Network Access

400 questions

Question 241Question

A network administrator needs to create a new Wireless LAN (WLAN) on a Cisco Wireless LAN Controller (WLC) using the GUI to allow client connectivity. Arrange the steps required to configure and activate the new WLAN in the correct sequential order.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order to create and activate a WLAN via the Cisco WLC GUI is: 1) Navigate to the WLANs tab and select 'Create New', 2) Define the Profile Name, SSID, and mapped Interface under the General tab, 3) Select Layer 2 security settings under the Security tab, and 4) Select the Status checkbox under the General tab and click Apply to enable client connections.
When configuring a WLAN via the Cisco WLC GUI, the administrator must first create the new WLAN entry from the WLANs menu. Next, the Profile Name, SSID, and Interface mapping are set under the General tab. After that, authentication methods (such as PSK or 802.1X) are selected under the Security tab. Finally, the Status checkbox under the General tab is enabled and applied to begin broadcasting the network to client devices.

Step-by-Step Solution

1
Initiate WLAN creation in WLC GUI
WLAN creation page is displayed
Selecting 'Create New' under the WLANs menu starts the creation process.
2
Configure basic parameters and interface mapping
WLAN identity and network binding are defined
Setting the Profile Name, SSID, and Interface/Interface Group binds the WLAN to the correct network segment.
3
Configure security options
WLAN security and authentication parameters are set
Security parameters under the Security tab define how clients authenticate and encrypt traffic.
4
Enable WLAN Status and apply changes
WLAN becomes active and broadcasts the SSID to clients
Checking the Status box enables the WLAN profile on the controller.

Key Concept

WLC GUI WLAN Configuration Sequence
Estimated Time:1m 0s
Question 242Question

A network engineer is configuring network interfaces on a Cisco Wireless LAN Controller (WLC) to support enterprise wireless operations and administrative access. Which two statements accurately describe the operational roles and switch connectivity requirements of the WLC Management Interface compared to the Service Port? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: The Management Interface terminates CAPWAP tunnels for lightweight AP communication and supports in-band administrative access via web GUI and SSH.; The Management Interface typically connects through a distribution port to an 802.1Q trunk port on the switch to transport tagged VLAN traffic.

Answer

The WLC Management Interface terminates CAPWAP tunnels for lightweight AP communication while supporting in-band management, and it connects through a distribution port to an 802.1Q trunk port on the switch to transport tagged VLAN traffic.
The WLC Management Interface handles in-band management duties (GUI, SSH, SNMP) as well as CAPWAP control and data tunnel termination between APs and the controller. Because it resides on the WLC distribution port array, it connects to standard 802.1Q switch trunk ports configured with specific VLAN tags.

Step-by-Step Solution

1
Identify the primary functions of the WLC Management Interface.
The Management Interface is an in-band logical interface used for administrative access (HTTP/HTTPS, SSH, SNMP) as well as establishing CAPWAP control and data tunnels with joined Access Points.
It acts as the default gateway address for controller communications across the enterprise network.
2
Analyze switchport connectivity for distribution system interfaces.
WLC distribution ports connect to switch ports configured as 802.1Q trunks so multiple logical interfaces (Management and Dynamic VLANs) can share physical links.
Trunking allows tagged frame transport across the underlying wired infrastructure.
3
Evaluate the Service Port constraints to eliminate incorrect options.
The Service Port is an out-of-band interface on an isolated physical port used for initial setup and recovery; it does not process CAPWAP traffic nor support 802.1Q VLAN trunking.
Distinguishing between in-band distribution interfaces and out-of-band physical interfaces ensures correct interface and trunking configurations.

Key Concept

WLC Management Interface vs. Service Port Operational Roles
Question 243Question

A network administrator configures an IEEE 802.1Q trunk link between two Cisco Catalyst switches. The trunk interface is configured to carry traffic for VLAN 10 (Data), VLAN 20 (configured as the native VLAN), and VLAN 30 (Voice). Which two statements accurately describe how traffic is processed over this trunk connection?

Select all that apply

Show answer & explanation

Answer: Frames belonging to VLAN 10 and VLAN 30 have a 4-byte 802.1Q header inserted into the Ethernet frame prior to transmission across the trunk.; Frames belonging to VLAN 20 are transmitted untagged across the trunk link under default 802.1Q operational behavior.

Answer

The two correct statements are that frames belonging to VLAN 10 and VLAN 30 have a 4-byte 802.1Q header inserted into the Ethernet frame, and frames belonging to VLAN 20 are transmitted untagged across the trunk link under default 802.1Q operational behavior.
IEEE 802.1Q trunking inserts a 4-byte header into frames belonging to tagged VLANs (such as VLAN 10 and VLAN 30) so recipient switches can identify their origin. Additionally, under standard 802.1Q operation, traffic belonging to the configured native VLAN (VLAN 20) is transmitted across the trunk link without a tag.

Step-by-Step Solution

1
Analyze standard IEEE 802.1Q encapsulation mechanics for tagged VLANs.
Frames belonging to non-native VLANs (VLAN 10 and VLAN 30) are tagged with a 4-byte 802.1Q header containing the Tag Protocol Identifier (TPID) and Tag Control Information (TCI).
802.1Q uses internal tagging to preserve VLAN identification across switch interconnects.
2
Evaluate the treatment of the designated native VLAN on an 802.1Q trunk link.
Frames associated with VLAN 20 (the native VLAN) are sent without an 802.1Q tag under default switch configurations.
IEEE 802.1Q natively supports untagged frames for backward compatibility with non-tagging legacy devices.
3
Evaluate ingress processing of untagged frames and native VLAN allowed list behavior.
Untagged ingress frames are mapped directly to the native VLAN rather than being dropped, and altering the native VLAN setting does not automatically prune VLAN 1.
Receptive untagged traffic maps directly to the port's native VLAN ID, while allowed VLAN lists require explicit configuration modifications.

