CCNA Network Access: 340 practice questions
7-day money-back guarantee — full refund within 7 days of purchase if you've completed under 20% of the questions. See pricing →
Certifications Tools Flashcards Career Paths Exam Guides Blog Pricing For Teams About
Try 20 questions free →

CCNA Network Access: 340 practice questions

CCNA 340 questions 12 shown free

12 of the 340 Network Access questions in the Certsqill CCNA bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for CCNA? Take the free 5-min readiness check →

1. DISTRIBUTION Gi1/0/24 connects to ACCESS-2 Gi0/1: Review this output and choose the technically supported conc

Hard
A distribution switch runs Cisco IOS XE. Review this output and choose the technically supported conclusion.DISTRIBUTION# show cdp neighbors detail ------------------------- Device ID: ACCESS-2 Entry address(es): IP address: 10.20.5.12 Platform: cisco C9200L, Capabilities: Switch IGMP Interface: GigabitEthernet1/0/24, Port ID (outgoing port): GigabitEthernet0/1 Holdtime : 142 sec
  1. The neighboring switch trusts all traffic received on Gi0/1.
    Neighbor capabilities do not establish security policy, trust, or permitted traffic behavior.
  2. Gi1/0/24 must be configured as an access port.
    CDP does not reveal whether the local interface is configured as access or trunk.
  3. DISTRIBUTION Gi1/0/24 connects to ACCESS-2 Gi0/1. ✓
    CDP identifies the local interface and the neighbor's reported outgoing interface.
  4. ACCESS-2 has verified application reachability through Gi0/1.
    CDP supplies neighbor identity and port information, not proof of application reachability.
The trap
Mistakes advertised capabilities for security configuration. Confuses discovery evidence with end-to-end application verification. Infers switching mode from unrelated discovery output.

CDP identifies the connected device and remote port, but does not prove reachability or trust.

2. The RADIUS authentication service is unreachable: What dependency most directly explains the failure?

Easy
On a wireless office floor, the WLAN is enabled with SSID Clinic-Staff, VLAN 30, and WPA2-Enterprise. Access points advertise the SSID, but every client fails authentication. The controller cannot reach the configured RADIUS server, while the wired VLAN gateway responds normally. What dependency most directly explains the failure?
  1. The access VLAN must be changed to the native VLAN.
    Enterprise authentication does not require clients to use the trunk native VLAN.
  2. The RADIUS authentication service is unreachable. ✓
    WPA2-Enterprise requires 802.1X/EAP authentication through a reachable RADIUS service.
  3. The SSID must use WPA2-Personal with a shared key.
    WPA2-Enterprise correctly uses RADIUS rather than a personal preshared key.
  4. The WLAN must be disabled before clients can authenticate.
    An enabled WLAN is required for client association and authentication attempts.
The trap
Confuses wireless VLAN mapping with native trunk behavior. Substitutes personal authentication for the stated enterprise design. Treats the working WLAN state as the failure.

WPA2-Enterprise depends on reachable RADIUS authentication even when the WLAN and VLAN operate.

3. Client data exits locally through the AP uplink: Which conclusion is correct?

Medium
At an engineering site, an AP is configured for FlexConnect local switching. Its WLAN maps to client VLAN 40, and the AP uplink is an access port in VLAN 40. The client receives an address from the local VLAN gateway, while the controller carries only CAPWAP control traffic for this WLAN. Which conclusion is correct?
  1. The client data bypasses VLAN 40 and uses the management VLAN.
    The WLAN mapping explicitly places locally switched client traffic in VLAN 40.
  2. Client data exits locally through the AP uplink. ✓
    FlexConnect local switching forwards client traffic from the AP onto its local access VLAN.
  3. The AP uplink must be a trunk carrying every WLAN VLAN.
    A single locally switched access VLAN can support this stated client configuration.
  4. The controller must tunnel all client data through CAPWAP.
    Central switching tunnels data, whereas this WLAN explicitly uses FlexConnect local switching.
The trap
Confuses local switching with centrally switched WLAN behavior. Applies central-switching uplink requirements to local switching. Confuses AP management traffic with client traffic.

