Question 1

On a Cisco Catalyst switch, which command displays the MAC address forward/filter table (the Layer 2 CAM table)?

Accepted Answer

Introduction / Context:Switches maintain a Content Addressable Memory (CAM) table—often called the MAC address table—to map MAC addresses to ports for efficient forwarding. Troubleshooting Layer 2 connectivity frequently requires viewing this table. Given Data / Assumptions: Environment: Cisco IOS/Catalyst syntax. Goal: Display the learned MAC entries and associated interfaces/VLANs. Concept / Approach:On modern Cisco switches, the command is show mac address-table. Older platforms might use show mac-address-table, but the commonly accepted form in IOS is as shown. Other listed commands are invalid or serve different purposes. Step-by-Step Solution: Recall the feature name: MAC address table (CAM).Match it to the IOS show command: show mac address-table.Exclude unrelated commands like show run (configuration), and non-existent syntaxes like show mac filter or show mac filter-table. Verification / Alternative check:Issuing show mac address-table dynamic displays dynamically learned entries by VLAN and port. Why Other Options Are Wrong:show run: Shows configuration, not learned MACs. show mac filter / show mac filter-table: Not standard IOS commands for MAC learning. Common Pitfalls:Confusing ARP tables (Layer 3) with MAC tables (Layer 2). ARP is viewed on routers/Layer 3 SVI with show arp. Final Answer:show mac address-table

Question 2

Two-switch redundancy without STP: Two switches are connected with two crossover links for redundancy, but Spanning Tree Protocol (STP) is disabled. What will happen on this switched network?

Accepted Answer

Introduction / Context:Layer 2 redundancy without loop prevention leads to switching loops. Spanning Tree Protocol (STP) is designed to detect and block redundant paths, preventing broadcast storms and MAC table instability. Given Data / Assumptions: Two physical links between the same pair of switches. STP is explicitly disabled. Standard Ethernet switching behavior applies. Concept / Approach:Without STP, frames can circulate indefinitely across redundant paths, especially broadcasts, multicasts, and unknown unicasts, causing exponential traffic growth (broadcast storms) and MAC table flapping. Step-by-Step Solution: Redundant links + no STP → a Layer 2 loop exists.Broadcast or unknown unicast frames are flooded on all ports.Frames loop back across the second link, are re-flooded, and repeat, overwhelming the network. Verification / Alternative check:Packet captures and switch CPU utilization during such misconfigurations reveal increasing duplicate frames and high utilization. Why Other Options Are Wrong:Load balance automatically: L2 switches do not load-balance parallel links by default; STP blocks one. Routing tables: Pure L2 switches do not have L3 routing tables. MAC tables not updating: They will update, but flapping occurs because of looping frames. Common Pitfalls:Assuming redundancy is always good; without loop prevention it is catastrophic at Layer 2. Final Answer:Broadcast storms will occur on the switched network.

Question 3

Characteristics of Layer 2 switching: which of the following are typically provided? (Hardware-based bridging using ASICs, wire-speed forwarding, low latency, and low cost)

Accepted Answer

Introduction / Context:Layer 2 switches forward frames using MAC address tables and specialized hardware. Recognizing their performance traits helps in designing cost-effective, high-throughput campus networks. Given Data / Assumptions: Features listed: hardware-based bridging (ASICs), wire speed, low latency, and low cost compared to routers. Context: typical Ethernet switching platforms. Concept / Approach:Switches leverage ASICs to perform lookups and forwarding at line rate, minimizing per-frame processing overhead and latency. Economies of scale make basic Layer 2 devices relatively inexpensive compared to higher-layer devices. Step-by-Step Solution: Hardware-based bridging → true; ASICs do L2 lookups quickly.Wire-speed → true; forwarding keeps up with interface line rates.Low latency → true; minimal processing compared to routing.Low cost → true; simpler feature set vs L3 routers. Verification / Alternative check:Vendor datasheets routinely specify wire-rate performance and microsecond-level latency for ASIC-based switches. Why Other Options Are Wrong:Any subset excludes valid properties and is therefore incomplete. Common Pitfalls:Assuming “wire speed” regardless of oversubscription; backplane and uplink capacities still matter. Final Answer:All of the above

Question 4

Effect of segmenting an Ethernet with a bridge/switch: which statements correctly describe the impact on collision and broadcast domains?

