CCNA – STP Questions

Question 1

Which three statements about RSTP are true? (choose three)
A. RSTP significantly reduces topology reconverging time after a link failure.
B. RSTP expends the STP port roles by adding the alternate and backup roles.
C. RSTP port states are blocking, discarding, learning, or forwarding.
D. RSTP also uses the STP proposal-agreement sequence.
E. RSTP use the same timer-based process as STP on point-to-point links.
F. RSTP provides a faster transition to the forwarding state on point-to-point links than STP does.

Answer: A B F

Question 2

Which two states are the port states when RSTP has converged? (choose two)
A. blocking
B. learning
C. disabled
D. forwarding
E. listening

Answer: A D

Explanation

RSTP only has 3 port states that are discarding, learning and forwarding. When RSTP has converged there are only 2 port states left: discarding and forwarding but the answers don’t mention about discarding state so blocking state (answer A) may be considered the best alternative answer.

Question 3

Which command enables RSTP on a switch?
A. spanning-tree mode rapid-pvst
B. spanning-tree uplinkfast
C. spanning-tree backbonefast
D. spanning-tree mode mst

Answer: A

Question 4

At which layer of the OSI model is RSTP used to prevent loops?
A. data link
B. network
C. physical
D. transport

Answer: A

Question 5

Refer to the exhibit. Given the output shown from this Cisco Catalyst 2950, what is the most likely reason that interface FastEthernet 0/10 is not the root port for VLAN 2?
Switch# show spanning-tree interface fastethernet0/10

A. This switch has more than one interface connected to the root network segment in VLAN 2.
B. This switch is running RSTP while the elected designated switch is running 802.1d Spanning Tree.
C. This switch interface has a higher path cost to the root bridge than another in the topology.
D. This switch has a lower bridge ID for VLAN 2 than the elected designated switch.

Answer: C

Question 6

Which two of these statements regarding RSTP are correct? (Choose two)
A. RSTP cannot operate with PVST+.
B. RSTP defines new port roles.
C. RSTP defines no new port states.
D. RSTP is a proprietary implementation of IEEE 802.1D STP.
E. RSTP is compatible with the original IEEE 802.1D STP.

Answer: B E

Question 7

Refer to the exhibit. Each of these four switches has been configured with a hostname, as well as being configured to run RSTP. No other configuration changes have been made. Which three of these show the correct RSTP port roles for the indicated switches and interfaces? (Choose three)

A. SwitchA, Fa0/2, designated
B. SwitchA, Fa0/1, root
C. SwitchB, Gi0/2, root
D. SwitchB, Gi0/1, designated
E. SwitchC, Fa0/2, root
F. SwitchD, Gi0/2, root

Answer: A B F

Explanation

The question says “no other configuration changes have been made” so we can understand these switches have the same bridge priority. Switch C has lowest MAC address so it will become root bridge and 2 of its ports (Fa0/1 & Fa0/2) will be designated ports -> E is incorrect.
Because SwitchC is the root bridge so the 2 ports nearest SwitchC on SwitchA (Fa0/1) and SwitchD (Gi0/2) will be root ports -> B and F are correct.
Now we come to the most difficult part of this question: SwitchB must have a root port so which port will it choose? To answer this question we need to know about STP cost and port cost.
In general, “cost” is calculated based on bandwidth of the link. The higher the bandwidth on a link, the lower the value of its cost. Below are the cost values you should memorize:

Link speed	Cost
10Mbps	100
100Mbps	19
1 Gbps	4

SwitchB will choose the interface with lower cost to the root bridge as the root port so we must calculate the cost on interface Gi0/1 & Gi0/2 of SwitchB to the root bridge. This can be calculated from the “cost to the root bridge” of each switch because a switch always advertises its cost to the root bridge in its BPDU. The receiving switch will add its local port cost value to the cost in the BPDU.
One more thing to notice is that a root bridge always advertises the cost to the root bridge (itself) with an initial value of 0.
Now let’s have a look at the topology again

SwitchC advertises its cost to the root bridge with a value of 0. Switch D adds 4 (the cost value of 1Gbps link) and advertises this value (4) to SwitchB. SwitchB adds another 4 and learns that it can reach SwitchC via Gi0/1 port with a total cost of 8. The same process happens for SwitchA and SwitchB learns that it can reach SwitchC via Gi0/2 with a total cost of 23 -> Switch B chooses Gi0/1 as its root port -> D is not correct.
Now our last task is to identify the port roles of the ports between SwitchA & SwitchB. It is rather easy as the MAC address of SwitchA is lower than that of SwitchB so Fa0/2 of SwitchA will be designated port while Gi0/2 of SwitchB will be alternative port -> A is correct but C is not correct.
Below summaries all the port roles of these switches:

+ DP: Designated Port (forwarding state)
+ RP: Root Port (forwarding state)
+ AP: Alternative Port (blocking state)

Question 8

Which two protocols are used by bridges and/or switches to prevent loops in a layer 2 network? (Choose two)
A. 802.1d
B. VTP
C. 802.1q
D. STP
E. SAP

Answer: A D

Question 9

Which switch would STP choose to become the root bridge in the selection process?
A. 32768: 11-22-33-44-55-66
B. 32768: 22-33-44-55-66-77
C. 32769: 11-22-33-44-55-65
D. 32769: 22-33-44-55-66-78

Answer: A

Question 10

Refer to the topology shown in the exhibit. Which ports will be STP designated ports if all the links are operating at the same bandwidth? (Choose three)

A. Switch A – Fa0/0
B. Switch A – Fa0/1
C. Switch B – Fa0/0
D. Switch B – Fa0/1
E. Switch C – Fa0/0
F. Switch C – Fa0/1

Answer: B C D

Explanation

First by comparing their MAC addresses we learn that switch B will be root bridge as it has lowest MAC. Therefore all of its ports are designated ports -> C & D are correct.
On the link between switch A & switch C there must have one designated port and one non-designated (blocked) port. We can figure out which port is designated port by comparing their MAC address again. A has lower MAC so Fa0/1 of switch A will be designated port while Fa0/1 of switch C will be blocked ->  B is correct.

CCNA – Hotspot

Hotspot Routing Question

Question 1:

If the router R1 has a packet with a destination address 192.168.1.255, what describes the operation of the network?
A – R1 will forward the packet out all interfaces
B – R1 will drop this packet because it is not a valid IP address
C – As R1 forwards the frame containing this packet, Sw-A will add 192.168.1.255 to its MAC table
D – R1 will encapsulate the packet in a frame with a destination MAC address of FF-FF-FF-FF-FF-FF
E – As R1 forwards the frame containing this packet, Sw-A will forward it ti the device assigned the IP address of 192.168.1.255

Answer: B

Question 2:

Users on the 192.168.1.0/24 network must access files located on the Server 1. What route could be configured on router R1 for file requests to reach the server?
A – ip route 0.0.0.0 0.0.0.0 s0/0/0
B – ip route 0.0.0.0 0.0.0.0 209.165.200.226
C – ip route 209.165.200.0 255.255.255.0 192.168.1.250
D – ip route 192.168.1.0 255.255.255.0 209.165.100.250

Answer: A

Quetion 3:

When a packet is sent from Host 1 to Server 1, in how many different frames will the packet be encapsulated as it is sent across the internetwork?
A – 0
B – 1
C – 2
D – 3
E – 4

Answer: C or D(depending on your understand, please read the comments to understand why)

Question 4:

What must be configured on the network in order for users on the Internet to view web pages located on Web Server 2?
A – On router R2,configure a default static route to the 192.168.1.0 network
B – On router r2, configure DNS to resolve the URL assigned to Web Server 2 to the 192.168.1.10 address
C – On router R1, configure NAT to translate an address on the 209.165.100.0/24 network to 192.168.1.10
D – On router R1, configure DHCP to assign a registered IP address on the 209.165.100.0/24 network to Web Server 2

Answer: C

Question 5:

The router address 192.168.1.250 is the default gateway for both the Web Server 2 and Host 1. What is the correct subnet mask for this network?
A – 255.255.255.0
B – 255.255.255.192
C – 255.255.255.250
D – 255.255.255.252

Answer: A

Hotspot Frame-relay Question

(In the old days, this question was a multi-choice question but Cisco upgraded it into a lab-sim question. Therefore, instead of listing all the configuration as above, you have to type show frame-relay map and show running-config to get its configuration)
Note: If you are not sure about Frame-Relay, please read my Frame Relay tutorial.

