Examkin

Network Access

400 questions

All types400Multiple choice204Multiple select91Matching23Ordering82
Question 61Question →

A network administrator needs to manually configure an 802.1Q trunk link on a switch port supporting multi-encapsulation according to security best practices. Place the Cisco IOS configuration commands in the correct execution sequence from initial interface selection to traffic pruning.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct configuration sequence is: 1) Enter interface context, 2) Define 802.1Q encapsulation, 3) Set switchport mode to trunk, 4) Reassign the native VLAN ID, and 5) Define allowed VLANs for traffic pruning.
The correct operational sequence begins with entering the interface configuration context. Next, on switches supporting multiple encapsulation protocols, 802.1Q encapsulation must be explicitly configured prior to setting the interface mode to trunk. Once the trunk state is active, security hardening steps follow: reassigning the untagged native VLAN away from VLAN 1, and finally filtering trunk traffic by restricting allowed VLANs.

Step-by-Step Solution

1
Select the target interswitch physical interface context.
Enters interface configuration prompt context.
CLI commands must target the specific interface designated for trunking.
2
Execute switchport trunk encapsulation dot1q.
Defines IEEE 802.1Q frame tagging for the port.
On legacy or multi-layer Catalyst switches, attempting switchport mode trunk before selecting encapsulation results in a CLI error.
3
Execute switchport mode trunk.
Forces interface into permanent trunking state.
Establishes trunk operation and stops unconditional access behavior.
4
Execute switchport trunk native vlan 99.
Changes untagged frame handling to VLAN 99.
Enhances security by avoiding the default native VLAN 1.
5
Execute switchport trunk allowed vlan 10,20,99.
Restricts broadcast/multicast forwarding to specified VLANs.
Implements traffic filtering and pruning across interswitch links.

Key Concept

Manual 802.1Q Trunk CLI Configuration Order
Question 62Question →

A network engineer is reconfiguring interface GigabitEthernet0/5 on a Cisco Catalyst switch. The port was previously configured as an 802.1Q trunk, but it must now be assigned to connect an end-user workstation in VLAN 45. Which two Cisco IOS configuration commands are required on the interface to complete this configuration?

Select all that apply

Show answer & explanation

Answer: switchport mode access; switchport access vlan 45

Answer

The commands required under interface configuration mode are 'switchport mode access' to define the operational mode as access, and 'switchport access vlan 45' to statically assign the port to VLAN 45.
To transition an interface from a trunk link to a dedicated workstation access port in VLAN 45, the engineer must explicitly set the interface mode using 'switchport mode access' and associate the port with the target VLAN using 'switchport access vlan 45'.

Step-by-Step Solution

1
Set interface mode to access
Interface is explicitly configured as an access port
Executing 'switchport mode access' disables dynamic negotiation for trunking and forces access mode operation.
2
Assign the access VLAN ID
Untagged traffic on this interface is assigned to VLAN 45
Executing 'switchport access vlan 45' associates incoming untagged frames on the port with VLAN 45.

Key Concept

Configuring Cisco IOS L2 switchports as access ports and assigning static VLAN membership.
Estimated Time:1m 30s
Question 63Question →

A network administrator needs to create VLAN 60 on a Cisco Catalyst switch, assign it the name PRINTERS, and configure interface GigabitEthernet0/14 as a static access port assigned to this VLAN. Place the Cisco IOS configuration commands in the correct sequential order starting from global configuration mode.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins by entering VLAN subconfiguration mode with 'vlan 60', setting the VLAN name with 'name PRINTERS', moving to the target interface subconfiguration mode using 'interface gigabitethernet0/14', setting the port operational mode to access with 'switchport mode access', and assigning the interface to the VLAN using 'switchport access vlan 60'.
The correct command order follows Cisco IOS context mode hierarchy: first entering VLAN subconfig mode with 'vlan 60' to create the VLAN, then configuring its name using 'name PRINTERS', next navigating to interface subconfig mode with 'interface gigabitethernet0/14', explicitly defining access mode using 'switchport mode access', and finally binding the port to the VLAN using 'switchport access vlan 60'.

Step-by-Step Solution

1
Enter VLAN configuration mode from global configuration mode
Prompt changes to Switch(config-vlan)#
VLAN 60 must be initialized in the switch VLAN database before naming or assigning interface membership.
2
Assign an administrative name to VLAN 60
VLAN 60 is assigned the name PRINTERS
The 'name' command is specific to VLAN subconfiguration mode and provides administrative identification for the broadcast domain.
3
Navigate to the specific interface configuration mode
Prompt changes to Switch(config-if)#
Interface parameters must be configured within interface subconfiguration mode.
4
Configure the interface mode as static access
Interface GigabitEthernet0/14 is defined as an access port
Executing 'switchport mode access' explicitly defines the port as non-trunking and disables dynamic trunk negotiation via DTP.
5
Assign the interface to VLAN 60
Interface GigabitEthernet0/14 becomes an active member of VLAN 60
The 'switchport access vlan 60' command associates untagged ingress/egress frames on GigabitEthernet0/14 with VLAN 60.

