CCNA Network Access: 96 practice questions

12 of the 96 Network Access questions in the Certsqill CCNA bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for CCNA? Take the free 5-min readiness check →

1. The frame is sent without an 802.1Q tag: When a frame from VLAN 10 is sent across this trunk, how is the frame

1. The frame is sent without an 802.1Q tag ✓

   The native VLAN on an 802.1Q trunk carries traffic without a VLAN tag. Frames belonging to the native VLAN are transmitted untagged; the receiving switch assumes untagged frames belong to its configured native VLAN.
2. The frame is tagged with VLAN ID 10

   The native VLAN is specifically the VLAN whose traffic travels untagged across a trunk — VLAN 10 frames are NOT tagged when VLAN 10 is the native VLAN.
3. The frame is dropped because native VLAN traffic cannot cross trunks

   Native VLAN traffic absolutely crosses trunks — it just travels untagged. Native VLAN traffic is forwarded; it is never dropped for being native.
4. The frame is tagged with VLAN 1 (the default native VLAN)

   The native VLAN was explicitly configured to VLAN 10, overriding the default of VLAN 1. The behavior is determined by the configured native VLAN, not the default.

On an 802.1Q trunk, frames from the native VLAN are transmitted WITHOUT an 802.1Q tag. All other VLANs carry their 4-byte VLAN tag. The receiving switch assigns untagged frames to its configured native VLAN.

2. interface GigabitEthernet0/0.10 → encapsulation dot1Q 10 →: Which configuration snippet correctly sets up the

1. interface GigabitEthernet0/0.10 → vlan 10 → ip address 192.168.10.1 255.255.255.0

   The command 'vlan 10' is not valid on a router subinterface — routers use 'encapsulation dot1Q 10' to specify the VLAN ID for a subinterface. 'vlan 10' is a VLAN database command on switches.
2. interface GigabitEthernet0/0.10 → encapsulation dot1Q 10 → ip address 192.168.10.1 255.255.255.0 ✓

   Router-on-a-stick subinterface configuration requires: (1) creating a subinterface (G0/0.10), (2) specifying 802.1Q encapsulation with the VLAN ID (encapsulation dot1Q 10), and (3) assigning the IP address. The parent interface must also be up (no shutdown).
3. interface GigabitEthernet0/0 → ip address 192.168.10.1 255.255.255.0 → switchport access vlan 10

   'switchport access vlan 10' is a switch port command, not a router command. Routers do not use switchport commands on their LAN interfaces.
4. interface GigabitEthernet0/0.10 → encapsulation dot1Q 10 native → ip address 192.168.10.1 255.255.255.0

   The 'native' keyword after dot1Q specifies this subinterface handles the native (untagged) VLAN. Using 'native' without native VLAN intent would cause the router to accept untagged frames on this subinterface — this keyword should not be used unless VLAN 10 is intentionally the native VLAN.

ROAS subinterface configuration: create subinterface (G0/0.VLAN), specify 802.1Q encapsulation and VLAN ID (encapsulation dot1Q 10), then assign the IP address that serves as the default gateway for hosts in that VLAN.

3. SVIs on the Layer 3 switch with ip routing enabled: Which interVLAN routing method is most efficient for this

1. Router-on-a-stick with an external router on a single trunk, sending all inter-VLAN traffic off-box and back again

   ROAS works but is less efficient than SVIs because every inter-VLAN packet must traverse the trunk to the external router and return, creating a bottleneck.
2. One dedicated physical router interface per VLAN, a legacy approach that consumes a separate port for every VLAN

   Using one physical interface per VLAN is the legacy method; it needs many router ports and does not scale beyond a few VLANs. SVIs and ROAS replaced it.
3. SVIs on the Layer 3 switch with ip routing enabled, so interVLAN forwarding happens in ASIC hardware at line rate ✓

   SVIs on a Layer 3 switch route between VLANs in hardware at line rate, which is more efficient than sending traffic off-box to an external router as router-on-a-stick does.
4. VLAN ACLs applied on the switch, filtering traffic inside each VLAN rather than routing packets between the VLANs

   VACLs filter traffic within a VLAN and do not route between VLANs. Inter-VLAN forwarding requires a Layer 3 decision, not a Layer 2 filter.

