Examkin

Network Access

400 questions

All types400Multiple choice204Multiple select91Matching23Ordering82
Question 121Question →

A network administrator executes the following command sequence on a freshly unboxed Cisco Catalyst switch interface to connect an unmanaged host:

Switch(config)# interface FastEthernet0/12
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 40

Prior to this configuration, VLAN 40 was not created in the switch VLAN database. Assuming all other interfaces remain in their default factory state, how does Cisco IOS process ingress frames from this host and manage the broadcast domain?

Show answer & explanation

Answer: Cisco IOS automatically creates VLAN 40 in the VLAN database, assigns FastEthernet0/12 to VLAN 40, and confines ingress broadcast frames from the host strictly within VLAN 40.

Answer

Cisco IOS automatically creates VLAN 40 in the VLAN database, assigns FastEthernet0/12 to VLAN 40, and confines ingress broadcast frames from the host strictly within VLAN 40.
When configuring an access port with 'switchport access vlan <id>', Cisco IOS checks if the specified VLAN exists in the VLAN database. If it does not exist, Cisco IOS automatically creates the VLAN in the database and assigns the interface to it. The interface then functions as an active access port within that dedicated VLAN broadcast domain.

Step-by-Step Solution

1
Analyze the interface commands provided.
The command 'switchport mode access' sets the port to access mode, and 'switchport access vlan 40' targets VLAN 40 for access traffic.
This establishes static L2 access port membership.
2
Evaluate Cisco IOS dynamic VLAN creation behavior.
When a non-existent VLAN ID is referenced in an access port configuration, Cisco IOS automatically generates that VLAN in the local VLAN database.
Cisco Catalyst switch software automatically creates missing access VLANs to ensure seamless port assignment.
3
Determine Layer 2 broadcast domain boundaries.
Traffic received on FastEthernet0/12 is tagged internally as belonging to VLAN 40, isolating broadcast traffic to ports within VLAN 40.
Each VLAN represents a distinct Layer 2 broadcast domain.

Key Concept

Automatic VLAN Creation on Access Port Assignment
Question 122Question →

A network engineer is configuring Link Aggregation (LAG) on a Cisco Wireless LAN Controller (WLC) connected to an access layer switch stack. The deployment includes central site Local mode APs and remote branch FlexConnect APs using local traffic switching. Which TWO configuration statements correctly describe the requirements and behavior of this WLAN infrastructure connection setup? (Select two.)

Select all that apply

Show answer & explanation

Answer: All distribution system physical ports on the Cisco WLC are bundled into a single logical link, requiring the connected switch ports to be configured as a single static EtherChannel (mode ON) without dynamic LACP or PAgP negotiation.; Switch ports connecting directly to FlexConnect APs operating in local switching mode must be configured as 802.1Q trunks (or VLAN-tagged access ports) to locally bridge client WLAN traffic to the infrastructure switch.

Answer

The correct requirements are: 1) Switch ports connected to the WLC must be bundled into a static EtherChannel using mode ON because Cisco WLCs do not support dynamic EtherChannel protocols like LACP or PAgP. 2) Switch ports connected to FlexConnect APs using local switching must be configured with appropriate 802.1Q VLAN trunking so local client traffic can be bridged directly to the local network infrastructure.
Enabling LAG on a Cisco WLC consolidates all distribution ports into a single logical link requiring the adjacent switch ports to be placed into a single static EtherChannel (mode ON). Additionally, FlexConnect APs configured for local switching require their direct access switch connections to be configured as 802.1Q trunks (or appropriately tagged ports) so that client VLAN traffic can be locally switched into the wired LAN infrastructure.

Step-by-Step Solution

1
Analyze WLC LAG behavior and switch link aggregation requirements.
Cisco AireOS WLCs merge all physical distribution ports into a single logical interface that requires static EtherChannel grouping (mode ON) on the connected switch.
The WLC does not support dynamic negotiation protocols such as LACP or PAgP.
2
Analyze FlexConnect AP infrastructure port requirements for local switching mode.
Traffic from SSIDs configured for local switching is mapped directly to VLAN tags on the AP's physical switch interface.
The switch port connecting to the FlexConnect AP must be an 802.1Q trunk (or access port supporting the required VLAN setup) to correctly forward local data frames without sending them through the central WLC CAPWAP tunnel.

Key Concept

WLAN Infrastructure Link Aggregation (LAG) and FlexConnect AP Switch Port Requirements
Estimated Time:2m 0s
Question 123Question →

A network engineer is integrating non-Cisco VoIP endpoints and access points into an existing Cisco Catalyst switch infrastructure. The engineer needs to ensure automated VLAN assignment and power negotiation function properly across the multi-vendor environment while maintaining Layer 2 discovery. Which two statements regarding the operation and configuration of CDP and LLDP in this scenario are correct?

Select all that apply

Show answer & explanation

Answer: LLDP-MED (Media Endpoint Discovery) is an IEEE 802.1AB extension that enables detailed power management, location identification, and automated voice VLAN policy discovery between network switches and IP endpoints.; CDP and LLDP operate as completely independent processes, allowing both protocols to run concurrently on the same interface without interfering with each other's neighbor tables.

