I85PREP
⌘ K
JNCIA-Design study materials
JNCIA-Design study resources

JNCIA-Design practice questions

One question at a time. Build your JNCIA-Design understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Network Design Fundamentals

A design team must choose a WAN topology for a small branch that needs only two redundant uplinks to headquarters and minimal cost. Which topology best fits these requirements?

  1. Full mesh
  2. Hub-and-spoke
  3. Partial mesh Correct answer.
  4. Ring

Explanation

A partial mesh connects only the sites that need redundant paths, so the branch gets two uplinks to headquarters without paying for links between every pair of sites. Full mesh and ring overbuild for a single small branch, and hub-and-spoke provides no redundant uplink by itself.

Question 2Network Design Fundamentals

In a three-tier hierarchical campus design, which role does the distribution layer primarily serve?

  1. Connecting the campus to external service providers
  2. Providing high-density end-user port connectivity
  3. Aggregating access switches and enforcing policy between VLANs Correct answer.
  4. Terminating all wireless client associations

Explanation

The distribution layer aggregates access-layer uplinks and applies routing, filtering, and policy between VLANs and subnets. Access switches provide end-user ports, while WAN and provider connectivity is handled at the core or a dedicated edge.

Question 3Network Design Fundamentals

A designer is documenting the structured cabling for a new floor. Which subsystem connects the floor telecommunications room to the individual work area outlets?

  1. Entrance facility
  2. Equipment room cross-connect
  3. Backbone cabling
  4. Horizontal cabling Correct answer.

Explanation

Horizontal cabling runs from the floor telecommunications room to the work area outlets on that floor. Backbone cabling links telecommunications rooms to each other and to the entrance facility, so it does not reach individual outlets.

Question 4Network Design Fundamentals

Which statement correctly describes the purpose of a VLAN in a campus design?

  1. It replaces the need for Layer 3 routing between subnets.
  2. It encrypts traffic between switches.
  3. It logically segments a switched network into separate broadcast domains. Correct answer.
  4. It increases the physical link speed between access and distribution.

Explanation

A VLAN creates a logical broadcast domain on shared physical switching infrastructure, letting the designer group users by function or security zone. It does not encrypt traffic, change link speed, or remove the need for Layer 3 routing between VLANs.

Question 5Network Design Fundamentals

A design must support a single subnet of 500 hosts in one building. Which private IPv4 prefix provides enough usable addresses with the least waste?

  1. 10.10.0.0/23 Correct answer.
  2. 10.10.0.0/24
  3. 10.10.0.0/22
  4. 10.10.0.0/25

Explanation

A /23 provides 512 addresses, of which 510 are usable, which covers 500 hosts with minimal waste. A /24 gives only 254 usable addresses, and a /22 provides 1022 usable addresses, wasting far more space.

Question 6Network Design Fundamentals

Which device type operates primarily at Layer 2 and forwards frames based on destination MAC addresses?

  1. Ethernet switch Correct answer.
  2. Layer 3 switch
  3. Firewall
  4. Router

Explanation

A traditional Ethernet switch builds a MAC address table and forwards frames at Layer 2 based on the destination MAC address. Routers and Layer 3 switches forward based on IP addressing, and firewalls enforce security policy.

Question 7Network Design Fundamentals

A company requires that a design remain functional if any single WAN link fails. Which design principle does this requirement describe?

  1. Manageability
  2. Availability Correct answer.
  3. Scalability
  4. Security

Explanation

Availability describes a design's ability to keep services reachable despite component or link failure, which is exactly the stated requirement. Scalability concerns growth, manageability concerns operational effort, and security concerns protection of assets.

Question 8Network Design Fundamentals

What is the primary benefit of summarization in a hierarchical routing design?

  1. It encrypts routing updates between areas.
  2. It guarantees equal-cost paths between all routers.
  3. It reduces the size of routing tables and the scope of topology changes. Correct answer.
  4. It eliminates the need for a default route.

Explanation

Summarization advertises an aggregate prefix instead of many specific routes, shrinking routing tables and containing the impact of topology changes within an area. It does not encrypt updates, create equal-cost paths, or remove the need for default routing.