Key Concept

802.1Q Trunking Frame Tagging and Native VLAN Operations
Question 244Question

A Cisco switch running Rapid PVST+ receives BPDUs on multiple interfaces from neighboring switches leading toward the Root Bridge. Place the tie-breaking criteria in the exact sequential order (from first evaluated to last evaluated) that the switch processes to elect its single Root Port.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequential order for Rapid PVST+ Root Port election tie-breakers is: 1. Lowest cumulative Root Path Cost to the Root Bridge, 2. Lowest Designated (upstream neighbor) Bridge ID (BID), 3. Lowest Designated (upstream neighbor) Port Priority, 4. Lowest Designated (upstream neighbor) Port Number, 5. Lowest local (receiving) Port ID on the evaluating switch.
When electing a Root Port, Rapid PVST+ follows a strict hierarchical evaluation of BPDU criteria: 1) Lowest cumulative path cost to the root bridge, 2) Lowest transmitting neighbor Bridge ID, 3) Lowest transmitting neighbor port priority, 4) Lowest transmitting neighbor port number, and 5) Lowest local receiving port ID. Local interface parameters are evaluated last because upstream BPDU parameters take precedence.

Step-by-Step Solution

1
Evaluate the cumulative path cost
The switch calculates the sum of port costs along the path to the Root Bridge. The port receiving the lowest total cost becomes the Root Port candidate.
Path efficiency to the Root Bridge is the primary metric for spanning-tree forwarding path selection.
2
Compare upstream neighbor Bridge IDs
If cumulative path costs are equal, compare the sending switch's Bridge ID (Bridge Priority + System ID Extension + MAC Address).
Paths connected to a superior upstream bridge take precedence.
3
Compare upstream neighbor Port Priority
If BPDUs are received from the same upstream neighbor over parallel links, compare the neighbor's Port Priority value (default 128).
Upstream administrators can influence downstream port selection by modifying port priority on the transmitting end.
4
Compare upstream neighbor Port Number
If neighbor port priorities match, compare the numerical interface index of the neighbor's transmitting interface (e.g., GigabitEthernet0/1 vs GigabitEthernet0/2).
Lower interface numbers on the neighbor take precedence when priorities are equal.
5
Compare local receiving Port ID
If all upstream BPDU fields are identical (such as when connected to an shared medium like an unmanaged hub), evaluate the local receiving switch's Port ID (Priority then Port Number).
The local receiving port ID serves as the absolute final tie-breaker because no upstream BPDU fields can differentiate the paths.

Key Concept

Rapid PVST+ Root Port Election Sequence
Question 245Question

An enterprise desktop administrator reports that newly provisioned Linux endpoints attached to switch port GigabitEthernet0/1 consistently fail to receive an IPv4 address via DHCP during system startup. However, if the DHCP client service is manually restarted 40 seconds after the operating system boots, an address is acquired successfully. The switch port is configured as a standard 802.1D access port. Which interface configuration command combination immediately resolves the boot-time DHCP timeout while ensuring the switch port is protected against unauthorized switches creating Layer 2 loops?

Show answer & explanation

Answer: Configure 'spanning-tree portfast' together with 'spanning-tree bpduguard enable' on GigabitEthernet0/1.

Answer

The correct option specifies configuring 'spanning-tree portfast' along with 'spanning-tree bpduguard enable' directly on the edge access interface.
Enabling PortFast on access port GigabitEthernet0/1 causes the switch port to immediately transition from the Disabled/Blocking state directly into the Forwarding state when the physical link comes UP. This eliminates the 30-second 802.1D delay (15s Listening + 15s Learning), allowing the host's initial boot-time DHCP Discover request to pass through successfully. Furthermore, enabling BPDU Guard on the interface adds loop prevention: if a user plugs an unauthorized switch into GigabitEthernet0/1, the port receives BPDUs and is automatically placed into an err-disabled state.

Step-by-Step Solution

1
Analyze the cause of the host DHCP timeout during bootup.
Standard 802.1D STP forces a newly connected link to pass through Listening (15 seconds) and Learning (15 seconds) states before reaching Forwarding (total 30 seconds delay). During this 30-second window, data frames including DHCP Discover messages are dropped.
Host operating systems typically issue DHCP requests immediately upon link UP and time out before STP transitions the port to Forwarding.
2
Determine the STP feature required to bypass listening and learning delays.
Cisco STP PortFast allows edge ports connected to single end-user devices to immediately enter the Forwarding state upon link UP.
PortFast bypasses the 30-second convergence delay, allowing instant frame transmission for DHCP initialization.
3
Identify the protection mechanism to prevent Layer 2 loops if a switch is plugged into a PortFast port.
STP BPDU Guard disables the PortFast-enabled port (placing it in err-disable state) upon receiving any BPDU frame.
Because PortFast ports transition directly to Forwarding without standard convergence analysis, receiving a BPDU indicates a potential switch or bridge attachment that could form a Layer 2 loop.