Question 1:

What destination Layer 2 address will be used in the frame header containing a packet for host 172.30.0.4?
A – 704
B – 196
C – 702
D – 344

Answer: C

Question 2:

A static map to the S-AMER location is required. Which command should be used to create this map?
A – frame-relay map ip 172.30.0.3 704 broadcast
B – frame-relay map ip 172.30.0.3 196 broadcast
C – frame-relay map ip 172.30.0.3 702 broadcast
D – frame-relay map ip 172.30.0.3 344 broadcast

Answer: B

Question 3:

Which connection uses the default encapsulation for serial interfaces on Cisco routers?
A – The serial connection to the MidEast branch office
B – The serial connection to the DeepSouth branch office
C – The serial connection to the NorthCentral branch office
D – The serial connection to the Multinational Core

Answer: A

Question 4:

If required, what password should be configured on the router in the MidEast branch office to allow a connection to be established with the Dubai router?
A – No password is required
B – Enable
C – Scr
D – Telnet
E – Console

Answer: A or D (because maybe there are 2 versions of this question, depending on the output of “show running-config” command, please read the explanation below)
Explanation
This question is not clear for a long time but now maybe the trick was solved. What Cisco wants to ask is the word used as password, not the type of connection, so in the exam you might see some strange words for answers like “En8ble”, “T1net”, “C0nsole”. All you have to do is to use the command “show running-config” as wx4 mentioned below to find the answer.
wx4 commented:
Q4: if password required which?
in my example it was connection to North!
How to figure out which pw is required?
#show running-config
1. check the interface to the router you need connection to. If there is “ppp authentication” you need a password!
2. you will find the password on the top of your running-config output
check the area:
username North password c0nsole
username xxxxx yyyyy
username…
in my case it was c0nsole, in your case it can be no password needed or a different password.
If you are still not clear, please read anton‘s comment:
A big question I noticed here was about the FR Lab regarding the password. You have to perform a show running-config and look for USERNAME and PASSWORD.
i.e.
username South_Router password c0nsol3
username North_Router password t31net
Obviously this has to be en PPP encapsulation, if asked for a posible password for SOUTH_ROUTER you pick c0nsol3, and for NORTH_ROUTER you pick t31net. If you’re running HDLC, i would pick “no password is required”.

CCNA – VTP Questions

Question 1

Refer to the exhibit. After SwitchB was added to the network, VLAN connectivity problems started to occur. What caused this problem?

A. Both switches are in server mode in the same domain.
B. The revision number of SwitchB was higher than the revision number of SwitchA.
C. SwitchA was not rebooted prior to adding SwitchB to the network.
D. V2-mode is not enabled.
E. VTP pruning is not activated, so the new paths in the network have not been recalculated.

Answer: B

Explanation

SwitchB has the same VTP Domain Name with SwitchA and it has a higher Configuration Revision number (7 > 1) so it will overwrite VLAN information of SwitchA. Because SwitchB is a new switch so its VLAN information is different from SwitchA -> VLAN connectivity problem occurs.

Question 2

A network administrator is explaining VTP configuration to a new technician. What should the network administrator tell the new technician about VTP configuration? (Choose three)
A. A switch in the VTP client mode cannot update its local VLAN database.
B. A trunk link must be configured between the switches to forward VTP updates.
C. A switch in the VTP server mode can update a switch in the VTP transparent mode.
D. A switch in the VTP transparent mode will forward updates that it receives to other switches.
E. A switch in the VTP server mode only updates switches in the VTP client mode that have a higher VTP revision number.
F. A switch in the VTP server mode will update switches in the VTP client mode regardless of the configured VTP domain membership.

Answer: A B D

Question 3

What are two benefits of using VTP in a switching environment? (Choose two)
A.It allows switches to read frame tags.
B. It allows ports to be assigned to VLANs automatically.
C. It maintains VLAN consistency across a switched network.
D. It allows frames from multiple VLANs to use a single interface.
E. It allows VLAN information to be automatically propagated throughout the switching environment.

Answer: C E

Question 4

What is the name of the VTP mode of operation that enables a switch to forward only VTP advertisements while still permitting the editing of local VLAN information?
A. server
B. client
C. tunnel
D.transparent

Answer: D

Question 5

Which VTP mode is capable of creating only local VLANs and does not synchronize with other switches in the VTP domain?
A. client
B. dynamic
C. server
D. static
E. transparent

Answer: E

Question 6

An administrator is unsuccessful in adding VLAN 50 to a switch. While troubleshooting the problem, the administrator views the output of the show vtp status command, which is displayed in the graphic. What commands must be issued on this switch to add VLAN 50 to the database? (Choose two)

A. Switch(config-if)# switchport access vlan 50
B. Switch(vlan)#vtp server
C. Switch(config)# config-revision 20
D. Switch(config)#vlan 50 name Tech
E. Switch(vlan)# vlan 50
F. Switch(vlan)# switchport trunk vlan 50

Answer: B E

Explanation

First we notice that the “VTP Operating Mode” of this switch is “Client”. In this mode we can’t add new VLAN so we must change to “Server” mode -> B is correct.
Now we can add a new VLAN, E is the correct configuration for adding a new VLAN.

Question 7

To configure the VLAN trunking protocol to communicate VLAN information between two switches, what two requirements must be met? (Choose two)
A. Each end of the trunk line must be set to IEEE 802.1E encapsulation.
B. The VTP management domain name of both switches must be set the same.
C. All ports on both the switches must be set as access ports.
D. One of the two switches must be configured as a VTP server.
E. A rollover cable is required to connect the two switches together.
F. A router must be used to forward VTP traffic between VLANs.

Answer: B D

Explanation

In Cisco switches there are two encapsulations: 802.1q and ISL so we can set two ends to ISL instead -> A is not correct.
The ports between two switches must be set to trunk ports so that they can exchange VLAN information through VTP -> C is not correct.
To connect two switches we can use cross-over cable or straight-through cable (because modern Cisco switches can “auto-sense”) but not rollover cable -> E is not correct.
To forward traffic in the same VLAN (between two or more switches) we can use switches only. If we want to forward VTP traffic between different VLANs we can use either a router or a Layer 3 switch -> F is not correct.
Two switches can only communicate when they are set to the same VTP domain name (and the same VTP password) -> B is correct.
One of the two switches must be set to VTP Server so that it can create VTP updates and advertise its VLAN information.

Question 8

Which statements describe two of the benefits of VLAN Trunking Protocol? (Choose two)
A. VTP allows routing between VLANs.
B. VTP allows a single switch port to carry information to more than one VLAN.
C. VTP allows physically redundant links while preventing switching loops.
D. VTP simplifies switch administration by allowing switches to automatically share VLAN configuration information.
E. VTP helps to limit configuration errors by keeping VLAN naming consistent across the VTP domain.
F. VTP enhances security by preventing unauthorized hosts from connecting to the VTP domain.

