSID to Enabled, create a dynamic interface for VLAN 20 and map the WLAN to it, but leave HTTPS disabled for security.

AnswerA

solution

! WLC-1
config wlan 1 enable
config wlan 1 broadcast-ssid enable
config wlan 1 interface vlan20
config interface create vlan20 20
config interface address vlan20 192.168.20.1 255.255.255.0
config wlan 1 interface vlan20
ip http secure-server

Why this answer

The WLAN was disabled, the SSID was hidden (Broadcast SSID Disabled), and it was incorrectly mapped to the management interface instead of a user VLAN. Additionally, HTTPS access was disabled. The solution: enable the WLAN, enable SSID broadcast, change the interface to a VLAN 20 interface (e.g., create a dynamic interface 'vlan20' with VLAN 20), and enable the HTTPS server for management access.

Note: On an AireOS WLC, the correct commands use `config wlan enable <wlan_id>`, `config wlan broadcast-ssid enable <wlan_id>`, and `config network secureweb enable` for HTTPS.

Exam trap

This question tests your ability to identify multiple misconfigurations simultaneously. Common traps: confusing management interface with user VLANs, thinking hidden SSID is acceptable when broadcast is required, and overlooking the HTTPS requirement. Also, ensure you use AireOS-specific commands, not IOS commands like `ip http secure-server`.

Always verify all requirements in the question.

Why the other options are wrong

The specific factual error: The management interface is for WLC management traffic, not client data. Client traffic should be on a separate user VLAN.

The specific factual error: Broadcast SSID must be enabled for the SSID to be visible. Disabling it hides the SSID, which contradicts the requirement to make it visible.

The specific factual error: HTTPS must be enabled for management access. Disabling it would block HTTPS connections to the WLC.

Practice this question →

106

MCQhard

Users in VLAN 60 on switch SW2 cannot reach the default gateway located on switch SW1. The trunk between SW1 and SW2 is operational and allows VLAN 60. What is the most likely reason for this issue?

A.VLAN 60 does not exist locally on SW2.

B.The native VLAN must be changed to 60 on both switches.

C.VLAN 60 is not allowed on the trunk link.

D.The default gateway must be configured as a loopback on SW2.

AnswerA

This is the most likely reason: SW2 has not been created with VLAN 60, so it does not have a spanning-tree instance or a switch virtual interface for that VLAN. Even if the trunk port with SW1 allows VLAN 60 and receives tagged frames, those frames are discarded because the VLAN is not present in SW2's VLAN database. Consequently, users in VLAN 60 cannot communicate through SW2, and no access port or SVI can be assigned to that VLAN.

Why this answer

VLAN 60 has not been created locally on SW2, even though the trunk can carry its traffic. A switch never processes VLAN traffic for a VLAN it doesn't know about; it discards tagged frames from the trunk destined for that VLAN and prevents access ports from assigning frames to it. (A) is correct. (B) is incorrect because native VLAN configuration only affects untagged frames—changing it to 60 is unnecessary for tagged VLAN 60 traffic. (C) is incorrect because the trunk is already configured to allow VLAN 60, so trunk filtering isn't the problem. (D) is incorrect because a default gateway is simply an IP address on a router or Layer 3 switch interface (like SVIs) and does not require a loopback on SW2.

Exam trap

Don't assume trunk configuration alone resolves VLAN issues; ensure VLANs exist on all relevant switches.

Why the other options are wrong

Native VLAN configuration does not affect tagged VLAN 60 traffic—native VLAN only matters for untagged frames.

The trunk is stated to allow VLAN 60, so VLAN filtering is not the problem; a student might misread the premise.

The default gateway resides on SW1, not SW2; configuring a loopback on SW2 does not create a gateway for VLAN 60.

Practice this question →

107

PBQhard

You are connected to the multilayer switch MLS1 in a branch network. The DHCP server on router R1 is supposed to serve the 192.168.20.0/24 VLAN 20, but clients in VLAN 20 are not receiving IP addresses. Additionally, a rogue DHCP server has been detected on VLAN 20. Configure MLS1 to enable DHCP snooping on VLAN 20, set the trust state on the uplink port to R1, and limit the rate of DHCP packets on access ports. Then, on R1, correct the DHCP configuration so that the pool for VLAN 20 uses the correct default-router (192.168.20.1) and DNS server (8.8.8.8), and ensure that the excluded-address range is not too large (exclude only the first 10 addresses). Verify the solution.

Network Topology

Hints

•On MLS1, DHCP snooping must be globally enabled and then applied to VLAN 20.
•The uplink to R1 must be trusted; access ports should have rate limiting to prevent DHCP starvation.
•On R1, the excluded-address range was too broad; only exclude the first 10 addresses. The default-router and DNS server were incorrect.

A.On MLS1: ip dhcp snooping, ip dhcp snooping vlan 20, interface Gig0/0 ip dhcp snooping trust, interface Gig0/1 ip dhcp snooping limit rate 10. On R1: ip dhcp excluded-address 192.168.20.1 192.168.20.10, ip dhcp pool VLAN20 network 192.168.20.0 255.255.255.0 default-router 192.168.20.1 dns-server 8.8.8.8

B.On MLS1: ip dhcp snooping vlan 20, interface Gig0/0 ip dhcp snooping trust, interface Gig0/1 ip dhcp snooping limit rate 10. On R1: ip dhcp excluded-address 192.168.20.1 192.168.20.254, ip dhcp pool VLAN20 network 192.168.20.0 255.255.255.0 default-router 192.168.20.1 dns-server 8.8.8.8

C.On MLS1: ip dhcp snooping vlan 20, interface Gig0/0 ip dhcp snooping trust, interface Gig0/1 ip dhcp snooping limit rate 10. On R1: ip dhcp excluded-address 192.168.20.1 192.168.20.10, ip dhcp pool VLAN20 network 192.168.20.0 255.255.255.0 default-router 192.168.10.1 dns-server 4.4.4.4

D.On MLS1: ip dhcp snooping vlan 20, interface Gig0/0 ip dhcp snooping trust, interface Gig0/1 ip dhcp snooping limit rate 10. On R1: ip dhcp excluded-address 192.168.20.1 192.168.20.10, ip dhcp pool VLAN20 network 192.168.20.0 255.255.255.0 default-router 192.168.20.1 dns-server 8.8.8.8, but no ip dhcp snooping enabled globally on MLS1

AnswerA

solution

! R1
configure terminal
ip dhcp excluded-address 192.168.20.1 192.168.20.10
ip dhcp pool VLAN20_POOL
default-router 192.168.20.1
dns-server 8.8.8.8
end

! MLS1
ip dhcp snooping
ip dhcp snooping vlan 20
interface GigabitEthernet0/0
ip dhcp snooping trust
exit
interface GigabitEthernet0/1
ip dhcp snooping limit rate 10
end

Why this answer

The problem had three faults: First, the DHCP pool on R1 had a wrong default-router (192.168.10.1 instead of 192.168.20.1) and an incorrect DNS server (4.4.4.4 instead of 8.8.8.8). Second, the excluded-address range was too large (excluding all addresses from .1 to .254 effectively blocked all dynamic assignments; corrected to exclude only .1 through .10). Third, DHCP snooping was disabled on MLS1, allowing a rogue DHCP server.

To enable DHCP snooping, both the global `ip dhcp snooping` command and the VLAN-specific `ip dhcp snooping vlan 20` command are required. With snooping enabled, the uplink port Gig0/0 was set as trusted and the access port Gig0/1 was configured with rate limiting to prevent DHCP starvation attacks.

Exam trap

Watch for three separate issues: DHCP pool misconfiguration (default-router, DNS, excluded range), DHCP snooping not enabled globally, and the need to set trust on the uplink. Candidates often forget the global 'ip dhcp snooping' command or misconfigure the excluded range.

Why the other options are wrong

The excluded-address range is too large; it should only exclude the first 10 addresses (1-10) to allow dynamic allocation from .11 onward.

The default-router must be the gateway for VLAN 20 (192.168.20.1), and the DNS server should be 8.8.8.8 as specified.

The global 'ip dhcp snooping' command is required to activate the feature; omitting it leaves DHCP snooping disabled entirely.

Practice this question →

108

MCQhard

Two routers, R1 and R2, have been configured with HSRP for VLAN 10 to provide default gateway redundancy to hosts. The virtual IP address is 192.168.10.1. After configuration, end hosts report inconsistent connectivity to the gateway, and a failover test reveals that when the active router is shut down, connectivity is lost. The network administrator checks the HSRP status on both routers. R1 shows HSRP group 10 as Active with no standby router, and R2 shows HSRP group 20 as Active with no standby router. What is the most likely cause of the redundancy failure?

A.R2 has a lower HSRP priority than R1, so it cannot become standby.

B.The HSRP group number is mismatched between R1 and R2.

C.The HSRP authentication strings do not match.

D.HSRP version 1 is used on R1 while version 2 is used on R2.

AnswerB

HSRP group numbers define distinct virtual router instances; R1 is active for group 10 with virtual IP 10.1.1.10, while R2 is active for group 20 with virtual IP 10.1.1.20. Because they belong to different groups, neither router accepts or processes the other's hello packets, so they form separate HSRP domains with no shared virtual MAC address. Consequently, the standby router cannot take over if the active fails, which is exactly the redundancy failure observed.

Why this answer

HSRP requires all routers participating in the same virtual router to use the same group number. Because R1 is active for group 10 and R2 is active for group 20, neither router has a standby for its group. If the active router for a group fails, no standby router can take over, causing loss of connectivity.

Authentication mismatch or HSRP version mismatch would typically prevent routers from forming a neighbor relationship, but the provided status showing each router active in a different group points specifically to a group mismatch.

Exam trap

Cisco often tests the HSRP group number mismatch as a subtle cause of redundancy failure because candidates focus on priority or authentication and overlook the fundamental requirement that the group number must be identical on all routers in the same virtual router group.

Why the other options are wrong

The output shows R2 is Active in its own group (20); priority only affects role election within the same group. The real problem is separate group numbers.

With mismatched authentication, the state would not be Active. The exhibit clearly shows Active on both routers, so authentication is not the cause.

Version mismatch would not change the displayed group number; the group number discrepancy is the direct evidence shown in the exhibit.

Practice this question →

109

MCQmedium

A port connected to an end-user PC should not send or expect VLAN tags from the endpoint. Which interface type is appropriate on the switch?

A.Access port

B.Trunk port

C.Routed port

D.Port-channel interface

AnswerA

An access port is correct because it carries traffic for exactly one VLAN and forwards untagged frames, which is exactly what a PC's NIC expects. PCs do not generate 802.1Q VLAN tags, so an access port's behavior of stripping and expecting untagged data aligns with the end-device's native Ethernet operation. Furthermore, access ports do not transmit DTP (Dynamic Trunking Protocol) frames, preventing any unwanted trunk negotiation toward the PC.

Why this answer

The appropriate interface type is an access port. In plain language, a normal user PC is expected to connect to one VLAN and send ordinary untagged Ethernet frames. The switch associates that traffic with the configured access VLAN.

This is different from a trunk, which is designed to carry multiple VLANs and commonly uses tagging to preserve VLAN identity across the link. Routed ports are Layer 3 interfaces used for routing between VLANs, not for attaching a single end-user PC. Port-channel interfaces aggregate multiple physical links for redundancy and bandwidth, but they do not determine whether VLAN tagging is used; the underlying port mode (access or trunk) still applies.

