Cisco CCNA (200-301) — All Questions

Which command makes a switch the primary root bridge for VLAN 1?

• a.spanning-tree vlan 1 root primary✓
• b.stp root enable
• c.spanning-tree priority 0
• d.set spanning-tree vlan 1 as the primary root device

'spanning-tree vlan 1 root primary' lowers the switch's priority (typically to 24576) so it wins the root election for that VLAN. It is a macro that adjusts priority; you can also set the priority manually in multiples of 4096.

What does Root Guard do when it receives a superior BPDU on a port?

• a.It immediately err-disables the port and shuts the VLAN down
• b.It elects that neighbor as the new root bridge
• c.It bundles the port into an EtherChannel automatically
• d.It blocks the port (root-inconsistent) if a superior BPDU arrives✓

Root Guard prevents a downstream switch from becoming the root: if a superior BPDU is heard on a guarded port, the port moves to a root-inconsistent (blocking) state. It automatically recovers once the superior BPDUs stop, unlike BPDU Guard which err-disables.

What problem does STP Loop Guard protect against?

• a.It stops a blocked port from forwarding if BPDUs stop arriving✓
• b.It disables the root bridge during maintenance windows
• c.It aggregates redundant links into a single logical port channel
• d.It speeds up the physical link negotiation

Loop Guard prevents a non-designated (blocking) port from wrongly transitioning to forwarding when it stops receiving BPDUs, which could otherwise create a loop after a unidirectional link failure. The port is placed in a loop-inconsistent state instead.

What is the default STP hello timer interval?

• a.15 seconds
• b.2 seconds✓
• c.10 seconds
• d.20 seconds

The default hello interval is 2 seconds, at which the root bridge sends BPDUs. Forward delay defaults to 15 seconds and max age to 20 seconds. These timers determine classic STP's relatively slow convergence.

Approximately how long does classic 802.1D STP take to converge after a topology change?

• a.About 5 minutes
• b.30 to 50 seconds✓
• c.About 10 milliseconds after any change
• d.Under 1 second

Classic STP takes roughly 30-50 seconds because a port passes through listening (15s) and learning (15s) before forwarding, plus max age delay. RSTP reduces this to sub-second in most cases, which is its main advantage.

An EtherChannel bundle is represented in the configuration as which logical interface?

• a.Port-channel interface✓
• b.VLAN interface (SVI)
• c.A tunnel interface created automatically by LACP
• d.Loopback interface

The bundle appears as a Port-channel interface (for example Port-channel1), and configuration applied to it is inherited by all member physical ports. Treating the group as one logical interface is what lets STP and routing see a single link.

What is an SSID in a wireless network?

• a.The pre-shared encryption key
• b.The wireless network name that clients see and connect to✓
• c.The AP's radio MAC address
• d.The radio channel number the AP is currently using

The SSID (Service Set Identifier) is the human-readable network name broadcast by an access point so clients can identify and join it. It is not a security feature by itself; encryption and authentication protect the traffic.

What is a BSSID?

• a.The MAC address of an access point's radio✓
• b.The IP subnet assigned to wireless clients
• c.The pre-shared key that wireless clients enter
• d.The plain-text SSID network name

The BSSID is the MAC address of the AP's radio and uniquely identifies that basic service set at Layer 2. While the SSID is the name users see, the BSSID lets clients and tools distinguish individual APs that share the same SSID.

What does an Extended Service Set (ESS) provide?

• a.An ad-hoc peer-to-peer link between two laptops
• b.Multiple APs sharing one SSID to allow seamless roaming✓
• c.A single autonomous access point serving exactly one wireless client
• d.A wired-only network with no radios

An ESS links multiple access points under a common SSID (usually on different channels) so clients can roam between them without losing connectivity. This extends wireless coverage across a large area while appearing as one network to users.

How do autonomous and lightweight access points differ?

• a.Autonomous APs run standalone, while lightweight APs need a WLC✓
• b.They are functionally identical in every deployment
• c.Lightweight APs never use any CAPWAP tunnel to reach a controller
• d.Both require a wireless LAN controller to function

Autonomous APs hold their full configuration locally and operate independently, whereas lightweight APs rely on a WLC for configuration and RF management via CAPWAP tunnels. The controller-based model centralizes management of many APs at once.

What does a lightweight AP configured in 'local' mode do?

• a.It only scans all channels for rogue devices and interference
• b.It routes traffic between VLANs on the campus
• c.It remains administratively disabled until reconfigured
• d.It is the default mode in which the AP serves wireless clients✓

Local mode is the default operational mode where the AP provides normal client service on its assigned channel, periodically going off-channel to scan. Other modes like monitor, FlexConnect, and sniffer serve specialized roles.