Question 9Network Design Fundamentals

A campus design places servers that many VLANs must reach in a dedicated block. Which design approach best keeps that server-to-client traffic efficient?

  1. Connect the servers only to the core with no routing policy
  2. Place the server block on the distribution layer with Layer 3 connectivity to all VLANs Correct answer.
  3. Extend every user VLAN to the server block as a Layer 2 domain
  4. Attach servers to access switches in each user VLAN

Explanation

A dedicated server block attached at distribution with Layer 3 links lets all VLANs reach the servers through routed paths without stretching Layer 2 domains. Extending user VLANs to the server block increases broadcast scope and failure domain size, which is poor design.

Question 10Network Design Fundamentals

A network designer needs to connect two sites over a service provider while keeping the provider's devices unaware of the customer's routing. Which technology fits this requirement?

  1. A dark fiber run
  2. A Layer 2 leased line
  3. An MPLS Layer 3 VPN Correct answer.
  4. A transparent LAN service

Explanation

An MPLS Layer 3 VPN lets the provider carry customer routes in separate VRFs, so provider devices forward customer traffic without participating in the customer's routing domain. Layer 2 services and dark fiber carry frames or light but leave routing entirely to the customer.

Question 11Network Design Fundamentals

Which statement best explains why a designer would deploy first-hop redundancy protocols such as VRRP at the distribution layer?

  1. To authenticate end hosts before they receive an address
  2. To provide a virtual default gateway that survives a gateway failure Correct answer.
  3. To load-balance traffic across multiple WAN links
  4. To summarize routes between access and distribution

Explanation

First-hop redundancy protocols present a shared virtual IP and MAC as the default gateway so hosts keep connectivity when the active gateway fails. They do not balance WAN links, authenticate hosts, or perform route summarization.

Question 12Network Design Fundamentals

A designer is choosing between a routed access layer and a Layer 2 access layer with a switched distribution block. Which consideration most favors routed access?

  1. It limits Layer 2 failure domains and enables faster convergence Correct answer.
  2. It removes the need for any VLAN configuration on access switches
  3. It allows a single subnet to span many access switches
  4. It eliminates the need for an IP addressing plan

Explanation

With routed access, each access switch terminates its own Layer 2 domain and peers at Layer 3, which shrinks broadcast and failure domains and supports faster convergence. VLANs and an addressing plan are still required, and a single subnet cannot span multiple routed access switches.

Question 13Network Design Fundamentals

An application requires that traffic from a given flow always follow the same path to avoid out-of-order delivery. Which design choice supports this requirement?

  1. Per-packet load balancing across equal-cost links
  2. Per-flow load balancing across equal-cost links Correct answer.
  3. Random early detection on all interfaces
  4. Increasing the administrative distance on all links

Explanation

Per-flow load balancing hashes each flow to one path, so packets in a flow stay in order, while per-packet balancing can reorder packets. RED affects queue management, and administrative distance affects route preference rather than path selection per flow.

Question 14Network Design Fundamentals

A designer must size a link that carries 200 Mbps of steady traffic and must not exceed 50 percent utilization during normal operation. Which capacity meets the requirement?

  1. 200 Mbps
  2. 1 Gbps
  3. 400 Mbps Correct answer.
  4. 800 Mbps

Explanation

Keeping 200 Mbps at or below 50 percent utilization requires a link of at least 400 Mbps. A 200 Mbps link would run at 100 percent, and 800 Mbps or 1 Gbps would meet the rule but overprovision beyond the stated requirement.

Question 15Network Design Fundamentals

Which practice improves the manageability of a large campus design?

  1. Assigning overlapping subnets to different buildings
  2. Using unique ad hoc configurations on every access switch
  3. Standardizing device templates and naming conventions across similar blocks Correct answer.
  4. Avoiding documentation to reduce design time

Explanation

Standard templates and consistent naming make similar blocks predictable to operate, automate, and troubleshoot. Ad hoc configurations, missing documentation, and overlapping subnets all increase operational risk and effort.

Question 16Network Design Fundamentals

A designer is planning an IPv6 deployment alongside existing IPv4. Which approach lets both protocols coexist on the same interfaces without translation?

