Examkin

Network Access

400 questions

All types400Multiple choice204Multiple select91Matching23Ordering82
Question 101Question →

A network engineer is deploying a point-to-point Layer 3 EtherChannel between two Cisco Catalyst switches, SW-Alpha and SW-Beta.

On SW-Alpha, the engineer issued `no switchport` on physical interfaces GigabitEthernet0/1 and GigabitEthernet0/2, added them to `channel-group 10 mode active`, and then configured `interface Port-channel 10` with `no switchport` and IP address `10.20.30.1 255.255.255.252`.

On SW-Beta, the engineer configured `interface Port-channel 10` with `no switchport` and IP address `10.20.30.2 255.255.255.252`. Next, the physical member interfaces GigabitEthernet0/1 and GigabitEthernet0/2 were assigned to `channel-group 10 mode passive`, but the engineer omitted the `no switchport` command on those physical member interfaces.

Executing `show etherchannel summary` on SW-Beta displays the following output:

text Flags: D - down P - bundled in port-channel I - stand-alone s - suspended H - Hot-standby (LACP only) R - Layer3 S - Layer2 U - in use f - failed to allocate aggregate interface Group Port-channel Protocol Ports ------+-------------+-----------+----------------------------------------------- 10 Po10(SD) LACP Gi0/1(D) Gi0/2(D)

Which configuration oversight on SW-Beta caused Port-channel 10 to exhibit the `SD` (Layer 2, Down) status flags?

Show answer & explanation

Answer: The physical member interfaces on SW-Beta were left operating in default Layer 2 switchport mode, preventing them from joining a routed Layer 3 port-channel bundle.

Answer

The physical member interfaces on SW-Beta remained in Layer 2 switchport mode because the 'no switchport' command was omitted on GigabitEthernet0/1 and GigabitEthernet0/2.
For a Layer 3 (routed) EtherChannel to operate correctly, physical member interfaces must be explicitly configured as routed ports using the 'no switchport' command. If physical ports remain in their default Layer 2 switchport state when added to a channel group, they cannot bundle with a routed port-channel interface, resulting in the port-channel defaulting to Layer 2 Down ('SD') status and physical ports marked as Down ('D').

Step-by-Step Solution

1
Analyze the output flags of 'show etherchannel summary' on SW-Beta.
Port-channel 10 displays flags 'SD', where 'S' indicates Layer 2 (Switchport) and 'D' indicates Down. Member ports Gi0/1 and Gi0/2 are marked with flag 'D' (Down).
Understanding flag meanings allows diagnosing whether the channel is operating as Layer 2 or Layer 3 and identifying port bundling status.
2
Evaluate the configuration differences between SW-Alpha and SW-Beta.
SW-Alpha configured 'no switchport' on both physical member interfaces and the logical port-channel interface. SW-Beta configured 'no switchport' only on the logical Port-channel interface but omitted it on physical member interfaces GigabitEthernet0/1 and GigabitEthernet0/2.
On Cisco Catalyst switches, physical interfaces operate as Layer 2 switchports by default.
3
Determine the operational requirement for Layer 3 EtherChannels.
Physical member interfaces must match the Layer 2/Layer 3 capability of the logical Port-channel interface. When physical ports remain Layer 2 switchports, Cisco IOS prevents them from bundling into a routed Port-channel, driving the Port-channel interface state to Layer 2 Down ('SD').
Applying 'no switchport' to the physical member interfaces before assigning them to the channel group ensures parameter consistency and enables successful LACP bundle establishment.

Key Concept

Layer 3 EtherChannel Physical Member Interface Requirements
Estimated Time:2m 0s
Question 102Question →

A network administrator is troubleshooting neighbor visibility on a Cisco Catalyst switch (SW-1) connected to a non-Cisco switch. The administrator executes the `show lldp entry Core-SW2` command on SW-1 and receives the following CLI output:

text
Local Interface: Gi1/0/24
Chassis id: 0014.f2ca.8800
Port id: Eth1/1
Port Description: Trunk-to-Core1
System Name: Core-SW2

System Description:
Cisco Nexus Operating System (NX-OS) Software, Version 9.3(5)

Time remaining: 92 seconds
System Capabilities: B, R
Enabled Capabilities: B, R

Management Addresses:
IP: 10.1.100.2

Auto Negotiation: supported, enabled
Physical media capabilities:
1000baseT(FD)

Media Attachment Unit type: 30
VLAN Advertised: 10, 20, 99
Port VLAN ID (PVID): 99

Based on this LLDP detailed output, which conclusion correctly interprets the neighbor properties and link configuration?

Show answer & explanation

Answer: The local switch interface receiving the LLDP frames is GigabitEthernet1/0/24, while the remote neighbor's egress port is Ethernet1/1 with a native VLAN (PVID) of 99.

Answer

The local switch interface receiving the LLDP frames is GigabitEthernet1/0/24, while the remote neighbor's egress port is Ethernet1/1 with a native VLAN (PVID) of 99.
In Cisco IOS LLDP detailed entries (`show lldp entry` or `show lldp neighbors detail`), 'Local Interface' indicates the interface on the local device where the frame arrived (Gi1/0/24). The 'Port id' field identifies the remote neighboring device's egress interface (Eth1/1). Furthermore, the 'Port VLAN ID (PVID)' field reflects the native VLAN advertised by the adjacent device for that link.

