I85PREP
⌘ K
Aruba ACSP study materials
Aruba ACSP study resources

Aruba ACSP practice questions

One question at a time. Build your Aruba ACSP understanding.

First 50 of 199 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Campus switching architecture and device deployment

What is the main purpose of Aruba Virtual Switching Framework (VSF)?

  1. It provides Layer 3 routing between separate data centers.
  2. It combines multiple physical switches into one logical switching entity. Correct answer.
  3. It encrypts all management traffic between campus switches.
  4. It replaces the need for Spanning Tree on access ports.

Explanation

VSF connects supported switches through VSF links so they operate as a single logical device with one control plane and one management address. It simplifies management and improves resiliency but does not encrypt traffic or replace Spanning Tree.

Question 2Campus switching architecture and device deployment

In a three-tier campus LAN design, which layer typically provides port density and connects endpoint devices such as PCs and access points?

  1. WAN edge layer
  2. Core layer
  3. Access layer Correct answer.
  4. Distribution layer

Explanation

The access layer connects endpoint devices and provides port density, PoE, and VLAN access. The distribution layer aggregates access switches and applies policy, while the core layer provides high-speed transport between major blocks.

Question 3Campus switching architecture and device deployment

Which Aruba CX switch series is typically positioned for access-layer deployment with PoE?

  1. CX 6400
  2. CX 8400
  3. CX 10000
  4. CX 6100 Correct answer.

Explanation

The Aruba CX 6100 series is an entry-level access switch family with PoE models for endpoint connectivity. Higher-end modular platforms such as the CX 6400 and CX 8400 are typically used for aggregation or core roles.

Question 4Campus switching architecture and device deployment

What does Power over Ethernet (PoE) enable on an Aruba campus switch?

  1. It provides redundant power to the switch's management module.
  2. It synchronizes switch configurations across a stack.
  3. It tunnels VLAN traffic over a Layer 3 network.
  4. It delivers electrical power to attached devices over the Ethernet cable. Correct answer.

Explanation

PoE supplies power to devices such as access points, IP phones, and cameras over the same copper Ethernet cable used for data. This removes the need for a separate local power supply at the endpoint.

Question 5Campus switching architecture and device deployment

Which port on an Aruba CX switch is intended for out-of-band management?

  1. The console USB port
  2. The dedicated management Ethernet port Correct answer.
  3. A front-panel access port in VLAN 1
  4. The VSF stacking link

Explanation

A dedicated management Ethernet port provides out-of-band access that is separate from the data plane. It can remain reachable even when the production data network is disrupted.

Question 6Campus switching architecture and device deployment

By default, which VLAN are all switch ports members of on an Aruba CX switch?

  1. VLAN 1 Correct answer.
  2. VLAN 4094
  3. No VLAN until configured
  4. VLAN 100

Explanation

VLAN 1 is the default VLAN, and switch ports begin as untagged members of VLAN 1 unless they are explicitly reassigned. Administrators often change this for security and design reasons, but VLAN 1 remains the initial default.

Question 7Campus switching architecture and device deployment

What is the primary role of a VSF link between stack members?

  1. To provide a redundant power path between switches
  2. To connect the stack to an external out-of-band management network
  3. To carry control and data traffic between stacked switches Correct answer.
  4. To carry only heartbeat messages for conductor election

Explanation

A VSF link is the stacking interconnect that carries both control traffic and user data between members of the logical switch. It is not limited to election heartbeats and does not carry power or out-of-band management connectivity.

Question 8Campus switching architecture and device deployment

In a VSX pair, what is the purpose of the inter-switch link (ISL)?

  1. It synchronizes only user authentication databases.
  2. It provides a dedicated out-of-band CLI path.
  3. It connects the VSX pair to the upstream core.
  4. It carries control and data traffic between the two VSX peers. Correct answer.

Explanation

The ISL is the high-bandwidth link between VSX peers and carries control and data traffic. A separate keepalive link is used for peer liveness, while uplinks connect the VSX pair to the core.

Question 9Campus switching architecture and device deployment

What is the purpose of the VSX keepalive link?

  1. It provides Power over Ethernet to the peer switch.
  2. It load-balances traffic between upstream core switches.
  3. It lets each peer verify that the other peer is alive when the ISL fails. Correct answer.
  4. It carries all user data between the VSX peers.

Explanation

The keepalive link is a lightweight heartbeat path used to determine whether the VSX peer is still reachable, especially when the ISL is down. It does not carry normal user data and is separate from the data-carrying ISL.

