Cisco CCNA (200-301) — All Questions

Which method routes between VLANs using a single physical router interface divided into subinterfaces?

• a.Layer 2 switching
• b.A dedicated physical router interface for every single VLAN
• c.Router-on-a-stick✓
• d.Proxy ARP

Router-on-a-stick uses one trunk link to a router whose subinterfaces each carry a VLAN with 802.1Q tagging, letting the router route between them. It is simple but the single link can become a bottleneck compared with a Layer 3 switch.

On a router subinterface for router-on-a-stick, which command associates it with VLAN 10 tagging?

• a.switchport trunk encapsulation dot1q
• b.encapsulation dot1q 10✓
• c.encapsulation dot1q 10 native tagged always
• d.encapsulation isl

'encapsulation dot1q 10' tells the subinterface to tag and expect 802.1Q frames for VLAN 10. The IP address configured on that subinterface becomes the default gateway for VLAN 10's hosts. ISL is a legacy Cisco alternative rarely used today.

On a multilayer (Layer 3) switch, which feature performs inter-VLAN routing?

• a.Switched Virtual Interfaces (SVIs) with ip routing enabled✓
• b.Router-on-a-stick with one tagged subinterface configured per VLAN
• c.A crossover cable between two access ports
• d.A trunk to an external router only

A Layer 3 switch routes between VLANs using SVIs (interface vlan X) once 'ip routing' is enabled, keeping traffic on the high-speed switch backplane. This scales better than router-on-a-stick because it avoids a single external trunk bottleneck.

What does the acronym SVI stand for?

• a.System Virtual Instance
• b.Secure VLAN Interface
• c.Switched Virtual Interface✓
• d.Static VLAN Identifier

SVI stands for Switched Virtual Interface, a logical Layer 3 interface (interface vlan X) representing a VLAN on a multilayer switch. Assigning it an IP address provides a gateway and enables inter-VLAN routing when routing is turned on.

Which global command enables IPv4 routing between SVIs on a Layer 3 switch?

• a.ip route enable
• b.router ospf 1
• c.enable routing
• d.ip routing✓

The global command 'ip routing' activates the switch's Layer 3 forwarding so it can route between SVIs. Without it, the SVIs exist but the switch will not forward packets between VLANs even though addresses are configured.

What is the purpose of a voice VLAN on an access port?

• a.It carries IP phone traffic separately from data on the same port✓
• b.It replaces the native VLAN on trunks
• c.It provides guest wireless isolation
• d.It is a trunk-only VLAN for inter-switch management traffic

A voice VLAN lets an IP phone tag its voice traffic into a separate VLAN while a PC daisy-chained through the phone uses the data VLAN, all on one access port. Separating voice enables consistent QoS and simpler policy for real-time traffic.

By default, which VLANs does an 802.1Q trunk carry?

• a.Only VLAN 1
• b.All VLANs (1-4094) unless the allowed list is pruned✓
• c.Only VLANs explicitly listed under switchport access
• d.Only the native VLAN

By default a trunk allows all VLANs (1-4094), tagging every VLAN except the native one. Administrators typically prune the allowed VLAN list to only needed VLANs to limit broadcast flooding and reduce the attack surface.

What is the primary purpose of VTP (VLAN Trunking Protocol)?

• a.To bundle several links into one logical channel for redundancy
• b.To elect the spanning-tree root bridge
• c.To encrypt all traffic crossing a trunk link
• d.To synchronize the VLAN database across switches in a domain✓

VTP propagates VLAN creation, deletion, and naming from a server switch to other switches in the same VTP domain, reducing manual configuration. It carries some risk: a switch with a higher revision number can overwrite the domain's VLAN database.

Which VTP mode receives and synchronizes VLAN information but cannot create or delete VLANs?

• a.Server
• b.Dynamic desirable negotiation mode
• c.Transparent
• d.Client✓

A VTP client cannot add, change, or delete VLANs; it only synchronizes its database from a server and forwards advertisements. Servers can modify VLANs, and transparent switches keep their own local VLANs while merely passing advertisements along.

How does a switch in VTP transparent mode handle VLANs?

• a.It synchronizes and overwrites its VLANs from the VTP server
• b.It keeps its own local VLANs but forwards VTP advertisements✓
• c.It deletes all locally configured VLANs when a new server appears
• d.It automatically becomes the spanning-tree root bridge

A transparent switch maintains its VLAN database independently and does not sync with the domain, but it still forwards VTP advertisements to downstream switches. This is required to configure extended-range VLANs in older VTP versions.

