CCNA VLAN Questions — Page 3 of 4

151

Multi-Selectmedium

Which TWO statements are true regarding VLAN configuration, 802.1Q trunking, and the native VLAN?

Select 2 answers

A.On an 802.1Q trunk, frames in the native VLAN are always tagged with a VLAN ID.

B.The native VLAN should be changed from the default VLAN 1 to an unused VLAN for security reasons.

C.802.1Q is a Cisco proprietary trunking protocol.

D.802.1Q supports up to 4094 VLANs (VLAN IDs 1–4094).

E.The native VLAN must be the same on both ends of an 802.1Q trunk for the trunk to operate.

AnswersB, D

Changing the native VLAN from the default VLAN 1 to an unused VLAN is a Cisco-recommended hardening step because VLAN 1 is well-documented and often carries control-plane traffic such as CDP, VTP, and PAgP. Attackers can exploit the default native VLAN to launch double-tagging (VLAN hopping) attacks, so moving native VLAN to a dedicated unused VLAN reduces the risk of layer 2 traffic being intercepted or misforwarded. Additionally, using an unused VLAN ensures that no legitimate user traffic is accidentally sent untagged on the trunk, which prevents VLAN misclassification.

Why this answer

Changing the native VLAN from the default VLAN 1 to an unused VLAN is a recommended security best practice to prevent VLAN hopping attacks. Option D is correct because 802.1Q uses a 12-bit VLAN ID field, allowing VLAN IDs from 1 to 4094 (0 and 4095 are reserved). Option A is false: on an 802.1Q trunk, frames in the native VLAN are typically sent untagged.

Option C is false: 802.1Q is an IEEE standard, not Cisco proprietary (ISL is Cisco proprietary). Option E is false: the native VLAN does not have to match on both ends; mismatched native VLANs can cause traffic to be misclassified but the trunk will still operate.

Exam trap

Cisco often tests the misconception that 802.1Q is proprietary (it is not) and that native VLAN frames are always tagged (they are untagged by default), leading candidates to incorrectly select options A or C.

Why the other options are wrong

The native VLAN is specifically the VLAN that does not get a tag; all other VLANs are tagged.

802.1Q is an open standard, whereas ISL was Cisco proprietary.

Mismatched native VLANs can lead to security vulnerabilities and misrouting, but the trunk itself may still come up.

Practice this question →

152

MCQhard

A network engineer is configuring a switch port for a new wireless access point that will support multiple SSIDs mapped to different VLANs. The AP will be powered by PoE and will tag traffic for each SSID. Which configuration on the switch port is most appropriate?

A.Configure the port as a trunk port and set the native VLAN to VLAN 1, allowing all VLANs.

B.Configure the port as a trunk port, set the native VLAN to the AP management VLAN, and allow the SSID VLANs on the trunk.

C.Configure the port as an access port in the management VLAN and use 802.1X authentication for the SSIDs.

D.Configure the port as an access port in the management VLAN and enable voice VLAN for the SSIDs.

AnswerB

This is the correct configuration for an AP supporting multiple SSIDs. The AP management traffic is typically untagged and placed in the native VLAN, while each SSID's traffic is tagged with its respective VLAN. The trunk allows multiple VLANs to traverse the link. This setup enables the AP to map each SSID to a different VLAN and tag frames accordingly.

Why this answer

For an access point supporting multiple SSIDs, the switch port should be configured as a trunk. The native VLAN is used for untagged management traffic from the AP, while each SSID's traffic is tagged with its corresponding VLAN. Allowing only the necessary VLANs on the trunk is a best practice.

This configuration ensures proper segmentation and security.

Exam trap

The trap here is assuming an access port with voice VLAN can handle multiple SSIDs, or that allowing all VLANs is acceptable.

Practice this question →

153

MCQhard

After enabling Dynamic ARP Inspection on VLAN 20, a network engineer notices that some hosts lose connectivity. The affected hosts have correct IP addresses and MAC addresses, but they cannot ping the default gateway. All other hosts on the same VLAN work fine. Further investigation reveals that the non-functioning hosts are using static IP configurations, while the working hosts are DHCP clients. What is the most likely cause?

A.The DHCP snooping binding table is exhausted and cannot accept new bindings for the static hosts.

B.IP Source Guard is also enabled on VLAN 20 and is blocking traffic from hosts that have no DHCP snooping binding.

C.DAI is dropping ARP packets from the static hosts because they do not have a corresponding entry in the DHCP snooping binding table.

D.The switch is detecting ARP spoofing from the static hosts and has shut down their switchport interfaces for security.

AnswerC

When DAI is enabled, it checks every ARP packet on untrusted ports against the DHCP snooping binding table. Since the static hosts have no DHCP lease, no binding exists, and DAI drops their ARP packets, preventing them from learning the gateway MAC address and causing loss of connectivity.

Why this answer

Dynamic ARP Inspection (DAI) relies on the DHCP snooping binding table to validate ARP packets. When a host uses a static IP address, it does not have an entry in that table, so DAI treats its ARP packets as invalid and drops them. This prevents the static host from resolving the default gateway's MAC address, breaking connectivity even though the IP and MAC are correct.

Exam trap

Cisco often tests the dependency of DAI on DHCP snooping, and the trap here is that candidates assume DAI validates based on the actual IP/MAC correctness rather than requiring a binding table entry.

Why the other options are wrong

Candidates may think that a large number of untrusted hosts could overwhelm the binding table, but static hosts do not interact with DHCP and would not fill the table or be rejected.

Candidates often confuse DAI and IP Source Guard since both use DHCP snooping; however, DAI specifically validates ARP packets, which matches the symptom of connectivity loss due to ARP resolution failure.

Some candidates might associate ARP security features with port shutdown, but standard DAI operation does not disable ports, and the symptom does not indicate interface down events.

Practice this question →

154

MCQhard

An administrator notices that hosts in VLAN 30 on SW1 cannot communicate with hosts in VLAN 30 on SW2, even though both switches are connected via an 802.1Q trunk. Traffic for VLANs 10 and 20 passes without issues across the same trunk. The trunk is configured to allow all VLANs, and the allowed VLAN list explicitly includes VLAN 30. What is the most likely cause of the problem?

A.The native VLAN is mismatched between SW1 and SW2, and VLAN 30 is the native VLAN on one side.

B.The trunk encapsulation is set to ISL on one switch and 802.1Q on the other.

C.Spanning Tree Protocol has placed VLAN 30 in a blocking state on the trunk link.

D.The switched virtual interface (SVI) for VLAN 30 on SW1 is administratively down.

AnswerA

A native VLAN mismatch causes one switch to send untagged frames for VLAN 30 while the other expects tagged frames, so the receiving switch cannot associate the untagged traffic with VLAN 30, leading to a communication failure only for that VLAN.

Why this answer

The most likely cause is a native VLAN mismatch. When the native VLAN is mismatched on an 802.1Q trunk, traffic for the native VLAN is not tagged, so frames from VLAN 30 on one switch are received as untagged frames on the other switch and placed into the switch's configured native VLAN. If the native VLAN on one side is VLAN 30 and on the other side is a different VLAN (e.g., VLAN 1), the hosts in VLAN 30 cannot communicate because the frames are interpreted as belonging to different VLANs.

Traffic for VLANs 10 and 20 passes because they are not the native VLAN and are properly tagged.

Exam trap

Cisco often tests the native VLAN mismatch scenario by describing a trunk that works for most VLANs but fails for one specific VLAN, leading candidates to incorrectly suspect STP blocking or SVI issues instead of recognizing the native VLAN mismatch.

Why the other options are wrong

This would cause a complete trunk failure, not a failure limited to a single VLAN.

STP would not randomly block one VLAN on a point-to-point trunk while the rest are forwarding; this is not a typical behavior.

Layer 2 switching within the same VLAN does not require an SVI; an SVI is only needed for routing between VLANs or management.

Practice this question →

155

MCQhard

Exhibit: A switch interface connected to an IP phone and PC is configured as an access port in VLAN 10. The PC works, but the phone does not register. What additional configuration is most likely needed?

A.switchport trunk encapsulation dot1q

B.switchport voice vlan <voice-vlan-id>

C.channel-group 1 mode active

D.ip helper-address on the switchport

AnswerB

This command configures a dedicated voice VLAN on an access port connected to an IP phone. It allows the phone to tag voice traffic with the specified VLAN ID while the attached PC remains untagged in the access VLAN, enabling separate QoS policies and subnets for voice and data. This is the standard Cisco configuration for a single switchport carrying both phone and PC traffic.

Why this answer

An IP phone commonly requires a voice VLAN so tagged voice traffic is separated from the data VLAN used by the attached PC. Without a voice VLAN, the PC can still work on the access VLAN while the phone fails to register properly.

Exam trap

Don't confuse portfast or trunk mode with the need for a voice VLAN. Focus on the specific requirements of IP phones.

Why the other options are wrong

This option is incorrect because the question specifies an access port configuration, which does not require trunk encapsulation. Access ports do not use trunking protocols like dot1q, as they are meant for single VLAN traffic only.

This option is wrong because the channel-group command is used for configuring EtherChannel, which is not relevant to the issue of the IP phone not registering on an access port. The problem lies in the VLAN configuration for voice traffic, not in link aggregation.

The 'ip helper-address' command is used to forward DHCP requests from clients to a DHCP server, but it does not address the registration issue of the IP phone in this scenario, which is related to VLAN configuration.

Practice this question →

156

MCQmedium

Hosts in VLAN 10 need to communicate with hosts in VLAN 20. What is required for that communication to work?

A.A DHCP server

B.A DNS server

C.A Layer 3 routing function

D.A second access switch

AnswerC

Layer 3 routing is the required mechanism because VLANs represent separate broadcast domains and distinct IP subnets. A router or multilayer switch must inspect the destination IP address, perform a route lookup, and rewrite the frame's MAC addresses before forwarding the packet to the destination VLAN. Without this IP-level forwarding decision, frames remain confined to their originating Layer 2 domain, so no traffic can cross the VLAN boundary.

Why this answer

Traffic between VLANs must be routed. A router or multilayer switch provides the Layer 3 function needed for inter-VLAN communication.

Exam trap

Do not confuse trunk links or access ports with routing functions; they serve different purposes in VLAN configurations.

Why the other options are wrong

A DHCP server is not required for communication between VLANs; it only assigns IP addresses to devices within a network. VLAN communication requires routing, which a DHCP server does not provide.

A DNS server is not required for VLAN communication, as DNS resolves domain names to IP addresses, which does not facilitate inter-VLAN routing. Communication between VLANs requires Layer 3 routing, not name resolution.

A second access switch is not required for VLAN communication; VLANs can communicate through a Layer 3 device such as a router or a Layer 3 switch. The existing switch infrastructure can handle VLANs without needing additional switches.

Practice this question →

157

MCQhard

A multilayer switch must route traffic between VLAN 10 and VLAN 20. Which condition is required for that to happen?

A.SVIs for the VLANs plus Layer 3 routing enabled on the switch

B.All ports in both VLANs configured as trunks

C.A separate OSPF process on every access port

D.Port security disabled on every edge port

AnswerA

On a multilayer switch, inter-VLAN routing is accomplished by creating a Switch Virtual Interface (SVI) for each VLAN and assigning each SVI an IP address in its respective subnet. These SVIs act as the default gateway for hosts in their VLAN, and the switch must have IP routing globally enabled with 'ip routing' so it can forward packets between the SVIs at Layer 3. This is the standard method for inter-VLAN routing on a multilayer switch, as opposed to using an external router or router-on-a-stick.

Why this answer

Inter-VLAN routing on a multilayer switch depends on having functional Layer 3 gateway interfaces for the VLANs and routing enabled on the switch. In plain language, the switch needs a routed brain for each VLAN, usually in the form of SVIs, and it must actually be operating as a Layer 3 device rather than only as a pure Layer 2 switch. Without those conditions, traffic may switch inside a VLAN but cannot be routed between different VLANs.

This is a core CCNA design idea because people often assume creating VLANs alone automatically gives them inter-VLAN communication. In reality, VLANs create separation, and routing is what reconnects them under controlled conditions. A trunk between switches can carry VLAN traffic, but it does not itself perform Layer 3 routing between the VLANs. The correct answer is the requirement that makes the switch act as the gateway between VLANs.

Exam trap

Don't confuse trunking with routing; trunk ports carry VLAN traffic but don't route it.

Why the other options are wrong

This option is wrong because configuring all ports as trunks does not facilitate inter-VLAN routing; SVIs and Layer 3 routing are necessary for that functionality.

This option is wrong because OSPF is a routing protocol used for dynamic routing, and access ports do not participate in routing processes. Routing between VLANs requires SVIs and Layer 3 capabilities, not OSPF on access ports.

Port security being disabled on every edge port is not a requirement for routing traffic between VLANs; it pertains to security configurations rather than routing functionality. VLAN routing can occur regardless of port security settings.

Practice this question →

158

PBQhard

You are connected to R1 via console. The network consists of R1, R2, and a multilayer switch MLS1. R1's GigabitEthernet0/0 connects to MLS1's GigabitEthernet1/0/1 (VLAN 10), and MLS1's GigabitEthernet1/0/2 connects to R2's GigabitEthernet0/0. The goal is to enable IPv6 communication between R1 and R2 across the layer-3 switch. Currently, R1 and R2 cannot ping each other's IPv6 addresses. Configure R1's G0/0 with the IPv6 prefix 2001:db8:1:10::/64 using EUI-64, and R2's G0/0 with static IPv6 address 2001:db8:1:10::2/64. Also ensure MLS1 has IPv6 routing enabled and an IPv6 address on VLAN 10 (2001:db8:1:10::3/64). Troubleshoot and fix any layer-2 or layer-3 issues preventing connectivity.

Network Topology

Hints

•R1's G0/0 has no IPv6 address configured.
•The correct command uses the 'eui-64' keyword to generate the interface ID from the MAC.
•After configuration, R1 should be able to ping the other IPv6 addresses.

A.Configure 'ipv6 address 2001:db8:1:10::/64 eui-64' on R1's G0/0 interface.

B.Enable IPv6 routing on R1 with 'ipv6 unicast-routing'.

C.Configure 'ipv6 address 2001:db8:1:10::1/64' on R1's G0/0 interface (without EUI-64).

D.Change the VLAN on MLS1's G1/0/1 to match R1's VLAN.

AnswerA

solution

! R1
interface GigabitEthernet0/0
ipv6 address 2001:db8:1:10::1/64 eui-64
end

Why this answer

R1 has no IPv6 address configured on G0/0. The required prefix is 2001:db8:1:10::/64 using EUI-64, which generates the interface ID from the MAC address. The command 'ipv6 address 2001:db8:1:10::/64 eui-64' must be entered in interface configuration mode.

Additionally, MLS1 has IPv6 routing enabled (as seen by the connected route), but R1's interface is missing the IPv6 address. After configuration, R1 will be able to ping R2 and MLS1. No other changes are needed because R2 and MLS1 are correctly configured.

Exam trap

Do not confuse global IPv6 routing enablement with interface address configuration. The presence of a connected route indicates routing is enabled; the missing piece is the interface address. Also, pay attention to specific requirements like EUI-64.

Why the other options are wrong

IPv6 unicast-routing is already enabled; the problem is at the interface level.

The requirement specifies EUI-64; omitting it results in a static address that does not match the intended configuration.

The VLAN configuration is correct; no change is needed.

Practice this question →

159

PBQhard

You are connected to switch SW1. The network uses Rapid-PVST+ and SW1 has been accidentally configured with a low spanning-tree priority, causing it to become the root bridge for VLAN 10 even though it should not be. Additionally, an edge port connected to a server is repeatedly receiving BPDUs, causing it to go into err-disabled state. Configure SW1 so that it is never the root bridge for VLAN 10, and configure the edge port so that it automatically recovers from err-disabled state after 300 seconds. Finally, verify that SW1 is not the root bridge for VLAN 10.

Network Topology

Hints

•To prevent a switch from becoming root, set its priority to a value higher than the current root's priority (e.g., 32768).
•The errdisable recovery cause command enables automatic recovery; the interval command sets the timeout.
•After configuration, verify with 'show spanning-tree vlan 10' that the bridge ID priority is not the lowest.

A.spanning-tree vlan 10 priority 36864; errdisable recovery cause bpduguard; errdisable recovery interval 300; show spanning-tree vlan 10

B.spanning-tree vlan 10 priority 4096; errdisable recovery cause bpduguard; errdisable recovery interval 300; show spanning-tree vlan 10

C.spanning-tree vlan 10 root secondary; errdisable recovery cause bpduguard; errdisable recovery interval 300; show spanning-tree vlan 10

D.spanning-tree vlan 10 priority 32768; errdisable recovery cause all; errdisable recovery interval 300; show spanning-tree vlan 10

AnswerA

solution

! SW1
no spanning-tree vlan 10 priority 4096
spanning-tree vlan 10 priority 32768
errdisable recovery cause bpduguard
errdisable recovery interval 300

Why this answer

The issue is that SW1 has the spanning-tree priority for VLAN 10 set to 4096, which makes it the root bridge. To prevent this, you must set the priority higher than the current root bridge's priority (e.g., 32768 or higher). Additionally, the edge port (G0/1) is in err-disabled state because it received a BPDU while PortFast was enabled (BPDU Guard triggered).

To automatically recover from err-disabled, you need to configure errdisable recovery cause bpduguard and set the interval to 300 seconds. After configuration, verify with 'show spanning-tree vlan 10' that SW1 is no longer the root and 'show errdisable recovery' to confirm the recovery settings.

Exam trap

Students often confuse the priority values: lower priority is better to become root. To prevent a switch from becoming root, set its priority higher than the current root's. Also, remember that 'root secondary' sets a low priority (28672) and does not prevent root election.

For errdisable recovery, use the specific cause (bpduguard) rather than 'all'.

Why the other options are wrong

The priority 4096 is too low and would still result in SW1 being the root bridge.

The 'root secondary' command does not prevent the switch from becoming root; it only makes it the backup root.

Using 'cause all' is not the best practice; the requirement is to recover from bpduguard specifically.

Practice this question →

160

MCQhard

Refer to the exhibit. A network administrator runs the show vlan brief command on SW2. Interface GigabitEthernet0/2 is intended to be an access port in VLAN 10, but it does not appear in the output. What is the most likely cause?

A.The interface is configured with switchport mode dynamic auto and no trunk has been negotiated, causing it to be hidden.