Key Concept

Cisco IOS command syntax and hierarchy for VLAN creation, naming, and access port assignment
Question 64Question →

A network engineer configures a Cisco switch running Rapid PVST+ to serve as the root bridge for VLAN 12. The engineer executes the global configuration command `spanning-tree vlan 12 priority 12288`. What total Bridge Priority value will be carried in the BPDUs transmitted by this switch for VLAN 12?

Show answer & explanation

Answer: 12288

Answer

12300
In Rapid PVST+, Cisco switches use the 802.1t System ID Extension, which split the 16-bit Bridge Priority field into a 4-bit Base Priority field (increments of 4096) and a 12-bit System ID Extension field carrying the VLAN ID. When `spanning-tree vlan 12 priority 12288` is configured, the total priority field transmitted in BPDUs is the sum of the base priority (1228812288) and the VLAN ID (1212), resulting in 1230012300.

Step-by-Step Solution

1
Identify the configured base bridge priority value.
The base priority is configured as 12288 (a valid multiple of 4096).
STP base priority values must be specified in increments of 4096.
2
Identify the System ID Extension (VLAN ID).
The System ID Extension is 12 for VLAN 12.
Rapid PVST+ uses the 12-bit System ID Extension field in the Bridge Identifier to encode the VLAN number.
3
Calculate the total Bridge Priority transmitted in BPDUs.
Total Priority = 12288 + 12 = 12300.
The total priority contained within BPDUs is the sum of the configured base priority and the System ID Extension.

Key Concept

Rapid PVST+ System ID Extension and Total Bridge Identifier Priority Calculation
Question 65Question →

A network engineer is configuring interface GigabitEthernet1/0/10 on a Cisco Catalyst switch to connect a single end-user workstation. VLAN 75 ('FINANCE') has not yet been created in global configuration mode. The engineer enters the following CLI commands:

Switch(config)# interface gigabitethernet1/0/10
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 75

Which two statements accurately describe the resulting switch behavior and interface operation? (Select two.)

Select all that apply

Show answer & explanation

Answer: The switch automatically creates VLAN 75 in the VLAN database and assigns interface GigabitEthernet1/0/10 to VLAN 75.; Frames transmitted out interface GigabitEthernet1/0/10 toward the connected workstation will be untagged standard Ethernet frames.

Answer

The switch automatically creates VLAN 75 in the VLAN database and assigns the interface to it, and frames transmitted out interface GigabitEthernet1/0/10 toward the workstation are untagged standard Ethernet frames.
Assigning an interface to a VLAN that does not yet exist using 'switchport access vlan' prompts Cisco IOS to automatically create the VLAN in the switch database. Additionally, ports configured with 'switchport mode access' operate exclusively as untagged ports for that single VLAN when transmitting traffic to attached end-user devices.

Step-by-Step Solution

1
Analyze the Cisco IOS dynamic behavior when assigning an interface to a missing VLAN.
Cisco IOS automatically instantiates VLAN 75 in the switch VLAN database.
Automatic creation of missing VLANs is standard Cisco IOS software behavior during access port VLAN assignment.
2
Analyze frame encapsulation on a statically assigned access port.
The port strips any internal VLAN tags before transmitting frames out to the workstation.
Access ports belong to only one VLAN and send standard untagged 802.3 frames to host endpoints.

Key Concept

Cisco IOS Dynamic VLAN Creation and Access Port Framing Mechanics
Question 66Question →

When IEEE 802.1Q encapsulation is applied to an Ethernet frame traversing a trunk link, how many bytes are inserted into the original frame header for the 802.1Q tag?

Show answer & explanation

Answer: 4 bytes

Answer

The 802.1Q header inserts a total of 4 bytes into the original Ethernet frame header.
The correct answer is 4 bytes. An IEEE 802.1Q tag inserts 4 bytes (32 bits) into the Ethernet frame header. This includes 2 bytes for the Tag Protocol Identifier (TPID, fixed at 0x8100) and 2 bytes for Tag Control Information (TCI, containing 802.1p priority bits, DEI, and the 12-bit VLAN ID).