How does an EtherChannel distribute traffic across its member links?

• a.It sends each individual packet round-robin across every link
• b.It uses only the first link and keeps the others idle as backups
• c.It duplicates all traffic on every member link at once
• d.It hashes addresses so each flow consistently uses one link✓

EtherChannel applies a hashing algorithm (based on source/destination MAC or IP, for example) to assign each conversation to one link, keeping a flow's packets in order. It balances per-flow, not per-packet, so a single flow does not exceed one link's speed.

What is the maximum number of active physical links in a single EtherChannel bundle?

• a.16
• b.8✓
• c.2
• d.4

An EtherChannel supports up to 8 active links bundled into one logical interface (some platforms allow additional standby links with LACP). All member ports must share matching speed, duplex, and VLAN settings to bundle successfully.

Which two modes belong to PAgP, the Cisco-proprietary EtherChannel negotiation protocol?

• a.trunk and access
• b.auto and desirable✓
• c.on and on
• d.active and passive

PAgP uses 'auto' and 'desirable' modes; a channel forms when at least one side is desirable. 'active' and 'passive' are LACP terms, and 'on' is a static mode with no negotiation. Mixing PAgP and LACP modes prevents the bundle from forming.

How does EtherChannel interact with Spanning Tree Protocol?

• a.It disables spanning tree entirely across the whole switched network
• b.It causes a second root bridge to be elected for redundancy
• c.STP treats the bundle as one logical link, so no member is blocked✓
• d.It automatically raises the STP bridge priority to become root

STP sees an EtherChannel as a single logical link, so it does not block any of the bundled physical ports, letting all of them forward and add bandwidth. Without bundling, STP would block the redundant links to prevent a loop.

What happens if the member interfaces of an EtherChannel have mismatched settings (such as different VLANs)?

• a.The channel forms and ignores the mismatch
• b.All traffic on the channel is automatically encrypted
• c.The ports are placed in the err-disabled state✓
• d.The switch automatically reboots to recover the bundle

EtherChannel requires consistent speed, duplex, and VLAN/trunk settings on all members; a mismatch triggers a misconfiguration guard that err-disables the ports. You must fix the inconsistency and re-enable the interfaces to restore the channel.

Which interface command adds a port to EtherChannel 1 using LACP active mode?

• a.channel-group 1 mode active✓
• b.channel-protocol lacp only
• c.interface port-channel 1 mode active enable
• d.etherchannel 1 on

'channel-group 1 mode active' places the interface into port-channel 1 and enables LACP active negotiation. The matching logical interface Port-channel1 is created automatically, and the neighbor must use active or passive for the bundle to form.

Which settings must match on all member interfaces for an EtherChannel to form?

• a.Speed, duplex, and VLAN/trunk settings must match on all members✓
• b.Only the IP address configured on each member interface
• c.Only the physical cable length of each member
• d.No settings need to match between members

Every member must agree on speed, duplex, and switchport mode and VLAN configuration; otherwise the bundle fails or ports err-disable. Physical member interfaces are Layer 2 (no IP), and consistency is what lets them act as one logical link.

What is the default Spanning Tree Protocol bridge priority on a Cisco switch?

• a.65535
• b.4096
• c.0
• d.32768✓

The default STP bridge priority is 32768. Because priority is compared first in the bridge ID, and all switches start equal, the lowest MAC address decides the root by default. Priority is adjusted in increments of 4096.

What components make up the STP bridge ID?

• a.Bridge priority, extended system ID (VLAN), and MAC address✓
• b.Only the configured bridge priority value
• c.Only the switch's burned-in MAC address of its lowest port
• d.The switch's IP address combined with its priority

The bridge ID is the 4-bit priority plus the 12-bit extended system ID (the VLAN number) plus the 48-bit MAC address. The extended system ID lets each VLAN run its own instance in PVST+ while sharing one base MAC.

In classic STP, what is the path cost of a 100 Mbps (Fast Ethernet) link?

• a.19✓
• b.1
• c.4
• d.100

Classic STP assigns a 100 Mbps link a cost of 19, a 10 Mbps link 100, a 1 Gbps link 4, and 10 Gbps a cost of 2. The root port is chosen by lowest cumulative path cost to the root bridge.

How does a switch select its root port in STP?