Answer: D E

Explanation

The main purposes of VTP are to simplify switch administration and limit VLAN configuration errors by allowing switches to automatically share VLAN configuration information. It doesn’t require the administrator to go to every switch to configure VLANs.
Maybe you will feel F is also a correct answer but it is not true because VTP only enhances security by preventing unauthorized switches (not hosts) from connecting to the VTP domain (by configuring a VTP domain name & VTP password). An unauthorized host can easily use the network cable of an authorized host to access the network.

Question 9

What are two results of entering the Switch(config)#vtp mode client command on a Catalyst switch? (Choose two)
A. The switch will ignore VTP summary advertisements.
B. The switch will forward VTP summary advertisements.
C. The switch will process VTP summary advertisements.
D. The switch will originate VTP summary advertisements.
E. The switch will create, modify and delete VLANs for the entire VTP domain.

Answer: B C

Question 10

Refer to the exhibit. The show vtp status command is executed at a switch that is generating the exhibited output. Which statement is true for this switch?

A. The switch forwards its VLAN database to other switches in the ICND VTP domain.
B. The configuration revision number increments each time the VLAN database is updated,
C. The switch forwards VTP updates that are sent by other switches in the ICND domain,
D. The VLAN database is updated when VTP information is received from other switches.

Answer: C

Explanation

In Transparent mode switch just forwards update sent by other switches without reading it. It doesn’t update its VLAN database so the Configuration Revision doesn’t increase.

CCNA – VLAN Questions 2

Question 1

Which of the following are benefits of VLANs? (Choose three)
A. They increase the size of collision domains.
B. They allow logical grouping of users by function.
C. They can enhance network security.
D. They increase the size of broadcast domains while decreasing the number of collision domains.
E. They increase the number of broadcast domains while decreasing the size of the broadcast domains.
F. They simplify switch administration.

Answer: B C E

Explanation

When using VLAN the number and size of collision domains remain the same -> A is not correct.
VLANs allow to group users by function, not by location or geography -> B is correct.
VLANs help minimize the incorrect configuration of VLANs so it enhances the security of the network -> C is correct.
VLAN increases the size of broadcast domains but does not decrease the number of collision domains -> D is not correct.
VLANs increase the number of broadcast domains while decreasing the size of the broadcast domains which increase the utilization of the links. It is also a big advantage of VLAN -> E is correct.
VLANs are useful but they are more complex and need more administration -> F is not correct.

Question 2

Refer to the diagram. All hosts have connectivity with one another. Which statements describe the addressing scheme that is in use in the network? (Choose three)

A. The subnet mask in use is 255.255.255.192.
B. The subnet mask in use is 255.255.255.128.
C. The IP address 172.16.1.25 can be assigned to hosts in VLAN1
D. The IP address 172.16.1.205 can be assigned to hosts in VLAN1
E. The LAN interface of the router is configured with one IP address.
F. The LAN interface of the router is configured with multiple IP addresses.

Answer: B C F

Explantion

First we should notice that different VLANs must use different sub-networks. In this case Host A (172.16.1.126) and Host B (172.16.1.129) are in different VLANs and must use different sub-networks. Therefore the subnet mask in use here should be 255.255.255.128. In particular, it is 172.16.1.0/25 with 2 sub-networks:
+ Sub-network 1: 172.16.1.0 -> 172.16.1.127 (assigned to VLAN 1)
+ Sub-network 2: 172.16.1.128 -> 172.16.1.255 (assigned to VLAN 2)
-> B is correct.
The IP address 172.16.1.25, which is in the same sub-network with host A so it can be assigned to VLAN 1 -> C is correct.
To make different VLANs communicate with each other we can configure sub-interfaces (with a different IP address on each interface) on the LAN interface of the router -> F is correct.

Question 3

A network associate is trying to understand the operation of the FLD Corporation by studying the network in the exhibit. The associate knows that the server in VLAN 4 provides the necessary resources to support the user hosts in the other VLANs. The associate needs to determine which interfaces are access ports. Which interfaces are access ports? (Choose three)

A. Switch1 – Fa0/2
B. Switch1 – Fa0/9
C. Switch2 – Fa0/3
D. Switch2 – Fa0/4
E. Switch2 – Fa0/8
F. Router – Fa1/0

Answer: A C D

Explanation

Access ports are switch’s ports which are connected to hosts.

Question 4

What are three valid reasons to assign ports to VLANs on a switch? (Choose three)
A. to make VTP easier to implement
B. to isolate broadcast traffic
C. to increase the size of the collision domain
D. to allow more devices to connect to the network
E. to logically group hosts according to function
F. to increase network security

Answer: B E F

Question 5

Which statement is correct about the internetwork shown in the diagram?

A. Switch 2 is the root bridge.
B. Spanning Tree is not running.
C. Host D and Server 1 are in the same network.
D. No collisions can occur in traffic between Host B and Host C.
E. If Fa0/0 is down on Router1, Host A cannot access Server1.
F. If Fa0/1 is down on Switch3, Host C cannot access Server2.

Answer: E

Explanation

Switch 2 cannot be the root bridge because all ports of root bridges are designated ports. In the diagram switch 2 has one blocked port -> It is not the root bridge -> A is not correct.
Because Switch 2 has a blocked port so surely Spanning Tree Protocol is running -> B is not correct.
Host D belongs to VLAN 2 while Server 1 belongs to VLAN 3 so they are not in the same network  -> C is not correct.
Host B & host C are connected through a hub so they are in the same collision domain and collision can occur -> D is not correct.
We need a router to allow different VLANs to communicate with each other. This router is called “router on a stick”. In this case it is Router1. The link between Router1 and Switch1 is configured as trunk link. If this link is down, different VLANs cannot communicate with each other -> E is correct.
If Fa0/1 is down on Switch3, Spanning Treel Protocol will “open” the blocked port on Switch 2 can Host C can access Server 2 through HostC -> Hub1 -> Switch2 -> Switch1 -> Router1-> Switch1 -> Server2 (notice that it must go through Router1 because they are in different VLANs). So F is not correct.

Question 6

Refer to the exhibit. Which of these statements correctly describes the state of the switch once the boot process has been completed?

A. As FastEthernet0/12 will be the last to come up, it will not be blocked by STP.
B. Remote access management of this switch will not be possible without configuration change.
C. More VLANs will need to be created for this switch.
D. The switch will need a different IOS code in order to support VLANs and STP.

Answer: B

Explanation

From the output we notice that the administrator has just shut down Interface Vlan1, which is the default VLAN so no one can access it remotely (like telnet) -> B is correct.
Answer A is not correct as STP calculation does not depend on which port comes up first or last. STP recalculates when there is a change in the network.
A normal switch can operate without VLAN -> C is not correct.
This IOS does support VLAN because it has VLAN 1 on it -> D is not correct.

CCNA – VLAN Questions

Question 1

Refer to the exhibit. A network associate needs to configure the switches and router in the graphic so that the hosts in VLAN3 and VLAN4 can communicate with the enterprise server in VLAN2. Which two Ethernet segments would need to be configured as trunk links? (Choose two)

A. A
B. B
C. C
D. D
E. E
F. F

Answer: C F

Explanation

The link between the switches and the link between switch & router should be configured as trunks. Other links (connected to hosts) should be configured as access links.

Question 2

Which three statements are typical characteristics of VLAN arrangements? (Choose three)
A. A new switch has no VLANs configured.
B. Connectivity between VLANs requires a Layer 3 device.
C. VLANs typically decrease the number of collision domains.
D. Each VLAN uses a separate address space.
E. A switch maintains a separate bridging table for each VLAN.
F. VLANs cannot span multiple switches.