  1. 6to4 tunneling
  2. Dual stack Correct answer.
  3. IPv4-only with static NAT
  4. NAT64

Explanation

Dual stack runs IPv4 and IPv6 simultaneously on interfaces, so hosts and routers can forward either protocol natively. NAT64 and 6to4 translate or tunnel traffic between protocol versions rather than running both natively.

Question 17Network Design Fundamentals

Which design choice best limits the scope of a Layer 2 loop's impact in a campus network?

  1. Enabling a spanning-tree variant with fast convergence and root guard on all access ports Correct answer.
  2. Disabling BPDU guard on user-facing ports
  3. Extending all VLANs across every access switch
  4. Using a single large VLAN for all users

Explanation

A fast-converging spanning tree plus root guard and BPDU guard on user ports limits loop impact and blocks rogue switches from becoming root. Extending VLANs widely or merging all users into one VLAN enlarges the loop's blast radius.

Question 18Network Design Fundamentals

A designer must ensure that a branch keeps working if its primary WAN router fails. Which design element addresses this requirement directly?

  1. A higher bandwidth primary link
  2. Route summarization at the branch
  3. A larger routing table on the primary router
  4. A second router with a redundant WAN link and a first-hop redundancy protocol for the LAN Correct answer.

Explanation

Two routers with redundant WAN paths and a virtual gateway on the LAN let hosts retain connectivity when the primary router fails. Larger tables, faster links, or summarization do not provide device-level redundancy.

Question 19Network Design Fundamentals

A design team is evaluating a hub-and-spoke WAN where all branch traffic goes to a central data center. Which statement is the most significant design limitation?

  1. Branch-to-branch traffic must traverse the hub, adding latency and hub load Correct answer.
  2. It prevents the use of private addressing
  3. It requires a full mesh of physical links
  4. The topology cannot support dynamic routing protocols

Explanation

In a hub-and-spoke design, spoke-to-spoke traffic passes through the hub, which adds latency and concentrates bandwidth and processing load at the central site. The topology supports dynamic routing and private addressing, and it explicitly avoids a full mesh.

Question 20Network Design Fundamentals

A designer needs to segment a data center so that each tenant has isolated Layer 2 and Layer 3 domains on shared physical equipment. Which technology best meets this requirement?

  1. VLAN access maps
  2. Link aggregation
  3. Port mirroring
  4. VRF with VLAN segmentation per tenant Correct answer.

Explanation

Combining per-tenant VRFs for Layer 3 isolation with separate VLANs for Layer 2 isolation provides tenant separation on shared hardware. Access maps, mirroring, and link aggregation do not create isolated routing and broadcast domains.

Question 21Network Design Fundamentals

A design must support 1000 hosts in a single subnet while reserving the first 100 addresses and the last 100 addresses for infrastructure and future use. Which prefix provides the tightest fit that still meets the requirement?

  1. /22 Correct answer.
  2. /21
  3. /24
  4. /23

Explanation

A /22 yields 1024 addresses, of which 1022 are usable, so 1000 hosts plus the reserved ranges fit within one subnet. A /23 offers only 510 usable addresses, while a /21 would waste over 1000 addresses.

Question 22Network Design Fundamentals

A designer observes that a campus with a single distribution pair will lose all inter-VLAN routing if that pair fails. Which change most directly removes this single point of failure?

  1. Increasing the bandwidth of the access uplinks
  2. Adding more access switches to the existing pair
  3. Adding a second distribution pair and connecting access switches to both pairs Correct answer.
  4. Enabling port security on access ports

Explanation

Adding a second distribution pair and dual-homing access switches removes the single routing point of failure and provides alternate paths. More bandwidth, more access switches, or port security do not create a redundant routing path.

Question 23Network Design Fundamentals

A WAN design must carry voice traffic with strict latency bounds alongside bulk data. Which design technique best protects voice quality?

  1. Putting voice and data in one queue and relying on overprovisioning
  2. Classifying voice into a priority queue with admission control and reserving bandwidth Correct answer.
  3. Increasing the MTU on all WAN links
  4. Sending voice over the same best-effort path as data with equal treatment

Explanation

Classifying voice into a low-latency priority queue, reserving bandwidth, and applying call admission control keeps voice delay and jitter within bounds even when data traffic peaks. Treating voice as best effort or relying only on overprovisioning leaves it exposed to congestion.