Step-by-Step Solution

1
Identify the structure of an IEEE 802.1Q tagged frame.
The 802.1Q header is inserted directly after the Source MAC address field.
This allows intermediate switches to identify VLAN membership without re-encapsulating the entire payload.
2
Break down the components of the 802.1Q tag.
The tag consists of a 2-byte Tag Protocol Identifier (TPID: 0x8100) and a 2-byte Tag Control Information (TCI) field containing Priority Code Point (3 bits), Drop Eligible Indicator (1 bit), and VLAN ID (12 bits).
Summing 2 bytes for TPID and 2 bytes for TCI equals a total header size of 4 bytes.

Key Concept

802.1Q Frame Tagging Header Architecture
Estimated Time:45s
Question 67Question →

A network engineer needs to manually configure an IEEE 802.1Q trunk link on a Cisco Catalyst switch interface (GigabitEthernet1/0/1) while following security best practices to disable Dynamic Trunking Protocol (DTP) and restrict active VLANs. What is the correct sequence of Cisco IOS CLI commands to accomplish this configuration on an interface supporting multi-protocol trunk encapsulation?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of commands begins with entering interface configuration mode (`interface GigabitEthernet1/0/1`), setting 802.1Q encapsulation (`switchport trunk encapsulation dot1q`), enabling trunk mode statically (`switchport mode trunk`), turning off DTP negotiation (`switchport nonegotiate`), and finally restricting the allowed VLAN list (`switchport trunk allowed vlan 10,20,30`).
The correct sequence respects Cisco IOS CLI syntax dependency rules: interface mode must be accessed first, followed by defining 802.1Q encapsulation prior to setting static trunk mode. Static trunking must be active before DTP frame transmission can be disabled with `switchport nonegotiate`, and allowed VLAN parameters are applied to restrict trunk traffic.

Step-by-Step Solution

1
Enter interface configuration mode
Access the interface context for GigabitEthernet1/0/1.
CLI commands affecting a specific switchport can only be applied within interface configuration mode.
2
Specify 802.1Q encapsulation protocol
Set trunk encapsulation type to dot1q.
On multi-encapsulation Catalyst switches, Cisco IOS requires explicit encapsulation definition before allowing the port mode to be changed to trunk.
3
Set port mode to static trunking
Force port state into unconditional trunk mode.
Static trunk mode disables dynamic negotiation behavior requirement and prepares the port for non-negotiation.
4
Disable Dynamic Trunking Protocol (DTP)
Stop sending DTP frames out of the interface.
The `switchport nonegotiate` command prevents DTP negotiation but is rejected by Cisco IOS if the interface is still set to dynamic auto or dynamic desirable.
5
Configure allowed VLAN list
Restrict VLAN traffic traversing the trunk to VLANs 10, 20, and 30.
Prunes unauthorized VLAN traffic from crossing the interswitch trunk link as part of security hardening.

Key Concept

Cisco IOS CLI trunk configuration sequence and DTP operational state requirements for 802.1Q trunking
Estimated Time:1m 30s
Question 68Question →

An administrator executes the command `show interfaces trunk` on a Cisco Catalyst switch and notices that VLAN 50 is included in the "VLANs allowed on trunk" section, but it does not appear in the "VLANs allowed and active in management domain" section. Which condition accounts for this operational state?

Show answer & explanation

Answer: VLAN 50 has not been created in the switch's local VLAN database.

Answer

VLAN 50 has not been created in the switch's local VLAN database.
For a VLAN to appear under 'VLANs allowed and active in management domain' in the `show interfaces trunk` output, it must be permitted by the trunk allowed list AND exist locally in the switch's VLAN database. If the VLAN has not been created using the `vlan 50` global configuration command, it remains inactive on the switch and will not appear in the active management domain output.

Step-by-Step Solution

1
Analyze the operational sections of the `show interfaces trunk` CLI output.
The 'VLANs allowed on trunk' output reflects the interface configuration (e.g., `switchport trunk allowed vlan`), while 'VLANs allowed and active in management domain' shows VLANs from that allowed list that currently exist in the local VLAN database and are not in a shut-down state.
Understanding Cisco IOS trunk verification logic is essential for accurately interpreting command output.
2
Identify why an allowed VLAN is excluded from the active management domain.
Because VLAN 50 is allowed by configuration but absent from the active list, it has not been instantiated in the switch database (using `vlan 50` in global configuration mode) or is currently disabled.
A switch cannot forward or locally activate trunk traffic for a VLAN that does not exist in its VLAN database.