Question 10Campus switching architecture and device deployment

What does a multi-chassis LAG (MCLAG) provide in a VSX deployment?

  1. It automatically converts access ports into routed ports.
  2. It bonds the ISL and keepalive into one logical link.
  3. It lets two VSX peers present a single LAG to a downstream device. Correct answer.
  4. It stacks more than two switches into a single control plane.

Explanation

A VSX LAG, also called an MCLAG, allows a downstream device to dual-home to two VSX peers while seeing a single logical LAG. This provides link redundancy without relying on Spanning Tree to block one of the links.

Question 11Campus switching architecture and device deployment

Which service must be reachable for a factory-default Aruba CX switch to complete zero-touch provisioning?

  1. A RADIUS server only
  2. An SNMP trap receiver only
  3. A syslog server only
  4. A DHCP server plus the provisioning service such as Aruba Central Correct answer.

Explanation

ZTP requires DHCP to provide addressing and onboarding information, and then the switch must reach the provisioning platform to obtain its image or configuration. RADIUS, SNMP, or syslog alone do not provide the ZTP workflow.

Question 12Campus switching architecture and device deployment

In Aruba's onboarding flow, what role does Aruba Activate typically play?

  1. It acts as the DHCP server for ZTP.
  2. It stores packet captures for troubleshooting.
  3. It provides the spanning-tree root for the campus.
  4. It redirects or informs devices about their assigned management platform. Correct answer.

Explanation

Aruba Activate is a cloud onboarding service that helps devices discover and connect to their assigned management platform, such as Aruba Central. It does not provide DHCP addressing, Spanning Tree root election, or packet capture storage.

Question 13Campus switching architecture and device deployment

What is the purpose of VSF split detection?

  1. To detect unidirectional fiber links between access switches.
  2. To detect an isolated stack fragment and prevent it from becoming a second active conductor. Correct answer.
  3. To detect power supply failures in stack members.
  4. To detect duplicate IP addresses on access ports.

Explanation

Split detection uses a separate connectivity check to determine whether a VSF fragment is isolated from the rest of the stack. If isolation is confirmed, the fragment is prevented from forming a duplicate active control plane.

Question 14Campus switching architecture and device deployment

In a VSF stack, what must be true of member IDs?

  1. They must match the last octet of the management IP.
  2. They must be unique within the stack. Correct answer.
  3. They must be assigned in descending order.
  4. They must be the same on every member.

Explanation

Each VSF member needs a unique member ID so the conductor can distinguish and manage it within the logical switch. Duplicate member IDs cause conflicts and prevent correct stack operation.

Question 15Campus switching architecture and device deployment

What does loop protection do on an Aruba switch?

  1. It automatically creates a LAG when a loop is found.
  2. It encrypts BPDUs between switches.
  3. It sends probe packets to detect Layer 2 loops and can disable the receiving port. Correct answer.
  4. It replaces RPVST+ with a static VLAN topology.

Explanation

Loop protection sends probe packets and detects if they return on a port, which indicates a Layer 2 loop. When a loop is detected, the switch can disable the affected port to protect the network.

Question 16Campus switching architecture and device deployment

What is a key characteristic of RPVST+ compared with a single Spanning Tree instance?

  1. It runs one spanning-tree instance for all VLANs.
  2. It runs a separate spanning-tree instance per VLAN. Correct answer.
  3. It only works on routed ports.
  4. It eliminates the need for a root bridge.

Explanation

RPVST+ creates a separate spanning-tree instance for each VLAN, allowing different forwarding topologies and better load sharing. A single STP instance uses one common topology for all VLANs.

Question 17Campus switching architecture and device deployment

In VSX, the ISL fails but the keepalive link remains up and the peer is reachable. What does the secondary peer typically do to prevent a split-brain condition?

  1. It converts the keepalive link into a new ISL automatically.
  2. It reboots both peers to force a new election.
  3. It promotes itself to primary and keeps all interfaces forwarding.
  4. It disables its VSX interfaces so only one peer forwards traffic. Correct answer.

Explanation

When the ISL is down but the keepalive link confirms the peer is still alive, the secondary VSX peer disables its VSX interfaces. This prevents both peers from actively forwarding for the same networks and creating a split-brain condition.

Question 18Campus switching architecture and device deployment

Two VSF members have the same conductor priority. What determines which member becomes conductor?

  1. The member with the most uplink ports.
  2. The member with the higher member ID.
  3. The member with the lower MAC address. Correct answer.
  4. The member that booted last.

