Examkin

Network Access

400 questions

All types400Multiple choice204Multiple select91Matching23Ordering82
Question 341Question →

A network administrator observes the following syslog message on a Cisco Catalyst switch:

`%CDP-4-NATIVE_VLAN_MISMATCH: Native VLAN mismatch discovered on GigabitEthernet1/0/1 (10), with SW-Floor2 GigabitEthernet0/1 (20).`

Which mechanism enables the switch to detect this misconfiguration?

Show answer & explanation

Answer: CDP carries a Native VLAN Type-Length-Value (TLV) field in its Layer 2 advertisements, allowing the switch to compare its locally configured native VLAN against the neighbor's advertised native VLAN.

Answer

CDP carries a Native VLAN Type-Length-Value (TLV) field in its advertisements, allowing switches to compare their configured native VLAN with that of directly connected Cisco neighbors.
Cisco Discovery Protocol (CDP) periodically sends Layer 2 multicast messages containing Type-Length-Value (TLV) metadata structures. One of these structures is the Native VLAN TLV. When a switch receives a CDP frame on an 802.1Q trunk interface, it compares the native VLAN ID advertised in the Native VLAN TLV with the local native VLAN configured on that port. If the two values differ (e.g., VLAN 10 vs. VLAN 20), the switch logs a %CDP-4-NATIVE_VLAN_MISMATCH message.

Step-by-Step Solution

1
Identify the protocol generating the syslog message.
The prefix %CDP indicates the message was generated by Cisco Discovery Protocol.
Syslog events starting with %CDP originate from the active CDP process.
2
Analyze how CDP exchanges configuration details across Layer 2 links.
CDP packs information elements into Type-Length-Value (TLV) fields within Layer 2 frames.
TLVs allow CDP to transmit specific device attributes, such as platform, capabilities, management addresses, and native VLAN IDs.
3
Determine how the native VLAN mismatch condition is detected.
The local switch compares its configured native VLAN (10) against the Native VLAN TLV value (20) in the neighbor's CDP frame.
When a discrepancy is detected between local interface configuration and incoming TLV payload, a Native VLAN Mismatch syslog event is triggered.

Key Concept

CDP Native VLAN TLV and Mismatch Detection
Estimated Time:1m 15s
Question 342Question →

A network administrator is inspecting a Cisco Catalyst switch interface that connects to a user PC. Running the command `show interfaces FastEthernet 0/4 switchport` displays the following output:

text
Name: Fa0/4
Administrative Mode: dynamic auto
Operational Mode: static access
Administrative Trunking Encapsulation: dot1q
Operational Trunking Encapsulation: native
Negotiation of Trunking: On
Access Mode VLAN: 1 (default)

The administrator needs to permanently configure this interface as a static access port assigned to VLAN 30 and disable DTP negotiation. Which set of commands must be executed under interface configuration mode to achieve this objective?

Show answer & explanation

Answer: switchport mode access
switchport access vlan 30
switchport nonegotiate

Answer

The command sequence consisting of `switchport mode access`, `switchport access vlan 30`, and `switchport nonegotiate` correctly assigns the port statically to VLAN 30 and disables DTP negotiation.
The correct command sequence explicitly configures the interface as a static access port (`switchport mode access`), assigns it to the designated access VLAN (`switchport access vlan 30`), and prevents the port from sending Dynamic Trunking Protocol frames (`switchport nonegotiate`).

Step-by-Step Solution

1
Analyze current interface state
The administrative mode is `dynamic auto`, meaning it will dynamically negotiate a trunk if the opposing side initiates negotiation.
To secure and statically assign an access port, dynamic trunking must be overridden.
2
Statically set access mode and assign target VLAN
`switchport mode access` forces static access behavior, and `switchport access vlan 30` binds untagged traffic to VLAN 30.
Access ports belong to a single broadcast domain (VLAN) for end-host traffic.
3
Disable DTP frame generation
`switchport nonegotiate` stops DTP frames from being sent out the port.
Disabling DTP prevents unauthorized trunk establishment attempts on access ports.

Key Concept

Configuring Layer 2 Static Access Ports and Disabling DTP Negotiation
Estimated Time:1m 30s
Question 343Question →

In a network running Rapid PVST+ for VLAN 30, Switch-4 has two direct Gigabit Ethernet connections to Switch-2, which is the Root Bridge. Link 1 connects Switch-4 port GigabitEthernet0/1 to Switch-2 port GigabitEthernet0/1. Link 2 connects Switch-4 port GigabitEthernet0/2 to Switch-2 port GigabitEthernet0/2. All interface costs use default values. Which port role and state will port GigabitEthernet0/2 on Switch-4 assume after STP convergence completes?