Key Concept

STP PortFast Immediate Forwarding and BPDU Guard Security Mechanics
Question 246Question

A network technician needs to configure a new VLAN and assign a switch interface to it on a Cisco Catalyst switch. Arrange the following Cisco IOS commands in the correct sequence to create VLAN 20 and configure interface GigabitEthernet0/2 as a static access port in VLAN 20, starting from global configuration mode.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence from global configuration mode is first creating the VLAN with 'vlan 20', entering interface configuration mode with 'interface gigabitethernet 0/2', setting the operational mode to access with 'switchport mode access', and finally assigning the interface to the VLAN with 'switchport access vlan 20'.
The proper administrative workflow in Cisco IOS requires creating or defining the VLAN in global configuration mode, entering the target interface configuration context, defining the administrative port state as an access port using 'switchport mode access', and specifying the access VLAN membership using 'switchport access vlan 20'.

Step-by-Step Solution

1
Create VLAN 20 in global configuration mode.
Executes 'vlan 20' to instantiate the VLAN and enter config-vlan submode.
Creating the VLAN first ensures the VLAN exists in the Layer 2 database.
2
Enter target interface configuration mode.
Executes 'interface gigabitethernet 0/2' to transition to config-if submode.
Interface parameters must be modified within the specific interface context.
3
Configure the port as a Layer 2 access port.
Executes 'switchport mode access' to turn off DTP negotiation for trunking.
Setting the administrative mode to access enforces single-VLAN membership.
4
Assign the port to VLAN 20.
Executes 'switchport access vlan 20' to bind interface traffic to VLAN 20.
This command places untagged frames received on GigabitEthernet0/2 into VLAN 20.

Key Concept

Cisco IOS VLAN configuration and interface access mode sequence
Estimated Time:45s
Question 247Question

Place the tie-breaker criteria used by a non-root switch running Rapid PVST+ to select its Root Port in the correct order, from first evaluated (highest priority) to last evaluated (lowest priority).

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct evaluation sequence for electing a Root Port is: 1) Lowest cumulative root path cost, 2) Lowest sender Bridge ID, 3) Lowest sender port priority, and 4) Lowest sender port number.
When a non-root switch receives BPDUs across multiple active interfaces, it runs the Rapid PVST+ Root Port election process in a strict sequential order: first, it selects the port with the lowest cumulative root path cost. If path costs are equal, it compares the neighbor Bridge IDs and picks the lowest. If multiple connections lead to the same neighboring switch, it compares the sender's port priority, and finally breaks any remaining tie using the sender's lowest port number.

Step-by-Step Solution

1
Identify the primary metric for Root Port selection in Rapid PVST+.
The switch evaluates the total path cost (cumulative root path cost) to reach the Root Bridge.
STP prioritizes forwarding traffic across the most direct/highest bandwidth path available.
2
Determine the tie-breaker when path costs from multiple interfaces are equal.
The switch evaluates the Bridge ID of the neighboring (sender) switches.
If equal-cost paths exist through different upstream switches, preferring the neighbor with the lower BID ensures determinism.
3
Determine the tie-breaker when parallel links connect to the exact same upstream neighbor switch.
The switch compares the Port Priority value advertised by the sending switch interface.
Port priority is configured on the upstream switch to influence path selection on downstream switches.
4
Identify the final tie-breaker when all upstream port priorities are identical.
The switch selects the link connected to the lowest physical port number on the upstream sender switch.
This guarantees a deterministic, unambiguous decision even when default configurations are unchanged.

Key Concept

Rapid PVST+ Root Port Election Tie-Breaker Decision Tree
Question 248Question

When creating a new Wireless LAN (WLAN) on a Cisco Wireless LAN Controller (WLC) using the web GUI, under which tab within the WLANs Edit menu is Pre-Shared Key (PSK) authentication configured for WPA2-Personal wireless clients?

Show answer & explanation

Answer: Security tab

Answer

The Security tab is used to configure WPA2-Personal Pre-Shared Key (PSK) authentication on a Cisco Wireless LAN Controller GUI.
In the Cisco WLC web GUI, all Layer 2 and Layer 3 security protocols—including WPA2-Personal Pre-Shared Key (PSK) and WPA2-Enterprise (802.1X)—are configured under the Security tab of the WLANs > Edit page.

Step-by-Step Solution

1
Navigate to the WLANs menu in the Cisco WLC GUI and select the target WLAN ID.
The WLANs > Edit page opens with several configuration tabs (General, Security, AAA Servers, QoS, Advanced).
Different WLAN parameters are segregated into functional tabs.
2
Select the Security tab and sub-tab Layer 2.
Layer 2 security mechanisms such as WPA+WPA2 are displayed.
Pre-Shared Key (PSK) is a Layer 2 security mechanism under the WPA/WPA2 policy.
3
Enable WPA2 Policy and set Auth Key Management to PSK, then enter the pre-shared key format and key value.
Client connectivity is configured to require the specified PSK for WPA2-Personal association.
This establishes client authentication criteria for the wireless network.

Key Concept

Cisco WLC GUI WLAN Security Configuration
Estimated Time:45s
Question 249Question

An administrator is configuring a trunk link between two Cisco Catalyst switches. Interface GigabitEthernet0/1 on Switch-1 is configured with `switchport mode dynamic auto` and `switchport trunk native vlan 50`. The connected interface GigabitEthernet0/1 on Switch-2 is configured with `switchport mode dynamic desirable` and `switchport trunk native vlan 10`. Which outcome will occur on this interswitch link?