SVIs on a Layer 3 switch provide hardware-accelerated interVLAN routing without requiring traffic to leave the switch — the most efficient approach when a Layer 3 switch is already in the design.

4. LLDP: Which protocol should be used?

1. CDP (Cisco Discovery Protocol)

   CDP is Cisco proprietary — it only runs on Cisco devices and cannot communicate with HP or Juniper equipment in a meaningful way for discovery purposes.
2. OSPF

   OSPF is a Layer 3 routing protocol — it does not perform Layer 2 neighbor discovery and does not provide device information such as port descriptions, device capabilities, or connected interface details.
3. STP (Spanning Tree Protocol)

   STP prevents Layer 2 loops by computing a loop-free tree topology — it is not a device discovery protocol and does not provide neighbor information to administrators.
4. LLDP (Link Layer Discovery Protocol — IEEE 802.1AB) ✓

   LLDP is a vendor-neutral IEEE standard (802.1AB) — supported by Cisco, HP, Juniper, and virtually all modern network vendors. It enables device discovery across multi-vendor environments.

LLDP (IEEE 802.1AB) is the vendor-neutral Layer 2 discovery protocol that works across all vendors. CDP is Cisco-proprietary and only works between Cisco devices.

5. Active or Passive: Which mode must Switch B be configured with for the EtherChannel to form successfully?

1. Active or Passive, since an LACP active port forms a valid channel with either an active or a passive peer port ✓

   LACP active mode actively sends LACP PDUs and forms a channel with either an active peer (both initiate) or a passive peer (one initiates, the other responds).
2. Active only, on the assumption that both switch ports must actively originate LACP PDUs to build the EtherChannel

   Active-active does form a channel, but active-passive works too. Restricting the answer to active-only wrongly excludes the valid passive combination.
3. Passive only, on the assumption that the peer must merely respond to PDUs rather than also originate them itself

   Active-passive does form a channel, but active-active works too. Restricting the answer to passive-only wrongly excludes the valid active combination.
4. On (static), configuring an unconditional channel that skips LACP negotiation entirely on the peer switch side

   Static 'on' does no negotiation, so pairing it with LACP active will not form a channel. Both ends must use the same negotiation protocol.

LACP EtherChannel forms when at least one side is active: Active-Active ✓, Active-Passive ✓, Passive-Passive ✗ (neither initiates). Static 'on' mode does not interoperate with LACP negotiation.

6. SW2: Which switch becomes the root bridge?

1. SW4

   SW4 has priority 4096 (lowest alongside SW2) but its MAC address (00:1A:AA:BB:CC:04) is higher than SW2's (00:1A:AA:BB:CC:02). When priority is equal, the lower MAC wins, so SW2 is elected.
2. SW2 ✓

   Root bridge election: lowest Bridge ID wins. Bridge ID = priority + MAC. SW2 and SW4 both have priority 4096 (lowest), so MAC breaks the tie. SW2's MAC (00:1A:AA:BB:CC:02) is lower than SW4's MAC (00:1A:AA:BB:CC:04). SW2 wins.
3. SW1

   SW1 has priority 32768, which is higher (worse) than SW2's and SW4's priority of 4096. A higher numerical priority value means a less preferred root bridge, so SW1 loses to both 4096-priority switches.
4. SW3

   SW3 has priority 32768 and the highest MAC address, so it would be the last choice for root bridge. Both its priority (32768 vs 4096) and its MAC address work against it.

Root bridge election: lowest Bridge ID wins. Bridge ID = priority + MAC. Step 1: Compare priorities — SW2 and SW4 both have 4096 (lowest). Step 2: Tie-break on MAC — SW2's MAC (.CC:02) < SW4's MAC (.CC:04). SW2 becomes root.