Answer

The two correct statements state that LLDP-MED is an IEEE 802.1AB extension enabling automated endpoint discovery features like voice VLAN policy assignment and power management, and that CDP and LLDP operate independently as separate protocols on the same interface.
LLDP-MED enhances standard IEEE 802.1AB by defining specific Type-Length-Value (TLV) fields for voice VLAN policy, location, and PoE management when connecting third-party endpoints. Additionally, CDP and LLDP are completely decoupled protocol stacks within Cisco IOS, running concurrently without mutual interference.

Step-by-Step Solution

1
Evaluate the capabilities of LLDP-MED in multi-vendor endpoint deployments.
Identified that LLDP-MED (Media Endpoint Discovery) is designed to supply Voice VLAN network policies, location info, and PoE details to multi-vendor devices.
Standard LLDP provides basic device discovery, whereas LLDP-MED extends IEEE 802.1AB for media endpoints such as IP phones.
2
Analyze protocol independence between CDP and LLDP.
Confirmed that Cisco IOS handles CDP (Cisco proprietary) and LLDP (IEEE standard) as separate internal processes.
Both protocols can simultaneously build their respective neighbor tables ('show cdp neighbors' and 'show lldp neighbors') on a shared interface.
3
Inspect interface command behavior for LLDP transmission and reception.
Disproved the claim that disabling transmit disables receive.
In Cisco IOS, 'lldp transmit' and 'lldp receive' are distinct granular interface commands.
4
Evaluate CDP framing standards.
Disproved the claim that CDP changes to IEEE 802.1AB.
CDP remains Cisco-proprietary regardless of connected neighbor devices.

Key Concept

CDP and LLDP Protocol Differences and Multi-Vendor Operations
Question 124Question →

An enterprise network requires redundant, high-bandwidth connectivity between a Cisco AireOS Wireless LAN Controller (WLC) distribution port bundle and a Cisco Catalyst distribution switch. The network team decides to enable Link Aggregation (LAG) on the controller. Which TWO switch-side configurations and behaviors are mandatory for this infrastructure connection to operate correctly? (Select two.)

Select all that apply

Show answer & explanation

Answer: The switch member ports must be statically bundled using channel-group mode on because AireOS LAG does not negotiate using dynamic protocols like LACP or PAgP.; The switch port-channel interface must be configured as an 802.1Q trunk carrying all necessary wireless client and management VLANs with matching native VLAN settings.

Answer

The mandatory switch-side configurations are configuring member ports in static EtherChannel mode (channel-group mode on) and setting the port-channel interface as an 802.1Q trunk carrying the required VLANs with matching native VLAN configurations.
On Cisco AireOS controllers, enabling LAG aggregates all physical distribution ports into a single logical channel. Because AireOS does not support dynamic negotiation protocols (LACP or PAgP), the upstream switch member ports must be statically bound using mode on. Additionally, because multiple VLANs (management, dynamic client WLANs, AP manager) travel across this aggregate link, the port-channel interface on the Catalyst switch must be configured as an 802.1Q trunk with properly aligned native and allowed VLANs.

Step-by-Step Solution

1
Identify the link aggregation capabilities and requirements of Cisco AireOS Wireless LAN Controllers.
AireOS controllers support a single LAG interface bundle that aggregates all distribution ports into one logical connection without supporting dynamic negotiation protocols (LACP/PAgP).
Since AireOS cannot participate in LACP or PAgP handshake negotiation, the upstream Catalyst switch must be configured manually for static EtherChannel using mode on.
2
Determine the trunking and VLAN requirements for WLC distribution port bundles.
All WLC logical interfaces (management, dynamic client VLANs, manager ports) pass over this unified LAG bundle requiring 802.1Q VLAN encapsulation.
The upstream switch port-channel and physical member ports must be configured as 802.1Q trunks with consistent native VLANs and allowed VLAN lists to prevent frame drops or VLAN leakage.
3
Evaluate and eliminate incorrect statements regarding LAP mode traffic routing and dynamic negotiation.
Dynamic negotiation modes like LACP passive or PAgP fail, and Local mode LAPs do not require switch trunk ports since CAPWAP tunnels all client data to the controller.
Local mode APs tunnel data to the WLC rather than switching locally, so AP switch ports remain in access mode, whereas FlexConnect mode APs would utilize switch trunking.

Key Concept

Cisco AireOS WLC Link Aggregation (LAG) and Upstream Switch Trunking
Estimated Time:1m 30s
Question 125Question →

A network administrator is reconfiguring interface GigabitEthernet0/2 on a Cisco Catalyst switch. The interface is currently connected to a trunking partner device and is actively operating as an 802.1Q trunk port via Dynamic Trunking Protocol (DTP). The administrator enters the following interface configuration command:

Switch(config-if)# switchport access vlan 50

VLAN 50 does not currently exist in the switch VLAN database. Assuming all other configuration settings remain at default, what is the resulting operational state of interface GigabitEthernet0/2 and VLAN 50?

Show answer & explanation

Answer: VLAN 50 is automatically created in the VLAN database, but interface GigabitEthernet0/2 continues to operate as an active trunk port.

Answer

VLAN 50 is automatically created in the switch VLAN database, but interface GigabitEthernet0/2 continues to operate as a trunk port.
When configuring 'switchport access vlan 50' on a Cisco Catalyst interface, Cisco IOS automatically creates VLAN 50 in the VLAN database if it does not already exist. However, configuring the access VLAN value only affects traffic when the interface operates in access mode. Since the port was dynamically negotiating as an 802.1Q trunk and no explicit 'switchport mode access' command was issued, the interface remains in trunking operational mode.