Step-by-Step Solution

1
Analyze the Local Interface and Port ID fields in the LLDP output
'Local Interface: Gi1/0/24' represents the local switch's port receiving the LLDP frame. 'Port id: Eth1/1' specifies the interface on the remote neighboring device (Core-SW2).
LLDP output explicitly distinguishes between the local port where traffic is received and the remote port ID advertised by the neighbor.
2
Examine the Port VLAN ID (PVID) TLV information
'Port VLAN ID (PVID): 99' is the native VLAN ID advertised by the neighbor device (Core-SW2) for its port Eth1/1.
IEEE 802.1AB LLDP includes Organizationally Specific TLVs that advertise port attributes of the remote sender, including its configured native VLAN (PVID).
3
Evaluate the remaining timer information
'Time remaining: 92 seconds' is the dynamic countdown timer before the cached entry expires, not the configured holdtime constant.
The default LLDP holdtime multiplier (4) with a default message frequency (30s) yields a default holdtime of 120s; 92 seconds is merely the current countdown state.

Key Concept

Interpretation of LLDP Detailed CLI Neighbor Data and IEEE 802.1AB TLVs
Estimated Time:2m 0s
Question 103Question →

A network technician notices that connecting an end-user host to an access port does not generate a Topology Change Notification (TCN) or cause MAC address table flushing on neighboring switches. Which feature configured on the access interface is responsible for suppressing these STP topology change notifications upon link state changes?

Show answer & explanation

Answer: PortFast

Answer

PortFast suppresses Topology Change Notifications (TCNs) when edge interfaces change state, avoiding unnecessary MAC table flushing across the network.
PortFast is intended for switch ports connected to end devices. Besides bypassing the Listening and Learning states to transition immediately to Forwarding, PortFast ensures that link state changes on edge ports do not trigger Spanning Tree Topology Change Notifications (TCNs), thereby protecting the network from unnecessary MAC address table aging and flushing.

Step-by-Step Solution

1
Identify the STP behavior caused by connecting end-user devices.
Standard 802.1D STP generates a Topology Change Notification (TCN) whenever a link comes up or goes down, causing switches in the broadcast domain to shorten their MAC address table aging timer.
End-user workstations power on and off frequently, which would cause constant MAC table flushing if TCNs were transmitted.
2
Evaluate the role of PortFast.
PortFast designates a port as an edge port, immediately transitioning it to Forwarding while suppressing TCN generation upon link state changes.
Since end-user workstations do not interconnect switches, link state changes on these ports do not affect the overall Spanning Tree topology.

Key Concept

PortFast TCN Suppression and Edge Port Operation
Question 104Question →

A network engineer is configuring Rapid PVST+ on a Cisco Catalyst switch to force it to become the Root Bridge for VLAN 40. The engineer attempts to configure a custom bridge priority value using the Cisco IOS CLI command line syntax. Which command entry contains a valid bridge priority value that Cisco IOS will accept, and what total bridge priority value will the switch advertise in its outbound Spanning Tree Protocol BPDUs for VLAN 40?

Show answer & explanation

Answer: The command 'spanning-tree vlan 40 priority 4096' will be accepted, and the advertised total bridge priority will be 4136.

Answer

The command 'spanning-tree vlan 40 priority 4096' will be accepted, and the advertised total bridge priority will be 4136.
In Cisco Rapid PVST+, the 16-bit priority portion of the 8-byte Bridge ID (BID) is divided into a 4-bit Bridge Priority and a 12-bit System ID Extension. Because only 4 bits are allocated to user configuration (24=162^4 = 16 levels), priority values in CLI commands must increase in steps of 4096 (4096×1=40964096 \times 1 = 4096). When the command 'spanning-tree vlan 40 priority 4096' is executed, Cisco IOS validates 40964096 as a valid base priority. During BPDU generation for VLAN 40, the switch adds the VLAN ID (4040) as the System ID Extension, resulting in a total priority value of 4096+40=41364096 + 40 = 4136.

Step-by-Step Solution

1
Verify CLI input validation rules for Rapid PVST+ bridge priority
Cisco IOS requires configurable bridge priority values to be explicit multiples of 4096 (0,4096,8192,12288,…,614400, 4096, 8192, 12288, \dots, 61440).
The 16-bit Priority field in the Bridge ID (BID) uses the 4 most significant bits for configurable priority and the remaining 12 bits for the System ID Extension (VLAN ID).
2
Calculate the total advertised Bridge Priority field value
Base Priority (40964096) + System ID Extension (4040) = Total Priority (41364136).
Rapid PVST+ dynamically inserts the 12-bit VLAN ID into the System ID Extension field for per-VLAN spanning tree identification.