Answer: B D E

Explanation

By default, all ports on a new switch belong to VLAN 1 (default & native VLAN). There are also some well-known VLANs (for example: VLAN 1002 for fddi-default; VLAN 1003 for token-ring…) configured by default -> A is not correct.
To communicate between two different VLANs we need to use a Layer 3 device like router or Layer 3 switch -> B is correct.
VLANs don’t affect the number of collision domains, they are the same -> C is not correct. Typically, VLANs increase the number of broadcast domains.
We must use a different network (or sub-network) for each VLAN. For example we can use 192.168.1.0/24 for VLAN 1, 192.168.2.0/24 for VLAN 2 -> D is correct.
A switch maintains a separate bridging table for each VLAN so that it can send frame to ports on the same VLAN only. For example, if a PC in VLAN 2 sends a frame then the switch look-ups its bridging table and only sends frame out of its ports which belong to VLAN 2 (it also sends this frame on trunk ports) -> E is correct.
We can use multiple switches to expand VLAN -> F is not correct.

Question 3

By default, each port in a Cisco Catalyst switch is assigned to VLAN1. Which two recommendations are key to avoid unauthorized management access? (Choose two)
A. Create an additional ACL to block the access to VLAN 1.
B. Move the management VLAN to something other than default.
C. Move all ports to another VLAN and deactivate the default VLAN.
D. Limit the access in the switch using port security configuration.
E. Use static VLAN in trunks and access ports to restrict connections.
F. Shutdown all unused ports in the Catalyst switch.

Answer: B F

Question 4

Which two benefits are provided by creating VLANs? (Choose two)
A. added security
B. dedicated bandwidth
C. provides segmentation
D. allows switches to route traffic between subinterfaces
E. contains collisions

Answer: A C

Question 5

Which two link protocols are used to carry multiple VLANs over a single link? (Choose two)
A. VTP
B. 802.1q
C. IGP
D. ISL
E. 802.3u

Answer: B D

Explanation

Cisco switches support two trunking protocols 802.1q & ISL. 802.1q is an open standard and is thus compatible between most vendors’ equipment while Inter-Switch Link (ISL) is Cisco proprietary.

Question 6

A switch is configured with all ports assigned to vlan 2 with full duplex FastEthernet to segment existing departmental traffic. What is the effect of adding switch ports to a new VLAN on the switch?
A. More collision domains will be created.
B. IP address utilization will be more efficient.
C. More bandwidth will be required than was needed previously.
D. An additional broadcast domain will be created.

Answer: D

Question 7

Which two statements about the use of VLANs to segment a network are true? (Choose two)
A. VLANs increase the size of collision domains.
B. VLANs allow logical grouping of users by function.
C. VLANs simplify switch administration.
D. VLANs enhance network security.

Answer: B D

Question 8

Cisco Catalyst switches CAT1 and CAT2 have a connection between them using ports Fa0/13. An 802.1Q trunk is configured between the two switches. On CAT1, VLAN 10 is chosen as native, but on CAT2 the native VLAN is not specified. What will happen in this scenario?
A. 802.1Q giants frames could saturate the link.
B. VLAN 10 on CAT1 and VLAN 1 on CAT2 will send untagged frames.
C. A native VLAN mismatch error message will appear.
D. VLAN 10 on CAT1 and VLAN 1 on CAT2 will send tagged frames.

Answer: C

Explanation

A “native VLAN mismatch” error will appear by CDP if there is a native VLAN mismatch on an 802.1Q link. “VLAN mismatch” can cause traffic from one vlan to leak into another vlan.

Question 9

Which two statements describe the Cisco implementation of VLANs? (Choose two)
A. VLAN 1 is the default Ethernet VLAN.
B. CDP advertisements are only sent on VLAN 1002.
C. By default, the management VLAN is VLAN 1005.
D. By default, the switch IP address is in VLAN 1005.
E. VLANs 1002 through 1005 are automatically created and cannot be deleted.

Answer: A E

Question 10

What are three advantages of VLANs? (Choose three)
A. VLANs establish broadcast domains in switched networks.
B. VLANs utilize packet filtering to enhance network security.
C. VLANs provide a method of conserving IP addresses in large networks.
D. VLANs provide a low-latency internetworking alternative to routed networks.
E. VLANs allow access to network services based on department, not physical location.
F. VLANs can greatly simplify adding, moving, or changing hosts on the network.

Answer: A E F

CCNA – Switch Questions 3

Question 1

Which of the following are true regarding bridges and switches? (Choose two)
A. Bridges are faster than switches because they have fewer ports.
B. A switch is a multiport bridge.
C. Bridges and switches learn MAC addresses by examining the source MAC address of each frame received.
D. A bridge will forward a broadcast but a switch will not.
E. Bridges and switches increase the size of a collision domain.

Answer: B C

Question 2

Which two commands correctly verily whether port security has been configured on port FastEthernet 0/12 on a switch? (Choose two)
A. SW1# show switchport port-security interface FastEthernet 0/12
B. SW1# show switchport port-secure interface FastEthernet 0/12
C. SW1# show port-security interface FastEthernet 0/12
D. SW1# show running-config

Answer: C D

Explanation

We can verify whether port security has been configured by using the “show running-config” or “show port-security interface ” for more detail. An example of the output of “show port-security interface ” command is shown below:

Question 3

Assuming the default switch configuration which vlan range can be added modified and removed on a Cisco switch?
A. 2 through 1001
B. 1 through 1001
C. 1 through 1002
D. 2 through 1005

Answer: A

Explanation

VLAN 1 is the default VLAN on Cisco switch. It always exists and can not be added, modified or removed.
VLANs 1002-1005 are default VLANs for FDDI & Token Ring and they can’t be deleted or used for Ethernet.

Question 4

Refer to the exhibit. This command is executed on 2960Switch:
2960Switch(config)# mac-address-table static 0000.00aa.aaaa vlan 10 interface fa0/1
Which two of these statements correctly identify results of executing the command? (Choose two)

A. Port security is implemented on the fa0/1 interface.
B. MAC address 0000.00aa.aaaa does not need to be learned by this switch.
C. Only MAC address0000.00aa.aaaa can source frames on the fa0/1 segment.
D. Frames with a Layer 2 source address of 0000.00aa.aaaa will be forwarded out fa0/1.
E. MAC address 0000.00aa.aaaa will be listed in the MAC address table for interface fa0/1 only.

Answer: B E

Explanation

The above command adds the MAC address 0000.00aa.aaaa to the MAC address table of the switch. This is called static MAC address. Static addresses have the following characteristics:
* Static addresses will not be removed from the address table when a given interface link is down.
* Static addresses are bound to the assigned interface and will not be moved. When a static address is seen on another interface, the address will be ignored and will not be written to the address table.
* A static address cannot be learned on another port until the address is removed with the no form of this command.
Static MAC address is not a Port Security feature -> A is not correct.
If the MAC address 0000.00aa.aaaa is seen again (on fa0/1 or other ports), it does not need to be learned because it already exists in the MAC address table of the switch -> B is correct.
Although configured with a static MAC address, switch can still learn other MAC addresses dynamically -> C is not correct.
Frames with a Layer 2 destination address (not source address) of 0000.00aa.aaaa will be forwarded out fa0/1 -> D is not correct.

Question 5

Which set of commands is recommended to prevent the use of a hub in the access layer?
A.
switch(config-if)#switchport mode trunk
switch(config-if)#switchport port-security maximum 1
B.
switch(config-if)#switchport mode trunk
switch(config-if)#switchport port-security mac-address 1
C.
switch(config-if)#switchport mode access
switch(config-if)#switchport port-security maximum 1
D.
switch(config-if)#switchport mode access
switch(config-if)#switchport port-security mac-address 1

Answer: C

Explanation

Port security is only used on access port (which connects to hosts) so we need to set that port to “access” mode, then we need to specify the maximum number of hosts which are allowed to connect to this port -> C is correct.
Note: If we want to allow a fixed MAC address to connect, use the “switchport port-security mac-address ” command.

