Cisco Certified Network Associate (CCNA) 200-301 Practice Test 22
Question 210
A switching team has repaired a network problem. The Port-channel trunk permits VLAN 20, but one member has incompatible access-port configuration and remains unbundled. Which device or protocol check is the strongest evidence that this particular failure is gone?
- The logical Port-channel permits VLAN 20 but the formerly faulty member is still unbundled.
- `show etherchannel summary` shows both intended physical links bundled, and `show interfaces trunk` shows the logical Port-channel forwarding VLAN 20.
- The physical links are up/up but `show interfaces trunk` lists neither the Port-channel nor VLAN 20.
- Only an unrelated VLAN 30 SVI is reachable.
Explanation
Correct Answer
B:The earlier issue was an access-mode member incompatible with a trunk Port-channel. Confirming both member inclusion and VLAN 20 transport demonstrates the corrected L2 aggregation.
Incorrect Answers
A:Trunk allowed list alone does not prove the member compatibility defect has been repaired.
C:Carrier does not prove tagged VLAN transport or successful bundle formation.
D:Reachability of a different VLAN does not test the failed VLAN 20 bundle membership.
Question 211
A network acceptance test follows this reported failure: The bundle is present at Layer 2, but the IP address is configured on one physical member and no routed Port-channel address exists. Which verification most specifically demonstrates the repaired function rather than checking an unrelated feature?
- `show run interface Port-channel10` shows `no switchport` and the correct routed IP, `show ip interface brief` shows it up/up, and the neighbor subnet is reachable.
- The Port-channel remains Layer 2 and the only IP address is still on one physical member.
- The Port-channel trunk carries VLAN 20, but no `no switchport` or routed interface IP is configured.
- Every member link is electrically up but the Port-channel has no IP and the next hop is unreachable.
Explanation
Correct Answer
A:A valid L3 Port-channel owns an IP and provides one aggregated routed interface. Confirm the logical interface state and route/neighbor connectivity rather than merely an L2 bundle name.
Incorrect Answers
B:A routed EtherChannel must have Layer 3 configuration on the logical Port-channel, with the physical members appropriately bundled. Leaving the Port-channel switched and placing an IP only on one physical member does not establish a routed logical adjacency.
C:A Layer 2 VLAN trunk is not the requested routed EtherChannel.
D:Link health alone does not establish Layer 3 aggregate addressing.
Question 212
After replacing PAgP with LACP on a Cisco–third-party switch bundle, the Cisco end reports Port-channel7 up. The change ticket requires proof that the logical interface is actually using LACP and that both physical members participate. Which evidence is sufficient for that acceptance test?
- `show etherchannel summary` identifies Po7 as an operational L2 bundle using LACP, with both physical ports marked bundled; `show lacp neighbor` identifies the expected peer.
- `show lacp neighbor` displays a peer system ID, without checking whether either physical member is selected into the bundle.
- `show interfaces trunk` lists VLANs allowed on one member, but no EtherChannel protocol or member status.
- `show ip route` displays a reachable remote subnet without identifying which Layer 2 links or aggregation protocol carried the traffic.
Explanation
Correct Answer
A:This pair of checks proves the two acceptance conditions separately: the EtherChannel summary shows the logical interface and which physical links are bundled, while the LACP neighbor display confirms the standards-based peer relationship. Member flags and channel status matter because a configured port-channel can exist while one member remains suspended or standalone. `show interfaces trunk` may be useful afterward to validate VLAN transport, but does not replace the required protocol and bundle checks. The question tests post-change verification, not diagnosing the former PAgP configuration fault.
Incorrect Answers
B:Finding a LACP neighbor is useful evidence of received LACP frames, but by itself it does not prove that both intended member ports were selected into the operational EtherChannel. A port can exchange control messages and nevertheless fail compatibility or bundling checks. Because the ticket explicitly requires two members participating, the technician must also inspect the EtherChannel summary or detailed port membership. The peer system ID is necessary contextual information, not complete proof of the logical bundle's health.
C:A trunk's allowed-VLAN display can confirm that certain 802.1Q VLANs are configured for carriage on an interface, which is a different validation objective. It neither establishes that the link participates in the intended EtherChannel nor shows which aggregation protocol negotiated the partner. Even a standalone trunk might carry traffic successfully while redundancy and capacity are missing. The appropriate test inspects EtherChannel logical state, bundled member flags, and a matching LACP peer, then checks VLAN carriage if the deployment also requires it.
D:A routing table on a Layer 3 device can demonstrate that a prefix is reachable via a next hop, but it does not identify the LACP negotiation protocol or prove two physical Ethernet ports have joined a bundle. The destination might remain reachable through an independent single link even when the EtherChannel failed. Therefore, reachability alone is insufficient for this Layer 2 acceptance test. Use Cisco EtherChannel and LACP state to establish aggregation health before treating higher-layer connectivity as an additional end-to-end confirmation.
Question 213
Rapid PVST+ selects the lowest bridge ID, comparing priority plus the relevant VLAN extension and then MAC address. The team needs a solution consistent with this requirement. Which option is the most appropriate design or configuration decision?