Key Concept

802.1Q Trunk Verification and Local VLAN Database Dependencies
Estimated Time:1m 15s
Question 69Question →

A network administrator needs to manually configure a switch port as an IEEE 802.1Q trunk link and limit the traffic traversing the link to specific VLANs. What is the correct sequence of CLI configuration commands to perform this setup on a Cisco Catalyst switch interface from first to last?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of configuration commands is: 1) Enter interface configuration mode (interface GigabitEthernet0/1), 2) Set encapsulation to dot1q (switchport trunk encapsulation dot1q), 3) Set mode to trunk (switchport mode trunk), and 4) Specify allowed VLANs (switchport trunk allowed vlan 10,20).
The proper administrative sequence requires entering the target interface configuration mode first, setting the 802.1Q encapsulation protocol second, forcing the port into permanent trunking mode third, and finally defining the list of allowed VLANs to prune unwanted traffic.

Step-by-Step Solution

1
Navigate to the targeted physical interface context.
Enters interface configuration sub-mode prompt Switch(config-if)#.
Interface parameters can only be altered from within interface configuration sub-mode.
2
Define 802.1Q encapsulation.
Configures IEEE 802.1Q frame tagging as the trunking method.
Cisco IOS switches supporting both ISL and 802.1Q reject the 'switchport mode trunk' command until encapsulation is explicitly defined.
3
Configure static trunk mode.
Forces the interface into an active trunking operational state.
This command turns off dynamic port mode negotiation and forces the port into a permanent trunking state.
4
Apply allowed VLAN list filtering.
Limits trunk traffic to VLAN 10 and VLAN 20.
Pruning unneeded VLANs improves security and reduces broadcast traffic across switch links.

Key Concept

IEEE 802.1Q Trunk Interface CLI Configuration Workflow
Question 70Question →

A Cisco Catalyst switch receives an untagged Ethernet frame on an interface configured as an 802.1Q trunk port. Place the operational steps performed by the switch in the correct order from ingress frame arrival to egress transmission.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence is: (1) Frame reception on 802.1Q trunk, (2) Internal classification into ingress native VLAN, (3) Ingress trunk allowed VLAN list verification, (4) MAC address table lookup within native VLAN context, and (5) Egress transmission untagged on matching native VLAN trunk.
When an untagged frame is received on an 802.1Q trunk port, the switch first accepts the frame and assigns it internally to the interface's native VLAN. It then validates whether that native VLAN is permitted according to the trunk's allowed VLAN configuration. Next, it performs a Layer 2 MAC table lookup restricted to that native VLAN's broadcast domain to select the egress port. Finally, when transmitting out another trunk port configured with the same native VLAN, the switch leaves the frame untagged according to 802.1Q specification.

Step-by-Step Solution

1
Identify the ingress frame state upon arrival.
The frame arrives on the 802.1Q trunk interface lacking a 4-byte 802.1Q VLAN header.
802.1Q trunks expect untagged frames to belong to the designated native VLAN.
2
Map untagged ingress traffic to the port's native VLAN.
The switch internal ASIC assigns the frame to the configured native VLAN ID of the receiving trunk port.
All frames moving through a Catalyst switch fabric must be associated with a specific VLAN domain.
3
Check interface trunk filtering rules (allowed VLAN list).
The switch confirms that the native VLAN ID is present in the `switchport trunk allowed vlan` filter for that interface.
If the native VLAN was explicitly removed from the allowed list, the switch would drop the frame at ingress.
4
Determine the Layer 2 egress destination.
The switch queries its MAC address table within the scope of the assigned native VLAN.
VLAN isolation requires that MAC lookups occur strictly within the MAC table instance dedicated to that specific VLAN.
5
Apply egress 802.1Q tagging rules prior to transmission.
The frame is forwarded out the destination trunk port untagged because its VLAN matches the destination port's configured native VLAN.
Standard IEEE 802.1Q behavior specifies that frames belonging to a trunk's native VLAN are transmitted across the link without an 802.1Q tag header.

Key Concept

IEEE 802.1Q Native VLAN Ingress Classification, Filtering, and Egress Tagging Lifecycle
Estimated Time:2m 0s
Question 71Question →

A Cisco switch receives an untagged Ethernet frame on an IEEE 802.1Q trunk link and forwards it out another 802.1Q trunk link. Arrange the operational steps in the correct order from initial frame arrival to final frame transmission.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence begins with the arrival of an untagged Ethernet frame on an 802.1Q trunk port, followed by internal mapping to the ingress port's native VLAN, executing a MAC address table lookup within that native VLAN, and finally transmitting the frame untagged out an egress trunk configured with a matching native VLAN.
IEEE 802.1Q trunks handle untagged traffic by implicitly classifying ingress frames into the configured native VLAN. The switch uses that native VLAN's MAC address table for forwarding decisions and sends the frame out an egress trunk untagged if the egress interface shares the same native VLAN configuration.