Question 24Network Design Fundamentals

A designer is comparing active/active and active/standby firewall pairs at a data center edge. Which statement best captures the key design trade-off?

  1. Active/active improves resource use but requires symmetric flow handling to avoid state mismatch Correct answer.
  2. Active/active removes the need for state synchronization
  3. Active/standby cannot provide any failover capability
  4. Active/standby provides higher aggregate throughput than active/active

Explanation

Active/active pairs use both devices but require careful flow symmetry and state sharing so that a flow's return traffic reaches the same state context. Active/standby does provide failover through state synchronization, and it typically delivers lower aggregate throughput than active/active.

Question 25Network Design Fundamentals

A design team must place a policy enforcement point so that traffic between user VLANs and the data center is inspected without backhauling branch traffic unnecessarily. Which placement best fits this goal?

  1. At every access switch
  2. At the branch access layer only
  3. Only at the internet edge
  4. At the distribution layer where user and data center paths converge Correct answer.

Explanation

Placing inspection at the distribution layer puts the control point on the path where user VLANs and data center traffic converge, so flows are inspected without unnecessary backhaul. Edge-only placement misses internal traffic, while per-access-switch placement is costly and hard to manage.

Question 26Network Design Fundamentals

In a hierarchical campus design, which function is assigned to the core layer?

  1. Providing high-speed transport between distribution blocks with minimal policy enforcement Correct answer.
  2. Terminating WAN circuits and hosting the firewall cluster
  3. Connecting end-user devices and enforcing port security
  4. Aggregating access switches and applying routing policy between VLANs

Explanation

The core layer exists to move packets quickly between distribution blocks, so it should stay simple and avoid policy or filtering that adds latency. Aggregation, VLAN routing, and end-user attachment belong to the distribution and access layers. Keeping the core lean preserves scalability and predictable convergence.

Question 27Network Design Fundamentals

A designer is documenting the three-tier campus model. Which pairing of layer and typical device is most accurate?

  1. Access layer - modular chassis that routes between VLANs
  2. Core layer - workgroup switch with PoE ports
  3. Distribution layer - multilayer switch providing inter-VLAN routing and policy Correct answer.
  4. Core layer - wireless LAN controller managing access points

Explanation

In the classic three-tier model the distribution layer aggregates access switches and hosts the multilayer switches that route between VLANs and apply policy. Access switches attach endpoints, and the core provides fast transport. Placing routing and policy at distribution keeps the core and access roles simple.

Question 28Network Design Fundamentals

A designer must choose a topology for a small site with three routers where every router needs a direct path to every other router and cost is not a constraint. Which topology matches that requirement?

  1. Partial mesh
  2. Ring
  3. Full mesh Correct answer.
  4. Hub-and-spoke

Explanation

A full mesh connects every node directly to every other node, giving each router a dedicated path to all peers and the highest resilience at the highest link cost. Hub-and-spoke and partial mesh leave some pairs without a direct link. A ring provides only two paths per node and no direct pair connectivity.

Question 29Network Design Fundamentals

Which characteristic distinguishes a routed access design from a Layer 2 access design with a switched distribution block?

  1. Routed access eliminates the need for any VLANs on access switches
  2. Routed access places the Layer 3 boundary at the access switch, so each access switch peers with distribution Correct answer.
  3. Routed access prevents the use of first-hop redundancy at the access layer
  4. Routed access requires Spanning Tree to prevent loops between access and distribution

Explanation

In routed access the Layer 3 boundary is pushed down to the access switch, which forms routed links toward distribution and removes the need for large Layer 2 domains. Layer 2 access instead extends VLANs to a switched distribution block. Routed access still uses VLANs locally and can still support first-hop redundancy.

Question 30Network Design Fundamentals

A designer is selecting a physical medium for a run of 90 meters inside a building that must support 10 Gbps. Which choice is appropriate?