Question 6

A Catalyst 2950 needs to be reconfigured. What steps will ensure that the old configuration is erased? (Choose three)
A. Erase flash.
B. Restart the switch.
C. Delete the VLAN database.
D. Erase the running configuration.
E. Erase the startup configuration.
F. Modify the configuration register.

Answer: B C E

Question 7

The network administrator has discovered that the power supply has failed on a switch in the company LAN and that the switch has stopped functioning. It has been replaced with a Cisco Catalyst 2950 series switch. What must be done to ensure that this new switch becomes the root bridge on the network?
A. Lower the bridge priority number.
B. Change the MAC address of the switch.
C. Increase the VTP revision number for the domain.
D. Lower the root path cost on the switch ports.
E. Assign the switch an IP address with the lowest value.

Answer: A

Question 8

Which two of these are characteristics of the 802.1Q protocol? (Choose two)
A. It is a layer 2 messaging protocol which maintains vlan configurations across network.
B. It includes an 8-bit field which specifies the priority of a frame.
C. It is used exclusively for tagging vlan frames and dose not address network reconvergence following switched network topology changes.
D. It modifies the 802.3 frame header and thus requires that the FCS be recomputed.
E. It is a trunking protocol capable of earring untagged frames.

Answer: D E

Explanation

IEEE 802.1Q is the networking standard that supports Virtual LANs (VLANs) on an Ethernet network. It is a protocol that allows VLANs to communicate with one another using a router. 802.1Q trunks support tagged and untagged frames.
If a switch receives untagged frames on a trunk port, it believes that frame is a part of the native VLAN. Also, frames from a native VLAN are not tagged when exiting the switch via a trunk port.
The 802.1q frame format is same as 802.3. The only change is the addition of 4 bytes fields. That additional header includes a field with which to identify the VLAN number. Because inserting this header changes the frame, 802.1Q encapsulation forces a recalculation of the original FCS field in the Ethernet trailer.
Note: Frame Check Sequence (FCS) is a four-octet field used to verify that the frame was received without loss or error. FCS is based on the contents of the entire frame.

Question 9

What are two advantages of Layer 2 Ethernet switches over hubs? (Choose two)
A. decreasing the number of collision domains
B. filtering frames based on MAC addresses
C. allowing simultaneous frame transmissions
D. increasing the size of broadcast domains
E. increasing the maximum length of UTP cabling between devices

Answer: B C

Explanation

Hub is considered a layer 1 device. When a packet arrives at one port, it is copied to the other ports without checking the content of that packet.
Switch operates at layer 2. When a packet arrives at one port, it checks in its database (based on MAC address) to see which port it should forward that packet out -> B is correct.
Remember that hubs can only communicate in half duplex mode, which means that a computer can only send data when it is not receiving. Switches can run in full duplex mode, which allows data to be sent and received at the same time. Switches effectively double the speed of the network when compared to hubs -> C is correct.
Switch increases the number of collision domains (which is better) -> A is not correct.
Switch does not have any effect on the size of broadcast domains. When using switch, the size of broadcast domains remain the same -> D is not correct.
Both hub and switch increase the maximum length of UTP cabling between devices so it is not an advantage of switch over hub -> E is not correct.

Question 10

Which command will show the MAC addresses of stations connected to switch ports?
A. show mac-address
B. show arp
C. show table
D. show switchport

Answer: B

Explanation

There is no “show mac-address” command. But notice the “show mac-address-table” and “show mac address-table” do exist.
If option A is “show mac-address-table” then both A & B are correct!

CCNA – Switch Questions 2

Question 1

In which circumstance are multiple copies of the same unicast frame likely to be transmitted in a switched LAN?
A. after broken links are re-established
B. in an improperly implemented redundant topology
C. when upper-layer protocols require high reliability
D. during high traffic periods
E. when a dual ring topology is in use

Answer: B

Explanation

If we connect two switches via 2 or more links and do not enable STP on these switches then a loop (which creates multiple copies of the same unicast frame) will occur. It is an example of an improperly implemented redundant topology.

Question 2

An administrator would like to configure a switch over a virtual terminal connection from locations outside of the local LAN. Which of the following are required in order for the switch to be configured from a remote location? (Choose two)
A. The switch must be configured with an IP address, subnet mask, and default gateway.
B. The switch must be connected to a router over a VLAN trunk.
C. The switch must be reachable through a port connected to its management VLAN.
D. The switch console port must be connected to the Ethernet LAN.
E. The switch management VLAN must be created and have a membership of at least one switch port.
F. The switch must be fully configured as an SNMP agent.

Answer: A C

Explanation

In order to remote access to a switch from outside of the local LAN (in a different subnet) we have to:
+ Configure an IP address on a VLAN on that switch, this VLAN is known as the management VLAN (it is usually VLAN 1)
+ Specify the default gateway for that switch so that it can send traffic to this gateway
Below shows an example of configuring remote access for a switch (suppose the management VLAN on the switch is 192.168.1.10/24 and the default-gateway IP address is 192.168.1.254)
Switch(config)#ip default-gateway 192.168.1.254
Switch(config)#interface vlan 1
Switch(config)#ip address 192.168.1.10 255.255.255.0
Switch(config)#no shutdown

Question 3

Refer to the exhibit. A junior network administrator was given the task of configuring port security on SwitchA to allow only PC_A to access the switched network through port fa0/1. If any other device is detected, the port is to drop frames from this device. The administrator configured the interface and tested it with successful pings from PC_A to RouterA, and then observes the output from these two show commands.

Which two of these changes are necessary for SwitchA to meet the requirements? (Choose two)
A. Port security needs to be globally enabled.
B. Port security needs to be enabled on the interface.
C. Port security needs to be configured to shut down the interface in the event of a violation.
D. Port security needs to be configured to allow only one learned MAC address.
E. Port security interface counters need to be cleared before using the show command.
F. The port security configuration needs to be saved to NVRAM before it can become active.

Answer: B D

Explanation

As we see in the output, the “Port Security” is in “Disabled” state (line 2 in the output). To enable Port security feature, we must enable it on that interface first with the command:
SwitchA(config-if)#switchport port-security
-> B is correct.
Also from the output, we learn that the switch is allowing 2 devices to connect to it (switchport port-security maximum 2) but the question requires allowing only PC_A to access the network so we need to reduce the maximum number to 1 -> D is correct.

Question 4

A company implements video conferencing over IP on their Ethernet LAN. The users notice that the network slows down, and the video either stutters or foils completely. What is the most likely reason for this?
A. minimum cell rate (MCR)
B. quality of service (QoS)
C. modulation
D. packet switching exchange (PSE)
E. reliable transport protocol (RTP)

Answer: B

Explanation

If the QoS is not configured correctly on the network (for example configure your network’s bandwidth below the bandwidth assigned by your ISP) can slow down all your traffic.

Question 5

Computer 1 is consoles into switch A. Telnet connections and pings run from the command prompt on switch A fail. Which of the following could cause this problem?

A. switch A does not have a cdp entry for switch B or router JAX
B. switch A does not have an IP address
C. port 1 on switch A should be an access port rather than a trunk port
D. switch A is not directly connected to router JAX
E. switch A does not have a default gateway assigned

Answer: B

Explanation

It’s a hard question to answer although it looks simple! From the output above we are sure that switch A does not have an IP address (on both Fa0/1 and on VLAN 1) so it can not ping or telnet to any other device -> B is correct.
Another answer seems to be correct is answer E – switch A does not have a default gateway assigned. We know that Switch A can not telnet to other device outside its subnet without having a default gateway. But the question only says “Telnet connections and pings run from the command prompt on switch A fail” without telling us where Switch A is trying to telnet or ping to. If it tries to connect to the outside network then E is correct. If it only want to connect to a device inside its subnet then a default gateway is not necessary.
So the best answer for this question is B!