Step-by-Step Solution

1
Identify ingress frame format
The switch identifies that the incoming frame lacks a 4-byte IEEE 802.1Q tag header.
Trunk ports process both tagged and untagged frames depending on whether traffic belongs to tagged VLANs or the native VLAN.
2
Classify frame to native VLAN
The frame is internally tagged/associated with the ingress port's native VLAN ID.
IEEE 802.1Q specification requires untagged frames traversing a trunk to be implicitly assigned to the native VLAN.
3
Execute Layer 2 forwarding lookup
The switch consults the MAC address table for the destination address within the native VLAN domain.
VLANs maintain isolated broadcast domains and separate MAC lookup tables to prevent cross-VLAN frame leakage.
4
Evaluate egress tagging behavior
The frame is forwarded across the egress trunk port without inserting an 802.1Q header tag.
To maintain compatibility, 802.1Q does not tag frames belonging to the native VLAN when sending them over trunk links.

Key Concept

IEEE 802.1Q Native VLAN Ingress and Egress Processing Mechanics
Question 72Question →

A network technician is verifying the operational characteristics of an IEEE 802.1Q trunk link established between two Cisco Catalyst switches. Which two statements describe correct behavior or features of IEEE 802.1Q trunking? (Select two.)

Select all that apply

Show answer & explanation

Answer: Frames belonging to the configured native VLAN are transmitted across the trunk link untagged by default.; IEEE 802.1Q inserts a 4-byte header into the standard Ethernet frame to carry VLAN identification information.

Answer

The correct statements are that native VLAN frames are transmitted untagged across an 802.1Q trunk by default, and that IEEE 802.1Q inserts a 4-byte header into the Ethernet frame.
IEEE 802.1Q trunking inserts a 4-byte tag between the MAC Source Address and EtherType fields of an Ethernet frame for tagged VLAN traffic. By default, frames originating from or destined for the native VLAN are sent across the trunk link without any 802.1Q tag attached.

Step-by-Step Solution

1
Analyze frame tagging mechanics for IEEE 802.1Q trunk links.
IEEE 802.1Q inserts a 4-byte tag into the frame header for tagged VLANs, while natively configured VLAN traffic remains untagged by default.
This maintains backward compatibility with legacy non-trunking devices.
2
Evaluate operational misconfiguration consequences on trunks.
Native VLAN mismatches generate warnings (via CDP/STP) without err-disabling ports, and PortFast is explicitly restricted from switch-to-switch links.
PortFast bypasses listening/learning states which can cause bridging loops on interswitch trunk paths.

Key Concept

IEEE 802.1Q Trunking Fundamentals and Native VLAN Mechanics
Question 73Question →

A network engineer observes that hosts in VLAN 10 on Switch-1 are unexpectedly communicating with hosts in VLAN 20 on Switch-2 across a direct 802.1Q trunk link. Upon reviewing the interface configurations, the engineer finds that Switch-1 has its trunk native VLAN set to VLAN 10, while Switch-2 has its trunk native VLAN set to VLAN 20. When a host in VLAN 10 on Switch-1 sends an uncompressed Ethernet broadcast frame, what is the exact behavior of Switch-2 when it receives this frame?

Show answer & explanation

Answer: Switch-2 accepts the untagged frame and forwards it out all active ports belonging to VLAN 20.

Answer

Switch-2 accepts the untagged frame and forwards it out all active ports belonging to VLAN 20.
When a switch transmits a frame for its configured native VLAN over an IEEE 802.1Q trunk link, it strips the VLAN tag and sends the frame untagged. When the receiving switch accepts an untagged frame on an 802.1Q trunk port, it associates that frame with its own locally configured native VLAN. Because Switch-1 has native VLAN 10 and Switch-2 has native VLAN 20, frames originating in VLAN 10 leave Switch-1 untagged and are ingested into VLAN 20 by Switch-2, causing cross-VLAN traffic leakage.

Step-by-Step Solution

1
Analyze frame egress behavior on Switch-1
Frames originating in VLAN 10 match Switch-1's native VLAN setting (VLAN 10) on the 802.1Q trunk, so Switch-1 transmits the frame across the link untagged (without an 802.1Q VLAN header tag).
By 802.1Q standards, traffic for the configured native VLAN on a trunk link is egressed without adding a 4-byte 802.1Q tag.
2
Analyze frame ingress behavior on Switch-2
Switch-2 receives the untagged frame on its trunk interface. It maps any incoming untagged frame to its local native VLAN configuration, which is VLAN 20.
Switch ports process untagged incoming frames as belonging to whatever native VLAN is locally configured on that receiving trunk port.
3
Determine forwarding decision
Because the frame is now assigned to VLAN 20 inside Switch-2, the broadcast frame is flooded to all active access ports in VLAN 20 on Switch-2.
This behavior results in VLAN hopping / traffic leakage across distinct VLANs due to mismatched native VLAN configurations.