Therefore, access port is the only correct choice for an untagged, single-VLAN end-device connection.

Exam trap

Don't confuse the need for VLANs with the need for VLAN tagging. Access ports handle untagged traffic for single VLANs.

Why the other options are wrong

A trunk port is designed to carry traffic for multiple VLANs using 802.1Q tagging, which is not expected from a standard PC. Using a trunk port for a PC would cause the switch to expect tagged frames, leading to communication failures.

A routed port is a Layer 3 interface used for routing between VLANs or connecting to routers, not for connecting end-user PCs. It does not operate as a Layer 2 switchport and would not handle VLAN tagging as required.

A port-channel interface is a logical bundling of multiple physical links for increased bandwidth and redundancy, not a single connection to an end-user PC. It is used between switches or to servers, not for typical PC access.

Practice this question →

110

PBQhard

You are connected to R1. Configure inter-VLAN routing on R1 using router-on-a-stick so that hosts in VLAN 10 (192.168.10.0/24) and VLAN 20 (192.168.20.0/24) can communicate. The switch SW1 is already configured with VLANs and trunking, but R1's current configuration prevents traffic. Identify and fix the issues.

Network Topology

Hints

•Check if the physical interface is administratively down.
•Verify that the trunk is allowing VLANs 10 and 20.
•Ensure 'ip routing' is enabled (it is by default).

A.Enable the physical interface with the 'no shutdown' command on R1.

B.Change the encapsulation on the subinterfaces to use dot1Q with native VLAN 10 and 20 respectively.

C.Enable IP routing globally with the 'ip routing' command on R1.

D.Remove the 'no shutdown' from the subinterfaces and apply it only to the physical interface.

AnswerA

solution

! R1
interface GigabitEthernet0/0
no shutdown
exit
show interfaces trunk

Why this answer

The issue was that the physical interface GigabitEthernet0/0 on R1 was administratively down, causing all subinterfaces for VLANs 10 and 20 to be in a down state. Enabling it with 'no shutdown' brings the trunk up, allowing inter-VLAN routing because the switch already has trunking configured. The other options are incorrect because they suggest steps that are either already in place (IP routing) or not needed (changing encapsulation or moving no shutdown to subinterfaces).

Exam trap

A common mistake is overlooking that router-on-a-stick requires the physical interface to be administratively up, as subinterfaces cannot function independently.

Why the other options are wrong

Changing encapsulation is unnecessary because the subinterfaces already use the correct dot1Q encapsulation for VLANs 10 and 20.

The 'ip routing' command is already enabled by default on routers, and global routing is not the problem here.

Subinterfaces do not support a 'no shutdown' command; their operational state is determined solely by the physical interface.

Practice this question →

111

Drag & Dropmedium

Drag and drop the following steps into the correct order to configure inter-VLAN routing using a router-on-a-stick topology.

Drag or tap steps into the slots.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Why this order

Inter-VLAN routing via router-on-a-stick requires creating VLANs on the switch, placing access ports in those VLANs, configuring a trunk to the router with the correct native VLAN to avoid mismatch, enabling the physical router interface, and then defining subinterfaces per VLAN with 802.1Q encapsulation and IP addresses. This ensures traffic from different VLANs can be routed.

Practice this question →

112

MCQhard

A trunk link has a native VLAN mismatch between two switches. What is the most likely result?

A.All VLANs except the native VLAN stop forwarding immediately.

B.Untagged frames can be interpreted as belonging to different VLANs on each switch.

C.The trunk automatically converts to an access port.

D.STP is disabled on the trunk until the mismatch is corrected.

AnswerB

With a native VLAN mismatch, each switch places untagged 802.1Q frames into its locally configured native VLAN. For example, if Switch A's native VLAN is 10 and Switch B's is 20, a single untagged frame will be associated with VLAN 10 on one side and VLAN 20 on the other, effectively crossing broadcast domains and potentially exposing traffic to the wrong VLAN. This misclassification can lead to security breaches, routing loops, or connectivity anomalies because VLAN membership is not preserved end-to-end.

Why this answer

Untagged traffic may be placed into different VLANs on each side of the trunk, causing traffic leakage or connectivity problems.

Exam trap

Be careful not to confuse native VLAN mismatches with issues that affect tagged traffic or automatic switch behavior.

Why the other options are wrong

A native VLAN mismatch does not cause all other VLANs to stop forwarding. The trunk continues to forward frames for all VLANs, but untagged frames (native VLAN) are miscommunicated.

A trunk port does not automatically convert to an access port due to a native VLAN mismatch. The trunk remains operational, but the native VLAN mismatch causes problems for untagged traffic.

STP continues to run normally on the trunk link despite a native VLAN mismatch. The mismatch does not disable STP; it only affects the handling of untagged frames.

Practice this question →

113

MCQmedium

After a switch replacement, users in VLAN 30 cannot reach devices in other VLANs. The replacement switch has a trunk link to the distribution switch that shows as up/up. What is the most likely cause?

A.The native VLAN must be changed to 30

B.VLAN 30 is not permitted on the trunk link

C.The uplink should be configured as an access port

D.STP must be disabled on VLAN 30

AnswerB

The trunk allowed list controls which VLANs traverse the link, and without an explicit 'allowed vlan add 30' statement, frames belonging to VLAN 30 are discarded at the trunk. Because the access switch and distribution switch only carry permitted VLANs, VLAN 30 has no path to the rest of the network. This exactly matches the symptom that only VLAN 30 suffers while other VLANs work normally on the same uplink.

Why this answer

The trunk is up, but VLAN 30 is not allowed on it. Traffic from that VLAN never crosses the uplink, so inter-VLAN reachability fails for users in VLAN 30 even though the local access ports may still look fine.

Exam trap

Ensure you distinguish between management settings and VLAN configuration. Focus on trunk settings when inter-VLAN issues arise.

Why the other options are wrong

Changing the native VLAN to 30 would not resolve the issue because the native VLAN is used for untagged traffic on a trunk, and the problem is that VLAN 30 traffic is not being allowed at all. Additionally, native VLAN mismatch can cause connectivity issues, but it does not specifically prevent only VLAN 30 from reaching other VLANs.

Configuring the uplink as an access port would place it in a single VLAN, preventing traffic from multiple VLANs (including VLAN 30) from traversing the link. Since the switch needs to carry traffic for multiple VLANs, the uplink must remain a trunk port.

Disabling STP on VLAN 30 would be dangerous as it could cause bridging loops and network instability. Moreover, STP does not control whether a VLAN is allowed on a trunk; it only prevents loops. The issue is a missing VLAN in the trunk allowed list, not a spanning-tree problem.

Practice this question →

114

MCQhard

Based on the exhibit, which configuration should be added to restore DHCP service for clients in VLAN 30?

A.ip helper-address 10.99.99.20 under interface Vlan30

B.switchport mode trunk under interface Vlan30

C.ip default-gateway 10.99.99.20 under interface Vlan30

D.spanning-tree portfast under interface Vlan30

AnswerA

The VLAN 30 SVI is the Layer 3 gateway for that subnet, so DHCP client broadcasts must be relayed as unicast to the server at 10.99.99.20. The ip helper-address command enables this relay function and is correctly placed on the SVI that receives the clients' requests. Without it, the broadcast would be dropped by the router.

Why this answer

The correct fix is to add an IP helper address pointing to the remote DHCP server on the Layer 3 interface for VLAN 30. In practical terms, the clients are sending DHCP discovery as a broadcast, and the server is on another subnet. The SVI for VLAN 30 is the local gateway that must relay those requests toward the server.

This is one of the most exam-realistic campus troubleshooting scenarios because it tests both subnet boundaries and the role of the local gateway interface.

Exam trap

A common exam trap is confusing the ip helper-address command with ip default-gateway or Layer 2 commands like switchport mode trunk. Candidates might incorrectly apply switchport commands to an SVI, which is a Layer 3 interface, or think setting ip default-gateway will relay DHCP requests. These mistakes cause DHCP broadcasts to fail reaching the remote server, leading to no IP address assignment for clients.

Understanding that ip helper-address is the DHCP relay mechanism on Layer 3 interfaces is critical to avoid this trap.

Why the other options are wrong

Incorrect. The command switchport mode trunk is a Layer 2 switchport configuration and cannot be applied to an SVI, which is a Layer 3 interface. This does not affect DHCP relay.

Incorrect. The ip default-gateway command sets the default gateway for management traffic on a Layer 2 device and does not relay DHCP broadcasts. It does not restore DHCP service for clients.

Incorrect. The spanning-tree portfast command is used on physical Layer 2 switchports to speed up port transitions and has no effect on DHCP relay or SVIs.

Practice this question →

115

MCQmedium

A switch administrator enters the following commands on interface GigabitEthernet1/0/10: interface g1/0/10 switchport mode access switchport access vlan 30 spanning-tree portfast spanning-tree bpduguard enable A user connects a small managed switch to this port, and the access port immediately changes to an err-disabled state. Which feature caused the port to shut down?

A.PortFast

B.BPDU Guard

C.Access VLAN 30 assignment

D.The interface being in access mode

AnswerB

Correct. BPDU Guard is correct because it is specifically designed to shut down an edge port that should not receive BPDUs. In plain terms, the switch sees evidence that another switch was attached and decides to protect the topology by disabling the port instead of allowing a possible loop or unexpected spanning-tree participation.

Why this answer

BPDU Guard is the feature that caused the shutdown. This question is really about separating two features that are often configured together on user-facing ports: PortFast and BPDU Guard. PortFast helps an edge port come up quickly, which is useful for PCs and phones.

BPDU Guard adds protection by watching for BPDUs on that same port. If a switch is connected where only an end device should exist, the newly connected switch may send BPDUs. The local switch interprets that as a topology risk and disables the port to protect the Layer 2 network.

The clues are the err-disabled state and the fact that another switch was connected. VLAN assignment and access mode are normal here and do not explain the shutdown.

Exam trap

Remember that BPDU Guard, not PortFast, causes a port to shut down when BPDUs are received. PortFast only affects port transition speed.

Why the other options are wrong

PortFast is a feature that allows a port to transition immediately to the forwarding state, bypassing the usual spanning-tree listening and learning phases. It does not cause a port to shut down or enter an err-disabled state; it only speeds up convergence for end-user devices.

Assigning an access VLAN (VLAN 30) simply places the port into a specific broadcast domain for user traffic. It has no mechanism to detect or react to BPDUs, and it does not cause a port to enter an err-disabled state. The port would remain operational regardless of the VLAN assignment.

Configuring a port as an access port is a standard practice for connecting end devices. It does not inherently cause any shutdown or err-disabled condition. The port remains up and forwarding traffic unless another feature, such as BPDU Guard, triggers a protective action.

Practice this question →

116

MCQhard

A network technician is troubleshooting connectivity between two directly connected Cisco switches. Hosts on VLAN 10 connected to SwitchA cannot ping the default gateway on SwitchB. The interface on SwitchB shows up/up, but the interface on SwitchA shows up/down. The technician examines the interface configuration and status on SwitchA. What is the most likely cause of this issue?

A.Replace the Ethernet cable because it is faulty.

B.Configure both interfaces with the same duplex and speed settings, either both auto or both manually set to full-duplex and 1000 Mbps.

C.Issue the 'shutdown' and 'no shutdown' commands on the interface to recover from err-disabled state.

D.Check the VLAN configuration on SwitchA because the interface is administratively down.