Question 6

Refer to the exhibit. Give this output for SwitchC, what should the network administrator’s next action be?

A. Check the trunk encapsulation mode for SwitchC’s fa0/1 port.
B. Check the duplex mode for SwitchC’s fa0/1 port.
C. Check the duplex mode for SwitchA’s fa0/2 port.
D. Check the trunk encapsulation mode for SwitchA’s fa0/2 port.

Answer: C

Question 7

Refer to the graphic

A host is connected to switch port Fa0/3 with a crossover cable. However, the port indicator on switch port Fa0/3 is not on, and the host can not communicate with hosts that belong to VLAN2 on the same switch. Based on the information given, where is the problem?
A. The switch has been assigned an incorrect subnet mask T1
B. Switch port Fa0/3 is not configured as a trunk port
C. Switch port Fa0/3 has been blocked by STP
D. The switch and the hosts must be in the same subnet
E. The cable type is wrong

Answer: E

Explanation

To specify when we use crossover cable or straight-through cable, we should remember:
Group 1: Router, Host, Server
Group 2: Hub, Switch
One device in group 1 + One device in group 2: use straight-through cable
Two devices in the same group: use crossover cable
In this case we connect a switch and a host so we need a straight-through cable -> E is correct.

Question 8

Refer to the exhibit. Some 2950 series switches are connected to the conference area of the corporate headquarters network. The switches provide two to three jacks per conference room to host laptop connections for employees who visit the headquarters office. When large groups of employees come from other locations, the network administrator often finds that hubs have been connected to wall jacks in the conference area although the ports on the access layer switches were not intended to support multiple workstations.
What action could the network administrator take to prevent access by multiple laptops through a single switch port and still leave the switch functional for its intended use?

A. Configure static entries in the switch MAC address table to include the range of addresses used by visiting employees.
B. Configure an ACL to allow only a single MAC address to connect to the switch at one time.
C. Use the mac-address-table 1 global configuration command to limit each port to one source MAC address.
D. Implement Port Security on all interfaces and use the port-security maximum 1 command to limit port access to a single MAC address
E. Implement Port Security on all interfaces and use the port-security mac-address sticky command to limit access to a single MAC address
F. Implement Port Security at global configuration mode and use the port-security maximum 1 command to allow each switch only one attached hub

Answer: D

Explanation

The Port Security filters frames based on its MAC so it can effectively prevent people connecting to the switch via hubs.

Question 9

Which of the following statements are true regarding bridges and switches? (Choose 3)
A. Switches are primarily software based while bridges are hardware based.
B. Both bridges and switches forward Layer 2 broadcasts.
C. Bridges are frequently faster than switches.
D. Switches have a higher number of ports than most bridges.
E. Bridges define broadcast domains while switches define collision domains.
F. Both bridges and switches make forwarding decisions based on Layer 2 addresses.

Answer: B D F

Question 10

A network administrator must configure 200 switch ports to accept traffic from only the currently attached host devices. What would be the most efficient way to configure MAC-level security on all these ports?
A. Visually verify the MAC addresses and then telnet to the switches to enter the switchport-port security mac-address command.
B. Have end users e-mail their MAC addresses. Telnet to the switch to enter the switchport-port security mac-address command.
C. Use the switchport port-security MAC address sticky command on all the switch ports that have end devices connected to them.
D. Use show mac-address-table to determine the addresses that are associated with each port and then enter the commands on each switch for MAC address port-security.

Answer: C

Explanation

We can use the “interface range” command (for example “interface range FastEthernet 0/1 – 48″) to configure many ports as the same time and use the “port-security MAC address sticky” command (without a specific MAC address) to dynamically learn the attached MAC Address and place it into the switch’s running-configuration -> C is correct.

CCNA – Switch Questions

Question 1

Which two commands can be used to verify a trunk link configuration status on a Cisco switch? (choose two)
A. show interfaces trunk
B. show interfaces switchport
C. show ip interface brief
D. show interfaces vlan

Answer: A B

Explanation

The “show interfaces trunk” command and “show interfaces switchport” command can be used to verify the status of an interface (trunking or not). The outputs of these commands are shown below (port Ethernet 1/0 has been configured as trunk):

The “show ip interface brief” command only gives us information about the IP address, the status (up/down) of an interface:

The “show interfaces vlan” command only gives us information about that VLAN, not about which ports are the trunk links:

Question 2

Refer to the exhibit. The following commands are executed on interface fa0/1 of 2950Switch.
2950Switch(config-if)#switchport port-security
2950Switch(config-if)#switchport port-security mac-address sticky
2950Switch(config-if)#switchport port-security maximum 1
The Ethernet frame that is shown arrives on interface fa0/1. What two functions will occur when this frame is received by 2950Switch? (Choose two)

A. The MAC address table will now have an additional entry of fa0/1 FFFF.FFFF.FFFF.
B. Only host A will be allowed to transmit frames on fa0/1.
C. This frame will be discarded when it is received by 2950Switch.
D. All frames arriving on 2950Switch with a destination of 0000.00aa.aaaa will be forwarded out fa0/1.
E. Hosts B and C may forward frames out fa0/1 but frames arriving from other switches will not be forwarded out fa0/1.
F. Only frames from source 0000.00bb.bbbb, the first learned MAC address of 2950Switch, will be forwarded out fa0/1.

Answer: B D

Question 3

Which Cisco Catalyst feature automatically disables the port in an operational PortFast upon receipt of a BPDU?
A. BackboneFast
B. UplinkFast
C. Root Guard
D. BPDU Guard
E. BPDU Filter

Answer: D

Explanation

We only enable PortFast feature on access ports (ports connected to end stations). But if someone does not know he can accidentally plug that port to another switch and a loop may occur when BPDUs are being transmitted and received on these ports.
With BPDU Guard, when a PortFast receives a BPDU, it will be shut down to prevent a loop -> D is correct.

Question 4

Why will a switch never learn a broadcast address?
A. Broadcast frames are never sent to switches.
B. Broadcast addresses use an incorrect format for the switching table.
C. A broadcast address will never be the source address of a frame.
D. Broadcasts only use network layer addressing.
E. A broadcast frame is never forwarded by a switch.

Answer: C

Question 5

Which three statements accurately describe layer 2 Ethernet switches? (choose three)
A. Microsegmentation decreases the number of collisions on the network.
B. If a switch receives a frame for an unknown destination.it uses ARP to resolve the address.
C. Spanning Tree Protocol allows switches to automatically share vlan information.
D. In a property functioning network with redundant switched paths, each switched segment will contain one root bridge with all its ports in the forwarding state. All other switches in that broadcast domain will have only one root port.
E. Establishing vlans increases the number of broadcast domains.
F. Switches that are configured with vlans make forwarding decisions based on both layer 2 and layer 3 address information.

Answer: A D E

Question 6

Switch ports operating in which two roles will forward traffic according to the IEEE 802.1w standard? (Choose two)
A. alternate
B. backup
C. designated
D. disabled
E. root

Answer: C E

Explanation

IEEE 802.1w is the standard of Rapid Spanning Tree Protocol (RSTP). There are 5 port roles in this standard: Root port, Designated port, Alternative port, Backup port and Disabled port. In these 5 port roles, only Root port and Designated port can forward traffic.

Question 7

Select the action that results from executing these commands:
Switch(config-if)# switchport port-security
Switch(config-if)# switchport port-security mac-address sticky
A. A dynamically learned MAC address is saved in the startup-configuration file.
B. A dynamically learned MAC address is saved in the running-configuration file.
C. A dynamically learned MAC address is saved in the VLAN database.
D. Statically configured MAC addresses are saved in the startup-configuration file if frames from that address are received.
E. Statically configured MAC addresses are saved in the running-configuration file if frames from that address are received.

