I85PREP
⌘ K
CCNA Automation study materials
CCNA Automation study resources

CCNA Automation practice questions

One question at a time. Build your CCNA Automation understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Network Fundamentals

In a controller-based network architecture, what is the primary function of the management plane?

  1. It rewrites Layer 2 headers as frames traverse the switch fabric.
  2. It forwards user traffic between interfaces based on the FIB.
  3. It configures, monitors, and provisions network devices through protocols such as NETCONF and RESTCONF. Correct answer.
  4. It encrypts all payload data end to end using IPsec.

Explanation

The management plane carries administrative traffic used to configure and monitor devices, and in modern networks it is exposed through programmable interfaces such as NETCONF, RESTCONF, and SNMP. Forwarding decisions and header rewrites belong to the data plane, while control-plane protocols build the topology and reachability information that the data plane consumes.

Question 2Network Fundamentals

A network engineer wants a single logical interface on a switch to carry traffic for VLAN 10 and VLAN 20 while routing between them. Which configuration approach accomplishes this?

  1. Convert the interface to a routed port with two IP addresses in different subnets.
  2. Assign the physical interface to VLAN 10 and create an SVI for VLAN 20 only.
  3. Create a port channel and place both VLANs in the native VLAN.
  4. Configure the link as an 802.1Q trunk and create switched virtual interfaces for both VLANs. Correct answer.

Explanation

A trunk carries multiple VLANs over one link by tagging frames with 802.1Q, and an SVI per VLAN supplies the Layer 3 gateway used to route between them. A single access port belongs to one VLAN, and a routed port supports addresses only in a way that does not provide per-VLAN tagging and separate broadcast domains.

Question 3Network Fundamentals

Which statement describes how a switch builds its MAC address table?

  1. It queries a DHCP server for a mapping of MAC addresses to switch ports.
  2. It learns destination MAC addresses only after the destination host sends an ARP request.
  3. It records the source MAC address and ingress port of received frames and ages entries out over time. Correct answer.
  4. It floods every frame to all ports so that hosts can reply with their addresses.

Explanation

Source-address learning is the core mechanism: the switch associates the frame's source MAC with the port it arrived on and timestamps the entry so idle entries can age out. Unknown unicast destinations are flooded, but flooding is not how the table is populated, and no DHCP or ARP interaction is required for learning.

Question 4Network Fundamentals

A host with address 192.168.10.50/26 needs to reach 192.168.10.120. What does the host conclude about the destination?

  1. The destination is on the local subnet, so the host ARPs for it directly. Correct answer.
  2. The destination is a broadcast address, so the host sends to all hosts.
  3. The destination is remote, so the host forwards the packet to its default gateway.
  4. The destination is in a different subnet, so the host drops the packet.

Explanation

A /26 mask yields subnets in blocks of 64, so 192.168.10.0/26 spans .0 through .63 and both .50 and .120 fall inside it. Because the destination is local, the host resolves the destination MAC with ARP instead of sending the frame to a router.

Question 5Network Fundamentals

Which IPv6 address type is used by a host to send a packet to every node on its local link only?

  1. Solicited-node multicast
  2. Link-local unicast
  3. Link-local multicast Correct answer.
  4. Global unicast

Explanation

IPv6 multicast addresses in ff02::/16 are link-local in scope, and ff02::1 is the all-nodes group that reaches every node on the link without crossing routers. Link-local unicast addresses identify a single interface, and solicited-node multicast targets only the nodes that share a particular address suffix.

Question 6Network Fundamentals

A router receives a packet destined for 10.20.30.40. Its routing table contains 10.0.0.0/8, 10.20.0.0/16, and 10.20.30.0/24, all reachable via different next hops. Which entry is used?

  1. 10.20.0.0/16
  2. The default route, because multiple prefixes match
  3. 10.20.30.0/24 Correct answer.
  4. 10.0.0.0/8

Explanation

Routers apply longest-prefix match, so the most specific prefix that still contains the destination wins. The /24 is more specific than the /16 and /8 and therefore is selected regardless of the next hops of the other routes.

Question 7Network Fundamentals

Which statement accurately contrasts TCP and UDP behavior?