AnswerB

The line protocol being down with up/up on the remote suggests a duplex mismatch, which can occur when one side is manually set and the other is auto-negotiating. Setting both sides consistently resolves the issue.

Why this answer

The interface on SwitchA shows up/down, meaning Layer 1 is active but the line protocol is down. This is commonly caused by a speed mismatch between the two ends. A duplex mismatch, in contrast, typically results in both interfaces showing up/up with CRC errors.

Therefore, the most likely cause is that the speed settings differ—for example, one interface is set to auto-negotiate while the other is hard-coded to a specific speed. Configuring both interfaces with identical speed and duplex settings, either both auto or both manually configured, resolves the issue.

Exam trap

The trap is that up/down is often misinterpreted as a faulty cable or an err-disabled state, but it actually points to a speed mismatch or auto-negotiation failure, not a duplex mismatch.

Why the other options are wrong

The interface status shows 'up, line protocol is down', which indicates a Layer 2 issue, not a physical cable fault. Additionally, no CRC, runts, giants, or collisions are reported, so the cable is likely not faulty.

The interface status is 'up, line protocol is down', not 'err-disabled'. The err-disabled state would show 'err-disabled' in the interface status, and a shutdown/no shutdown would be appropriate only for err-disabled recovery.

The interface status is 'up', not 'administratively down'. An administratively down interface would show 'administratively down, line protocol is down'. VLAN configuration issues typically cause the interface to be up/up but unable to forward traffic, not up/down.

Practice this question →

117

PBQhard

You are connected to R1. The network uses a router-on-a-stick design with a single switch (SW1) and two VLANs (10 and 20). Currently, hosts in VLAN 10 cannot ping hosts in VLAN 20, and the trunk between R1 and SW1 shows a native VLAN mismatch. Examine the provided configuration and output, then apply the necessary corrections to R1 so that inter-VLAN routing works correctly.

Hints

•Check the native VLAN on the trunk — it might not match the switch.
•Examine each subinterface's encapsulation — one may have the wrong VLAN ID.
•Is IP routing enabled? The router needs to forward between VLANs.

A.Change the native VLAN on R1's trunk interface to 99, correct the encapsulation on G0/0.20 to dot1Q 20, and enable IP routing globally.

B.Change the native VLAN on R1's trunk interface to 99, correct the encapsulation on G0/0.20 to dot1Q 20, but do not enable IP routing because it is enabled by default.

C.Change the native VLAN on R1's trunk interface to 1, correct the encapsulation on G0/0.20 to dot1Q 20, and enable IP routing globally.

D.Change the native VLAN on R1's trunk interface to 99, correct the encapsulation on G0/0.10 to dot1Q 10, and enable IP routing globally.

AnswerA

solution

! R1
interface GigabitEthernet0/0
switchport trunk native vlan 99
exit
interface GigabitEthernet0/0.20
encapsulation dot1Q 20
exit
ip routing

Why this answer

The configuration has three issues: 1) The native VLAN on the trunk is VLAN 1, but the switch expects VLAN 99 (common mismatch scenario). 2) Subinterface G0/0.20 uses encapsulation dot1Q 10 instead of 20, causing VLAN 20 traffic to be mis-tagged. 3) The 'ip routing' command is missing globally, so R1 cannot route between subinterfaces. To fix, configure the main interface G0/0 with 'encapsulation dot1Q 99 native' to set the native VLAN to 99, correct the encapsulation on G0/0.20 to 'dot1Q 20', and enable IP routing with 'ip routing'.

Exam trap

Candidates often forget to enable 'ip routing' globally, assuming it is on by default. They may also overlook the native VLAN mismatch or incorrectly use a Layer 2 switchport command instead of 'encapsulation dot1Q 99 native' on the router interface.

Why the other options are wrong

The specific factual error is that IP routing is not enabled by default; it requires the 'ip routing' global command.

The specific factual error is that the native VLAN must match on both sides; changing R1's native VLAN to 1 does not match the switch's native VLAN 99.

The specific factual error is that the subinterface G0/0.20 is associated with VLAN 20, so its encapsulation must be dot1Q 20, not 10.

Practice this question →

118

MCQhard

A network engineer notices that a newly connected switch-to-switch link is up, but traffic from multiple VLANs is not passing. When issuing the show interfaces trunk command, no trunk ports are listed. Both switch ports are configured with switchport mode dynamic auto. What is the most likely cause?

A.There is a native VLAN mismatch between the two switches.

B.The connecting cable is a straight-through Ethernet cable rather than a crossover cable.

C.One switch lacks a VLAN that exists on the other switch.

D.Both ports are set to dynamic auto, so neither switch initiates DTP negotiation.

AnswerD

In dynamic auto mode, a switch port passively waits for DTP negotiation requests. When both ends are dynamic auto, no side initiates the negotiation, so the ports default to access mode. This perfectly matches the symptom: the link is up, but no trunk appears under show interfaces trunk, and multi-VLAN traffic is not passing.

Why this answer

When both switch ports are configured with switchport mode dynamic auto, neither actively initiates Dynamic Trunking Protocol (DTP) negotiation. DTP dynamic auto ports wait for the other side to send DTP frames to form a trunk; since both sides are passive, the link remains in access mode and does not become a trunk, preventing traffic from multiple VLANs from passing.

Exam trap

Cisco often tests the subtle difference between dynamic auto (passive) and dynamic desirable (active) DTP modes, leading candidates to incorrectly assume that two dynamic auto ports will automatically form a trunk.

Why the other options are wrong

Confusing DTP trunk negotiation with the operational consequences of a native VLAN mismatch.

Assuming that a crossover cable is mandatory for switch-to-switch connections, ignoring auto-MDIX.

Mistaking the ability to forward traffic for a specific VLAN with the ability to negotiate a trunk.

Practice this question →

119

MCQhard

Two switches, SW1 and SW2, are connected via a trunk link. Hosts in VLAN 50 on SW1 cannot communicate with hosts in VLAN 50 on SW2, while hosts in other VLANs communicate normally. What is the most likely cause?

A.VLAN 50 is not allowed on the trunk from SW1.

B.The native VLAN must be changed to 50 on both switches.

C.The trunk must be changed to an access port.

D.The switches must run PPP on the uplink.

AnswerA

The trunk between SW1 and SW2 has a configured allowed VLAN list that excludes VLAN 50; any frames tagged for that VLAN are dropped at the trunk interface. Because 802.1Q trunks only forward VLANs explicitly permitted in the `switchport trunk allowed vlan` list, the missing entry prevents VLAN 50 traffic from reaching SW2. This would cause clients in VLAN 50 to lose connectivity across the link.

Why this answer

The strongest explanation is that VLAN 50 is missing from the allowed VLAN list on one side of the trunk. In practical terms, the trunk is up and carrying other VLANs, so the problem is selective rather than total. When one VLAN is omitted from the allowed list, only that VLAN fails while others continue to work normally.

This is a high-value switching troubleshooting pattern because it rewards careful reading of operational output rather than generic trunk theory.

Exam trap

Be careful to distinguish between total trunk failures and selective VLAN issues. Check the allowed VLAN list on trunk links when only one VLAN is affected.

Why the other options are wrong

The native VLAN is used for untagged traffic on a trunk and does not affect the forwarding of tagged frames for other VLANs. Changing the native VLAN to 50 would not resolve the issue because VLAN 50 frames are still tagged and require inclusion in the allowed VLAN list.

An access port can only carry a single VLAN, so changing the trunk to an access port would prevent the link from carrying multiple VLANs, including VLAN 50. The link is intended to carry multiple VLANs, so a trunk is required.

PPP (Point-to-Point Protocol) is a WAN protocol used on serial links, not on Ethernet trunks. Ethernet trunks use 802.1Q or ISL encapsulation, and PPP has no relevance to VLAN trunking issues.

Practice this question →

120

MCQhard

A phone and PC share one switchport. The phone works, but the PC cannot reach its normal data resources. The switchport voice VLAN is configured, and the access VLAN is incorrect. Which explanation is strongest?

A.The PC is likely in the wrong data VLAN even though the phone still uses the correct voice VLAN.

B.If the phone works, the PC must also work because both use the same VLAN always.

C.The issue must be BGP because phones cannot use VLANs.

D.The access VLAN becomes irrelevant whenever a voice VLAN is configured.

AnswerA

The PC is likely in the wrong data VLAN even though the phone still uses the correct voice VLAN because a single switchport can serve two logical VLANs simultaneously: an access VLAN for untagged data traffic and a voice VLAN for tagged voice traffic. In a typical Cisco IP phone deployment, the phone tags its voice frames with the voice VLAN and passes the PC's untagged frames onto the access VLAN, so the phone's operation only proves the voice VLAN path is healthy. The PC's connectivity depends entirely on the access VLAN configuration—if the access VLAN ID, subnet, or DHCP scope is misconfigured, the PC will fail while the phone continues to work. Thus, the symptom directly points to a data VLAN issue, not a voice VLAN problem.

Why this answer

The switchport is configured with a voice VLAN for the phone and an access VLAN for the PC. If the access VLAN is incorrect, the PC will be placed in the wrong data VLAN, preventing it from reaching its normal data resources, while the phone continues to operate correctly on its designated voice VLAN. This is a common misconfiguration where the data VLAN ID does not match the network segment the PC expects.

Exam trap

Cisco often tests the misconception that a working phone implies the PC is also correctly configured, but the trap here is that voice and data VLANs are independent, so a misconfigured access VLAN only affects the PC.

Why the other options are wrong

This statement is incorrect because the phone and PC can operate on different VLANs on the same port. The phone uses the voice VLAN, while the PC uses the access (data) VLAN. They are not required to use the same VLAN, and misconfiguration of the access VLAN can cause the PC to fail while the phone works.

BGP (Border Gateway Protocol) is a routing protocol used between autonomous systems, not related to VLAN configuration on a switchport. The issue described is about Layer 2 VLAN assignment, not Layer 3 routing. BGP has no role in this scenario.

The access VLAN remains relevant even when a voice VLAN is configured. The access VLAN is used for the PC's data traffic, while the voice VLAN is used for the phone's traffic. If the access VLAN is incorrect, the PC will not be able to communicate on the correct data network.

Practice this question →

121

MCQhard

A network administrator is troubleshooting connectivity issues in a switched network. Users on VLAN 10 report intermittent connectivity to the server farm. The network uses Rapid PVST+ as the spanning-tree protocol. The administrator examines the switch that is the root bridge for VLAN 10 and notices that one of the uplink interfaces to an access switch is in a blocking state. What is the most likely cause of this issue?

A.Change the port type of Gi0/3 to trunk to allow multiple VLANs.

B.Configure spanning-tree portfast on Gi0/3 to speed up convergence.

C.Check the spanning-tree priority on other switches to ensure the intended root bridge has the lowest priority for VLAN 10.

D.Enable BPDU guard on Gi0/3 to prevent unauthorized switches from affecting the network.

AnswerC

The root bridge is elected based on the lowest bridge priority. If another switch has a lower priority, it becomes the root, causing ports on the current root to block. Verifying and adjusting priorities will ensure the correct root bridge election.

Why this answer

In Rapid PVST+, the root bridge for a VLAN should have all its ports in a forwarding state. If an uplink interface on the root bridge is blocking, it indicates that another switch is being elected as the root bridge for VLAN 10, likely because it has a lower spanning-tree priority. By checking and adjusting the priority on other switches, the administrator can ensure the intended switch becomes the root bridge, resolving the intermittent connectivity caused by suboptimal path selection.

