Examkin

Network Access

400 questions

All types400Multiple choice204Multiple select91Matching23Ordering82
Question 21Question →

A network engineer connects a new point-to-point link between Switch-1 and Switch-2 in an enterprise network running Rapid PVST+. Place the steps of the RSTP Proposal/Agreement fast convergence mechanism in the correct chronological order from link initialization to the Designated Port entering the Forwarding state.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological sequence for the Rapid PVST+ Proposal/Agreement handshake is: 1) Switch-1 sends a BPDU with the Proposal bit set on its Designated Port (in Discarding state) toward Switch-2. 2) Switch-2 receives the superior BPDU, selects the receiving port as its new Root Port, and enters the synchronization phase. 3) Switch-2 blocks all of its non-edge Designated Ports by placing them into the Discarding state. 4) Switch-2 transmits an Agreement BPDU back to Switch-1 out of its newly selected Root Port. 5) Switch-1 receives the Agreement BPDU and immediately transitions its Designated Port to the Forwarding state.
In Rapid PVST+ (IEEE 802.1w), fast convergence on point-to-point links relies on an explicit proposal/agreement handshake. When a link initializes, the upstream switch sends a BPDU with the Proposal bit set while its Designated Port is in the Discarding state. The downstream switch evaluates the BPDU, adopts the interface as its new Root Port, and enters the sync phase by blocking (placing in Discarding) all non-edge Designated Ports to eliminate loop potential. Once synchronized, the downstream switch sends an Agreement BPDU back out its Root Port. Upon receiving the Agreement BPDU, the upstream switch immediately transitions its Designated Port into the Forwarding state without waiting for traditional 802.1D timers.

Step-by-Step Solution

1
Initiate the handshake proposal
Switch-1 sends a BPDU with the Proposal bit set while its port is in the Discarding state.
Rapid PVST+ relies on active proposal/agreement handshake frames across point-to-point links rather than passive timer delays.
2
Process the proposal on the receiving switch
Switch-2 identifies the interface as its new Root Port upon evaluating the superior BPDU.
Accepting a superior BPDU triggers Switch-2 to sync its topology before confirming agreement.
3
Synchronize downstream ports to prevent loops
Switch-2 forces all non-edge Designated Ports into the Discarding state (sync process).
Isolating local non-edge ports guarantees that no active switching loop can form while transitioning the new Root Port.
4
Send agreement confirmation
Switch-2 transmits an Agreement BPDU back to Switch-1.
The Agreement BPDU explicitly informs Switch-1 that Switch-2 has safely synchronized its downstream ports.
5
Complete rapid transition to Forwarding
Switch-1 transitions its Designated Port directly into the Forwarding state.
Because Switch-2 confirmed loop safety via the Agreement BPDU, Switch-1 can bypass legacy 802.1D listening and learning timers.

Key Concept

Rapid PVST+ Proposal/Agreement Handshake Mechanism
Question 22Question →

A network administrator configures a Cisco Catalyst switch running Rapid PVST+ with the command `spanning-tree vlan 50 priority 8192`. What total bridge priority value will this switch include in its outgoing Bridge Protocol Data Units (BPDUs) for VLAN 50?

Show answer & explanation

Answer: 82428242

Answer

The total bridge priority included in BPDUs for VLAN 50 is 82428242.
In Cisco Rapid PVST+, the 16-bit Bridge Priority field is divided into a 4-bit configurable priority value (in increments of 4096) and a 12-bit System ID Extension representing the VLAN ID. When a base priority of 81928192 is configured for VLAN 50, the switch combines the base priority with the VLAN ID (8192+50=82428192 + 50 = 8242) to form the total bridge priority advertised in BPDUs.

Step-by-Step Solution

1
Identify the base bridge priority configured on the switch.
The configured base bridge priority is 81928192.
The CLI command explicitly sets the base priority to 81928192.
2
Determine the System ID Extension for the specified VLAN.
The System ID Extension is equal to the VLAN ID, which is 5050.
Rapid PVST+ uses the 12-bit System ID Extension field to encode the VLAN number into the Bridge ID.
3
Calculate the total bridge priority advertised in BPDUs.
8192+50=82428192 + 50 = 8242.
Total Bridge Priority = Base Priority + System ID Extension.

Key Concept

Rapid PVST+ Bridge ID Structure and System ID Extension
Question 23Question →

A network administrator is configuring and verifying Layer 2 discovery protocols across a enterprise topology consisting of Cisco and multi-vendor switches. Match each Cisco IOS command on the left with its corresponding operational scope and function on the right.

