Cisco CCNA 200-301 Network Access Practice Questions

Free CCNA 200-301 Network Access practice test questions

8 questions from this domain with answers and explanations - different from the samples on the main Cisco CCNA 200-301 page. Sign up free to practice the full set.

1. Question 1Network Access

   Which command is used to assign a Cisco switch port to VLAN 20?

   • AVlan 20
   • BSwitchport access vlan 20Correct
   • CSwitchport trunk allowed vlan 20
   • DSwitchport mode trunk
   ✓ Correct answer: B

   On a Cisco switch, the interface-level command 'switchport access vlan 20' configures the port as an access port belonging to VLAN 20. This command is used after setting the port to access mode with 'switchport mode access'. The VLAN must either already exist in the VLAN database or it will be created automatically. This is the standard method for placing end-host ports into a specific VLAN for Layer 2 segmentation.

   Why the other options are wrong

   • A'vlan 20' is a global configuration command used to create or enter the VLAN database for VLAN 20 - it does not assign an interface to that VLAN; that requires the 'switchport access vlan 20' interface command.
   • C'switchport trunk allowed vlan 20' modifies which VLANs are permitted on a trunk link - it does not configure an access port assignment and would only affect trunk port behavior, not place a port into access mode for VLAN 20.
   • D'switchport mode trunk' configures the port as a trunk port that carries multiple VLANs using 802.1Q tagging - it does not assign the port to a single specific VLAN for end-host access.
2. Question 2Network Access

   Which Spanning Tree Protocol feature allows an edge port to immediately transition to the forwarding state when connected to an end device?

   • APortFastCorrect
   • BBPDU Guard
   • CRoot Guard
   • DLoop Guard
   ✓ Correct answer: A

   PortFast is an STP feature that causes a switch port to skip the Listening and Learning states and move directly to Forwarding when the link comes up. This eliminates the 30-50 second STP convergence delay that would otherwise prevent end-user devices from obtaining DHCP addresses or accessing the network immediately after connecting. PortFast should only be enabled on ports connected to hosts, never on ports facing other switches.

   Why the other options are wrong

   • BBPDU Guard complements PortFast by shutting down a port if a BPDU is received on it (indicating a rogue switch connection), but it does not itself cause the port to skip STP states.
   • CRoot Guard prevents a port from accepting superior BPDUs that would cause a non-root switch to become the root bridge; it protects the STP topology but does not accelerate port state transitions.
   • DLoop Guard prevents a port from transitioning to Forwarding if it stops receiving BPDUs, guarding against unidirectional link failures; it slows transitions rather than accelerating them.
3. Question 3Network Access

   How does Spanning Tree Protocol prevent Layer 2 loops?

   • AIt shuts down every redundant physical link
   • BIt load-balances frames over all redundant links
   • CIt filters broadcast frames at each port
   • DIt places redundant ports in a blocking stateCorrect
   ✓ Correct answer: D

   STP elects a root bridge and computes each switch's best path to it, then puts loop-forming ports into a blocking (discarding) state. Blocked ports carry no user data but still listen for BPDUs, so they can be reactivated if an active link fails. This prevents broadcast storms and MAC table instability.

   Why the other options are wrong

   • ASTP blocks specific ports logically rather than shutting every redundant link down.
   • BClassic STP does not load-balance; it blocks redundant paths to prevent loops.
   • CSTP does not selectively filter broadcasts; it blocks ports to break loops.
4. Question 4Network Access

   Which requirement must EtherChannel member ports meet?

   • ADifferent speeds to spread the traffic load
   • BMatching speed, duplex, and VLAN settingsCorrect
   • CA unique native VLAN on each member port
   • DAssignment to a separate access VLAN each
   ✓ Correct answer: B

   For links to bundle into one EtherChannel, member interfaces must match on speed, duplex, switchport mode, and VLAN configuration (access VLAN, or allowed list and native VLAN for trunks). A mismatched port is excluded from the bundle or err-disabled. Consistent settings ensure uniform load distribution.

   Why the other options are wrong

   • AMembers must have identical speeds, not different ones, to bundle.
   • CAll members must share the same native VLAN, not a unique one each.
   • DAll members must use the same access VLAN, not separate VLANs.
5. Question 5Network Access

   A network administrator at a shipping company is troubleshooting an EtherChannel bundle that will not form. She has configured 'channel-group 1 mode on' on both switches. The port speeds match, but one side has ports in VLAN 10 and the other in VLAN 20. Why will the EtherChannel not form?