B.The interface is administratively shut down, and down ports are excluded from the show vlan brief output.

C.The interface is configured as a trunk port and therefore does not appear under any VLAN in show vlan brief.

D.VLAN 10 is not active, so the port assigned to it is not displayed in the listing.

AnswerC

show vlan brief only displays ports that are in access mode. Trunk ports are not included because they belong to all VLANs allowed on the trunk. The output shows VLAN 10 with members Gi0/9–Gi0/11 but not Gi0/2, confirming it is not an access port.

Why this answer

The `show vlan brief` command displays only access ports and their assigned VLANs. Trunk ports, which carry multiple VLANs, are not listed in this output. If GigabitEthernet0/2 is configured as a trunk port (e.g., with `switchport mode trunk` or dynamically via DTP), it will not appear under any VLAN in the `show vlan brief` output, even if it is intended to be an access port in VLAN 10.

Exam trap

Cisco often tests the distinction between access and trunk port behavior in `show vlan brief` output, trapping candidates who assume all switchports appear in the VLAN listing regardless of mode.

Why the other options are wrong

Confusion about how dynamic trunking protocol (DTP) modes interact with VLAN membership display.

Misconception that only operational interfaces are shown in VLAN membership tables.

Overlooking the explicit 'active' status and port list for VLAN 10 in the output.

Practice this question →

161

MCQhard

A network engineer is troubleshooting connectivity between two hosts in different VLANs on the same switch. Host A in VLAN 10 (10.10.10.5/24) cannot ping Host B in VLAN 20 (10.10.20.5/24). The switch is configured as a router-on-a-stick with a trunk port to an external router. The trunk port is up/up, but inter-VLAN routing fails. What is the most likely cause?

A.The trunk port is not in trunking mode; it is in dynamic desirable mode.

B.The native VLAN on the switch trunk is VLAN 1, but the router subinterface for VLAN 1 is not configured with the 'native' keyword or is missing.

C.The VLANs are not allowed on the trunk; the allowed VLAN list is missing VLAN 10 and 20.

D.The switch ports Gi0/4 and Gi0/5 are in access mode but not assigned to the correct VLANs.

AnswerC

When an allowed VLAN list on a trunk is configured and does not include VLAN 10 and VLAN 20, all tagged frames from those VLANs are dropped, causing inter-VLAN routing failure even though the trunk is up/up.

Why this answer

The most likely cause is that the allowed VLAN list on the trunk is missing VLAN 10 and 20. Even though the trunk port is up/up, if the switch's allowed VLAN list has been restricted (for example, using the switchport trunk allowed vlan command) and does not include those VLANs, all frames tagged with VLAN 10 or 20 will be discarded at the trunk. This directly prevents inter-VLAN routing despite the trunk being operational, whereas a native VLAN mismatch only affects untagged traffic and would not impact the tagged frames between the two hosts.

Exam trap

A common trap is assuming an up/up trunk automatically passes traffic for all VLANs, overlooking that the allowed VLAN list can be manually pruned and must include every VLAN that needs to traverse the trunk.

Why the other options are wrong

Dynamic desirable mode can still form a trunk if the other side is willing; the trunk is already up/up, so the port mode is not the issue.

A native VLAN mismatch or missing native subinterface only affects untagged frames; the hosts in VLAN 10 and VLAN 20 send tagged traffic, so this would not break their routing.

The hosts' access port configurations would prevent intra-VLAN communication if misassigned, but the question describes an inter-VLAN routing failure through the trunk, not a problem with the access ports themselves.

Practice this question →

162

MCQhard

A DHCP client on VLAN 30 is not receiving an IP address from a DHCP server (10.99.99.20) on another subnet. The SVI for VLAN 30 is configured with an IP address and is up, but the DHCP relay command is missing. Which command should be added to the SVI configuration?

A.ip directed-broadcast

B.ip helper-address 10.99.99.20

C.service dhcp-server 10.99.99.20

D.default-router 10.99.99.20

AnswerB

On the VLAN 30 SVI, the DHCP client's broadcast is not forwarded by default because routers do not forward link-local broadcasts. The command `ip helper-address 10.99.99.20` instructs the router to convert that DHCPDISCOVER broadcast into a unicast packet and send it to the DHCP server at 10.99.99.20, while also inserting the SVI's IP address as the giaddr field. This allows the server to know which subnet the client is on and assign an address from the correct pool. Without this command, the client's broadcast remains confined to VLAN 30 and the server never receives the request.

Why this answer

DHCP Discover messages are broadcasts and do not cross routers by default. On an SVI or routed interface facing the clients, an ip helper-address relays those broadcasts to the DHCP server on another subnet.

Exam trap

A frequent exam trap is selecting ip directed-broadcast or default-router as the solution for DHCP relay issues. ip directed-broadcast only enables forwarding of directed broadcasts but does not relay DHCP requests to servers on other subnets. default-router is a DHCP pool parameter that assigns a gateway to clients but does not affect how DHCP broadcasts are forwarded. Another trap is assuming service dhcp-server is an interface command for relay, which it is not. These distractors test your understanding of DHCP relay mechanisms and Cisco IOS command usage.

Why the other options are wrong

The ip directed-broadcast command enables forwarding of directed broadcasts but does not relay DHCP requests. It is unrelated to DHCP relay and will not solve the problem of clients not receiving addresses from a remote DHCP server.

service dhcp-server is not a valid Cisco IOS interface command for DHCP relay. It does not configure the router to forward DHCP broadcasts and thus will not resolve the issue.

default-router is a DHCP pool parameter used to assign the default gateway IP address to clients. It does not configure the interface to relay DHCP broadcasts and is not relevant to the relay configuration.

Practice this question →

163

MCQmedium

On an 802.1Q trunk, which VLAN is sent untagged by default on many Cisco switches unless changed?

A.VLAN 10

B.VLAN 20

C.VLAN 1

D.The highest configured VLAN

AnswerC

By default, Cisco switches configure VLAN 1 as the native VLAN on an 802.1Q trunk. Frames in the native VLAN are transmitted without a VLAN tag, while all other VLANs carry a 802.1Q tag. This default behavior ensures that control-plane traffic like CDP, VTP, and DTP, which typically run on VLAN 1, can traverse the trunk without tagging.

Why this answer

On many Cisco platforms, VLAN 1 is the default native VLAN. Native VLAN traffic is sent untagged unless the native VLAN is changed.

Exam trap

Be cautious not to confuse commonly used VLANs in practice with the default native VLAN set by Cisco.

Why the other options are wrong

VLAN 10 is not the default untagged VLAN on Cisco switches; instead, VLAN 1 is typically used for this purpose unless configured otherwise. Therefore, selecting VLAN 10 would be incorrect in the context of the question.

VLAN 20 is not the default untagged VLAN on Cisco switches; instead, VLAN 1 is typically sent untagged on 802.1Q trunks unless configured otherwise. Therefore, selecting VLAN 20 does not align with the standard behavior of Cisco switch configurations.

This option is incorrect because the default untagged VLAN on many Cisco switches is VLAN 1, not the highest configured VLAN. The highest configured VLAN can vary based on the network setup and does not have a default status in this context.

Practice this question →

164

MCQhard

A multilayer switch has working SVIs for VLAN 10 and VLAN 20, but traffic between the VLANs fails. Hosts can ping their own gateway interfaces. Which misconfiguration is most strongly suggested if the SVIs themselves are correct?

A.IP routing is not enabled on the multilayer switch.

B.Both VLANs need to use the same IP subnet.

C.All access ports must be converted into trunks.

D.The wireless controller must provide the default gateway.

AnswerA

The correct answer is that IP routing is not enabled globally on the multilayer switch. Even with SVIs for VLAN 10 and 20 created and hosts able to ping their respective gateways, the switch will not forward packets between VLANs unless the `ip routing` global configuration command has been issued. Without this command, the switch functions as a Layer 2 device; it has SVI interfaces but no Layer 3 forwarding table to route traffic from one subnet to another. To fix this, you must enable IP routing and, if needed, configure static routes or a dynamic routing protocol.

Why this answer

IP routing is not enabled. The switch can ping SVIs locally because they are directly connected, but without `ip routing`, it cannot forward packets between VLANs. Option B is wrong because different VLANs require different subnets for routing.

Option C is wrong because access ports do not need to be trunks; SVIs handle routing at Layer 3. Option D is wrong because the wireless controller does not provide the default gateway for wired VLAN routing; the SVI does.

Exam trap

Remember that SVIs alone do not enable inter-VLAN routing; IP routing must be explicitly enabled on the switch.

Why the other options are wrong

Different VLANs must use different IP subnets for routing; using the same subnet would break Layer 3 separation.

Access ports remain as access ports; inter-VLAN routing requires SVIs with routing enabled, not trunk conversion of access ports.

The default gateway for each VLAN is the SVI IP address; a wireless controller is irrelevant to Layer 3 forwarding between wired VLANs.

Practice this question →

165

MCQhard

Two switches are connected by a trunk. VLAN 50 exists on both switches, but traffic still fails across the link. The allowed VLAN list is correct. Which additional item should be checked next?

A.Check for a trunk mismatch such as native VLAN inconsistency or other trunk-parameter problems.

B.Reset OSPF process IDs on both switches.

C.Add ip helper-address under every access interface.

D.Disable the MAC address table.

AnswerA

A trunk with VLAN 50 allowed on both ends is only a prerequisite for Layer 2 connectivity; native VLAN mismatch or an inconsistent allowed VLAN list can still cause VLAN 50 frames to be tagged with the wrong VLAN ID or dropped entirely. Verifying trunk encapsulation (802.1Q), trunk mode (desirable/trunk), and especially native VLAN consistency is the correct next step because these parameters govern whether frames in VLAN 50 are correctly forwarded across the link.

Why this answer

After confirming that the VLAN exists on both switches and is allowed on the trunk, another important item to verify is whether the trunk itself is actually operational with the expected encapsulation and whether there is a native VLAN or other trunk inconsistency. In plain language, just because the VLAN is listed does not guarantee the trunk is healthy in every relevant way. Trunking problems can still occur because of broader configuration mismatches.

This question is about disciplined troubleshooting. Once the obvious allowed-list issue is ruled out, the next step is to keep checking other trunk-related characteristics rather than jumping immediately to unrelated routing or service features. The correct answer is the one that stays grounded in trunk-specific verification.

Exam trap

Don't jump to unrelated issues like spanning tree or IP configuration when the problem is clearly trunk-related.

Why the other options are wrong

Resetting OSPF process IDs does not address VLAN traffic issues over a trunk link, as OSPF is a routing protocol and unrelated to Layer 2 VLAN configurations.

Adding an ip helper-address is irrelevant to VLAN traffic issues across a trunk link, as this command is used for forwarding DHCP requests, not for resolving VLAN connectivity problems.

Disabling the MAC address table would not resolve VLAN traffic issues across a trunk link, as it pertains to Layer 2 forwarding and would disrupt normal switch operations, leading to further connectivity problems.

Practice this question →

166

MCQhard

A network administrator is troubleshooting an issue where hosts on VLAN 10 cannot ping the default gateway at 192.168.10.1. The router (R1) has an SVI for VLAN 10 with IP 192.168.10.1/24. The administrator captures traffic on the router's G0/0/0 interface (trunk to the switch) and reviews the embedded packet capture output. What is the root cause of the problem?

A.The router's SVI for VLAN 10 is administratively down.

B.The switch port connecting the host is configured in the wrong VLAN (e.g., VLAN 20 instead of VLAN 10).

C.An inbound ACL on the router's SVI is blocking ICMP echo requests from the host.

D.The router has ICMP redirects enabled, causing it to ignore the pings.

AnswerB

The router is sending ARP requests, but the host never receives them because the switch port is in a different VLAN. This prevents the router from learning the host's MAC address, causing the ping to fail.

Why this answer

The captured traffic on the trunk shows that the router is not receiving any frames tagged with VLAN 10 from the host. If the switch port connecting the host is configured in VLAN 20 instead of VLAN 10, the host's frames will be tagged with VLAN 20 (or remain untagged in the access VLAN 20) and will not reach the router's SVI for VLAN 10, causing the ping to fail. This is the most direct cause given the symptom that the host cannot ping the default gateway.

Exam trap

Cisco often tests the distinction between Layer 2 and Layer 3 issues, and the trap here is that candidates assume the problem is on the router (e.g., ACL or interface state) when the packet capture reveals that the traffic never reaches the router's SVI due to a VLAN mismatch on the switch access port.

Why the other options are wrong

The SVI is operational, so this cannot be the root cause.

The router receives the ICMP requests, so an inbound ACL would have dropped them before they reached the capture buffer.

ICMP redirects do not prevent the router from responding to pings; they only send redirect messages when appropriate.

Practice this question →

167

PBQhard

You are connected to Multilayer Switch SW1. Configure LACP EtherChannel between SW1 and SW2 using ports GigabitEthernet0/1 and GigabitEthernet0/2. Ensure the channel is formed and active. The current configuration has mismatched VLAN assignments and speed/duplex settings preventing the channel from coming up. Verify the channel state using 'show etherchannel summary'.

Network Topology

Hints

•Check that both physical ports have identical speed and duplex settings.
•Ensure the allowed VLAN list on each member port matches the Port-channel interface.
•Use 'show etherchannel summary' to see if ports are in a suspended (D) or bundled (P) state.

A.Configure both Gi0/1 and Gi0/2 with speed 1000, duplex full, and switchport trunk allowed vlan 10,20,30.

B.Configure both Gi0/1 and Gi0/2 with speed 100, duplex half, and switchport trunk allowed vlan 30.

C.Configure both Gi0/1 and Gi0/2 with speed 1000, duplex full, and switchport trunk allowed vlan 10,20.

D.Configure both Gi0/1 and Gi0/2 with speed 1000, duplex full, and switchport mode access.

AnswerA

solution

! SW1
interface GigabitEthernet0/1
switchport trunk allowed vlan 10,20,30
exit
interface GigabitEthernet0/2
speed 1000
duplex full
switchport trunk allowed vlan 10,20,30
exit

Why this answer

The EtherChannel is down because the two member ports on SW1 have inconsistent configurations. GigabitEthernet0/1 is set to speed 1000 and duplex full with allowed VLANs 10,20, while GigabitEthernet0/2 is set to speed 100 and duplex half with allowed VLAN 30. LACP requires all member ports to have identical speed, duplex, and VLAN allowed lists.

To fix, on SW1 configure both Gi0/1 and Gi0/2 with the same speed (1000), duplex (full), and trunk allowed VLANs (10,20,30). The Port-channel interface already has the correct allowed VLANs. After correction, 'show etherchannel summary' should show both ports as bundled (P).

Exam trap

The exam trap is that candidates often focus only on speed/duplex mismatches and forget that VLAN allowed lists must also match. Additionally, they may assume that the Port-channel interface inherits settings from member ports, but in fact, the member ports must match the Port-channel configuration.

Why the other options are wrong

The specific factual error is that LACP requires all member ports to have identical configurations, and this option does not align with the existing Port-channel configuration.

The specific factual error is that the VLAN allowed list must match across all member ports and the Port-channel interface; omitting VLAN 30 will cause inconsistency.

The specific factual error is that LACP requires consistent switchport mode (access or trunk) across all member ports and the Port-channel interface.

Practice this question →

168

MCQmedium

A network engineer is configuring a new Cisco Catalyst 9300 switch. The switch currently has all interfaces in VLAN 1, and the engineer needs to segment traffic for the Finance department. The engineer creates VLAN 20 and assigns it the name 'Finance'. Which command sequence is required to place access ports FastEthernet 1/0/1 through 1/0/10 into VLAN 20?

A.Switch(config)# interface range FastEthernet 1/0/1 - 10 Switch(config-if-range)# switchport mode access Switch(config-if-range)# switchport access vlan 20

B.Switch(config)# vlan 20 Switch(config-vlan)# name Finance Switch(config-vlan)# exit Switch(config)# interface range FastEthernet 1/0/1 - 10 Switch(config-if-range)# switchport trunk allowed vlan 20

C.Switch(config)# interface range FastEthernet 1/0/1 - 10 Switch(config-if-range)# switchport mode trunk Switch(config-if-range)# switchport trunk native vlan 20

D.Switch(config)# vlan 20 Switch(config-vlan)# name Finance Switch(config-vlan)# interface FastEthernet 1/0/1 - 10 Switch(config-if-range)# switchport access vlan 20

AnswerA

This sequence correctly enters interface range configuration mode, sets the ports to access mode, and assigns VLAN 20 as the access VLAN. On Cisco switches, access ports must be explicitly set to access mode if they are not already, and the switchport access vlan command assigns the VLAN. Without setting the mode, the ports might remain in dynamic mode, causing issues. This is the standard method to assign multiple ports to a VLAN efficiently.

Why this answer

To assign multiple access ports to a VLAN, you must enter interface range configuration, set the ports to access mode, and then assign the VLAN. The switchport mode access command ensures the ports operate as access ports, and switchport access vlan 20 assigns the VLAN. This is the standard and efficient way to configure multiple ports simultaneously on Cisco switches.

Exam trap

The trap here is confusing trunk commands like 'switchport trunk allowed vlan' with access VLAN assignment, or forgetting to set the port mode to access, leading to dynamic mode behavior.

Practice this question →

169

MCQeasy

A junior administrator at a branch office connects a new Cisco IP phone to switch port FastEthernet0/12. The phone must receive power from the switch, and a PC will later be daisy-chained to the phone's PC port. The switch must also ensure the voice traffic is carried in VLAN 50 while data traffic stays in VLAN 10. Which configuration on the interface accomplishes these requirements?

A.switchport mode access, switchport access vlan 50, switchport voice vlan 10, and power inline auto

B.switchport mode access, switchport access vlan 10, switchport voice vlan 50, and power inline auto

C.switchport mode trunk, switchport trunk native vlan 10, switchport trunk allowed vlan 50, and power inline never

D.switchport mode dynamic auto, switchport access vlan 10, switchport voice vlan 50, and power inline auto

AnswerB

This configuration places the port in access mode for data in VLAN 10, tags voice frames with VLAN 50 using the voice VLAN command, and enables PoE delivery to the phone with power inline auto. The phone receives power and both voice and data traffic are properly segmented, which is the standard Cisco IP telephony deployment on a switch access port.

Why this answer

An access port with a data VLAN and a separate voice VLAN is the standard way to connect a Cisco IP phone that also provides a PC port. Enabling power inline auto supplies PoE so the phone powers up, and the voice VLAN command causes the phone to tag its voice frames into VLAN 50 while the attached PC remains in VLAN 10.