Click a left item, then click its matching right item

Items

cdp run
no cdp enable
lldp transmit
show lldp neighbors detail

Matches

Show answer & explanation

Answer

The correct matches pair 'cdp run' with 'Global configuration command that enables Cisco Discovery Protocol across all supported device interfaces.', 'no cdp enable' with 'Interface configuration command that disables Cisco Discovery Protocol on a specific interface.', 'lldp transmit' with 'Interface configuration command that selectively enables sending Link Layer Discovery Protocol packets out of an interface.', and 'show lldp neighbors detail' with 'Privileged EXEC mode command that displays expanded neighbor information, including management IP addresses and system capabilities.'
Each Cisco IOS command corresponds directly to a specific scope and function: 'cdp run' turns on CDP globally across the chassis, 'no cdp enable' disables CDP on an individual port, 'lldp transmit' enables outbound LLDP packet transmission on a specific port, and 'show lldp neighbors detail' provides detailed neighbor operational information.

Step-by-Step Solution

1
Identify the configuration scope (global vs. interface vs. EXEC mode) for each command.
'cdp run' is global configuration; 'no cdp enable' and 'lldp transmit' are interface configuration; 'show lldp neighbors detail' is EXEC mode verification.
Understanding mode syntax is critical for proper Layer 2 discovery protocol deployment.
2
Distinguish CDP single-state toggle from LLDP directional interface controls.
CDP uses 'cdp enable' / 'no cdp enable' per interface, whereas LLDP uses separate 'lldp transmit' and 'lldp receive' commands per interface.
LLDP provides granular directional transmission control that CDP does not.
3
Map each command to its precise definition.
Match left_1 to right_1, left_2 to right_2, left_3 to right_3, and left_4 to right_4.
Validates proper CLI syntax and operational scope for Cisco IOS discovery protocols.

Key Concept

CDP and LLDP CLI Syntax, Configuration Scopes, and Verification Commands
Question 24Question →

A network administrator is configuring interface GigabitEthernet1/0/14 on a Cisco Catalyst switch to connect an end-user workstation. The workstation must be placed into VLAN 30, and the interface must be explicitly prevented from negotiating a trunk link. Which TWO commands must be executed under interface configuration mode to accomplish this setup? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: switchport mode access; switchport access vlan 30

Answer

The correct commands to execute in interface configuration mode are 'switchport mode access' and 'switchport access vlan 30'.
Configuring an access port on a Cisco Catalyst switch requires setting the administrative mode to access using 'switchport mode access' and binding the port to a target VLAN using 'switchport access vlan 30'. Both commands must be run within the interface configuration mode.

Step-by-Step Solution

1
Set the operational mode of GigabitEthernet1/0/14 to static access mode.
Interface is locked into access mode using 'switchport mode access'.
Prevents accidental trunk negotiation with connected end-user devices via DTP.
2
Assign the access port to the designated VLAN.
Interface is assigned to VLAN 30 using 'switchport access vlan 30'.
Places untagged frames received on this interface into the Layer 2 broadcast domain of VLAN 30.

Key Concept

Static Access Port Assignment and VLAN Configuration
Question 25Question →

A network administrator needs to establish out-of-band administrative access to a Cisco Wireless LAN Controller (WLC) for system maintenance. The out-of-band management network uses subnet 192.168.100.0/24192.168.100.0/24, which is completely isolated from production wireless client traffic and general infrastructure VLANs. Which physical interface and configuration method on the WLC should the administrator use to achieve this isolated management connection?

Show answer & explanation

Answer: Configure the physical Service Port with an IP address on the 192.168.100.0/24192.168.100.0/24 subnet, as it provides dedicated out-of-band management access and maintains a separate routing table.

Answer

The Service Port should be configured with an IP address on the out-of-band network because it is physically isolated and maintains a distinct routing table from the main distribution system ports.
The Cisco WLC Service Port is specifically designed for out-of-band management. It operates independently from the controller's distribution system ports and maintains its own routing table, allowing network administrators to access the WLC GUI, SSH, or SNMP even if the production network or in-band interfaces are unreachable.

Step-by-Step Solution

1
Identify the specific functional requirement from the scenario.
The requirement specifies completely isolated out-of-band management connectivity on subnet 192.168.100.0/24192.168.100.0/24.
Different Cisco WLC interfaces serve distinct roles (Management vs. Service Port vs. Dynamic vs. Virtual).
2
Evaluate the role of the WLC Service Port.
The Service Port is a 10/100/1000 Ethernet port dedicated solely to out-of-band management access (GUI/SSH/SNMP).
It operates outside the main data-plane distribution system trunk lines and uses a dedicated non-routable interface context.
3
Compare against in-band logical interfaces.
The Management Interface, Virtual Interface, and Dynamic Interfaces reside on distribution system ports and handle in-band traffic, client mapping, or mobility features.
Only the physical Service Port satisfies strict out-of-band isolation demands.

Key Concept

Cisco WLC Interface Types (Service Port vs. Management Interface)
Question 26Question →

Match each Cisco Lightweight Access Point (AP) operational mode on the left with its corresponding functional behavior and traffic forwarding characteristics on the right.