Show answer & explanation

Answer: Alternate port in the Discarding state

Answer

Port GigabitEthernet0/2 on Switch-4 will become an Alternate port in the Discarding state.
When a non-root switch has multiple parallel links connected to the same upstream Root Bridge, the tie-breakers for selecting a Root Port are: lowest cumulative Root Path Cost, lowest Designated Bridge ID, lowest upstream Designated (Sender) Port ID, and lowest local Port ID. Here, cumulative cost and Bridge ID are equal for both links. The tie is broken by Switch-2's sender Port ID: Gi0/1 has a lower numerical Port ID than Gi0/2. Thus, Switch-4's GigabitEthernet0/1 becomes the Root Port in the Forwarding state, while GigabitEthernet0/2 assumes the Alternate port role in the Discarding state to block switching loops.

Step-by-Step Solution

1
Determine Root Port selection on Switch-4 across redundant paths to the Root Bridge.
Both local ports (Gi0/1 and Gi0/2) connect directly to Root Bridge Switch-2, resulting in identical Root Path Cost (44) and identical Root/Designated Bridge ID.
When Root Path Cost and Designated Bridge ID are tied, Rapid PVST+ evaluates the upstream Designated (Sender) Port ID to break the tie.
2
Compare upstream sender Port IDs from Switch-2.
Switch-2 sends BPDUs out its Gi0/1 port (Port ID 128.1128.1) to Switch-4's Gi0/1, and out its Gi0/2 port (Port ID 128.2128.2) to Switch-4's Gi0/2. Lower port priority/number wins.
Since 128.1<128.2128.1 < 128.2, Switch-4 selects port GigabitEthernet0/1 as its single Root Port.
3
Determine the role and state for the remaining unselected port GigabitEthernet0/2 on Switch-4.
GigabitEthernet0/2 receives superior BPDUs from Switch-2 compared to any BPDUs Switch-4 could send, so Switch-4 places GigabitEthernet0/2 into the Alternate port role, which operates in the Discarding state.
Alternate ports offer an alternate path to the Root Bridge and remain blocked (Discarding) to prevent Layer 2 loops.

Key Concept

Rapid PVST+ Root Port selection tie-breaking via upstream Sender Port ID and Alternate port role assignment.
Question 344Question →

A network administrator is deploying Cisco Lightweight Access Points (LAPs) at a remote branch office connected to a main campus Wireless LAN Controller (WLC) over a WAN link. The branch APs are configured in FlexConnect mode with local switching configured for the primary employee WLAN. Which two statements accurately describe the operational behavior of these access points under normal operations and during a WAN outage? (Select two.)

Select all that apply

Show answer & explanation

Answer: During normal operations with an active WAN connection, control traffic is encapsulated in a CAPWAP tunnel to the central WLC while user data traffic on locally switched WLANs is bridged directly onto the local branch switch.; If the WAN link fails and the AP enters Standalone mode, existing client sessions on locally switched WLANs using local authentication methods continue to transmit traffic without disruption.

Answer

In FlexConnect mode with local switching, CAPWAP control traffic goes to the central WLC while client data traffic is bridged directly to the local branch network. If the WAN connection to the WLC fails, the AP transitions to Standalone mode and continues forwarding data for locally switched WLANs.
FlexConnect mode is designed for branch office deployments connected over WAN links. Under normal conditions, CAPWAP control traffic is tunneled to the central Wireless LAN Controller, while client data traffic on locally switched WLANs is bridged directly to the local Ethernet switch. When WAN connectivity to the controller is lost, the AP transitions into Standalone mode and maintains data forwarding and local authentication for locally switched WLANs without dropping client traffic.

Step-by-Step Solution

1
Analyze FlexConnect mode functionality during normal operations (Connected state).
Control traffic (CAPWAP control) is sent over the WAN to the central WLC, whereas data traffic for locally switched WLANs stays local and is switched onto the branch network.
FlexConnect implements split-MAC architecture flexible enough to separate control plane encapsulation from local data plane forwarding.
2
Evaluate FlexConnect mode behavior during a WAN connectivity loss (Standalone state).
The AP continues operating locally switched WLANs in Standalone mode, allowing active clients and locally authenticated clients to remain connected.
Standalone mode provides high availability at remote sites by avoiding complete wireless downtime when WLC reachability drops.

Key Concept

FlexConnect AP Mode Local Switching vs Central Switching Mechanics
Question 345Question →

A network engineer is implementing security monitoring across an enterprise campus using a centralized Cisco Wireless LAN Controller (WLC) architecture. The security policy requires dedicated access points to continuously scan all 802.11 channels for rogue devices and radio frequency (RF) interference without broadcasting SSIDs, accepting client associations, or handling user data traffic. Which Cisco Lightweight Access Point (AP) mode should be configured on these access points?