Key Concept

IEEE 802.1Q Native VLAN Tagging and Mismatch Behavior
Estimated Time:1m 30s
Question 74Question →

A network administrator connects two Cisco Catalyst switches via their GigabitEthernet0/1 interfaces. Switch-A is configured with `switchport mode dynamic desirable`, while Switch-B remains in its default `dynamic auto` mode. What is the correct chronological sequence of operational events during Dynamic Trunking Protocol (DTP) negotiation to establish an IEEE 802.1Q trunk link?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence is: Switch-A transmits a DTP frame requesting a trunk, Switch-B receives and parses the DTP frame, Switch-B transmits a DTP acknowledgment frame, both switches agree upon IEEE 802.1Q encapsulation, and finally both switch interfaces transition to the operational trunk state.
The correct order follows the DTP state machine negotiation flow. A port in `dynamic desirable` mode actively sends DTP request frames to its link partner. The neighboring port in `dynamic auto` mode receives and processes this request, responding with a DTP acknowledgment frame to consent to trunking. Following parameter exchange, both switches negotiate the trunk encapsulation (IEEE 802.1Q) and finally transition both interface operational states to trunking.

Step-by-Step Solution

1
Identify the initiating interface state and behavior
Switch-A (`dynamic desirable`) actively sends DTP negotiation frames to initiate trunking.
Interfaces in `dynamic desirable` mode actively attempt to convert the link to a trunk.
2
Determine the receiving interface processing
Switch-B (`dynamic auto`) receives the request and evaluates parameters.
Interfaces in `dynamic auto` mode do not initiate DTP requests but respond to incoming requests.
3
Trace the protocol response and handshake
Switch-B sends a DTP response agreeing to form a trunk link.
A `dynamic auto` port agrees to become a trunk when requested by a `dynamic desirable` port.
4
Resolve encapsulation negotiation
Both switches negotiate and agree on 802.1Q encapsulation.
Trunking encapsulation must be determined prior to bringing up the operational trunking state.
5
Confirm operational state transition
Both ports transition to operational trunking mode.
Once negotiation handshakes and parameters match, the link operational mode becomes trunk.

Key Concept

Dynamic Trunking Protocol (DTP) negotiation flow between dynamic desirable and dynamic auto interface modes in IEEE 802.1Q trunking.
Estimated Time:2m 0s
Question 75Question →

A network engineer is troubleshooting Layer 2 protocol operations between a Cisco Catalyst switch (SW-1) and an adjacent third-party switch (SW-2). The engineer executes the `show lldp neighbors detail` command on SW-1 and reviews the following output:

SW-1# show lldp neighbors detail
------------------------------------------------
Local Interface: Gi1/0/12
Chassis id: 0050.56a1.b2c3
Port id: Eth101/1/5
Port Description: Ethernet101/1/5
System Name: SW-2-AGG
System Description: Vendor-X Enterprise Operating System v8.4
Time remaining: 114 seconds
System Capabilities: B, R
Enabled Capabilities: B
Management Addresses:
IP: 192.168.40.254
Auto Negotiation - supported, enabled
Physical media capabilities:
1000baseT(FD)
VLAN Information:
Native VLAN: 10

Assuming SW-1 port GigabitEthernet1/0/12 is configured as an 802.1Q trunk using default native VLAN 1 and default LLDP timer settings, which diagnosis and remediation step accurately reflect this state?

Show answer & explanation

Answer: A native VLAN mismatch exists because the remote device advertises native VLAN 10 over IEEE 802.1AB TLVs while SW-1 uses native VLAN 1; the native VLAN settings must be synchronized on both switch ports to prevent traffic leakage.

Answer

A native VLAN mismatch exists because the remote device advertises native VLAN 10 over IEEE 802.1AB TLVs while SW-1 uses native VLAN 1; the native VLAN settings must be synchronized on both switch ports to prevent traffic leakage.
The detailed LLDP output explicitly indicates that the remote switch (SW-2-AGG) is sending LLDP Type-Length-Value (TLV) data showing its native VLAN as 10. Since SW-1 is configured with the default native VLAN 1 on its trunk port (Gi1/0/12), a native VLAN mismatch exists across the 802.1Q trunk. Aligning the native VLAN configurations on both connected switch interfaces fixes the mismatch.