- Elect the switch with the highest MAC address before considering its priority.
- Elect the port with the highest configured interface bandwidth and call that device the root.
- Elect the device with the largest number of access VLANs regardless of its bridge ID.
- Elect the switch with the lowest effective bridge ID: compare configured priority including the VLAN/system-ID extension, then MAC address on a tie.
Explanation
Correct Answer
D:Per-VLAN STP root election selects the lowest Bridge ID. Root priority dominates MAC address; a device with a numerically lower priority can defeat a lower-MAC competitor.
Incorrect Answers
A:STP elects the lowest BID, compares priority first, and favors lower MAC only when priorities tie.
B:Port speed/path cost participates in path selection after the root is elected; it does not substitute for bridge-ID election.
C:The count of configured VLANs is not the bridge-ID election criterion.
Question 214
A switching team is evaluating a deployment. A non-root switch chooses its path toward the root using cumulative spanning-tree cost and the documented tie-breakers. What approach correctly addresses the stated requirement?
- Choose the fastest direct Ethernet link regardless of the root path cost advertised by its upstream bridge.
- Choose the lowest local switch MAC address and ignore received BPDUs.
- Choose the root port offering the lowest accumulated root path cost, then apply the STP tie-breakers such as superior sender Bridge ID/port ID if equal.
- Make all redundant interfaces root ports simultaneously to maximize Layer 2 forwarding.
Explanation
Correct Answer
C:The BPDU received from an upstream bridge advertises a root path cost, and the receiving link adds its own port cost. The lowest total cost to the elected root is preferred, not necessarily the physically fastest local cable.
Incorrect Answers
A:A fast port may lead through a longer/higher-cost upstream path, so the cumulative cost can be worse.
B:Local bridge identity does not replace the root path cost and BPDU tie-breaking procedure for selecting a root port.
D:A non-root bridge selects an appropriate best root port; allowing unconstrained redundant forwarding can create loops.
Question 215
A proposed network design has this requirement: Redundant Layer 2 topology must have one appropriate designated forwarding port per segment and a backup alternate where necessary. Which choice is technically appropriate for that deployment?
- For each shared segment, select the port advertising the superior BPDU as designated; keep redundant inferior paths in alternate/discarding role.
- Assign both sides of every redundant Ethernet segment forwarding with no blocked/alternate role.
- Block the designated port on every segment and have no forwarding path between bridges.
- Choose the switch with the highest bridge ID to be designated in every segment, ignoring path cost.
Explanation
Correct Answer
A:STP permits one designated forwarding port for a LAN segment while non-designated redundant paths avoid loops. Each non-root bridge has a root port toward the root and may have alternate protection paths.
Incorrect Answers
B:That can create a Layer 2 cycle and broadcast storm in redundant topology.
C:A designated port forwards traffic for its LAN segment; blanket blocking destroys intended connectivity.
D:Designated-port election uses the best BPDU and root path information; highest BID alone is not favorable.
Question 216
A switching team must implement a change. Rapid PVST+ ports progress among discarding, learning and forwarding states depending on role and agreement. Which technical decision most directly meets these requirements?
- Rapid PVST+/RSTP uses discarding, learning and forwarding states; an alternate port can stay discarding until needed.
- RSTP has only listening and blocking states, with no learning or forwarding states.
- An alternate RSTP port must stay forwarding while the primary root path also forwards on a redundant loop.
- A forwarding RSTP port never learns MAC addresses because only the learning state can populate the table.
Explanation
Correct Answer
A:RSTP consolidates legacy disabled/blocking/listening into discarding while preserving learning and forwarding phases. Port roles (root, designated, alternate) and proposal/agreement influence rapid transitions.
Incorrect Answers
B:Those names do not describe the three operational RSTP states.
C:Alternate ports prevent loops by staying discarding until topology requires them.
D:Forwarding ports both learn source MAC addresses and forward frames.
Question 217
An access port connected to a normal workstation should become forwarding promptly without waiting for topology convergence. The team needs a solution consistent with this requirement. Which option is the most appropriate design or configuration decision?
- Configure PortFast on the redundant uplinks to force both interswitch paths forwarding.
- Disable spanning tree for the entire VLAN solely to shorten one workstation’s DHCP wait.
- Lower OSPF interface cost on the user access switchport to bypass STP listening time.
- Configure `spanning-tree portfast` on the verified host-facing edge switchport, not on an unprotected redundant interswitch link.
Explanation
Correct Answer
D:PortFast allows genuine edge ports to enter forwarding quickly for devices such as workstations that do not participate in a bridge loop. Misapplying it to a switch-to-switch loop may remove important convergence safeguards.
Incorrect Answers
A:Uplinks connecting bridges should participate in STP topology decisions to prevent loops.
B:Removing STP globally exposes the bridged network to loops and is unnecessary for edge startup.
C:OSPF cost affects routed path selection and does not control STP edge-port transitions.
Question 218
A switching team is evaluating a deployment. An edge PortFast port must shut down if a connected device unexpectedly sends bridging BPDUs. What approach correctly addresses the stated requirement?
- Enable `spanning-tree bpduguard enable` on the PortFast edge interface so receipt of a BPDU errdisables it.