Exam trap

The trap here is assuming a trunk is required to carry both voice and data, when a single access port with the voice vlan command already separates the two traffic types.

Practice this question →

170

MCQmedium

A network administrator needs to configure VLANs and access ports on 200 managed switches across multiple locations. The administrator requires a solution that uses a push‑based deployment model, does not require any agent software to be installed on the switches, and can be executed from a central control node. Which automation tool is most suitable for this task?

A.Puppet

B.Chef

C.Ansible

D.Python scripts

AnswerC

Ansible is the correct answer because it employs a push-based, agentless model over SSH (or WinRM). The control node connects directly to managed hosts, executes modules written in Python, and applies YAML playbooks in real time, with no persistent agent installed on targets. This makes Ansible ideal for immediate orchestration and configuration tasks, especially in dynamic environments where maintaining agents on every node is impractical.

Why this answer

Ansible is the most suitable tool because it uses a push-based model (SSH) to apply configurations directly to network devices without requiring any agent software. It operates from a central control node, making it ideal for managing 200 switches across multiple locations with a single playbook execution.

Exam trap

Cisco often tests the distinction between push-based (Ansible) and pull-based (Puppet, Chef) models, and the trap here is assuming that any scripting language like Python is a complete automation tool rather than a component that requires additional orchestration.

Why the other options are wrong

Requires agents and is pull‑based, failing both the agentless and push requirements.

Agents are mandatory, and the pull mechanism contradicts the push requirement.

Lacks built‑in push‑based orchestration, idempotency, and agentless design without significant custom development, making it less suitable than a purpose‑built tool.

Practice this question →

171

MCQhard

A switch has a root port and an alternate port for the same VLAN. Which statement best explains the operational role of the alternate port?

A.It is a backup path toward the root bridge and normally does not forward while the active root path is healthy.

B.It always forwards traffic at the same time as the root port for load balancing.

C.It is the port that elects the root bridge for the VLAN.

D.It is a special routed port used for inter-VLAN communication.

AnswerA

In Rapid PVST+ or classic STP, an alternate port receives a superior BPDU from another switch on the same segment, providing a redundant path to the root. It remains in discarding/blocking state while the root port is healthy, and only transitions to forwarding if the root port fails, ensuring a loop-free topology while preserving redundancy.

Why this answer

The alternate port acts as a backup path toward the root bridge and stays in a non-forwarding state under normal conditions. In practical terms, STP keeps it ready in case the active path fails, but it does not allow it to forward frames while the primary root path is healthy. That is how STP preserves redundancy without creating loops.

This question is useful because many learners understand root ports and designated ports but do not clearly understand what the alternate role represents.

Exam trap

Don't confuse STP's redundancy roles with load balancing or congestion management. Remember, alternate ports are for backup, not active traffic routing.

Why the other options are wrong

Option B is incorrect because an alternate port does not forward traffic while the root port is active; it serves as a backup path and only becomes active if the root port fails.

This option is wrong because the alternate port does not participate in the election process for the root bridge; it only serves as a backup path to the root bridge once it is established.

Option D is incorrect because an alternate port is not a routed port; it operates at Layer 2 and is part of the Spanning Tree Protocol, which does not involve routing functionalities for inter-VLAN communication.

Practice this question →

172

MCQmedium

A network engineer is configuring a new Cisco switch that will carry traffic for multiple VLANs between two buildings. The link between the two switches must transport frames for VLAN 10, 20, and 30, and both switches must be able to identify which VLAN each frame belongs to. Which configuration should be applied to the inter-switch link on both switches?

A.Configure the ports as trunk ports using 802.1Q encapsulation.

B.Configure the ports as trunk ports using ISL encapsulation.

C.Configure the ports as routed ports with IP addresses in each VLAN subnet.

D.Configure the ports as access ports and assign them to VLAN 10.

AnswerA

A trunk port using 802.1Q encapsulation inserts a VLAN tag into each frame so the receiving switch can identify which VLAN the frame belongs to. This allows a single physical link to carry traffic for VLAN 10, 20, and 30 simultaneously. 802.1Q is the standard trunking encapsulation on Cisco switches and is required for multi-VLAN links between switches.

Why this answer

The inter-switch link must carry frames for multiple VLANs while preserving VLAN identity, which is exactly what an 802.1Q trunk does. Access ports serve only one VLAN, ISL is a legacy nonstandard encapsulation, and routed ports operate at Layer 3 and cannot transport VLAN-tagged frames. Configuring 802.1Q trunking on both ends ensures frames for VLAN 10, 20, and 30 are tagged and correctly identified by the receiving switch.

Exam trap

The trap here is assuming that any trunk encapsulation works, when only the standards-based 802.1Q option is appropriate on modern Cisco switches.

Practice this question →

173

MCQhard

A trunk between two switches is up, but users in VLAN 40 cannot communicate across it. The output shows both sides allow VLAN 40. What is another likely trunk-related cause to check next?

A.Native VLAN mismatch between the two trunk ends

B.Missing router ID in OSPF

C.Incorrect NTP source interface

D.Lack of PAT overload on the WAN router

AnswerA

A native VLAN mismatch on an 802.1Q trunk means each switch expects a different VLAN ID for untagged frames. If VLAN 40 is the native VLAN on one side but not the other, frames sent untagged from one switch are received and categorized into the wrong VLAN or dropped, breaking connectivity for that VLAN. This is a classic trunk misconfiguration to verify after confirming the allowed VLAN list includes VLAN 40 on both ends. Cisco best practice is to set the native VLAN to an unused VLAN or ensure it matches exactly on both trunk peers.

Why this answer

If VLAN 40 is allowed on both ends and the trunk is up, a native VLAN mismatch is still worth checking because trunk problems are not limited to the allowed VLAN list. In plain language, the link may be carrying traffic, but if the two switches disagree on how untagged traffic should be treated, behavior can still become unpredictable. Native VLAN mismatches are a well-known source of warnings and unexpected traffic handling on 802.1Q trunks.

That does not mean every VLAN problem is caused by the native VLAN, but once the obvious allowed-list issue has been ruled out, it becomes a logical next trunk-specific item to verify.

Exam trap

Don't assume that allowed VLANs are the only trunk-related issue; native VLAN mismatches can also disrupt communication.

Why the other options are wrong

This option is wrong because the question specifically addresses VLAN communication issues over a trunk link, which are unrelated to OSPF router ID configuration. OSPF router ID affects routing protocols, not VLAN traffic directly.

NTP source interface is unrelated to VLAN communication issues over a trunk link; it primarily affects time synchronization across devices. Since the question focuses on VLAN connectivity, this option does not address the core problem.

Lack of PAT overload on the WAN router is unrelated to VLAN communication issues between switches. This option pertains to address translation for outbound traffic, not VLAN trunking problems.

Practice this question →

174

MCQhard

Exhibit: Users on SW2 in VLAN 30 can reach local devices but not hosts in VLAN 30 on SW1. What is the most likely reason?

A.The trunk native VLAN is 1 on both sides

B.VLAN 30 is not allowed on the trunk

C.SW2 must run VTP server mode

D.Spanning tree blocks all user VLANs by default

AnswerB

Inter-switch traffic for a VLAN requires that VLAN to be present in the trunk's allowed list on both ends. When VLAN 30 is omitted or 'pruned' from that list, frames are discarded at the trunk port, so SW2's local clients can communicate within their broadcast domain but cannot reach devices beyond the switch. The command 'show interfaces trunk' would reveal that VLAN 30 is not in the allowed VLAN list, confirming the filter is the cause.

Why this answer

The trunk is allowing only VLANs 10 and 20. Even though both switches have VLAN 30 defined locally, VLAN 30 traffic cannot cross the trunk unless that VLAN is allowed on the link. Option A is incorrect because the native VLAN (default 1) does not affect tagged VLAN 30 traffic, and native VLAN mismatch causes different issues.

Option C is incorrect because VTP is used for VLAN database synchronization, not for forwarding traffic over a trunk; switches do not need to be VTP servers to pass VLAN traffic. Option D is incorrect because spanning tree only blocks redundant paths to prevent loops, not all user VLANs by default.

Exam trap

Ensure you verify trunk configurations when VLAN traffic is not passing between switches, even if VLANs are correctly configured locally.

Why the other options are wrong

This option is incorrect because the native VLAN being set to 1 does not prevent VLAN 30 traffic from being transmitted across the trunk link. The issue lies in VLAN 30 not being allowed on the trunk, which is not addressed by the native VLAN setting.

This option is incorrect because VTP server mode is not required for VLANs to communicate across switches; VLAN configuration can be done independently on each switch. The issue in the question is related to trunking and VLAN allowance, not VTP mode.

Spanning Tree Protocol (STP) does not block all user VLANs by default; it only blocks specific ports to prevent loops. In this case, the issue is related to VLAN 30 not being allowed on the trunk, not STP blocking the VLAN.

Practice this question →

175

MCQeasy

A network technician is configuring a new Cisco switch. The technician wants to connect a server that requires 802.1Q trunking to carry multiple VLANs. The server's network interface card supports VLAN tagging and is configured to use VLAN 10, 20, and 30. Which switch port mode should be configured on the switch port connected to the server?

A.Access mode

B.Dynamic auto mode

C.Dynamic desirable mode

D.Trunk mode

AnswerD

Trunk mode allows multiple VLANs to traverse the link by tagging frames with VLAN IDs. The server's NIC supports 802.1Q tagging and needs to communicate on VLANs 10, 20, and 30. Configuring the switch port as a trunk will enable this functionality.

Why this answer

Trunk mode is required to carry multiple VLANs over a single link. The server supports 802.1Q tagging, so configuring the switch port as a trunk allows VLAN 10, 20, and 30 traffic to pass. Access mode is for single VLAN, and dynamic modes rely on DTP, which the server does not support.

Exam trap

The trap here is assuming that dynamic auto or desirable modes will work with a server, but they require DTP, which servers typically do not support.

Practice this question →

176

PBQhard

You are connected to SW1. Configure an LACP EtherChannel between SW1 and SW2 using ports GigabitEthernet0/1 and GigabitEthernet0/2. Set the channel-group mode to active on both sides. The port-channel interface should be configured as a trunk allowing VLANs 10, 20, and 30. Initially, the EtherChannel fails to form due to mismatched speed/duplex on one link. Identify and correct the issue, then verify the channel is up and operational.

Network Topology

Hints

•Check the speed and duplex settings on each member interface.
•LACP requires all ports in the channel to have identical speed and duplex.
•Use 'show interfaces status' to quickly see speed/duplex mismatches.

A.Change speed and duplex on Gi0/2 to 1000 and full, then verify with 'show etherchannel summary'.

B.Change the channel-group mode on Gi0/2 to passive, then verify with 'show etherchannel summary'.

C.Change the allowed VLANs on the port-channel to include only VLAN 1, then verify with 'show etherchannel summary'.

D.Change the port-channel interface to access mode, then verify with 'show etherchannel summary'.

AnswerA

solution

! SW1
interface GigabitEthernet0/2
speed 1000
duplex full

Why this answer

The EtherChannel fails because GigabitEthernet0/2 has speed 100 and duplex half, while GigabitEthernet0/1 has speed 1000 and duplex full. LACP requires all member ports to have identical speed and duplex settings. To resolve, change the speed and duplex on Gi0/2 to match Gi0/1: 'speed 1000' and 'duplex full'.

After correction, the channel will bundle. Verify with 'show etherchannel summary' to see both ports in the 'P' (bundled) state.

Exam trap

Do not confuse Layer 1 issues (speed/duplex) with Layer 2 configuration (VLANs, trunking) or LACP mode settings. Always check physical parameters first when an EtherChannel fails to form.

Why the other options are wrong

The specific factual error is that LACP modes must be compatible (active-active or active-passive), but the question states both sides are active, so mode is not the issue.

The specific factual error is that VLAN settings are irrelevant to the physical bundling of ports in an EtherChannel.

The specific factual error is that interface mode is a Layer 2 property unrelated to the physical bundling process.

Practice this question →

177

MCQhard

A network administrator is deploying a new branch office that will have 500 devices in a single VLAN. The administrator wants to minimize broadcast traffic and improve performance by segmenting the network into smaller broadcast domains while keeping the design simple. Which action best accomplishes this?

A.Increase the MTU on all switch ports to reduce broadcast overhead.

B.Configure private VLANs to isolate all devices from each other.

C.Create multiple VLANs and assign devices to them based on function, then route between the VLANs.

D.Enable storm control on the switch ports to limit broadcast traffic.

AnswerC

Creating multiple VLANs splits the single large broadcast domain into several smaller ones, reducing broadcast traffic and improving performance. Routing between the VLANs allows devices in different VLANs to communicate when needed. This approach is simple, scalable, and directly addresses the goal of minimizing broadcast traffic in a 500-device network.

Why this answer

Segmenting a large flat network into multiple VLANs creates smaller broadcast domains, which directly reduces broadcast traffic and improves performance. Storm control only limits rates without segmenting, MTU changes are irrelevant to broadcast domains, and private VLANs add complexity and restrict communication. Routing between VLANs preserves necessary connectivity, making the VLAN approach the simplest effective solution for the 500-device branch.

Exam trap

The trap here is confusing traffic-rate limiting tools like storm control with actual broadcast domain segmentation.

Practice this question →

178

PBQhard

You are connected to R1. Configure DHCP server on R1 to assign addresses from 192.168.50.0/24 to hosts on VLAN 50, excluding 192.168.50.1-192.168.50.20, with default-router 192.168.50.1 and DNS server 8.8.8.8. On switch SW1, configure DHCP snooping globally and on VLAN 50, and enable trusted ports on the uplink to R1. Then, a host on VLAN 50 reports it received an incorrect IP address; troubleshoot and fix the issue: the wrong helper-address is configured on SW1, the excluded range is too large, and a rogue DHCP server is present on port Fa0/5.

Hints

•Check the DHCP snooping configuration first — is it enabled and on the correct VLAN?
•Look at the helper-address: the DHCP server is on the SVI, not on the point-to-point link.
•The excluded range on R1 is too large; it should only exclude the first 20 addresses.

A.Enable DHCP snooping globally and on VLAN 50, trust the uplink port to R1, correct the excluded range on R1 to 192.168.50.1-192.168.50.20, and change the helper-address on SW1's G0/1 to 192.168.50.1.

B.Enable DHCP snooping globally and on VLAN 50, trust the uplink port to R1, and change the helper-address on SW1's G0/1 to 10.0.0.1.

C.Enable DHCP snooping globally and on VLAN 50, trust the uplink port to R1, and correct the excluded range on R1 to 192.168.50.1-192.168.50.20.

D.Enable DHCP snooping globally and on VLAN 50, trust the uplink port to R1, and change the helper-address on SW1's G0/1 to 192.168.50.1.

AnswerA

solution

! R1
configure terminal
no ip dhcp excluded-address 192.168.50.1 192.168.50.100
ip dhcp excluded-address 192.168.50.1 192.168.50.20
end
write memory

! SW1
configure terminal
ip dhcp snooping
ip dhcp snooping vlan 50
interface GigabitEthernet0/1
ip dhcp snooping trust
no ip helper-address 10.0.0.1
ip helper-address 192.168.50.1
interface FastEthernet0/5
shutdown
end
write memory

Why this answer

The host received a wrong IP because a rogue DHCP server on Fa0/5 was responding. First, enable DHCP snooping globally with 'ip dhcp snooping' and on VLAN 50 with 'ip dhcp snooping vlan 50'. Then, trust the uplink port to R1 (G0/1) with 'ip dhcp snooping trust'.

Next, fix the excluded range on R1: change it to exclude only the first 20 addresses (192.168.50.1-192.168.50.20) so that hosts can obtain other addresses. Finally, correct the helper-address on SW1's G0/1: change 'ip helper-address 10.0.0.1' to 'ip helper-address 192.168.50.1' because the DHCP server is on the VLAN 50 SVI, not on the point-to-point link.

Exam trap

This question tests your ability to troubleshoot a multi-faceted DHCP issue. Common traps include: (1) forgetting that DHCP snooping must be enabled both globally and per VLAN, (2) assuming the helper-address should be the router's link IP instead of the server's SVI IP, (3) overlooking the excluded range configuration, and (4) thinking that only one of the issues needs to be fixed. Always verify all components: snooping, trust, helper-address, and pool configuration.

Why the other options are wrong

The helper-address must be the IP of the DHCP server, which is the SVI address 192.168.50.1, not the link address 10.0.0.1.

The helper-address misconfiguration prevents DHCP requests from being forwarded to the correct server, so fixing only the excluded range is insufficient.

The excluded range must be corrected to allow hosts to receive addresses from the pool; otherwise, the DHCP server will not assign addresses.

Practice this question →

179

MCQhard

A trunk is up between two switches, but traffic for VLAN 40 fails while other VLANs work. Which output item should be checked first?

A.Whether VLAN 40 is included in the allowed VLAN list on the trunk

B.Whether the router ID matches on both switches

C.Whether NetFlow is enabled on the VLAN

D.Whether NTP is synchronized on the switches

AnswerA

A trunk being administratively up indicates the physical and data-link layers are functioning, but Layer 2 connectivity for a particular VLAN depends on the VLAN being present in the trunk's allowed list (via switchport trunk allowed vlan). If VLAN 40 is not included on one or both sides, its frames are silently discarded or not placed on the trunk, even though other VLANs pass normally. This configuration discrepancy is the classic cause of a single-VLAN outage on an otherwise healthy trunk.

Why this answer

The first thing to check is whether VLAN 40 appears in the trunk’s allowed VLAN list. In practical terms, this is a selective failure, not a total trunk failure. Since other VLANs are crossing successfully, the link is operational. That strongly suggests one VLAN is being excluded rather than the trunk being generally broken.

This is one of the most common VLAN troubleshooting patterns in switching.

Exam trap

Avoid assuming a total trunk failure when only one VLAN is affected. Focus on VLAN-specific configurations.

Why the other options are wrong

This option is wrong because the router ID is relevant for routing protocols, not for VLAN traffic issues on a trunk link. The problem specifically pertains to VLAN 40 traffic, which is not influenced by router IDs.

NetFlow is a network protocol used for collecting IP traffic information, but it does not directly affect VLAN traffic flow on a trunk link. Therefore, checking if NetFlow is enabled does not address the issue of VLAN 40 traffic failure.