Show answer & explanation

Answer: The trunk link forms successfully, but CDP logs periodic native VLAN mismatch error messages, and untagged traffic on VLAN 50 from Switch-1 will leak into VLAN 10 on Switch-2.

Answer

The interswitch link negotiates successfully into an 802.1Q trunk state because dynamic auto paired with dynamic desirable forms a trunk. However, because the native VLAN numbers do not match across switches, untagged traffic sent by Switch-1 on VLAN 50 will be treated as belonging to VLAN 10 by Switch-2, and CDP will log continuous native VLAN mismatch warnings.
When configuring DTP, pairing dynamic auto with dynamic desirable successfully forms an operational trunk. However, IEEE 802.1Q leaves native VLAN frames untagged. Switch-1 sends VLAN 50 traffic untagged, while Switch-2 interprets all incoming untagged traffic as belonging to its native VLAN (VLAN 10), leading to cross-VLAN traffic leakage and CDP logging native VLAN mismatch warnings.

Step-by-Step Solution

1
Analyze DTP negotiation modes between Switch-1 and Switch-2.
Dynamic auto (passive waiting) combined with dynamic desirable (active requesting) results in an operational trunk link.
DTP modes determine whether the port becomes an access or trunk port regardless of VLAN tagging options.
2
Analyze IEEE 802.1Q native VLAN behavior across the link.
Untagged frames sent from VLAN 50 on Switch-1 cross the link without an 802.1Q header and are ingested into VLAN 10 by Switch-2.
802.1Q does not tag frames belonging to the configured native VLAN of the transmitting switch interface.
3
Evaluate CDP control plane protocol alerts.
CDP exchanges native VLAN information via TLVs and generates console log warnings while leaving the interface in the forwarding state.
CDP identifies configuration mismatches between neighbors but does not automatically err-disable the port.

Key Concept

802.1Q DTP Negotiation Mechanics and Native VLAN Mismatch Consequences
Estimated Time:1m 30s
Question 250Question

A network administrator is deploying switch configurations for end-user workstation ports in an enterprise network. Which two statements correctly describe the operational benefits and state transition changes when Cisco STP PortFast is enabled on an access interface?

Select all that apply

Show answer & explanation

Answer: The switch port bypasses the 802.1D Listening and Learning states, transitioning immediately from Blocking to Forwarding upon link bring-up.; Link state changes on the interface do not trigger Topology Change Notifications (TCNs) sent across the Spanning Tree domain.

Answer

PortFast allows an access interface to bypass the Listening and Learning states to transition immediately to Forwarding, and it prevents interface status changes from generating Topology Change Notifications (TCNs) across the network.
PortFast provides two major operational benefits: it allows edge access ports to skip the 15-second Listening and 15-second Learning states to enter Forwarding instantly, and it prevents link up/down events on host ports from generating Topology Change Notifications (TCNs) that unnecessarily flush MAC tables network-wide.

Step-by-Step Solution

1
Analyze the state transition behavior of PortFast.
Standard 802.1D STP takes 30 seconds (15s Listening + 15s Learning) before forwarding frames. PortFast bypasses these intermediary states to put the link into Forwarding immediately upon physical link detection.
End-user hosts need instantaneous network connectivity to complete initial protocol exchanges such as DHCP IP address assignment.
2
Analyze the impact of PortFast on STP topology change notifications (TCNs).
Normal STP topology changes trigger TCN BPDUs, instructing switches to reduce MAC table aging times. PortFast suppresses TCN generation for host connect/disconnect events.
Host link state toggles do not alter the physical path between switches, so flushing MAC address tables across the campus fabric is unnecessary.
3
Evaluate distractor statements regarding BPDU handling and trunk port usage.
PortFast alone does not filter BPDUs, nor is it safe for switch-to-switch interconnects.
Receiving a BPDU on a standard PortFast port causes it to lose PortFast status unless BPDU Guard is active, and enabling PortFast on trunks risks creating Layer 2 loops.

Key Concept

STP PortFast operational benefits and state transitions
Estimated Time:1m 15s
Question 251Question

A network engineer needs to configure a routed (Layer 3) EtherChannel bundle on a Cisco Catalyst switch using LACP active mode on physical interfaces GigabitEthernet0/1 and GigabitEthernet0/2, assigning the IP address 10.1.1.1/30 to the logical channel. In what sequential order should the configuration steps be executed on the switch CLI?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct execution order is: 1) Enter interface range configuration mode for GigabitEthernet0/1 - 2, 2) Execute 'no switchport' on member interfaces to convert them to Layer 3, 3) Issue 'channel-group 10 mode active' to initiate LACP, 4) Access 'interface Port-channel 10' and assign IP address 10.1.1.1 255.255.255.252.
Configuring a Layer 3 LACP EtherChannel follows a precise sequence: first select member physical interfaces (`interface range`), convert them from Layer 2 to Layer 3 (`no switchport`), assign them to the channel group with LACP negotiation (`channel-group 10 mode active`), and finally configure the IP address on the logical bundle (`interface Port-channel 10`).