FlexConnect local switching places client frames onto the AP’s local mapped VLAN rather than tunneling data centrally.

4. H4 becomes the VLAN 20 root because its priority is lowest: Which statement is correct?

Medium
A hospital administration network uses Rapid PVST+ for VLAN 20. Four switches have these configured priorities and base MAC addresses: H1: priority 32768, MAC 00:11:22:33:44:10; H2: priority 24576, MAC 00:11:22:33:44:20; H3: priority 24576, MAC 00:11:22:33:44:05; H4: priority 4096, MAC 00:11:22:33:44:40. An edge-facing designated port on H4 has root guard enabled. Which statement is correct?
  1. H2 becomes root because its priority and MAC combination beats H4’s bridge ID.
    Any bridge priority of 24576 loses to H4’s priority of 4096 before MAC comparison.
  2. Root guard forces H4’s protected port to become the root port.
    Root guard prevents superior BPDUs on a designated edge, but does not force root-port selection.
  3. H4 becomes the VLAN 20 root because its priority is lowest. ✓
    H4 has the lowest bridge ID because priority 4096 beats every listed priority.
  4. H3 becomes root because its MAC address is lowest among equal-priority switches.
    MAC comparison matters only after priority comparison; H4 has a lower priority.
The trap
Treats a higher priority as numerically preferred. Confuses a protection mechanism with root election. Compares MAC addresses before the configured priority.

H4 wins the election with priority 4096; root guard protects a designated edge port independently.

5. The WLAN meets the stated central-switching requirement: Review the configured WLAN fields and choose the comp

Medium
A library requires Staff-WiFi clients to use VLAN 60 and have their data centrally switched through a Catalyst 9800 controller. Review the configured WLAN fields and choose the compliant conclusion.WLAN ID: 12 SSID: Staff-WiFi Status: Enabled Security: WPA2-Enterprise, AES Interface: Staff-VLAN, VLAN ID 60 Switching: Central AP mode: Local
  1. The WLAN requires WPA2-Personal to support centrally switched clients.
    Central switching is independent of whether authentication uses enterprise or personal security.
  2. The WLAN meets the stated central-switching requirement. ✓
    The WLAN is enabled, mapped to VLAN 60, secured with enterprise authentication, and centrally switched.
  3. The WLAN fails because local AP mode prevents central switching.
    Local AP mode commonly serves clients while the WLAN switching field remains centrally configured.
  4. The WLAN requires FlexConnect local switching before it can use VLAN 60.
    Central switching can map client data to VLAN 60 through the controller interface.
The trap
Confuses AP operating mode with WLAN data-switching mode. Links authentication method to the unrelated data path. Confuses VLAN mapping with local-switching mode.

The enabled WLAN maps to VLAN 60 and explicitly selects central switching with WPA2-Enterprise security.

6. The access port assigns untagged frames to VLAN 40 instead: What is the direct configuration problem?

Hard
In a managed tenant network, an endpoint is connected untagged to GigabitEthernet1/0/8. The endpoint should reach other untagged devices in data VLAN 30. The switch shows VLAN 30 active, the port is up, and spanning tree forwards VLAN 30. However, the interface configuration is `switchport mode access` followed by `switchport access vlan 40`. What is the direct configuration problem?
  1. The endpoint needs a voice VLAN before data VLAN 30 can operate.
    A voice VLAN is optional and unrelated to the stated untagged data requirement.
  2. VLAN 30 must be removed because VLAN 40 is active.
    Both VLANs may exist; the interface simply needs the required access VLAN assignment.
  3. The access port assigns untagged frames to VLAN 40 instead of VLAN 30. ✓
    An access port classifies untagged endpoint traffic into its configured access VLAN, which is 40.
  4. The port must be changed to trunk mode for untagged traffic.
    Access mode is appropriate for an untagged endpoint requiring one data VLAN.
The trap
Mistakes endpoint access design for trunk operation. Treats a port-assignment error as a VLAN existence conflict. Introduces an unnecessary voice dependency.