NTP synchronization is not directly related to VLAN traffic issues on a trunk link; it primarily affects time-sensitive protocols. Therefore, checking NTP synchronization would not help diagnose why VLAN 40 traffic is failing.

Practice this question →

180

MCQhard

Clients in VLAN 30 are not receiving addresses from the DHCP server located in VLAN 99. Which configuration change should be made on the Layer 3 interface for VLAN 30?

A.Add ip dhcp snooping trust under interface Vlan30.

B.Add switchport mode trunk under interface Vlan30.

C.Add ip default-gateway 10.99.99.20 under interface Vlan30.

D.Add ip helper-address 10.99.99.20 under interface Vlan30.

AnswerD

This is correct because the SVI for VLAN 30 is the interface that receives the client DHCP broadcasts. By adding `ip helper-address 10.99.99.20`, the Layer 3 device forwards the request as a unicast packet to the DHCP server in VLAN 99.

Why this answer

The DHCP server is on a different subnet, so the client broadcast messages from VLAN 30 will not naturally cross the Layer 3 boundary. In simple terms, the clients are asking for an address by shouting on their own floor of the building, but the server lives on another floor and cannot hear that broadcast directly. The router or Layer 3 switch must relay the request for them. On Cisco devices, that relay function is usually configured with `ip helper-address` on the interface that receives the client broadcasts.

Here, that receiving interface is Vlan30, because that is the default gateway for the clients in VLAN 30. Pointing `ip helper-address` to 10.99.99.20 tells the Layer 3 device to forward DHCP requests to the remote server. DHCP snooping trust is a separate security feature, trunk mode is unrelated to an SVI, and `ip default-gateway` is not the correct solution for relaying DHCP across subnets.

Exam trap

Remember that DHCP snooping and trunk mode do not facilitate DHCP relay. Focus on the purpose of `ip helper-address` for relaying requests across VLANs.

Why the other options are wrong

This option is wrong because enabling DHCP snooping trust on VLAN 30 does not facilitate communication with the DHCP server in VLAN 99; it only protects against rogue DHCP servers.

Adding 'switchport mode trunk' under interface Vlan30 is incorrect because VLAN 30 is already configured as a Layer 3 interface, and trunking is not applicable to Layer 3 interfaces. This command is used for Layer 2 interfaces to allow multiple VLANs over a single link.

This option is wrong because the command 'ip default-gateway' is used to set a default gateway for a Layer 2 device, not for enabling DHCP relay on a Layer 3 interface. Clients in VLAN 30 need a helper address to reach the DHCP server in VLAN 99.

Practice this question →

181

MCQhard

Refer to the exhibit. A network administrator is troubleshooting connectivity issues for hosts on VLAN 50 on SW1. The hosts on VLAN 50 cannot reach any devices outside SW1, even though the trunk link between SW1 and SW2 is up. The administrator issues the 'show interfaces GigabitEthernet0/1 trunk' command on SW1. Based on the output, what is the most likely cause of the issue?

A.The native VLAN on the trunk is misconfigured, causing VLAN 50 traffic to be dropped.

B.The trunk is operating in access mode instead of trunk mode, preventing VLAN 50 traffic.

C.VLAN 50 is not in the allowed VLAN list on the trunk.

D.Spanning tree protocol has blocked the trunk port for VLAN 50, isolating the hosts.

AnswerC

The exhibit's 'Vlans allowed on trunk' line explicitly lists '1-49,60-4094', which omits VLAN 50. This configured allowed list filters which VLANs can traverse the trunk; any VLAN not listed is blocked, even if it is defined on the switch. The absence of VLAN 50 from the allowed list means its frames are dropped at the trunk interface, isolating hosts in VLAN 50 from other switches. This is the exact administrative misconfiguration causing the problem.

Why this answer

The 'show interfaces GigabitEthernet0/1 trunk' output would list the allowed VLANs on the trunk. If VLAN 50 is not included in the allowed VLAN list, traffic from VLAN 50 will be dropped at the trunk, preventing hosts on SW1 from reaching devices outside SW1. This is the most likely cause because the trunk is up but VLAN 50 traffic is not forwarded.

Exam trap

Cisco often tests the distinction between native VLAN misconfiguration and allowed VLAN list misconfiguration, where candidates mistakenly attribute all trunk issues to native VLAN mismatches rather than checking the allowed VLAN list.

Why the other options are wrong

The assumption that a native VLAN mismatch can drop tagged VLAN traffic is a common misunderstanding.

Misreading the output may lead to believing the trunk is not in trunking mode.

Confusing spanning tree blocking with allowed VLAN filtering; the output shows no block state, only absence of the VLAN.

Practice this question →

182

PBQmedium

You are connected to the console of SW1. The network administrator reports that a workstation connected to interface FastEthernet0/1 cannot communicate with the rest of the network. The workstation is configured for VLAN 10, but the interface is in VLAN 1.

Hints

•Use 'show vlan brief' to see VLAN assignments.
•The interface is currently in VLAN 1.
•Change the access VLAN to 10.

A.Configure the interface as a trunk port.

B.Configure the interface as an access port and assign it to VLAN 10.

C.Configure the interface as a trunk port and allow VLAN 10.

D.Configure the interface as a dynamic desirable port.

AnswerB

solution

! SW1
interface FastEthernet0/1
switchport access vlan 10

Why this answer

The workstation is configured for VLAN 10, but the switch interface is in VLAN 1. To restore connectivity, the interface must be configured as an access port and assigned to VLAN 10, matching the workstation's VLAN. This places the port in the correct broadcast domain so the workstation can communicate with other VLAN 10 devices and its gateway.

Exam trap

200-301 often tests the difference between access and trunk port configuration — candidates pick trunk because they think VLAN 10 must be 'allowed', but an end-device port should be an access port in VLAN 10.

Why the other options are wrong

Trunk ports are used to carry multiple VLANs between switches, not to assign a single workstation to a specific VLAN.

Trunk ports are designed to carry multiple VLANs and are typically used between switches, not for end-user devices.

DTP modes control whether a port becomes a trunk or remains an access port; they do not change the access VLAN.

183

MCQhard

Refer to the exhibit. A network administrator connects an IP phone to interface GigabitEthernet1/0/1 on a Cisco Catalyst switch. The PC connected through the phone works normally on the data VLAN, but the phone cannot obtain an IP address and fails to register with the call server. Which action will resolve the problem?

A.Configure 'switchport trunk allowed vlan 10,20' on interface Gi1/0/1 and change the switchport mode to trunk.

B.Add 'switchport voice vlan 20' on interface GigabitEthernet1/0/1.

C.Issue 'switchport access vlan 20' and 'switchport voice vlan 10' on interface Gi1/0/1.

D.Enable 'switchport port-security mac-address sticky' on the interface and manually add the phone’s MAC address to the access VLAN.

AnswerB

The 'switchport voice vlan 20' command is the correct Cisco IOS configuration for a voice-enabled access port. It leaves VLAN 10 as the default access VLAN for PC data (untagged) while defining VLAN 20 as the voice VLAN for the IP phone. The phone discovers VLAN 20 via CDP or LLDP and tags its voice frames with 802.1Q, keeping voice and data in separate Layer 2 domains and subnets.

Why this answer

The PC works on the data VLAN, but the phone cannot obtain an IP address, indicating the phone is not receiving the correct VLAN assignment. The phone should be placed in the voice VLAN (VLAN 20) using the 'switchport voice vlan 20' command, which allows the switch to tag the phone's traffic with VLAN 20 via CDP/LLDP, enabling it to get an IP from the voice VLAN DHCP server.

Exam trap

Cisco often tests the distinction between 'switchport access vlan' (for data) and 'switchport voice vlan' (for voice), and the trap here is that candidates may confuse which VLAN is assigned to which device, or incorrectly think trunking is required for a phone connection.

Why the other options are wrong

A trunk port does not provide the voice VLAN advertisement mechanism to the phone; the PC would need to send tagged frames, which typical endpoint NICs do not do.

The phone requires access to VLAN 20 for voice services, and the PC must remain in VLAN 10 for data; this configuration does the opposite, failing to meet the requirement.

The phone still cannot learn the voice VLAN; port security does not provide a DHCP address or make the switch advertise VLAN 20 to the phone.

Practice this question →

184

MCQmedium

A PC connected to switch port Gi0/10 should be in VLAN 20 but receives broadcasts only from VLAN 1. Which switchport setting is most likely wrong?

A.switchport mode trunk

B.switchport access vlan 20 missing or incorrect

C.speed 1000

D.duplex full

AnswerB

The access VLAN assignment on a switchport determines which untagged (native) VLAN the port belongs to. If a PC on interface Gi0/10 should be in VLAN 20 but is not, the most direct cause is that the port is either left in the default VLAN (often VLAN 1) or configured with a different access VLAN via the 'switchport access vlan' command. Without this correct mapping, the PC's frames are forwarded in the wrong broadcast domain and cannot reach VLAN 20 resources. This is the primary configuration that controls the behavior described.

Why this answer

The PC is receiving broadcasts only from VLAN 1, which indicates the switchport is not correctly assigned to VLAN 20. The most likely cause is that the 'switchport access vlan 20' command is missing or incorrect, leaving the port in its default VLAN (VLAN 1). This prevents the PC from participating in VLAN 20 and receiving its broadcasts.

Exam trap

Cisco often tests the misconception that a trunk port is needed for VLAN membership, but for a single end device, an access port with the correct VLAN assignment is required.

Why the other options are wrong

The switchport mode trunk setting is incorrect because a trunk port allows multiple VLANs to pass, while the question indicates that the PC should only receive broadcasts from VLAN 20. Therefore, the issue lies with the access VLAN configuration.

The speed setting of 1000 Mbps (1 Gbps) does not influence VLAN membership or broadcast traffic; it only affects the data transfer rate. Therefore, this option does not address the issue of the PC receiving broadcasts only from VLAN 1.

The duplex setting of the switch port does not influence VLAN membership or broadcast traffic. Therefore, a duplex configuration of 'full' does not affect the ability of a PC to receive broadcasts from VLAN 20.

Practice this question →

185

MCQmedium

A switch displays this output: Port Name Status Vlan Fa0/1 connected 10 Fa0/2 connected 10 Fa0/24 connected trunk Which port should be checked first if a user in VLAN 20 cannot reach the distribution switch over the uplink?

A.Fa0/1

B.Fa0/2

C.Fa0/24

D.Any access port in VLAN 1

AnswerC

Fa0/24 is the only port configured as a trunk, which is necessary for carrying traffic from multiple VLANs, including VLAN 20, to the distribution switch over the uplink. When a user in VLAN 20 cannot reach the distribution switch, this trunk port represents the primary path for inter-VLAN communication upstream. Investigating its configuration for allowed VLANs or potential physical layer issues is the logical first step to diagnose the connectivity problem for VLAN 20.

Why this answer

If users in VLAN 20 must cross the uplink, the trunk port is the first place to verify allowed VLANs and tagging.

Exam trap

Don't confuse access ports with trunk ports; only trunk ports can carry multiple VLANs.

Why the other options are wrong

Fa0/1 is connected to VLAN 10, and since the user in VLAN 20 cannot reach the distribution switch, checking this port would not address the issue, as it is not part of the user's VLAN.

Fa0/2 is connected to VLAN 10, which means it cannot facilitate communication for a user in VLAN 20. The issue lies with the trunk port, which is responsible for carrying multiple VLANs, including VLAN 20.

Option D is incorrect because it suggests checking any access port in VLAN 1, which is not relevant to the user's issue in VLAN 20. The problem lies with the trunk port not allowing VLAN 20 traffic, not with access ports in VLAN 1.

Practice this question →

186

MCQhard

A switch trunk is carrying several VLANs, but VLAN 99 traffic is failing. The trunk allowed list includes VLAN 99 on both sides. Which statement best explains why a VLAN can still fail even when it is allowed?

A.Because the VLAN may still be absent, inactive, or otherwise not operational locally even if it is allowed on the trunk

B.Because allowing a VLAN on a trunk automatically disables it

C.Because VLANs can cross trunks only when PAT is enabled

D.Because VLAN 99 must always be the native VLAN

AnswerA

An entry in the trunk's allowed VLAN list only authorizes 802.1Q frames for that VLAN to pass; it does not create or activate the VLAN. If VLAN 99 is absent from the local VLAN database, is administratively shutdown with the 'shutdown vlan' command, or has no active member ports or up SVI, it is not operational locally. Therefore, even though the trunk configuration permits VLAN 99, end-to-end connectivity will fail because the VLAN is not functioning on the switch itself.

Why this answer

A VLAN can still fail across a trunk even when it is allowed because the allowed list is only one part of the overall design. In plain language, a switch may permit the VLAN on the link, but if the VLAN does not actually exist locally, is not active, or if some other trunk characteristic is inconsistent, traffic can still fail. This is an important CCNA troubleshooting principle: one correct line of configuration does not guarantee the full end-to-end condition is correct.

Candidates often stop at the allowed VLAN list because it is visible in common show commands. However, VLAN presence, local status, and other trunk parameters still matter. The best answer is the one recognizing that permission on the trunk does not automatically prove the entire VLAN path is healthy.

Exam trap

A common exam trap is assuming that simply including VLAN 99 in the trunk allowed list guarantees that VLAN 99 traffic will pass. Many candidates stop troubleshooting once they see the VLAN is allowed on the trunk, neglecting to verify if VLAN 99 is actually created and active on each switch. This mistake leads to incorrect conclusions, as the allowed list only controls trunk forwarding permissions, not VLAN existence or operational status.

The exam tests your understanding that VLAN configuration and status are equally critical for successful VLAN traffic flow.

Why the other options are wrong

Incorrect. Allowing a VLAN on a trunk does not disable it; this option contradicts how VLANs and trunks operate in Cisco switches.

Incorrect. Port Address Translation (PAT) is unrelated to VLAN trunking. VLANs do not require PAT to cross trunks.

Incorrect. VLAN 99 does not have to be the native VLAN to function on a trunk. The native VLAN is independent of VLAN allowance and operation.

Practice this question →

187

PBQhard

You are connected to R1. Configure R1 as a DHCP server for VLAN 20 clients (192.168.20.0/24) with DNS server 203.0.113.10 and default gateway 192.168.20.1. On switch SW1, enable DHCP snooping globally and on VLAN 20, configure the uplink to R1 as trusted, and ensure that the DHCP server is reachable via ip helper-address on the VLAN 20 SVI. Currently, clients are not receiving IP addresses because of misconfigurations: the excluded-address range on R1 is too large (excluding the entire subnet), the helper-address on SW1 points to a wrong IP (192.0.2.99), and a rogue DHCP server is connected to port Fa0/3 on SW1. Fix all issues so that clients can get addresses securely.

Hints

•The excluded-address range is too broad; narrow it to only the gateway and a small reserved range.
•The helper-address must point to the DHCP server's IP, which is on a different subnet.
•DHCP snooping must be enabled globally and per VLAN, and the port connecting to the legitimate DHCP server must be trusted.

A.On R1, change the excluded-address range to 192.168.20.1 192.168.20.1; on SW1, configure ip helper-address 10.0.0.1 under interface Vlan20; enable DHCP snooping globally and on VLAN 20, and configure the uplink to R1 as trusted.

B.On R1, remove the excluded-address range entirely; on SW1, configure ip helper-address 192.168.20.1 under interface Vlan20; enable DHCP snooping globally and on VLAN 20, and configure the uplink to R1 as trusted.

C.On R1, change the excluded-address range to 192.168.20.1 192.168.20.254; on SW1, configure ip helper-address 192.0.2.99 under interface Vlan20; enable DHCP snooping globally and on VLAN 20, and configure the uplink to R1 as trusted.

D.On R1, change the excluded-address range to 192.168.20.1 192.168.20.1; on SW1, configure ip helper-address 10.0.0.1 under interface Vlan20; enable DHCP snooping globally and on VLAN 20, but do not configure any trusted ports.

AnswerA

solution

! R1
no ip dhcp excluded-address 192.168.20.0 192.168.20.255
ip dhcp excluded-address 192.168.20.1
ip dhcp excluded-address 192.168.20.2 192.168.20.10

! SW1
ip dhcp snooping
ip dhcp snooping vlan 20
interface FastEthernet0/1
ip dhcp snooping trust
exit
interface Vlan20
no ip helper-address 192.0.2.99
ip helper-address 10.0.0.1

Why this answer

The DHCP server had an excluded-address range covering the entire subnet (192.168.20.0–255), which prevented any IP from being assigned. Fix: change the excluded range to only include the gateway (192.168.20.1) and optionally other reserved addresses. The helper-address on SW1 pointed to 192.0.2.99 (nonexistent) instead of the DHCP server at 10.0.0.1; correct it.

DHCP snooping was disabled; enable it globally and on VLAN 20, then configure the uplink to R1 (port connecting to R1) as trusted and the port connecting the rogue server (Fa0/3) as untrusted (or simply leave it untrusted by default, but the rogue server will be blocked).

Exam trap

A common trap is forgetting that the excluded-address range should only reserve specific addresses, not the whole subnet. Another trap is confusing the helper-address with the default gateway or leaving the incorrect IP. Also, many candidates enable DHCP snooping but forget to configure the trusted port, which breaks legitimate DHCP traffic.

Why the other options are wrong

The helper-address must point to the DHCP server, not the default gateway. The excluded-address range should include the gateway to prevent conflicts.

The excluded-address range must be limited to reserved addresses only, not the entire usable range. The helper-address must be corrected to 10.0.0.1.

DHCP snooping requires the port connected to the legitimate DHCP server to be explicitly trusted; otherwise, all DHCP server messages are discarded.

Practice this question →

188

PBQhard

You are connected to SW1. The network has three switches (SW1, SW2, SW3) running Rapid-PVST+. SW1 should be the root bridge for VLAN 10. PortFast and BPDU Guard must be enabled on all edge ports connected to end hosts. An err-disabled port (G0/1) has occurred due to a BPDU violation on an edge port. Recover the port and ensure it is configured correctly to prevent recurrence.

Network Topology

Hints

•The port is in err-disabled state. You need to manually recover it by cycling the interface.
•After recovery, verify the port is forwarding and still has PortFast and BPDU Guard enabled.
•If the err-disabled condition recurs, the connected device may be sending BPDUs; consider removing BPDU Guard from that port if it is not truly an edge port.

A.Enter interface configuration mode for Gi0/1, issue 'shutdown' followed by 'no shutdown', then configure 'spanning-tree bpduguard disable' on the interface.