Click a left item, then click its matching right item

Items

Local Mode
FlexConnect Mode
Monitor Mode
Rogue Detector Mode
Sniffer Mode

Matches

Show answer & explanation

Answer

Local Mode pairs with central CAPWAP tunnel encapsulation; FlexConnect Mode pairs with local switching and WAN failover fallback; Monitor Mode pairs with continuous channel scanning for WIDS/rogue detection; Rogue Detector Mode pairs with wired ARP/MAC table monitoring; Sniffer Mode pairs with capturing and forwarding raw 802.11 frames to a packet analyzer.
Each AP mode matches its precise Cisco implementation standards: Local mode centralizes traffic over CAPWAP tunnels; FlexConnect mode allows local switching and standalone branch operation; Monitor mode scans wireless channels without serving clients; Rogue Detector correlates wired ARP/MAC tables with reported rogue lists; Sniffer mode captures raw 802.11 frames for analysis.

Step-by-Step Solution

1
Classify client-serving operational modes in Cisco centralized vs branch architectures.
Local mode centralizes all data and control traffic via CAPWAP tunnels to the controller. FlexConnect mode provides local data switching and standalone operation for branch offices.
Differentiating central switching from decentralized local switching in AP architectures.
2
Analyze non-client-serving specialized AP modes.
Monitor, Rogue Detector, and Sniffer modes disable standard client associations to perform specialized monitoring tasks.
Identifying the operational focus of specialized Cisco wireless modes.
3
Map specific interface behaviors to non-client-serving modes.
Monitor mode continuously cycles radios across channels; Rogue Detector disables radios to inspect wired ARP/MAC tables; Sniffer mode captures raw 802.11 frames on designated channels.
Distinguishing between radio scanning, wired correlation, and packet capture mechanisms.

Key Concept

Cisco Access Point Operational Modes and Traffic Forwarding Architectures
Question 27Question →

An administrator needs to create a new WPA2-Personal WLAN using the Cisco Wireless LAN Controller (WLC) GUI. Place the steps in the correct chronological order to complete this configuration.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts by selecting 'Create New' on the WLANs page, defining the Profile Name and SSID, enabling the WLAN and mapping the interface under the General tab, and finally configuring PSK under the Layer 2 Security tab.
The correct order follows standard WLC GUI workflow: first initiating creation via the drop-down menu on the WLANs page, defining the WLAN identity (Profile Name and SSID), enabling the WLAN and selecting its interface under the General tab, and finally defining authentication parameters under the Layer 2 Security tab.

Step-by-Step Solution

1
Initiate WLAN creation
Access the creation interface by choosing 'Create New' on the WLANs menu.
The controller requires starting a new instance from the main WLAN management page.
2
Define WLAN identification
Specify the Profile Name, broadcast SSID, and numerical WLAN ID.
Applying these parameters creates the WLAN entry and opens the WLAN Edit configuration sub-menus.
3
Configure General settings
Map the WLAN to its target interface/VLAN and set the WLAN Status to Enabled.
Clients cannot connect unless the WLAN is bound to an active interface and enabled.
4
Configure Security settings
Set Layer 2 Security to WPA2/WPA3, select PSK under Auth Key Management, and set the password.
This establishes the WPA2-Personal authentication requirements for connecting clients.

Key Concept

WLC GUI WLAN Configuration Sequence
Question 28Question →

An engineer is attempting to deploy a routed Layer 3 EtherChannel between two distribution switches. The logical interface `Port-channel 1` has been configured with `no switchport` and assigned an IPv4 address. However, executing `show etherchannel summary` reveals the following output:

text
Flags: D - down P - bundled in port-channel
I - stand-alone s - suspended
H - Hot-standby (LACP only)
R - Layer3 S - Layer2
U - in use f - failed to allocate aggregator

Group Port-channel Protocol Ports
------+-------------+----------+-----------------------------------------------
1 Po1(SD) LACP Gi0/1(I) Gi0/2(I)

Which configuration step is required on the local switch to resolve this issue and bring the EtherChannel to an operational `SU` state?

Show answer & explanation

Answer: Execute the `no switchport` command on physical interfaces GigabitEthernet0/1 and GigabitEthernet0/2 before bundling them into the channel group.

Answer

Execute the `no switchport` command on physical interfaces GigabitEthernet0/1 and GigabitEthernet0/2 before bundling them into the channel group.
In Cisco IOS/IOS-XE, creating a routed (Layer 3) EtherChannel requires disabling Layer 2 switching capabilities using `no switchport` on both the physical member interfaces (GigabitEthernet0/1 and GigabitEthernet0/2) and the logical Port-Channel interface. When physical ports remain configured as Layer 2 switchports while the port-channel is routed, the physical ports cannot be bundled, showing flag `I` (stand-alone), and the port-channel shows flag `S` (Layer 2) and `D` (Down).