Step-by-Step Solution

1
Analyze the effect of the command on the VLAN database
VLAN 50 is created automatically
When assigning an interface to a non-existent VLAN using 'switchport access vlan <vlan-id>', Cisco IOS dynamically creates the VLAN in the VLAN database.
2
Evaluate the administrative vs. operational mode of the interface
The interface operational mode remains trunk
The command 'switchport access vlan 50' modifies the access VLAN parameter for when the port operates in access mode. Because 'switchport mode access' was not executed, the existing dynamic/trunking operational state remains unchanged.

Key Concept

Separation of Access VLAN Configuration and Interface Operational Mode in Cisco IOS
Estimated Time:1m 30s
Question 126Question →

A network engineer connects a Cisco Lightweight Access Point (AP) to an 802.1Q trunk interface on a Layer 2 access switch. The AP is intended to join a Wireless LAN Controller (WLC) via its management interface using untagged CAPWAP control traffic. The switch port is configured with switchport mode trunkswitchport\ mode\ trunk and switchport trunk native vlan 50switchport\ trunk\ native\ vlan\ 50. However, the AP fails to establish a CAPWAP tunnel, and syslog messages on the switch indicate native VLAN mismatch errors. CDP neighbor outputs confirm that the switch expects tagged traffic on VLAN 1 while transmitting native frames on VLAN 50. Which switchport configuration change correctly resolves the AP's management access failure while allowing untagged CAPWAP discovery traffic?

Show answer & explanation

Answer: Reconfigure the switchport native VLAN to match the untagged subnet VLAN assigned for AP management access.

Answer

Reconfiguring the switchport native VLAN to match the untagged subnet VLAN assigned for AP management access correctly resolves the management connectivity failure.
Lightweight Cisco APs transmit untagged packets for CAPWAP management discovery by default. If the switchport connected to the AP is an 802.1Q trunk, untagged traffic is placed into the trunk's configured native VLAN. When the native VLAN on the switch port does not match the actual IP subnet dedicated to AP management, the AP cannot communicate with the gateway or reach the WLC management interface. Reconfiguring the switch port's native VLAN to match the AP management subnet resolves the tagging mismatch and restores CAPWAP connectivity.

Step-by-Step Solution

1
Identify the cause of the CAPWAP discovery and management access failure.
Lightweight APs send untagged management/CAPWAP frames by default during initial discovery unless explicitly configured with a management VLAN tag.
When the connected switch port uses a native VLAN (VLAN 50) that differs from the subnet broadcast domain expecting untagged AP traffic (VLAN 1), 802.1Q native VLAN mismatch occurs and traffic drops.
2
Evaluate the switchport 802.1Q trunking behavior.
Changing the switchport native VLAN setting (switchport trunk native vlan <vlan−id>switchport\ trunk\ native\ vlan\ <vlan-id>) to match the AP's untagged management network allows untagged CAPWAP packets to enter the correct Layer 2 domain.
Matching the native VLAN on both ends of an 802.1Q trunk allows untagged AP control frames to reach the default gateway and route to the WLC management interface.

Key Concept

AP and WLC Management Switchport 802.1Q Native VLAN Alignment
Estimated Time:2m 0s
Question 127Question →

Network administrators use Layer 2 discovery protocols to discover adjacent network hardware and verify topology details. Match each Layer 2 discovery protocol attribute on the left with its corresponding protocol characteristic or default value on the right.

Click a left item, then click its matching right item

Items

IEEE 802.1AB
Cisco Proprietary Discovery Protocol
Default CDP Holdtime
Default LLDP Holdtime

Matches

Show answer & explanation

Answer

IEEE 802.1AB matches Open vendor-neutral standard for Link Layer Discovery Protocol (LLDP); Cisco Proprietary Discovery Protocol matches Cisco Discovery Protocol (CDP); Default CDP Holdtime matches 180 seconds; Default LLDP Holdtime matches 120 seconds.
IEEE 802.1AB is the formal standard specification for LLDP. CDP is Cisco's proprietary discovery protocol. CDP defaults to an update timer of 60 seconds and a holdtime of 180 seconds, while LLDP defaults to a transmit timer of 30 seconds and a holdtime of 120 seconds.

Step-by-Step Solution

1
Identify the standard governing LLDP.
LLDP is defined under IEEE 802.1AB.
IEEE 802.1AB provides an open standard for neighbor discovery across multi-vendor equipment.
2
Identify the ownership model of CDP.
CDP is Cisco proprietary.
CDP was created by Cisco to allow Cisco switches, routers, and devices to discover each other.
3
Calculate or recall the default CDP holdtime.
The CDP holdtime defaults to 180 seconds.
CDP transmits messages every 60 seconds, and the default holdtime is set to 3 update intervals (180 seconds).
4
Calculate or recall the default LLDP holdtime.
The LLDP holdtime defaults to 120 seconds.
LLDP uses a default transmit timer of 30 seconds with a default holdtime multiplier of 4, producing a 120-second holdtime.

Key Concept

Distinguishing characteristics, standards, and default timers of CDP and LLDP.
Question 128Question →

An administrator is configuring a trunk link between Switch-1 and Switch-2. On Switch-1 interface GigabitEthernet0/1, the engineer executes the following configuration commands:

Switch-1(config-if)# switchport mode trunk
Switch-1(config-if)# switchport trunk native vlan 20
Switch-1(config-if)# switchport trunk allowed vlan 10,30,40

Assuming Switch-2 has default 802.1Q trunk configurations with native VLAN 20 allowed, how will Switch-1 process frame forwarding for VLAN 20 traffic egressing interface GigabitEthernet0/1?