7. BPDU Guard: To protect the network from a rogue switch being connected to one of these ports, which feature sh

1. BPDU Filter

   BPDU Filter suppresses BPDUs on a port, preventing them from being sent or received. This is dangerous because it can leave STP unaware of connected switches, potentially creating loops instead of protecting against them.
2. Root Guard

   Root Guard prevents a port from becoming a root port and is used on designated ports toward the access layer to stop a connected switch from becoming root. It is not the protection intended for PortFast access ports.
3. BPDU Guard ✓

   BPDU Guard disables a PortFast-enabled port immediately if a BPDU is received on it. Since workstations don't send BPDUs, any BPDU received indicates a switch was connected, so BPDU Guard prevents rogue switches from influencing STP.
4. Loop Guard

   Loop Guard prevents a port from moving to forwarding if it stops receiving BPDUs, guarding against loops from unidirectional link failures. It is not the mechanism that protects PortFast access ports from rogue switches.

BPDU Guard is the standard companion to PortFast — it immediately disables (err-disables) a PortFast port if any BPDU is received, preventing a rogue switch connection from influencing the STP topology.

8. CAPWAP: Which protocol creates the tunnel between the LWAPs and the WLC to carry control and data traffic?

1. LWAPP (Lightweight Access Point Protocol), Cisco's older standard

   LWAPP was Cisco's proprietary predecessor to CAPWAP and has since been deprecated and replaced by the open CAPWAP standard, so modern LWAP-to-WLC tunnels use CAPWAP, not LWAPP.
2. GRE (Generic Routing Encapsulation), a generic IP tunnel

   GRE is a generic IP tunneling protocol used for site-to-site encapsulation, but it is not the purpose-built protocol for AP-to-WLC control and data tunnels, a role that CAPWAP fills.
3. RADIUS (Remote Authentication Dial-In User Service) protocol

   RADIUS is an AAA protocol that authenticates wireless clients against a policy server; it does not build the management tunnel between the LWAP and the WLC, which CAPWAP handles.
4. CAPWAP (Control and Provisioning of Wireless Access Points) ✓

   CAPWAP is the protocol (UDP 5246 for control, UDP 5247 for data) that creates tunnels between LWAPs and the WLC. It carries configuration and management traffic on the control plane and optionally tunnels client data to the WLC.

CAPWAP (Control and Provisioning of Wireless Access Points) creates the control and data tunnels between lightweight APs and the WLC using UDP ports 5246 (control) and 5247 (data). It replaced the deprecated Cisco-proprietary LWAPP.

9. Access port — both sides passively wait for the other: What will be the resulting port mode?

1. Access port — both sides passively wait for the other to initiate trunking ✓

   Dynamic auto passively waits for the other side to initiate DTP trunk negotiation. When both ends are dynamic auto, neither initiates, so the link stays an access port rather than becoming a trunk.
2. Trunk port — DTP negotiates trunking automatically once both sides agree

   Dynamic auto plus dynamic auto does not form a trunk. Dynamic auto only responds to negotiation started by dynamic desirable or trunk; two passive ends never trigger DTP, so no trunk forms.
3. Err-disabled — the DTP negotiation failure administratively shuts the port

   A DTP negotiation that does not succeed does not err-disable the port; the port simply falls back to access mode, so err-disable is not the outcome here.
4. Trunk port — Cisco switch-to-switch links default to trunking automatically

   Cisco switch-to-switch links do not default to trunking. The common access-layer default is dynamic auto, which stays in access mode unless the neighbor actively initiates trunking.

Dynamic auto + dynamic auto = access port. Both sides wait passively for the other to initiate DTP. Neither initiates, so no trunk forms. To form a trunk, at least one side must be dynamic desirable or trunk mode.