Explanation

VSF conductor election first compares configured priority, and if priorities are equal, the lower MAC address wins the tie. Member ID, uplink count, and boot order are not the defined tiebreakers.

Question 19Campus switching architecture and device deployment

Which VSX feature allows both peers to forward traffic for the same VLAN and use a common virtual MAC for the default gateway?

  1. Zero-touch provisioning
  2. Active-gateway with active-forwarding Correct answer.
  3. Loop protection
  4. VSF split detection

Explanation

Active-gateway provides a shared virtual MAC address for the default gateway on both VSX peers. Active-forwarding allows both peers to forward traffic for that VLAN, avoiding suboptimal routing through a single peer.

Question 20Campus switching architecture and device deployment

When configuring a VSX LAG between two VSX peers and a downstream dual-homed switch, which item must be consistent on both peers?

  1. The ISL must be a single 1 Gb port.
  2. The LAG ID and member port configuration must match on both peers. Correct answer.
  3. The downstream switch must run VSF.
  4. The keepalive link's IP address must be identical on both peers.

Explanation

Both VSX peers must agree on the LAG identity and the physical member links that form the multi-chassis LAG. This consistency lets the downstream device treat the two peer connections as one logical LAG.

Question 21VLANs, trunking, and Layer 2 forwarding

On an Aruba switch, which VLAN carries untagged traffic on an 802.1Q trunk port by default?

  1. VLAN 1 Correct answer.
  2. The lowest VLAN ID that is configured on the port
  3. VLAN 100
  4. No VLAN, because every frame on a trunk is tagged

Explanation

Every 802.1Q trunk has a native VLAN, and Aruba switches default it to VLAN 1. Untagged frames received on the trunk are assigned to the native VLAN, and frames sent in that VLAN leave the port without a tag.

Question 22VLANs, trunking, and Layer 2 forwarding

A frame in VLAN 20 leaves an Aruba access port. How is it transmitted?

  1. Untagged, with no 802.1Q header Correct answer.
  2. Tagged with VLAN 20 and 802.1Q priority bits
  3. Tagged with VLAN 1 and the port PVID
  4. Double-tagged with VLAN 20 and VLAN 1

Explanation

An access port belongs to exactly one VLAN and hides tagging from the attached device. Frames in that VLAN are sent without an 802.1Q header, because the end device is not expected to interpret tags.

Question 23VLANs, trunking, and Layer 2 forwarding

Which value in the Ethernet Type/Length field identifies a frame as carrying an 802.1Q tag?

  1. 0x8100 Correct answer.
  2. 0x86DD
  3. 0x8847
  4. 0x0800

Explanation

An 802.1Q tag inserts a 4-byte header whose TPID value is 0x8100. The other listed values identify IPv4, MPLS unicast, and IPv6 payloads respectively.

Question 24VLANs, trunking, and Layer 2 forwarding

A switch has 12 access ports split evenly between VLAN 10 and VLAN 20. How many broadcast domains exist?

  1. Twenty-four, one per VLAN per port
  2. Six, one per group of six ports
  3. Two, one per VLAN Correct answer.
  4. One, because all ports belong to the same switch

Explanation

A VLAN is a Layer 2 broadcast domain, so broadcasts are flooded only to ports in the same VLAN. Because the ports are divided between two VLANs, exactly two broadcast domains exist regardless of how many ports each contains.

Question 25VLANs, trunking, and Layer 2 forwarding

Which statement describes VLAN 1 on an ArubaOS-CX switch?

  1. It exists only after a trunk port is configured
  2. It is created on demand and can be removed
  3. It is created by default and cannot be deleted Correct answer.
  4. It is reserved for management and carries no user traffic

Explanation

VLAN 1 is the default VLAN on the switch, created automatically with ports as untagged members. It forwards traffic like any other VLAN and cannot be removed from the VLAN database.

Question 26VLANs, trunking, and Layer 2 forwarding

Which address does a switch examine to populate its MAC address table?

  1. The source IP of the frame
  2. The source MAC of the frame Correct answer.
  3. The BPDU carried on the ingress port
  4. The destination MAC of the frame

Explanation

The switch learns the source MAC of each received frame and associates it with the ingress port and VLAN. The destination MAC is used for the forwarding lookup, not for learning.

Question 27VLANs, trunking, and Layer 2 forwarding

A switch receives a unicast frame whose destination MAC address is not in its MAC table. What does it do?