  1. Category 5e unshielded twisted pair
  2. Category 6A unshielded twisted pair Correct answer.
  3. Single-mode fiber with long-reach optics
  4. Multimode fiber with appropriate optics

Explanation

Category 6A twisted pair is specified for 10GBASE-T up to 100 meters, which covers a 90-meter horizontal run plus patching. Category 5e is rated only for 1 Gbps at that distance. Fiber would work technically, but the question targets the copper standard suited to in-building 10 Gbps cabling.

Question 31Network Design Fundamentals

A design team is placing an aggregation block for a building with 40 access switches. Which consideration most directly favors a two-tier collapsed core over a three-tier design at that site?

  1. The site needs to support more than 100 VLANs across many buildings
  2. The site has a small number of distribution blocks and does not need a separate core for scale Correct answer.
  3. The site must terminate multiple service provider connections at a dedicated layer
  4. The site requires strict separation of routing policy from access switching

Explanation

A collapsed core merges the core and distribution functions when there are few distribution blocks, reducing devices, cost, and hop count. A separate core becomes worthwhile when the network grows to many distribution blocks or large-scale transport is needed. Policy separation alone does not require a dedicated core layer.

Question 32Network Design Fundamentals

A designer is planning a data center fabric and wants predictable any-to-any server-to-server latency with a fixed number of hops. Which design approach best supports that goal?

  1. Three-tier data center with spanning-tree blocked links
  2. Hub-and-spoke topology with a central aggregation switch
  3. Ring topology with rapid spanning tree
  4. Spine-and-leaf fabric with equal-cost multipathing Correct answer.

Explanation

Spine-and-leaf fabrics give every leaf a single hop to every spine, so server-to-server paths have predictable hop counts and ECMP uses all links. Spanning-tree-based designs block redundant links and produce variable paths. Hub-and-spoke and ring topologies add variable hop counts and bottlenecks.

Question 33Network Design Fundamentals

A designer must choose a routing protocol for a network that needs fast convergence on a link-state basis with hierarchical areas. Which protocol matches that requirement?

  1. RIPv2
  2. Static routing
  3. OSPF Correct answer.
  4. BGP with a single AS

Explanation

OSPF is a link-state interior gateway protocol that supports areas, which limits flooding scope and speeds convergence. RIPv2 is distance-vector with slow convergence and a 15-hop limit. Static routes and single-AS BGP do not provide link-state hierarchical area behavior.

Question 34Network Design Fundamentals

A designer needs to interconnect 12 branch sites so that each branch can reach the others through a provider while the provider only forwards traffic. Which design element provides this?

  1. A Layer 2 extended VLAN across all branches
  2. A shared flat subnet across all branch routers
  3. A hub-and-spoke GRE tunnel to a single headend only
  4. A Layer 3 VPN service with the enterprise routing between sites Correct answer.

Explanation

A Layer 3 VPN lets the provider forward traffic while enterprise routers handle routing between sites, giving any-to-any reachability without provider involvement in enterprise routing. A flat extended VLAN or shared subnet creates a large failure domain. A single headend tunnel forces all traffic through one point.

Question 35Network Design Fundamentals

A designer is calculating the number of access ports for a new floor. There are 120 users, each expected to need one wired port, plus 20 conference room ports and 15 percent spare capacity. Which port count should be planned?

  1. 175
  2. 140
  3. 155
  4. 161 Correct answer.

Explanation

Add the 120 user ports and 20 conference ports to get 140 required ports. Adding 15 percent spare capacity gives 140 × 1.15 = 161 ports. Rounding up to the nearest switch port count is a separate step after this calculation.

Question 36Network Design Fundamentals

A designer is sizing a subnet for a point-to-point link between two routers and wants to conserve address space. Which prefix length is the most efficient standard choice for IPv4?

  1. /30 Correct answer.
  2. /24
  3. /29
  4. /28

Explanation

A /30 provides four addresses, of which two are usable host addresses after the network and broadcast addresses, which fits a point-to-point link exactly. Larger prefixes waste addresses on a link that needs only two. A /31 is also used on modern equipment, but it is not among the options.

Question 37Network Design Fundamentals

A designer observes that a single distribution switch pair handles all inter-VLAN routing for a building, and its failure isolates every VLAN. Which change most directly reduces that single point of failure?