Show answer & explanation

Answer: Switch-1 drops frames originating from VLAN 20 because VLAN 20 is not included in the interface allowed VLAN list.

Answer

Switch-1 drops frames originating from VLAN 20 because VLAN 20 is explicitly excluded from the trunk's allowed VLAN list.
The correct answer identifies that Switch-1 drops frames originating from VLAN 20. When the command 'switchport trunk allowed vlan' is used with an explicit parameter list, only traffic for the listed VLANs (10, 30, 40) is permitted across the trunk link. Because VLAN 20 is not in this list, its traffic is pruned and dropped at ingress/egress, even though it is configured as the native VLAN.

Step-by-Step Solution

1
Analyze the configuration command 'switchport trunk allowed vlan 10,30,40'.
The allowed VLAN list for interface GigabitEthernet0/1 is set exclusively to VLANs 10, 30, and 40.
Explicitly specifying allowed VLAN numbers replaces the default 'all' list with only the specified VLAN IDs.
2
Evaluate the status of native VLAN 20 against the allowed VLAN list.
VLAN 20 is configured as native, but it is absent from the allowed list (10, 30, 40).
For a native VLAN's traffic to transit an 802.1Q trunk link, it must be included in the port's allowed VLAN list.
3
Determine the forwarding behavior for egress VLAN 20 frames on Switch-1.
Switch-1 drops egress frames belonging to VLAN 20.
Trunk interfaces filter out (prune) any frames belonging to VLANs not present in the allowed list, regardless of native VLAN designation.

Key Concept

802.1Q Trunk Allowed VLAN Filtering Logic
Question 129Question →

An engineer is troubleshooting a switch port running classic 802.1D Spanning Tree Protocol (STP) that connects to an access host. The current interface state is shown below:

text
Switch# show spanning-tree interface GigabitEthernet 0/1
Vlan Role Sts Cost Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
VLAN0010 Desg LRN 4 128.1 P2p

If the network administrator configures `spanning-tree portfast` on interface GigabitEthernet 0/1 and the link subsequently flaps, which statement accurately describes the operational state transitions and spanning-tree behaviors of this interface?

Show answer & explanation

Answer: The interface immediately transitions upon link-up from Blocking directly to Forwarding, skipping Listening and Learning, and it does not trigger a Topology Change Notification (TCN) when the link flaps.

Answer

The interface immediately transitions upon link-up from Blocking directly to Forwarding, skipping Listening and Learning, and it does not trigger a Topology Change Notification (TCN) when the link flaps.
Enabling Cisco PortFast on an access interface causes it to transition directly from Blocking to Forwarding immediately upon link up, completely bypassing the 15-second Listening and 15-second Learning states. In addition, link flaps on PortFast-enabled ports do not send Topology Change Notifications (TCNs) to the Root Bridge, avoiding global MAC address table aging flushes.

Step-by-Step Solution

1
Analyze the initial interface output status.
The command output shows interface GigabitEthernet 0/1 in the Designated role and LRN (Learning) state.
Standard 802.1D STP transitions through Blocking (20s max age) -> Listening (15s forward delay) -> Learning (15s forward delay) -> Forwarding (total convergence delay of 30-50 seconds).
2
Evaluate the impact of enabling Cisco PortFast on an access interface.
PortFast bypasses the Listening and Learning states, placing the port into Forwarding immediately when link-up occurs.
End-user hosts (workstations, servers, printers) do not create Layer 2 loops and require rapid link activation to prevent DHCP lease timeouts or PXE boot failures.
3
Determine the Topology Change Notification (TCN) behavior associated with PortFast.
Link up/down events on PortFast-enabled ports do not generate TCNs.
Preventing TCN generation eliminates unnecessary MAC address table timer reductions (aging down to forward delay) across the switches in the STP domain whenever end-user PCs reboot or disconnect.

Key Concept

STP Port States and PortFast Benefits
Estimated Time:1m 30s
Question 130Question →

A network administrator is configuring interface GigabitEthernet0/1 on a Cisco Catalyst switch to connect a single end-user computer. The interface needs to be explicitly configured as an access port and assigned to VLAN 10. Which two Cisco IOS commands must be entered in interface configuration mode to complete this task?

Select all that apply

Show answer & explanation

Answer: switchport mode access; switchport access vlan 10

Answer

The correct commands are 'switchport mode access' to define the operational mode as an access port, and 'switchport access vlan 10' to assign the access port to VLAN 10.
To properly configure an access port on a Cisco Catalyst switch, the administrator must define the port operational mode using 'switchport mode access' and specify its VLAN association using 'switchport access vlan 10'.

Step-by-Step Solution

1
Set the switch port mode to access.
Interface is forced into static non-trunking (access) mode.
Ensures the port will not negotiate trunking via DTP and acts as a standard access port.
2
Assign the access port to the target VLAN.
Interface is placed into VLAN 10.
Associates untagged frames received on this access port with VLAN 10.