What does FlexConnect (formerly H-REAP) mode allow a remote AP to do?

• a.Encrypt only the CAPWAP control channel and nothing else
• b.Supply inline power to the access point over the Ethernet cabling
• c.Elect a designated router for the wireless LAN segment
• d.Switch client traffic locally if the link to the WLC goes down✓

FlexConnect lets a branch AP switch client data locally at the remote site and keep serving clients even if the WAN link back to the central WLC fails. This suits branch offices where backhauling all traffic to the controller is impractical.

What does an access point in monitor mode do?

• a.Bridges two separate wired LAN segments together
• b.Dedicated to RF scanning for rogues and IDS; it serves no clients✓
• c.Serves wireless clients normally while routing between VLANs
• d.Acts as the primary DHCP server for the wireless LAN

In monitor mode the AP does not serve clients; instead it dedicates its radios to scanning all channels for rogue APs, interference, and intrusion detection. It is used for security monitoring and location services rather than client access.

Which media access method do 802.11 wireless networks use?

• a.Time-division multiplexing across all associated clients
• b.CSMA/CA✓
• c.Token passing
• d.CSMA/CD

Wireless uses CSMA/CA (collision avoidance) because stations cannot reliably detect collisions on the shared RF medium as wired CSMA/CD does. Devices sense the channel, wait random backoff intervals, and often use acknowledgments to confirm delivery.

Which frames does a wireless client exchange with an AP to join its BSS?

• a.TCP SYN and SYN-ACK
• b.A DHCP Discover message only
• c.An OSPF hello and database exchange sequence
• d.Association request and association response✓

After scanning and authenticating, a client sends an association request and the AP replies with an association response to complete joining the BSS. Only then can data frames flow. TCP and DHCP happen later, at higher layers.

In which frequency band does the 802.11ac standard operate?

• a.2.4 GHz only
• b.5 GHz only✓
• c.900 MHz
• d.Both 60 GHz and 2.4 GHz simultaneously

802.11ac operates exclusively in the 5 GHz band, taking advantage of wider channels and more non-overlapping channels for higher throughput. 802.11n works in both 2.4 and 5 GHz, while the newer 802.11ax (Wi-Fi 6) also spans both bands.

How is a Cisco Wireless LAN Controller most commonly managed?

• a.Through SNMP write community strings only
• b.Through a serial console exclusively
• c.Through an HTTPS web GUI✓
• d.Telnet only

A WLC is typically administered through its secure HTTPS web interface, with SSH and console access also available. The centralized GUI lets administrators configure WLANs, security policies, and RF settings for all associated APs from one place.

How does WPA2-Enterprise differ from WPA2-Personal?

• a.Enterprise mode uses legacy WEP static keys for compatibility
• b.Enterprise uses 802.1X/RADIUS; Personal uses a pre-shared key✓
• c.Both modes rely on the same static shared password for every user
• d.Personal mode requires per-user digital certificates

WPA2-Personal authenticates all clients with one shared passphrase (PSK), while WPA2-Enterprise authenticates each user individually via 802.1X against a RADIUS server. Enterprise provides per-user credentials, accounting, and easier revocation.

What is the purpose of an 802.11 beacon frame?

• a.It negotiates an EtherChannel bundle between two APs
• b.It carries encrypted user data between clients
• c.It assigns IP addresses to associating clients
• d.It advertises the network's presence, SSID, and capabilities✓

Beacon frames are management frames the AP broadcasts periodically to announce the SSID, supported rates, and capabilities so clients can discover and join the network. Hiding the SSID suppresses it in beacons but is not a real security control.

What is the effect of channel bonding (using 40, 80, or 160 MHz channels) in Wi-Fi?

• a.It disables encryption to speed up the link
• b.It lowers the operating frequency to improve wall penetration
• c.It reduces the achievable data rate for stability
• d.It combines adjacent channels into a wider one for more throughput✓

Channel bonding joins adjacent 20 MHz channels into a wider channel, increasing throughput. The trade-off is fewer non-overlapping channels and more interference, so wide channels are used cautiously in the crowded 2.4 GHz band.

What happens during wireless roaming?

• a.The controller reassigns every VLAN across the campus fabric
• b.Two access points merge into one physical radio
• c.A client moves its association to another AP in the same ESS✓
• d.An access point reboots to clear its client table

Roaming lets a moving client hand off its association from one AP to another within the same ESS (same SSID) as signal strength changes, ideally without dropping sessions. Controllers help coordinate fast, seamless roaming across many APs.