Accepted Answer

Introduction / Context:Switches (bridges) segment collision domains at Layer 2 but do not, by default, segment broadcast domains. Understanding this distinction is fundamental to LAN design and performance optimization. Given Data / Assumptions: Statements include effects on the number and size of collision domains and broadcast domains. No VLANs or routing are introduced—just bridging/switching. Concept / Approach:Each switch port is its own collision domain, so adding a switch increases the count of collision domains while reducing their size per segment. Broadcasts, however, are forwarded out all ports within the same VLAN, so a single broadcast domain persists unless VLANs or routers are used. Step-by-Step Solution: Collision domains: increase in number (true) and become smaller per segment (true).Broadcast domains: unchanged with plain switching (neither increased nor decreased).Therefore, correct set is “1 and 5.” Verification / Alternative check:Observe with half-duplex hubs vs switches: collisions vanish per port; broadcasts still reach all ports in the VLAN. Why Other Options Are Wrong:Options including 3 or 4: Claim broadcast domain changes, which is false without VLANs/routers. Options including 6: “Larger collision domains” is incorrect; the opposite is true. Common Pitfalls:Confusing VLANs (which segment broadcast domains) with basic switching (which does not). Final Answer:1 and 5

Question 5

Switch learning and forwarding behavior: If a switch receives a frame where the source MAC is not yet in the MAC table but the destination MAC is present, what does the switch do?

Accepted Answer

Introduction / Context:Learning bridges and switches build a MAC table by observing source addresses on incoming frames. Correctly understanding this process helps explain forwarding, flooding, and convergence behaviors in Ethernet LANs. Given Data / Assumptions: Source MAC is currently unknown to the switch. Destination MAC is known and mapped to a specific egress port. No security features (like port security) are preventing learning. Concept / Approach:Switches learn on source, forward based on destination. Upon receiving a frame, the switch adds the source MAC and ingress port to the table. If the destination is known, it forwards only out that destination port (unicast forwarding). Step-by-Step Solution: Update CAM: learn source MAC → associate with ingress port.Lookup destination MAC: found → identify egress port.Forward frame out the single destination port. Verification / Alternative check:show mac address-table after traffic shows the learned source entry; subsequent frames will be forwarded without flooding. Why Other Options Are Wrong:Flooding: Occurs only when destination is unknown or broadcast/multicast. Adding the destination: Destination learning does not occur on lookup; learning is based on source addresses. Common Pitfalls:Assuming learning occurs on both source and destination; it does not. Only sources trigger learning. Final Answer:Add the source address and port to the MAC address table and forward the frame out the destination port

Question 6

Collision vs broadcast domains: Which statement about what a switch and a router create is true in a default, non-VLAN Ethernet LAN?

Accepted Answer

Introduction / Context:Designing Ethernet LANs requires distinguishing how switches and routers segment traffic. Switches break up collisions; routers break up broadcasts. This determines scalability and performance. Given Data / Assumptions: No VLANs are configured; one VLAN, one broadcast domain across the switch. Switch ports operate as individual collision domains. Routers separate broadcast domains at Layer 3. Concept / Approach:Each switch port is its own collision domain; hence, a switch creates many collision domains but still one broadcast domain per VLAN. A router does not forward broadcasts between interfaces, thereby creating distinct broadcast domains on each interface/subnet. Step-by-Step Solution: Switch: multiple collision domains (per port) + one broadcast domain (per VLAN).Router: separates broadcast domains by subnets (no L2 broadcast forwarding).Match to answer set → option describing separate collisions for switch and separate broadcast domains via router. Verification / Alternative check:Simple lab: ARP broadcast will traverse all switch ports in a VLAN, but not pass through the router to another subnet. Why Other Options Are Wrong:Options claiming a switch creates multiple broadcast domains are wrong without VLANs. Options claiming a router creates only collision domains misunderstand L3 behavior. Common Pitfalls:Equating switch segmentation with broadcast segmentation; only VLANs or routers segment broadcasts. Final Answer:A switch creates separate collision domains but one broadcast domain. A router provides a separate broadcast domain.