  1. TCP is connectionless and relies on the application for retransmission, while UDP guarantees ordered delivery.
  2. TCP uses a two-way handshake, while UDP uses a three-way handshake.
  3. TCP and UDP both guarantee delivery, but UDP adds sequencing headers.
  4. TCP provides connection-oriented delivery with acknowledgments, while UDP is connectionless with no delivery guarantee. Correct answer.

Explanation

TCP establishes a session, acknowledges segments, and retransmits lost data, whereas UDP sends datagrams with no handshake, acknowledgment, or retransmission. Applications that need reliability over UDP must implement it themselves, which is why UDP is favored for low-latency traffic.

Question 8Network Fundamentals

What is the purpose of the DHCP DISCOVER message in the address assignment process?

  1. The server offers a lease to the client.
  2. The client broadcasts to locate available DHCP servers. Correct answer.
  3. The client formally accepts the offered lease.
  4. The server confirms that the client may use the address.

Explanation

DHCP follows the DORA sequence: the client broadcasts DISCOVER, servers respond with OFFER, the client sends REQUEST to accept one offer, and the chosen server sends ACK. DISCOVER is therefore the client's initial broadcast search for servers.

Question 9Network Fundamentals

A switch port is configured with the PortFast feature. What behavior does this enable?

  1. The port becomes an STP root port regardless of path cost.
  2. The port automatically forms an EtherChannel with the neighbor.
  3. The port blocks all BPDUs to prevent loops.
  4. The port skips the listening and learning STP states and moves directly to forwarding. Correct answer.

Explanation

PortFast allows an edge port to transition immediately to the forwarding state so that end devices can use the link without waiting through STP convergence. It is intended for host-facing ports and should be paired with BPDU Guard, because a PortFast port that receives BPDUs may indicate a miswiring.

Question 10Network Fundamentals

Which characteristic distinguishes a Layer 3 switch from a traditional Layer 2 switch?

  1. It operates only with fiber optic media.
  2. It can route packets between VLANs using SVIs and a routing table. Correct answer.
  3. It forwards frames using only the CAM table.
  4. It requires a separate external router for all inter-VLAN traffic.

Explanation

A multilayer switch performs routing in hardware, using switched virtual interfaces as gateways and a routing table to move packets between subnets. A Layer 2 switch forwards only on MAC addresses and needs an external router to move traffic between VLANs.

Question 11Network Fundamentals

A network uses OSPF and the administrator wants to summarize routes from several OSPF areas into the backbone. Where must this summarization be configured?

  1. On the area border router Correct answer.
  2. On the autonomous system boundary router only
  3. On the designated router of each broadcast segment
  4. On every router inside the area being summarized

Explanation

Inter-area summarization is performed by the area border router, which sits between an area and the backbone and can advertise a single aggregate into area 0. Internal routers do not generate type 3 summaries, and an ASBR summarizes external routes rather than inter-area routes.

Question 12Network Fundamentals

Which two endpoints would a network automation script use to retrieve structured interface statistics from a device using RESTCONF?

  1. A Telnet session with screen scraping
  2. An HTTPS URL with a YANG-modeled resource path Correct answer.
  3. An SNMP trap receiver
  4. An SSH session running show commands

Explanation

RESTCONF exposes YANG-modeled data over HTTPS using standard HTTP methods and resource-oriented URLs. SSH, Telnet, and SNMP are separate management transports and do not provide RESTCONF's structured, model-driven access.

Question 13Network Fundamentals

An engineer wants to verify that a switch's interface Gi0/1 is administratively enabled and has no errors. Which command output field confirms the administrative state?

  1. The duplex setting
  2. The MTU value
  3. The interface status field showing 'up' Correct answer.
  4. The line protocol state shown in the interface status

Explanation

In interface status output, the first status field reflects the administrative and physical state of the interface, while the second reflects the line protocol. A disabled interface commonly shows 'administratively down' in that first field.

Question 14Network Fundamentals

What is the role of the native VLAN on an 802.1Q trunk?

  1. It blocks all traffic when the trunk is misconfigured.
  2. It carries untagged frames across the trunk. Correct answer.
  3. It carries only voice traffic.
  4. It is always VLAN 1 and cannot be changed.