Show answer & explanation

Answer: Monitor mode

Answer

Monitor mode
Monitor mode is specifically designed for dedicated wireless security monitoring and intrusion detection (WIPS). In this mode, the AP radio does not transmit client beacon signals or accept client associations. Instead, it systematically cycles through all configured channels to collect statistics, detect rogue access points, calculate location metrics, and monitor RF health.

Step-by-Step Solution

1
Identify the operational constraints specified in the scenario.
The AP must continuously scan channels, detect rogues, measure RF noise/interference, and not serve client connections or transmit beacons.
Security monitoring requires a dedicated RF sensor rather than a client-facing access point.
2
Evaluate Cisco Lightweight Access Point modes against these requirements.
In Monitor mode, the AP radio does not transmit to serve clients; it continuously cycles through all configured channels to gather location, WIPS, and rogue AP detection metrics.
This matches all security and functional requirements without interfering with regular client traffic.

Key Concept

Cisco Lightweight Access Point Operational Modes
Estimated Time:1m 0s
Question 346Question →

A network administrator is troubleshooting neighbor discovery between a Cisco Catalyst switch and an adjacent third-party switch. Global LLDP is enabled on the Cisco switch using the 'lldp run' command. The Cisco switch successfully detects the neighbor on interface GigabitEthernet0/1, but the neighbor does not receive any discovery frames from the Cisco switch. Which interface configuration command must be applied to GigabitEthernet0/1 to resolve this issue?

Show answer & explanation

Answer: lldp transmit

Answer

The command 'lldp transmit' applied under interface configuration mode enables outbound LLDP frame transmission on that specific interface.
On Cisco Catalyst switches, LLDP allows transmit and receive functions to be enabled or disabled independently on each interface. The 'lldp transmit' command under interface mode activates outbound frame transmission so neighboring devices can discover the local switch.

Step-by-Step Solution

1
Analyze the reported symptom.
The local Cisco switch receives neighbor information but does not transmit LLDP frames on GigabitEthernet0/1.
LLDP allows granular directional control (transmit and receive) per interface.
2
Identify the command controlling directional LLDP transmission.
Entering interface configuration mode and executing 'lldp transmit' enables outbound advertisement frames.
When global LLDP is enabled ('lldp run'), individual interfaces can still have transmission disabled ('no lldp transmit').

Key Concept

LLDP Interface Directional Control Commands
Estimated Time:1m 0s
Question 347Question →

A network administrator needs to provision a new VLAN for the Sales department (VLAN 50, named SALES) on a Cisco Catalyst switch and assign interface GigabitEthernet0/5 as a static access port belonging to this VLAN. Place the following Cisco IOS commands in the correct sequential order from privileged EXEC mode to complete this configuration.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts with entering global configuration mode (`configure terminal`), followed by creating VLAN 50 (`vlan 50`), naming it (`name SALES`), accessing interface configuration mode (`interface GigabitEthernet0/5`), setting static access mode (`switchport mode access`), and assigning the port to VLAN 50 (`switchport access vlan 50`).
Cisco IOS requires navigating through a strict prompt hierarchy. The administrator must first enter global configuration mode (`configure terminal`), instantiate and name the VLAN (`vlan 50` followed by `name SALES`), navigate to the specific interface (`interface GigabitEthernet0/5`), set the port operational mode to access (`switchport mode access`), and finally bind the access port to VLAN 50 (`switchport access vlan 50`).

Step-by-Step Solution

1
Execute `configure terminal` at the privileged EXEC prompt (`Switch#`).
Enters global configuration mode (`Switch(config)#`).
Global configuration mode is the entry point for defining system-level entities such as VLANs.
2
Execute `vlan 50`.
Creates VLAN 50 and moves to VLAN configuration mode (`Switch(config-vlan)#`).
VLAN ID 50 must be created before assigning a descriptive name or configuring interface membership.
3
Execute `name SALES`.
Names VLAN 50 as SALES.
VLAN names are assigned inside config-vlan subconfiguration mode.
4
Execute `interface GigabitEthernet0/5`.
Enters interface configuration mode (`Switch(config-if)#`).
Interface parameters must be modified from within the target interface's configuration prompt.
5
Execute `switchport mode access`.
Sets the administrative mode of GigabitEthernet0/5 to access.
Configuring explicit access mode prevents DTP trunk negotiation and secures the port.
6
Execute `switchport access vlan 50`.
Associates interface GigabitEthernet0/5 with VLAN 50.
Places untagged traffic entering GigabitEthernet0/5 into broadcast domain 50.