• a.It picks the port with the highest MAC address among all designated ports
• b.It always selects the port connected to an end host
• c.It chooses any currently blocking port on the switch
• d.It selects the port with the lowest path cost to the root bridge✓

Each non-root switch chooses exactly one root port: the port with the lowest cumulative path cost toward the root bridge. Ties are broken by the lowest sender bridge ID, then the lowest port ID. The root port always forwards.

What is a designated port in Spanning Tree Protocol?

• a.A port that is permanently kept in the blocking state
• b.A port that has been placed into the err-disabled state
• c.The port that identifies the switch as the root bridge itself
• d.The single forwarding port elected for each network segment✓

Each segment elects one designated port, the forwarding port with the lowest cost to the root for that segment. On the root bridge, all ports are designated. Non-designated (alternate) ports block to keep the topology loop-free.

What does a non-designated (alternate) port do in classic Spanning Tree Protocol?

• a.It always becomes the root port for the switch
• b.It forwards user data at full speed
• c.It learns MAC addresses while also forwarding frames
• d.It blocks (discards) frames to prevent a switching loop✓

A non-designated port is put in the blocking state, discarding data frames while still listening to BPDUs, which prevents a Layer 2 loop on the redundant path. If the active path fails, this port can transition to forwarding to restore connectivity.

Which set correctly lists the RSTP (802.1w) port roles?

• a.Active, passive, standby, monitoring, reserved
• b.Root, designated, alternate, backup✓
• c.Listening, learning, blocking
• d.Primary and secondary

RSTP defines four port roles: root, designated, alternate, and backup. The alternate port is a backup path to the root, and the backup port is a redundant link to the same segment. These roles allow RSTP's fast, sub-second convergence.

Which set correctly lists the RSTP (802.1w) port states?

• a.Discarding, learning, forwarding✓
• b.Trunk and access
• c.Blocking, listening, learning, forwarding, disabled
• d.Up and down

RSTP simplifies the five classic STP states into three: discarding, learning, and forwarding. Collapsing blocking, listening, and disabled into a single discarding state is part of what makes RSTP converge far faster than legacy 802.1D.

What does Per-VLAN Spanning Tree Plus (PVST+) provide?

• a.A single STP instance shared by all VLANs at once
• b.No spanning tree, relying only on EtherChannel
• c.One instance shared across a whole region as MST does
• d.A separate spanning-tree instance for each VLAN✓

PVST+ runs an independent spanning-tree instance per VLAN, letting each VLAN have its own root bridge and enabling load balancing across redundant links. The trade-off is higher CPU and BPDU overhead compared with MST, which groups VLANs into instances.

Which command makes a switch the primary root bridge for VLAN 1?

• a.spanning-tree vlan 1 root primary✓
• b.stp root enable
• c.spanning-tree priority 0
• d.set spanning-tree vlan 1 as the primary root device

'spanning-tree vlan 1 root primary' lowers the switch's priority (typically to 24576) so it wins the root election for that VLAN. It is a macro that adjusts priority; you can also set the priority manually in multiples of 4096.

What does Root Guard do when it receives a superior BPDU on a port?

• a.It immediately err-disables the port and shuts the VLAN down
• b.It elects that neighbor as the new root bridge
• c.It bundles the port into an EtherChannel automatically
• d.It blocks the port (root-inconsistent) if a superior BPDU arrives✓

Root Guard prevents a downstream switch from becoming the root: if a superior BPDU is heard on a guarded port, the port moves to a root-inconsistent (blocking) state. It automatically recovers once the superior BPDUs stop, unlike BPDU Guard which err-disables.

What problem does STP Loop Guard protect against?

• a.It stops a blocked port from forwarding if BPDUs stop arriving✓
• b.It disables the root bridge during maintenance windows
• c.It aggregates redundant links into a single logical port channel
• d.It speeds up the physical link negotiation

Loop Guard prevents a non-designated (blocking) port from wrongly transitioning to forwarding when it stops receiving BPDUs, which could otherwise create a loop after a unidirectional link failure. The port is placed in a loop-inconsistent state instead.

What is the default STP hello timer interval?

• a.15 seconds
• b.2 seconds✓
• c.10 seconds
• d.20 seconds

The default hello interval is 2 seconds, at which the root bridge sends BPDUs. Forward delay defaults to 15 seconds and max age to 20 seconds. These timers determine classic STP's relatively slow convergence.

Approximately how long does classic 802.1D STP take to converge after a topology change?