Explanation

802.1Q inserts a tag into tagged frames, but frames on the native VLAN traverse the trunk without a tag. Both ends of the trunk must agree on the native VLAN, and best practice is to change it from the default to a dedicated unused VLAN.

Question 15Network Fundamentals

Which statement best describes the function of the control plane in a traditional router?

  1. It encrypts routing protocol updates with IPsec.
  2. It forwards each packet using the FIB in hardware.
  3. It manages device configuration through NETCONF only.
  4. It builds the routing table by running protocols such as OSPF and BGP. Correct answer.

Explanation

The control plane runs routing protocols and builds the routing information base, which is then programmed into the forwarding table used by the data plane. Configuration management belongs to the management plane, and encryption of updates is an optional security feature rather than the control plane's defining role.

Question 16Network Fundamentals

A host on VLAN 5 cannot reach a host on VLAN 6 in the same building. Both VLANs are configured on the same multilayer switch, and each has an SVI. What is the most likely cause?

  1. The MAC address table has aged out entries.
  2. The hosts are using IPv4 rather than IPv6.
  3. The trunk between switches is using 802.1Q.
  4. IP routing is not enabled on the multilayer switch. Correct answer.

Explanation

SVIs provide gateways, but the switch forwards between them only when global IP routing is enabled. Without routing enabled, the switch treats traffic destined for another VLAN as non-local and does not forward it, even though both SVIs are up.

Question 17Network Fundamentals

Which protocol uses a three-way handshake before any application data is exchanged?

  1. ICMP
  2. TCP Correct answer.
  3. UDP
  4. ARP

Explanation

TCP establishes a connection with a SYN, SYN-ACK, ACK exchange before data transfer begins, which synchronizes sequence numbers and confirms reachability. UDP, ICMP, and ARP have no connection-establishment handshake.

Question 18Network Fundamentals

A network engineer is planning an IPv4 addressing scheme and needs 500 usable host addresses per subnet. Which prefix length is the minimum that satisfies this requirement?

  1. /23 Correct answer.
  2. /25
  3. /24
  4. /22

Explanation

A /23 leaves 9 host bits, giving 512 addresses and 510 usable hosts after removing the network and broadcast addresses. A /24 provides only 254 usable hosts, which is insufficient, while a /22 would work but is not the minimum prefix that meets the requirement.

Question 19Network Fundamentals

Which feature of a wireless LAN controller architecture centralizes policy and management for many access points?

  1. Split MAC, where the controller handles management and the AP handles real-time framing Correct answer.
  2. Static WEP key distribution
  3. Ad hoc mode between client stations
  4. Autonomous AP operation with per-AP configuration

Explanation

In a controller-based design the access point and controller share MAC functions: the controller manages authentication, roaming, and policy while the AP handles time-sensitive framing and retransmission. Autonomous APs are managed individually, which is the opposite of centralized control.

Question 20Network Fundamentals

Which address does a host use as the destination MAC when sending a frame to a host on a different subnet?

  1. The broadcast MAC address ff:ff:ff:ff:ff:ff
  2. The destination host's MAC address
  3. The default gateway's MAC address Correct answer.
  4. The switch's management MAC address

Explanation

When the destination IP is off-subnet, the host resolves the gateway's IP to a MAC address with ARP and uses that as the frame's destination. The gateway then forwards the packet toward the remote host, so the original frame never carries the remote host's MAC.

Question 21Network Fundamentals

In a two-tier campus design, what is the primary role of the distribution layer?

  1. It hosts all endpoint devices directly.
  2. It aggregates access switches and enforces routing and policy between them. Correct answer.
  3. It provides high-density access ports to end devices.
  4. It connects the campus to the internet service provider only.

Explanation

The distribution layer aggregates access-layer switches, applies policy, and typically performs inter-VLAN routing and summarization. Access switches provide end-device ports, while WAN or internet connectivity is usually handled by a separate edge or core function.

Question 22Network Fundamentals

Which statement about IPv4 private address ranges is correct?

  1. 127.0.0.0/8 is a private range used for internal addressing.
  2. 169.254.0.0/16 is a private range assigned by DHCP servers.
  3. 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 are reserved for private use and are not routed on the public internet. Correct answer.
  4. 224.0.0.0/4 is a private range for multicast applications.