Key Concept

Cisco IOS hierarchical configuration sequence for VLAN creation and static access port assignment.
Estimated Time:1m 30s
Question 348Question →

A network engineer is configuring Layer 2 discovery protocols across an enterprise network that includes both Cisco and non-Cisco hardware. Which two statements correctly describe the operational characteristics, default timers, or CLI configuration syntax for CDP and LLDP on Cisco Catalyst switches? (Select two)

Select all that apply

Show answer & explanation

Answer: CDP uses default advertisement and holdtime timers of 60 seconds and 180 seconds respectively, whereas LLDP defaults to a 30-second advertisement timer and a 120-second holdtime.; When LLDP is enabled globally, bidirectional neighbor discovery on a specific interface requires both 'lldp transmit' and 'lldp receive' commands under interface configuration mode.

Answer

The two correct statements are: 1) CDP defaults to 60-second update and 180-second holdtime timers while LLDP defaults to 30-second update and 120-second holdtime timers; and 2) LLDP requires both 'lldp transmit' and 'lldp receive' interface commands for bidirectional operation once enabled globally.
CDP operates using a 60-second update interval and a 180-second holdtime by default. In contrast, LLDP uses a 30-second update interval and a 120-second holdtime. Additionally, LLDP interface submode commands decouple transmitting and receiving discovery frames into 'lldp transmit' and 'lldp receive', both of which are required for bidirectional neighbor identification.

Step-by-Step Solution

1
Analyze default timer specifications for CDP and LLDP
CDP timer = 60s, holdtime = 180s. LLDP timer = 30s, holdtime = 120s (multiplier of 4).
Memorization and verification of protocol operational defaults.
2
Evaluate LLDP interface configuration semantics
LLDP allows separate control over packet transmission ('lldp transmit') and reception ('lldp receive') per interface.
Understanding inter-vendor discovery protocol control granularity.
3
Evaluate global configuration commands and IEEE standards
'no cdp run' disables CDP globally across all ports. LLDP is standardized under IEEE 802.1AB.
Differentiating global vs interface scope commands and protocol standards.

Key Concept

CDP and LLDP operational differences, default timers, and interface configuration commands
Question 349Question →

A network administrator is configuring a newly created Wireless LAN (WLAN) on a Cisco Wireless LAN Controller (WLC) using the GUI. The administrator must map client traffic on this WLAN to a specific VLAN interface and ensure the network is active for client association. Which TWO settings are located directly under the General tab of the WLAN configuration page?

Select all that apply

Show answer & explanation

Answer: Selecting the appropriate dynamic interface or interface group from the Interface/Interface Group drop-down menu; Selecting the Status checkbox to enable the WLAN for client connections

Answer

The correct settings located under the General tab are selecting the appropriate dynamic interface from the Interface/Interface Group drop-down menu and selecting the Status checkbox to enable the WLAN.
On a Cisco WLC GUI, the General tab for a WLAN contains fundamental operational settings including Profile Name, SSID, Status (enabled/disabled), and Interface/Interface Group binding. Choosing the appropriate interface maps the WLAN to a specific VLAN, and checking Status activates the WLAN for wireless client association.

Step-by-Step Solution

1
Identify the parameters configured on the General tab during Cisco WLC WLAN setup.
The General tab contains parameters such as Profile Name, SSID, Status (Enabled/Disabled), Radio Policy, and Interface/Interface Group mapping.
These basic operational settings define the identity, network mapping, and operational state of the WLAN.
2
Evaluate the requirement to map client traffic to a specific VLAN and enable client association.
Mapping client traffic requires selecting the target interface under Interface/Interface Group, and enabling client association requires checking the Status checkbox.
Both of these configuration fields reside directly within the General tab.
3
Distinguish General tab parameters from Security tab parameters.
WPA2 security policies and RADIUS server configurations are located under the Security tab (Layer 2 sub-tab and AAA Servers sub-tab respectively).
Security and authentication mechanisms are isolated in dedicated sub-tabs under the Security main menu.

Key Concept

Cisco WLC GUI WLAN General Tab Configuration
Estimated Time:1m 30s
Question 350Question →

During initial topology convergence for a VLAN running Rapid PVST+, switches exchange BPDUs to determine which switch assumes the Root Bridge role. Place the evaluation criteria steps in the correct order, from the first criterion evaluated to the final step establishing the Root Bridge.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with comparing base priority values, adding the System ID Extension to calculate total priority, using the lowest MAC address as a tie-breaker if priorities match, and concluding with designating the switch with the lowest overall Bridge ID as the Root Bridge.
In Rapid PVST+, Root Bridge election follows a strict hierarchy based on the Bridge ID (BID). Switches first compare base bridge priority, add the System ID Extension (VLAN ID) to establish total priority, resolve any ties using the lowest MAC address, and finally designate the switch with the overall lowest BID as the Root Bridge.