Answer: B

Explanation

The full syntax of the second command is:
switchport port-security mac-address sticky [MAC]
If we don’t specify the MAC address (like in this question) then the switch will dynamically learn the attached MAC Address and place it into your running-configuration -> B is correct.

Question 8

What is valid reason for a switch to deny port access to new devices when port security is enabled?
A. The denied MAC addresses have already been learned or configured on another secure interface in the same VLAN.
B. The denied MAC address are statically configured on the port.
C. The minimum MAC threshold has been reached.
D. The absolute aging times for the denied MAC addresses have expired.

Answer: A

Explanation

A security violation occurs in either of these situations:
* When the maximum number of secure MAC addresses is reached on a secure port and the source MAC address of the ingress traffic is different from any of the identified secure MAC addresses, port security applies the configured violation mode.
* If traffic with a secure MAC address that is configured or learned on one secure port attempts to access another secure port in the same VLAN, applies the configured violation mode.
From the second statement we can figure out A is the correct answer. But for your information we will discuss other answers as well.
Answer B is not correct because we can’t configured which MAC address will be denied. We can only configure which MAC is allowed.
We can only configure the maximum MAC threshold, not the minimum threshold -> C is not correct.
The aging times are only configured for allowed MAC addresses, not for denied MAC -> D is correct.
For your information about aging time:
When the aging type is configured with the absolute keyword, all the dynamically learned secure addresses age out when the aging time expires
This is how to configure the secure MAC address aging type on the port:
Router(config-if)# switchport port-security aging type absolute
and configure the aging time (aging time = 120 minutes)
Router(config-if)# switchport port-security aging time 120
When this command is used, all the dynamically learned secure addresses age out when the aging time expires

Question 9

A network administrator needs to configure port security on a switch. Which two statements are true? (Choose two)
A. The network administrator can apply port security to dynamic access ports
B. The network administrator can configure static secure or sticky secure mac addresses in the voice vlan.
C. The sticky learning feature allows the addition of dynamically learned addresses to the running configuration.
D. The network administrator can apply port security to EtherChannels.
E. When dynamic mac address learning is enabled on an interface, the switch can learn new addresses up to the maximum defined.

Answer: C E

Question 10

Refer to the exhibit. Which statement is true?

A. The Fa0/11 role confirms that SwitchA is the root bridge for VLAN 20.
B. VLAN 20 is running the Per VLAN Spanning Tree Protocol.
C. The MAC address of the root bridge is 0017.596d.1580.
D. SwitchA is not the root bridge, because not all of the interface roles are designated.

Answer: D

Explanation

Only non-root bridge can have root port. Fa0/11 is the root port so we can confirm this switch is not the root bridge -> A is not correct.
From the output we learn this switch is running Rapid STP, not PVST -> B is not correct.
0017.596d.1580 is the MAC address of this switch, not of the root bridge. The MAC address of the root bridge is 0017.596d.2a00 -> C is not correct.
All of the interface roles of the root bridge are designated. SwitchA has one Root port and 1 Alternative port so it is not the root bridge -> D is correct.

Question 11

A technician has installed SwithchB and needs to configure it for remote access from the management workstation connected SwitchA. Which set of commands is required to accomplish this task?
A.
SwitchB(config)#interface FastEthernet 0/1
SwitchB(config)#ip address 192.168.8.252 255.255.255.0
SwitchB(config)#no shutdown
B.
SwitchB(config)#ip default-gateway 192.168.8.254
SwitchB(config)#interface vlan 1
SwitchB(config)#ip address 192.168.8.252 255.255.255.0
SwitchB(config)#no shutdown
C.
SwitchB(config)#interface vlan 1
SwitchB(config)#ip address 192.168.8.252 255.255.255.0
SwitchB(config)#ip default-gateway 192.168.8.254 255.255.255.0
SwitchB(config)#no shutdown
D.
SwitchB(config)#ip default-network 192.168.8.254
SwitchB(config)#interface vlan 1
SwitchB(config)#ip address 192.168.8.252 255.255.255.0
SwitchB(config)#no shutdown

Answer: B

Explanation

To remote access to SwitchB, it must have a management IP address on a VLAN on that switch. Traditionally, we often use VLAN 1 as the management VLAN (but in fact it is not secure).
In the exhibit, we can recognize that the Management Workstation is in a different subnet from the SwitchB. For intersubnetwork communication to occur, you must configure at least one default gateway. This default gateway is used to forward traffic originating from the switch only, not to forward traffic sent by devices connected to the switch.

Question 12

A network administrator wants to ensure that only the server can connect to port Fa0/1 on a Catalyst switch. The server is plugged into the switch Fa0/1 port and the network administrator is about to bring the server online. What can the administrator do to ensure that only the MAC address of the server is allowed by switch port Fa0/1? (Choose two)
A. Configure port Fa0/1 to accept connections only from the static IP address of the server.
B. Employ a proprietary connector type on Fa0/1 that is incompatible with other host connectors.
C. Configure the MAC address of the server as a static entry associated with port Fa0/1.
D. Bind the IP address of the sewer to its MAC address on the switch to prevent other hosts from spoofing the server IP address.
E. Configure port security on Fa0/1 to reject traffic with a source MAC address other than that of the server.
F. Configure an access list on the switch to deny server traffic from entering any port other than Fa0/1.

Answer: C E

Explanation

We can”configure the MAC address of the server as a static entry associated with port Fa0/1″ with this command:
Switch(config-if)#switchport port-security mac-address sticky 0000.00AA.AAAA.AAAA
and “configure port security on Fa0/1 to reject traffic with a source MAC address other than that of the server” with these commands:
Switch(config-if)#switchport port-security maximum 1 (only allow 1 MAC address and that is the static MAC address)
Also we often define what will the switch do if the security is violated:
Switch(config-if)#switchport port-security violation shutdown

Question 13

The network security policy requires that only one host be permitted to attach dynamically to each switch interface. If that policy is violated, the interface should shut down. Which two commands must the network administrator configure on the 2950 Catalyst switch to meet this policy? (Choose two)
A. Switch1(config-if)#switchport port-security maximum 1
B. Switch1(config)#mac-address-table secure
C. Switch1(config)#access-list 10 permit ip host
D. Switch1(config-if)#switchport port-security violation shutdown
E. Switch1(config-if)#ip access-group 10

Answer: A D

CCNA – Drag and Drop 5

Question 1

Drag the Cisco default administrative distance to the appropriate routing protocol or route (Not all options are used)

Answer:

+ RIP: 120
+ OSPF: 110
+ static route referencing IP address of next hop: 1
+ internal EIGRP route: 90
+ directly connected network: 0

Question 2

Drag the term on the left to its definition on the right (not all options are used)

Answer:

+ poison reverse: A router learns from its neighbor that a route is down and the router sends an update back to the neighbor with an infinite metric to that route
+ LSA: The packets flooded when a topology change occurs, causing network routers to update their topological databases and recalculate routes
+ split horizon: This prevents sending information about a routeback out the same interface that originally learned about the route
+ holddown timer: For a given period, this causes the router to ignore any updates with poorer metrics to a lost network

Question 3

Drag the description on the left to the correct router mode on the right

Answer:

+ user EXEC mode: limited to basic monitoring commands
+ privileged EXEC mode: provide access to all other router commands
+ global configuration mode: commands that affect the entire system
+ specific configuration mode: commands that affect interfaces/processes only
+ setup mode: interactive configuration dialog

Question 4

Drag each definition on the left to the matching term on the right

Answer:

+ cost: a configurable value based by default on the bandwidth of the interface
+ load: the amount of activity on a network resource
+ bandwidth: the data capacity of a link
+ hop count: the number of point-to-point links in a transmission path
+ reliability: usually refers to the bit error rate of each network link
+ delay: the amount of time required to move a packet from source to destination

CCNA – Drag and Drop 4

Question 1

Drag the function on the left to the matching security appliance or application on the right. (Not all functions are used)

Answer:

1) antispyware: detects software designed to capture sensitive information and removes it from the computer
2) antivirus: prevents known malicious programs from being installed on workstations
3) IDS: identifies malicious network traffic and alerts network personnel
4) firewall: filters traffic based on source and destination IP address or traffic type

Question 2

Drag the Frame Relay acronym on the left to match its definition on the right. (Not all acronyms are used)

Answer:

1) a router is this type of device: DTE
2) the most common type of virtual circuit: PVC
3) provides status messages between DTE and DCE devices: LMI
4) identifies the virtual connection between the DTE and the switch: DLCI

Question 3

The left describes some types of connections while the right describes some types of cables. Drag the items on the left to the proper locations.