Step-by-Step Solution

1
Analyze the `show etherchannel summary` flags
Po1 status is `SD` (Layer 2, Down) and member ports Gi0/1 and Gi0/2 are marked with flag `I` (Stand-alone).
The flag `S` indicates the port-channel is operating in Layer 2 mode instead of Layer 3 (`R`), causing a capability mismatch with the Layer 3 logical interface setup.
2
Identify missing physical interface commands
The physical member interfaces Gi0/1 and Gi0/2 still have default Layer 2 `switchport` operational characteristics.
For a routed Layer 3 EtherChannel, `no switchport` must be applied to all participating physical member interfaces as well as the logical Port-Channel interface.
3
Determine the corrective configuration change
Entering interface range configuration mode for Gi0/1 - 2 and issuing `no switchport` converts the physical member interfaces to Layer 3, allowing them to successfully bundle (`P`) under `Po1(RU)`.
Layer matching across physical member ports and logical channel interfaces is mandatory for successful LACP aggregation.

Key Concept

Layer 3 EtherChannel Physical and Logical Port Matching
Question 29Question →

In a Cisco centralized wireless network deployment, how does a Lightweight Access Point (LAP) operating in default Local mode handle wireless client data traffic?

Show answer & explanation

Answer: It encapsulates all client data traffic within a CAPWAP tunnel and forwards it directly to the Wireless LAN Controller (WLC) for switching.

Answer

In default Local mode, a Cisco Lightweight AP encapsulates all wireless client data traffic into a CAPWAP tunnel and sends it to the WLC for centralized processing and switching.
In a Cisco centralized wireless architecture, an AP operating in default Local mode sends all client traffic through a CAPWAP data tunnel directly to the Wireless LAN Controller (WLC). The controller then centrally processes and switches this traffic onto the wired LAN.

Step-by-Step Solution

1
Identify the operation mode of the access point.
The access point is operating in standard default Local mode under a centralized Cisco WLC architecture.
Local mode is the default state for a Lightweight AP connected to a WLC.
2
Determine the data path for client traffic in Local mode.
Wireless client data frames received by the AP are encapsulated in CAPWAP data packets and tunneled to the WLC.
Split-MAC architecture designates real-time 802.11 functions to the AP while management, authentication, and data switching are centralized at the controller.

Key Concept

Cisco Centralized Wireless Architecture and Local AP Mode CAPWAP Data Tunneling
Estimated Time:45s
Question 30Question →

An administrator is configuring client connectivity for a new wireless network using the Cisco Wireless LAN Controller (WLC) web interface. The WLAN must use WPA2-Personal (PSK) authentication and be mapped to a dedicated dynamic interface. Arrange the GUI configuration steps in the correct sequential order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of configuration steps is: 1) Select Create New and click Go on the WLANs page; 2) Define the Profile Name and SSID, then click Apply; 3) Map the dynamic interface under the General tab; 4) Configure WPA2-Personal (PSK) under Security > Layer 2; 5) Check the Status Enabled box on the General tab and click Apply.
Configuring a WLAN via the Cisco WLC GUI follows a defined procedural sequence. First, the administrator must navigate to WLANs > WLANs, select 'Create New', and click 'Go'. Second, the Profile Name and SSID are specified, followed by clicking 'Apply' to generate the profile entry. Third, under the General tab, the administrator maps the WLAN to the designated dynamic interface. Fourth, under Security > Layer 2, WPA2 Policy is enabled alongside PSK key management and the pre-shared key value. Fifth, the administrator returns to the General tab to check the Status checkbox to Enabled, clicking Apply to operationalize the WLAN.

Step-by-Step Solution

1
Initiate WLAN Creation
Navigating to WLANs > WLANs, selecting 'Create New' from the drop-down menu, and clicking 'Go' opens the initial setup page.
You must create a new profile instance before configuring parameters.
2
Define Profile Name and SSID
Entering the Profile Name and SSID and clicking 'Apply' instantiates the WLAN entry in the controller configuration.
The WLC requires an established Profile Name and SSID identifier before opening the full edit menu.
3
Bind Dynamic Interface
Selecting the dynamic interface on the General tab binds wireless client traffic to the appropriate VLAN.
Interface mapping determines client IP address assignment and network access.
4
Configure Layer 2 Security
Selecting WPA+WPA2, enabling WPA2 Policy, enabling PSK, and entering the pre-shared key secures client connections.
Layer 2 security options must be configured under Security > Layer 2 rather than Layer 3 or AAA tabs.
5
Enable and Save WLAN
Checking the 'Status: Enabled' box on the General tab and clicking 'Apply' activates the SSID across associated APs.
WLAN profiles are disabled by default during creation and must be explicitly enabled after all configurations are set.