10. Root port: In Rapid PVST+, which port role is assigned to the port that provides the best path toward the root

1. Designated port

   A designated port is the forwarding port on each network segment that offers the best path to root from that segment's view. Each segment has one designated port, on the switch closest to root on that segment.
2. Root port ✓

   The root port is the port on a non-root switch that has the best (lowest cost) path to the root bridge. Each non-root switch has exactly one root port.
3. Alternate port

   An alternate port is an RSTP role that provides a backup path to the root bridge, not the best path. It receives superior BPDUs from another switch and stays discarding, ready to become root port if the current one fails.
4. Backup port

   A backup port is an RSTP role that is a redundant port on the same switch backing up a designated port on the same segment. It transitions to forwarding if that designated port fails.

The root port is the port on each non-root switch that has the best (lowest cost) path to the root bridge — every non-root switch has exactly one root port, and it is in the forwarding state.

11. switchport mode access → switchport access vlan 10 →: Which configuration correctly sets up this switch port?

1. switchport mode trunk → switchport trunk allowed vlan 10,20 → no voice vlan

   A trunk can technically carry both VLANs, but Cisco IP phones rely on the voice VLAN feature on an access port; a trunk with no voice VLAN is the wrong port type for a phone-plus-PC connection.
2. switchport mode access → switchport access vlan 10 → switchport access vlan 20

   Issuing 'switchport access vlan 20' overwrites the earlier access VLAN 10 instead of adding a second VLAN. An access port has only one access VLAN, and voice traffic needs 'switchport voice vlan'.
3. switchport mode access → switchport access vlan 10 → switchport voice vlan 20 ✓

   An access port with a voice VLAN carries the data VLAN untagged for the PC and the voice VLAN tagged by the IP phone at the same time. VLAN 10 serves the PC while VLAN 20 carries the phone's voice traffic.
4. switchport mode access → switchport voice vlan 20 only (no access VLAN needed)

   With only the voice VLAN set, the PC's untagged traffic lands in the default VLAN 1 rather than VLAN 10, so both the access VLAN for the PC and the voice VLAN for the phone must be configured.

For IP phone + PC: configure access port with 'switchport access vlan 10' (PC data) and 'switchport voice vlan 20' (phone voice). The phone tags voice traffic as VLAN 20; PC traffic is untagged as VLAN 10.

12. The ports on one switch are access ports on VLAN 10: Which configuration mismatch is most likely causing the f

1. One switch uses LACP while the other uses PAgP, and these incompatible negotiation protocols cannot agree to form a bundle

   LACP and PAgP are incompatible negotiation protocols and cannot form a bundle together, but in a typical access-layer misconfiguration a VLAN mismatch is the more common and direct cause, making it the best answer here.
2. The member ports run at different speeds, one side at 100 Mbps and the other at 1 Gbps, so the links never bundle

   A speed difference keeps the individual links from coming up at all, so the interfaces would be down rather than merely failing to bundle; that is a separate problem from EtherChannel negotiation with active links.
3. The EtherChannel bundles more than 4 ports, exceeding the maximum number of links a single channel-group supports

   LACP supports up to 16 links (8 active, 8 standby) and PAgP up to 8, so bundling only 4 ports is well within limits and would not by itself prevent the EtherChannel from forming.
4. The ports on one switch are access ports on VLAN 10, while the ports on the other switch are access ports on VLAN 20 ✓

   EtherChannel requires identical settings on all member ports: same access or trunk mode, same allowed VLANs, same speed, and same duplex. Access VLAN 10 on one side and VLAN 20 on the other blocks the bundle from forming.

EtherChannel member ports must have identical configuration: same VLAN (access) or same allowed VLANs (trunk), speed, duplex, and mode. A VLAN mismatch (VLAN 10 vs VLAN 20) prevents the channel from forming.

Other CCNA domains

• Network Fundamentals — 116 questions →
• IP Connectivity — 97 questions →
• Security Fundamentals — 68 questions →
• IP Services — 66 questions →
• Automation and Programmability — 51 questions →
• All 494 CCNA questions →