Answer:

Explanation:

To specify when we use crossover cable or straight-through cable, we should remember:
Group 1: Router, Host(PC), Server
Group 2: Hub, Switch
One device in group 1 + One device in group 2: use straight-through cable
Two devices in the same group: use crossover cable
For example: we use straight-through cable to connect switch to router, switch to host, hub to host, hub to server… and we use crossover cable to connect switch to switch, switch to hub, router to router, host to host… ).
+ We can connect a modem to router auxiliary port using a rollover cable. Recall that the purpose of the router’s auxiliary port is for connecting to a modem and most Cisco routers have a second port on the back called the auxiliary port. We can use this port in case of a far-away router goes down, the administrator can have someone in the area go to the router, plug in a modem and access to the router remotely (if using the console port, we have to go to the site to work with that router).
+ We can connect a PC serial port to a switch/router console port through the RJ-45 to DB-9 or RJ-45 to DB-25 adapter (at the PC end), depending on the computer.

Question 4

The above provides some descriptions, while the below provides some routing protocols. Drag the above items to the proper locations.

Answer:

Explanation:

Enhanced Interior Gateway Routing Protocol (EIGRP) is a Cisco proprietary routing protocol, so it is vendor-specific. By default, EIGRP internal routes have an administrative distance value of 90.
OSPF uses cost as its metric. By default, the cost of an interface is calculated based on bandwidth with the formula cost= 10000 0000/bandwith (in bps). OSPF elects a DR on each broadcast and nonbroadcast multiaccess networks (like Ethernet and Frame Relay environments, respectively). It doesn’t elect a DR on point-to-point link (like a serial WAN).

Question 5

As a CCNA candidate, you are required to have a firm understanding of the OSI model. At which layers of the OSI model do Wide Area Networks operate in? Please drag the items to the proper locations.

Answer:

Explanation

WAN operates in the two lowest layers which are Data Link and Physical layers.

CCNA – Drag and Drop 3

Question 1

Drag the security features on the left to the specific security risks they help protect against on the right. (Not all options are used)

Answer:

1) VTY password: remote access to device console
2) console password: access to the console 0 line
3) access-group: access to connected networks or resources
4) service password-encryption: viewing of passwords
5) enable secret: access to privileged mode
The unselected left-box – CHAP – is used to verify the identity of the peer by means of a three-way handshake.

Question 2

Refer to the exhibit. PC-A is sending packets to the FTP server. Consider the packets as they leave RA interface Fa0/0 forwards RB. Drag the correct frame and packet address to their places in the table.

Answer:

Source MAC: 0000.0C93.9999
Destination MAC: 0000.0C89.3333
Source IP: 172.16.21.7
Destination IP: 172.16.34.250

Explanation

Remember these rules:
The IP addresses (of source and destination) of a packet never change during the transportation through the network. For example if PC-A wants to send a packet to PC-Z then the source and destination IP addresses of the packet will be the IP addresses of PC-A and PC-Z no matter how many devices they go through.
The MAC addresses, conversely, will change while passing the devices. The source MAC address is the address of the last sender and the destination MAC address is the address of the next device.

Question 3

As a network administrator, you are required to configure the network security policy. And the policy requires that only one host be permitted to attach dynamically to each switch interface. If that policy is violated, the interface should shut down. Which two commands must the network administrator configure on the 2950 Catalyst switch to meet this policy? Please choose appropriate commands and drag the items to the proper locations.

Answer:

Appropriate commands:
SW(config-if)# switchport port-security maximum 1
SW(config-if)# switchport port-security violation shutdown

Question 4

The left describes boot sequence, while the right describes the orders. Drag the items on the left to the proper locations.

Answer:

1) Step 1: The power on self test executes.
2) Step 2: The bootstrap loader in ROM executes.
3) Step 3: The IOS is located and loaded based on boot system commands in NVRAM.
4) Step 4: The configuration file is loaded from NVRAM.
5) Step 5: If no configuration file is located, the setup dialog initiates.

Explanation

When a router boots up, it performs a series of steps, called the boot sequence, to test the hardware and load the necessary software. The boot sequence consists of the following steps:
1) Power on self test (POST): tests the hardware to verify that all components of the device are operational and present.
2) The bootstrap loader in ROM executes: The bootstrap loader is a program in ROM that is used to find where a valid Cisco IOS image is located.
3) If a valid Cisco IOS image is located, it is loaded.
4) IOS loads configuration file. Once the IOS image is loaded, it will search for a valid startup configuration in NVRAM.
5) If a valid startup configuration file cannot be found, the router will load the System Configuration Dialog (sometimes called setup mode). This mode allows you to perform the initial configuration of the router.

Question 5

Drag and Drop question. Drag the items to the proper locations.
Routing has been configured on the local router with these commands:
Local(config)# ip route 0.0.0.0 0.0.0.0 192.168.1.1
Local(config)# ip route 10.1.0.0 255.255.255.0 192.168.2.2
Local(config)# ip route 10.1.0.0 255.255.0.0 192.168.3.3
Drag each destination IP address on the top to its correct next hop address at the bottom.

Answer:

Next hop 192.168.1.1:
+ 10.2.1.3
+ 10.6.8.4
Next hop 192.168.2.2:
+ 10.1.0.14
+ 10.1.0.123
Next hop 192.168.3.3:
+ 10.1.1.10
+ 10.1.4.6

Explanation

If we have many entries matching for next hop ip address then the router will choose the one with most specific path to send the packet. This is called the “longest match” rule, the route with the most bits in the mask set to “1″ will be chosen to route packet.

Question 6

If a Cisco router has learned about network 10.1.1.0 from multiple sources, the router will select and install only one entry into the routing table. Indicate the order of preference that the router will use by dragging the routes on the left to the order of preference category on the right.

Answer:

1) First preference: S 10.1.1.0 is directly connected, Serial1
2) Second preference: S 10.1 1.0/24 [1/0] via 10.1.2.2
3) Third preference: D 10.1.1.0/24 [90/2172416] via 10.1.5.5, Serial0
4) Fourth preference: O 10.1.1.0/24 [ 110/789] via 10.1.3.1, Serial0
5) Fifth preference: R 10.1.1.0/24 [120/3] via 10.1.3.1, Senal0

Explanation

Administrative distance is the first criterion that a router uses to determine which routing protocol to use if two protocols provide route information for the same destination. It is a measure of the trustworthiness of the source of the routing information. The smaller the administrative distance value, the more reliable the protocol.
In this question, notice that the destination of all routes is 10.1.1.0/24 so we need to use Administrative distance of each routing protocol to specify the priority of each route. Below lists the Administrative Distance default values of popular routing protocols:
+ Directly connected: 0
+ Static route: 1
+ EIGRP (symbolize by “D”): 90
+ OSPF (symbolize by “O”): 110
+ RIP (symbolize by “R”): 120