Key Concept

Cisco WLC GUI WLAN Configuration Sequence
Estimated Time:1m 15s
Question 31Question →

A network administrator is configuring Rapid PVST+ on a Cisco Catalyst switch. The administrator intends for the switch to advertise a total Bridge Priority of 2053020530 for VLAN 5050 in its outgoing BPDUs to influence the Root Bridge election. Which priority value must be specified in the `spanning-tree vlan 50 priority <value>` command?

Show answer & explanation

Answer: 20480

Answer

The base priority value that must be configured is 20480.
In Cisco Rapid PVST+, the Bridge Priority is composed of a 4-bit Base Priority field and a 12-bit System ID Extension field containing the VLAN ID. The Base Priority must be configured as a multiple of 4096 (0,4096,8192,dots,614400, 4096, 8192, dots, 61440). When the command `spanning-tree vlan 50 priority 20480` is executed, the switch automatically adds the VLAN ID (5050) to the base priority (2048020480), producing a total advertised Bridge Priority of 2053020530.

Step-by-Step Solution

1
Understand the Spanning Tree Bridge Identifier (BID) priority composition in Rapid PVST+.
Total Bridge Priority = Base Priority + System ID Extension (VLAN ID).
Rapid PVST+ uses 802.1t System ID Extension, allocating 4 bits for the base priority (in increments of 4096) and 12 bits for the VLAN ID.
2
Calculate the required base priority for VLAN 50 given a total priority of 20530.
Base Priority = 20530 - 50 = 20480.
Subtracting the VLAN ID (50) from the target total Bridge Priority yields the exact base priority.
3
Verify that the base priority is a valid increment of 4096.
20480 / 4096 = 5 (an exact integer multiple).
The Cisco IOS CLI accepts only values in increments of 4096 (e.g., 0, 4096, 8192, 12288, 16384, 20480, 24576, 28672, 32768).

Key Concept

Rapid PVST+ System ID Extension and Bridge Priority Increment Calculation
Question 32Question →

A network administrator needs to manually configure a static IEEE 802.1Q trunk on a Cisco Catalyst switch interface (GigabitEthernet0/1), set the native VLAN to VLAN 50, and disable Dynamic Trunking Protocol (DTP) frame transmission. What is the correct sequence of Cisco IOS configuration commands to accomplish this task?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with entering interface configuration mode (`interface GigabitEthernet0/1`), explicitly setting the switchport mode to static trunk (`switchport mode trunk`), specifying the untagged native VLAN (`switchport trunk native vlan 50`), and finally disabling DTP frame negotiation (`switchport nonegotiate`).
To properly configure an 802.1Q trunk link with a custom native VLAN and suppressed DTP, an engineer must first enter interface configuration mode (`interface GigabitEthernet0/1`). Next, the port operational mode must be set to static trunking (`switchport mode trunk`). Once the port is in static trunk mode, the native VLAN can be configured (`switchport trunk native vlan 50`), followed by disabling DTP negotiations (`switchport nonegotiate`).

Step-by-Step Solution

1
Enter interface configuration mode
Prompt changes to Switch(config-if)# for GigabitEthernet0/1
Cisco IOS requires navigating to the specific interface context before executing port configuration commands.
2
Set interface mode to trunk
Interface transitions to static trunk operational mode
Static trunking must be active before setting trunk-specific parameters or disabling dynamic DTP negotiation.
3
Specify custom native VLAN
VLAN 50 is assigned as the native VLAN for untagged ingress and egress frames
Overrides the default native VLAN 1 setting on the trunk link.
4
Disable DTP negotiation
Switch stops sending DTP negotiation frames out GigabitEthernet0/1
The switchport nonegotiate command is only valid on interfaces configured in static access or static trunk mode.

Key Concept

Static IEEE 802.1Q trunk configuration and DTP negotiation suppression on Cisco IOS switchports
Question 33Question →

Two Cisco Catalyst switches, SW1 and SW2, are connected via an IEEE 802.1Q trunk link. Interface GigabitEthernet0/1 on SW1 is configured with native VLAN 10, while interface GigabitEthernet0/1 on SW2 is configured with native VLAN 20. When a host in VLAN 10 connected to SW1 sends a broadcast frame across the trunk link, how does SW2 process this frame upon arrival?

Show answer & explanation

Answer: SW2 receives the untagged frame on its trunk interface and forwards it to all active ports assigned to VLAN 20, causing inter-VLAN traffic leakage.

Answer

SW2 receives the untagged frame on its trunk interface and forwards it to all active ports assigned to VLAN 20, causing inter-VLAN traffic leakage.
Under IEEE 802.1Q trunking rules, frames belonging to the native VLAN are sent across the trunk link untagged. When SW1 sends a frame for VLAN 10, it strips any tag because VLAN 10 is its native VLAN. When SW2 receives this untagged frame on a trunk interface configured with native VLAN 20, SW2 associates all untagged incoming traffic with its local native VLAN (VLAN 20) and forwards it accordingly, resulting in inter-VLAN leakage between VLAN 10 and VLAN 20.