The port is operational but classifies untagged endpoint frames into access VLAN 40, not required VLAN 30.

7. `switchport trunk allowed vlan add 40`: Which command preserves the existing allowed VLANs while adding VLAN 4

Hard
At a branch office, Gi0/1 is an operational 802.1Q trunk to the distribution switch. The branch must carry existing VLANs 10, 20, and 30 plus newly added VLAN 40. The current allowed list is 10,20,30, and native VLAN 99 is already configured. Which command preserves the existing allowed VLANs while adding VLAN 40?
  1. `switchport trunk allowed vlan add 40` ✓
    The add keyword appends VLAN 40 without replacing the existing allowed VLAN list.
  2. `switchport trunk native vlan 40`
    Changing the native VLAN does not add VLAN 40 to the trunk allowed list.
  3. `switchport access vlan 40`
    This command applies access-port behavior and does not extend an 802.1Q trunk list.
  4. `switchport trunk allowed vlan 40`
    Without add, this command replaces the allowed list and removes VLANs 10, 20, and 30.
The trap
Confuses native VLAN assignment with allowed-list membership. Uses an access VLAN command on a trunk requirement. Overwrites required existing VLAN permissions.

The `add` form extends the trunk’s allowed list while retaining VLANs 10, 20, and 30.

8. SSH establishes an encrypted CLI session: Which forwarding and security outcome should be observed?

Easy
A small data center switch has reachable management IP connectivity. Its VTY lines use `transport input ssh`, local username authentication, and valid RSA host keys. An administrator tests both protocols from a workstation. Which forwarding and security outcome should be observed?
  1. Telnet establishes an encrypted CLI session; SSH is rejected.
    Telnet provides no encryption, and the configured transport explicitly permits SSH.
  2. Neither protocol works because RSA keys disable remote management.
    RSA host keys support SSH and do not prevent a correctly configured SSH session.
  3. SSH establishes an encrypted CLI session; Telnet is rejected. ✓
    SSH provides encrypted remote CLI transport, while the VTY restriction excludes Telnet.
  4. Both protocols establish encrypted CLI sessions through the VTY lines.
    Telnet remains unencrypted and is not accepted by the configured VTY transport policy.
The trap
Reverses both protocol security and configured transport. Assumes VTY authentication encrypts every protocol. Treats SSH key prerequisites as a management prohibition.

The VTY policy permits encrypted SSH and rejects Telnet, which lacks encryption.

9. The two links form an operational LACP trunk bundle: Review the relevant configurations and status.

Medium
In a training lab, two switches connect with two compatible trunk links. Review the relevant configurations and status.SW1(config)# interface range gigabitEthernet1/0/1 - 2 SW1(config-if-range)# channel-group 7 mode active SW1(config-if-range)# exit SW1(config)# interface port-channel 7 SW1(config-if)# switchport mode trunk SW2(config)# interface range gigabitEthernet1/0/1 - 2 SW2(config-if-range)# channel-group 7 mode passive SW2(config-if-range)# exit SW2(config)# interface port-channel 7 SW2(config-if)# switchport mode trunk SW1# show etherchannel summary Group Port-channel Protocol Ports 7 Po7(SU) LACP Gi1/0/1(P) Gi1/0/2(P)
  1. The links remain separate because passive ports cannot join LACP bundles.
    Passive LACP can respond to an active peer and successfully form a bundle.
  2. Only one link forwards because LACP permits no redundant member links.
    Both members are marked bundled, although hashing assigns individual flows to members.
  3. The two links form an operational LACP trunk bundle. ✓
    Active LACP initiates negotiation, passive responds, and both member ports show bundled.
  4. The links form a static EtherChannel because one side uses passive mode.
    The displayed protocol is LACP, and passive is an LACP negotiation mode, not static on.
The trap
Confuses LACP passive with static EtherChannel configuration. Confuses per-flow hashing with single-member operation. Confuses passive negotiation with disabled negotiation.

An active LACP side can negotiate with a passive side, and both members show bundled in the status.