Question 7

Core Layer 2 switch functions that increase effective bandwidth include which items? (Address learning, Routing, Forwarding and filtering, Creating network loops, Loop avoidance, IP addressing)

Accepted Answer

Introduction / Context:Layer 2 switches improve LAN throughput by learning where stations reside and by controlling frame propagation. Recognizing which functions are Layer 2 responsibilities clarifies how bandwidth is preserved. Given Data / Assumptions: Candidates: (1) Address learning, (2) Routing, (3) Forwarding and filtering, (4) Creating loops, (5) Loop avoidance (e.g., STP), (6) IP addressing. Focus is strictly Layer 2 operations. Concept / Approach:Switches learn source MACs and build a table, then forward known unicasts only out the correct port (filtering others), and use loop-avoidance mechanisms to prevent storms. Routing and IP addressing are Layer 3 and do not apply to L2 switching. Step-by-Step Solution: (1) Address learning → yes, L2 core function.(3) Forwarding and filtering → yes, central to switching.(5) Loop avoidance → yes, via STP/RSTP/MSTP.(2) Routing and (6) IP addressing → L3, not L2.(4) Creating loops → harmful, not a feature. Verification / Alternative check:Switch command outputs (show mac address-table, show spanning-tree) evidence learning and loop prevention. Why Other Options Are Wrong:Any set that includes routing/IP addressing or loop creation mixes non-L2 or undesirable behaviors. Common Pitfalls:Assuming IP addressing is required for switching; it is only needed for management or L3 SVIs, not for pure L2 forwarding. Final Answer:1, 3 and 5

Question 8

Multiple copies of the same unicast frame in a switched LAN: under which circumstance is this most likely?

Accepted Answer

Introduction / Context:Switched Ethernet should deliver each unicast frame once. However, network design mistakes—especially loops without proper control—can cause duplicate unicast frames, confusing hosts and applications. Given Data / Assumptions: Environment includes redundant links between switches. Spanning Tree Protocol may be misconfigured or disabled. MAC learning may flap due to looping traffic. Concept / Approach:In a faulty redundant topology, the same unicast frame can traverse multiple looped paths and be delivered more than once. STP, RSTP, or MSTP prevents this by blocking redundant links until needed. Step-by-Step Solution: Consider a loop without STP: unknown unicasts/broadcasts flood both links.Frame circulates and may reappear at the destination multiple times.Hosts see duplicates; MAC tables flap as the source appears on different ports. Verification / Alternative check:Packet captures show identical sequence numbers and data arriving repeatedly; switch logs may show STP disabled and MAC moves. Why Other Options Are Wrong:High traffic: Increases load but not duplication by itself. After link restoration: STP convergence momentarily can cause brief anomalies, but persistent duplicates indicate a loop. Upper-layer reliability: TCP retransmits missing segments, not duplicate Ethernet frames from the LAN. Common Pitfalls:Blaming servers or applications when the root cause is a Layer 2 loop. Always verify STP status and physical topology. Final Answer:In an improperly implemented redundant topology

Question 9

Switching and loop prevention (Layer 2): Which of the following is a Layer 2 control protocol specifically designed to maintain a loop-free topology in an Ethernet switched network?