Key Concept

Rapid PVST+ Bridge ID Structure and System ID Extension Calculation
Question 105Question →

An administrator connects a switch access port to a user workstation without enabling Cisco PortFast. Place the standard IEEE 802.1D Spanning Tree Protocol (STP) port states in the chronological sequence that the interface transitions through from initial physical link up to active user data forwarding.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological sequence of IEEE 802.1D STP port state transitions is: Blocking state, Listening state, Learning state, and Forwarding state.
In classic IEEE 802.1D Spanning Tree Protocol (STP), an edge port not configured with PortFast undergoes a strict 30-second convergence timer sequence: Blocking (initial loop prevention) -> Listening (15s, BPDU exchange and role selection) -> Learning (15s, MAC table population without data forwarding) -> Forwarding (active data packet processing).

Step-by-Step Solution

1
Identify initial link state
Port enters Blocking state
Standard 802.1D STP defaults unconfigured edge ports to Blocking to safely prevent loops during initial topology evaluation.
2
Transition to neighbor discovery and role determination
Port enters Listening state for 15 seconds (Forward Delay)
BPDUs are transmitted and processed to elect root bridges and designate root/designated port roles.
3
Prepare Layer 2 forwarding tables
Port enters Learning state for 15 seconds (Forward Delay)
MAC addresses are learned from incoming frames to populate the CAM table, mitigating flooding when forwarding begins.
4
Complete convergence to operational status
Port enters Forwarding state
With topology determined and MAC table initialized, user frames are actively forwarded.

Key Concept

IEEE 802.1D STP Port State Transitions
Estimated Time:1m 15s
Question 106Question →

An administrator needs to enable Link Aggregation (LAG) on a Cisco Wireless LAN Controller (WLC) connected to an upstream switch stack. Place the configuration and operational steps in the correct chronological sequence from start to finish.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with saving the WLC configuration, enabling LAG in the controller settings, saving and rebooting the WLC to apply the change, and finally configuring the connected switch ports as a static EtherChannel (mode on).
The sequence follows the standard Cisco procedure for turning on controller-wide Link Aggregation (LAG). First, current configuration state is saved. Second, LAG is enabled in the WLC settings menu. Third, the WLC configuration is saved and the controller is rebooted to apply the change. Fourth, the corresponding switch ports are configured into a static EtherChannel using 'channel-group mode on' to complete the physical and logical aggregation.

Step-by-Step Solution

1
Save the existing WLC configuration
Establishes a baseline configuration state before initiating a system reboot
It is essential to safeguard existing controller configuration prior to changing structural hardware modes.
2
Enable LAG in WLC settings
Places the WLC into a pending LAG state
The controller feature knob for LAG must be explicitly enabled before hardware interface aggregation takes effect.
3
Save and reboot the WLC
The controller reboots with LAG operational across all physical distribution system ports
Enabling LAG on a Cisco WLC requires a reboot to reconfigure internal interface mappings.
4
Configure static EtherChannel on the upstream switch
The switch ports bundle into a single logical link matching the WLC LAG mode
Cisco WLC LAG requires static frame grouping ('mode on') on the switch side since WLCs do not support LACP or PAgP negotiation.

Key Concept

WLC Link Aggregation (LAG) configuration workflow and switch port requirements
Question 107Question →

A network administrator is configuring edge ports on a Cisco Catalyst switch connected to user workstations. Which two statements describe the operational benefits and behaviors when Cisco PortFast is enabled on an access interface? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: The interface bypasses the Listening and Learning STP states, transitioning directly to Forwarding upon link connection.; Link state changes on the PortFast-enabled port do not cause the switch to generate Topology Change Notifications (TCNs).

Answer

The correct benefits are that the interface bypasses the Listening and Learning STP states to transition directly to Forwarding, and link state changes on the port do not cause the switch to generate Topology Change Notifications (TCNs).
PortFast provides two primary operational advantages on end-user access ports: first, it bypasses the Listening (15s) and Learning (15s) states to move immediately into Forwarding state when a link comes online. Second, it suppresses Topology Change Notification (TCN) messages when the port changes status, preventing unnecessary MAC table aging throughout the campus network.

Step-by-Step Solution

1
Identify the main objective of configuring Cisco PortFast on switch ports.
PortFast is intended strictly for access ports connected to end-user devices such as PCs, printers, or IP phones.
End-user devices do not run Spanning Tree Protocol or form Layer 2 redundant loops under normal topology conditions.
2
Analyze state transition behavior for PortFast-enabled ports.
Upon link activation, the port skips the 15-second Listening and 15-second Learning timer delays and immediately enters Forwarding.
Eliminating this 30-second delay ensures client hosts do not experience address assignment timeouts during initial network startup.
3
Evaluate the impact of PortFast on STP topology updates across the network.
Port transitions on PortFast interfaces are prevented from triggering Topology Change Notifications (TCNs) sent toward the Root Bridge.
Suppressing TCNs avoids unnecessary flushing of MAC address tables across the entire switching domain when host ports connect or disconnect.