Step-by-Step Solution

1
Analyze how 802.1Q handles native VLAN egress traffic on SW1
By default, IEEE 802.1Q trunk interfaces transmit frames belonging to the configured native VLAN without inserting a 4-byte 802.1Q tag header. Thus, SW1 transmits the VLAN 10 broadcast frame untagged.
802.1Q maintains backward compatibility with legacy non-trunking devices by omitting VLAN tags on the designated native VLAN.
2
Analyze how SW2 handles untagged ingress traffic on an 802.1Q trunk
When a switch receives an untagged frame on an 802.1Q trunk port, it automatically maps that frame to whichever VLAN is locally configured as the native VLAN on that specific interface. On SW2, the native VLAN is VLAN 20.
Switches rely entirely on local interface configuration to classify incoming untagged frames.
3
Determine the operational outcome of the mismatch
The broadcast frame sent by VLAN 10 on SW1 is flooded out ports in VLAN 20 on SW2, creating an unintended security vulnerability and cross-VLAN traffic leakage.
Mismatched native VLAN configurations merge separate broadcast domains at Layer 2.

Key Concept

802.1Q Native VLAN Tagging Mechanics and Mismatch Behavior
Estimated Time:1m 30s
Question 34Question →

A network administrator is connecting two Cisco Catalyst switches using an IEEE 802.3ad Link Aggregation Control Protocol (LACP) EtherChannel. SwitchA has its member interfaces configured with the command `channel-group 1 mode passive`. Which mode must be configured on SwitchB's corresponding member interfaces to successfully form the EtherChannel?

Show answer & explanation

Answer: active

Answer

The mode 'active' must be configured on SwitchB.
The correct answer specifies 'active' mode. In LACP, 'active' mode actively sends LACP negotiation frames, whereas 'passive' mode only listens and responds. Because the remote switch is set to 'passive', the local switch must be set to 'active' to initiate communication and successfully build the bundle.

Step-by-Step Solution

1
Identify the protocol associated with the configured mode.
The command 'mode passive' indicates the use of Link Aggregation Control Protocol (LACP), an open standard protocol.
EtherChannel negotiation protocols (LACP vs PAgP) cannot be mixed.
2
Analyze the operational state of LACP 'passive' mode on SwitchA.
SwitchA is in a passive state, meaning it will listen and respond to incoming LACP packets but will not initiate negotiation.
Two passive switches will wait indefinitely for the other to start negotiation, keeping the link down.
3
Determine the required mode for SwitchB.
SwitchB must be set to 'active' mode so that it actively transmits LACP packets to initiate channel creation.
An LACP EtherChannel requires at least one side to actively initiate negotiation (active-active or active-passive).

Key Concept

LACP Mode Compatibility
Question 35Question →

A network engineer needs to build a functional Layer 3 LACP EtherChannel (Port-channel 10) between two Cisco Catalyst switches using interfaces GigabitEthernet1/0/1 and GigabitEthernet1/0/2. Place the required Cisco IOS CLI configuration steps in the correct order from start to finish.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence for configuring a Layer 3 LACP EtherChannel is: first select the physical interface range (`interface range GigabitEthernet1/0/1 - 2`), disable Layer 2 switching on the physical ports (`no switchport`), create/assign the LACP active group (`channel-group 10 mode active`), enter the logical port-channel interface (`interface Port-channel 10`), and finally assign the IPv4 address (`ip address 192.168.10.1 255.255.255.252`).
To successfully configure a Layer 3 EtherChannel, physical member links must first be selected and converted into routed ports via the `no switchport` command. Next, the LACP dynamic protocol mode (`mode active`) is applied to bind the physical interfaces into channel-group 10. Finally, the network administrator enters the logical `interface Port-channel 10` configuration mode and assigns the IP address to the aggregate interface.

Step-by-Step Solution

1
Select physical range
Enters range configuration mode `(config-if-range)` for member ports.
Allows simultaneous configuration of physical interfaces GigabitEthernet1/0/1 and GigabitEthernet1/0/2.
2
Execute `no switchport` on physical links
Member interfaces become routed ports.
Physical ports must be routed interfaces before being grouped into a Layer 3 EtherChannel.
3
Execute `channel-group 10 mode active`
Creates logical interface Port-channel 10 and binds member links using LACP.
The `active` keyword initiates LACP negotiation.
4
Enter `interface Port-channel 10`
Enters interface configuration mode `(config-if)` for the logical bundle.
Layer 3 parameters must be configured on the aggregate port-channel interface.
5
Assign IP address with `ip address 192.168.10.1 255.255.255.252`
Port-channel 10 is configured with a unicast IP address.
Completes Layer 3 routed EtherChannel setup.