Exam trap

Cisco often tests the misconception that a blocking port on a root bridge indicates a physical or configuration issue with that specific port, when in fact it signals that the switch is not the root bridge due to a lower priority on another switch.

Why the other options are wrong

Changing the port type to trunk does not affect spanning-tree root bridge election or port roles. The blocking state is determined by spanning-tree topology, not by trunk configuration.

Portfast is intended for access ports connected to end devices to bypass listening/learning states; it is not used on uplinks and does not resolve a blocking state caused by spanning-tree topology.

BPDU guard is used on access ports to protect against rogue switches by disabling the port if a BPDU is received. It does not affect root bridge election or port roles on uplinks.

Practice this question →

122

MCQmedium

SW1 is the root bridge for VLAN 10. A user switch receives a BPDU on an access port connected to a desk-side unmanaged switch. What should happen if BPDU Guard is enabled on that port?

A.The port transitions to forwarding more quickly

B.The port is moved to err-disabled state

C.The switch elects a new root bridge

D.The port becomes a trunk automatically

AnswerB

When BPDU Guard is enabled on a PortFast edge access port, receiving any BPDU is considered a violation because a legitimate end host should never generate BPDUs. The switch immediately places the port into the err-disabled state, effectively shutting it down to prevent a rogue switch from participating in VLAN 10 spanning tree. This protects the root bridge's topology by blocking the unauthorized device at the access layer.

Why this answer

BPDU Guard is designed to protect edge ports. If a BPDU is received on a PortFast access port, the switch places the interface into the err-disabled state to stop a potential Layer 2 loop or rogue switch.

Exam trap

Remember that BPDU Guard actively disables ports, it doesn't just log or ignore BPDUs.

Why the other options are wrong

PortFast allows a port to transition to forwarding immediately upon link up, but it does not react to BPDU reception. BPDU Guard is a separate feature that disables the port upon receiving a BPDU, not accelerate forwarding.

Receiving a BPDU on a single edge port does not trigger a root bridge election. Root bridge election is based on bridge ID comparison across the entire spanning-tree domain, not on a single BPDU on a port.

BPDU Guard does not change the port mode; it only reacts to BPDU reception by disabling the port. Port mode (access or trunk) is configured separately and is not affected by STP protection features.

Practice this question →

123

PBQhard

You are connected to R1. The network administrator reports that hosts on VLAN 10 cannot communicate with the server attached to R2's GigabitEthernet0/1 interface. Troubleshoot and resolve the issue. Identify the root cause and apply the necessary fix on R1.

Network Topology

Hints

•The high input error count on G0/0 suggests a Layer 1 issue, possibly duplex mismatch.
•Compare the configured duplex on R1's G0/0 with the typical auto-negotiation settings on a switch.
•Reverting to auto-negotiation on both speed and duplex is often the solution for such mismatches.

A.Configure 'no duplex' and 'no speed' under interface GigabitEthernet0/0 to enable auto-negotiation.

B.Change the duplex setting on GigabitEthernet0/0 to half-duplex using 'duplex half'.

C.Apply 'speed 100' and 'duplex full' on GigabitEthernet0/0 to match a common switch configuration.

D.Clear the interface counters on GigabitEthernet0/0 with 'clear counters gigabitethernet0/0' without changing any configuration.

AnswerA

solution

! R1
configure terminal
interface GigabitEthernet0/0
no duplex
no speed
end
clear counters GigabitEthernet0/0

Why this answer

The issue is a duplex mismatch on GigabitEthernet0/0. R1 is configured with 'duplex full' and 'speed 1000', but the connected switch port is likely set to auto-negotiate or is set to half-duplex. This causes high input errors (1500) and degraded performance.

The fix is to set R1's G0/0 to auto-negotiate both speed and duplex, matching the switch's configuration. Enter interface configuration mode for G0/0, issue 'no duplex' and 'no speed' to revert to auto, then clear the interface counters with 'clear counters gigabitethernet0/0'.

Exam trap

The exam trap is that candidates often focus on speed mismatches or clearing counters, but the real issue is duplex mismatch. Remember that on GigabitEthernet interfaces, auto-negotiation is the default and recommended setting; static duplex/speed settings can cause mismatches and errors.

Why the other options are wrong

The specific factual error is that manually setting half-duplex does not resolve a mismatch; it may create a new mismatch or degrade performance further.

The specific factual error is that GigabitEthernet interfaces usually operate at 1000 Mbps; setting speed to 100 may cause the interface to not come up or to underperform.

The specific factual error is that clearing counters is a diagnostic step, not a fix. The root cause (duplex mismatch) remains unaddressed.

Practice this question →

124

MCQhard

Based on the exhibit, why are clients in VLAN 70 failing to resolve hostnames even though they can reach remote IP addresses?

A.The clients are missing valid DNS server information.

B.The default gateway must be removed from the DHCP scope.

C.The clients must use PPP before DNS works.

D.The VLAN must be converted to the native VLAN on all trunks.

AnswerA

The DHCP scope assigns IP configuration but does not include Option 6 (DNS server), so clients receive no resolver address. When a user pings a hostname, the client cannot query a DNS server, causing resolution failure; direct IP access works because no DNS is required. This exactly matches the exhibited symptom of IP connectivity succeeding while hostname-based access fails.

Why this answer

The strongest explanation is that the clients are missing valid DNS server information. In practical terms, successful reachability to remote IP addresses proves that Layer 3 forwarding is working. The failure occurs only when a hostname is used, which points to a naming service problem rather than a general connectivity problem. The DHCP scope shown provides an address and default gateway, but no DNS server option is defined.

This is a very realistic IP-services troubleshooting pattern because the network path works while application usability still fails.

Exam trap

A frequent exam trap is to mistake the inability to resolve hostnames as a routing or VLAN trunking problem. Candidates might incorrectly believe that removing the default gateway or converting the VLAN to the native VLAN on trunks will resolve the issue. However, these options do not address DNS resolution, which is an application-layer service independent of Layer 3 forwarding.

The trap arises because clients can reach remote IP addresses, misleading candidates to focus on routing or VLAN configuration rather than missing DNS server information in the DHCP scope.

Why the other options are wrong

Removing the default gateway from the DHCP scope is incorrect because the default gateway is essential for routing traffic outside the local VLAN. Its presence does not cause hostname resolution failures.

The suggestion that clients must use PPP before DNS works is incorrect because PPP is unrelated to DNS resolution in a typical VLAN and DHCP environment. DNS operates independently of PPP.

Converting the VLAN to the native VLAN on all trunks does not affect DNS resolution. This option addresses Layer 2 trunking issues, which are unrelated to the hostname resolution problem described.

Practice this question →

125

Matchingmedium

Drag and drop the VLAN/trunking commands and terms on the left to their correct descriptions or functions on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Enables 802.1Q trunking on a switch interface

Assigns an access port to VLAN 10

VLAN that carries untagged traffic on a trunk link; default is VLAN 1

Changes the native VLAN on a trunk to VLAN 99

Uses subinterfaces on a single router interface to route between VLANs

Why these pairings

These pairings match common VLAN/trunking commands and terms to their correct descriptions.

Exam trap

Do not confuse the commands for access and trunk ports. Remember that 'switchport mode access' places the port in access mode, while 'switchport mode trunk' places it in trunk mode. Also, the native VLAN and VLAN 1 are related to trunking and default settings, not to the configuration of an access port.

Practice this question →

126

PBQhard

You are troubleshooting a wireless client association failure on a Cisco WLC. The client is unable to connect to the corporate SSID 'CorpNet' and reports an authentication error. Review the WLC configuration and fix the issue so that the client can associate and obtain an IP address from VLAN 100. The WLC management IP is 192.168.1.10/24.

Hints

•Check the security settings — the client may not support WPA3.
•Verify if the SSID is hidden — the client cannot scan for it.
•Ensure the VLAN assigned to the WLAN matches the client's subnet.

A.Change the WLAN security to WPA2, enable SSID broadcast, and configure the WLAN interface to use VLAN 100 with a DHCP scope on that VLAN.

B.Change the WLAN security to WPA3 only, enable SSID broadcast, and change the management interface IP to 192.168.100.10/24.

C.Keep WPA3, disable SSID broadcast for security, and configure the WLAN interface to use VLAN 100 with a DHCP scope on VLAN 1.

D.Change the WLAN security to WPA2, keep SSID broadcast disabled, and configure the WLAN interface to use VLAN 1.

AnswerA

solution

! WLC
configure terminal
wlan CorpNet 1 CorpNet
security wpa2
security wpa akm psk
security wpa psk ascii 7 1234567890abcdef
no security wpa3-sae
broadcast-ssid enable
interface wlan 1
vlan 100
end

Why this answer

The client authentication and DHCP issues are caused by: (1) WPA3 being configured while the client only supports WPA2, (2) SSID broadcast disabled, preventing client discovery, and (3) the WLAN's client VLAN (100) lacking a DHCP server or scope. The management interface VLAN (1) does not interfere with client DHCP. To resolve, change security to WPA2, enable SSID broadcast, and ensure the WLAN is associated with the correct VLAN (100) and a DHCP scope exists on that VLAN.

Exam trap

Be careful not to confuse the management interface VLAN with the client data VLAN. Also, remember that SSID broadcast must be enabled for clients to discover the network, and security settings must match client capabilities. Always verify DHCP scope placement matches the client VLAN.

Why the other options are wrong

The specific factual error is that WPA3-only security may not be supported by the client, and changing the management interface IP does not resolve the client VLAN assignment issue.

The specific factual errors are: WPA3 may not be compatible, disabling SSID broadcast hides the network, and DHCP scope must be on the same VLAN as the client (VLAN 100).

The specific factual errors are: SSID broadcast must be enabled for client discovery, and the WLAN interface must be mapped to VLAN 100, not VLAN 1.

Practice this question →

127

PBQhard

You are connected to SW1 via the console. SW1 is a Layer 2 switch with two links to SW2 configured as an EtherChannel using LACP. The EtherChannel is not coming up. Interface G0/2 was accidentally configured as an access port in VLAN 10, while G0/1 is configured as a trunk. The administrator wants to use LACP to bundle the links. Troubleshoot and fix the configuration to bring up the EtherChannel.

Hints

•All interfaces in an EtherChannel must have identical configuration.
•Check if the interfaces are in the same VLAN or trunk mode.
•LACP active mode requires matching configurations on both ends.

A.Change interface G0/2 to trunk mode and ensure both interfaces have the same allowed VLAN list.

B.Change interface G0/1 to access VLAN 10 to match G0/2.

C.Remove the access VLAN configuration from G0/2 and leave it as a default switchport (dynamic desirable).

D.Change the EtherChannel mode from LACP to PAgP on both switches.

AnswerA

solution

! SW1
interface GigabitEthernet0/2
no switchport access vlan 10
switchport mode trunk

Why this answer

For an EtherChannel to form, all member interfaces must have matching configuration, including trunk mode and allowed VLANs. Since G0/1 is a trunk and G0/2 is an access port in VLAN 10, the mismatch prevents the EtherChannel from bundling. Changing G0/2 to trunk mode and ensuring both interfaces have the same allowed VLAN list resolves the inconsistency.

Exam trap

200-301 often tests EtherChannel configuration requirements; candidates may focus on the protocol mode but overlook the need for matching trunk/access and VLAN configurations.