  1. Enabling port security on access ports
  2. Deploying a second distribution pair and splitting VLAN gateways across both Correct answer.
  3. Increasing the uplink speed from access to distribution
  4. Adding more access switches to the building

Explanation

Adding a second distribution pair and distributing gateway responsibilities removes the single device dependency for inter-VLAN routing. More access switches or faster uplinks do not address the distribution failure. Port security affects endpoint behavior, not routing resilience.

Question 38Network Design Fundamentals

A designer is comparing an active/active firewall pair with an active/standby pair at a data center edge. Which statement best captures the design difference?

  1. Active/active uses both devices for traffic but requires state synchronization and careful asymmetric-flow handling Correct answer.
  2. Active/active eliminates the need for session state sharing between peers
  3. Active/standby provides more aggregate throughput because both devices forward traffic
  4. Active/standby cannot fail over without a routing protocol change

Explanation

An active/active pair forwards traffic on both devices, which raises aggregate capacity but demands state synchronization and consistent flow symmetry to avoid dropped sessions. Active/standby keeps one device idle until failover and is simpler to reason about. Throughput and failover mechanics differ accordingly.

Question 39Network Design Fundamentals

A designer must ensure that a WAN design keeps voice quality acceptable when bulk data shares the same links. Which technique most directly protects voice traffic?

  1. Increasing the MTU on all WAN interfaces
  2. Enabling equal-cost multipathing across WAN links
  3. Applying NAT to all voice flows
  4. Classifying voice into a priority queue with a bandwidth guarantee Correct answer.

Explanation

Classifying voice into a low-latency priority queue with a guaranteed bandwidth allocation protects it from being starved by bulk data. Larger MTU, multipathing, and NAT do not provide per-class latency treatment. QoS classification and queuing are the direct mechanism for protecting real-time traffic.

Question 40Network Design Fundamentals

A designer is choosing between a star and a hub-and-spoke WAN for a company with a central data center and 20 small branches. Which statement best describes the tradeoff?

  1. Hub-and-spoke centralizes policy and reduces cost but creates a single point of failure and backhaul delay Correct answer.
  2. A star topology requires a full mesh of provider circuits
  3. A star topology provides direct branch-to-branch paths and lower latency
  4. Hub-and-spoke removes the need for routing at branch sites

Explanation

Hub-and-spoke concentrates traffic and policy at the hub, which lowers circuit cost and simplifies management but makes the hub critical and forces branch-to-branch traffic to backhaul. A star likewise routes through a central point rather than providing direct branch paths. Neither topology removes the need for branch routing.

Question 41Campus and Enterprise LAN Design

In a campus LAN design, which layer of the hierarchical three-tier model is primarily responsible for enforcing access control policies and marking traffic at the edge where end devices connect?

  1. Core layer
  2. Distribution layer
  3. Access layer Correct answer.
  4. Collapsed core layer

Explanation

The access layer is where end devices attach, so it is the natural enforcement point for port security, 802.1X, VLAN assignment, and QoS marking close to the source. The distribution layer aggregates access switches and applies inter-VLAN policy, while the core focuses on fast transport.

Question 42Campus and Enterprise LAN Design

A designer wants to limit the size of a single Layer 2 broadcast domain on a Cisco campus switch block. Which action directly achieves that goal?

  1. Enable Rapid PVST+ on all uplinks
  2. Increase the MTU on the distribution uplinks
  3. Configure HSRP on the distribution switches
  4. Create additional VLANs and assign user ports across them Correct answer.

Explanation

A VLAN defines a Layer 2 broadcast domain, so splitting users into more VLANs reduces the number of devices sharing each broadcast domain. Spanning tree, MTU, and first-hop redundancy do not change broadcast domain boundaries.

Question 43Campus and Enterprise LAN Design

Which statement best describes the purpose of a switch block in a campus design?

  1. It defines the physical rack layout for data center servers
  2. It replaces the need for a routing protocol between buildings
  3. It provides a single flat Layer 2 domain across the entire campus
  4. It groups access switches with their distribution switches to contain failure and traffic domains Correct answer.