Key Concept

Layer 3 EtherChannel Configuration Sequence
Question 36Question →

A network administrator needs to aggregate physical interfaces GigabitEthernet0/1 and GigabitEthernet0/2 into a Layer 3 LACP EtherChannel (Port-channel 1) and assign an IP address of 10.1.1.1/30 to the logical interface. Place the configuration steps in the correct sequential order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct configuration order is: 1) Select physical member ports (interface range GigabitEthernet0/1 - 2), 2) Disable Layer 2 switching (no switchport), 3) Associate ports with LACP channel-group (channel-group 1 mode active), 4) Enter logical port-channel mode (interface Port-channel 1), and 5) Assign the IP address (ip address 10.1.1.1 255.255.255.252).
To successfully configure a Layer 3 EtherChannel using LACP, physical member interfaces must first be selected (`interface range`), converted to routed ports (`no switchport`), and joined to an active LACP channel group (`channel-group 1 mode active`). Afterwards, the logical interface context must be accessed (`interface Port-channel 1`) to assign the designated IP address (`ip address 10.1.1.1 255.255.255.252`).

Step-by-Step Solution

1
Select target physical interfaces
System enters interface range configuration mode prompt switch(config-if-range)#
Configuration commands must target both physical member interfaces simultaneously.
2
Execute 'no switchport' on physical member interfaces
Physical ports are converted from Layer 2 switch ports to Layer 3 routed ports
Layer 3 EtherChannels require member interfaces to operate in routed mode.
3
Execute 'channel-group 1 mode active'
Physical interfaces are added to EtherChannel group 1 using LACP active negotiation, creating Port-channel 1
The 'active' keyword enables dynamic IEEE 802.3ad LACP protocol negotiation.
4
Execute 'interface Port-channel 1'
System enters interface configuration mode for the logical port-channel switch(config-if)#
Layer 3 IP attributes must be applied directly to the logical bundled interface.
5
Execute 'ip address 10.1.1.1 255.255.255.252'
Logical interface Port-channel 1 receives the specified IP address and subnet mask
This enables routing over the aggregated logical EtherChannel link.

Key Concept

Layer 3 EtherChannel Configuration with LACP
Question 37Question →

A network administrator is setting up interswitch connectivity using standard IEEE 802.1Q trunking. Which action does IEEE 802.1Q take on Ethernet frames to identify VLAN membership as traffic traverses the trunk link?

Show answer & explanation

Answer: It inserts a 4-byte tag containing the VLAN ID directly into the Ethernet frame header between the Source MAC address and Type/Length fields.

Answer

IEEE 802.1Q identifies VLAN membership by inserting a 4-byte header field into the Ethernet frame between the Source MAC address and the Length/Type fields.
IEEE 802.1Q performs internal frame tagging by inserting a 4-byte VLAN tag directly into the Ethernet header between the Source MAC address and the Length/Type fields. This tag includes the Tag Protocol Identifier (0x8100) and the 12-bit VLAN ID.

Step-by-Step Solution

1
Identify the standard frame modification mechanism specified by IEEE 802.1Q for interswitch trunking.
IEEE 802.1Q inserts an in-line 4-byte VLAN tag into the existing Ethernet header.
In-line tagging allows switches on both ends of the trunk link to recognize which VLAN the frame belongs to without wrapping the entire frame in a separate encapsulation wrapper.
2
Analyze the position and structure of the 802.1Q tag.
The tag is placed between the Source MAC Address field and the Length/Type field.
This 4-byte tag includes the Tag Protocol Identifier (TPID 0x8100) and Tag Control Information (TCI), which holds the 12-bit VLAN Identifier (VID).

Key Concept

IEEE 802.1Q Frame Tagging Mechanics
Question 38Question →

A network administrator is replacing legacy Cisco access switches with multi-vendor infrastructure. On a Cisco Catalyst switch (SW-Access1), the administrator attempts to selectively enable Link Layer Discovery Protocol (LLDP) on interface GigabitEthernet1/0/5 to discover an adjacent non-Cisco VoIP gateway while disabling Cisco Discovery Protocol (CDP) on that specific link.

The administrator enters interface configuration mode and attempts the following command sequence:

SW-Access1(config)# interface gigabitethernet1/0/5
SW-Access1(config-if)# no cdp enable
SW-Access1(config-if)# lldp enable

The switch returns an error: `% Invalid input detected at '^' marker` pointing to the `enable` keyword.

Which combination of commands must the administrator issue to globally activate LLDP and correctly enable both transmission and reception of LLDP packets on interface GigabitEthernet1/0/5?

Show answer & explanation

Answer: Execute 'lldp run' in global configuration mode, and execute both 'lldp transmit' and 'lldp receive' in interface configuration mode.