Why the other options are wrong

The specific factual error is that changing G0/1 to access VLAN 10 would not resolve the mismatch if the intended configuration is trunking. It would only create a different mismatch if the other side expects trunking.

The specific factual error is that dynamic desirable mode does not ensure trunking; it relies on DTP negotiation, which may fail if the other side is set to trunk. Additionally, the VLAN mismatch (access vs trunk) would still prevent EtherChannel formation.

The specific factual error is that the protocol does not affect the requirement for consistent interface configurations. Both LACP and PAgP require identical VLAN and trunk settings on all member ports.

128

MCQhard

SW2 receives the following STP details for VLAN 10: The root bridge ID is 32768:0001.0001.0001 (SW1), and SW2's bridge ID is 32768:0002.0002.0002. Its interface Gi0/1 has a path cost of 4 to the root, while Gi0/2 has a path cost of 19. Based on this information, which statement is correct?

A.SW2 is the root bridge for VLAN 10.

B.Gi0/1 on SW2 is the root port.

C.All SW2 ports in VLAN 10 must be designated ports.

D.STP is disabled because the priorities are equal.

AnswerB

Gi0/1 is the root port because STP selects the port with the lowest root path cost to reach the root bridge, and the received BPDU lists the root as reachable through Port 1. On SW2, Port 1 maps to Gi0/1, so that interface assumes the root port role. A root port is the non-root switch's closest path to the root, and it remains in forwarding state.

Why this answer

The root bridge has the lowest bridge ID. SW1 is the root because its bridge ID is lower than SW2's local bridge ID. On a non-root switch, the port with the best path toward the root becomes the root port, so Gi0/1 is the root port here.

Exam trap

A common exam trap is to incorrectly conclude that STP is disabled when bridge priorities are equal. Candidates may mistakenly believe that equal priorities cause STP to fail or not elect a root bridge. However, STP always elects a root bridge by comparing the MAC addresses as a tiebreaker when priorities match.

Another trap is assuming all ports on a non-root switch must be designated ports, ignoring the existence of a root port that leads toward the root bridge. Misreading the root port can lead to incorrect answers about port roles and network topology.

Why the other options are wrong

This option is incorrect because the root bridge ID shown in the STP details differs from SW2's local bridge ID, indicating SW2 is not the root bridge for VLAN 10.

This option is wrong since a non-root switch does not have all ports as designated ports; it must have one root port and may have other ports as designated or blocked.

This is incorrect because equal priorities do not disable STP; the protocol uses the MAC address portion of the bridge ID to break ties and continue operation.

Practice this question →

129

PBQhard

You are connected to SW1 via the console. SW1 is a Layer 2 switch connected to two other switches (SW2 and SW3) via redundant links. All switches run IEEE 802.1D Spanning Tree Protocol. The network administrator wants SW1 to become the root bridge for VLAN 1. Currently, the root bridge is SW2. Configure SW1 to achieve this and ensure that port G0/1, which connects to an end device, immediately transitions to forwarding state upon link up and is protected from BPDU attacks.

Network Topology

Hints

•The 'root primary' macro sets the priority lower than any other switch.
•PortFast allows a port to skip listening/learning states.
•BPDU Guard err-disables the port if a BPDU is received.

A.Configure 'spanning-tree vlan 1 root primary' globally, and on interface G0/1 configure 'spanning-tree portfast' and 'spanning-tree bpduguard enable'.

B.Configure 'spanning-tree vlan 1 priority 4096' globally, and on interface G0/1 configure 'spanning-tree portfast' and 'spanning-tree guard root'.

C.Configure 'spanning-tree vlan 1 root secondary' globally, and on interface G0/1 configure 'spanning-tree portfast' and 'spanning-tree bpduguard enable'.

D.Configure 'spanning-tree vlan 1 priority 32768' globally, and on interface G0/1 configure 'spanning-tree portfast' and 'spanning-tree bpdufilter enable'.

AnswerA

solution

! SW1
spanning-tree vlan 1 root primary
interface GigabitEthernet0/1
spanning-tree portfast
spanning-tree bpduguard enable

Why this answer

The 'spanning-tree vlan 1 root primary' command reduces the bridge priority to 24576 (or lower) to ensure SW1 becomes root for VLAN 1. PortFast on G0/1 speeds up access port convergence, and BPDU Guard protects against rogue switches by disabling the port upon BPDU reception.

Exam trap

Do not confuse 'root primary' with 'root secondary' or manual priority settings. Also, remember that BPDU Guard is for access port security, while Root Guard protects the root bridge position. BPDU Filter suppresses BPDUs and is not a security feature.

Why the other options are wrong

The specific factual error: 'spanning-tree guard root' is a root guard feature, not BPDU guard. Also, manually setting priority to 4096 may not guarantee root if another switch has lower priority.

The specific factual error: 'root secondary' is for backup root, not primary. It sets priority to 28672, which is higher than the default priority of 32768 but not low enough to become root if another switch has a lower priority.

The specific factual error: priority 32768 is default and does not change root status. BPDU filter is not a security feature against BPDU attacks; it suppresses BPDUs entirely.

130

MCQmedium

Exhibit: PCs in VLAN 20 are not receiving addresses from a DHCP server in another subnet. The switch SVI for VLAN 20 is up, and routing is working. Which configuration is most likely missing on the gateway for VLAN 20?

A.ip default-gateway 10.20.20.1

B.ip helper-address 10.99.99.10

C.switchport trunk allowed vlan 20

D.spanning-tree portfast default

AnswerB

DHCP relies on broadcast discovery, and broadcasts do not cross Layer 3 boundaries. The PCs in VLAN 20 cannot reach the DHCP server on a different subnet unless the VLAN 20 SVI has ip helper-address 10.99.99.10 configured. That command converts the client broadcast into a unicast relayed to the server, while also inserting the SVI IP as the giaddr so the server can scope an appropriate address. Therefore, this is the missing configuration.

Why this answer

DHCP Discover messages are broadcasts and do not cross routers by default. An ip helper-address on the client gateway interface relays those requests to a remote DHCP server.

Exam trap

A frequent exam trap is selecting the ip default-gateway command as the solution for DHCP relay issues. This command only applies to Layer 2 switches for their own management traffic and does not forward DHCP broadcasts across routed interfaces. Candidates may also mistakenly focus on VLAN trunking or spanning-tree settings, which do not affect DHCP relay functionality.

The key is to recognize that DHCP broadcasts must be explicitly forwarded by the router or Layer 3 switch interface using ip helper-address to reach a DHCP server in another subnet.

Why the other options are wrong

The ip default-gateway command configures the default gateway for a Layer 2 switch’s management interface and does not forward DHCP broadcasts. Since the question involves DHCP relay across routed VLANs, this command is irrelevant.

The switchport trunk allowed vlan 20 command controls VLAN traffic allowed on a trunk link but does not influence DHCP relay or routing between VLANs. The issue is DHCP relay, not VLAN trunk configuration.

The spanning-tree portfast default command enables PortFast on switch ports to speed up STP convergence and does not affect DHCP relay or routing. It is unrelated to the problem of clients not receiving DHCP addresses.

Practice this question →

131

MCQmedium

A phone and a PC are attached to the same switchport. The intended data VLAN is VLAN 10, and the phone uses voice VLAN 20. The switchport currently has `switchport voice vlan 20` configured. The phone works, but the PC cannot reach the data network. Which command is most likely missing?

A.switchport mode dynamic auto

B.switchport voice vlan 20

C.switchport access vlan 10

D.spanning-tree guard root

AnswerC

The PC fails to reach the network because it is untagged on the access port while the switchport is likely in its default VLAN 1 or a mismatched VLAN. Issuing 'switchport access vlan 10' explicitly assigns the data VLAN to the port, ensuring the PC's traffic is placed in the correct Layer 2 domain. The phone can still tag its voice traffic with VLAN 20 via the voice VLAN feature, but the access VLAN governs the untagged PC traffic.

Why this answer

When a Cisco IP phone and a PC share one port, the switchport often needs both a data VLAN and a voice VLAN. If the voice VLAN exists but the data access VLAN is wrong or missing, the phone can work while the PC fails.

Exam trap

Ensure both data and voice VLANs are configured when devices share a port. Don't confuse duplex or trunk settings with VLAN issues.

Why the other options are wrong

The phone works but the PC cannot reach the data network, indicating the PC is not in the correct VLAN. 'switchport mode dynamic auto' sets the port to negotiate trunking via DTP, which does not assign a data VLAN to the PC.

The PC cannot reach the data network because the switchport is likely configured as a voice VLAN only, but the data VLAN (access VLAN) is missing. Option B configures the voice VLAN, which is correct for the phone, but does not set the access VLAN for the PC.

The issue is that the PC cannot reach the data network, which is typically configured via the access VLAN. Spanning-tree guard root is unrelated to VLAN assignment; it prevents a switch from becoming the root bridge, not connectivity issues on a specific VLAN.

Practice this question →

132

MCQmedium

A network administrator is configuring a Cisco IOS switch port that connects to an IP phone and a PC daisy-chained behind the phone. The administrator wants the PC's data traffic to be untagged on VLAN 20, and the phone's voice traffic to be tagged with VLAN 30. The phone is already configured to use VLAN 30 for voice. Which configuration on the switch port will accomplish this?

A.switchport mode trunk switchport trunk native vlan 20 switchport trunk allowed vlan 30

B.switchport mode trunk switchport trunk native vlan 30 switchport trunk allowed vlan 20

C.switchport mode access switchport access vlan 30 switchport voice vlan 20

D.switchport mode access switchport access vlan 20 switchport voice vlan 30

AnswerD

This configuration sets the port as an access port for data VLAN 20 and uses the voice VLAN 30 for tagged voice traffic. The phone will receive untagged data frames on VLAN 20 and will tag its voice frames with VLAN 30. This is the standard Cisco configuration for a port connecting to an IP phone with a PC behind it.

Why this answer

The correct configuration uses an access port for data VLAN 20 and a voice VLAN 30. This allows the PC to send untagged data frames that are assigned to VLAN 20, while the IP phone tags its voice frames with VLAN 30. This is the standard and recommended approach for connecting an IP phone and PC to a single switch port.

Exam trap

The trap here is confusing the voice VLAN and data VLAN assignments, or incorrectly using a trunk port when an access port with voice VLAN is sufficient.

Practice this question →

133

PBQhard

You are connected to R1, a multilayer switch acting as a DNS forwarder for two VLANs. Users on VLAN 10 report that they cannot resolve 'files.example.com' while VLAN 20 works fine. The DNS server 198.51.100.53 is reachable but returns SERVFAIL for queries from subnet 192.168.10.0/24, while server 203.0.113.53 responds correctly for both VLANs. Diagnose and fix the DNS resolution issue using nslookup and dig, then adjust the IOS-XE configuration to ensure proper name resolution. Choose the best fix that permanently resolves the problem.

Network Topology

Hints

•The first DNS server returns SERVFAIL for the A record query.
•The second DNS server resolves the name correctly.
•Use 'no ip name-server <ip>' to remove a faulty server.

A.Remove the faulty primary DNS server using 'no ip name-server 198.51.100.53' and keep the working secondary server 203.0.113.53.

B.Add a static DNS entry for 'files.example.com' using 'ip host files.example.com 10.0.0.1' on R1.

C.Change the DNS server order so that the working server is primary using 'ip name-server 203.0.113.53 198.51.100.53'.