   • AThe channel-group number must be different on each switch for the bundle to form
   • BMode 'on' requires LACP to be configured
   • CEtherChannel only supports trunk ports, not access ports
   • DEtherChannel needs matching VLAN configuration on all member ports at both endsCorrect
   ✓ Correct answer: D

   EtherChannel (whether configured with mode 'on', LACP, or PAgP) requires that all parameters on the bundled ports match on both sides, including speed, duplex, VLAN assignments, and trunk/access mode. When one switch has ports in VLAN 10 and the other has ports in VLAN 20, this mismatch prevents the EtherChannel from forming because a logical bundle cannot be created from ports with inconsistent Layer 2 configurations.

   Why the other options are wrong

   • AThe group number is only locally significant, so it neither has to match nor differ.
   • BMode 'on' does not require LACP - in fact, mode 'on' bypasses negotiation protocols entirely and forces the bundle without using either LACP or PAgP.
   • CEtherChannel supports both trunk and access ports - the restriction is that all ports in the bundle must be consistently configured, not that only trunk ports are allowed.
6. Question 6Network Access

   A Cisco switch port is configured with 'switchport voice vlan 100' and 'switchport access vlan 10'. How is traffic from an attached IP phone and the PC behind it handled?

   • ABoth the phone and PC traffic are placed untagged in VLAN 10
   • BPhone traffic is tagged for VLAN 100 and PC traffic is untagged in VLAN 10Correct
   • CBoth phone and PC traffic are tagged for VLAN 100
   • DThe PC traffic is dropped because the port is in voice mode
   ✓ Correct answer: B

   A voice VLAN allows a single access port to carry two VLANs: the IP phone sends 802.1Q-tagged frames for the voice VLAN, and the PC connected to the phone's data port sends untagged frames placed in the access (data) VLAN. This avoids needing a full trunk to the phone.

   Why the other options are wrong

   • AVoice traffic is tagged for VLAN 100, not placed untagged in the data VLAN.
   • COnly voice traffic is tagged; the PC's data frames remain untagged in the access VLAN.
   • DPC traffic is forwarded in the access VLAN; a voice VLAN does not block data traffic.
7. Question 7Network Access

   In an 802.1Q trunk, what is the size in bytes of the VLAN tag that is inserted into the Ethernet frame header?

   • A2 bytes
   • B4 bytesCorrect
   • C8 bytes
   • D12 bytes
   ✓ Correct answer: B

   The 802.1Q tag is inserted between the Source MAC and EtherType fields and consists of a 2-byte Tag Protocol Identifier (TPID, 0x8100) and a 2-byte Tag Control Information field (containing the PCP, DEI, and 12-bit VLAN ID), totaling 4 bytes.

   Why the other options are wrong

   • A2 bytes is only the size of the TCI portion or the TPID alone, not the full tag.
   • C8 bytes is incorrect; the full 802.1Q tag is 4 bytes.
   • D12 bytes corresponds to the bit-length of the VLAN ID field (12 bits), not the byte size of the tag.
8. Question 8Network Access

   During router-on-a-stick configuration, which command is used on a router subinterface to associate it with VLAN 30 and enable 802.1Q tagging?

   • Aswitchport trunk encapsulation dot1q 30
   • Bencapsulation dot1q 30Correct
   • Cswitchport access vlan 30
   • Dvlan 30 tag dot1q
   ✓ Correct answer: B

   On a router subinterface (e.g., Gi0/0.30), 'encapsulation dot1q 30' tells the router to tag/untag traffic for VLAN 30, allowing inter-VLAN routing over a single physical trunk link.

   Why the other options are wrong

   • A'switchport' commands are used on switch ports, not router subinterfaces, and this syntax is invalid.
   • C'switchport access vlan' is a switch access-port command, not valid on a router subinterface.
   • DThis is not valid Cisco IOS syntax.

How Network Access is tested

This domain holds 137 of the 705 questions in the CCNA 200-301 bank, about 19%. The mix is 114 single-answer multiple choice and 23 multiple-response, so it is worth practising the formats as well as the content.

Once you have a few attempts recorded, CertGrid scores every domain separately and points you at the weakest one, so you can drill Network Access on its own rather than re-running full-length mocks.

Other CCNA 200-301 exam domains

• Network Fundamentals148 questions
• IP Connectivity175 questions
• IP Services70 questions
• Security Fundamentals105 questions
• Automation and Programmability70 questions
• All CCNA 200-301 practice questions705 total
• Network Access study notesKey concepts
• Cisco practice examsAll Cisco

CCNA 200-301 Network Access FAQ