Accepted Answer

Introduction / Context:The classic problem in switched Ethernet LANs is that redundant links, while good for availability, create Layer 2 loops. These loops can cause broadcast storms and MAC address table instability. The industry solution is the Spanning Tree Protocol (STP), a Layer 2 control protocol that logically blocks some paths to guarantee a single active tree. Given Data / Assumptions: We are discussing Layer 2 (Data Link) control behavior, not Layer 3 routing. The environment is an Ethernet switched LAN with potential redundant links. We want the protocol whose purpose is loop prevention at Layer 2. Concept / Approach:STP elects a root bridge, calculates the shortest path tree using path cost, and places nonessential ports into a blocking (or alternate) state. Variants include 802.1D (original), 802.1w (Rapid STP), and 802.1s (Multiple STP). Other protocols listed serve different roles (discovery, VLAN management, routing). Step-by-Step Solution: Identify the loop-prevention requirement at Layer 2.Map protocols to roles: STP (loop prevention), VTP (VLAN database sharing), CDP/LLDP (neighbor discovery), RIP (Layer 3 routing).Select STP as the only Layer 2 protocol that builds a loop-free logical topology. Verification / Alternative check:Vendor docs and IEEE 802.1D/W/S define STP/RSTP/MSTP as the loop-avoidance mechanisms. No other listed protocol performs this function at Layer 2. Why Other Options Are Wrong: VTP: Manages VLANs across Cisco switches; does not block loops. RIP: Layer 3 distance-vector routing; not a Layer 2 protocol. CDP/LLDP: Neighbor discovery; informational only. Common Pitfalls:Confusing VTP (VLAN sharing) with STP; assuming link aggregation replaces STP (bundles still need loop control across topologies). Final Answer:STP

Question 10

Cisco Catalyst port security policy: You must permit exactly one host to learn dynamically on each access interface and shut the port on any violation. Which two interface-level commands meet this requirement?

Accepted Answer

Introduction / Context:Catalyst switches can limit the number of MAC addresses learned per access port to mitigate MAC flooding and unauthorized device attachment. Enforcing “exactly one host” per interface and shutting the port on violations is a classic use of port security. Given Data / Assumptions: The goal is one dynamically learned MAC per access port. On violation, the port must transition to an error-disabled state (shutdown). Configuration is at the interface level for port security behavior. Concept / Approach:Port security is configured under the interface with switchport port-security options. Two key knobs are the maximum number of MACs and the violation action. To actually enable port security, you also use switchport port-security (base command). Among the options provided, only the maximum limiter and violation action are relevant interface-level commands. Step-by-Step Solution: Set limit: switchport port-security maximum 1Set action: switchport port-security violation shutdown(Enable feature: switchport port-security) — base enable not shown among options but required in practice. Verification / Alternative check:Use show port-security interface to confirm the maximum and violation mode, and test with a second host to see the port error-disable. Why Other Options Are Wrong: ip access-group 10: Applies an ACL at Layer 3/4; not port security. access-list 10 permit ip host 1: Irrelevant and syntactically incomplete. mac-address-table secure: Not a valid global configuration command for this purpose. Common Pitfalls:Forgetting the base switchport port-security command; using sticky without understanding persistence; applying ACLs instead of port security. Final Answer:Switch(config-if)# switchport port-security maximum 1 and Switch(config-if)# switchport port-security violation shutdown

Question 11

Rapid Spanning Tree (IEEE 802.1w): On Cisco switches, which global configuration command enables the 802.1w RSTP behavior?

Accepted Answer

Introduction / Context:Rapid Spanning Tree Protocol (RSTP), standardized as IEEE 802.1w, accelerates convergence compared to the original 802.1D STP. Cisco implements RSTP per-VLAN with the rapid-pvst mode (Rapid-PVST+). Given Data / Assumptions: Command must be entered in global configuration (config) mode. We want Cisco’s RSTP implementation across VLANs. Exact keyword syntax matters. Concept / Approach:On IOS, spanning tree mode choices typically include pvst, rapid-pvst, and mst. There is no literal mode 802.1w command. Therefore, the correct configuration uses the Rapid-PVST keyword in config mode. Step-by-Step Solution: Enter global config: configure terminal.Apply: spanning-tree mode rapid-pvstVerify: show spanning-tree summary (should report mode as rapid-pvst). Verification / Alternative check:Use show spanning-tree and show spanning-tree summary to verify RSTP timers/roles (alternate/backup ports appear only in RSTP). Why Other Options Are Wrong: EXEC mode variants (with # prompt) do not set persistent configuration. mode 802.1w is not valid syntax. mstp-rapid is not a Cisco keyword. Common Pitfalls:Confusing RSTP (rapid-pvst) with MST (spanning-tree mode mst); mixing modes across a Layer 2 domain causing PVST simulation issues. Final Answer:Switch(config)# spanning-tree mode rapid-pvst

Question 12

STP convergence state: After a spanning-tree topology has converged, which statement accurately describes the state of switch/bridge ports?