  1. Drops it and logs an event
  2. Sends it back out the ingress port only, since the destination is unknown
  3. Floods it out every port on the switch, regardless of VLAN membership
  4. Floods it out all ports in the same VLAN except the ingress port Correct answer.

Explanation

Frames with an unknown destination MAC are flooded within the VLAN, along with broadcasts and unknown multicasts. Flooding never crosses a VLAN boundary, so hosts in other VLANs never receive the frame.

Question 28VLANs, trunking, and Layer 2 forwarding

A trunk port allows only VLANs 10 and 20. A tagged frame for VLAN 30 arrives on that port. What happens?

  1. It is flooded out all other trunk ports
  2. It is rewritten into VLAN 1 and forwarded
  3. It is forwarded after the port is added to VLAN 30
  4. It is discarded Correct answer.

Explanation

The allowed VLAN list on a trunk acts as a filter. Tagged frames for VLANs outside that list are dropped at ingress, and no traffic for those VLANs is transmitted out the port.

Question 29VLANs, trunking, and Layer 2 forwarding

On an ArubaOS-CX trunk port, what does the PVID control?

  1. The VLAN used for BPDUs sent out of that port
  2. The VLAN assigned to tagged frames received on that port
  3. The VLAN for untagged frames received on the port Correct answer.
  4. The highest VLAN ID permitted on that port

Explanation

The PVID sets the VLAN membership of untagged ingress traffic on a trunk or hybrid port. Tagged frames are mapped to their VLAN by the tag itself, not by the PVID.

Question 30VLANs, trunking, and Layer 2 forwarding

An IP phone that tags its own voice frames is attached to a port, and a PC behind the phone sends untagged data traffic. Which configuration satisfies this?

  1. Put both VLANs untagged on the port and let the phone select one
  2. Put the port in access mode in the voice VLAN and leave the PC untagged in that same VLAN
  3. Set the port to carry the voice VLAN tagged and the data VLAN as the untagged native Correct answer.
  4. Disable LLDP-MED and make the voice VLAN the native VLAN of the port

Explanation

A port serving a tagging phone and an untagged PC carries the data VLAN as its native VLAN and the voice VLAN as a tagged member. LLDP-MED can additionally advertise the voice VLAN to the phone so it tags automatically.

Question 31VLANs, trunking, and Layer 2 forwarding

Hosts in VLAN 10 and VLAN 20 must communicate through one Aruba switch. What is required?

  1. The hosts must use a trunk link between them
  2. A single port must be an untagged member of both VLANs
  3. L3 interfaces on both VLANs plus global IP routing Correct answer.
  4. Both VLANs must share the same native VLAN on the uplink

Explanation

Because each VLAN is a separate broadcast domain, inter-VLAN traffic must be routed. A switch performs this with an L3 interface (SVI) per VLAN and IP routing enabled globally.

Question 32VLANs, trunking, and Layer 2 forwarding

Which protocol lets switches exchange VLAN membership information automatically over a trunk?

  1. LLDP
  2. LACP
  3. STP
  4. MVRP Correct answer.

Explanation

MVRP registers and advertises VLAN membership dynamically across trunks, and older AOS-S switches use GVRP for the same purpose. LLDP handles neighbor discovery, LACP handles link aggregation, and STP handles loop prevention.

Question 33VLANs, trunking, and Layer 2 forwarding

In MSTP, several VLANs are mapped to the same instance. What do those VLANs share?

  1. Independent forwarding states on each port
  2. Per-VLAN BPDU counters on every port
  3. Separate root bridge election per VLAN
  4. A single topology and the same blocked ports Correct answer.

Explanation

MSTP maps a group of VLANs to an instance, and all VLANs in that instance use one spanning tree topology with identical blocking decisions. A separate tree per VLAN is the behaviour of PVST+, not MSTP.

Question 34VLANs, trunking, and Layer 2 forwarding

A dynamically learned MAC entry reaches its aging time on an Aruba switch. What is the effect?

  1. Traffic to that MAC is flooded in the VLAN until relearned Correct answer.
  2. The entry is converted into a static entry
  3. The port is disabled until the MAC address is relearned again
  4. The frame is dropped until the host sends a gratuitous ARP

Explanation

An aged-out dynamic entry is removed from the forwarding table. Until the host transmits again and the entry is relearned, frames destined to it are treated as unknown unicast and flooded within the VLAN.

Question 35VLANs, trunking, and Layer 2 forwarding

What is the purpose of configuring a MAC address limit on an access port?