On a WLC, how is a WLAN (SSID) typically mapped to the wired network?

• a.All SSIDs must always share one single VLAN
• b.Each WLAN/SSID is mapped to a VLAN through a WLC interface✓
• c.SSIDs cannot be associated with any VLAN
• d.VLANs are configured only on the lightweight AP, never on the WLC

On a controller, each WLAN is tied to a dynamic interface that is associated with a specific VLAN, so wireless clients on that SSID land in the intended wired VLAN. This lets you separate, for example, guest and corporate traffic by SSID.

In the split-MAC architecture, which functions remain on the lightweight AP?

• a.The AP runs the campus routing protocol for all VLANs
• b.The AP stores the entire controller configuration database
• c.Real-time RF tasks such as beacons, acknowledgments, and encryption✓
• d.The access point independently makes every client roaming decision

In split-MAC, the AP keeps time-sensitive real-time functions like beaconing, frame acknowledgments, and encryption/decryption, while the WLC handles management, authentication, and RF coordination. Splitting duties centralizes control without adding latency.

How is the CAPWAP control channel between a lightweight AP and a WLC protected?

• a.It is an unencrypted cleartext management channel between AP and WLC
• b.It is encrypted with DTLS✓
• c.It relies on plain Telnet
• d.It uses legacy WEP keys

CAPWAP secures its control messages with DTLS (Datagram Transport Layer Security) by default, protecting management traffic between the AP and controller. The data channel can also be DTLS-encrypted when configured, though it is often left unencrypted.

Which UDP ports does CAPWAP use for its control and data channels?

• a.UDP 67 for control and UDP 68 for data
• b.TCP 22 for control and TCP 23 for data
• c.UDP 5246 for control and UDP 5247 for data✓
• d.TCP 80 for control and TCP 443 for encrypted data forwarding

CAPWAP uses UDP port 5246 for the control channel and UDP port 5247 for the data channel between the AP and the WLC. Knowing these ports is useful when permitting CAPWAP through a firewall between remote APs and the controller.

Which of the following is a common source of interference in the 2.4 GHz Wi-Fi band?

• a.OSPF hello packets on the wired network
• b.Straight-through Ethernet cables in the wiring closet
• c.Fiber-optic cabling in the ceiling
• d.Microwave ovens and Bluetooth devices✓

Microwave ovens, Bluetooth devices, and cordless phones share the unlicensed 2.4 GHz band and cause interference, degrading Wi-Fi performance. This crowding, plus only three non-overlapping channels, is a key reason the 5 GHz band is often preferred.

Which VLAN ID range is considered the extended range on Cisco Catalyst switches?

• a.1006-4094✓
• b.1002-1005
• c.1-1005
• d.2-1001

Normal-range VLANs are 1-1005, and the extended range is 1006-4094, giving access to thousands of additional VLAN IDs. VLANs 1002-1005 within the normal range are reserved for legacy Token Ring and FDDI.

Which VLAN IDs are reserved by default for legacy Token Ring and FDDI and cannot be deleted?

• a.1006-1010, at the start of the extended range
• b.1002-1005✓
• c.0 and 4095, which mark the boundaries of the field
• d.1-4, which are early low-numbered user VLANs

VLANs 1002 through 1005 are reserved for legacy Token Ring and FDDI and exist by default on Catalyst switches; they cannot be removed. VLAN 1 is the default data VLAN, and 0 and 4095 are reserved by the 802.1Q standard.

Which command sequence, entered in global configuration mode, creates VLAN 50 and names it SALES?

• a.vlan create 50 followed by description SALES
• b.vlan 50 followed by name SALES✓
• c.name SALES vlan 50 entered on one line
• d.switchport access vlan 50 followed by name SALES

Creating a VLAN uses 'vlan 50' to enter VLAN configuration mode, then 'name SALES' to label it. The 'switchport access vlan' command assigns a port to a VLAN and is entered under an interface, not in global VLAN configuration.

Which interface command places IP phone traffic into voice VLAN 20 while data uses the access VLAN?

• a.switchport access vlan 20, which would carry data instead
• b.switchport trunk voice vlan 20, which is not valid syntax
• c.switchport voice vlan 20✓
• d.voice vlan 20 entered directly in global configuration mode

The 'switchport voice vlan 20' command tells the port to tag phone traffic for VLAN 20 while untagged PC traffic uses the access VLAN. This lets a phone and a PC share a single access port with separate VLANs.

Which Cisco-proprietary protocol can dynamically negotiate whether a switch link becomes an access or a trunk port?