Accepted Answer

Introduction / Context:Spanning Tree Protocol converges by selecting a root bridge and then determining which links forward and which must be blocked to prevent loops. Understanding the steady-state port roles and states is essential for troubleshooting and design. Given Data / Assumptions: Classic STP (802.1D) and RSTP (802.1w) converge to a loop-free tree. Ports have roles (root, designated, alternate/backup) and states (forwarding, blocking/discarding). Edge/PortFast ports transition rapidly but still obey loop-free principles. Concept / Approach:In a converged topology, exactly enough ports forward to maintain connectivity; redundant paths are placed in a non-forwarding state (blocking in 802.1D, discarding in 802.1w). Therefore, every non-administratively-down port is either forwarding or blocked/discarding. Step-by-Step Solution: Recognize that forwarding on all ports would create loops — impossible.Note roles: root and designated ports forward; non-designated (alternate/backup) block/discard.Select the statement that includes both forwarding and blocking states. Verification / Alternative check:show spanning-tree output displays port roles and states; you will observe a mix of forwarding and discarding states in redundant topologies. Why Other Options Are Wrong: “All ports forwarding” is false in a redundant design. “All ports root or designated” ignores non-designated/alternate roles. “Blocking or looping” uses a nonstandard term; ports do not “loop.” “Only edge ports forward” is inaccurate; trunk/root/designated ports also forward. Common Pitfalls:Equating roles with states; forgetting that RSTP uses “discarding” not “blocking,” though conceptually similar. Final Answer:All ports are in either the forwarding or blocking (alternate) state.

Question 13

Purpose of Spanning Tree Protocol (STP) in a switched LAN: What primary problem does STP solve in Ethernet networks with redundant links?

Accepted Answer

Introduction / Context:Redundant Layer 2 paths are valuable for resiliency, but they introduce the risk of loops. Unlike routed networks that use TTL decrements and routing protocols, Layer 2 frames can circulate indefinitely, causing broadcast storms and MAC table instability. STP is designed to address this. Given Data / Assumptions: Ethernet switches forward based on MAC tables and flood unknown/broadcast traffic. Redundant physical links may exist between switches. Goal: loop-free operation without manually disabling paths. Concept / Approach:STP elects a root bridge and prunes the topology logically, leaving one active path per segment. Root and designated ports forward, while redundant paths are blocked, preventing loops. Rapid and Multiple STP variants improve convergence and scalability while preserving the core objective. Step-by-Step Solution: Identify the layer in question: Layer 2 switching.Recognize the problem: loops from redundant links.Map STP’s function: compute a loop-free spanning tree and block excess paths. Verification / Alternative check:Topology diagrams with triangles of switches demonstrate that, after STP convergence, exactly one link in the triangle is placed in a blocking/discarding state to prevent loops. Why Other Options Are Wrong: Network monitoring is unrelated to loop prevention. Routing loops are Layer 3 and handled by routing protocols, not STP. VLAN database management (e.g., VTP) is a different control plane task. Collision domains are defined by switch ports; STP does not create them. Common Pitfalls:Confusing STP with routing protocols; assuming link aggregation alone eliminates loops (it does not across topologies). Final Answer:Prevent switching loops in redundant Layer 2 topologies

Question 14

Switch port LED indications: On a Cisco switch, a port Status LED that alternates between green and amber typically indicates which condition?