Step-by-Step Solution

1
Select member physical interfaces using `interface range GigabitEthernet0/1 - 2`.
Enters range interface configuration mode context `(config-if-range)#`.
Allows simultaneous configuration of all member links intended for the EtherChannel bundle.
2
Execute `no switchport` on physical member interfaces.
Disables Layer 2 switchport operation on GigabitEthernet0/1 and GigabitEthernet0/2.
Layer 3 EtherChannels require member interfaces to operate as routed ports prior to group assignment so that Port-Channel 10 is dynamically spawned as a Layer 3 interface.
3
Execute `channel-group 10 mode active`.
Creates logical interface Port-channel 10 and enables LACP active negotiation on member ports.
The 'active' keyword configures LACP to actively send LACP packets to negotiate the channel with the peer device.
4
Enter `interface Port-channel 10` and assign `ip address 10.1.1.1 255.255.255.252`.
Assigns the IPv4 protocol configuration to the logical routed bundle.
In a routed EtherChannel, IP addresses are configured exclusively on the logical Port-channel interface, not on physical member links.

Key Concept

Layer 3 EtherChannel CLI Configuration and LACP Active Mode Negotiation Sequence
Question 252Question

A network administrator is setting up a Cisco Catalyst switch. Interface GigabitEthernet0/3 is connected to an end-user host that must belong to VLAN 45. VLAN 45 has not been previously created in the switch VLAN database. The administrator enters global configuration mode and executes the following commands:

Switch# configure terminal
Switch(config)# interface gigabitethernet0/3
Switch(config-if)# switchport access vlan 45

Which statement correctly describes the operational state of VLAN 45 and interface GigabitEthernet0/3 after these commands are executed?

Show answer & explanation

Answer: VLAN 45 is automatically created in the VLAN database, but the interface will still negotiate Dynamic Trunking Protocol (DTP) unless 'switchport mode access' is explicitly configured.

Answer

VLAN 45 is automatically created in the VLAN database, but the interface will still negotiate Dynamic Trunking Protocol (DTP) unless 'switchport mode access' is explicitly configured.
When the 'switchport access vlan 45' command is entered for a VLAN that does not yet exist, Cisco IOS automatically creates VLAN 45 in the VLAN database (assigning a default name like VLAN0045). However, setting the access VLAN does not change the port's administrative trunking mode. On Cisco Catalyst switches with default DTP settings (dynamic auto or dynamic desirable), the interface will continue to attempt trunk negotiation unless 'switchport mode access' is explicitly configured to force static Layer 2 access mode.

Step-by-Step Solution

1
Analyze the behavior of 'switchport access vlan <vlan-id>' when the target VLAN does not exist.
Cisco IOS automatically creates the non-existent VLAN in the VLAN database (e.g., % Access VLAN does not exist. Creating vlan 45).
IOS features automatic VLAN creation when assigning an access VLAN to an interface.
2
Evaluate the switchport mode state of the interface.
The command 'switchport access vlan 45' configures the access VLAN parameter, but does not explicitly change the interface mode to static access.
By default, Catalyst switch ports operate in dynamic mode (dynamic auto or dynamic desirable), meaning DTP frames are still sent/processed unless 'switchport mode access' is explicitly applied.
3
Determine the necessary complete configuration for a dedicated access port.
Both 'switchport mode access' (to statically force access mode and disable trunk negotiation) and 'switchport access vlan 45' are required.
Best practice requires explicit configuration of both switchport mode access and switchport access vlan.

Key Concept

Cisco IOS Automatic VLAN Creation and Access Port Command Requirements
Estimated Time:2m 0s
Question 253Question

In an enterprise network operating Rapid PVST+ for VLAN 2020, three Catalyst switches are interconnected as follows:

- Switch-A is configured with a base bridge priority of 40964096 and MAC address `0011.1111.1111`.
- Switch-B is configured with a base bridge priority of 2867228672 and MAC address `0022.2222.2222`.
- Switch-C is configured with a base bridge priority of 2867228672 and MAC address `0033.3333.3333`.

Switch-B and Switch-C both connect directly to Switch-A using single 1 Gbps1\text{ Gbps} trunk links on interface GigabitEthernet 0/1. In addition, Switch-B and Switch-C are connected directly to each other via two parallel 1 Gbps1\text{ Gbps} trunk links: Link 1 connects interface GigabitEthernet 0/2 on both switches, and Link 2 connects interface GigabitEthernet 0/3 on both switches. All switches maintain default port priorities of 128128.

Based on Rapid PVST+ operations for VLAN 2020, what are the port role and operational state of interface GigabitEthernet 0/3 on Switch-C?

Show answer & explanation

Answer: Alternate role and Discarding state

Answer

Interface GigabitEthernet 0/3 on Switch-C operates in the Alternate role and Discarding state.
In Rapid PVST+, Switch-A is elected Root Bridge because it has the lowest Bridge ID (41164116). Switch-B and Switch-C both select GigabitEthernet 0/1 as their Root Port with a path cost of 44. On the parallel links between Switch-B and Switch-C, Switch-B wins the Designated Port election for both segments because its MAC address (`0022.2222.2222`) is lower than Switch-C's MAC address (`0033.3333.3333`), breaking the path cost tie. Because Switch-C receives BPDUs from a neighboring switch on GigabitEthernet 0/2 and 0/3, both interfaces serve as redundant paths to the root and are assigned the Alternate port role. Rapid PVST+ replaces the legacy 802.1D Blocking state with the Discarding state for non-forwarding ports.