Explanation

RFC 1918 defines the three private blocks 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16, which require NAT for internet access. The other ranges listed serve link-local autoconfiguration, loopback, and multicast purposes.

Question 23Network Fundamentals

An engineer needs to verify the path a packet takes across several routers. Which tool and mechanism is designed for this?

  1. ARP, using broadcast requests
  2. DHCP, using lease renewal
  3. Ping, using ICMP echo requests
  4. Traceroute, using incrementing TTL values Correct answer.

Explanation

Traceroute sends probes with increasing TTL values so each router along the path returns an ICMP time-exceeded message that reveals its address. Ping only tests reachability to a destination, and ARP and DHCP serve address resolution and configuration rather than path discovery.

Question 24Network Fundamentals

Why is a loopback interface commonly used as the router ID source and management address on a router?

  1. It provides the highest bandwidth of any interface.
  2. It forwards traffic faster than physical interfaces.
  3. It is a logical interface that stays up as long as the router is operational. Correct answer.
  4. It is automatically assigned a public IP address.

Explanation

A loopback is a virtual interface that does not depend on a physical link, so it remains reachable as long as the router is running and at least one path exists. This stability is why it is preferred for router IDs and management access.

Question 25Network Fundamentals

A network administrator observes that a switch port connecting to a workstation is flapping between up and down. Which action best isolates the cause?

  1. Check the cable, connector, and interface error counters on the port. Correct answer.
  2. Change the STP priority of the switch.
  3. Convert the port to a trunk.
  4. Disable the workstation's DHCP client.

Explanation

Physical layer faults such as a damaged cable, bad connector, or duplex mismatch commonly cause a link to flap, and interface error counters help confirm this. Changing STP priority, trunking, or DHCP settings does not address a physical link instability.

Question 26Network Fundamentals

A network automation script must retrieve structured interface counters from a Cisco IOS XE device using a standards-based data model over an encrypted session. Which combination of transport and encoding should the script use?

  1. NETCONF over SSH with XML-encoded YANG data Correct answer.
  2. RESTCONF over HTTP with YAML-encoded YANG data
  3. SSH with CLI screen-scraping of show command output
  4. SNMPv2c over UDP with BER-encoded MIB objects

Explanation

NETCONF runs over a secure SSH transport and encodes configuration and state data in XML that follows YANG models, giving a script predictable, structured output. SNMP is structured but uses MIB OIDs and is not model-driven in the YANG sense, while RESTCONF requires HTTPS for encryption. CLI screen-scraping returns unstructured text that is brittle when output formats change.

Question 27Network Fundamentals

Which statement correctly describes how an API returns data to an automation client?

  1. The client opens a raw TCP socket and parses an unstructured byte stream defined by the vendor
  2. The client polls a MIB tree and maps object identifiers to configuration values
  3. The client sends a request to an endpoint and receives a structured response, typically in JSON or XML Correct answer.
  4. The client relies on the device to push a full configuration file after every change

Explanation

An API exposes endpoints that accept requests and return structured payloads, most commonly JSON or XML, which scripts can parse deterministically. The other descriptions involve unstructured streams, SNMP MIB polling, or device-initiated file transfer, none of which describe a request-response API.

Question 28Network Fundamentals

A team wants to manage device configurations as versioned text files stored in Git and applied by an automation tool, rather than by hand-editing devices. Which practice does this describe?

  1. Best-effort queuing for voice traffic
  2. Stateless packet filtering at the edge
  3. Infrastructure as Code with configuration version control Correct answer.
  4. Dynamic routing convergence tuning

Explanation

Infrastructure as Code means the intended device state is expressed in files kept under version control and applied by tooling, which makes changes reviewable and repeatable. Routing convergence, packet filtering, and QoS queuing are data-plane or control-plane behaviors unrelated to managing configuration as code.

Question 29Network Fundamentals

An engineer must choose a data-serialization format for automation payloads. The requirement is a human-readable format with native support for nested objects and arrays that is widely consumed by REST APIs. Which format best fits?