Key Concept

STP PortFast Benefits and Operational Trait
Question 108Question →

A network administrator needs to convert two physical switch interfaces (GigabitEthernet0/1 and GigabitEthernet0/2) on a Cisco Catalyst switch into a routed (Layer 3) EtherChannel bundle using dynamic LACP active mode. In what sequential order should the Cisco IOS configuration commands be executed to successfully establish the routed port-channel interface and configure its IP addressing?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct CLI configuration sequence is: enter physical interface range mode ('interface range GigabitEthernet0/1 - 2'), convert physical links to routed mode ('no switchport'), assign interfaces to dynamic LACP group ('channel-group 10 mode active'), enter logical port-channel mode ('interface Port-channel 10'), and assign the IP address ('ip address 10.10.10.1 255.255.255.252').
To build a routed (Layer 3) EtherChannel using LACP, an engineer must first enter physical interface configuration mode ('interface range GigabitEthernet0/1 - 2'), disable Layer 2 processing on those physical member links using 'no switchport', and bind them into an active LACP bundle with 'channel-group 10 mode active'. Once the bundle is formed, the engineer enters the logical interface mode ('interface Port-channel 10') and applies the IPv4 network parameters using 'ip address 10.10.10.1 255.255.255.252'.

Step-by-Step Solution

1
Select physical member interfaces using 'interface range GigabitEthernet0/1 - 2'
Enters interface range configuration mode for both physical ports simultaneously.
Configuration commands must target the physical interfaces that will compose the EtherChannel.
2
Disable Layer 2 functionality on physical links using 'no switchport'
Converts physical member interfaces from Layer 2 switchports to Layer 3 routed interfaces.
If interfaces remain in Layer 2 mode when assigned to a channel group, a Layer 2 port-channel will be created instead of a Layer 3 port-channel.
3
Bind physical interfaces into an LACP group using 'channel-group 10 mode active'
Creates logical Port-channel 10 and initiates LACP active negotiation on physical member links.
The 'active' keyword specifies dynamic LACP negotiation protocol mode.
4
Enter logical bundle interface configuration using 'interface Port-channel 10'
Moves CLI focus to the newly spawned logical interface Port-channel 10.
Layer 3 IP attributes must be configured on the parent logical bundle rather than individual member links.
5
Configure the IP address using 'ip address 10.10.10.1 255.255.255.252'
Assigns Layer 3 IPv4 addressing to Port-channel 10 for routing.
In a Layer 3 EtherChannel, routing parameters reside on the logical Port-channel interface.

Key Concept

Layer 3 LACP EtherChannel CLI Configuration Sequence
Question 109Question →

A network administrator needs to explicitly configure switch interface GigabitEthernet0/3 as a static access port belonging to VLAN 30. Which set of commands must be executed in interface configuration mode to achieve this configuration?

Show answer & explanation

Answer: switchport mode access
switchport access vlan 30

Answer

The correct command set to execute in interface configuration mode is 'switchport mode access' followed by 'switchport access vlan 30'.
To configure an access port for an end-user host in VLAN 30, an administrator enters interface configuration mode and issues 'switchport mode access' to define the operational mode, followed by 'switchport access vlan 30' to bind the port to that specific broadcast domain.

Step-by-Step Solution

1
Set interface mode
The interface mode is configured for access using 'switchport mode access'.
This disables trunk negotiation and ensures the interface functions strictly as a host access port.
2
Assign access VLAN
The port is assigned to VLAN 30 using 'switchport access vlan 30'.
Associates untagged traffic from the connected host with broadcast domain VLAN 30.

Key Concept

Layer 2 Access Port Configuration
Question 110Question →

Place the following Cisco IOS configuration commands in the correct order to create VLAN 30, assign it the name 'ENGINEERING', and configure interface GigabitEthernet1/0/15 as a static access port in VLAN 30, starting from privileged EXEC mode (`Switch#`).

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts by entering global configuration mode (`configure terminal`), creating and naming the VLAN (`vlan 30` followed by `name ENGINEERING`), navigating to the interface (`interface GigabitEthernet1/0/15`), statically setting access mode (`switchport mode access`), and finally assigning the port to VLAN 30 (`switchport access vlan 30`).
The CLI prompt hierarchy in Cisco IOS enforces a strict order of operations: privileged EXEC mode (`Switch#`) must first transition to global configuration mode (`configure terminal`), followed by entering the VLAN submode (`vlan 30`) to set parameters like `name ENGINEERING`. Once VLAN creation and naming are complete, navigating to interface configuration mode (`interface GigabitEthernet1/0/15`) allows setting the operational mode (`switchport mode access`) and assigning the port membership (`switchport access vlan 30`).

Step-by-Step Solution

1
Enter Global Configuration mode from privileged EXEC mode.
Prompt changes to `Switch(config)#`.
CLI global context is needed to instantiate VLANs and select target interfaces.
2
Execute `vlan 30` in global configuration mode.
Prompt changes to `Switch(config-vlan)#`.
VLAN sub-configuration mode is required to configure specific properties such as the VLAN name.
3
Execute `name ENGINEERING` in VLAN configuration mode.
VLAN 30 is named ENGINEERING in the switch VLAN database.
VLAN name commands can only be issued within the `Switch(config-vlan)#` prompt context.
4
Navigate to the interface context using `interface GigabitEthernet1/0/15`.
Prompt changes to `Switch(config-if)#`.
Port configuration commands require interface configuration context.
5
Configure the port operational mode using `switchport mode access`.
Interface GigabitEthernet1/0/15 is set to static access mode.
Static access mode prevents DTP negotiation and ensures frames are untagged on host links.
6
Assign the port membership using `switchport access vlan 30`.
GigabitEthernet1/0/15 is placed into VLAN 30.
Associates the access interface with the intended broadcast domain.