  1. To limit how many source MACs can be learned on the port Correct answer.
  2. To reserve a fixed amount of bandwidth for each MAC seen on the port
  3. To assign the port to a VLAN based on the source MAC address
  4. To age out MAC entries faster on that port

Explanation

A MAC limit caps the number of source MAC addresses the port may learn, which bounds how many devices can share a single edge port. When the limit is exceeded, the configured violation action is applied.

Question 36VLANs, trunking, and Layer 2 forwarding

Which feature limits the rate of broadcast traffic entering an interface?

  1. Loop protection
  2. QoS trust DSCP
  3. IGMP snooping
  4. Storm control Correct answer.

Explanation

Storm control meters broadcast, multicast, or unknown unicast traffic on an interface and drops or disables the port when the configured rate is exceeded. IGMP snooping and loop protection address different problems.

Question 37VLANs, trunking, and Layer 2 forwarding

Two switches are joined by a trunk, but one side uses native VLAN 1 and the other uses native VLAN 99. What is the result for untagged frames?

  1. Untagged frames are placed in different VLANs on each side Correct answer.
  2. The higher VLAN ID becomes the native VLAN on both sides
  3. The trunk fails to come up until the native VLANs match
  4. Tagged frames are dropped but untagged frames pass normally

Explanation

A switch classifies untagged trunk frames using its own PVID. If the two ends disagree, each side places that traffic in a different VLAN, so the frames are not delivered to the intended hosts.

Question 38VLANs, trunking, and Layer 2 forwarding

Two switches are connected by two parallel trunk links and no loop-prevention protocol is enabled. What is the consequence?

  1. A broadcast storm forms as both links forward broadcasts Correct answer.
  2. One link is placed in the blocking state by the switch firmware
  3. Both links forward and duplicate every unicast frame on the link
  4. The trunks automatically form an EtherChannel bundle

Explanation

With no spanning tree or other loop-prevention mechanism, both parallel trunks forward broadcasts and each copy is duplicated again on every pass. The resulting broadcast storm saturates the links and consumes switch CPU.

Question 39VLANs, trunking, and Layer 2 forwarding

In a QinQ deployment, which value is typically used as the TPID of the outer service-provider tag?

  1. 0x8847
  2. 0x0800
  3. 0x88A8 Correct answer.
  4. 0x8100

Explanation

QinQ stacks a service-provider tag outside the customer tag, and the outer tag normally uses TPID 0x88A8. The inner customer tag keeps the standard 802.1Q value of 0x8100.

Question 40VLANs, trunking, and Layer 2 forwarding

A switch repeatedly sees the same source MAC address arriving on two different ports. What does it normally do?

  1. It keeps two entries and load-balances between them
  2. It relearns the MAC on the most recent port and updates the table Correct answer.
  3. It blocks both ports until an administrator clears the duplicate
  4. It drops all frames sourced from that MAC address

Explanation

The switch always updates a source MAC entry with the most recent port and VLAN it observes. Rapid repeated moves cause table churn and usually indicate a loop or a duplicated MAC, which port-security features can flag.

Question 41VLANs, trunking, and Layer 2 forwarding

In a private VLAN, which devices can an isolated port communicate with?

  1. Only the promiscuous port or ports of the primary VLAN Correct answer.
  2. Any port on the same switch, including other VLANs
  3. Only other isolated ports in the same secondary VLAN
  4. All ports in the same primary VLAN

Explanation

Isolated ports can reach only promiscuous ports, so hosts within the isolated VLAN cannot talk to each other. Community ports, by contrast, can also reach other members of the same community VLAN.

Question 42VLANs, trunking, and Layer 2 forwarding

Two switches have identical MSTP region names and revisions but different VLAN-to-instance mappings. What is the result?

  1. They form separate MSTP regions Correct answer.
  2. They form one region and the higher-priority mapping wins
  3. MSTP falls back to a single STP instance
  4. They form one region with a merged mapping

Explanation

An MSTP region is defined by an identical region name, revision, and VLAN-to-instance mapping. If any of the three differs, the switches belong to different regions and each region runs its own internal topology.

Question 43VLANs, trunking, and Layer 2 forwarding

Two Aruba switches must form a LAG across two links, and one side is configured as LACP active. What is acceptable on the other side?

  1. LACP passive or active Correct answer.
  2. A different LACP key with the same ports
  3. No aggregation configuration at all
  4. Static LAG mode with LACP disabled

Explanation

LACP needs at least one side to initiate negotiation, and a peer that is active or passive will both complete the bundle. Static mode does not run LACP and therefore does not interoperate with an LACP-configured side.