D.Configure the router to use only the faulty server by removing the working server with 'no ip name-server 203.0.113.53'.

AnswerA

solution

! R1
configure terminal
no ip name-server 198.51.100.53
end

Why this answer

The faulty DNS server 198.51.100.53 returns SERVFAIL for the A record query, indicating a misconfiguration or missing record on that server. Although reordering (Option C) would allow resolution to work by querying the functional server first, it is not the optimal fix because the broken server remains in the list and could still be used if the primary times out or for future queries. The best practice is to completely remove the faulty server using 'no ip name-server 198.51.100.53'.

Option B adds a static entry that only helps one domain and does not address the root cause. Option D would make the router use only the broken server, worsening the problem.

Exam trap

Do not confuse a reachable DNS server with a functional one. SERVFAIL means the server is responding but cannot resolve the query. The solution is to remove the faulty server, not reorder or add static entries.

Why the other options are wrong

Reordering the name servers works around the issue temporarily but leaves the faulty server in the configuration, which is not a permanent solution and violates best practice of removing misconfigured DNS servers.

Practice this question →

134

Multi-Selecthard

A switch port is configured with DHCP snooping trust on the uplink toward the legitimate DHCP server, and DHCP snooping is enabled on the user VLAN. A user connects a rogue DHCP server to an untrusted access port. Which two statements describe what DHCP snooping does in this situation? (Choose two.)

Select 2 answers

A.DHCP server messages received on the untrusted access port are dropped.

B.The access port is automatically converted to a trusted port after the first DHCP packet is seen.

C.The switch disables the entire VLAN and places it in err-disabled state.

D.The rogue server's MAC address is added to the snooping binding table as a trusted entry.

E.Client DHCP messages received on the untrusted access port are still forwarded toward the trusted uplink.

AnswersA, E

DHCP snooping classifies ports as trusted or untrusted. Server-originated messages such as OFFER and ACK arriving on an untrusted port are discarded, which prevents a rogue server on an access port from handing out addresses. This is the core protection the feature provides in this scenario.

Why this answer

DHCP snooping builds a binding table from legitimate client transactions and blocks server messages on untrusted ports. Client messages on untrusted access ports are permitted and forwarded uplink, while rogue server offers on those same ports are discarded. This combination stops the rogue server without disrupting normal client DHCP behavior.

Exam trap

The trap here is assuming DHCP snooping blocks all DHCP traffic on untrusted ports, when it actually blocks only server-originated messages and still permits client requests.

Practice this question →

135

MCQhard

Two switches are connected using four Gigabit Ethernet interfaces configured as an EtherChannel with LACP. The network administrator notices that only two of the four interfaces are active in the port-channel, and the other two are in a suspended state. Upon further investigation, the administrator finds that the two inactive interfaces correspond to remote interfaces that are configured with the 'on' mode, while the active ones correspond to remote interfaces configured with LACP active/passive. The administrator also verifies that all local interfaces have the same speed, duplex, and VLAN. What is the most likely cause of the suspended interfaces?

A.The interfaces are in err-disabled state due to a spanning-tree loop.

B.The remote switch interfaces corresponding to the suspended local interfaces are configured with the 'on' mode instead of 'active' or 'passive' for LACP.

C.The port-channel interface is shutdown.

D.There is a mismatch in the allowed VLANs on the member interfaces.

AnswerB

When one switch has LACP active/passive and the other has 'on' (static), LACP negotiation fails, and the ports become suspended. Changing the remote switch to 'active' or 'passive' allows LACP to negotiate and bundle the ports.

Why this answer

LACP requires both ends of a link to be configured in either 'active' or 'passive' mode to negotiate an EtherChannel. If some remote interfaces are set to 'on' mode (static EtherChannel), LACP negotiation fails on those links, causing the corresponding local LACP-enabled interfaces to remain in a suspended state. The local switch detects that LACP PDUs are not received on those interfaces and suspends them to prevent misconfiguration.

The other two interfaces with correctly configured remote peers form the EtherChannel successfully.

Exam trap

Cisco often tests the misconception that all interfaces must match in speed, duplex, and VLAN to form an EtherChannel, but the trap here is that the LACP mode mismatch (active/passive vs. on) is the specific cause of suspended interfaces even when other parameters are consistent.

Why the other options are wrong

The exhibit shows the ports as suspended, not err-disabled. Spanning-tree loops typically cause err-disable, not suspension.

The port-channel is up (U), so it is not shutdown.

The scenario explicitly states that all interfaces are configured with the same VLAN, so this is not the cause.

Practice this question →

136

PBQmedium

You are connected to SW1 via console. SW1 is a Layer 2 switch connected to two other switches (SW2 and SW3) via trunk links. The network administrator wants to ensure that SW1 becomes the root bridge for VLAN 10 and VLAN 20. Currently, SW2 is the root for both VLANs. Configure SW1 to become the root bridge for these VLANs using the Cisco-recommended macro STP commands.

Network Topology

Hints

•Use the 'root primary' macro to set the bridge priority to 24576.
•Ensure VLANs 10 and 20 exist on SW1.

A.spanning-tree vlan 10 root primary; spanning-tree vlan 20 root primary

B.spanning-tree vlan 10 root secondary; spanning-tree vlan 20 root secondary

C.spanning-tree vlan 10 priority 4096; spanning-tree vlan 20 priority 4096

D.spanning-tree vlan 10 root; spanning-tree vlan 20 root

AnswerA

solution

! SW1
spanning-tree vlan 10 root primary
spanning-tree vlan 20 root primary

Why this answer

The 'spanning-tree vlan <vlan> root primary' command is the Cisco-recommended macro that sets the bridge priority to 24576, which is lower than the default 32768, making SW1 the root bridge for those VLANs. Option A correctly uses this macro. Option C, while it could achieve the same goal by setting priority to 4096, is not the macro command and would be considered a static configuration; the question specifically asks for the appropriate macro commands.

Option B sets priority to 28672 as a secondary root, and Option D is invalid syntax.

Exam trap

Do not confuse 'root primary' with 'root secondary'. 'root primary' sets priority to 24576 to become root; 'root secondary' sets priority to 28672 to act as backup. Also, remember that the 'root' keyword must be followed by 'primary' or 'secondary'.

Why the other options are wrong

Option B uses 'root secondary', which sets the priority to 28672, making SW1 a backup root, not the primary root bridge.

Option C uses a static priority assignment of 4096, which would also make SW1 root, but the question expects the Cisco-recommended macro command 'root primary'.

Option D uses incomplete syntax 'spanning-tree vlan 10 root' without 'primary' or 'secondary', which is invalid.

137

PBQhard

You are connected to Switch1. Configure an LACP EtherChannel between Switch1 and Switch2 using interfaces GigabitEthernet0/1 and GigabitEthernet0/2. The channel must be in active mode on both sides, and the port-channel interface must have VLAN 10 as the access VLAN. The current configuration has a speed/duplex mismatch and inconsistent VLAN assignments preventing the channel from forming. Verify the channel is up using 'show etherchannel summary'.

Network Topology

Hints

•Check that all member interfaces have the same speed and duplex settings.
•Ensure all interfaces (including the port-channel) are in the same VLAN.
•Both sides must use LACP active mode for the channel to form.

A.Set speed auto on Gi0/1 and Gi0/2, set duplex auto on both, change access VLAN on Gi0/2 to 10, change access VLAN on Port-channel1 to 10, and set channel-group mode active on both interfaces.

B.Set speed 1000 on Gi0/1, set duplex full on Gi0/1, change access VLAN on Gi0/1 to 20, change access VLAN on Port-channel1 to 20, and set channel-group mode passive on both interfaces.

C.Set speed 100 on Gi0/2, set duplex half on Gi0/2, change access VLAN on Gi0/1 to 20, change access VLAN on Port-channel1 to 20, and set channel-group mode desirable on both interfaces.

D.Set speed auto on Gi0/1 and Gi0/2, set duplex auto on both, change access VLAN on Gi0/1 to 10, change access VLAN on Port-channel1 to 10, and set channel-group mode active on Gi0/1 and passive on Gi0/2.

AnswerA

solution

! Switch1
interface gigabitethernet0/1
speed auto
duplex auto
channel-group 1 mode active
exit
interface gigabitethernet0/2
speed auto
duplex auto
switchport access vlan 10
channel-group 1 mode active
exit
interface port-channel 1
switchport access vlan 10
end

Why this answer

The EtherChannel is not forming due to three issues: (1) Speed mismatch: Gi0/1 is set to 100 Mbps while Gi0/2 is 1000 Mbps; both must match (e.g., auto). (2) Duplex mismatch: Gi0/1 is half-duplex, Gi0/2 is full-duplex; both must be the same (e.g., full). (3) VLAN mismatch: Gi0/1 is in VLAN 10, Gi0/2 in VLAN 20, and Port-channel1 is in VLAN 1; all access VLANs must be consistent (set to VLAN 10). Additionally, the channel-group mode should be 'active' on both interfaces for LACP. The solution involves setting speed and duplex to auto, changing the access VLAN on Gi0/2 and the port-channel to VLAN 10, and setting channel-group mode to active.

Exam trap

The exam trap here is that candidates may focus only on resolving the speed/duplex and VLAN mismatches but forget to check the LACP mode requirement. Also, they might confuse LACP modes (active/passive) with PAgP modes (desirable/auto). Always verify that the mode matches the protocol and the requirement.

Why the other options are wrong

The specific factual error: passive mode on both sides will not form an LACP EtherChannel because neither side initiates negotiation; at least one side must be active.

The specific factual error: 'desirable' is a PAgP mode; LACP uses 'active' or 'passive'. Using 'desirable' would not form an LACP EtherChannel.

The specific factual error: the requirement explicitly states 'active mode on both sides', so setting one side to passive violates the requirement, even though the channel might still form.

Practice this question →

138

PBQhard

You are managing a Cisco WLC (192.168.1.10) via its web UI. The wireless network 'CorpSecure' has been configured but clients cannot associate. Some report 'wrong password' errors; others see the SSID but fail to connect. Additionally, management access to the WLC web UI is intermittent. Identify and resolve the issues so that wireless clients can successfully associate with 'CorpSecure' using WPA3-Personal and the WLC web UI is reliably accessible from the management VLAN (VLAN 10).

Hints

•Check the security settings on the WLAN; clients expecting WPA3 will fail with WPA2 configured.
•An SSID that is hidden (Broadcast disabled) may not appear in client scans unless manually entered.
•Management access issues might be unrelated to the WLAN config; verify the management interface IP and default gateway are correct.

A.Configure the SSID with WPA3-Personal; verify management interface is on VLAN 10 with correct gateway.

B.Change the SSID security to WPA2-PSK and disable SSID broadcast; reset the WLC to factory defaults.

C.Update the WLC firmware to the latest version and change the management VLAN to VLAN 1.

D.Reconfigure the SSID with WPA3-Enterprise and enable SSID broadcast; set the management interface to use DHCP.

AnswerA

solution

! WLC
Navigate to WLANs > Edit CorpSecure > Security > Layer 2 > Select WPA3-Personal (AES) > Apply
Navigate to WLANs > Edit CorpSecure > SSID > Enable Broadcast SSID > Apply

Why this answer

The primary issue is a security mismatch: the SSID is set to WPA2-PSK while clients expect WPA3, causing 'wrong password' errors. Since clients can see the SSID, broadcast is already enabled; the secondary connection failures may be due to incompatible devices, but the correct fix is to change the security to WPA3-Personal (AES). Additionally, verify that the management interface is on VLAN 10 with the correct gateway to ensure reliable WLC web UI access.