Key Concept

VLAN Creation and Access Port Assignment in Cisco IOS
Question 111Question →

An edge switch port connected directly to an end-host is configured with Cisco STP PortFast. Which operational benefit does PortFast provide when this link transitions to an up state?

Show answer & explanation

Answer: The interface immediately transitions to the forwarding state by bypassing the listening and learning states.

Answer

The interface immediately transitions to the forwarding state by bypassing the listening and learning states.
Enabling PortFast on a Cisco switch access port connected to an end device allows the port to bypass the 802.1D listening and learning states, transitioning immediately to the forwarding state to eliminate initialization delays.

Step-by-Step Solution

1
Analyze standard 802.1D STP port state transitions.
Standard ports move from Blocking to Listening (15s) to Learning (15s) before reaching Forwarding (30 seconds total delay).
This delay prevents temporary Layer 2 loops while topology information propagates.
2
Determine the impact of enabling PortFast on an access interface connected to an end-host.
The interface skips the Listening and Learning states and enters the Forwarding state immediately upon link-up.
End-user hosts do not form loops, so bypassing convergence timers prevents network timeouts for protocols like DHCP.

Key Concept

STP PortFast operational mechanism and convergence benefit
Question 112Question →

A network administrator executes the `show cdp neighbors` command on a Cisco Catalyst switch to inspect connected devices and receives the following output:

Device ID Local Intrfce Holdtme Capability Platform Port ID
SW-ACCESS-02 Gig 0/1 162 R S I WS-C3560 Gig 0/24

Based on this command output, which interface on the local switch directly connects to neighboring switch SW-ACCESS-02?

Show answer & explanation

Answer: GigabitEthernet 0/1

Answer

The local switch interface connected to SW-ACCESS-02 is GigabitEthernet 0/1.
In the `show cdp neighbors` command output, the 'Local Intrfce' column specifies the physical interface on the current (local) switch where the CDP advertisement was received. For the entry corresponding to device SW-ACCESS-02, the 'Local Intrfce' is GigabitEthernet 0/1 (abbreviated as Gig 0/1).

Step-by-Step Solution

1
Examine the column headers of the `show cdp neighbors` output
Identify the columns for neighbor identity ('Device ID'), local port ('Local Intrfce'), remaining hold time ('Holdtme'), neighbor platform ('Platform'), and remote port ('Port ID').
Understanding the CLI output structure allows distinguishing local interface bindings from remote device port identifiers.
2
Locate the entry corresponding to Device ID 'SW-ACCESS-02'
Match 'SW-ACCESS-02' with its row entry.
The row contains parameters specifically sent by and associated with that neighboring device.
3
Read the value under the 'Local Intrfce' column for that row
The value is 'Gig 0/1', corresponding to local interface GigabitEthernet 0/1.
The 'Local Intrfce' field explicitly specifies the port on the local switch receiving the CDP advertisements from the neighbor.

Key Concept

CDP Neighbor Output Data Parsing (Local vs Remote Interface Identification)
Question 113Question →

A network administrator is configuring a Cisco Catalyst switch running Rapid PVST+ to serve as a secondary root bridge for VLAN 20. The administrator intends to set a custom bridge priority using the command `spanning-tree vlan 20 priority <value>`. Which value will Cisco IOS accept for this command?

Show answer & explanation

Answer: 24576

Answer

The correct option is 24576 because base bridge priority in Rapid PVST+ must be configured as a strict multiple of 4096.
In Rapid PVST+, Cisco IOS enforces that bridge priority settings configured via CLI must be exact multiples of 4096 (range 0 to 61440). The value 24576 equals 6 × 4096, making it a valid base priority parameter.

Step-by-Step Solution

1
Understand Rapid PVST+ Priority Architecture
Rapid PVST+ uses the 802.1t System ID Extension, which splits the 16-bit Bridge Priority field into a 4-bit Priority field and a 12-bit System ID Extension (VLAN ID).
Because only the top 4 bits are allocated for configurable priority, priority values can only change in steps of 212=40962^{12} = 4096.
2
Evaluate CLI configuration requirements
When executing `spanning-tree vlan <vlan-id> priority <value>`, the `<value>` parameter must be a multiple of 4096 (e.g., 0, 4096, 8192, 12288, 16384, 20480, 24576, 28672, 32768, etc.).
Cisco IOS automatically adds the VLAN ID to the base priority when constructing the BPDU, so the user must specify the unshifted base priority.
3
Test candidate values
Calculating 24576/4096=624576 / 4096 = 6, which is an exact integer. Other choices (24596, 20000, 8212) leave non-zero remainders when divided by 4096.
Only 24576 satisfies the increment requirement and will be accepted by Cisco IOS.