• a.About 5 minutes
• b.30 to 50 seconds✓
• c.About 10 milliseconds after any change
• d.Under 1 second

Classic STP takes roughly 30-50 seconds because a port passes through listening (15s) and learning (15s) before forwarding, plus max age delay. RSTP reduces this to sub-second in most cases, which is its main advantage.

An EtherChannel bundle is represented in the configuration as which logical interface?

• a.Port-channel interface✓
• b.VLAN interface (SVI)
• c.A tunnel interface created automatically by LACP
• d.Loopback interface

The bundle appears as a Port-channel interface (for example Port-channel1), and configuration applied to it is inherited by all member physical ports. Treating the group as one logical interface is what lets STP and routing see a single link.

What is an SSID in a wireless network?

• a.The pre-shared encryption key
• b.The wireless network name that clients see and connect to✓
• c.The AP's radio MAC address
• d.The radio channel number the AP is currently using

The SSID (Service Set Identifier) is the human-readable network name broadcast by an access point so clients can identify and join it. It is not a security feature by itself; encryption and authentication protect the traffic.

What is a BSSID?

• a.The MAC address of an access point's radio✓
• b.The IP subnet assigned to wireless clients
• c.The pre-shared key that wireless clients enter
• d.The plain-text SSID network name

The BSSID is the MAC address of the AP's radio and uniquely identifies that basic service set at Layer 2. While the SSID is the name users see, the BSSID lets clients and tools distinguish individual APs that share the same SSID.

What does an Extended Service Set (ESS) provide?

• a.An ad-hoc peer-to-peer link between two laptops
• b.Multiple APs sharing one SSID to allow seamless roaming✓
• c.A single autonomous access point serving exactly one wireless client
• d.A wired-only network with no radios

An ESS links multiple access points under a common SSID (usually on different channels) so clients can roam between them without losing connectivity. This extends wireless coverage across a large area while appearing as one network to users.

How do autonomous and lightweight access points differ?

• a.Autonomous APs run standalone, while lightweight APs need a WLC✓
• b.They are functionally identical in every deployment
• c.Lightweight APs never use any CAPWAP tunnel to reach a controller
• d.Both require a wireless LAN controller to function

Autonomous APs hold their full configuration locally and operate independently, whereas lightweight APs rely on a WLC for configuration and RF management via CAPWAP tunnels. The controller-based model centralizes management of many APs at once.

What does a lightweight AP configured in 'local' mode do?

• a.It only scans all channels for rogue devices and interference
• b.It routes traffic between VLANs on the campus
• c.It remains administratively disabled until reconfigured
• d.It is the default mode in which the AP serves wireless clients✓

Local mode is the default operational mode where the AP provides normal client service on its assigned channel, periodically going off-channel to scan. Other modes like monitor, FlexConnect, and sniffer serve specialized roles.

What does FlexConnect (formerly H-REAP) mode allow a remote AP to do?

• a.Encrypt only the CAPWAP control channel and nothing else
• b.Supply inline power to the access point over the Ethernet cabling
• c.Elect a designated router for the wireless LAN segment
• d.Switch client traffic locally if the link to the WLC goes down✓

FlexConnect lets a branch AP switch client data locally at the remote site and keep serving clients even if the WAN link back to the central WLC fails. This suits branch offices where backhauling all traffic to the controller is impractical.

What does an access point in monitor mode do?

• a.Bridges two separate wired LAN segments together
• b.Dedicated to RF scanning for rogues and IDS; it serves no clients✓
• c.Serves wireless clients normally while routing between VLANs
• d.Acts as the primary DHCP server for the wireless LAN

In monitor mode the AP does not serve clients; instead it dedicates its radios to scanning all channels for rogue APs, interference, and intrusion detection. It is used for security monitoring and location services rather than client access.

Which media access method do 802.11 wireless networks use?

• a.Time-division multiplexing across all associated clients
• b.CSMA/CA✓
• c.Token passing
• d.CSMA/CD

Wireless uses CSMA/CA (collision avoidance) because stations cannot reliably detect collisions on the shared RF medium as wired CSMA/CD does. Devices sense the channel, wait random backoff intervals, and often use acknowledgments to confirm delivery.

Which frames does a wireless client exchange with an AP to join its BSS?