Exam trap

Candidates might mistakenly conclude the SSID broadcast is disabled and enable it unnecessarily, overlooking that the visible SSID indicates broadcast is already on, or they might ignore the management VLAN configuration.

Why the other options are wrong

The specific factual error: WPA2-PSK is not compatible with clients expecting WPA3-Personal, and hiding the SSID prevents clients from seeing it.

The specific factual error: VLAN 1 is the default and often discouraged for management; the issue is not firmware-related but configuration-based.

The specific factual error: WPA3-Enterprise is not appropriate without a RADIUS server, and DHCP for management can lead to unreliable access.

Practice this question →

139

PBQhard

You are connected to WLC-1 via SSH. A new SSID 'CorpSecure' must be configured for 5 GHz clients using WPA3-Personal. However, after creation, clients can see the SSID but fail to associate. Review the WLC configuration and fix the issue so that clients can successfully associate and obtain an IP address from VLAN 100 (subnet 10.0.100.0/24).

Network Topology

Hints

•Check the current security settings on the WLAN; they are using WPA2, not WPA3.
•The radio policy is not set — clients may try to connect on 2.4 GHz, but the SSID should be 5 GHz only.
•Ensure the WLAN is enabled after changes.

A.Change the WLAN security to WPA3-Personal, enable AES-CCMP for WPA3, set the radio policy to 5 GHz, and ensure the WLAN is mapped to the dynamic interface for VLAN 100.

B.Change the WLAN security to WPA2-Personal, enable TKIP encryption, and set the radio policy to 5 GHz.

C.Change the WLAN security to WPA3-Personal, enable AES-CCMP, but leave the radio policy as 'All' (both 2.4 GHz and 5 GHz).

D.Change the WLAN security to WPA3-Personal, enable AES-CCMP, set the radio policy to 5 GHz, but do not enable the WLAN after changes.

AnswerA

solution

! WLC-1
config wlan security wpa3 1 enable
config wlan security wpa3 psk 1 set ascii CorpSecurePass123
config wlan radio-policy 1 5ghz
config wlan enable 1
config wlan security wpa3 ciphers 1 aes-ccmp

Why this answer

The SSID was configured with WPA2 instead of WPA3. The WLC also had no radio policy set for 5 GHz only. To fix, change the WLAN security to WPA3-Personal, enable AES-CCMP for WPA3, and set the radio policy to 5 GHz.

Additionally, ensure the WLAN is mapped to the appropriate dynamic interface for VLAN 100, not the management interface, and that client VLAN 100 is reachable. The commands to modify the WLAN are: config wlan security wpa3 1 enable, config wlan security wpa3 psk ascii CorpSecurePass123 1, config wlan radio policy 802.11a-only 1, and config wlan enable 1.

Exam trap

Students often forget to change the radio policy from 'All' to a specific band, or they confuse WPA2 with WPA3. Also, they may overlook enabling the WLAN after configuration. Ensure you understand the specific requirements for WPA3 and the need to match the radio policy to the client band.

Why the other options are wrong

The specific factual error is that WPA2-Personal with TKIP does not meet the WPA3-Personal requirement; WPA3 mandates AES-CCMP.

The specific factual error is that the radio policy must be set to 5 GHz only, not 'All', to restrict access to 5 GHz clients.

The specific factual error is that the WLAN remains disabled, so clients cannot associate even if other settings are correct.

Practice this question →

140

MCQhard

A network engineer is configuring a new switch port for a VoIP phone that will have a PC daisy-chained behind it. The engineer wants to ensure that voice traffic is tagged with VLAN 100 and data traffic is untagged in VLAN 200. Which configuration should be applied to the switch port?

A.Configure the port as an access port in VLAN 200 and enable voice VLAN 100 with the switchport voice vlan 100 command.

B.Configure the port as a trunk port with native VLAN 200 and allowed VLAN 100.

C.Configure the port as an access port in VLAN 100 and enable voice VLAN 200 with the switchport voice vlan 200 command.

D.Configure the port as a trunk port with native VLAN 100 and allowed VLAN 200.

AnswerA

This configuration sets the port as an access port for data traffic in VLAN 200, while enabling voice VLAN 100 for VoIP traffic. The phone will tag voice traffic with VLAN 100, and the PC's data traffic will be untagged and assigned to VLAN 200. This meets the requirement of tagged voice and untagged data on the same port.

Why this answer

The correct configuration uses the voice VLAN feature on an access port. The port is set to access VLAN 200 for data traffic, and the voice VLAN 100 is enabled. The VoIP phone will tag voice frames with VLAN 100, while the PC's data frames remain untagged and are placed in VLAN 200.

This is the standard Cisco approach for connecting a phone and PC on a single switch port.

Exam trap

The trap here is assuming that a trunk port is required for voice and data separation, when the voice VLAN feature on an access port achieves the same result with simpler configuration.

Practice this question →

141

Multi-Selectmedium

A network administrator is configuring a Cisco router to act as a DHCP server for a new VLAN. The router must provide IP addresses, default gateway, and DNS server information to clients. Which two commands are required in the DHCP pool configuration to provide the default gateway and DNS server to clients? (Choose two.)

Select 2 answers

A.network 10.1.1.0 255.255.255.0

B.default-router 10.1.1.1

C.dns-server 8.8.8.8

D.lease 0 8

E.ip helper-address 10.1.1.1

AnswersB, C

The default-router command in DHCP pool configuration specifies the default gateway address that will be provided to DHCP clients. In this scenario, it sets the gateway to 10.1.1.1, which is essential for clients to reach other networks. Without this command, clients would not receive a default gateway and could only communicate on the local subnet.

Why this answer

To provide default gateway and DNS server information to DHCP clients, the DHCP pool must include the default-router and dns-server commands. The default-router command supplies the gateway address, and the dns-server command supplies the DNS server address. The network command defines the pool subnet, the lease command sets lease time, and ip helper-address is used for DHCP relay, not for these parameters.

Exam trap

The trap here is mixing up the network command, which defines the pool, with the default-router and dns-server commands, which actually provide the gateway and DNS information.

Practice this question →

142

PBQmedium

You are connected to SW1 via the console. SW1 is a Layer 2 switch connected to router R1 via trunk link G0/1. R1 performs inter-VLAN routing using subinterfaces. VLANs 10, 20, and 30 exist on SW1. Hosts in VLAN 10 (192.168.10.0/24) can ping R1's subinterface, but cannot communicate with hosts in VLAN 20. You suspect the trunk is not allowing VLAN 20 traffic.

Network Topology

Hints

•Check which VLANs are allowed on the trunk.
•The 'allowed vlan' command can be used to add or remove VLANs.
•Verify that VLAN 20 exists on the switch.

A.Configure 'switchport trunk allowed vlan add 20' on SW1's G0/1 interface.

B.Configure 'switchport mode access' on SW1's G0/1 interface.

C.Configure 'switchport trunk native vlan 20' on SW1's G0/1 interface.

D.Configure 'switchport trunk allowed vlan except 20' on SW1's G0/1 interface.

AnswerA

solution

! SW1
interface GigabitEthernet0/1
switchport trunk allowed vlan add 20

Why this answer

The symptom — VLAN 10 hosts can reach R1's subinterface but VLAN 20 hosts cannot communicate — points to VLAN 20 being pruned from the trunk. The correct fix is to add VLAN 20 to the trunk's allowed VLAN list on SW1's G0/1 interface using 'switchport trunk allowed vlan add 20', which preserves existing allowed VLANs while permitting VLAN 20. This restores 802.1Q tagging for VLAN 20 traffic across the trunk to R1.

Exam trap

200-301 often tests the misconception that configuring a native VLAN or changing port mode will fix VLAN reachability — candidates overlook that the allowed VLAN list on a trunk is exclusive once explicitly set and must be amended with the 'add' keyword.

Why the other options are wrong

Access mode carries only a single VLAN, so it would stop inter-VLAN routing entirely.

The native VLAN is for untagged frames; changing it does not add VLAN 20 to the allowed list.

The 'except' keyword excludes the specified VLAN, so it would prevent VLAN 20 from being carried.

143

PBQmedium

You are connected to SW1 via the console. SW1 is a Layer 2 switch with two VLANs: VLAN 10 (Sales) and VLAN 20 (Engineering). A router R1 is connected to port G0/1 on SW1 for inter-VLAN routing. Currently, the router is not routing between VLANs because the trunk is not configured correctly. Configure the switch port as a trunk and ensure the router can route between VLANs using subinterfaces (Router-on-a-Stick).

Network Topology

Hints

•The router expects a trunk link to carry multiple VLANs.
•Allowed VLAN list must include only the VLANs that need routing.
•The switch port must be in trunk mode, not access.

A.Configure the switch port as a trunk with 802.1Q encapsulation and allow VLANs 10 and 20.

B.Configure the switch port as an access port in VLAN 10 and add VLAN 20 as a secondary VLAN.

C.Configure the switch port as a trunk with ISL encapsulation and allow all VLANs.

D.Configure the switch port as a trunk with 802.1Q encapsulation and allow VLANs 1, 10, and 20.

AnswerA

solution

! SW1
interface GigabitEthernet0/1
switchport trunk encapsulation dot1q
switchport mode trunk
switchport trunk allowed vlan 10,20

Why this answer

The switch port was in access mode, which only carries one VLAN. Changing it to trunk with 802.1Q encapsulation allows multiple VLANs to traverse to the router. The allowed VLAN list restricts to VLANs 10 and 20 for security.

Exam trap

The trap is that candidates may confuse trunking with access ports, use outdated encapsulation (ISL), or include unnecessary VLANs like VLAN 1. Always remember that for Router-on-a-Stick, the switch port must be a trunk with 802.1Q and only allow the required VLANs.

Why the other options are wrong

Access ports cannot carry multiple VLANs; they are assigned to a single VLAN. The concept of secondary VLAN does not exist for access ports.

ISL encapsulation is deprecated in favor of 802.1Q, which is the industry standard. Allowing all VLANs violates the principle of least privilege.

Including VLAN 1 is unnecessary and can be a security concern. The allowed VLAN list should be restricted to only the VLANs that need to be routed.

144

Multi-Selectmedium

A network administrator is configuring a new switch and needs to set up VLANs. The administrator wants to ensure that VLAN 10 is used for voice traffic and VLAN 20 for data traffic on a port connected to an IP phone and a PC. Which two commands are required on the interface to achieve this configuration? (Choose two.)

Select 2 answers

A.switchport mode access

B.switchport voice vlan 10

C.switchport mode trunk

D.switchport trunk encapsulation dot1q

E.switchport access vlan 20

AnswersB, E

This command configures VLAN 10 as the voice VLAN. The IP phone will tag its voice traffic with VLAN 10, while data traffic from the PC remains untagged and is assigned to the access VLAN. This enables proper QoS and segmentation for voice.

Why this answer

To support both voice and data on a single port, the interface must be in access mode with a voice VLAN. The 'switchport access vlan 20' command assigns the data VLAN, and 'switchport voice vlan 10' assigns the voice VLAN. The phone tags voice traffic, while data traffic remains untagged.

Exam trap

The trap here is assuming that a trunk is needed for voice and data; however, Cisco's voice VLAN feature allows an access port to carry both by tagging voice traffic.