Key Concept

Rapid PVST+ Bridge Priority Configuration and 4096 Increment Constraint
Question 114Question →

A network engineer transitions several Cisco Lightweight Access Points (LAPs) deployed at a branch office from default Local mode to FlexConnect mode with local switching enabled for the corporate employee wireless network. The switch ports connected to these APs are currently configured as Layer 2 access ports assigned to VLAN 10 (Management). Following the transition, AP-to-WLC CAPWAP control connectivity remains healthy, but wireless clients connecting to the employee SSID (mapped to VLAN 20) fail to obtain IP addresses or communicate with local resources. Which configuration change must be applied to the access switch ports to restore client connectivity on the employee WLAN?

Show answer & explanation

Answer: Reconfigure the switch ports as 802.1Q trunk ports with VLAN 10 configured as the native VLAN and allow VLAN 20 on the trunk.

Answer

Reconfigure the switch ports as 802.1Q trunk ports with VLAN 10 configured as the native VLAN and allow VLAN 20 on the trunk.
When a Cisco LAP operates in FlexConnect mode with local switching, client traffic is broken out locally at the AP's physical switch port. To carry untagged AP management traffic alongside tagged client VLAN traffic (such as VLAN 20), the connected switch port must be configured as an 802.1Q trunk with the AP management VLAN (VLAN 10) specified as the native VLAN.

Step-by-Step Solution

1
Analyze AP mode traffic behavior differences between Local mode and FlexConnect mode.
In Local mode, all client traffic is encapsulated in CAPWAP and sent to the WLC, requiring only a simple switch access port in the AP management VLAN. In FlexConnect local switching mode, client traffic is switched locally onto the Ethernet switch port.
Understanding how traffic leaves the AP determines the required switch port mode.
2
Identify the VLAN requirements for the FlexConnect AP connection.
The AP requires management traffic on VLAN 10 (untagged CAPWAP traffic) and wireless client traffic tagged for VLAN 20.
Carrying both tagged client traffic and untagged management traffic over a single physical cable requires an 802.1Q trunk.
3
Determine the necessary switch port trunk settings.
The switch port must be set to trunk mode (`switchport mode trunk`), with VLAN 10 set as the native VLAN (`switchport trunk native vlan 10`) so CAPWAP management traffic remains untagged, while allowing VLAN 20 for client traffic.
This allows the AP to maintain its CAPWAP tunnel while successfully bridging tagged client packets to the local switch.

Key Concept

FlexConnect AP Switch Port Infrastructure Trunking
Estimated Time:2m 0s
Question 115Question →

A network administrator is troubleshooting neighbor discovery on a Cisco Catalyst switch connected to a multi-vendor IP phone on interface GigabitEthernet1/0/5. Global LLDP has already been enabled with the `lldp run` command. However, output from `show lldp neighbors` indicates that while the switch successfully processes incoming packets from the IP phone, the IP phone is not receiving any LLDP advertisements from the switch.

Which interface configuration command must be applied under interface GigabitEthernet1/0/5 to resolve this issue and allow the switch to send LLDP frames to the phone?

Show answer & explanation

Answer: lldp transmit

Answer

The command 'lldp transmit' must be configured under interface GigabitEthernet1/0/5 to allow outbound LLDP advertisements.
The correct answer specifies 'lldp transmit'. Unlike Cisco Discovery Protocol (CDP), which uses a single interface command ('cdp enable'), Link Layer Discovery Protocol (LLDP) provides granular directional control on interfaces. The 'lldp transmit' interface submode command explicitly instructs the Cisco switch port to generate and send outbound LLDP frames to adjacent devices.

Step-by-Step Solution

1
Identify the protocol and scope required
The target protocol is LLDP (IEEE 802.1AB) operating at the interface level on a Cisco Catalyst switch.
Global LLDP is active, but outbound transmission on GigabitEthernet1/0/5 is currently disabled or missing.
2
Differentiate CDP and LLDP interface command syntax
CDP uses 'cdp enable' on interfaces, whereas LLDP uses separate direction-specific submode commands: 'lldp transmit' and 'lldp receive'.
LLDP allows directional control over transmission and reception per port.
3
Select the correct directional interface submode command
Applying 'lldp transmit' enables outbound advertisement of local switch Type-Length-Value (TLV) attributes.
The issue specifically states that incoming packets are received but outbound packets are not being sent.

Key Concept

LLDP Interface Configuration Commands
Estimated Time:1m 0s
Question 116Question →

A network administrator is setting up a new wireless network using the Cisco Wireless LAN Controller (WLC) web GUI. After defining the WLAN profile name and SSID on the General tab, the administrator needs to configure WPA2 Pre-Shared Key (PSK) authentication for client connectivity. Under which tab and sub-tab within the WLANs > Edit menu is the PSK passphrase field configured?

Show answer & explanation

Answer: Security tab, under the Layer 2 sub-tab

Answer

The PSK passphrase is configured under the Security tab on the Layer 2 sub-tab.
In the Cisco WLC web GUI, Layer 2 wireless security protocols (WPA2/WPA3) and key management methods (PSK vs 802.1X) are located under WLANs > Edit > Security > Layer 2. Enabling PSK under Auth Key Management displays the Pre-Shared Key entry box directly on the Layer 2 sub-tab.