  1. JSON Correct answer.
  2. Binary BER encoding
  3. Comma-separated values
  4. Fixed-width flat records

Explanation

JSON represents nested objects and arrays directly and is the dominant payload format for REST APIs, while remaining readable by humans. CSV and fixed-width records are flat and cannot express hierarchy, and BER is a binary encoding used mainly by SNMP rather than by REST payloads.

Question 30Network Fundamentals

A Python script iterates over a list of 200 devices and calls a REST API on each one. The script currently opens a new session for every request and finishes slowly. Which change most directly improves efficiency?

  1. Convert the JSON responses to CSV before parsing them
  2. Reuse a persistent HTTP session across requests to reduce per-request connection setup Correct answer.
  3. Increase the polling interval so each device is contacted less often
  4. Add a retry loop that resends every request three times

Explanation

Reusing a persistent session avoids repeated TCP and TLS handshakes for each API call, which is usually the dominant overhead when many small requests are made. Polling less often or reformatting responses does not reduce connection setup, and blind retries add load rather than removing the cost.

Question 31Network Fundamentals

A configuration template contains a variable placeholder for the management IP address, and a data file supplies a different value for each device. Which concept does this pairing illustrate?

  1. Link aggregation that bundles physical interfaces
  2. Templating that separates reusable structure from per-device data Correct answer.
  3. Static routing that pins traffic to a fixed next hop
  4. Duplicate address detection on a broadcast segment

Explanation

Templating keeps the reusable configuration structure in one file and injects device-specific values from a separate data source, so one template serves many devices. Routing, link aggregation, and address detection are network behaviors unrelated to generating configuration text.

Question 32Network Fundamentals

An automation platform must authenticate to network devices with per-user credentials and enforce role-based authorization so that only senior engineers can push configuration changes. Which approach satisfies both requirements?

  1. SNMPv2c read-only community strings on all devices
  2. Telnet access restricted by an access list on the VTY lines
  3. A single shared local username and password stored on every device
  4. Centralized AAA with TACACS+ or RADIUS and command authorization Correct answer.

Explanation

Centralized AAA provides per-user authentication and can return authorization attributes that restrict which commands or roles a user may use. Shared local credentials defeat accountability, SNMP community strings are not user logins, and Telnet with an ACL neither encrypts sessions nor enforces per-command roles.

Question 33Network Fundamentals

A script needs to confirm that a device's running configuration matches the intended state stored in Git before any change is applied. Which comparison should the script perform?

  1. Retrieve interface error counters and compare them with baseline thresholds
  2. Retrieve the ARP table and compare it with the MAC address table
  3. Retrieve the routing table and compare it with the neighbor adjacency list
  4. Retrieve the running configuration and diff it against the rendered intended configuration Correct answer.

Explanation

Idempotent automation compares the device's actual running configuration with the rendered intended configuration and only applies differences. ARP, error counters, and routing tables describe operational state, not configuration drift against a source of truth.

Question 34Network Fundamentals

A REST API returns HTTP status 401 for a request that previously succeeded. Which cause is most consistent with that status code?

  1. The credentials or token presented with the request are missing, expired, or invalid Correct answer.
  2. The requested resource path does not exist on the server
  3. The server accepted the request and created a new object
  4. The client exceeded a rate limit defined by the server

Explanation

HTTP 401 means the request lacks valid authentication credentials, so an expired token or wrong password is the expected cause. A missing resource returns 404, successful creation returns 201, and rate limiting typically returns 429.

Question 35Network Fundamentals

An engineer wants to confirm that a device supports a specific YANG model and capability before a NETCONF script relies on it. Which action accomplishes this?

  1. Compare the device's uptime with the last configuration change
  2. Read the capabilities exchanged during the NETCONF session hello Correct answer.
  3. Send an ICMP echo request to the device management address
  4. Check the ARP entry for the automation server

Explanation

During session establishment each NETCONF peer sends a hello containing a capabilities list that names supported YANG modules and features. ICMP reachability, uptime, and ARP entries say nothing about supported data models.

Question 36Network Fundamentals

A team deploys a script that changes VLAN assignments on many switches. Which safeguard best limits the blast radius if the script contains a logic error?