B.Enter interface configuration mode for Gi0/1, issue 'shutdown' followed by 'no shutdown', then configure 'spanning-tree portfast' and 'spanning-tree bpduguard enable' on the interface.

C.Enter interface configuration mode for Gi0/1, issue 'shutdown' followed by 'no shutdown', then configure 'spanning-tree guard root' on the interface.

D.Enter interface configuration mode for Gi0/1, issue 'shutdown' followed by 'no shutdown', then verify that the connected device is not a switch or remove it from the network.

AnswerD

solution

! SW1
configure terminal
interface gigabitEthernet 0/1
shutdown
no shutdown
end

Why this answer

The port Gi0/1 is in err-disabled state because BPDU Guard disabled it after receiving a BPDU on a PortFast edge port. First, shut down the interface and then re-enable it with 'no shutdown' to recover from err-disabled. However, to prevent recurrence, the root cause must be addressed: the connected device (likely another switch) should not be sending BPDUs on an edge port.

Optionally, you can disable BPDU Guard on that specific port if it is not truly an edge port, but the task requires PortFast and BPDU Guard on edge ports. The correct fix is to ensure no BPDUs are sent from the downstream device or use 'spanning-tree bpduguard disable' on that port if it is not an edge port (but the task mandates BPDU Guard). Since the scenario requires BPDU Guard, the candidate should recover the port and then verify that the connected device is not a switch (or remove it from the topology).

Exam trap

The exam trap is that candidates may focus on recovering the port (shutdown/no shutdown) but forget to address why the BPDU was received. Simply re-enabling BPDU Guard or reapplying PortFast will not prevent recurrence. The key is to ensure the connected device is not sending BPDUs, either by removing it or reclassifying the port.

Why the other options are wrong

The specific factual error is that BPDU Guard should not be disabled on a port that is supposed to be an edge port with BPDU Guard enabled.

The specific factual error is that simply re-enabling the same features does not prevent recurrence; the source of BPDUs must be removed or the port must be reconfigured as a non-edge port.

The specific factual error is that Root Guard and BPDU Guard serve different purposes; Root Guard does not stop BPDU Guard from disabling the port.

Practice this question →

189

MCQhard

A network administrator is troubleshooting connectivity from a PC (192.168.1.10/24) to a server at 10.0.0.5/24. The PC's default gateway is 192.168.1.1. Router R1 has a directly connected route to 10.0.0.0/24 via interface GigabitEthernet0/1, which is connected to another VLAN. The server is actually located on the 10.0.0.0/16 network, reachable via a static route through 192.168.1.2. What is the most likely cause of the connectivity issue?

A.The route to 10.0.0.0/16 has a lower administrative distance than the directly connected route.

B.The directly connected route to 10.0.0.0/24 is the most specific match but is incorrect for the destination.

C.The route to 10.0.0.0/8 has a higher metric, so it is not used.

D.The router does not have a default route, so traffic to 10.0.0.5 is dropped.

AnswerB

The router uses a longest-prefix-match lookup on the destination 10.0.0.5. The /24 route is the most specific match, so it is selected even though it points to an interface from which 10.0.0.5 is unreachable. The packet is therefore forwarded out the wrong interface rather than being processed by one of the longer, less-specific routes.

Why this answer

The router's routing table contains a directly connected route to 10.0.0.0/24, which is the most specific match (longest prefix) for the destination 10.0.0.5. However, if that directly connected subnet is not actually the network where the server resides (e.g., it points to a different interface or VLAN), traffic will be forwarded incorrectly. The router always prefers the most specific prefix, even if another route (like a summary) is administratively preferred or has a lower metric.

Exam trap

Cisco often tests the concept that the longest prefix match overrides administrative distance and metric, leading candidates to incorrectly assume that a lower AD or metric route will be chosen when a more specific but incorrect route exists.

Why the other options are wrong

You might think that OSPF routes are more reliable, but directly connected routes are always preferred regardless of AD.

You might confuse metric with prefix length; metric only matters when prefix lengths are equal.

A default route is only used when no more specific route exists; here a specific route exists.

Practice this question →

190

PBQhard

You are connected to R1, a multilayer switch acting as an HSRP active gateway for VLAN 100. The network requires R1 to be the active router with a virtual IP of 192.168.100.1. Currently, both R1 and the peer router R2 show as active in 'show standby brief', and the virtual IP is misconfigured. Configure HSRP on R1 to fix these issues: set priority to 110, enable preempt, correct the virtual IP, and track interface GigabitEthernet0/1 (decrement priority by 20 if it goes down).

Network Topology

Hints

•Check the virtual IP address configured under the standby group — it should match the expected virtual IP.
•Preempt is disabled by default; verify if it's configured to allow R1 to become active after a failure.
•Use 'show standby' to see all details including tracking status.

A.interface Vlan100 standby 100 ip 192.168.100.1 standby 100 priority 110 standby 100 preempt standby 100 track GigabitEthernet0/1 20

B.interface Vlan100 standby 100 ip 192.168.100.254 standby 100 priority 110 standby 100 preempt standby 100 track GigabitEthernet0/1 20

C.interface Vlan100 standby 100 ip 192.168.100.1 standby 100 priority 100 standby 100 preempt standby 100 track GigabitEthernet0/1 20

D.interface Vlan100 standby 100 ip 192.168.100.1 standby 100 priority 110 standby 100 track GigabitEthernet0/1 20

AnswerA

solution

! R1
interface Vlan100
standby 100 ip 192.168.100.1
standby 100 priority 110
standby 100 preempt
standby 100 track GigabitEthernet0/1 20

Why this answer

The problem had multiple issues: the virtual IP was wrong (192.168.100.254 instead of 192.168.100.1), preempt was not enabled (both routers could claim active), and priority was default (100). Additionally, interface tracking was missing to decrement priority if the upstream link failed. The solution consists of four commands: 'standby 100 ip 192.168.100.1' to set the correct virtual IP, 'standby 100 priority 110' to make R1 the active router, 'standby 100 preempt' to allow R1 to reclaim active role after recovery, and 'standby 100 track GigabitEthernet0/1 20' to reduce priority by 20 if that interface goes down.

Exam trap

Watch out for three common HSRP pitfalls: (1) virtual IP must match the configured gateway, (2) preempt is required for a router to reclaim active role after recovery, and (3) priority must be higher than the peer to be preferred. Also, remember that interface tracking decrements priority, so the tracked interface must be specified correctly.

Why the other options are wrong

The virtual IP address is wrong; it should be 192.168.100.1, not 192.168.100.254.

Priority must be higher than the default (100) to ensure R1 becomes the active router; 110 is required.

Preempt is required to allow R1 to reclaim the active role when its priority becomes higher again after a failure.

Practice this question →

191

MCQeasy

Which VLAN is used by default for most switch ports on a new Cisco switch?

A.VLAN 1

B.VLAN 99

C.VLAN 1002

D.No VLAN until the port is manually assigned

AnswerA

On a new Cisco switch, every port is automatically placed in VLAN 1, which is the factory-default VLAN and cannot be deleted or renamed. This default assignment applies to both access and trunk ports, and VLAN 1 also serves as the default native VLAN. Therefore, VLAN 1 is the correct answer for the default switch port VLAN.

Why this answer

On a default Cisco switch, access ports belong to VLAN 1 until changed. Best practice is usually to move user ports away from VLAN 1, but the default is still VLAN 1.

Exam trap

Remember that VLAN 1 is the default VLAN on Cisco switches, despite being discouraged for use in production environments.

Why the other options are wrong

VLAN 99 is not the default VLAN for switch ports on a new Cisco switch; the default is VLAN 1. VLAN 99 is often used in specific configurations but is not the factory default setting.

VLAN 1002 is a reserved VLAN for Token Ring and FDDI, and it is not the default VLAN for switch ports on a new Cisco switch. Most switch ports default to VLAN 1 unless configured otherwise.

This option is incorrect because, by default, Cisco switches assign all ports to VLAN 1, not leaving them unassigned. Every port is part of VLAN 1 unless configured otherwise.

Practice this question →

192

Multi-Selectmedium

Which TWO commands are required to configure a switch port to support both a desktop PC and a VoIP phone using voice VLAN?

Select 2 answers

A.switchport mode access

B.switchport mode trunk

C.switchport voice vlan <vlan-id>

D.switchport access vlan <vlan-id>

E.switchport port-security maximum 1

AnswersA, C

This command configures the port as an access port, which is required for connecting a desktop PC and a VoIP phone (the phone typically uses the access port for data and a separate voice VLAN).

Why this answer

'switchport mode access,' is required because voice VLAN only operates on an access port. Option C, 'switchport voice vlan <vlan-id>,' is the command that actually assigns the voice VLAN ID. Option B is incorrect because a trunk port would not properly separate voice and data traffic as the phone expects an access port.

Option D is a common data VLAN configuration but is not strictly necessary for voice VLAN operation; the access VLAN can be left as the default or configured separately. Option E is wrong because 'switchport port-security maximum 1' would allow only a single MAC address, while the port must support two devices (the phone and the PC), second MAC being the phone's internal switch.

Exam trap

Candidates often mistakenly include 'switchport access vlan' as one of the two required commands, but the question specifically asks for voice VLAN configuration, not the full port setup.

Why the other options are wrong

Trunk mode is incompatible because the phone expects an access port, and the voice VLAN is tagged internally by the phone, not by switch port trunking.

Configuring an access VLAN is not mandatory for voice VLAN; the question targets only the commands unique to enabling the voice feature.

Limiting the port to one MAC address would block the PC's MAC, breaking dual-device support provided by the phone's internal switch.

Practice this question →

193

MCQhard

A network administrator is configuring a Layer 2 EtherChannel between two switches. Switch A uses 'channel-group 1 mode active', and Switch B uses 'channel-group 1 mode desirable'. All member interfaces are trunk ports with identical allowed VLANs. The EtherChannel fails to form. What is the most likely cause?

A.The switches are using different EtherChannel negotiation protocols.

B.A Layer 2 EtherChannel cannot carry trunk links.

C.The channel-group number must be different on each switch.

D.The member interfaces must be in access mode before the bundle can form.

AnswerA

Switch A is configured for Link Aggregation Control Protocol (LACP) using `mode active`, whereas Switch B is configured for Port Aggregation Protocol (PAgP) using `mode desirable`. LACP and PAgP are distinct EtherChannel negotiation protocols. For an EtherChannel to establish using a negotiation protocol, both connected switches must utilise the identical protocol, as they are incompatible with each other. This protocol mismatch directly causes the EtherChannel to fail.

Why this answer

The two switches are using different negotiation protocols: LACP (active) on one side and PAgP (desirable) on the other. EtherChannel requires both sides to use the same protocol, so this protocol mismatch prevents the bundle from forming. The other settings—trunking, VLAN configuration, and channel-group number—are correctly configured and do not cause the failure.

Exam trap

Ensure both sides of an EtherChannel use the same negotiation protocol; mismatches are a common setup error.

Why the other options are wrong

This option is incorrect because a Layer 2 EtherChannel can indeed carry trunk links, allowing multiple VLANs to be transmitted over the same logical link. The issue with the EtherChannel not forming is more likely related to mismatched negotiation protocols or other configuration errors.

This option is wrong because the channel-group number must be the same on both switches for an EtherChannel to form. Different numbers would prevent the aggregation of the links.

This option is wrong because a Layer 2 EtherChannel can indeed carry trunk links, allowing multiple VLANs to be transmitted over the same link. Therefore, the inability to form the EtherChannel is not due to the mode of the member interfaces.

Practice this question →

194

PBQhard

You are connected to SW1. The current configurations of interfaces GigabitEthernet0/1 and GigabitEthernet0/2 are as follows: Gi0/1: speed 100, duplex half, switchport access vlan 10 Gi0/2: speed 1000, duplex full, switchport access vlan 20 The port-channel interface 1 does not exist. Configure a LACP EtherChannel between SW1 and SW2 using these two interfaces, with port-channel 1 and mode active on both sides. Ensure the channel forms by resolving any speed/duplex or VLAN mismatches. After configuration, verify with 'show etherchannel summary'.

Network Topology

Hints

•Check speed and duplex consistency between member interfaces.
•All member interfaces must be in the same VLAN.
•The port-channel interface VLAN must match the physical interfaces.

A.The EtherChannel will not form because the physical interfaces have mismatched speed/duplex and VLAN assignments. You must configure both interfaces with the same speed (1000), duplex (full), and access VLAN (10), then apply channel-group 1 mode active on each.

B.The EtherChannel will form successfully because LACP active mode negotiates the channel regardless of speed/duplex or VLAN differences.

C.The EtherChannel will not form because the port-channel interface must be configured with the same VLAN as the physical interfaces, but the physical interfaces can have different speeds.

D.The EtherChannel will form successfully because the port-channel interface inherits the VLAN from the first physical interface added, so no additional configuration is needed.

AnswerA

solution

! SW1
interface GigabitEthernet0/1
speed 1000
duplex full
switchport access vlan 10
channel-group 1 mode active
interface GigabitEthernet0/2
speed 1000
duplex full
switchport access vlan 10
channel-group 1 mode active
interface Port-channel1
switchport access vlan 10

Why this answer

The EtherChannel fails because member interfaces have mismatched speed/duplex (Gi0/1 is 100/half, Gi0/2 is 1000/full) and different VLANs (VLAN 10 vs 20). Additionally, the port-channel interface and physical interfaces must have matching VLAN assignments. To fix, unify both physical interfaces to the same speed (1000), duplex (full), and access VLAN (10).

Then set channel-group mode active on each physical interface. Finally, ensure the port-channel interface also uses VLAN 10. Verify with 'show etherchannel summary' which should show the port-channel as SU (in use).

Exam trap

Cisco exam traps often test the requirement for identical speed, duplex, and VLAN on all EtherChannel member interfaces. Do not assume LACP can negotiate mismatches; it only handles aggregation, not physical or VLAN parameters.

Why the other options are wrong

LACP active mode only enables negotiation, but it does not resolve underlying parameter mismatches. The interfaces must still have consistent speed, duplex, and VLAN configuration.

All member interfaces must have identical speed and duplex settings. Even if VLANs match, speed mismatch will cause the channel to fail.

The port-channel interface is a logical interface that requires its own VLAN configuration. Physical interfaces must have identical VLAN assignments; otherwise, the channel will not form.

Practice this question →

195

PBQhard

You are connected to a multilayer switch MLSW1. PortFast and BPDU Guard have already been enabled on interface GigabitEthernet0/1, which connects to an end device, and a BPDU received on that interface placed it in the err-disabled state. Configure Rapid PVST+ so that MLSW1 becomes the root bridge for VLAN 10 with a priority of 4096. Recover the interface by re-enabling it. Finally, verify which port is blocking on VLAN 10 by connecting to MLSW2 and executing the appropriate show command.

Network Topology

Hints

•Check the current root priority and adjust with 'spanning-tree vlan <vlan> priority <value>'.
•An err-disabled interface can be recovered by administrative shutdown and no shutdown.
•Look at the spanning-tree topology to find which port is blocking; it will be in 'ALT' role with 'BLK' state.

A.spanning-tree vlan 10 priority 4096; interface GigabitEthernet0/1; shutdown; no shutdown; show spanning-tree vlan 10

B.spanning-tree vlan 10 root primary; interface GigabitEthernet0/1; no shutdown; show spanning-tree vlan 10

C.spanning-tree vlan 10 priority 4096; interface GigabitEthernet0/1; no shutdown; show interfaces status

D.spanning-tree vlan 10 priority 4096; interface GigabitEthernet0/1; shutdown; no shutdown; show running-config

AnswerA

solution

! MLSW1
spanning-tree vlan 10 priority 4096
interface gigabitEthernet 0/1
shutdown
no shutdown

Why this answer

The correct solution sets the spanning-tree priority for VLAN 10 to 4096 on MLSW1, ensuring it becomes the root bridge. PortFast and BPDU Guard are already configured on G0/1, which caused the interface to go err-disabled when a BPDU was received. To recover, you must issue the 'shutdown' followed by 'no shutdown' commands on the interface.

Because MLSW1 is the root bridge, it has no blocking ports; the blocking port (alternate) will be seen on a downstream switch like MLSW2. Therefore, verification must be done on MLSW2 using 'show spanning-tree vlan 10' to view the alternate blocking port. Option A correctly includes all required steps.

Option B uses 'root primary' (priority 24576) instead of the specified 4096, lacks the recovery commands, and verifies on the wrong device. Option C omits the err-disabled recovery and uses the wrong verification command. Option D also verifies with 'show running-config', which does not display STP port roles.

Exam trap

Remember that 'spanning-tree vlan <vlan> root primary' sets priority to 24576, not a custom value. Also, err-disabled recovery requires a shutdown followed by no shutdown. Always use 'show spanning-tree vlan <vlan>' to verify port roles, not 'show interfaces status' or 'show running-config'.

Why the other options are wrong

The specific factual error: 'root primary' sets priority to 24576, not 4096. Also, err-disabled recovery requires a shutdown followed by no shutdown.

The specific factual error: err-disabled recovery requires a shutdown before no shutdown. 'show interfaces status' does not display STP port roles.

The specific factual error: 'show running-config' does not display STP port roles or blocking status.

Practice this question →

196

PBQmedium

You are connected to SW1 via console. SW1 is a multilayer switch with SVIs for VLAN 10 (192.168.10.1/24) and VLAN 20 (192.168.20.1/24). Hosts in VLAN 10 and VLAN 20 need to communicate with each other. Currently, inter-VLAN routing is not working. You need to enable routing on SW1 and verify that the SVIs are operational.

Network Topology

Hints

•Check if 'ip routing' is already enabled.
•Verify that the SVIs are up with 'no shutdown'.

A.Enable IP routing using the 'ip routing' global configuration command.

B.Configure a routing protocol such as OSPF or EIGRP on the SVIs.

C.Assign IP addresses to the physical interfaces connected to the hosts.

D.Create a trunk port and connect a router to perform router-on-a-stick.

AnswerA

solution

! SW1
ip routing

Why this answer

The 'ip routing' command enables Layer 3 routing on the multilayer switch, allowing SVIs to route between VLAN 10 and VLAN 20. Option B is unnecessary because directly connected SVIs do not require a routing protocol; routing protocols are only needed for routes learned from other routers, and 'ip routing' must still be enabled. Option C would require converting the physical interfaces to routed ports, which would break the existing Layer 2 VLAN topology and is not the intended solution.