Step-by-Step Solution

1
Navigate to WLANs > Edit for the target WLAN in the WLC GUI.
Access the configuration tabs for the specific WLAN.
WLAN-specific parameters are modified in this section.
2
Click on the Security tab, then select the Layer 2 sub-tab.
Layer 2 security options (such as WPA+WPA2) are displayed.
Wi-Fi authentication mechanisms (PSK and 802.1X) operate at Layer 2.
3
Select PSK under Auth Key Management and enter the passphrase in the Pre-Shared Key box.
The PSK passphrase is applied directly within the Layer 2 sub-tab.
Cisco AireOS WLC GUI integrates PSK key entry directly into the Layer 2 security policy page.

Key Concept

WLC GUI WLAN Security Configuration & Navigation
Estimated Time:1m 15s
Question 117Question →

Match each Layer 2 discovery protocol characteristic or configuration parameter on the left with its correct operational description or standard on the right.

Click a left item, then click its matching right item

Items

IEEE 802.1AB
CDP Default Holdtime
LLDP-MED
lldp transmit

Matches

Show answer & explanation

Answer

IEEE 802.1AB matches the vendor-neutral open standard specification for Layer 2 discovery. CDP Default Holdtime matches 180 seconds before purging a neighbor entry. LLDP-MED matches the extension providing endpoint attributes such as VoIP policy. lldp transmit matches the interface-level command to enable sending outgoing discovery frames.
Each match correctly aligns the discovery protocol attribute, standards body designation, timer setting, or interface command syntax to its operational definition in Cisco IOS networks.

Step-by-Step Solution

1
Identify the standard associated with LLDP
IEEE 802.1AB defines the open-standard LLDP protocol across heterogenous network devices.
CDP is Cisco proprietary, whereas LLDP was developed under IEEE 802.1AB.
2
Recall CDP default timer values
CDP sends messages every 60 seconds and retains neighbor information for a holdtime of 180 seconds.
Knowing default timers is crucial for troubleshooting layer 2 neighbor relationships in Cisco networks.
3
Differentiate LLDP base protocol from LLDP-MED extensions
LLDP-MED extends base LLDP capability to advertise endpoint information like voice VLAN IDs, call control details, and PoE parameters.
LLDP-MED operates specifically between network infrastructure devices and media endpoints.
4
Analyze interface syntax for directional LLDP control
'lldp transmit' and 'lldp receive' control outgoing and incoming frames per interface.
Unlike CDP which is enabled bidirectionally when turned on, LLDP allows fine-grained directional enabling per interface.

Key Concept

Layer 2 Discovery Protocol Capabilities, Standards, and CLI Syntax
Question 118Question →

Match each Cisco Lightweight Access Point (AP) operational mode to its precise functional capability and operational behavior within a centralized or branch wireless architecture.

Click a left item, then click its matching right item

Items

FlexConnect Mode
Monitor Mode
Rogue Detector Mode
Sniffer Mode

Matches

Show answer & explanation

Answer

FlexConnect Mode pairs with local VLAN switching and WAN offline authentication fallback; Monitor Mode pairs with dedicated radio scanning for location tracking and wIDS without client association; Rogue Detector Mode pairs with wired interface monitoring of ARP/MAC tables to identify rogue wired connections; Sniffer Mode pairs with capturing raw 802.11 frames on a designated channel for remote packet analysis.
Each Cisco AP mode serves a specialized operational role: FlexConnect is tailored for remote branch local switching and WAN survivability; Monitor mode provides dedicated wireless security scanning without client association; Rogue Detector mode checks wired ARP/MAC tables to find rogue infrastructure connected to wired switches; and Sniffer mode captures raw wireless traffic on a fixed channel for deep packet inspection.

Step-by-Step Solution

1
Analyze FlexConnect Mode capabilities
Identified local switching and local authentication fallback behavior during WLC WAN unreachable states.
FlexConnect APs are specifically designed for branch/WAN deployments to prevent branch data traffic from bottlenecking over the WAN while supporting standalone survivability.
2
Analyze Monitor Mode operational parameters
Matched with dedicated multi-channel scanning for wIDS, Rogue AP detection, and location tracking.
Monitor mode APs do not transmit SSIDs or allow client associations, freeing the radios to continuously scan tuned channels for security metrics.
3
Differentiate Rogue Detector Mode from wireless scanning modes
Matched with wired switch ARP/MAC inspection.
Rogue Detector APs leverage the wired network infrastructure rather than wireless radios to correlate MAC addresses reported as rogues with connected switch ports.
4
Analyze Sniffer Mode functionality
Matched with channel-specific raw 802.11 frame capturing forwarded to remote analysis tools.
Sniffer mode tunes an AP radio to a fixed channel and streams captured wireless headers and payloads to an IP endpoint running a frame analyzer.

Key Concept

Cisco Access Point Operational Modes
Estimated Time:2m 30s
Question 119Question →

A network administrator is configuring an 802.1Q trunk link between two Cisco Catalyst switches. By default, how does an 802.1Q trunk interface handle Ethernet frames associated with the native VLAN when forwarding them across the trunk?