Step-by-Step Solution

1
Evaluate Base Bridge Priority
Identifies the base priority component configured on each participating switch.
Base priority is the primary configurable metric evaluated in the Bridge ID.
2
Incorporate System ID Extension
Combines base priority and VLAN ID into the effective 16-bit priority value.
Rapid PVST+ requires unique per-VLAN bridge priorities by appending the VLAN number.
3
Evaluate MAC addresses for tie-breaking
Determines the winning switch when total priorities are identical.
The 48-bit switch MAC address serves as a unique secondary tie-breaker.
4
Confirm Root Bridge election outcome
The switch with the lowest resulting BID becomes the Root Bridge.
All switches in the spanning-tree domain recognize the switch with the lowest BID as Root.

Key Concept

Rapid PVST+ Root Bridge Election and Bridge ID Evaluation
Question 351Question →

A network administrator needs to prevent wireless clients connected to the same SSID from communicating directly with each other at Layer 2 across the wireless controller. Which menu tab and feature configuration on the Cisco Wireless LAN Controller (WLC) GUI must be configured to achieve this client isolation?

Show answer & explanation

Answer: Navigate to the Advanced tab under WLANs edit settings and set the Peer-to-Peer Blocking Action.

Answer

Navigate to the Advanced tab under WLANs edit settings and set the Peer-to-Peer Blocking Action.
Peer-to-Peer Blocking is configured under the Advanced tab of a WLAN's configuration in the Cisco WLC GUI. It restricts connected wireless clients on the same WLAN from transmitting traffic directly to each other, enhancing network security.

Step-by-Step Solution

1
Identify the required client isolation requirement.
The requirement is to prevent Layer 2 communications between clients associated with the same WLAN.
Peer-to-peer blocking stops wireless stations on the same subnet/WLAN from attacking or communicating directly with each other.
2
Locate the correct configuration menu in the Cisco WLC GUI.
Access WLANs > WLANs ID > Edit, then select the Advanced tab.
Advanced WLAN operational settings including Peer-to-Peer Blocking, AAA Override, and Coverage Hole Detection are grouped under the Advanced tab.
3
Select the appropriate Peer-to-Peer Blocking Action.
Choose Drop (or Up-Stream Forward depending on gateway design).
Setting the action to Drop drops peer-to-peer frames directly at the controller.

Key Concept

Cisco WLC Peer-to-Peer (P2P) Blocking configuration under WLAN Advanced tab
Estimated Time:1m 30s
Question 352Question →

A network administrator is configuring Rapid PVST+ on a Cisco Catalyst switch to optimize Spanning Tree Protocol (STP) operations for VLAN 30. The administrator wants to manually set the bridge priority so that this switch becomes a predictable root bridge for VLAN 30. Which command will be successfully accepted by Cisco IOS CLI without returning a configuration error?

Show answer & explanation

Answer: spanning-tree vlan 30 priority 20480

Answer

The command 'spanning-tree vlan 30 priority 20480' is valid because priority values must be specified in increments of 4096.
The correct answer specifies a base priority value (2048020480) that is a valid multiple of 4096 (5×40965 \times 4096). In Cisco switches running Rapid PVST+, the Bridge ID uses a 4-bit priority field and a 12-bit System ID Extension containing the VLAN number. Consequently, configured priority values must be multiples of 4096.

Step-by-Step Solution

1
Analyze the IEEE 802.1t / Rapid PVST+ Bridge Identifier (BID) structure.
The 8-byte BID consists of a 2-byte Bridge Priority (4-bit Priority + 12-bit System ID Extension) and a 6-byte MAC Address.
Because the 4 highest bits represent the configurable priority, valid CLI priority values can only change in steps of 212=40962^{12} = 4096.
2
Evaluate the mathematical validity of the priority values.
20480/4096=5.020480 / 4096 = 5.0, which is a whole integer. 18000/4096=4.394518000 / 4096 = 4.3945, which is invalid.
Cisco IOS enforces priority inputs to be strictly in multiples of 4096 (0,4096,8192,12288,16384,20480,24576,28672,327680, 4096, 8192, 12288, 16384, 20480, 24576, 28672, 32768, etc.).
3
Verify System ID Extension behavior.
The administrator specifies the base priority (2048020480), and the switch automatically adds the VLAN ID (3030) to form a priority of 2051020510 in BPDU frames.
Entering 2051020510 manually in the CLI is rejected because the CLI expects only the un-extended base priority value.

Key Concept

Rapid PVST+ System ID Extension and Bridge Priority Calculation
Question 353Question →

A network engineer is configuring interface GigabitEthernet0/8 on a Cisco Catalyst switch to connect a security IP camera. The requirements specify creating a new VLAN named CAMERAS with VLAN ID 65 and configuring the interface as a static access port assigned to this VLAN. Which sequence of Cisco IOS commands correctly completes this configuration from global configuration mode?