Explanation

A switch block pairs a set of access switches with redundant distribution switches so that failures and broadcast traffic stay contained within the block. This modularity keeps the rest of the campus stable when one block has problems.

Question 44Campus and Enterprise LAN Design

Which technology allows a single physical access switch port to carry traffic for multiple VLANs when the connected device is an IP phone with a PC attached behind it?

  1. An 802.1Q trunk port Correct answer.
  2. A port configured for PortFast only
  3. A routed port with an SVI
  4. An access port in a single VLAN

Explanation

An 802.1Q trunk carries multiple tagged VLANs over one link, which is how a voice VLAN and a data VLAN share the phone-to-switch connection. A single access port or a routed port cannot carry both VLANs simultaneously.

Question 45Campus and Enterprise LAN Design

A design requires that a user's VLAN assignment follow the user wherever they connect on campus. Which solution meets this requirement?

  1. Static access port VLANs configured per wall jack
  2. Port security with sticky MAC addresses
  3. Private VLAN isolated ports on every access switch
  4. Cisco Identity Services Engine with 802.1X dynamic VLAN assignment Correct answer.

Explanation

Identity-based networking with 802.1X and ISE can assign a VLAN dynamically based on the authenticated user or device identity, so the policy follows the user. Static per-jack VLANs tie the VLAN to the physical location instead.

Question 46Campus and Enterprise LAN Design

Which first-hop redundancy protocol allows multiple routers to share a virtual IP and also load-share across VLANs by assigning different active gateways per VLAN?

  1. Static default routes on each access switch
  2. VRRP in single-group mode
  3. HSRP with multiple groups mapped to different VLANs Correct answer.
  4. GLBP with a single forwarder

Explanation

HSRP supports multiple groups, and a common design maps different VLANs to different active HSRP groups so both distribution switches forward traffic. This provides gateway redundancy and balances load across the pair.

Question 47Campus and Enterprise LAN Design

A campus design has a distribution pair running HSRP. Which additional configuration is required so that spanning tree and HSRP active gateway roles align and avoid suboptimal forwarding?

  1. Set all access switches to the same bridge priority
  2. Disable spanning tree on the distribution uplinks
  3. Enable BPDU filter on all access ports
  4. Set spanning tree root bridge priority to match the HSRP active gateway on each VLAN Correct answer.

Explanation

Aligning the spanning tree root with the HSRP active gateway for each VLAN keeps the Layer 2 path and the Layer 3 gateway on the same switch, avoiding traffic that crosses the peer link unnecessarily. This is a standard best practice in distribution block design.

Question 48Campus and Enterprise LAN Design

Which design choice reduces the size of a Layer 2 failure domain in a large building while still supporting wired and wireless users?

  1. Use routed access with Layer 3 links from access to distribution Correct answer.
  2. Extend a single VLAN across all floors
  3. Use a single large switch stack for the whole building
  4. Bridge all wireless controllers into one VLAN

Explanation

Routed access places a Layer 3 boundary at or near the access switch, so broadcast and failure domains stay small and convergence is faster. Extending VLANs across floors or bridging large segments expands Layer 2 failure domains.

Question 49Campus and Enterprise LAN Design

What is the primary benefit of using EtherChannel between an access switch and a distribution switch pair?

  1. It eliminates the need for VLANs on the link
  2. It automatically load-balances Layer 3 routes
  3. It increases aggregate bandwidth and provides link redundancy while spanning tree treats the bundle as one logical link Correct answer.
  4. It allows the link to carry traffic without any spanning tree participation

Explanation

EtherChannel bundles multiple physical links into one logical link, increasing bandwidth and providing redundancy while spanning tree sees a single port and avoids blocking individual members. It does not remove the need for VLANs or routing.

Question 50Campus and Enterprise LAN Design

Which spanning tree enhancement is designed to speed convergence on edge ports connected to end-user devices?

  1. Root guard
  2. Loop guard
  3. BPDU guard
  4. PortFast Correct answer.

Explanation

PortFast transitions an edge port directly to forwarding, skipping the listening and learning states, which speeds up connectivity for end devices. Root guard, BPDU guard, and loop guard protect topology integrity rather than accelerating edge convergence.