Practice this question →

145

MCQhard

The SVI for VLAN 20 has `ip nat outside` and the WAN interface has `ip nat inside`. Hosts in VLAN 20 must reach the internet through PAT, but users report no external connectivity. Which configuration issue best explains the problem?

A.The ACL should deny 192.168.20.0/24 instead of permit it

B.The interfaces are marked with inside and outside in the wrong places

C.PAT cannot be used with a /30 WAN link

D.NAT overload requires a route-map instead of an ACL

AnswerB

When PAT is configured, Cisco IOS identifies traffic to translate based on the inside and outside interface roles. If those labels are swapped, traffic arriving from the campus LAN appears on the 'outside' interface, so it is not considered an 'inside local' source and the translation rule does not trigger. As a result, packets are forwarded without translation and hosts on VLAN 20 cannot reach the internet through PAT. The fix is to mark the LAN-facing interface as 'inside' and the WAN-facing interface as 'outside' so the NAT process operates in the correct direction.

Why this answer

NAT overload works only when the inside and outside interfaces are identified correctly. Here the roles are reversed, so translations are not built in the right direction.

Exam trap

A frequent exam trap is assuming that the ACL or the subnet mask is the cause of NAT failure when the real issue is reversed inside and outside interface roles. Candidates often overlook the importance of interface designation commands (ip nat inside and ip nat outside), which are crucial for NAT operation. Without correct interface roles, the router cannot translate addresses properly, causing hosts to lose external connectivity even if ACLs and routing are correct.

This trap is tempting because ACLs and subnetting are more familiar concepts, but interface roles are equally critical for NAT to function.

Why the other options are wrong

Option A is incorrect because the ACL used for NAT must permit the inside local subnet (192.168.20.0/24) to allow translation. Denying this subnet would block NAT translation, but the question states the ACL permits it, so this is not the cause.

Option C is incorrect because a /30 WAN link is commonly used in point-to-point connections and does not prevent PAT from functioning. PAT works independently of the WAN subnet size.

Option D is incorrect because NAT overload can be configured using a standard ACL; a route-map is optional and not required. The absence of a route-map does not cause the connectivity issue described.

Practice this question →

146

MCQmedium

A network administrator is configuring a switch port that connects to a Cisco IP phone, which in turn has a desktop PC attached to its PC port. The administrator wants the phone to be placed in VLAN 100 and the PC in VLAN 200 on the same physical switch port. Which configuration should be applied to the switch port?

A.Configure the port as a trunk port and allow VLAN 100 and VLAN 200 on the trunk.

B.Configure the port as an access port in VLAN 100 and enable the voice VLAN 100 on the port.

C.Configure the port as a dynamic auto port and enable VLAN 100 and VLAN 200 with the switchport trunk allowed vlan command.

D.Configure the port as an access port in VLAN 200 and configure the voice VLAN as 100 using the switchport voice vlan 100 command.

AnswerD

This is the correct configuration for a Cisco IP phone with a PC attached. The access VLAN (200) carries untagged data traffic from the PC, while the voice VLAN (100) carries tagged voice traffic from the phone. The switchport voice vlan command enables the phone to receive its VLAN information via CDP or LLDP-MED and tag voice frames appropriately.

Why this answer

The correct approach uses an access port for the PC data VLAN and the switchport voice vlan command for the phone voice VLAN. This allows the phone to tag voice traffic with VLAN 100 while the PC sends untagged traffic in VLAN 200. The phone learns the voice VLAN through CDP or LLDP-MED and can also pass through the PC data.

Exam trap

The trap here is assuming that a trunk port is required to support both a voice and data VLAN on a single switch port.

Practice this question →

147

MCQhard

After hardening SSH by disabling password authentication and restricting access to an ACL permitting only the management subnet 10.1.10.0/24, configuring RADIUS AAA authentication, enabling port security with a maximum of two MAC addresses on all access ports, and implementing DHCP snooping and DAI on VLAN 10, the administrator finds that users in VLAN 10 obtain DHCP addresses and access the network normally, but SSH from the management workstation (10.1.10.20) to the switch fails with timeouts.

A.The SSH ACL is misconfigured and denies port 22 from the management subnet.

B.The management workstation’s IP-to-MAC binding is missing from the DHCP snooping binding table, causing DAI to drop its ARP traffic.

C.Port security on the switch interface connected to the management workstation has learned two MAC addresses and shut down the port.

D.RADIUS AAA authentication is missing the shared secret on the switch, causing SSH login timeouts.

AnswerB

Dynamic ARP Inspection (DAI) validates ARP packets against the DHCP snooping binding table, which contains IP-to-MAC mappings learned from DHCP. Because the management workstation uses a static IP address, no DHCP binding is ever recorded, so the switch has no entry for that IP. As a result, DAI classifies the workstation's ARP replies as invalid and drops them, preventing L2 reachability. This matches the symptom precisely: only the statically configured host fails, while DHCP-assigned management hosts continue to work normally.

Why this answer

The management workstation (10.1.10.20) is on the same VLAN 10 where DHCP snooping and DAI are enabled. DAI validates ARP packets against the DHCP snooping binding table. Since the workstation uses a static IP address, its IP-to-MAC binding is not automatically added to the DHCP snooping database.

DAI will drop the workstation's ARP replies, preventing the switch from learning its MAC address and causing SSH timeouts.

Exam trap

Cisco often tests the interaction between security features like DAI and static IP hosts, where candidates overlook that DAI requires explicit static bindings for non-DHCP clients, leading to connectivity failures that appear as timeouts rather than explicit denials.

Why the other options are wrong

Misunderstanding ACL processing—assumes a simple subnet permit ACL would block port 22 by default, but the ACL entry permits all traffic from the subnet, not just specific ports.

Assumes port security is the first cause of connectivity failure when MAC limits are configured, but the symptom does not indicate a port security violation; the port would need to go into err-disabled, which is not mentioned.

AAA failures manifest as authentication errors or prompts that time out after attempting RADIUS, but they typically affect all attempts, not a single source, unless combined with ACLs that permit other hosts but block this one.

Practice this question →

148

PBQhard

You are connected to a multilayer switch MLS1. The network has two other switches: SW2 and SW3. The interface GigabitEthernet0/1 already has PortFast and BPDU Guard enabled. Configure MLS1 as the root bridge for VLAN 10 and VLAN 20 using the root primary command. After configuration, verify that the interface is not in err-disabled state and that the root bridge role is correctly assigned.

Network Topology

Hints

•Use spanning-tree vlan root primary to set the switch as root for specified VLANs.
•Verify with show spanning-tree vlan <vlan> to confirm root bridge priority is 24576.
•Check interface status with show interfaces gigabitethernet 0/1 status to ensure it is not err-disabled.

A.Configure 'spanning-tree vlan 10 root primary' and 'spanning-tree vlan 20 root primary' on MLS1. Verify with 'show spanning-tree vlan 10' and 'show interfaces gigabitEthernet0/1 status'.

B.Configure 'spanning-tree vlan 10 root primary' and 'spanning-tree vlan 20 root secondary' on MLS1. Verify with 'show spanning-tree vlan 10' and 'show interfaces gigabitEthernet0/1 status'.

C.Configure 'spanning-tree vlan 10 priority 4096' and 'spanning-tree vlan 20 priority 4096' on MLS1. Verify with 'show spanning-tree vlan 10' and 'show interfaces gigabitEthernet0/1 status'.

D.Configure 'spanning-tree vlan 10 root primary' and 'spanning-tree vlan 20 root primary' on MLS1. Then configure 'spanning-tree portfast default' and 'spanning-tree bpduguard default' globally. Verify with 'show spanning-tree vlan 10' and 'show interfaces gigabitEthernet0/1 status'.

AnswerA

solution

! MLS1
spanning-tree vlan 10 root primary
spanning-tree vlan 20 root primary

Why this answer

The interface Gi0/1 already has PortFast and BPDU Guard configured, so no additional configuration is needed for that step. Using 'spanning-tree vlan 10 root primary' and 'spanning-tree vlan 20 root primary' sets the priority to 24576, ensuring MLS1 becomes root for both VLANs. Verify with 'show spanning-tree vlan 10' to see the priority changed and 'show interfaces gigabitEthernet0/1 status' to confirm the port is not err-disabled.

Exam trap

Do not confuse 'root primary' with 'root secondary' or manual priority settings. The 'root primary' command automatically sets the priority to 24576, which is the recommended value. Also, avoid adding unnecessary global commands when the interface already has the required features configured.

Why the other options are wrong

Using 'root secondary' for VLAN 20 sets priority to 28672, leaving MLS1 as backup root, not the primary root.

Manually setting priority to 4096 is valid but not the recommended method; 'root primary' is simpler and ensures proper value.

Global portfast and bpduguard are not required because the interface is already configured with those features; this adds unnecessary commands.

Practice this question →

149

Multi-Selectmedium

A network technician is configuring a new Cisco switch and needs to secure unused switch ports to prevent unauthorized access. The technician decides to disable the ports and place them in an unused VLAN. Which two commands are required to accomplish this on each unused interface? (Choose two.)

Select 2 answers

A.shutdown

B.switchport mode access

C.switchport access vlan 999

D.switchport trunk allowed vlan none

E.no switchport

AnswersA, C

The 'shutdown' command administratively disables the interface, preventing any traffic from being sent or received. This is a critical step to secure unused ports. When a port is shut down, it cannot be used for unauthorized access. This command is entered in interface configuration mode. It is one of the two required commands to disable the ports as specified in the scenario.

Why this answer

To secure unused ports, you should administratively disable them with the 'shutdown' command and assign them to an unused VLAN using 'switchport access vlan 999'. This prevents unauthorized devices from connecting and isolates any potential traffic. Setting the port to access mode is also good practice but not one of the two required commands in this scenario.

Exam trap

The trap here is thinking that setting the port to access mode or using trunk commands is sufficient to secure unused ports, when the key actions are disabling the port and placing it in an unused VLAN.

Practice this question →

150

MCQhard

A network engineer is troubleshooting connectivity issues for hosts in VLAN 10. Hosts in VLAN 10 are unable to ping the default gateway at 192.168.10.1. The engineer checks the switch configuration and notices that the SVI for VLAN 10 is configured with an IP address, but the interface is in a down/down state. What is the most likely cause of this issue?

A.The interface is administratively shut down.

B.VLAN 10 does not exist in the VLAN database.

C.The IP address is not in the correct subnet for VLAN 10.

D.The switch does not have a default gateway configured.

AnswerB

The SVI for VLAN 10 is down/down because the VLAN is not created. Once VLAN 10 is created with the 'vlan 10' command in global configuration mode, the SVI will come up if there is at least one active port in that VLAN.

Why this answer

An SVI (Switch Virtual Interface) will remain in a down/down state if the corresponding VLAN does not exist in the switch's VLAN database. Even if the SVI is configured with an IP address, the interface cannot come up because there is no Layer 2 VLAN to associate with it. This is a common cause of SVI down/down issues when the VLAN has not been created or has been deleted.

Exam trap

Cisco often tests the distinction between an SVI being down due to a missing VLAN versus an administratively shutdown interface, leading candidates to mistakenly choose the administrative shutdown option when the interface status shows 'down/down' instead of 'administratively down'.

Why the other options are wrong

The running-config shows 'no shutdown', so this is not the cause.

The IP address and subnet mask are correctly configured for the VLAN.

The SVI status is not affected by the presence or absence of a default gateway.

Practice this question →