Step-by-Step Solution

1
Determine the Root Bridge for VLAN 20.
Switch-A Bridge Priority (4096+20=41164096 + 20 = 4116) is lower than Switch-B and Switch-C (28672+20=2869228672 + 20 = 28692). Switch-A is elected Root Bridge.
The bridge with the lowest Bridge ID (Priority + System ID Extension + MAC) becomes the Root Bridge.
2
Determine Root Ports on non-root switches.
Switch-B GigabitEthernet 0/1 (Cost 44) and Switch-C GigabitEthernet 0/1 (Cost 44) are elected Root Ports.
Direct 1 Gbps1\text{ Gbps} links to Switch-A provide the lowest cumulative Root Path Cost (44).
3
Evaluate Designated Port selection between Switch-B and Switch-C on parallel links (Gi0/2 and Gi0/3).
Switch-B advertises Root Path Cost 44, Switch-C advertises Root Path Cost 44. Ties are broken by Sender Bridge ID. Switch-B MAC (`0022.2222.2222`) < Switch-C MAC (`0033.3333.3333`). Switch-B wins Designated role on both Gi0/2 and Gi0/3.
On a segment between two switches with equal Root Path Cost, the switch with the lower Bridge ID becomes the Designated Switch.
4
Determine the port role and state for Switch-C's interfaces GigabitEthernet 0/2 and 0/3.
Both Gi0/2 and Gi0/3 on Switch-C receive superior BPDUs from Switch-B (a foreign switch). They are assigned the Alternate role and placed in the Discarding state.
In Rapid PVST+ (802.1w), ports receiving BPDUs from another switch that offer an alternate path to the root are Alternate ports and reside in the Discarding state.

Key Concept

Rapid PVST+ Port Roles (Root, Designated, Alternate, Backup) and 802.1w Operational States (Discarding, Learning, Forwarding)
Estimated Time:2m 0s
Question 254Question

An enterprise topology runs Rapid PVST+ across four switches for VLAN 40. Switch SW1 serves as the Root Bridge with a priority of 40964096 (total priority 41364136 with System ID Extension). Switches SW2 and SW3 are distribution switches, both configured with a base bridge priority of 2867228672 (2871228712 total). Switch SW4 is an access switch connected to SW2 via interface GigabitEthernet1/0/1 and to SW3 via interface GigabitEthernet1/0/2. All interconnecting links between switches are 10-Gigabit Ethernet (10 Gbps10\text{ Gbps}, cost 22).

The MAC addresses of the distribution switches are:
- SW2 MAC: `0011.2233.4455`
- SW3 MAC: `0011.2233.6677`

Both SW2 and SW3 have direct single-link 10 Gbps10\text{ Gbps} connections to SW1. Which statement correctly identifies the Rapid PVST+ port role and state for interface GigabitEthernet1/0/2 on Switch SW4, along with the precise technical reason?

Show answer & explanation

Answer: Interface GigabitEthernet1/0/2 becomes an Alternate port in the Discarding state because SW4 receives a superior BPDU from SW2 due to SW2's lower MAC address.

Answer

Interface GigabitEthernet1/0/2 becomes an Alternate port in the Discarding state because SW4 receives a superior BPDU from SW2 due to SW2's lower MAC address.
The correct answer identifies that interface GigabitEthernet1/0/2 becomes an Alternate port in the Discarding state. SW4 evaluates two potential paths to the Root Bridge (SW1). Both paths have equal cumulative root path costs of 4 (2+22 + 2). Comparing the upstream switch Bridge IDs, both SW2 and SW3 have identical bridge priorities of 28712 (28672 base+40 VLAN ID28672 \text{ base} + 40 \text{ VLAN ID}). The tie is broken by MAC address comparison, where SW2 (`0011.2233.4455`) is lower than SW3 (`0011.2233.6677`). Thus, SW2 provides superior BPDUs, causing SW4 to select GigabitEthernet1/0/1 as its Root Port and GigabitEthernet1/0/2 as an Alternate port in the Rapid PVST+ Discarding state.

Step-by-Step Solution

1
Calculate Cumulative Root Path Cost for each path on SW4
Path via SW2 = 2 (SW4-SW2)+2 (SW2-SW1)=42\text{ (SW4-SW2)} + 2\text{ (SW2-SW1)} = 4. Path via SW3 = 2 (SW4-SW3)+2 (SW3-SW1)=42\text{ (SW4-SW3)} + 2\text{ (SW3-SW1)} = 4. Costs are equal.
Rapid PVST+ first compares cumulative root path cost to elect the Root Port.
2
Evaluate Designated Bridge ID (Sender Bridge Priority + MAC)
SW2 Priority = 28672+40=2871228672 + 40 = 28712. SW3 Priority = 28672+40=2871228672 + 40 = 28712. Priorities are equal, so compare MAC addresses: `0011.2233.4455` (SW2) vs `0011.2233.6677` (SW3). SW2 has the lower MAC address.
When root path costs are equal, the switch evaluates the sender's Designated Bridge ID.
3
Determine Port Role and State for SW4's interfaces
GigabitEthernet1/0/1 (connected to SW2) is elected as Root Port (Forwarding state). GigabitEthernet1/0/2 (connected to SW3) becomes an Alternate port (Discarding state).
Rapid PVST+ assigns Alternate port role to non-root interfaces receiving inferior BPDUs from alternate upstream switches and places them in the Discarding state.

Key Concept

Rapid PVST+ Root Port Election and Alternate Port State Operations
Question 255Question

An administrator is connecting a workstation to port FastEthernet 0/8 on a switch. Which interface configuration command must be executed to explicitly force the port into static access mode?