Key Concept

Cisco IOS VLAN Access Port Configuration
Estimated Time:45s
Question 131Question →

An engineer is analyzing legacy IEEE 802.1D Spanning Tree Protocol (STP) behavior on a Cisco switch interface that is configured without PortFast. Place the following STP port states in chronological order, starting from link initialization and ending when the interface reaches active user data transmission.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological order of classic IEEE 802.1D STP port states during port initialization is Blocking, Listening, Learning, and Forwarding.
Standard IEEE 802.1D STP port state convergence transitions sequentially through Blocking (loop prevention / BPDU listening) -> Listening (BPDU transmission/reception, topology role determination) -> Learning (MAC address table population without frame forwarding) -> Forwarding (full data frame forwarding and continuous learning).

Step-by-Step Solution

1
Identify the initial state assigned to prevent immediate switching loops upon link UP.
The interface starts in the Blocking state where data frames are dropped and MAC addresses are not learned, but incoming BPDUs are evaluated.
802.1D STP defaults to a loop-prevention state to listen for existing network bridge topology.
2
Determine the state where active STP participation and BPDU transmission begin.
The port transitions to the Listening state for 15 seconds (Forward Delay), sending and receiving BPDUs to elect the root bridge and establish port roles.
In Listening, the switch establishes topology structure without yet accepting host MAC entries.
3
Identify the state designed to populate layer 2 tables prior to passing payload traffic.
The port moves to the Learning state for an additional 15 seconds (Forward Delay), reading source MAC addresses from frame headers without forwarding frames.
Pre-building the MAC address table minimizes unicast flooding once frame forwarding is enabled.
4
Identify the ultimate operational state achieved upon timer completion.
The port enters the Forwarding state, enabling full bidirectional user traffic forwarding alongside ongoing BPDU processing and MAC learning.
The port has passed all convergence checks over the 30-second convergence window.

Key Concept

Classic IEEE 802.1D STP Port State Transition Sequence
Question 132Question →

A network engineer is configuring a routed (Layer 3) EtherChannel between two switches using LACP. The engineer issued the `no switchport` command on physical interfaces GigabitEthernet0/1 and GigabitEthernet0/2 before assigning them to channel group 1 with mode `active`. However, the bundle fails to pass routed traffic. Upon executing `show etherchannel summary`, the output displays:

text
Group Port-channel Protocol Ports
------+-------------+-----------+-----------------------------------------------
1 Po1(SD) LACP Gi0/1(I) Gi0/2(I)

Which administrative action will resolve this issue and bring the Layer 3 EtherChannel into an operational state?

Show answer & explanation

Answer: Issue the `no switchport` command on the logical Port-Channel 1 interface.

Answer

Issue the `no switchport` command on the logical Port-Channel 1 interface.
The `show etherchannel summary` command output displays `Po1(SD)`, where `S` signifies Layer 2 and `D` signifies Down. Because the physical member interfaces were configured with `no switchport`, they are operating as Layer 3 ports. LACP prevents ports from bundling if there is a mismatch between the physical member ports and the logical port-channel interface mode. Converting the Port-Channel 1 interface to Layer 3 using `no switchport` resolves the configuration mismatch and enables the LACP bundle to become operational (`Po1(RU)` or `Po1(SU)` depending on code version definitions).

Step-by-Step Solution

1
Analyze the flags in the `show etherchannel summary` output.
Flag `S` on `Po1(SD)` indicates Layer 2 operational mode, and flag `D` indicates Down. Flags `(I)` on member ports indicate Stand-alone state.
The physical ports were configured as routed ports (`no switchport`), but the logical Port-Channel interface retained its default Layer 2 switchport property.
2
Identify the underlying compatibility requirement for EtherChannel aggregation.
All physical member interfaces and the parent Port-Channel interface must share matching operational parameters, including Layer 2 vs. Layer 3 mode.
LACP will suspend member ports or keep them stand-alone if there is a Layer 2 / Layer 3 mode mismatch with the logical port-channel.
3
Determine the corrective CLI command on the logical interface.
Executing `interface Port-channel 1` followed by `no switchport` converts the logical interface to Layer 3.
Aligning the logical interface mode to Layer 3 allows LACP to bundle Gi0/1 and Gi0/2 into Po1, changing the flags to `SU` (Layer 3, in Use) and member port flags to `P` (bundled in port-channel).

Key Concept

Layer 3 EtherChannel Configuration and Operability Flags
Estimated Time:2m 0s
Question 133Question →

An enterprise network team is troubleshooting an LACP-based routed EtherChannel between Switch-1 and Switch-2.

Switch-1 configuration snippet:
interface range GigabitEthernet0/1 - 2
no switchport
channel-group 12 mode active
!
interface Port-channel 12
no switchport
ip address 10.1.12.1 255.255.255.252

Switch-2 command output:
# show etherchannel summary
Flags: D - down P - bundled in port-channel
I - stand-alone s - suspended
H - Hot-standby S - Layer2
R - Layer3 U - in use
Group Port-channel Protocol Ports
------+-------------+-----------+-----------------------------------------------
12 Po12(SD) LACP Gi0/1(I) Gi0/2(I)

Which configuration change on Switch-2 will successfully establish the Layer 3 EtherChannel and bring Port-channel 12 to the operational Layer 3 state (RU)?

Show answer & explanation

Answer: Configure 'no switchport' and 'channel-group 12 mode passive' on physical interfaces GigabitEthernet0/1 and GigabitEthernet0/2, then assign the IP address under interface Port-channel 12.