- Enable only PortFast and let the edge port continue forwarding after any BPDU, with no guard action.
- Enable `spanning-tree guard loop` on the workstation edge port and assume it will errdisable on BPDU receipt.
- Disable BPDUs at the remote switch while leaving the untrusted edge device bridged and the port active.
Explanation
Correct Answer
A:BPDU Guard protects an edge-only port from unexpected attached bridges. A BPDU indicates the port may no longer be a safe edge; errdisable stops forwarding until the condition is removed and recovery is performed.
Incorrect Answers
B:PortFast alone does not provide the requested automatic shutdown upon BPDU arrival.
C:Loop Guard protects non-designated ports from lost BPDUs; it does not have BPDU Guard’s violation response.
D:Suppressing evidence does not implement the required shutdown-on-BPDU security control.
Question 219
SW1 is the intended spanning-tree root for VLAN 20. Its designated interface Gi1/0/24 faces a downstream access switch that must not become root. The downstream switch occasionally advertises a superior BPDU. Which protection should SW1 apply on Gi1/0/24?
- Loop Guard, because the designated port is losing expected BPDUs from the current root.
- Root Guard, which prevents a superior downstream BPDU from changing the intended root hierarchy.
- PortFast without BPDU Guard, because all downstream switch ports are edge ports.
- Disable STP so the designated port ignores every control-plane packet.
Explanation
Correct Answer
B:Root Guard belongs on designated ports toward switches that should never take over root status. When Gi1/0/24 receives a superior BPDU, Root Guard can put the port into a root-inconsistent blocked state, preventing a downstream device from becoming the root through that link. When the superior BPDUs cease, the port can recover automatically. Confirm SW1's intended bridge priority, the downstream boundary and the actual BPDU type before deploying the feature. This is not BPDU Guard on a host edge port and not Loop Guard on an alternate/root port. The selected feature defends the root hierarchy while preserving spanning-tree loop prevention, so a later repair can restore normal port forwarding without disabling STP.
Incorrect Answers
A:Loop Guard addresses non-designated ports that should keep receiving BPDUs and may otherwise become forwarding when those BPDUs stop. The port in this scenario is designated and is instead receiving superior BPDUs from a downstream device attempting to influence root selection. That is Root Guard's use case. Loop Guard and Root Guard are different protections and should not be conflated on one port.
C:A port facing another switch is not automatically a genuine host-only edge. Applying PortFast without appropriate protection can skip normal transition safeguards and is not designed to defend against downstream superior BPDUs. The observed BPDU demonstrates a participating bridge, so the correct decision concerns Root Guard on the designated boundary, not accelerating a client port.
D:Disabling STP removes the loop-prevention protocol from a redundant Layer 2 topology. A superior BPDU should be handled by a protective spanning-tree feature, not by suppressing all tree computation. Turning off STP can create a broadcast storm if redundant links form a loop. The correct control is targeted to the designated port's intended root trust boundary.
Question 220
A redundant switch port that is currently an alternate (non-designated) Rapid PVST+ path stops receiving BPDUs because of a one-way fault. Engineers must prevent it from incorrectly moving into forwarding state while the fault persists. Which feature fits?
- BPDU Guard applied to a user-facing PortFast edge port
- Root Guard applied where an access switch must never advertise a superior root
- PortFast applied to the redundant interswitch alternate port
- Loop Guard on the non-designated redundant link
Explanation
Correct Answer
D:Loop Guard observes non-designated STP ports that are supposed to receive BPDUs. If the BPDUs stop, it can hold the port in a loop-inconsistent blocked condition rather than allowing it to become designated and forward into a physical loop. When BPDUs resume, recovery is automatic. This directly matches an alternate/root-port unidirectional or missing-BPDU event. Confirm the port's STP role with `show spanning-tree`, check for loop-inconsistent state and investigate the physical or protocol fault. Root Guard, by contrast, is intended for superior BPDUs received on designated ports. Loop Guard cannot rescue links that were already unidirectional before a normal BPDU relationship ever existed, so physical diagnostics still matter.
Incorrect Answers
A:BPDU Guard is designed to protect edge-facing ports by reacting when a BPDU is unexpectedly received, commonly errdisabling the port. The issue here is the opposite: an alternate network link stops receiving the expected BPDUs, risking a false assumption of a loop-free path. BPDU Guard does not provide the required loss-of-BPDU protection for this non-designated interswitch role.
B:Root Guard prevents a designated port from accepting a superior-BPDU root change and can place it in root-inconsistent state. It is not the correct mechanism for an alternate or root port that stops receiving BPDUs. Cisco documents the roles as different: Root Guard protects the intended root hierarchy, whereas Loop Guard protects non-designated paths from transitioning incorrectly when expected BPDUs vanish. They should not be interchanged on the same port.
C:PortFast speeds the transition of genuine edge ports to forwarding and is not appropriate on a redundant interswitch alternate path. Applying it here could bypass the normal participation safeguards that prevent Layer 2 loops. The root problem is missing expected control-plane BPDUs, not a legitimate host-facing device needing faster access initialization. Changing PortFast settings would aggravate the risk.