  1. Run the script against all devices at once to finish before the maintenance window ends
  2. Store the script only on the engineer's laptop without version control
  3. Disable logging so that error messages do not slow the script
  4. Validate changes in a lab or canary subset and require peer review before full rollout Correct answer.

Explanation

Testing on a small canary group and peer-reviewing the change catches logic errors before they reach the whole fleet, which bounds the impact. Running everywhere at once maximizes exposure, and disabling logging or skipping version control removes the evidence and history needed to detect and reverse mistakes.

Question 37Network Fundamentals

A controller-based network exposes a northbound API. Which statement describes what that API provides?

  1. An interface for external applications and automation tools to program the controller Correct answer.
  2. A method for switches to elect a spanning-tree root
  3. A protocol for the controller to configure its managed devices
  4. A mechanism for hosts to obtain addresses automatically

Explanation

The northbound API faces upward toward applications and automation platforms, letting them consume controller services and program intent. Southbound interfaces face the managed devices, while root election and address assignment are separate network functions.

Question 38Network Fundamentals

An automation script authenticates to a REST API and receives a token with a short lifetime. What is the correct way for the script to continue working after the token expires?

  1. Disable authentication on the API endpoint for automation traffic
  2. Reuse the expired token because the server caches authorization decisions
  3. Embed a permanent administrative password directly in the script source
  4. Request a new token using the stored refresh credentials and retry the call Correct answer.

Explanation

Short-lived tokens are refreshed by re-authenticating with stored refresh credentials and then retrying the failed call. Reusing expired tokens fails authorization, hardcoding permanent credentials creates a serious secret-management risk, and disabling authentication removes the control entirely.

Question 39Network Fundamentals

An engineer needs to parse a device's interface statistics inside an automation workflow. Which data source yields structured fields that can be addressed by name without writing text pattern matches?

  1. A model-driven telemetry or NETCONF stream carrying YANG-modeled data Correct answer.
  2. A packet capture of management traffic decoded by hand
  3. A screenshot of the device's web dashboard
  4. The raw output of a show interface command captured as plain text

Explanation

Model-driven telemetry and NETCONF streams deliver YANG-modeled data whose fields can be referenced by name, eliminating fragile text parsing. Raw CLI text, hand-decoded captures, and screenshots require manual interpretation and break when formats change.

Question 40Network Fundamentals

A script must decide whether a configuration change is safe by comparing the device's current routing table with the table expected after the change. Which capability is the script primarily exercising?

  1. Compression of configuration files for storage
  2. Analysis of retrieved operational state to support a decision Correct answer.
  3. Authentication of the engineer running the script
  4. Encryption of management traffic between peers

Explanation

Retrieving current state and reasoning about the expected difference is analysis of operational data, which is what decision logic in automation performs. Encryption, authentication, and compression are supporting functions that do not evaluate whether a change is safe.

Question 41Network Access

A switch port is configured with `switchport port-security` and `switchport port-security violation shutdown`. A second device is connected to the port and the port goes err-disabled. Which action restores the port after the offending device is removed?

  1. Shut down and re-enable the interface with `shutdown` / `no shutdown` Correct answer.
  2. Reload the switch to reset the port state
  3. Clear the MAC address table with `clear mac address-table dynamic`
  4. Remove and reapply the port-security configuration on the interface

Explanation

A port-security shutdown violation places the interface in the err-disabled state, and the standard recovery is to administratively shut the port and then bring it back up. Clearing the MAC table or reapplying port-security does not reset the err-disabled condition. Reloading the switch would work but is disruptive and unnecessary.

Question 42Network Access

Which statement correctly describes the purpose of the native VLAN on an 802.1Q trunk link?

  1. It encrypts tagged frames as they traverse the trunk
  2. It carries untagged frames across the trunk and must match on both ends Correct answer.
  3. It carries only voice traffic between the switch and the IP phone
  4. It is the VLAN used exclusively for the management SVI

Explanation

On an 802.1Q trunk, frames belonging to the native VLAN are sent untagged, so both ends of the link must agree on which VLAN is native. A mismatch causes frames to be placed into different VLANs on each side. The native VLAN is not inherently a voice or management VLAN, and 802.1Q does not provide encryption.