Show answer & explanation

Answer: It transmits the frames across the trunk link without inserting an 802.1Q VLAN header tag.

Answer

By default, an 802.1Q trunk interface transmits frames belonging to the configured native VLAN without adding a 4-byte 802.1Q tag.
Under IEEE 802.1Q trunking specifications, frames belonging to the configured native VLAN are transmitted across the trunk link without an added 802.1Q VLAN header tag. When the receiving switch accepts untagged frames on an 802.1Q trunk port, it implicitly assigns those frames to its local native VLAN.

Step-by-Step Solution

1
Identify the frame tagging mechanism defined by IEEE 802.1Q for interswitch trunk links.
IEEE 802.1Q inserts a 4-byte VLAN tag field into Ethernet frames for all non-native VLAN traffic.
Trunk interfaces must distinguish traffic belonging to different VLANs over a shared physical medium.
2
Determine how 802.1Q treats traffic associated with the native VLAN.
Frames belonging to the native VLAN are forwarded untagged by default.
This behavior ensures backward compatibility with legacy devices and non-trunking switches that do not understand 802.1Q tags.

Key Concept

802.1Q Native VLAN Untagged Frame Forwarding
Question 120Question →

A network administrator configures an interswitch link between Switch-A and Switch-B using interface GigabitEthernet1/0/24 on both switches.

Switch-A interface configuration:
text
interface GigabitEthernet1/0/24
switchport trunk encapsulation dot1q
switchport mode dynamic auto
switchport trunk native vlan 20
switchport trunk allowed vlan 10,20,30

Switch-B interface configuration:
text
interface GigabitEthernet1/0/24
switchport trunk encapsulation dot1q
switchport mode dynamic desirable
switchport trunk native vlan 1
switchport trunk allowed vlan 10,30,40

Assuming both switches support DTP and IEEE 802.1Q encapsulation, what is the operational behavior of this interswitch link?

Show answer & explanation

Answer: The trunk link forms successfully; tagged traffic for VLANs 10 and 30 is forwarded normally, but untagged VLAN 20 frames sent by Switch-A are dropped upon ingress at Switch-B because Switch-B's native VLAN (VLAN 1) is not in its allowed VLAN list.

Answer

The trunk link forms successfully; tagged traffic for VLANs 10 and 30 is forwarded normally, but untagged VLAN 20 frames sent by Switch-A are dropped upon ingress at Switch-B because Switch-B's native VLAN (VLAN 1) is not in its allowed VLAN list.
Dynamic Trunking Protocol (DTP) successfully negotiates an operational 802.1Q trunk because Switch-A is set to dynamic auto and Switch-B is set to dynamic desirable. Tagged VLANs present in both allowed lists (VLAN 10 and VLAN 30) traverse the link normally. However, Switch-A transmits VLAN 20 frames untagged because VLAN 20 is Switch-A's native VLAN. Upon receiving these untagged frames, Switch-B assigns them to its local native VLAN (VLAN 1). Since VLAN 1 is omitted from Switch-B's explicit allowed list (10, 30, 40), Switch-B drops the frames upon ingress.

Step-by-Step Solution

1
Evaluate DTP negotiation outcome between Switch-A and Switch-B.
Switch-A is in 'dynamic auto' mode (listens for trunking requests) and Switch-B is in 'dynamic desirable' mode (actively solicits trunking). Combining 'auto' and 'desirable' successfully negotiates an operational 802.1Q trunk.
DTP operational state matrix specifies that auto + desirable results in a trunking interface.
2
Determine tagged VLAN forwarding behavior for matched allowed VLANs.
VLAN 10 and VLAN 30 are explicitly included in Switch-A's allowed list (10, 20, 30) and Switch-B's allowed list (10, 30, 40). Frames for VLAN 10 and 30 carry standard 802.1Q tags and pass bidirectionally.
Traffic for non-native allowed VLANs is tagged with 802.1Q headers and permitted across the link.
3
Analyze 802.1Q native VLAN egress tagging and ingress classification.
Switch-A has native VLAN 20, so frames originating from VLAN 20 are transmitted across the trunk link without an 802.1Q tag. When Switch-B receives an untagged frame on its trunk port, it implicitly maps the frame to its own configured native VLAN (VLAN 1).
802.1Q trunks send native VLAN frames untagged, and receiving switches associate untagged ingress frames with their local native VLAN configuration.
4
Evaluate allowed VLAN filtering logic on Switch-B for the ingress untagged traffic.
Switch-B's trunk allowed list is restricted to '10, 30, 40'. Because native VLAN 1 is not included in Switch-B's allowed VLAN list, Switch-B drops the untagged frames received from Switch-A.
Before accepting traffic into a VLAN on a trunk, the switch verifies that the destination VLAN ID is explicitly permitted in the switchport trunk allowed vlan list.

Key Concept

802.1Q Trunking Mechanics, DTP Negotiation, Native VLAN Ingress Processing, and Allowed VLAN List Enforcement
PreviousPage 6 / 20Next