Accepted Answer

Introduction / Context:Port LEDs on Cisco Catalyst switches provide quick diagnostics without using the CLI. Understanding common color patterns helps network engineers rapidly identify cabling faults, duplex mismatches, or other anomalies. Given Data / Assumptions: We are discussing the Status LED behavior, not Mode LEDs like speed/PoE. Alternating green/amber is a distinct pattern from solid green, solid amber, or off. Platform families share similar conventions (exact patterns can vary by model). Concept / Approach:In general Cisco guidance, steady green means a healthy link, steady amber often indicates STP blocking or a disabled/error state, and alternating green/amber signals a problem such as link faults or excessive errors. Engineers should confirm via documentation for the specific model and verify using CLI counters. Step-by-Step Solution: Observe LED pattern: alternating green/amber.Associate pattern with error condition (e.g., excessive CRCs, collisions, link flaps).Verify using show interface to check errors and STP state. Verification / Alternative check:If STP blocking were the cause, many models show steady amber (not alternating). Error counters rising in the CLI corroborate the LED indication. Why Other Options Are Wrong: Administrative shutdown typically shows LED off or steady amber, not alternating. STP blocking commonly presents steady amber; alternating suggests faults. Calling it “normal” or “half-duplex by design” ignores the fault indication. Common Pitfalls:Relying solely on LEDs without checking interface logs; misinterpreting model-specific legends—always cross-check the device guide. Final Answer:The port is experiencing errors.

Question 15

Edge ports and server links: You plan to connect a server on an access port and do not want STP delays on link-up. Which Cisco command should you use on that interface (safe edge behavior, not a global disable)?

Accepted Answer

Introduction / Context:Servers and endpoints benefit from immediate forwarding on link-up. Waiting through STP listening/learning states delays DHCP and application startup. Cisco provides a safe edge optimization called PortFast for access ports that are not expected to form loops. Given Data / Assumptions: The port connects to a single server (no switch behind it). We want to avoid the normal STP delay but not disable loop protection across the network. The correct solution is interface-level. Concept / Approach:spanning-tree portfast transitions the port quickly to forwarding while still allowing STP to protect against loops (BPDU Guard can be added for safety). Disabling STP entirely is dangerous and not recommended. Step-by-Step Solution: On the access interface, configure: spanning-tree portfastOptionally add: spanning-tree bpduguard enableVerify with: show spanning-tree interface detail Verification / Alternative check:Observe immediate forwarding on link-up and successful client DHCP without delay. If a switch is inadvertently connected, BPDU Guard will err-disable the port. Why Other Options Are Wrong: Global or interface commands to “turn off” STP are unsafe and often invalid syntax. spanning-tree security is not a valid command. no spanning-tree vlan 1 disables STP for a VLAN globally—risky and not the intent. Common Pitfalls:Confusing PortFast with disabling STP; forgetting BPDU Guard on edge ports. Final Answer:spanning-tree portfast

Question 16

Switch forwarding behavior: When a switch receives a frame and the destination MAC address is unknown (not present in the MAC table), what action does it take?

Accepted Answer

Introduction / Context:Ethernet switches learn MAC addresses by inspecting the source MAC of inbound frames and associating them with ingress ports. When the destination is unknown, the switch must still attempt delivery without prior knowledge, using a defined fallback behavior. Given Data / Assumptions: The switch operates in store-and-forward or cut-through but still consults its MAC table. The destination MAC does not exist in the current table. The switch is not using higher-layer protocols for decision-making. Concept / Approach:The IEEE bridging behavior (learning bridge) dictates that unknown unicast frames are flooded out all ports in the same VLAN except the port on which the frame arrived. The first return traffic from the true destination allows the switch to learn the proper MAC-to-port mapping. Step-by-Step Solution: Receive frame; check destination MAC in table: miss.Flood frame out all other ports in the same VLAN.When the destination replies, learn its MAC/port; future frames are unicasted correctly. Verification / Alternative check:Packet captures on multiple switch ports show replication of unknown unicast frames during the learning phase. After learning, only the correct egress port sees the traffic. Why Other Options Are Wrong: Forwarding to the “first available link” is not defined behavior. Dropping would prevent initial communication. Switches do not perform name resolution; that is a host/DNS task. Sending only to a default gateway is incorrect within the same VLAN. Common Pitfalls:Confusing broadcast with unknown unicast; forgetting VLAN separation (flooding occurs within VLAN boundaries). Final Answer:Floods the frame out all ports except the ingress port

Spanning Tree Protocol Questions

Questions

Practice smarter