Answer

The correct action is to configure 'no switchport' and 'channel-group 12 mode passive' on physical interfaces GigabitEthernet0/1 and GigabitEthernet0/2, and assign the IP address under interface Port-channel 12.
To transition Port-channel 12 on Switch-2 from (SD) Layer 2 Down to (RU) Layer 3 In-Use, the physical member interfaces (Gi0/1 and Gi0/2) must have switchport functionality disabled via 'no switchport'. LACP dynamic negotiation requires compatible modes across both switches; since Switch-1 is configured in 'active' mode, Switch-2 can use either 'active' or 'passive' mode. Lastly, IP addressing in a Layer 3 EtherChannel must be assigned directly to the Port-channel 12 logical interface rather than to the individual member interfaces.

Step-by-Step Solution

1
Analyze the output of 'show etherchannel summary' on Switch-2.
Port-channel 12 shows flag 'S' (Layer 2) and 'D' (Down), while physical interfaces show 'I' (Stand-alone). Switch-1 is configured as Layer 3 ('R').
The flags indicate a Layer mismatch (Layer 2 on Switch-2 vs Layer 3 on Switch-1) and independent member states due to incomplete Layer 3/LACP setup.
2
Determine Layer 3 EtherChannel requirements for member interfaces.
Member interfaces must be routed ports using the 'no switchport' command prior to or matching port-channel settings.
EtherChannel member interfaces must match Layer 2 or Layer 3 properties to form an operational bundle.
3
Verify LACP mode compatibility.
Switch-1 is set to 'active'. Switch-2 must be set to 'active' or 'passive'.
LACP requires at least one side to be in active mode to initiate link aggregation control protocol negotiation.
4
Verify Layer 3 IP address placement.
The IP address must be assigned to interface Port-channel 12, not to individual physical interfaces.
In a routed EtherChannel, the port-channel interface acts as the single logical Layer 3 routing point.

Key Concept

Layer 3 EtherChannel LACP Negotiation and Troubleshooting
Estimated Time:3m 0s
Question 134Question →

A switch port running standard IEEE 802.1D Spanning Tree Protocol (STP) detects an active connection to an end device. Arrange the STP port states in the correct sequential order from initial physical link detection to fully active data frame forwarding.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequential progression of 802.1D STP port states is: Blocking State, Listening State, Learning State, and Forwarding State.
Under standard IEEE 802.1D, a newly connected port progresses through four distinct states to ensure network loops do not form: Blocking (drops data, listens for BPDUs), Listening (discards data, sends/receives BPDUs, no MAC learning), Learning (discards data, learns MAC addresses), and finally Forwarding (forwards data frames normally).

Step-by-Step Solution

1
Identify the initial state upon link up.
The port starts in the Blocking state to avoid creating temporary switching loops while BPDU information is evaluated.
802.1D requires all non-designated/non-root ports or newly activated ports to block user traffic initially.
2
Determine the transition following BPDU analysis.
The port transitions to the Listening state for the duration of the Forward Delay timer (15 seconds).
During Listening, the port sends and receives BPDUs to elect root bridges and assign port roles without forwarding traffic or learning MAC addresses.
3
Determine the step after topology role determination.
The port enters the Learning state for a second Forward Delay timer interval (15 seconds).
Learning allows the switch to build its MAC address table from source MACs in incoming frames to minimize flooding when forwarding begins.
4
Identify the final operational state.
The port reaches the Forwarding state.
Once the learning phase expires without topology conflicts, the interface fully forwards user data frames and processes BPDUs.

Key Concept

802.1D Spanning Tree Protocol Port State Transitions
Estimated Time:45s
Question 135Question →

A network administrator is setting up out-of-band administrative access for a newly deployed Cisco Wireless LAN Controller (WLC). The design requires isolating administrative management traffic (GUI/SSH) from AP CAPWAP tunnels and user data traffic by utilizing the dedicated physical Service Port on the WLC. Which operational characteristic correctly describes the behavior and network configuration of the WLC Service Port?

Show answer & explanation

Answer: It operates strictly out-of-band and uses an independent routing configuration separate from the WLC data plane dynamic and management interfaces.

Answer

The WLC Service Port operates strictly out-of-band and uses an independent routing configuration separate from the WLC data plane dynamic and management interfaces.
The correct answer highlights that the Cisco WLC Service Port is a dedicated out-of-band management interface. It is physically separate from the distribution system ports, operates in its own routing domain, and is reserved for administrative GUI/SSH management, system recovery, and maintenance without handling CAPWAP or client data traffic.

Step-by-Step Solution

1
Identify the primary functional role of the Cisco WLC Service Port.
The Service Port is a dedicated 10/100/1000 Ethernet interface designed for out-of-band management, system recovery, and initial setup.
Out-of-band management separates administrative control plane traffic from data plane and wireless infrastructure traffic.
2
Evaluate how traffic routing and connectivity differ between the Service Port and in-band interfaces (Management/Dynamic).
The Service Port maintains its own static routing gateway configuration and does not pass CAPWAP, client data, or dynamic interface traffic.
This physical and logical isolation ensures management access remains functional even during heavy data plane saturation or network outages.

Key Concept

Cisco WLC Service Port vs. In-Band Management Interfaces
Estimated Time:1m 30s
Question 136Question →

Two Cisco Catalyst switches are connected using four physical Ethernet links intended for a high-capacity trunk bundle. The interfaces on Switch-1 are configured with `channel-group 5 mode active`, while the interfaces on Switch-2 are configured with `channel-group 5 mode passive`. After connecting the cables, three of the four links bundle successfully into `Port-channel 5`, but interface `GigabitEthernet0/1` on Switch-1 remains in an Independent (`I`) operational state. What is the primary cause of this member interface failing to join the active LACP EtherChannel?