Show answer & explanation

Answer: switchport mode access

Answer

The command 'switchport mode access' explicitly configures an interface to operate strictly as a Layer 2 access port.
The command 'switchport mode access' instructs Cisco IOS to statically set the interface operational mode to access (non-trunking). This disables dynamic trunking negotiation on that interface.

Step-by-Step Solution

1
Identify the goal of configuring a switchport for host connection
Host connections require non-trunking access ports that statically belong to a single broadcast domain.
By default, switch ports on modern Catalyst switches may attempt DTP negotiation unless configured explicitly.
2
Select the Cisco IOS command that sets administrative port mode
Executing 'switchport mode access' in interface configuration mode forces the interface to function as an access port.
This command overrides dynamic mode negotiation and ensures the interface remains an access port.

Key Concept

Access Port Mode Configuration
Question 256Question

A network administrator is troubleshooting an issue where end-user workstations experience initial network connection timeouts and fail to obtain IPv4 addresses via DHCP upon booting up. The administrator decides to configure Cisco STP PortFast on the access-mode switch interfaces connected to these workstations. Which TWO operational benefits or behaviors occur as a result of enabling PortFast on these access ports? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: The interface bypasses the standard 802.1D Listening and Learning states, transitioning immediately to the Forwarding state upon link activation.; Link state changes on the interface do not trigger Topology Change Notifications (TCNs) to be flooded across the Spanning Tree domain.

Answer

Enabling PortFast on access interfaces allows ports to immediately transition from the Blocking state to the Forwarding state by bypassing the standard Listening and Learning delay, while also suppressing the generation of Topology Change Notifications (TCNs) during link UP/DOWN events on edge ports.
The correct options identify that PortFast allows an access port to transition directly from Blocking to Forwarding (bypassing the 15-second Listening and 15-second Learning timer delay) and that edge interface transitions on PortFast ports do not trigger Topology Change Notifications (TCNs) to the STP root bridge.

Step-by-Step Solution

1
Analyze the impact of standard 802.1D STP convergence on DHCP client requests.
Standard IEEE 802.1D STP requires ports to spend 15 seconds in the Listening state and 15 seconds in the Learning state (30 seconds total) before reaching Forwarding.
This 30-second convergence delay causes DHCP client software on workstations to time out before the port can forward traffic.
2
Determine the primary operational state behavior of Cisco PortFast.
PortFast moves an edge interface immediately into the Forwarding state upon link UP, bypassing Listening and Learning.
End-user devices do not create Layer 2 loops, making the 30-second STP listening/learning check unnecessary for edge devices.
3
Evaluate the secondary operational trait regarding Topology Change Notifications (TCNs).
PortFast suppresses TCN generation for edge port link status changes.
Frequent rebooting or power cycles of client PCs would otherwise cause constant network-wide MAC address table aging if TCNs were flooded.

Key Concept

STP PortFast Operational Behavior and TCN Suppression
Question 257Question

A network administrator configures a Cisco Lightweight Access Point (LAP) to assist in identifying unauthorized rogue devices on the enterprise network. After updating the operational mode of the access point via the Wireless LAN Controller (WLC), the administrator observes that both the 2.4 GHz and 5 GHz radios on the access point are disabled, and no SSIDs are being broadcast. However, the device actively reports rogue device MAC address correlations back to the WLC. Which statement correctly explains the operational behavior of the access point in this scenario?

Show answer & explanation

Answer: The access point is operating in Rogue Detector mode, which turns off its wireless radios and uses its wired link to listen for broadcast ARP packets to match against rogue MAC lists.

Answer

The access point is operating in Rogue Detector mode, which turns off its wireless radios and uses its wired link to listen for broadcast ARP packets to match against rogue MAC lists.
The correct answer accurately describes Rogue Detector mode. In this specialized mode, the AP's wireless radios are turned off completely. The AP uses its wired Ethernet connection (typically configured on a trunk port to see all VLANs) to listen to ARP broadcasts and match MAC addresses against the WLC's list of rogue APs and clients detected by other monitoring APs.

Step-by-Step Solution

1
Analyze the reported operational state of the Lightweight AP.
The access point has disabled both 2.4 GHz and 5 GHz wireless radios (no SSIDs broadcast), yet it actively correlates rogue MAC addresses with the WLC.
Identifying radio status (disabled vs active) narrows down the operational AP mode.
2
Differentiate between Cisco Lightweight AP modes (Local, FlexConnect, Monitor, Sniffer, Rogue Detector).
Rogue Detector mode is the only mode where RF radios are shut off completely while the AP operates purely over its wired interface to inspect ARP broadcasts.
Monitor and Sniffer modes require active wireless radios to listen to 802.11 channels over the air.
3
Correlate wired inspection with WLC functionality.
The AP compares MAC addresses seen on wired broadcast frames against the list of rogue wireless clients reported by other APs to the WLC.
This determines if a rogue AP or rogue client connected wirelessly is also physically plugged into the enterprise wired network.

Key Concept

Cisco Lightweight Access Point Operational Modes
Question 258Question

A Cisco Catalyst switch is operating with default Rapid PVST+ settings. What total bridge priority value will the switch advertise in its BPDUs for VLAN 100?

Show answer & explanation

Answer: 32868

Answer

32868
In Rapid PVST+, the 16-bit Priority field of the Bridge ID is divided into a 4-bit Bridge Priority and a 12-bit System ID Extension. The System ID Extension automatically equals the VLAN ID. With the default base bridge priority set to 32768, the advertised total priority for VLAN 100 is calculated as 32768+100=3286832768 + 100 = 32868.