Show answer & explanation

Answer: vlan 65
name CAMERAS
exit
interface gigabitethernet0/8
switchport mode access
switchport access vlan 65

Answer

The correct command sequence creates VLAN 65, assigns it the name CAMERAS, and provisions interface GigabitEthernet0/8 using 'switchport mode access' and 'switchport access vlan 65'.
Proper Cisco IOS VLAN and access port configuration requires instantiating the VLAN with 'vlan <vlan-id>' in global configuration mode, naming it with 'name <name>', returning to global configuration mode, entering the target interface configuration context, explicitly defining static access mode with 'switchport mode access', and binding the port to the specified VLAN using 'switchport access vlan <vlan-id>'.

Step-by-Step Solution

1
Create and name the VLAN in global configuration mode
VLAN 65 is instantiated with the name CAMERAS using 'vlan 65' followed by 'name CAMERAS'.
VLANs must be instantiated in the VLAN database to segment broadcast domains.
2
Enter interface configuration mode for GigabitEthernet0/8
The CLI prompt changes to switch(config-if)#.
Port assignment commands must be executed under the specific interface configuration context.
3
Set static access mode and assign the port to VLAN 65
Executing 'switchport mode access' disallows dynamic trunking, and 'switchport access vlan 65' places the interface in VLAN 65.
Explicitly setting access mode disables Dynamic Trunking Protocol (DTP) negotiation and locks the port into access operation.

Key Concept

VLAN Creation and Access Port Assignment Syntax
Question 354Question →

A network administrator is categorizing Cisco Lightweight Access Point (LAP) operational modes to ensure appropriate deployment across enterprise campus and branch locations. Which AP mode on the left corresponds to each functional traffic handling and operational behavior on the right?

Click a left item, then click its matching right item

Items

Local Mode
FlexConnect Mode
Sniffer Mode
Rogue Detector Mode

Matches

Show answer & explanation

Answer

Local Mode corresponds to default CAPWAP central tunneling of all client traffic; FlexConnect Mode corresponds to local traffic switching and WAN failure resiliency for branch sites; Sniffer Mode corresponds to capturing raw 802.11 frames for packet analysis; Rogue Detector Mode corresponds to monitoring wired subnets to detect unauthorized AP connections.
Each Cisco LAP mode serves a specific operational role: Local mode is the default central-tunneling mode; FlexConnect mode allows local traffic switching at branch sites; Sniffer mode collects RF packet captures for troubleshooting; Rogue Detector mode checks the wired network to detect rogue APs physically connected to switches.

Step-by-Step Solution

1
Analyze Centralized AP Operations
Local Mode is identified as the default LAP state where CAPWAP data and control tunnels carry all client frames to the WLC.
Campus deployments rely on central WLC data plane processing via Local mode.
2
Analyze Remote Branch AP Operations
FlexConnect Mode is identified as the mode designed for WAN-connected branch offices requiring local switching and standalone resilience.
FlexConnect avoids sending all branch user traffic across high-latency or low-bandwidth WAN links.
3
Differentiate Specialized Non-Client Servicing Modes
Sniffer Mode dedicates radios to capturing 802.11 air traffic for packet analyzers, while Rogue Detector Mode listens on wired networks to correlate rogue wireless MAC addresses.
Both modes cease servicing wireless clients to perform dedicated diagnostic or security functions.

Key Concept

Cisco Access Point Operating Modes and Traffic Handling
Estimated Time:1m 30s
Question 355Question →

A network administrator is configuring a new Wireless LAN (WLAN) for guest client connectivity on a Cisco Wireless LAN Controller (WLC) using the GUI. Arrange the administrative steps in the correct chronological sequence from first to last to properly configure and enable the WLAN.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological sequence is: 1) Navigate to WLANs and select 'Create New', 2) Define Profile Name, SSID, and ID, 3) Map the dynamic interface under the General tab, 4) Configure Layer 2 security settings under the Security tab, and 5) Enable the WLAN Status checkbox under the General tab and Apply.
The proper administrative workflow in Cisco AireOS WLC GUI begins with creating the WLAN container ('Create New'). Next, the administrator assigns identity parameters (Profile Name and SSID). Once created, the administrator binds the WLAN to its dynamic interface under the General tab, configures Layer 2 security parameters under the Security tab, and finally checks the Status checkbox under the General tab to enable the network for client association.

Step-by-Step Solution

1
Navigate to the WLANs menu in the Cisco WLC GUI.
Access the WLAN configuration index page.
Choosing 'Create New' initiates the wizard to instantiate a new WLAN ID.
2
Input the Profile Name and SSID, then click Apply.
The WLC creates the WLAN profile instance.
Basic naming attributes are required before sub-tab parameters become editable.
3
Select the target dynamic interface/VLAN on the General tab.
Wireless client traffic on this WLAN is mapped to the selected network interface.
Interface binding ensures clients receive IP addresses from the correct subnet.
4
Select the Security tab and define Layer 2 security settings (e.g., WPA2/WPA3 PSK or 802.1X).
Encryption and authentication policies are bound to the WLAN.
Wireless clients must authenticate using matching security parameters to join.
5
Return to the General tab, check the Status box, and click Apply.
The WLAN state changes to Enabled.
WLANs are created in a disabled state by default to prevent client association during configuration.