10. LLDP neighbor advertisements from that interface stop: If LLDP transmit is disabled only on Gi1/0/10, which tr

Hard
A temporary project office uses a mixed-vendor switch and Cisco access switch. LLDP is globally enabled on the Cisco switch, and Gi1/0/10 has LLDP transmit and receive enabled. The link is up, VLAN 25 is forwarding, and users have normal application connectivity. If LLDP transmit is disabled only on Gi1/0/10, which traffic or function is directly affected?
  1. The trunk loses VLAN 25 because LLDP controls VLAN membership.
    VLAN membership and trunk forwarding are configured independently of LLDP advertisements.
  2. All IPv4 user traffic on VLAN 25 stops forwarding.
    LLDP is a discovery protocol and does not carry ordinary IPv4 user traffic.
  3. LLDP neighbor advertisements from that interface stop. ✓
    Disabling LLDP transmit stops local discovery advertisements while ordinary data forwarding continues.
  4. The remote switch automatically disables its access port.
    Stopping advertisements does not inherently administratively disable the connected remote interface.
The trap
Assumes discovery loss triggers remote interface shutdown. Confuses discovery control frames with data-plane forwarding. Attributes VLAN configuration to neighbor discovery.

Disabling LLDP transmission removes local neighbor advertisements but does not interrupt established VLAN forwarding.

11. Compare the WLAN profile name and configured SSID fields: Which verification step is most appropriate?

Medium
Operations staff report that a wireless network appears as “Visitor Wi-Fi,” while the controller administrator calls it “Guest WLAN.” Authentication succeeds, and the requirement is to determine whether these names represent different configuration fields before changing anything. Which verification step is most appropriate?
  1. Compare the WLAN profile name and configured SSID fields in the controller. ✓
    The profile name identifies the controller object, while the SSID is the name clients discover.
  2. Compare the access VLAN number with the SSID broadcast name.
    VLAN mapping controls forwarding placement; it does not determine the client-visible wireless network name.
  3. Compare the WLAN security key with the client’s saved profile name.
    A matching key verifies authentication material, not whether administrative and broadcast names differ.
  4. Compare the controller interface address with the WPA authentication method.
    Interface addressing and WPA method provide connectivity and authentication details, not profile-name verification.
The trap
Confuses Layer 2 placement with the wireless network identifier. Confuses authentication credentials with independently configured WLAN naming fields. Combines unrelated addressing and security fields.

Inspect both controller naming fields because an administrative profile name can differ from the broadcast SSID.

12. Only warehouse traffic leaving through the affected site's: Which traffic is directly affected?

Medium
A distribution block uses two WLANs. Employee WLAN traffic is centrally switched through the controller, while the warehouse WLAN is configured for FlexConnect local switching at each access point. The controller remains reachable through CAPWAP, and the controller-to-site path is operational. Only the affected site access switch's path from the AP to its local client VLAN has failed. Which traffic is directly affected?
  1. Only employee traffic because central switching bypasses the site access switch.
    Centrally switched employee traffic remains on the stated operational controller-to-site path; the failed path is the local client VLAN path.
  2. Neither WLAN because CAPWAP control remains operational.
    CAPWAP control availability does not guarantee that every configured data path is forwarding.
  3. Both WLANs because every client frame crosses the controller.
    FlexConnect local switching sends warehouse client data directly through the AP's local wired path.
  4. Only warehouse traffic leaving through the affected site's local VLAN. ✓
    FlexConnect local switching sends warehouse data from the AP into the local VLAN, so that traffic depends on the failed path.
The trap
Confuses control-plane reachability with data-plane forwarding. Assumes all WLANs use centralized data forwarding. Reverses the forwarding dependencies.

The failed local VLAN path affects the FlexConnect WLAN, not the centrally switched WLAN.

328 more Network Access questions

The remaining 328 questions in this domain are part of the full CCNA bank — 1699 questions, every option explained. Start with the free five-minute check and see your score per domain.

Test your CCNA readiness — free

Other CCNA domains

Part of the Certsqill CCNA question bank · Network Access · Every answer, right and wrong, comes with its own explanation.