Answer

Execute 'lldp run' in global configuration mode, and execute both 'lldp transmit' and 'lldp receive' in interface configuration mode.
The correct answer specifies 'lldp run' in global configuration mode and both 'lldp transmit' and 'lldp receive' in interface configuration mode. In Cisco IOS, CDP and LLDP differ significantly in CLI command syntax and defaults. CDP is enabled globally by default and uses 'cdp enable' per interface. Conversely, LLDP is disabled globally by default (requiring 'lldp run') and controls interface communication via directional parameters ('lldp transmit' and 'lldp receive').

Step-by-Step Solution

1
Identify the global configuration command required to enable LLDP across the Cisco Catalyst switch.
Unlike CDP which is enabled globally by default ('cdp run'), LLDP is disabled globally by default and must be enabled using the global configuration command 'lldp run'.
Global activation of the LLDP process is a prerequisite before interface-level behavior can be configured.
2
Analyze interface-level configuration syntax differences between CDP and LLDP in Cisco IOS.
CDP uses a simple binary interface toggle command ('cdp enable' / 'no cdp enable'). LLDP does not use the 'enable' keyword at the interface level; instead, it provides directional control using 'lldp transmit' and 'lldp receive'.
Attempting to enter 'lldp enable' on a Cisco IOS interface causes an invalid input error because 'enable' is not a valid sub-command under 'lldp'.
3
Synthesize the required global and interface commands to achieve the administrator's goal.
Issue 'lldp run' globally, and under interface GigabitEthernet1/0/5 issue 'no cdp enable', 'lldp transmit', and 'lldp receive'.
This setup disables CDP on the specific interface while enabling bidirectional LLDP communication with adjacent multi-vendor devices.

Key Concept

Cisco IOS CLI Syntax and Directional Operational Differences Between CDP and LLDP
Question 39Question →

In a centralized Cisco wireless deployment operating under the split-MAC architecture, operational responsibilities are divided between the Lightweight Access Point (AP) and the Wireless LAN Controller (WLC). Which two functions are performed directly by the Lightweight AP? (Select two options.)

Select all that apply

Show answer & explanation

Answer: Real-time 802.11 frame transmission and acknowledgment generation; 802.11 MAC-layer frame encryption and decryption

Answer

The two functions performed directly by the Lightweight AP are real-time 802.11 frame transmission and acknowledgment generation, and 802.11 MAC-layer frame encryption and decryption.
In a Cisco split-MAC wireless architecture, time-sensitive real-time 802.11 MAC functions are offloaded to the Lightweight AP. These include frame transmissions, ACK generation, beaconing, probe responses, and hardware-based wireless encryption/decryption. This ensures low latency and strict adherence to 802.11 timing rules.

Step-by-Step Solution

1
Analyze the split-MAC architecture model in Cisco centralized wireless networks.
Recognize that split-MAC divides 802.11 protocol handling into real-time functions on the AP and non-real-time management functions on the WLC.
Real-time functions require microsecond-level latency responsiveness that cannot survive CAPWAP tunnel transmission delays to the WLC.
2
Identify AP-specific real-time MAC functions.
Select frame acknowledgment (ACK) handling, beaconing, probe responses, and hardware encryption/decryption as AP responsibilities.
These tasks take place directly at the physical and medium access control layers on the local RF interface.
3
Identify WLC management and control functions.
Categorize client authentication, association tracking, 802.11 to 802.3 frame conversion, and Radio Resource Management (RRM) as WLC tasks.
Centralizing these tasks allows unified policy control, seamless roaming, and intelligent RF orchestration.

Key Concept

Split-MAC architecture division of real-time vs non-real-time functions between Lightweight APs and WLCs
Question 40Question →

A network engineer is configuring interface GigabitEthernet0/2 on a Cisco Catalyst switch to connect an office desktop computer. The host must be statically assigned to VLAN 25, and dynamic trunk negotiation protocols on the interface must be disabled. Which set of commands must the engineer enter in interface configuration mode to achieve this objective?

Show answer & explanation

Answer: switchport mode access
switchport access vlan 25

Answer

The correct sequence consists of 'switchport mode access' followed by 'switchport access vlan 25' entered in interface configuration mode.
Configuring 'switchport mode access' forces the interface into static Layer 2 access mode and stops dynamic trunking protocol (DTP) negotiation. Following it with 'switchport access vlan 25' correctly places untagged host frames into broadcast domain VLAN 25.

Step-by-Step Solution

1
Set the port mode to static access
Disables dynamic trunking protocol (DTP) negotiation and locks the interface into Layer 2 access mode.
Explicitly setting access mode ensures host interfaces do not negotiate trunk links.
2
Assign the access VLAN ID
Associates all incoming untagged frame traffic on GigabitEthernet0/2 with VLAN 25.
The 'switchport access vlan <id>' command dictates which single VLAN broadcast domain receives untagged ingress traffic from the connected host.

Key Concept

Access Port VLAN Assignment and Operational Mode Locking
PreviousPage 2 / 20Next
Network Access Practice Questions — Cisco CCNA — Page 2 | Examkin