Key Concept

Cisco WLC GUI WLAN Provisioning Lifecycle
Estimated Time:1m 30s
Question 356Question →

Match each Layer 2 discovery protocol characteristic or configuration parameter on the left with its corresponding description or default value on the right.

Click a left item, then click its matching right item

Items

IEEE 802.1AB
CDP default holdtime
LLDP default reinitialization delay
lldp run

Matches

Show answer & explanation

Answer

IEEE 802.1AB matches the open vendor-neutral standard specification for LLDP. CDP default holdtime matches 180 seconds. LLDP default reinitialization delay matches 2 seconds. 'lldp run' matches the global configuration command used to enable LLDP on a Cisco switch.
IEEE 802.1AB is the official open standard defining LLDP. CDP defaults to an advertisement interval of 60 seconds and a holdtime of 180 seconds. The LLDP reinitialization delay defaults to 2 seconds on Cisco switches. Enabling LLDP globally requires the 'lldp run' global configuration command.

Step-by-Step Solution

1
Identify the standard governing LLDP.
IEEE 802.1AB is the formal IEEE standard for LLDP, distinguishing it from Cisco proprietary CDP.
Knowledge of protocol standardization helps determine multi-vendor interoperability.
2
Determine the default CDP timer values.
CDP sends advertisements every 60 seconds and maintains a holdtime of 180 seconds by default.
Timer parameters ensure neighbor records persist across three missed advertisement intervals.
3
Identify default LLDP operational timers.
The LLDP reinitialization delay (lldp reinit) defaults to 2 seconds, which delays LLDP initialization on an interface after a state change.
Understanding default timer settings is critical for troubleshooting protocol behavior and flapping links.
4
Verify global configuration syntax for LLDP activation.
The command 'lldp run' enables LLDP globally on Cisco IOS switches.
LLDP is disabled by default on some Cisco platforms or software versions, requiring global activation before interface commands take effect.

Key Concept

Layer 2 Discovery Protocol Standards, Timers, and Configuration Commands
Estimated Time:1m 30s
Question 357Question →

A network administrator is configuring interface FastEthernet0/18 on switch SW-2 to connect an end-user workstation in VLAN 75. The interface must be explicitly set to access mode and assigned to VLAN 75. Which two commands must be entered in interface configuration mode to complete this setup? (Select two.)

Select all that apply

Show answer & explanation

Answer: switchport mode access; switchport access vlan 75

Answer

To configure a switch port for end-device access connectivity, the engineer must statically set the port mode to access using 'switchport mode access' and assign it to the designated VLAN using 'switchport access vlan 75'.
Proper access port configuration requires two explicit commands in interface configuration mode: 'switchport mode access' to define the port as a static access port, and 'switchport access vlan 75' to assign it to VLAN 75.

Step-by-Step Solution

1
Set the administrative mode of the interface to access.
The interface is forced into access mode and will not negotiate trunking.
Ensures the port operates strictly as a single-VLAN access port.
2
Assign the access port to VLAN 75.
The interface becomes a member of VLAN 75.
Associates untagged frames received on FastEthernet0/18 with broadcast domain VLAN 75.

Key Concept

Access Port VLAN Assignment
Question 358Question →

A network engineer is auditing an enterprise switch network operating with Rapid PVST+. Which two statements correctly describe the port roles and operational mechanisms of Rapid PVST+? (Select two.)

Select all that apply

Show answer & explanation

Answer: An Alternate port serves as a backup path toward the Root Bridge and can immediately transition to the Root Port role if the active Root Port fails.; A Backup port provides redundant connectivity to a shared segment where another port on the same local switch is functioning as the Designated port.

Answer

The correct statements are that an Alternate port serves as a backup path toward the Root Bridge and can transition immediately upon root port failure, and that a Backup port provides redundant connectivity to a shared segment where another port on the same switch is the Designated port.
Rapid PVST+ defines explicit port roles to achieve rapid convergence. An Alternate port provides a backup path to the root bridge and takes over immediately if the root port fails. A Backup port provides a redundant link to a shared collision domain where another interface on the same switch is already the designated port.