• a.LACP, which negotiates the bundling of EtherChannel links
• b.CDP, which discovers directly connected Cisco neighbors
• c.DTP (Dynamic Trunking Protocol)✓
• d.VTP, which synchronizes the VLAN database across switches

DTP negotiates trunk formation between Cisco switches automatically. VTP propagates VLAN definitions, CDP discovers neighbors, and LACP bundles links, so none of those handle trunk-mode negotiation.

Which command disables DTP negotiation so a manually configured trunk stops sending DTP frames?

• a.switchport nonegotiate✓
• b.switchport mode dynamic auto, which keeps negotiation on
• c.no cdp enable, which only stops neighbor discovery
• d.no switchport, which converts the port to a routed interface

'switchport nonegotiate' turns off DTP so the port will not send negotiation frames, which is best practice on a statically configured trunk or access port. The dynamic modes leave DTP active, which can be a security risk.

Which command restricts an 802.1Q trunk so it carries only VLANs 10, 20, and 30?

• a.switchport trunk native vlan 10,20,30, which sets one native VLAN
• b.switchport access vlan 10,20,30, which is invalid on a trunk
• c.switchport trunk vlan allowed 10-30, with the keywords reversed
• d.switchport trunk allowed vlan 10,20,30✓

The allowed-VLAN list is set with 'switchport trunk allowed vlan 10,20,30', pruning all other VLANs from the trunk. Limiting the list reduces unnecessary broadcast flooding and narrows the trunk's attack surface.

In which VTP mode can a switch forward VTP advertisements and maintain its own local VLANs but not propagate its changes to others?

• a.Off mode, which stops forwarding advertisements entirely
• b.Client mode, which cannot create local VLANs at all
• c.Server mode, which creates and advertises VLANs to the domain
• d.Transparent mode✓

A transparent-mode switch keeps its own local VLAN database and passes VTP advertisements through without applying them, so its changes are not propagated. Server mode advertises changes domain-wide, and client mode only adopts what servers advertise.

Why can inserting a used switch with a higher VTP configuration revision number be dangerous?

• a.It forces every switch to recalculate the spanning tree
• b.It can overwrite the VLAN database of every switch in the domain✓
• c.It will immediately shut down all trunk links in the domain
• d.It changes the native VLAN on all connected trunks

VTP switches accept the database with the highest revision number, so a used switch carrying a higher revision can replace the correct VLAN database domain-wide, deleting VLANs and orphaning ports. Resetting the revision (or using transparent mode) before connecting avoids this.

Using the traditional (short) STP cost values, what is the default path cost of a 1 Gbps link?

• a.2
• b.4✓
• c.100
• d.19

In the classic short-form STP cost table, 10 Mbps is 100, 100 Mbps is 19, 1 Gbps is 4, and 10 Gbps is 2. Lower cost is preferred, so faster links are chosen for the path toward the root bridge.

Using the traditional (short) STP cost values, what is the cost of a 100 Mbps FastEthernet link?

• a.10
• b.4
• c.19✓
• d.100

The short-form STP cost for 100 Mbps is 19. STP sums the cost of the links a frame would cross to reach the root, choosing the lowest total cost as the root path.

When a nonroot switch selects its single root port, which value is evaluated first?

• a.The lowest sender bridge ID advertised on the segment
• b.The highest configured port priority on the interface
• c.The lowest port ID of the local receiving interface
• d.The lowest cumulative path cost to the root bridge✓

Root-port election compares the accumulated path cost to the root first. Only if two paths tie on cost does STP move to tie-breakers: lowest sender bridge ID, then lowest sender port ID, then lowest local port ID.

In a fully converged STP topology, how many designated ports exist on each active LAN segment?

• a.None, because designated ports exist only on the root
• b.Exactly one✓
• c.Two, one at each end of the segment
• d.One per VLAN multiplied by the number of trunks

Every active segment has exactly one designated port, which is the port forwarding toward that segment from the switch closest to the root. All ports on the root bridge are designated, ensuring each segment has a single forwarding path.

In RSTP, which port role provides an alternate path to the root bridge and can quickly take over if the root port fails?

• a.Designated port, which forwards toward a downstream segment
• b.Alternate port✓
• c.Backup port, which protects against a self-loop on a shared segment
• d.Edge port, which connects directly to a single end host

The RSTP alternate port is a blocked port that offers a backup route to the root and can transition rapidly if the root port is lost. A backup port instead protects a segment where the same switch has two connections.

In RSTP, a port connected to a single end host is configured as which port type so it forwards immediately?