Option D provides an external router-on-a-stick solution but does not enable routing on SW1 itself, which is the required task. Therefore, only option A correctly enables inter-VLAN routing on SW1.

Exam trap

The trap is that many candidates assume SVIs automatically route traffic once they have IP addresses. However, on a multilayer switch, you must explicitly enable IP routing with the 'ip routing' command. Without it, the switch remains a Layer 2 device and SVIs only serve as management interfaces.

Why the other options are wrong

Routing protocols like OSPF or EIGRP are not required for directly connected SVIs; only 'ip routing' is needed to enable Layer 3 routing.

Assigning IP addresses to physical interfaces would convert them to routed ports, breaking the existing Layer 2 VLAN configuration and is not the correct approach.

Using an external router with router-on-a-stick would enable inter-VLAN routing but does not enable routing on SW1 as required.

197

MCQhard

Refer to the exhibit. A network engineer notices that on a four-link EtherChannel bundle between two switches, all traffic from a particular VLAN is being forwarded over only one physical link, while the other three links remain idle. The engineer suspects a load-balancing issue and issues the show etherchannel load-balance command, the output of which is shown. What is the most likely cause of the uneven traffic distribution?

A.The switch is using source‑MAC‑address load balancing, and multiple end hosts are appearing with the same source MAC address.

B.The EtherChannel is misconfigured with an LACP active/passive mode mismatch, forcing only one link to bundle.

C.VLAN pruning on the trunk has removed the VLAN from three of the four member interfaces.

D.Spanning Tree Protocol has blocked three of the four links in the EtherChannel because they form a loop.

AnswerA

The show etherchannel load-balance output confirms the global load‑balancing method is src‑mac. With this method, frames with an identical source MAC always hash to the same physical member link, causing all traffic from hosts sharing that MAC to use only one link.

Why this answer

The output of 'show etherchannel load-balance' indicates the switch is using source-MAC-address load balancing. With this method, all frames from a given source MAC address are hashed to the same physical link. If multiple end hosts in the VLAN are actually behind a single upstream router or firewall that uses the same source MAC address for all traffic (e.g., due to proxy ARP or NAT), then all traffic from that VLAN will be pinned to one link, leaving the other three idle.

Exam trap

Cisco often tests the misconception that load-balancing issues are caused by misconfiguration or STP, when the real problem is the hash algorithm's behavior with a single dominant source MAC address.

Why the other options are wrong

Candidates may think that an LACP problem explains a single active link, but a mismatch would cause the entire EtherChannel to fail, not selectively use one member.

Candidates might mistake an idle member for a pruned VLAN, but pruning would not affect all traffic, only the specific VLAN, and it is not related to the load‑balance method shown.

Candidates may associate an idle link with STP blocking, but an EtherChannel bundle presents one logical link to STP. A blocking state on some members only would indicate a serious configuration error, not the load‑balance method shown.

Practice this question →

198

MCQhard

A switchport connected to another switch is configured as an access port by mistake. Which symptom is most likely in a multi-VLAN design?

A.Only one VLAN is likely to pass correctly, while other VLAN traffic across the link fails

B.The link negotiates as a trunk but drops all VLAN traffic

C.The switch generates excessive broadcasts on all VLANs

D.The switch stops learning MAC addresses entirely

AnswerA

An access port is configured to carry exactly one untagged VLAN, known as the access VLAN. When connected to another switch, that link will only pass traffic belonging to the access VLAN; frames from other VLANs that arrive expecting trunk tagging will be dropped or misclassified. This causes a failure for all other VLANs across that link, because the access port does not support 802.1Q trunking or multi-VLAN tagging.

Why this answer

The most likely symptom is that only one VLAN’s traffic works correctly across the link while traffic for other VLANs fails. In plain language, an access port belongs to one VLAN in normal switching behavior. If an inter-switch link that should carry multiple VLANs is accidentally configured as an access port, the network loses the ability to transport the other VLANs.

The physical link may stay up, which can make the problem seem subtle, but the logical role of the port is wrong.

Exam trap

Be cautious not to confuse physical link status with logical configuration issues. An access port will not drop the link but will restrict traffic to a single VLAN.

Why the other options are wrong

An access port cannot negotiate trunking; it simply forwards only one VLAN's traffic.

Broadcast storms are not caused by an access port misconfiguration.

Practice this question →

199

MCQhard

After enabling DHCP snooping on VLAN 10, a technician finds that clients in that VLAN are no longer receiving IP addresses from the DHCP server. The server is connected to port Gi0/24. What is the most likely cause?

A.The port Gi0/24 has not been configured as a trusted port for DHCP snooping.

B.The DHCP server is on a different subnet, and the VLAN 10 SVI does not have an ip helper-address configured.

C.The DHCP snooping database location was not configured, causing the switch to discard all DHCP server messages.

D.The DHCP snooping binding table does not contain an entry for the DHCP server’s MAC address, so offers are being discarded.

AnswerA

DHCP snooping immediately blocks all DHCP server messages on untrusted ports. Because Gi0/24 is the uplink to the DHCP server, it must be explicitly set as trusted (ip dhcp snooping trust), otherwise the switch will drop the DHCP offers sent by the server.

Why this answer

When DHCP snooping is enabled, all ports are untrusted by default. Untrusted ports will drop DHCP server messages (OFFER, ACK, etc.) unless the port is explicitly configured as trusted. Since the DHCP server is connected to Gi0/24 and the technician did not configure it as a trusted port, the switch discards the server's responses, preventing clients from obtaining IP addresses.

Exam trap

Cisco often tests the default untrusted state of all ports when DHCP snooping is enabled, leading candidates to overlook the need to manually trust the server port.

Why the other options are wrong

This option assumes that the loss of DHCP service is due to a missing relay agent, but the symptom started only after enabling snooping, not after an infrastructure change that would affect the relay path.

The idea that a missing database causes immediate traffic blocking is a common misinterpretation of the database’s role—it is purely for persistency, not for runtime filtering.

Many candidates assume that DHCP snooping uses a reverse-check against the binding table for any DHCP server messages, but the filtering is based solely on the trusted/untrusted port state, not on a learned server entry.

Practice this question →

200

PBQhard

You are connected to SW1, a multilayer switch. Configure DHCP snooping and an IP helper-address so that clients in VLAN 20 receive IP addresses from the DHCP server at 10.0.0.2. The DHCP server is already configured with a pool for 192.168.20.0/24, but clients are not getting addresses. Identify and correct the issues in the current configuration.

Network Topology

Hints

•Check the helper-address on VLAN 20 — is it pointing to the correct server IP?
•DHCP snooping must be enabled globally and for the specific VLAN.
•The port towards the DHCP server must be configured as trusted.

A.Enable DHCP snooping globally and on VLAN 20, configure interface G0/0 as trusted, and change the ip helper-address on the SVI for VLAN 20 from 10.0.0.3 to 10.0.0.2.

B.Enable DHCP snooping globally and on VLAN 20, configure interface G0/1 as trusted, and change the ip helper-address on the SVI for VLAN 20 from 10.0.0.3 to 10.0.0.2.

C.Enable DHCP snooping globally and on VLAN 20, configure interface G0/0 as trusted, and keep the ip helper-address as 10.0.0.3 because that is the correct server address.

D.Enable DHCP snooping globally and on VLAN 20, configure both interfaces G0/0 and G0/1 as trusted, and change the ip helper-address on the SVI for VLAN 20 from 10.0.0.3 to 10.0.0.2.

AnswerA

solution

! SW1
configure terminal
ip dhcp snooping
ip dhcp snooping vlan 20
interface gigabitethernet0/0
ip dhcp snooping trust
interface vlan20
no ip helper-address 10.0.0.3
ip helper-address 10.0.0.2
end
write memory

Why this answer

The DHCP relay helper-address was pointing to 10.0.0.3 instead of the actual server at 10.0.0.2. Also, DHCP snooping was not enabled. After enabling DHCP snooping globally and on VLAN 20, configure the uplink to the DHCP server as a trusted port (G0/0) and the access port (G0/1) as untrusted (default).

Finally, correct the helper-address to 10.0.0.2. These steps allow DHCP broadcasts from VLAN 20 to be relayed to the server and prevent rogue DHCP attacks.

Exam trap

A common trap is to trust all ports or to forget that the ip helper-address must match the actual DHCP server IP. Also, candidates may confuse which port should be trusted: only the port facing the legitimate DHCP server should be trusted, not client-facing ports.

Why the other options are wrong

The specific factual error is that the access port (G0/1) should be untrusted, not trusted. Only the uplink port to the legitimate DHCP server should be trusted.

The specific factual error is that the ip helper-address must be set to the actual DHCP server IP (10.0.0.2), not 10.0.0.3.

The specific factual error is that only the uplink port (G0/0) should be trusted; trusting the access port (G0/1) allows any device connected to that port to act as a DHCP server.

Practice this question →

201

Multi-Selectmedium

Which TWO statements are true about configuring and verifying VLANs, 802.1Q trunking, native VLAN, and inter-VLAN routing with router-on-a-stick?

Select 2 answers

A.On a router-on-a-stick configuration, each subinterface must be configured with an IP address and the encapsulation dot1Q command to specify the VLAN ID.

B.The native VLAN is always tagged on an 802.1Q trunk link.

C.The command switchport trunk native vlan 10 is used to restrict which VLANs are allowed on a trunk.

D.When configuring a router-on-a-stick, the native VLAN must match on both the switch and the router subinterface to avoid miscommunication.

E.The command show interfaces trunk displays the IP addresses configured on router subinterfaces.

AnswersA, D

In router-on-a-stick, a single physical router interface is divided into logical subinterfaces, each dedicated to a distinct VLAN. For every subinterface, you must assign an IP address that falls within the VLAN's subnet and issue the `encapsulation dot1Q <vlan-id>` command so the router tags outgoing frames and recognizes incoming tagged frames for that VLAN. Without this encapsulation, the router cannot distinguish which VLAN a frame belongs to, breaking inter-VLAN routing.

Why this answer

In a router-on-a-stick configuration, each subinterface must be assigned an IP address and use the encapsulation dot1Q command to associate it with a specific VLAN ID; this enables the router to process tagged frames from multiple VLANs over a single physical link. Option D is also correct because the native VLAN configured on the switchport trunk must match the native VLAN used on the router's subinterface (or physical interface if no subinterface); a mismatch causes the router to mishandle untagged frames because it expects them to belong to the configured native VLAN, leading to communication failures. Option B is wrong because on an 802.1Q trunk, the native VLAN frames are sent untagged, not tagged.

Option C is wrong because the command 'switchport trunk native vlan 10' only changes the native VLAN; it does not restrict which VLANs are allowed—that requires 'switchport trunk allowed vlan'. Option E is wrong because 'show interfaces trunk' shows trunking status, native VLAN, and allowed VLAN lists on switch ports, not IP addresses of router subinterfaces.

Exam trap

Cisco often tests the misconception that the native VLAN is tagged on a trunk, or that the switchport trunk native vlan command controls allowed VLANs, when in fact it only changes which VLAN is untagged.

Why the other options are wrong

The native VLAN is sent untagged to maintain backward compatibility with devices that do not understand 802.1Q tagging.

The command to restrict allowed VLANs is switchport trunk allowed vlan, not the native VLAN command.

To see IP addresses on subinterfaces, use show ip interface brief or show running-config on the router.

Practice this question →

202

MCQeasy

A network administrator at a small branch office needs to allow a wireless guest user to reach an internal web server at 10.5.5.20 using a browser, while preventing that guest from reaching any other internal subnet. The guest is connected to VLAN 50 and the web server is in VLAN 10. Which type of ACL should be applied on the router between VLANs to meet this requirement?

A.Extended numbered ACL 100 applied inbound on the VLAN 50 interface

B.Standard numbered ACL 10 applied inbound on the VLAN 50 interface

C.Standard named ACL GUEST_IN applied outbound on the VLAN 10 interface

D.Extended named ACL GUEST_OUT applied outbound on the VLAN 50 interface

AnswerA

An extended ACL can match source IP, destination IP, protocol, and port. Applied inbound on VLAN 50, it can permit TCP traffic from the guest subnet to 10.5.5.20 port 80 while denying all other traffic, exactly meeting the requirement to allow only the web server and block other internal subnets.

Why this answer

An extended ACL is required because the requirement involves matching both source and destination addresses, and the protocol/port for HTTP. Applying it inbound on the guest VLAN interface filters traffic as it enters the router, before it can reach other internal subnets. A standard ACL cannot match destination addresses, and the other placements either use the wrong ACL type or the wrong direction.

Exam trap

The trap here is assuming that a standard ACL applied close to the source is sufficient, when destination-based filtering requires an extended ACL.

Practice this question →

203

MCQhard

A network administrator is troubleshooting a Windows 10 client that cannot reach the internet. The client is connected to a Cisco switch port configured as an access port in VLAN 100. The administrator runs ipconfig on the client and sees an IP address of 169.254.10.15 with a subnet mask of 255.255.0.0. The switch port shows status up/up. What is the most likely cause of the issue?

A.The switch port is in err-disabled state due to a spanning-tree loop.

B.The switch is not configured with an ip helper-address on the VLAN 100 SVI to forward DHCP broadcasts to the DHCP server.

C.The client is in the wrong VLAN; the switch should be configured with VLAN 200.

D.There is a duplex mismatch between the client and the switch.

AnswerB

For a DHCP client in VLAN 100 to obtain an address from a server located in a different VLAN or subnet, the VLAN 100 SVI must include an 'ip helper-address' pointing to the DHCP server. DHCP requests are IP broadcast packets, and routers do not forward broadcasts across interfaces by default; without UDP forwarding configured, the DHCPDISCOVER is never relayed to the server, so the client receives no DHCPOFFER and may fall back to an APIPA address. The correct remedy is to configure 'interface vlan 100' with the 'ip helper-address' command referencing the DHCP server's IP address.

Why this answer

The 169.254.x.x address is an Automatic Private IP Addressing (APIPA) address, assigned by Windows when DHCP fails. Since the client is in VLAN 100 and the switch port is up/up, the most likely cause is that the VLAN 100 SVI lacks an ip helper-address command, so DHCP broadcast requests from the client are not forwarded to the DHCP server, leaving the client without a valid IP address.

Exam trap

Cisco often tests the misconception that an APIPA address indicates a physical or VLAN issue, when in fact it specifically points to DHCP failure, and the most common cause in a routed environment is the absence of ip helper-address on the SVI.

Why the other options are wrong

The port status is 'connected', not err-disabled.

No information suggests the client should be in VLAN 200; the configuration matches the intended VLAN.

Duplex mismatch would typically cause errors or speed/duplex issues, but the switch shows a-full, so this is not the problem.

Practice this question →

204

MCQmedium

A PC in VLAN 30 must obtain an address from a DHCP server in VLAN 99. Which feature is required on the Layer 3 interface for VLAN 30?

A.Port security

B.DHCP snooping

C.DHCP relay

D.Dynamic ARP inspection

AnswerC

DHCP relay, configured with the ip helper-address command on the VLAN interface, intercepts the client's DHCPDISCOVER broadcast and unicasts it to the DHCP server's IP address on another subnet. The relay agent also relays DHCPOFFER, DHCPREQUEST, and DHCPACK messages, allowing the client in VLAN 30 to obtain an address despite the server being in a different VLAN or subnet. Without this relay, DHCP broadcasts would remain confined to VLAN 30 and never reach the remote server.

Why this answer

DHCP Discover messages are broadcasts and do not cross Layer 3 boundaries on their own. DHCP relay, commonly configured with ip helper-address, forwards the requests to a server on another subnet.

Exam trap

A frequent exam trap is selecting DHCP snooping or port security as the solution for inter-VLAN DHCP communication. DHCP snooping is often misunderstood as a relay mechanism, but it only validates DHCP messages to prevent unauthorized servers and does not forward broadcasts between VLANs. Similarly, port security controls MAC address access on switchports but does not affect DHCP message forwarding.

Candidates may also confuse Dynamic ARP Inspection with DHCP relay, but DAI only inspects ARP traffic for security purposes. The key mistake is overlooking that DHCP broadcasts are Layer 2 broadcasts and require DHCP relay on the Layer 3 interface to reach servers in other VLANs.

Why the other options are wrong

Port security restricts MAC addresses on switchports to enhance security but does not forward DHCP broadcasts or enable clients in one VLAN to reach DHCP servers in another VLAN. It does not facilitate inter-VLAN DHCP communication.

DHCP snooping is a security feature that validates DHCP messages to prevent rogue DHCP servers but does not relay DHCP requests between VLANs. It cannot replace DHCP relay functionality needed for inter-VLAN DHCP address assignment.

Dynamic ARP Inspection inspects ARP traffic to prevent ARP spoofing attacks but does not forward DHCP messages or enable DHCP communication between VLANs. It is unrelated to DHCP relay or inter-VLAN DHCP address assignment.

Practice this question →

205

MCQhard

A network administrator is troubleshooting connectivity between two directly connected Cisco switches. Hosts on VLAN 10 connected to Switch A cannot ping the default gateway on Switch B. The interface on Switch A shows 'up/up' but there are excessive CRC errors and runts. The administrator checks the interface configuration on both switches. What is the most likely cause of the issue?

A.Replace the faulty Ethernet cable.

B.Mismatched duplex and speed settings between the interfaces.

C.Disable spanning tree on both interfaces to prevent loop prevention from blocking traffic.

D.Assign the interfaces to the same VLAN to ensure Layer 2 connectivity.

AnswerB

With one switch operating at full-duplex and 1000 Mbps while the other operates at half-duplex and 100 Mbps, the two interfaces cannot coordinate frame timing properly. The full-duplex side transmits without carrier sensing, while the half-duplex side detects a collision, sends a jam signal, and drops the corrupted frame—producing CRC errors on the half-duplex interface. Forcing both interfaces to the same speed (1000 Mbps) and full-duplex mode eliminates the mismatch, allowing the error counters to stop incrementing.

Why this answer

The presence of excessive CRC errors and runts on an interface that is 'up/up' strongly indicates a Layer 1 or Layer 2 duplex mismatch. When one switch is set to full-duplex and the other to half-duplex (or auto-negotiation fails), the half-duplex side will detect collisions and retransmit, while the full-duplex side will not, leading to frame corruption (CRC errors) and truncated frames (runts). Configuring both interfaces with the same duplex and speed settings (e.g., full-duplex and 1000 Mbps) resolves this mismatch, restoring proper connectivity for VLAN 10 traffic to the default gateway.