Question 44VLANs, trunking, and Layer 2 forwarding

An SVI for VLAN 30 has an IP address assigned, and no ports in VLAN 30 are up. What is the state of the SVI?

  1. It stays up and silently discards traffic
  2. It stays up and routes to a null interface
  3. It goes down because no member port is up Correct answer.
  4. It is deleted automatically by the switch

Explanation

A VLAN interface is up only when at least one port in that VLAN is up, unless the interface is explicitly configured to remain up. With no active member ports, the SVI transitions to down.

Question 45VLANs, trunking, and Layer 2 forwarding

With IGMP snooping disabled, how does a switch handle a multicast frame whose group address it has not learned?

  1. It forwards it only to the multicast router port
  2. It forwards it out the native VLAN ports only
  3. It drops it at ingress because the group address is unknown
  4. It floods it to every port in the VLAN except the ingress Correct answer.

Explanation

Without IGMP snooping the switch has no group membership information, so multicast is treated as unknown traffic and flooded within the VLAN. IGMP snooping builds a group-to-port table that constrains this forwarding.

Question 46VLANs, trunking, and Layer 2 forwarding

A switch port is configured as an access port in VLAN 50. How does the switch handle Ethernet frames on that port?

  1. Untagged inbound and tagged outbound with VLAN 50.
  2. Tagged inbound with VLAN 50 and untagged outbound.
  3. Untagged in both directions and a member of VLAN 50 only. Correct answer.
  4. Tagged in both directions with VLAN 50 on the wire.

Explanation

An access port carries traffic for exactly one VLAN and does not put an 802.1Q tag on the wire. The switch applies the VLAN internally when making forwarding decisions and strips the tag before a frame leaves the port, so attached hosts exchange ordinary untagged Ethernet frames.

Question 47VLANs, trunking, and Layer 2 forwarding

How many VLANs can be identified by the VLAN ID field defined in IEEE 802.1Q?

  1. 4096
  2. 8192
  3. 4094 Correct answer.
  4. 1024

Explanation

The 802.1Q VLAN ID field is 12 bits wide, which yields 4096 distinct values. Two of those values are unavailable for normal VLAN identification: 0 is used for priority tagging and 4095 is reserved, leaving 4094 usable VLAN IDs.

Question 48VLANs, trunking, and Layer 2 forwarding

Two switches are connected by a LAG of two 10 Gb/s member links. A single large TCP flow between two hosts crosses that LAG. How is the flow carried?

  1. Packets are rotated across both members one after another.
  2. The flow is hashed to one member and stays on it. Correct answer.
  3. The flow fills the first member, then spills onto the second.
  4. The flow is copied onto both members for redundancy.

Explanation

A LAG distributes traffic by hashing on header fields such as source and destination MAC addresses, IP addresses, and Layer 4 ports to pick a member link. Because that hash is stable for a given conversation, one flow uses a single member and can never exceed that member's bandwidth, while many flows spread across the bundle.

Question 49VLANs, trunking, and Layer 2 forwarding

A frame with source MAC 00:11:22:33:44:55 arrives on port 1 in VLAN 10. Shortly afterward the same source MAC arrives on port 5 in VLAN 20 of the same switch. What does the switch record?

  1. A single entry for the MAC lists two ports, one per VLAN.
  2. Two entries for the same MAC, one per VLAN, mapped to each port. Correct answer.
  3. A single entry moves to port 5, because a MAC can belong to one port.
  4. No entry is created in VLAN 20 until the VLAN 10 entry ages out.

Explanation

The Layer 2 forwarding table is keyed on VLAN plus MAC address, so the same MAC address seen in two different VLANs produces two independent entries. Each entry learns its own port and ages on its own timer, and no MAC-move violation is raised because the VLANs are separate broadcast domains.

Question 50VLANs, trunking, and Layer 2 forwarding

Three switches form a triangle: A connected to B, B connected to C, and C connected to A, with all links at 1 Gb/s. RSTP runs with default settings, switch A has the lowest bridge ID and switch C the highest. Which port ends up in the alternate (discarding) role?

  1. The port on switch B that connects to switch C.
  2. The port on switch A that connects to switch C.
  3. The port on switch B that connects to switch A.
  4. The port on switch C that connects to switch B. Correct answer.

Explanation

Switch A is the root bridge, so B and C each choose their direct link to A as root port. On the B-to-C link both switches advertise a root path cost of one link, and the tie is broken by bridge ID: B's superior BPDU makes its port designated and forwarding, leaving C's port toward B as an alternate port that discards.