Question 43Network Access

A Cisco switch port connects to a PC that does not send 802.1Q tags. Which interface configuration places the port in access mode on VLAN 20?

  1. `switchport mode trunk` followed by `switchport trunk native vlan 20`
  2. `switchport mode access` followed by `switchport access vlan 20` Correct answer.
  3. `switchport mode dynamic desirable` with no VLAN assignment
  4. `switchport nonegotiate` followed by `switchport access vlan 20`

Explanation

An end-device port that does not tag frames should be statically configured as an access port, and `switchport access vlan 20` assigns it to VLAN 20. Trunk mode is for links carrying multiple VLANs and would not match an untagged PC. Dynamic desirable negotiates a trunk and does not guarantee access mode.

Question 44Network Access

Which protocol prevents Layer 2 loops by electing a root bridge and placing redundant ports into blocking state?

  1. LACP
  2. CDP
  3. STP Correct answer.
  4. LLDP

Explanation

Spanning Tree Protocol elects a root bridge and computes a loop-free topology by blocking redundant ports. LLDP and CDP are neighbor-discovery protocols, and LACP bundles links rather than blocking loops.

Question 45Network Access

Which feature allows a single physical switch port to carry traffic for multiple VLANs to another switch?

  1. A trunk link Correct answer.
  2. A routed port
  3. An access link
  4. A switched virtual interface

Explanation

A trunk link carries frames for multiple VLANs between switches by tagging them, typically with 802.1Q. An access link belongs to one VLAN, a routed port has an IP address and no VLAN tagging, and an SVI is a logical interface on the switch itself.

Question 46Network Access

Which command displays the VLAN-to-port assignments and trunk status on a Cisco switch?

  1. `show running-config | include ip route`
  2. `show interfaces switchport` Correct answer.
  3. `show mac address-table`
  4. `show ip interface brief`

Explanation

`show interfaces switchport` reports administrative and operational mode, access VLAN, native VLAN, and trunking VLANs for each port. The other commands show Layer 3 addressing, MAC learning, or static routes, none of which describe VLAN port assignment.

Question 47Network Access

Which EtherChannel negotiation mode actively initiates bundling and is defined by IEEE 802.3ad?

  1. LACP passive
  2. PAgP desirable
  3. PAgP auto
  4. LACP active Correct answer.

Explanation

LACP is the IEEE 802.3ad standard, and the active mode actively sends LACP packets to negotiate a bundle. PAgP is Cisco proprietary and its auto mode only responds. LACP passive also only responds rather than initiating.

Question 48Network Access

Which device forwards frames only to the port where the destination MAC address was learned, reducing unnecessary traffic?

  1. A media converter
  2. A repeater
  3. A Layer 2 switch Correct answer.
  4. A hub

Explanation

A Layer 2 switch learns source MAC addresses per port and forwards frames only out the port associated with the destination MAC. Hubs and repeaters flood every frame to all ports, and a media converter only changes the physical medium.

Question 49Network Access

A trunk between two switches shows the native VLAN mismatch error in logs. Which change resolves the problem?

  1. Configure the same native VLAN on both trunk interfaces Correct answer.
  2. Disable DTP on both interfaces
  3. Assign the same voice VLAN on both interfaces
  4. Change both interfaces to access mode

Explanation

The native VLAN mismatch occurs because untagged frames on each side are associated with different VLANs. Setting the same native VLAN on both trunk ends removes the inconsistency. Changing to access mode or disabling DTP does not correct the VLAN mismatch.

Question 50Network Access

A switch port is configured with `switchport port-security maximum 2` and `switchport port-security mac-address sticky`. Three devices attempt to use the port. What is the default violation behavior?

  1. The port allows the third device and overwrites the oldest sticky entry
  2. The port drops frames from the third device and logs a violation Correct answer.
  3. The port shuts down immediately
  4. The port sends an SNMP trap and shuts down

Explanation

The default port-security violation mode is protect, which silently drops frames from unauthorized MAC addresses; with logging enabled by default in newer behavior, the violation is also logged. Shutdown mode must be configured explicitly. Sticky entries are not overwritten to admit additional devices beyond the maximum.