Exam trap

Cisco often tests the concept that 'up/up' does not guarantee error-free communication, and candidates mistakenly focus on cable replacement or VLAN misconfiguration instead of recognizing CRC errors and runts as classic symptoms of a duplex mismatch.

Why the other options are wrong

The exhibit shows both switches have different speed and duplex settings, indicating a configuration mismatch rather than a cable fault.

The interface is up/up and the errors are CRC, which are not related to spanning tree operation.

CRC errors indicate physical or duplex issues, not VLAN misconfiguration.

Practice this question →

206

MCQhard

A network technician is troubleshooting a connectivity issue between two directly connected switches, SW1 and SW2. Hosts on VLAN 10 connected to SW1 can ping each other but cannot ping the default gateway or any host on VLAN 10 connected to SW2. The interface on SW1 is up/up, but the interface on SW2 is up/down. What is the most likely cause of the problem?

A.Configure the interface on SW2 to use a different MTU value.

B.Ensure both switches are configured for the same duplex setting, preferably by enabling autonegotiation on both interfaces.

C.Replace the Ethernet cable connecting SW1 and SW2.

D.Check for late collisions on the interface and increase the collision window size.

AnswerB

The output from SW1 shows the interface is full-duplex, but SW2's interface is up/down. This is a classic symptom of a duplex mismatch, where one side is full and the other half-duplex. Configuring both ends to the same duplex (or enabling autonegotiation) will resolve the issue.

Why this answer

The interface on SW2 is up/down, which typically indicates a Layer 1 issue such as a duplex mismatch. Duplex mismatch occurs when one switch is manually set to full duplex and the other to half duplex or auto-negotiation fails, causing the side expecting full duplex to report up/down due to excessive errors. Option A is incorrect because MTU mismatch would cause connectivity issues but not an up/down interface state.

Option C is incorrect because a faulty cable would likely cause both interfaces to be down/down, not up/down. Option D is incorrect because late collisions are a symptom of duplex mismatch, not a separate cause; increasing collision window size is not a standard troubleshooting step. The correct solution is to ensure both switches use the same duplex setting, preferably via autonegotiation (IEEE 802.3u).

Exam trap

Cisco often tests the distinction between up/down (Layer 1 issue like duplex mismatch) and down/down (cable or power issue) to trap candidates who assume any interface problem is a bad cable.

Why the other options are wrong

Changing MTU values affects frame size but does not cause an interface to show up/down; that state is associated with Layer 1 issues like duplex mismatch.

A bad cable typically results in both interfaces showing down/down, not one up and the other up/down.

Late collisions are a consequence of duplex mismatch, not a root cause; adjusting collision window size is not a standard practice on modern switches.

Practice this question →

207

MCQhard

Two switches are connected by a trunk. VLAN 50 exists on both switches, but hosts in VLAN 50 cannot communicate across the link. All other VLANs work. Based on the exhibit, what is the most likely cause?

A.VLAN 50 is not allowed on the trunk from SwitchA.

B.The native VLAN is mismatched.

C.802.1Q cannot carry VLAN 50.

D.VLAN 50 must be configured as the native VLAN first.

AnswerA

On a Cisco trunk, the 'switchport trunk allowed vlan' list on SwitchA determines which VLANs may traverse the link. Even though VLAN 50 is defined on both switches, if SwitchA's trunk interface does not explicitly include VLAN 50 in its allowed list, the switch will not forward VLAN 50 frames across the trunk. You must add VLAN 50 to the allowed list with 'switchport trunk allowed vlan add 50' on SwitchA's trunk port to restore connectivity.

Why this answer

VLAN 50 is missing from the allowed VLAN list on the trunk, which blocks only that VLAN while allowing others. Option B is incorrect: a native VLAN mismatch would affect the native VLAN (usually VLAN 1) or cause STP issues, not specifically VLAN 50. Option C is incorrect: 802.1Q encapsulation supports all VLANs from 1 to 4094, including VLAN 50.

Option D is incorrect: VLANs do not need to be the native VLAN to be transported over a trunk; any VLAN can traverse a trunk if it is allowed.

Exam trap

Ensure you differentiate between general trunk issues and VLAN-specific configurations. Don't confuse access port settings with trunk link issues.

Why the other options are wrong

This option is wrong because a native VLAN mismatch would typically affect all VLANs, not just VLAN 50. Since other VLANs are functioning correctly, it indicates that the native VLAN configuration is not the issue.

802.1Q is a standard that can carry VLANs up to 4096, including VLAN 50. Therefore, the issue of VLAN 50 not communicating is not due to the protocol's inability to carry it.

This option is wrong because VLAN 50 can exist on a trunk without being the native VLAN; it does not need to be configured as such to communicate across the trunk link.

Practice this question →

208

MCQhard

A network administrator notices that a workstation connected to a Cisco switch port cannot communicate with other devices on the same VLAN. The switch port is up/up, but the workstation reports slow performance and intermittent connectivity. What is the most likely cause of this issue?

A.Replace the faulty Ethernet cable between the switch and the workstation.

B.A duplex mismatch between the switch port and the workstation.

C.Assign the switch port to the correct VLAN.

D.Disable spanning-tree on the port to prevent frequent topology changes.

AnswerB

A duplex mismatch between the switch port and the workstation is the correct cause because it creates a half-duplex device that performs CSMA/CD while the full-duplex peer transmits without sensing the medium. When both devices transmit simultaneously, the half-duplex side detects a late collision and backs off, while the full-duplex side is unaware and does not retransmit, causing dropped frames, high latency, and degraded throughput. The switch output would likely show a high number of late collisions or a significant rate of alignment errors, even though the link remains up/up, matching the symptom of a slow but stable connection.

Why this answer

A duplex mismatch occurs when one end of the link is set to full-duplex and the other to half-duplex. The half-duplex end detects collisions and the full-duplex end does not, causing late collisions, CRC errors, and retransmissions. This results in slow performance and intermittent connectivity even though the port is operationally up.

Exam trap

Cisco often tests the concept that a link being up/up does not guarantee error-free communication, and candidates mistakenly focus on VLAN or cable issues instead of recognizing duplex mismatch as the cause of slow performance and intermittent connectivity.

Why the other options are wrong

No cable-related errors are shown.

VLAN issues would typically prevent communication entirely or show input errors from misconfigured trunking.

The port is stable and not flapping.

Practice this question →

209

PBQmedium

You are connected to SW1 via the console. The network uses VLANs 10 (Sales) and 20 (Engineering). A new switch SW2 is connected to SW1 via G0/1. You need to enable CDP to discover neighbor devices and verify that SW1 sees SW2. Currently, CDP is disabled globally.

Network Topology

Hints

•CDP is a Cisco proprietary protocol.
•The command to enable it globally is straightforward.
•After enabling, wait a few seconds for neighbor discovery.

A.Enable CDP globally with 'cdp run' and verify with 'show cdp neighbors'.

B.Enable CDP on interface G0/1 with 'cdp enable' and verify with 'show cdp neighbors'.

C.Enable CDP globally with 'cdp run' and verify with 'show cdp interface'.

D.Enable CDP globally with 'cdp enable' and verify with 'show cdp neighbors'.

AnswerA

solution

! SW1
cdp run

Why this answer

CDP is disabled globally with 'no cdp run'. Re-enabling with 'cdp run' allows SW1 to discover directly connected Cisco devices, including SW2. Option B is incorrect because interface-level 'cdp enable' requires CDP to already be enabled globally; since CDP is globally disabled, this command has no effect.

Option C is incorrect because 'show cdp interface' displays CDP parameters per interface, not the neighbor table; you need 'show cdp neighbors' to see discovered devices. Option D is incorrect because 'cdp enable' is not a valid global command; the correct global command is 'cdp run'.

Exam trap

Remember that CDP has both global and interface-level configuration. If CDP is disabled globally, interface-level commands have no effect. Always use 'cdp run' to enable globally and 'show cdp neighbors' to see neighbors.

Why the other options are wrong

Interface-level 'cdp enable' requires CDP to be enabled globally first; with global CDP disabled, this command is ineffective.

'show cdp interface' shows CDP status and counters on interfaces, not the list of neighboring devices; use 'show cdp neighbors' to see neighbors.

'cdp enable' is an interface command, not a global command; the global command to enable CDP is 'cdp run'.

210

Multi-Selectmedium

Which three of the following are characteristics of Layer 2 Ethernet switches that support VLANs? (Choose three.)

Select 3 answers

.They forward frames based on the destination MAC address.

.They can segment a LAN into multiple broadcast domains.

.They use ARP to resolve IP addresses to MAC addresses.

.They use the Spanning Tree Protocol to prevent Layer 2 loops.

.They perform routing between VLANs without a router.

.They forward frames based on the destination IP address.

Why this answer

Layer 2 Ethernet switches that support VLANs forward frames based on the destination MAC address, which is the fundamental switching decision. They can segment a LAN into multiple broadcast domains because each VLAN creates its own isolated broadcast domain, preventing unnecessary traffic propagation. They use the Spanning Tree Protocol (STP) to prevent Layer 2 loops by dynamically blocking redundant paths, ensuring a loop-free topology.

Exam trap

Cisco often tests the misconception that switches use ARP or that VLANs segment collision domains, when in fact VLANs segment broadcast domains and switches forward based on MAC addresses, not IP addresses.

Practice this question →

211

MCQmedium

A network administrator is configuring a new wireless LAN controller (WLC) and access points (APs). The APs are connected to switch ports that are configured as access ports in VLAN 10. The administrator wants the APs to obtain IP addresses from a DHCP server and then join the WLC. Which protocol does the AP use to discover the WLC's IP address?

A.DNS resolution of CISCO-CAPWAP-CONTROLLER

B.CAPWAP Discovery Request

C.LWAPP Discovery Request

D.DHCP Option 43

AnswerB

After obtaining an IP address, the AP uses CAPWAP (Control and Provisioning of Wireless Access Points) to discover and join the WLC. It sends a CAPWAP Discovery Request via broadcast or multicast to find the controller. The WLC responds, and the AP then establishes a CAPWAP tunnel. This is the standard protocol for AP-WLC communication. Thus, this is the correct answer.

Why this answer

Access points use CAPWAP to discover and join a wireless LAN controller. After getting an IP address, the AP sends CAPWAP Discovery Requests via broadcast or multicast. The WLC responds, and the AP establishes a CAPWAP tunnel.

DHCP Option 43 and DNS are methods to provide the WLC IP, but the protocol itself is CAPWAP. LWAPP is outdated. Therefore, CAPWAP Discovery Request is the correct answer.

Exam trap

The trap here is confusing the method of providing the WLC IP (like DHCP Option 43 or DNS) with the actual discovery protocol (CAPWAP).

Practice this question →

212

Drag & Dropmedium

Drag and drop the following steps into the correct order to configure a switch port for a VoIP phone (voice VLAN + data VLAN), an AP trunk, and a PoE-powered IoT device.

Drag or tap steps into the slots.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

First create VLANs, then assign data and voice VLANs to the phone port, configure the AP trunk, and lastly enable PoE on the IoT port.

Exam trap

The trap is that candidates may enable PoE too early or configure trunks before VLANs exist. Remember: VLANs must be created first, then assigned to ports, and PoE is typically enabled last.

Practice this question →

213

MCQmedium

PCs in VLAN 30 on SwitchA cannot reach servers in VLAN 30 on SwitchB. All other VLANs work across the trunk. What is the most likely cause?

A.The native VLAN is mismatched between the switches.

B.VLAN 30 should be configured as the native VLAN on both ends.

C.SwitchB must use ISL instead of 802.1Q.

D.VLAN 30 is not allowed on the trunk from SwitchA.

AnswerD

This is correct because the exhibit explicitly shows that VLAN 30 is absent from the allowed VLAN list on the trunk interface on SwitchA. For 802.1Q trunking, a VLAN must be permitted on both sides of the link; if it is missing from SwitchA's allowed list, that switch will not forward frames for VLAN 30 onto the trunk, breaking connectivity to the servers. The other VLANs are allowed and therefore work, isolating the issue to the missing VLAN 30 entry.

Why this answer

The trunk is up and carrying multiple VLANs, but VLAN 30 is missing from the allowed list on one side. Since SwitchA and SwitchB both need to permit VLAN 30 on the trunk, if SwitchA's allowed VLAN list does not include VLAN 30, traffic for that VLAN cannot cross. Native VLAN mismatch or ISL vs 802.1Q issues would affect all VLANs, not just VLAN 30.

Thus, the most likely cause is that VLAN 30 is not allowed on the trunk from SwitchA.

Exam trap

Be cautious of assuming native VLAN mismatches or protocol issues when the problem is specific to the allowed VLAN list.

Why the other options are wrong

This option is wrong because a native VLAN mismatch would typically affect all VLANs across the trunk, not just VLAN 30. In this scenario, only VLAN 30 is experiencing connectivity issues, indicating a different problem.

This option is wrong because configuring VLAN 30 as the native VLAN does not directly affect the ability of PCs in VLAN 30 on SwitchA to communicate with servers in VLAN 30 on SwitchB, especially if VLAN 30 is already properly configured on both switches.

SwitchB using ISL instead of 802.1Q is not relevant to the connectivity issue between VLAN 30 on SwitchA and SwitchB. The problem is likely due to VLAN 30 not being allowed on the trunk, not the encapsulation method used.

Practice this question →

214

MCQmedium

Users on VLAN 20 are not receiving IPv4 addresses from the centralized DHCP server at 10.50.0.10. Users in other VLANs are working normally. Based on the exhibit, which change should fix the issue for VLAN 20 clients?

A.Change the helper address on interface Vlan20 to 10.50.0.10.

B.Convert the VLAN 20 user ports to trunk mode.

C.Configure a default gateway on the user PCs manually.

D.Disable DHCP snooping on VLAN 20.

AnswerA

The DHCP server is not on VLAN 20, so the router interface Vlan20 must use the ip helper-address command to forward DHCP client broadcasts as unicasts to the actual DHCP server at 10.50.0.10. Without a correctly configured helper address, the DHCP messages never leave the local VLAN and clients remain unaddressed. This is the standard fix for a DHCP relay problem.

Why this answer

The SVI for VLAN 20 is forwarding DHCP requests to the wrong helper address. DHCP relay depends on the Layer 3 interface for that VLAN sending client broadcasts to the correct server. Trunks, access ports, and the DHCP pool name on the server are not the first issue shown here.

DHCP snooping can filter DHCP server replies on untrusted ports, but since other VLANs are working and no trust misconfiguration is indicated, the root cause is the incorrect ip helper-address on Vlan20.

Exam trap

A frequent exam trap is assuming that user ports must be trunks or that disabling DHCP snooping will fix DHCP address assignment issues. In reality, user ports should remain in access mode to maintain VLAN membership, and DHCP snooping is unrelated to this specific forwarding problem because the exhibit shows a misconfigured helper address while other VLANs function normally. Another common mistake is thinking that manually configuring a default gateway on clients solves DHCP problems, but DHCP discovery requires proper relay configuration on the Layer 3 interface.

Misconfiguring or omitting the ip helper-address on the VLAN interface causes DHCP requests to fail, which is the core issue here.

Why the other options are wrong

Disabling DHCP snooping is unnecessary because the other VLANs work, and the scenario does not indicate a trust misconfiguration; the real problem is the incorrect helper address on Vlan20.

Practice this question →

215

MCQhard

A switchport connected to another switch should carry multiple VLANs, but it was manually configured as an access port. What is the most likely operational result?

A.The link will not carry multiple VLANs as intended because an access port handles one VLAN only.

B.The switch automatically converts the access port into a proper trunk.

C.The port becomes a routed Layer 3 interface.

D.The VLANs are summarized into one prefix automatically.

AnswerA

An access port is configured to carry exactly one untagged VLAN—the port's assigned access VLAN—and it strips or rejects tags on ingress/egress. Therefore, traffic from multiple VLANs cannot traverse this inter-switch link, and frames from VLANs other than the access VLAN are dropped or not forwarded as intended. To support multiple VLANs between switches, the port must be configured as a trunk using switchport mode trunk.

Why this answer

An access port is designed to carry only a single VLAN. If the link is intended to carry multiple VLANs, it must be configured as a trunk. The switch will not automatically convert the port to a trunk (B).

The port remains a Layer 2 access port, not a routed Layer 3 interface (C). VLANs are not automatically summarized into a single prefix (D). The most likely result is that the link will not carry multiple VLANs as intended.

Exam trap

Beware of confusing automatic port mode changes with manual configurations. Access ports do not auto-convert to trunk mode.

Why the other options are wrong

Switches do not automatically convert an access port to a trunk; manual configuration is required.

An access port remains a Layer 2 interface; it does not become a routed Layer 3 interface.

VLANs operate at Layer 2 and are not automatically summarized into a single prefix; that would be a routing function.

Practice this question →

216

MCQhard

A network engineer notices that Host A in VLAN 10 (10.10.10.50/24) can successfully ping its default gateway 10.10.10.1, but cannot ping the VLAN 20 SVI (10.20.20.1) or any hosts in VLAN 20. The SVIs for both VLAN 10 and VLAN 20 are in an up/up state, and the switch's trunk ports are correctly allowing both VLANs. What is the most likely cause?

A.The ip routing global configuration command is missing.

B.The VLAN 20 SVI is administratively shut down.

C.The trunk between the access switch and the Layer 3 switch is misconfigured as an access port.

D.The default gateway on Host A is configured incorrectly.

AnswerA

The 'ip routing' global configuration command is what enables IPv4 forwarding between VLANs on a multilayer switch. With SVIs created and IP addresses assigned, the switch can answer pings to those addresses for local subnet traffic, but it will not route packets between VLANs unless 'ip routing' is enabled. Since Host A can successfully ping 10.10.10.1 (its own SVI gateway) but fails to reach Host B on VLAN 20, the missing command precisely explains the failure: the switch is essentially acting as a host on each VLAN rather than a router.

Why this answer

Host A can reach its default gateway (10.10.10.1), which is the VLAN 10 SVI, but cannot reach the VLAN 20 SVI (10.20.20.1) or any hosts in VLAN 20. This indicates that Layer 2 connectivity is working (trunk allows both VLANs, SVIs are up/up), but inter-VLAN routing is failing. On a multilayer switch, inter-VLAN routing requires the global command 'ip routing' to enable the switch's IP routing engine; without it, the switch acts as a Layer 2 device only and cannot forward packets between different VLANs.