• a.TCP SYN and SYN-ACK
• b.A DHCP Discover message only
• c.An OSPF hello and database exchange sequence
• d.Association request and association response✓

After scanning and authenticating, a client sends an association request and the AP replies with an association response to complete joining the BSS. Only then can data frames flow. TCP and DHCP happen later, at higher layers.

In which frequency band does the 802.11ac standard operate?

• a.2.4 GHz only
• b.5 GHz only✓
• c.900 MHz
• d.Both 60 GHz and 2.4 GHz simultaneously

802.11ac operates exclusively in the 5 GHz band, taking advantage of wider channels and more non-overlapping channels for higher throughput. 802.11n works in both 2.4 and 5 GHz, while the newer 802.11ax (Wi-Fi 6) also spans both bands.

How is a Cisco Wireless LAN Controller most commonly managed?

• a.Through SNMP write community strings only
• b.Through a serial console exclusively
• c.Through an HTTPS web GUI✓
• d.Telnet only

A WLC is typically administered through its secure HTTPS web interface, with SSH and console access also available. The centralized GUI lets administrators configure WLANs, security policies, and RF settings for all associated APs from one place.

How does WPA2-Enterprise differ from WPA2-Personal?

• a.Enterprise mode uses legacy WEP static keys for compatibility
• b.Enterprise uses 802.1X/RADIUS; Personal uses a pre-shared key✓
• c.Both modes rely on the same static shared password for every user
• d.Personal mode requires per-user digital certificates

WPA2-Personal authenticates all clients with one shared passphrase (PSK), while WPA2-Enterprise authenticates each user individually via 802.1X against a RADIUS server. Enterprise provides per-user credentials, accounting, and easier revocation.

What is the purpose of an 802.11 beacon frame?

• a.It negotiates an EtherChannel bundle between two APs
• b.It carries encrypted user data between clients
• c.It assigns IP addresses to associating clients
• d.It advertises the network's presence, SSID, and capabilities✓

Beacon frames are management frames the AP broadcasts periodically to announce the SSID, supported rates, and capabilities so clients can discover and join the network. Hiding the SSID suppresses it in beacons but is not a real security control.

What is the effect of channel bonding (using 40, 80, or 160 MHz channels) in Wi-Fi?

• a.It disables encryption to speed up the link
• b.It lowers the operating frequency to improve wall penetration
• c.It reduces the achievable data rate for stability
• d.It combines adjacent channels into a wider one for more throughput✓

Channel bonding joins adjacent 20 MHz channels into a wider channel, increasing throughput. The trade-off is fewer non-overlapping channels and more interference, so wide channels are used cautiously in the crowded 2.4 GHz band.

What happens during wireless roaming?

• a.The controller reassigns every VLAN across the campus fabric
• b.Two access points merge into one physical radio
• c.A client moves its association to another AP in the same ESS✓
• d.An access point reboots to clear its client table

Roaming lets a moving client hand off its association from one AP to another within the same ESS (same SSID) as signal strength changes, ideally without dropping sessions. Controllers help coordinate fast, seamless roaming across many APs.

On a WLC, how is a WLAN (SSID) typically mapped to the wired network?

• a.All SSIDs must always share one single VLAN
• b.Each WLAN/SSID is mapped to a VLAN through a WLC interface✓
• c.SSIDs cannot be associated with any VLAN
• d.VLANs are configured only on the lightweight AP, never on the WLC

On a controller, each WLAN is tied to a dynamic interface that is associated with a specific VLAN, so wireless clients on that SSID land in the intended wired VLAN. This lets you separate, for example, guest and corporate traffic by SSID.

In the split-MAC architecture, which functions remain on the lightweight AP?

• a.The AP runs the campus routing protocol for all VLANs
• b.The AP stores the entire controller configuration database
• c.Real-time RF tasks such as beacons, acknowledgments, and encryption✓
• d.The access point independently makes every client roaming decision

In split-MAC, the AP keeps time-sensitive real-time functions like beaconing, frame acknowledgments, and encryption/decryption, while the WLC handles management, authentication, and RF coordination. Splitting duties centralizes control without adding latency.

How is the CAPWAP control channel between a lightweight AP and a WLC protected?

• a.It is an unencrypted cleartext management channel between AP and WLC
• b.It is encrypted with DTLS✓
• c.It relies on plain Telnet
• d.It uses legacy WEP keys

CAPWAP secures its control messages with DTLS (Datagram Transport Layer Security) by default, protecting management traffic between the AP and controller. The data channel can also be DTLS-encrypted when configured, though it is often left unencrypted.