• a.An edge port✓
• b.A boundary port, which separates two STP regions
• c.A point-to-point non-edge port, which links two switches
• d.A root port, which leads toward the root bridge

An RSTP edge port (equivalent to enabling PortFast) attaches to an end device and skips the listening and learning delays to forward immediately. If an edge port unexpectedly receives a BPDU, it loses its edge status.

Which STP protection feature prevents a connected switch from becoming the root bridge by ignoring superior BPDUs on that port?

• a.BPDU Guard, which err-disables a port that receives any BPDU
• b.UDLD, which detects unidirectional fiber link failures
• c.Loop Guard, which reacts to the loss of expected BPDUs
• d.Root Guard✓

Root Guard keeps a designated port from accepting superior BPDUs, so an attached switch cannot take over as root; the port goes to a root-inconsistent state instead. This enforces the intended root placement at the network edge toward other switches.

Which feature prevents an alternate or root port from wrongly transitioning to forwarding when it stops receiving expected BPDUs?

• a.BPDU Guard, which shuts down edge ports receiving BPDUs
• b.Loop Guard✓
• c.Root Guard, which blocks superior BPDUs from taking over root
• d.PortFast, which speeds edge ports directly to forwarding

Loop Guard watches non-designated ports and, if BPDUs stop arriving (which could open a loop), it places the port in a loop-inconsistent blocking state rather than letting it move to forwarding. This guards against unidirectional link problems.

By default, how does a Cisco switch decide which physical link in an EtherChannel carries a given frame?

• a.By selecting a link at random for every individual frame
• b.By hashing address fields such as source and destination MAC or IP✓
• c.By sending each successive frame out a different link in turn
• d.By using only the lowest-numbered link and reserving the rest

EtherChannel load balancing computes a hash from configurable address fields and maps the result to one of the bundled links, keeping each flow on a single link to preserve ordering. It does not do simple round-robin, which would risk reordering.

Which condition will prevent a set of interfaces from bundling into an EtherChannel?

• a.Assigning all of the ports to the same channel group
• b.Mismatched speed, duplex, or allowed-VLAN settings among the ports✓
• c.Placing all of the member ports in the same VLAN
• d.Configuring every member port with identical settings

EtherChannel members must share consistent speed, duplex, trunk/access mode, native VLAN, and allowed-VLAN settings; any mismatch stops the bundle from forming. Identical configuration and a common channel group are exactly what a working EtherChannel requires.

Which two PAgP modes will successfully form an EtherChannel between two switches?

• a.on/desirable, mixing static with dynamic negotiation
• b.passive/active, which are actually LACP keywords
• c.desirable/desirable or desirable/auto✓
• d.auto/auto, where neither side starts negotiation

PAgP forms a channel when at least one side is desirable (actively negotiating), so desirable/desirable and desirable/auto both work. Auto/auto fails because neither initiates, and mixing the static 'on' mode with a dynamic mode also fails.

In a wireless LAN, what does the SSID identify?

• a.The specific radio channel the access point transmits on
• b.The unique MAC address of the access point's radio
• c.The pre-shared encryption key protecting the traffic
• d.The name of the wireless network that clients associate to✓

The SSID (Service Set Identifier) is the human-readable network name broadcast (or hidden) by an AP so clients know which WLAN to join. The radio's MAC is the BSSID, and the channel and encryption key are separate settings.

What does the BSSID represent in an infrastructure wireless LAN?

• a.The human-readable name of the wireless network
• b.The MAC address of the associated wireless client
• c.The MAC address of the access point's radio✓
• d.The IP address of the wireless LAN controller

The BSSID is the Layer 2 MAC address of the AP's radio that identifies a particular basic service set. Clients use it to distinguish among multiple APs that may advertise the same SSID during roaming.

Compared with the 2.4 GHz band, what is a key advantage of using the 5 GHz band for Wi-Fi?

• a.It offers many more non-overlapping channels and less interference✓
• b.It always consumes less power on client devices
• c.It is the only band that supports WPA3 encryption
• d.It penetrates walls and travels farther than 2.4 GHz

The 5 GHz band provides far more non-overlapping channels than the three available at 2.4 GHz, reducing co-channel interference in dense deployments. Its trade-off is shorter range and weaker wall penetration, not a security or power difference.

Which lightweight AP mode lets a branch AP keep switching client traffic locally if the WAN link to the controller fails?

• a.Sniffer mode, which captures frames for analysis only
• b.Local mode, which tunnels all client data to the controller
• c.Monitor mode, which passively scans and does not serve clients
• d.FlexConnect mode✓

FlexConnect allows an AP at a remote site to switch client traffic locally and keep serving clients even if the CAPWAP tunnel to the central WLC goes down. Local mode tunnels all traffic back to the controller, so an outage would drop service.