Exam trap

Cisco often tests the distinction between a switch operating as a Layer 2 device versus a Layer 3 device, and the trap here is that candidates assume SVIs in an up/up state automatically provide inter-VLAN routing, forgetting the mandatory 'ip routing' command.

Why the other options are wrong

Candidates may overlook the explicit mention that the SVIs are up/up, mistakenly thinking a shut SVI could be the problem.

Trunk misconfiguration is a common inter-VLAN issue, but the scenario explicitly says the trunks are working properly, making this answer invalid.

The successful ping to the default gateway proves the gateway is correct. Without 'ip routing', the switch can't forward packets from VLAN 10 to VLAN 20, but it can respond to local VLAN requests.

Practice this question →

217

PBQhard

You are connected to R1. The network consists of R1, SW1, and two hosts (Host-A on VLAN 10, Host-B on VLAN 20). SW1 has two access ports (one per VLAN) and a trunk to R1. Configure R1 for router-on-a-stick inter-VLAN routing. The current configuration has a native VLAN mismatch and a missing subinterface for VLAN 20. Fix these issues so that Host-A and Host-B can ping each other.

Hints

•Check if all required subinterfaces are present.
•Examine the native VLAN on the trunk.
•Verify that IP routing is enabled globally.

A.Configure interface G0/0.20 with encapsulation dot1Q 20 and IP address 192.168.20.1 255.255.255.0, set native VLAN to 1 on the trunk, and enable ip routing.

B.Configure interface G0/0.20 with encapsulation dot1Q 20 and IP address 192.168.20.1 255.255.255.0, set native VLAN to 99 on the trunk, and enable ip routing.

C.Configure interface G0/0.20 with encapsulation dot1Q 20 and IP address 192.168.20.1 255.255.255.0, set native VLAN to 1 on the trunk, but do not enable ip routing.

D.Configure interface G0/0.20 with encapsulation dot1Q 20 and IP address 192.168.20.1 255.255.255.0, set native VLAN to 99 on the trunk, and do not enable ip routing.

AnswerA

solution

! R1
configure terminal
interface GigabitEthernet0/0.20
encapsulation dot1Q 20
ip address 192.168.20.1 255.255.255.0
exit
interface GigabitEthernet0/0
no encapsulation dot1Q 99
exit
ip routing
end

Why this answer

The native VLAN mismatch exists: R1 expects native VLAN 99, but SW1 likely uses native VLAN 1 (default). This causes CDP/STP issues but not directly inter-VLAN routing; however, for proper operation, set native VLAN to 1 on R1. Additionally, the subinterface for VLAN 20 is missing, so traffic from VLAN 20 cannot be routed.

Finally, 'ip routing' is disabled, preventing any inter-VLAN routing. Solution: change native VLAN on trunk to 1, create subinterface G0/0.20 with encapsulation dot1Q 20 and IP 192.168.20.1/24, and enable ip routing.

Exam trap

Be careful to identify all issues in the scenario. Candidates often focus only on the missing subinterface and forget to check the native VLAN mismatch and the global 'ip routing' command. Always verify that routing is enabled and that native VLANs match on both ends of the trunk.

Why the other options are wrong

The native VLAN mismatch is not resolved; the switch likely uses native VLAN 1, so R1 should also use 1 or both sides must be configured consistently.

IP routing is disabled by default on Cisco routers; it must be explicitly enabled for the router to perform routing functions.

Two errors: native VLAN mismatch persists and IP routing is disabled, so packets cannot be routed between VLANs.

Practice this question →

218

MCQhard

A PC connected to SW1 cannot reach the default gateway. The access port is assigned to VLAN 20, and the switch output shows that VLAN 20 is inactive. What is the most likely cause?

A.Port security has shut down the interface

B.VLAN 20 does not exist or is not active on the switch

C.The port must be converted to a trunk

D.The default gateway must be configured on the physical switch port

AnswerB

VLAN 20 must exist in the switch's VLAN database and be enabled (not shutdown) for the access port to forward frames. The exhibit's output indicates VLAN 20 is inactive, so the switch will not deliver the PC's frames to the default gateway in that VLAN. As a result, the PC cannot reach the gateway even if its IP address and gateway settings are correct.

Why this answer

The port is operationally up, but VLAN 20 is listed as inactive because that VLAN does not exist in the VLAN database. An access port assigned to a missing VLAN will not carry normal user traffic for that VLAN.

Exam trap

Ensure the VLAN is created and active in the VLAN database when troubleshooting connectivity issues.

Why the other options are wrong

This option is wrong because the question specifies that the PC cannot reach the default gateway due to VLAN issues, not because of port security settings. Port security would typically result in the interface being in an error-disabled state, which is not indicated here.

This option is incorrect because converting the port to a trunk would not resolve the issue of the PC not reaching the default gateway if VLAN 20 is not configured or active. The problem lies in the VLAN configuration, not the port type.

This option is incorrect because the default gateway is typically configured on the device (e.g., a router or PC) rather than on the switch port itself. The issue in the question pertains to VLAN configuration, not gateway settings.

Practice this question →

219

PBQmedium

You are connected to SW1, a Layer 2 switch. Port G0/1 connects to a PC in VLAN 10. Management requires that only one MAC address is allowed on this port, and if a violation occurs, the port should shut down and a log message should be generated. Additionally, you need to ensure that the port enables rapidly and does not wait for STP convergence. Currently, the PC has MAC address aaaa.bbbb.cccc.

Network Topology

Hints

•Port security must be enabled first.
•Use the 'mac-address' command to specify the allowed MAC.
•PortFast bypasses STP listening/learning for access ports.

A.switchport port-security; switchport port-security maximum 1; switchport port-security mac-address aaaa.bbbb.cccc; switchport port-security violation shutdown; spanning-tree portfast

B.switchport port-security maximum 1; switchport port-security mac-address aaaa.bbbb.cccc; switchport port-security violation restrict; spanning-tree portfast

C.switchport port-security maximum 1; switchport port-security mac-address aaaa.bbbb.cccc; switchport port-security violation protect; spanning-tree portfast

D.switchport port-security maximum 1; switchport port-security mac-address aaaa.bbbb.cccc; switchport port-security violation shutdown; no spanning-tree portfast

AnswerA

solution

! SW1
interface GigabitEthernet0/1
switchport port-security
switchport port-security maximum 1
switchport port-security mac-address aaaa.bbbb.cccc
switchport port-security violation shutdown
spanning-tree portfast

Why this answer

Option A is correct because it includes the mandatory 'switchport port-security' command that globally enables port security on the interface before any other port-security parameters can take effect. It sets the maximum MAC count to 1, statically binds the PC's MAC (aaaa.bbbb.cccc), configures the violation mode to shutdown (which err-disables the port and generates a syslog/SNMP log), and enables PortFast so the port transitions to forwarding immediately without waiting for STP convergence.

Exam trap

200-301 often tests whether candidates remember that 'switchport port-security' must be entered first — many candidates select an option that lists maximum/MAC/violation commands without the enabling command and lose the point.

Why the other options are wrong

The specific factual error: 'restrict' does not disable the port; it only filters traffic and logs the violation, but the port remains operational.

The specific factual error: 'protect' silently drops unauthorized traffic without logging or disabling the port.

The specific factual error: PortFast is required to bypass STP convergence; without it, the port will wait for STP to transition, causing delay.

220

MCQhard

After configuring DHCP snooping on VLAN 10 to prevent rogue DHCP servers, all clients in the VLAN stop receiving DHCP offers from the legitimate DHCP server that is connected to port Gi0/1. The administrator verifies the DHCP server is operational and reachable. What should the technician do next?

A.Enable Dynamic ARP Inspection on VLAN 10.

B.Configure interface Gi0/1 as a DHCP snooping trusted port.

C.Add an ip helper-address on the VLAN 10 SVI pointing to the DHCP server.

D.Reconfigure the DHCP server scope to include DHCP Option 82.

AnswerB

DHCP snooping treats all ports as untrusted by default and drops DHCP server messages (OFFER, ACK) that arrive on untrusted ports. The DHCP server is connected to interface Gi0/1, so the switch is currently dropping its valid reply. By configuring Gi0/1 as a DHCP snooping trusted port, the switch will forward DHCP offers and acknowledgments from that port, allowing clients on VLAN 10 to obtain addresses while still protecting against rogue DHCP servers on other ports.

Why this answer

DHCP snooping, by default, treats all ports as untrusted and drops DHCP server messages (OFFER, ACK) received on untrusted ports. Since the legitimate DHCP server is connected to Gi0/1, that port must be explicitly configured as a DHCP snooping trusted port using the 'ip dhcp snooping trust' interface command to allow DHCP server responses to reach clients.

Exam trap

Cisco often tests the default behavior of DHCP snooping where all ports are untrusted, and the trap is that candidates may think the issue is a routing problem (ip helper-address) or a server-side configuration (Option 82) rather than recognizing the need to mark the server-facing port as trusted.

Why the other options are wrong

Misunderstanding that DAI controls DHCP traffic rather than ARP packets.

Assuming DHCP snooping introduces routing changes or that the server is on a different subnet.

Confusing DHCP snooping with DHCP relay agent functionality and option 82 insertion.

Practice this question →

221

MCQhard

A network engineer notices that after adding a new switch to the network, a different switch unexpectedly becomes the STP root bridge, disrupting all VLANs. The new switch has the default priority (32768) but has a lower MAC address than all existing switches. What is the most likely cause?

A.The new switch is running PVST+ while the existing switches use Rapid PVST+

B.Root Guard is enabled on the new switch’s uplink ports facing the existing root

C.The existing root bridge has a bridge priority lower than the default value of 32768

D.The new switch was added with a bridge priority of 4096

AnswerC

If the existing root bridge’s priority is less than 32768 (e.g., 4096 or 0), its Bridge ID is lower than the new switch’s default 32768 + lower MAC. STP always elects the switch with the lowest Bridge ID as the root bridge. Thus, despite the new switch’s lower MAC, the manually lowered priority keeps the existing switch as root.

Why this answer

The existing root bridge has a bridge priority lower than the default value of 32768, so even though the new switch has the default priority, its lower MAC address does not make it the root. STP elects the root bridge based on the lowest bridge ID (priority + MAC address). Since the existing root already has a lower priority, it remains the root.

The new switch's lower MAC address only becomes a tiebreaker when priorities are equal, which is not the case here.

Exam trap

Cisco often tests the misconception that a lower MAC address alone can cause a root bridge change, but the trap here is that candidates forget the bridge priority is compared first, so a switch with default priority cannot outrank an existing root with a manually lowered priority.

Why the other options are wrong

Candidates may think that STP version incompatibility disrupts root election, but both versions use the same BPDU format and root election rules.

Candidates often associate Root Guard with preventing a switch from becoming the root. However, it does not cause another switch to become root; it just protects the network from unexpected superior BPDUs.

Candidates may confuse the symptom and think that a low priority on the new switch causes the problem, but this would make the new switch the root, not another switch.

Practice this question →

222

MCQmedium

A DHCP server is located on a different VLAN from the clients. Which feature is required so the clients can still receive addresses?

A.DHCP snooping

B.DHCP relay

C.Port security

D.NAT overload

AnswerB

DHCP relay is the correct solution because DHCP clients send broadcast DISCOVER messages, and routers do not forward broadcasts between VLANs. A relay agent such as an ip helper-address command on the router's SVI intercepts the broadcast, unicasts it to the DHCP server's IP, and relays the server's OFFER/ACK back to the client, enabling cross-subnet address assignment.

Why this answer

DHCP relay forwards client broadcasts to a remote server as unicast, typically using ip helper-address on the Layer 3 interface.

Exam trap

A common exam trap is selecting DHCP snooping as the solution for clients on different VLANs to receive DHCP addresses. DHCP snooping is a security mechanism that filters DHCP messages to prevent rogue servers but does not forward DHCP broadcasts across VLANs. Another tempting but incorrect choice is port security, which controls MAC address access on switch ports but does not affect DHCP broadcast forwarding.

NAT overload is unrelated to DHCP address assignment and only translates IP addresses for outbound traffic. The key misunderstanding is confusing DHCP relay’s role in forwarding broadcasts with security or address translation features.

Why the other options are wrong

DHCP snooping is a security feature that prevents unauthorized DHCP servers by filtering DHCP messages. It does not forward DHCP broadcasts across VLANs, so it cannot enable clients on different VLANs to receive addresses.

Port security restricts the number and identity of MAC addresses on switch ports to enhance security. It does not affect DHCP broadcast forwarding or enable clients to receive addresses from servers on different VLANs.

NAT overload translates multiple private IP addresses to a single public IP address for outbound traffic. It does not address the issue of forwarding DHCP broadcasts between VLANs or enable DHCP clients to obtain addresses from remote servers.

Practice this question →

223

MCQhard

Two switches are connected via an IEEE 802.1Q trunk. Hosts in VLAN 30 on opposite sides cannot communicate, yet hosts in VLAN 10 communicate normally. Both switches have VLAN 30 in their VLAN database, and the trunk link is operational. What is the most likely cause?

A.VLAN 30 is pruned or not allowed on one side of the trunk

B.The native VLAN must be set to 30

C.STP blocks all VLANs on the trunk when one VLAN fails

D.The trunk must be changed to access mode for VLAN 30

AnswerA

VLAN 30 is either pruned via VTP pruning or excluded by the switchport trunk allowed vlan list on at least one of the interconnected switches. Because the 802.1Q trunk carries VLAN 10 successfully, the physical link and trunk parameters are operational, but VLAN 30's frames are deliberately filtered before crossing the trunk, so hosts in VLAN 30 experience complete connectivity loss while VLAN 10 remains unaffected.

Why this answer

If a VLAN is not allowed on one side of the trunk, frames for that VLAN are dropped even though other VLANs continue to work. Option A correctly identifies that VLAN 30 is either pruned or missing from the allowed list on one end. Option B is wrong because the native VLAN only affects untagged frames and would not cause the filtering of a tagged VLAN like VLAN 30.

Option C is incorrect because STP can block individual VLANs per port, but it does not block all VLANs on a trunk due to a single VLAN’s issue—only the affected VLAN would be blocked. Option D is invalid because converting the trunk to access mode would break all VLAN trunking, including the working VLAN 10.

Exam trap

Ensure you check the trunk configuration for allowed VLANs, not just VLAN existence or port assignments.

Why the other options are wrong

The native VLAN setting only governs untagged traffic on the trunk, not the tagged frames of VLAN 30, so it cannot fix a missing allowed VLAN.

STP does not globally block all VLANs on a trunk; per‑VLAN spanning tree can block individual VLANs, but a single VLAN failure would not cause the trunk to block all traffic.

Changing the trunk to access mode would restrict the link to a single VLAN, breaking VLAN 10 connectivity as well, which contradicts the working state of VLAN 10.

Practice this question →

224

Multi-Selectmedium

Which TWO statements correctly describe the configuration and use of a voice VLAN on a Cisco switch port?

Select 2 answers

A.The voice VLAN is configured using the 'switchport mode trunk' command.

B.When a voice VLAN is configured, the switch port operates in two VLANs: one for data and one for voice traffic.

C.The voice VLAN must be the same as the native VLAN on the trunk link.

D.The IP phone uses CDP or LLDP to learn the voice VLAN ID from the switch.

E.The data VLAN and voice VLAN must be in the same IP subnet.

AnswersB, D

With a voice VLAN configured, a single physical switchport simultaneously carries data and voice traffic by operating as an access port for the data VLAN and accepting tagged frames on the voice VLAN. The switch sets the port to 'switchport mode access' with 'switchport access vlan' for data and 'switchport voice vlan' for voice, so the port effectively bridges two separate VLANs. This is why a PC connected through an IP phone still gets an untagged data VLAN assignment while the phone's traffic is tagged with the voice VLAN ID.

Why this answer

When a voice VLAN is configured on a Cisco switch port, the port operates in two separate VLANs simultaneously: one for data traffic (the access VLAN) and one for voice traffic (the voice VLAN). This is achieved using the 'switchport voice vlan' command, which allows the switch to tag voice frames with the voice VLAN ID while leaving data frames untagged (or tagged with the access VLAN). This separation ensures that voice traffic receives appropriate QoS treatment and is isolated from data traffic.

Exam trap

Cisco often tests the misconception that a voice VLAN requires trunking or that the voice VLAN must match the native VLAN, but in reality, a voice VLAN is configured on an access port using the 'switchport voice vlan' command, and the native VLAN concept applies only to trunk ports.

Why the other options are wrong

Trunk mode is used to carry multiple VLANs, but for a single access port with voice, the port remains in access mode and uses the voice VLAN feature.

The native VLAN is used for untagged traffic on a trunk, while the voice VLAN is a specific VLAN that carries tagged voice traffic from the phone.

They are separate VLANs and usually belong to different subnets for logical separation and management.

Practice this question →

225

PBQeasy

You are connected to SW1, a Layer 2 switch. The network administrator wants to prevent unauthorized switches from being connected to access ports. Port G0/1 is an access port in VLAN 10. You need to configure BPDU Guard on this port to protect against STP loops caused by rogue switches. Additionally, enable PortFast for immediate transition to forwarding.

Hints

•PortFast should be applied to access ports to reduce STP convergence time.
•BPDU Guard disables the port if a BPDU is received.
•Both commands are under the interface configuration.

A.SW1(config-if)# spanning-tree portfast SW1(config-if)# spanning-tree bpduguard enable

B.SW1(config)# spanning-tree portfast default SW1(config)# spanning-tree bpduguard default

C.SW1(config-if)# spanning-tree portfast SW1(config-if)# spanning-tree guard root

D.SW1(config-if)# spanning-tree portfast SW1(config-if)# spanning-tree bpduguard disable

AnswerA

solution

! SW1
interface GigabitEthernet0/1
spanning-tree portfast
spanning-tree bpduguard enable

Why this answer

PortFast allows an access port to skip STP listening/learning and transition immediately to forwarding. BPDU Guard protects against STP loops by error-disabling the port if a BPDU is received, which would indicate an unauthorized switch connection.

Exam trap

Be careful to distinguish between interface-level and global commands for PortFast and BPDU Guard. Also, remember that BPDU Guard uses 'bpduguard enable' (not 'disable') and is different from Root Guard ('guard root').

Why the other options are wrong

The specific factual error is that global commands affect all ports, not a single interface.

The specific factual error is confusing Root Guard with BPDU Guard; they serve different purposes.

The specific factual error is using the 'disable' keyword instead of 'enable' to activate BPDU Guard.