Step-by-Step Solution

1
Analyze the local vs remote interface fields in the LLDP output.
Local Interface is GigabitEthernet1/0/12 (on SW-1). Port id/description is Eth101/1/5 (on remote neighbor SW-2-AGG).
Correctly identifying local versus remote identifiers prevents interface role misinterpretation.
2
Evaluate the protocol timers displayed in the output.
'Time remaining: 114 seconds' reflects LLDP's standard holdtime (default 120 seconds = 30s hello × 4 holdtime multiplier).
This confirms that LLDP discovery is operating normally and is not timing out or relying on CDP 180s timers.
3
Examine the Organizationally Specific VLAN TLV output.
The neighbor advertises Native VLAN: 10 via LLDP TLVs, whereas SW-1 uses default native VLAN 1 on trunk Gi1/0/12.
An unmanaged difference in native VLAN configuration across an 802.1Q trunk leads to VLAN hopping vulnerabilities, STP errors, and traffic leakage.

Key Concept

LLDP CLI Output Analysis and Native VLAN Mismatch Detection
Estimated Time:2m 0s
Question 76Question →

A network administrator needs to statically configure an interface on a Cisco Catalyst switch to act as an IEEE 802.1Q trunk link to a neighboring switch. Which interface configuration command achieves this objective?

Show answer & explanation

Answer: switchport mode trunk

Answer

The command `switchport mode trunk` statically sets the switch interface to operate in trunking mode.
The `switchport mode trunk` command puts the interface into permanent trunking mode and initiates DTP negotiation to convert the link into a trunk link.

Step-by-Step Solution

1
Identify the administrative requirement.
The link must be manually configured as a static 802.1Q trunk line connecting two switches.
The scenario requires an interface command that changes the port mode to permanent trunking.
2
Evaluate Cisco IOS interface mode configuration syntax.
Executing `switchport mode trunk` forces the interface to transition out of access mode into permanent 802.1Q trunking mode.
This is the standard command used to establish permanent L2 interswitch connectivity.

Key Concept

802.1Q Trunk Mode Configuration
Question 77Question →

SwitchA has its interconnecting physical interfaces configured with the command `channel-group 1 mode passive`. Which channel-group mode must be configured on SwitchB for the IEEE 802.3ad LACP EtherChannel to successfully form?

Show answer & explanation

Answer: `active`

Answer

The mode configured on SwitchB must be `active`.
The `active` mode causes the switch port to actively initiate negotiations by sending LACP frames. Since SwitchA is configured as `passive`, it only responds to received LACP frames. SwitchB must be in `active` mode so LACP frames are transmitted to start the dynamic trunk negotiation.

Step-by-Step Solution

1
Analyze the LACP mode configured on SwitchA.
SwitchA is set to `passive`, meaning it responds to LACP packets but will not initiate LACP frame exchanges.
LACP passive mode requires an incoming LACP negotiation request to begin bundling interfaces.
2
Determine the compatible LACP mode required on SwitchB.
SwitchB must be set to `active` so that it actively transmits LACP control frames to SwitchA.
At least one end of an LACP EtherChannel link must be in `active` mode for successful negotiation.

Key Concept

LACP Mode Compatibility
Question 78Question →

A host in VLAN 20 sends an Ethernet frame to another host in VLAN 20 located on a remote switch across an IEEE 802.1Q trunk link. What is the correct chronological sequence of events for processing and forwarding this frame from the source access port to the destination access port?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological sequence begins with Switch 1 receiving the untagged frame on an access port, inserting a 4-byte 802.1Q tag for VLAN 20, transmitting the tagged frame over the trunk, Switch 2 receiving and identifying the tagged frame, Switch 2 stripping the 802.1Q header, and finally delivering the untagged frame to the destination host on the access port.
The correct sequence follows standard IEEE 802.1Q trunking operations: frames enter an access port untagged, are tagged with a 4-byte header containing the VLAN ID when forwarded out a trunk port for non-native VLANs, travel across the link, are read and stripped of the tag by the remote switch, and are finally delivered untagged to the destination host on an access port in the same VLAN.