Step-by-Step Solution

1
Evaluate the definition and convergence behavior of Rapid PVST+ Alternate ports.
Alternate ports receive BPDUs from other switches and act as backup root paths, transitioning immediately to root ports without forwarding delays during failures.
Rapid PVST+ optimizes convergence by allowing pre-calculated alternate paths to become root ports instantaneously.
2
Evaluate the definition and function of Rapid PVST+ Backup ports.
Backup ports receive BPDUs from another interface on the exact same switch on a shared medium where the local switch is designated.
This redundant port role specifically addresses self-loop scenarios on shared collision domains.
3
Verify bridge priority calculation rules for Rapid PVST+.
Configurable base priorities must be multiples of 4096 due to the 4-bit priority portion of the extended bridge ID.
Increments of 1024 are invalid and will be rejected by Cisco IOS CLI.
4
Analyze PortFast placement guidelines and Rapid PVST+ handshake mechanics.
Proposal-agreement handshakes function on point-to-point links automatically; PortFast is restricted to edge ports.
Misconfiguring PortFast on trunks bypasses standard loop protection mechanisms.

Key Concept

Rapid PVST+ Port Roles and Operational Characteristics
Question 359Question →

A network administrator configures a Cisco Catalyst switch running Rapid PVST+ by setting the base bridge priority for VLAN 25 to 1638416384 using the command `spanning-tree vlan 25 priority 16384`. Which value represents the exact priority component of the Bridge Identifier (BID) transmitted in BPDUs by this switch for VLAN 25?

Show answer & explanation

Answer: 1640916409

Answer

The correct priority component in the BID is 1640916409, calculated by adding the configured base priority of 1638416384 and the VLAN ID extension of 2525.
Rapid PVST+ implements 802.1t System ID Extension, dividing the traditional 16-bit priority field into a 4-bit Priority field (multiples of 4096) and a 12-bit System ID Extension containing the VLAN ID. When a switch transmits BPDUs for VLAN 25 with a base priority of 1638416384, the actual BID priority header value becomes 16384+25=1640916384 + 25 = 16409.

Step-by-Step Solution

1
Identify the base priority and System ID Extension configured for the VLAN.
Base Priority = 1638416384, System ID Extension = 2525 (VLAN 25).
Rapid PVST+ uses the 12-bit System ID Extension to embed the VLAN ID into the Bridge Identifier structure.
2
Calculate the total BID priority value.
16384+25=1640916384 + 25 = 16409.
The total bridge priority field encoded into BPDUs is the sum of the 4-bit base priority prefix and the 12-bit VLAN identifier.

Key Concept

Rapid PVST+ System ID Extension and Bridge Identifier (BID) Calculation
Question 360Question →

A network administrator has deployed Cisco Lightweight Access Points (LAPs) in FlexConnect mode at a remote branch office connected via WAN to a centralized Wireless LAN Controller (WLC) at headquarters. The WAN link between the branch and headquarters suddenly fails, causing the APs to lose communication with the WLC. Which two statements accurately describe the operational behavior of the APs while in FlexConnect standalone mode? (Choose two.)

Select all that apply

Show answer & explanation

Answer: WLANs configured for FlexConnect local switching continue to forward client data traffic locally at the branch.; WLANs configured for central switching cease forwarding client traffic because the CAPWAP data tunnel to the WLC is down.

Answer

In FlexConnect standalone mode, WLANs configured for local switching continue forwarding client traffic locally at the branch, while WLANs configured for central switching stop forwarding traffic because the CAPWAP tunnel to the central WLC is unavailable.
When a FlexConnect AP loses its CAPWAP control tunnel to the centralized WLC, it enters standalone mode. In standalone mode, WLANs configured for local switching remain operational because traffic is mapped directly to local VLANs on the branch switch. Conversely, WLANs configured for central switching fail because client traffic must be encapsulated in CAPWAP and sent to the WLC, which is unreachable due to the WAN outage.

Step-by-Step Solution

1
Analyze the impact of WLC unreachability on FlexConnect local switching WLANs.
Local switching allows the branch AP to handle 802.11 to 802.3 frame conversion locally, allowing existing and new locally authenticated client traffic to flow without WLC CAPWAP encapsulation.
FlexConnect was designed specifically for branch reliability so local resources remain accessible during WAN outages.
2
Analyze the impact of WLC unreachability on centrally switched WLANs.
Central switching requires data packets to be tunneled via CAPWAP to the WLC at headquarters. Without WAN reachability to the WLC, the CAPWAP data path is broken.
Data frames cannot be processed locally on centrally switched SSIDs.
3
Evaluate invalid assumptions regarding automatic AP mode switching or controller election.
Standard Local mode APs drop clients when WLC connectivity fails, and FlexConnect standalone APs do not act as local Wireless LAN Controllers.
AP operational modes are administratively defined and do not dynamically alter their fundamental architecture during fault conditions.

Key Concept

FlexConnect Standalone Mode vs Connected Mode Traffic Handling
Estimated Time:1m 30s
PreviousPage 18 / 20Next
Network Access Practice Questions — Cisco CCNA — Page 18 | Examkin