Step-by-Step Solution

1
Identify the default base bridge priority
Default base priority is 32768
Cisco switches running PVST+/Rapid PVST+ use a default base priority of 32768.
2
Determine the System ID Extension value
System ID Extension is 100
In PVST+ and Rapid PVST+, the System ID Extension carries the VLAN ID for which the BPDU is generated.
3
Calculate the total bridge priority
32768 + 100 = 32868
Total Bridge Priority = Base Priority + System ID Extension (VLAN ID).

Key Concept

Rapid PVST+ System ID Extension and Total Bridge Priority Calculation
Question 259Question

Which primary operational benefit is achieved when Cisco STP PortFast is enabled on a switch access interface connected to an end-user host?

Show answer & explanation

Answer: The port transitions immediately from Blocking to Forwarding state upon link UP and avoids generating Topology Change Notifications.

Answer

Enabling PortFast causes the access interface to immediately transition into the STP Forwarding state upon link activation while preventing Topology Change Notifications (TCNs) from being sent to the root bridge.
Enabling PortFast on an access interface allows edge devices (such as PCs and servers) to begin transmitting data immediately upon link activation by bypassing the Listening (15s) and Learning (15s) states. Furthermore, because edge ports joining or leaving the network do not reflect core topology changes, PortFast prevents the switch from generating Topology Change Notifications (TCNs) to the Root Bridge.

Step-by-Step Solution

1
Analyze standard 802.1D STP timer delays on link initiation.
Standard 802.1D STP requires ports to spend 15 seconds in Listening and 15 seconds in Learning before reaching Forwarding.
This 30-second delay ensures no temporary switching loops exist before user data is forwarded.
2
Evaluate the effect of PortFast on edge device connectivity.
Edge ports connected directly to workstations or servers cannot form switching loops, making the 30-second delay redundant.
PortFast bypasses Listening and Learning states directly to Forwarding and suppresses TCN generation to maintain network stability.

Key Concept

STP PortFast Benefits and State Bypass Behavior
Question 260Question

An enterprise network administrator deploys a Cisco Wireless LAN Controller (WLC). The Management Interface is assigned to VLAN 10 with IP address 10.10.10.10/2410.10.10.10/24, and the Service Port is configured on an isolated network with IP address 192.168.1.50/24192.168.1.50/24 for out-of-band management. Engineers in the Network Operations Center (NOC) residing on subnet 172.16.100.0/24172.16.100.0/24 report that they can successfully ping and manage the WLC via HTTPS using the Service Port IP address (192.168.1.50192.168.1.50). However, lightweight Access Points (APs) located on subnet 10.10.20.0/2410.10.20.0/24 consistently fail to complete CAPWAP discovery and join procedures with the Management Interface (10.10.10.1010.10.10.10). Furthermore, NOC engineers cannot establish HTTPS or SSH sessions to 10.10.10.1010.10.10.10, whereas administrative hosts directly connected to VLAN 10 can access 10.10.10.1010.10.10.10 without issue. Which of the following root causes accounts for both the AP CAPWAP join failure and the remote NOC management access timeout to the Management Interface?

Show answer & explanation

Answer: The WLC Management Interface lacks a valid default gateway configuration, preventing routed return traffic to remote subnets while allowing local Layer 2 communications.

Answer

The WLC Management Interface lacks a valid default gateway configuration, preventing routed return traffic to remote subnets while allowing local Layer 2 communications.
The correct answer identifies that a missing or invalid default gateway on the WLC Management Interface prevents the WLC from routing return IP packets to subnets outside its local subnet (10.10.10.0/24). Local VLAN 10 devices can communicate using direct Layer 2 switching, and the Service Port functions because it operates on a separate out-of-band routing stack. However, both remote AP CAPWAP join responses and remote NOC management attempts fail because the WLC cannot route return packets to subnets 10.10.20.0/24 or 172.16.100.0/24.

Step-by-Step Solution

1
Analyze the Service Port management behavior
The Service Port uses a separate, isolated out-of-band routing context with its own static routes and gateway, allowing NOC access to 192.168.1.50 independently of the data plane/Management Interface routing table.
Cisco WLC architecture isolates out-of-band Service Port traffic from the in-band Management and Dynamic interfaces.
2
Compare local vs remote reachability to the Management Interface IP (10.10.10.10)
Local hosts on VLAN 10 (10.10.10.0/24) communicate with the WLC via direct Layer 2 ARP and switching, succeeding without routing. Remote hosts (NOC at 172.16.100.0/24 and APs at 10.10.20.0/24) require Layer 3 routing.
When a remote client sends a packet to the Management Interface, the WLC receives the ingress packet but must consult the Management Interface routing table to send return packets back to the client's gateway.
3
Identify the common failure point for off-subnet APs and off-subnet NOC hosts
Without a valid default gateway configured on the WLC Management Interface, return traffic for CAPWAP join responses (to 10.10.20.0/24) and HTTPS/SSH responses (to 172.16.100.0/24) is dropped by the WLC kernel.
Missing default gateway breaks bidirectional Layer 3 IP connectivity for all remote subnets attempting to communicate with the Management Interface.

Key Concept

WLC Management Interface Gateway and Routing Isolation
Estimated Time:3m 0s
PreviousPage 13 / 20Next