Step-by-Step Solution

1
Identify frame ingress at the source switch
The source switch accepts an untagged frame on a standard VLAN 20 access port.
End-user hosts send standard Ethernet frames without 802.1Q tags.
2
Apply 802.1Q tagging prior to trunk egress
A 4-byte 802.1Q tag with VLAN ID 20 is inserted into the Ethernet header.
Trunk links require frame tagging to distinguish traffic belonging to non-native VLANs across switches.
3
Transmit the tagged frame across the trunk
The frame travels over the physical interswitch link.
The frame carries the VLAN 20 identifier across the shared trunk interface.
4
Process frame ingress at the receiving switch
Switch 2 reads the 802.1Q tag to determine the target VLAN.
The receiving switch relies on the tag to route the frame internally within the correct VLAN context.
5
De-encapsulate the 802.1Q frame
The 4-byte 802.1Q header is stripped from the frame.
Standard access ports must not send tagged frames to end hosts that do not support 802.1Q tagging.
6
Forward untagged frame to destination host
The original frame is delivered out the destination VLAN 20 access port.
The destination host receives standard Ethernet traffic identical to what was originally transmitted.

Key Concept

802.1Q Frame Tagging and Trunk Processing Lifecycle
Estimated Time:1m 0s
Question 79Question →

An access port on a Cisco switch running IEEE 802.1D Spanning Tree Protocol (STP) without PortFast enabled is connected to a workstation and experiences a link-up event. Arrange the operational STP port states in the exact sequential order that the interface undergoes from initial link activation until it actively processes and forwards user data traffic.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence of 802.1D STP port states from link activation to active forwarding is: Blocking state, Listening state, Learning state, and Forwarding state.
IEEE 802.1D Spanning Tree Protocol transitions non-PortFast interfaces through a mandatory four-stage sequence: Blocking (loop prevention), Listening (BPDU exchange and port role determination), Learning (building MAC tables), and Forwarding (active user frame transmission).

Step-by-Step Solution

1
Identify the initial default safety state upon link bring-up in classic IEEE 802.1D STP.
The port enters the Blocking state immediately upon physical link detection.
Default 802.1D STP behavior forces a non-PortFast interface into Blocking to prevent immediate Layer 2 loop creation.
2
Determine the state where active BPDU negotiation and role determination occur.
The port transitions from Blocking to the Listening state for a duration of 15 seconds.
In Listening, the switch transmits and processes BPDUs to determine active topology roles, while suppressing MAC table learning and user data frame forwarding.
3
Identify the state dedicated to populating switch address tables prior to data forwarding.
The port transitions from Listening to the Learning state for a duration of 15 seconds.
In Learning, the port populates its MAC address table from incoming frame source MACs to prevent unnecessary unicast flooding when data forwarding starts.
4
Identify the final fully functional operational state.
The port transitions from Learning into the Forwarding state.
After the total 30-second convergence delay (2 x 15-second Forward Delay timers) completes without topology conflicts, the interface begins normal frame forwarding.

Key Concept

IEEE 802.1D STP Port State Transition Sequence
Question 80Question →

Which two statements accurately describe port roles, states, and configuration rules in Rapid PVST+? (Select two choices.)

Select all that apply

Show answer & explanation

Answer: An Alternate port provides a backup path to the Root Bridge and remains in the discarding state under normal operation.; Rapid PVST+ removes the 802.1D Listening port state and consolidates non-forwarding states into the Discarding state.

Answer

The correct statements are that an Alternate port provides a backup path to the Root Bridge while remaining in a discarding state, and that Rapid PVST+ eliminates the 802.1D Listening state by using the Discarding state.
Rapid PVST+ introduces the Alternate port role, which provides an instant backup path to the Root Bridge while staying in a discarding state. Additionally, Rapid PVST+ streamlines the IEEE 802.1D port states (Disabled, Blocking, Listening, Learning, Forwarding) down to three operational states: Discarding, Learning, and Forwarding.

Step-by-Step Solution

1
Evaluate the role of an Alternate port in Rapid PVST+.
Confirm that an Alternate port receives BPDUs from another switch and acts as an alternate path to the Root Bridge in the discarding state.
RSTP/Rapid PVST+ defines Alternate ports for fast convergence when a Root port link fails.
2
Evaluate Rapid PVST+ operational port states.
Identify that 802.1w simplifies port states to Discarding, Learning, and Forwarding, combining Disabled, Blocking, and Listening into Discarding.
This structural simplification enables faster overall protocol operation.
3
Verify bridge priority increments and PortFast guidelines.
Reject custom non-multiplier priority values and reject applying PortFast on switch interconnects.
Priority values must adhere to steps of 4096 due to the System ID Extension, and PortFast is reserved exclusively for edge access interfaces.

Key Concept

Rapid PVST+ Port Roles, States, and Priority Calculations
PreviousPage 4 / 20Next
Network Access Practice Questions — Cisco CCNA — Page 4 | Examkin