Show answer & explanation

Answer: The interface has an operational speed or duplex setting that does not match the other physical member interfaces in the bundle.

Answer

The physical interface has an operational speed or duplex setting that does not match the other physical member interfaces in the bundle.
EtherChannel member interfaces must be configured identically regarding speed, duplex, media type, VLAN range, and trunking mode. If a single interface has a mismatched operational speed or duplex setting (e.g., auto-negotiated to 100/full instead of 1000/full), LACP consistency checks will fail for that port. Cisco IOS will flag the interface as Independent ('I') in the show etherchannel summary output, keeping it operating standalone outside the bundle while the matching ports form the EtherChannel.

Step-by-Step Solution

1
Analyze the LACP negotiation mode compatibility between Switch-1 and Switch-2.
Switch-1 is set to 'active' and Switch-2 is set to 'passive'. Active-to-passive is a valid LACP negotiation combination, so mode mismatch between switches is not the issue.
LACP active mode actively sends LACPDU packets, while passive mode responds to incoming LACPDUs.
2
Identify mandatory prerequisite physical interface matching parameters for EtherChannel member ports.
All member ports in an EtherChannel bundle must match speed, duplex, interface mode (access/trunk), native VLAN, and allowed VLANs.
If any individual physical port has a mismatched operational attribute (such as 100 Mbps when others are 1 Gbps), Cisco IOS prevents that port from joining the bundle to protect against frame misordering or forwarding loops.
3
Interpret the 'I' (Independent) flag in 'show etherchannel summary' output.
The 'I' flag indicates that the port is operating standalone (independently) because it failed EtherChannel consistency checks or negotiation.
Speed/duplex mismatch on that specific interface causes it to drop out of the logical bundle while remaining active as a standalone port.

Key Concept

EtherChannel Physical Interface Prerequisites & LACP Verification
Estimated Time:1m 15s
Question 137Question →

A network engineer is evaluating the Rapid PVST+ topology operational mechanics across a enterprise LAN segment. A switch has multiple active connections to adjacent switches and redundant interswitch links. Which two statements correctly describe Rapid PVST+ port role operations and behaviors in this environment? (Select two.)

Select all that apply

Show answer & explanation

Answer: An Alternate port receives BPDUs from a neighbor switch, provides an alternate path to the root bridge, and remains in the Discarding state.; A Backup port receives BPDUs originated by its own local switch over a shared collision domain or redundant link to the same segment and remains in the Discarding state.

Answer

The correct statements are that an Alternate port receives BPDUs from a neighbor switch to provide an alternate path toward the root bridge in the Discarding state, and a Backup port receives BPDUs sent by its own switch to provide redundancy for a Designated Port on the same collision domain.
In Rapid PVST+ (IEEE 802.1w implementation in Cisco switches), an Alternate port receives BPDUs from other switches and stands by to replace the Root Port if the active path to the root bridge fails. A Backup port receives BPDUs transmitted by its own switch over a shared media connection and stands by to replace the Designated Port for that specific segment. Both roles maintain a Discarding state to prevent Layer 2 loops.

Step-by-Step Solution

1
Analyze Alternate Port Role
Identified that an Alternate port receives BPDUs from other switches and acts as a standby path to the Root Bridge.
Rapid PVST+ defines Alternate ports to take over immediately if the primary Root Port loses connectivity to the root bridge.
2
Analyze Backup Port Role
Identified that a Backup port receives its own switch's BPDUs on a shared or redundant connection to the same network segment.
A Backup port backs up a local Designated Port on the same LAN segment when multiple interfaces from a single switch connect to the same shared collision domain.
3
Evaluate Distractors and Misconfigurations
Eliminated incorrect assertions regarding role substitution and PortFast trunk misapplications.
Alternate ports back up Root Ports (not Designated Ports), and PortFast is intended for edge host ports, not for bypassing Backup port role logic on interswitch links.

Key Concept

Rapid PVST+ Port Roles (Root, Designated, Alternate, Backup) and Operational States
Question 138Question →

A network engineer connects two Cisco Catalyst switches using interface GigabitEthernet0/1. Switch-1 is configured with the commands 'switchport mode dynamic desirable' and 'switchport trunk native vlan 10'. Switch-2 is configured with 'switchport mode dynamic auto' and 'switchport trunk native vlan 20'. Assuming default Dynamic Trunking Protocol (DTP) settings, which statement accurately describes the resulting operational state of this interswitch connection?

Show answer & explanation

Answer: An 802.1Q trunk will form successfully, but a native VLAN mismatch will occur, causing untagged traffic from VLAN 10 on Switch-1 to cross into VLAN 20 on Switch-2.

Answer

An 802.1Q trunk will form successfully, but a native VLAN mismatch will occur, causing untagged traffic from VLAN 10 on Switch-1 to cross into VLAN 20 on Switch-2.
When one switch interface is configured as 'dynamic desirable' and the opposite interface is 'dynamic auto', Dynamic Trunking Protocol (DTP) successfully negotiates the link into an operational 802.1Q trunk. However, because Switch-1 uses VLAN 10 as its native VLAN and Switch-2 uses VLAN 20, 802.1Q untagged frame behavior causes traffic sent on VLAN 10 from Switch-1 to arrive untagged and be placed into VLAN 20 on Switch-2. This native VLAN mismatch generates continuous syslog alerts via CDP.

