Select Two (Multi-Select) Questions

A virtual switch does not support VLAN tagging.

Why wrong: Incorrect. Virtual switches support 802.1Q VLAN tagging for traffic segmentation.

A virtual switch performs routing between different subnets.

Why wrong: Incorrect. Virtual switches operate at Layer 2 only; routing requires a router or Layer 3 switch.

A virtual switch is a physical device installed in the hypervisor host.

Why wrong: Incorrect. A virtual switch is a software-based switch running within the hypervisor.

Change of Authorization (CoA)

Why wrong: CoA is used for mid-session policy changes, not a core TrustSec feature.

802.1X authentication

Why wrong: 802.1X is an authentication protocol, not a TrustSec feature.

MACsec encryption

Why wrong: MACsec provides encryption, not access control.

It runs a single spanning-tree instance for all VLANs.

Why wrong: Incorrect: That's MST; Rapid PVST+ runs per VLAN.

It eliminates the need for BPDUs.

Why wrong: Incorrect: BPDUs are still used for topology discovery.

It uses a separate root bridge per VLAN.

Why wrong: Incorrect: That's PVST+; Rapid PVST+ uses a single root per VLAN but not separate.

It supports only wired networks and not wireless.

Why wrong: Incorrect; it supports both.

It is a fully cloud-based solution with no on-premises components.

Why wrong: Incorrect; it has on-premises components.

It only displays network device health scores and does not provide path tracing.

Why wrong: Incorrect; it does provide path tracing.

RESTCONF supports the candidate datastore for editing configurations.

Why wrong: RESTCONF works only on the running datastore; candidate is supported by NETCONF.

NETCONF uses HTTP as its transport protocol.

Why wrong: NETCONF uses SSH as its transport, not HTTP.

RESTCONF and NETCONF both support JSON and XML encoding.

Why wrong: NETCONF uses XML only; RESTCONF supports both.

Increase AP transmit power to maximize coverage.

Why wrong: Higher power increases cell overlap and co-channel interference.

Enable 2.4 GHz band only to maximize range.

Why wrong: 2.4 GHz has limited channels and is more prone to interference.

Enable AAA authentication.

Why wrong: AAA is a broader framework.

Use the service password-encryption command.

Why wrong: Encrypts passwords but does not set enable password.

Configure login local on the console line.

Why wrong: This is for user authentication, not enable.

Different router IDs

Why wrong: Router IDs must be unique but not necessarily different? Actually they must be unique.

Same subnet mask

Why wrong: Subnet mask must match for broadcast links.

Root Guard

Why wrong: Root Guard prevents a switch from becoming root, but does not improve convergence.

BPDU Guard

Why wrong: BPDU Guard is a security feature to prevent rogue switches.

PortFast

Why wrong: PortFast is for immediate transition to forwarding on access ports, not for convergence after topology change.

Configure switchport mode dynamic auto on all ports.

Why wrong: Dynamic auto can negotiate trunk.

Set the native VLAN to VLAN 1 on all trunk ports.

Why wrong: VLAN 1 is default and does not mitigate.

Use 802.1Q trunking instead of ISL.

Why wrong: Both are susceptible; switching encapsulation is not a mitigation.

VDCs allow overlapping VLAN IDs across different VDCs only if using different VNIs.

Why wrong: VLAN IDs are local per VDC and do not require VNI mapping.

VDCs provide Layer 3 routing isolation by default across all VDCs.

Why wrong: Layer 3 isolation requires additional configuration.

VDCs are supported on all Cisco IOS-XE switches.

Why wrong: VDCs are specific to Nexus switches.

Eliminates the need for spanning-tree protocol.

Why wrong: Spine-leaf uses Layer 3 routing, so no spanning-tree is needed, but this is not a benefit? Actually it is a benefit, but let's keep consistent: the correct answer is B and D. C is not correct because it's not a benefit in the context of the question; it's a design characteristic.

Reduces the amount of cabling required.

Why wrong: Spine-leaf often requires more cabling than traditional three-tier.

Eliminates the need for firewall appliances.

Why wrong: Firewalls are still needed for security.

switchport mode dynamic auto

Why wrong: Auto mode waits for the neighbor to initiate trunking.

switchport mode access

Why wrong: Access mode disables trunking.

switchport trunk native vlan 1

Why wrong: This sets native VLAN but does not enable trunking.

The interfaces must be on the same physical switch.

Why wrong: HSRP works across switches.

The interfaces must have the same IP address.

Why wrong: They use a virtual IP, not the same interface IP.

NETCONF sessions are stateless

Why wrong: NETCONF sessions are stateful; they maintain a connection and a session ID.

YANG defines both the data model and the RPC operations for network devices

Why wrong: YANG defines data models; RPCs are defined separately (e.g., in YANG also, but not exclusively).

NETCONF uses TLS as the mandatory transport protocol

Why wrong: NETCONF uses SSH as the mandatory transport; TLS is optional.

Increased security by eliminating the need for SSH access

Why wrong: Automation often requires SSH; security depends on implementation.

Lower initial investment compared to manual processes

Why wrong: Automation often requires upfront investment in tools and training.

It uses IPsec to encrypt traffic between network devices.

Why wrong: CTS uses MACsec, not IPsec.

It uses VLANs to segment traffic based on security roles.

Why wrong: Segmentation is via SGTs, not VLANs.

Increased number of single points of failure

Why wrong: Spine-leaf eliminates single points of failure if redundant spines and leaves are used.

Increased broadcast domain size

Why wrong: Spine-leaf typically uses Layer 3 at spine, reducing broadcast domains.

Reduced need for VLANs

Why wrong: VLAN usage is not directly reduced; it's a design choice.

Wireless access points must be directly connected to the fabric edge switches.

Why wrong: Wireless can be integrated using SD-Access Wireless, but APs do not have to be directly connected to fabric edge.

Fabric edge nodes are responsible for connecting the fabric to external networks.

Why wrong: Fabric border nodes connect to external networks, not edge nodes.

The fabric uses VLANs to isolate tenant traffic.

Why wrong: SD-Access uses VRFs and VXLAN network IDs (VNIs) for isolation, not VLANs.

Each member switch must have the same hardware model.

Why wrong: While recommended, it is not strictly required; however, mixing models may limit features.

It requires dedicated stacking cables for interconnectivity.

Why wrong: StackWise virtual can use standard Ethernet interfaces for the stack links.

It supports up to 9 member switches in a stack.

Why wrong: The maximum number of members is typically 8 for StackWise virtual (e.g., Catalyst 9000 series).