Step-by-Step Solution

1
Evaluate DTP Negotiation Modes
Dynamic Desirable on Switch-1 actively sends DTP frames, while Dynamic Auto on Switch-2 listens and responds positively to DTP trunk requests.
DTP mode dynamic desirable paired with dynamic auto results in an operational trunk link.
2
Analyze Native VLAN Configuration
Switch-1 expects untagged frames to belong to VLAN 10, whereas Switch-2 expects untagged frames to belong to VLAN 20.
802.1Q trunks do not tag frames belonging to the native VLAN across the link header.
3
Determine Frame Delivery Behavior and Protocol Alerts
Untagged frames sent from VLAN 10 on Switch-1 travel across the trunk untagged and are ingested into VLAN 20 by Switch-2. Cisco Discovery Protocol (CDP) detects this discrepancy and generates syslog messages.
A native VLAN mismatch leads to VLAN hopping/leaking and triggers CDP native VLAN mismatch error logs.

Key Concept

DTP Negotiation Outcomes and 802.1Q Native VLAN Alignment
Question 139Question →

An administrator is configuring an interswitch trunk link between Switch-A and Switch-B using GigabitEthernet0/1 on both switches. The current running configurations are as follows:

Switch-A:
text
interface GigabitEthernet0/1
switchport mode dynamic desirable
switchport trunk native vlan 20
switchport trunk allowed vlan 10,20,30

Switch-B:
text
interface GigabitEthernet0/1
switchport mode dynamic auto
switchport trunk native vlan 10
switchport trunk allowed vlan 10,20,30

Based on these configuration state parameters, which operational behavior will occur on this interswitch connection?

Show answer & explanation

Answer: The link successfully negotiates 802.1Q trunking, but CDP reports a native VLAN mismatch and untagged frame traffic from Switch-A VLAN 20 is processed on Switch-B in VLAN 10.

Answer

The link successfully negotiates 802.1Q trunking, but CDP reports a native VLAN mismatch and untagged frame traffic from Switch-A VLAN 20 is processed on Switch-B in VLAN 10.
The combination of 'dynamic desirable' on Switch-A and 'dynamic auto' on Switch-B allows DTP to successfully form an 802.1Q trunk link. Because Switch-A has configured native VLAN 20 and Switch-B has configured native VLAN 10, untagged traffic transmitted by Switch-A for VLAN 20 is interpreted as VLAN 10 by Switch-B upon arrival. CDP routinely verifies native VLAN settings via TLVs and generates continuous native VLAN mismatch alert messages in the console system log.

Step-by-Step Solution

1
Analyze Dynamic Trunking Protocol (DTP) negotiation mode compatibility.
Switch-A uses 'dynamic desirable' (actively attempts to negotiate a trunk) and Switch-B uses 'dynamic auto' (responds to trunk negotiation requests). The operational state of the link becomes an 802.1Q trunk.
Matching dynamic desirable with dynamic auto results in successful trunk establishment.
2
Evaluate native VLAN tagging behavior and traffic path across the trunk.
Switch-A sends VLAN 20 frames untagged over the 802.1Q trunk. Switch-B receives these untagged frames and assigns them to its configured native VLAN, which is VLAN 10.
802.1Q native VLAN traffic is transmitted without a VLAN header tag. The receiving switch places all untagged traffic into its configured native VLAN.
3
Determine Layer 2 discovery protocol and management alert impacts.
Cisco Discovery Protocol (CDP) exchanges neighbor capabilities and detects configured native VLAN 20 on Switch-A versus native VLAN 10 on Switch-B, triggering `%CDP-4-NATIVE_VLAN_MISMATCH` console error messages.
CDP carries native VLAN TLVs to detect trunk configuration inconsistencies across directly connected neighbors.

Key Concept

802.1Q Interswitch Trunking Negotiation and Native VLAN Mismatch Dynamics
Estimated Time:2m 30s
Question 140Question →

In an IEEE 802.1Q trunk link between two Cisco switches, how is traffic belonging to the native VLAN transmitted across the link by default?

Show answer & explanation

Answer: It is transmitted as untagged frames without an 802.1Q header.

Answer

Traffic belonging to the native VLAN is transmitted as untagged frames without an 802.1Q header by default.
By default, IEEE 802.1Q trunking transmits frames belonging to the native VLAN across the link without inserting an 802.1Q VLAN header tag. When the receiving switch accepts untagged frames on a trunk port, it automatically places them into its configured native VLAN.

Step-by-Step Solution

1
Identify the standard frame handling behavior of IEEE 802.1Q trunking.
IEEE 802.1Q inserts a 4-byte tag field into Ethernet frames for standard tagged VLANs to preserve VLAN identification across switch interconnects.
Tagging allows switches to multiplex multiple VLANs over a single physical link.
2
Apply the native VLAN exception rule.
Frames associated with the native VLAN are sent across the trunk link completely untagged without modifying the original frame header.
This behavior maintains backward compatibility with legacy devices or unmanaged switches that do not process 802.1Q tags.

Key Concept

802.1Q Native VLAN Untagged Behavior
Estimated Time:45s
PreviousPage 7 / 20Next
Network Access Practice Questions — Cisco CCNA — Page 7 | Examkin