AP Networking Switching, VLANs, and Ethernet Practice Test

1. Destination MAC address
2. TCP source port
3. DNS hostname
4. DHCP lease number

Correct answer: A. Destination MAC address

Ordinary Layer 2 forwarding uses the destination MAC within the VLAN. IP routing is a separate function.

1. DNS answer
2. Default gateway metric
3. Destination IP address
4. Source MAC address

Correct answer: D. Source MAC address

The switch records the arriving frame's source MAC and ingress port. Seeing a destination does not reveal where that destination lives.

1. An endpoint in one data VLAN
2. Only DNS servers
3. Only routers using BGP
4. Every VLAN as tagged traffic automatically

Correct answer: A. An endpoint in one data VLAN

A typical access port handles one untagged data VLAN. Voice-VLAN and other special configurations require explicit design.

1. Resolving hostnames
2. Carrying traffic for multiple VLANs over a link
3. Replacing all routing
4. Assigning DHCP leases

Correct answer: B. Carrying traffic for multiple VLANs over a link

A trunk preserves VLAN identity across a shared link, usually using 802.1Q tags and a configured native VLAN.

1. A cable speed
2. A DNS search domain
3. A separate public Internet
4. A separate broadcast domain

Correct answer: D. A separate broadcast domain

Broadcast forwarding is contained within the VLAN. Inter-VLAN communication needs a routing function and policy.

1. Only identical cable lengths
2. Only MAC learning
3. A permitted Layer 3 path
4. Only the same SSID name

Correct answer: C. A permitted Layer 3 path

Layer 2 switching does not itself route between VLANs. A router or Layer 3 switch can provide that path.

1. Flood it to every VLAN
2. Send it only to DNS
3. Flood it to eligible ports in the same VLAN except ingress
4. Discard it because all destinations must already be learned

Correct answer: C. Flood it to eligible ports in the same VLAN except ingress

The destination is unknown, so flooding stays within the appropriate VLAN and excludes the arrival port, subject to configured controls.

1. It is always encrypted
2. It automatically crosses all routers
3. It goes only to the DNS server
4. It is flooded to eligible ports in that VLAN except ingress

Correct answer: D. It is flooded to eligible ports in that VLAN except ingress

A VLAN bounds the Layer 2 broadcast domain. Routers do not ordinarily forward those Ethernet broadcasts into other subnets.

1. DNS
2. HTTP
3. Spanning Tree Protocol
4. DHCP

Correct answer: C. Spanning Tree Protocol

STP can block redundant paths to create a loop-free active topology. Redundant physical links require appropriate control.

1. HTTP/2
2. TLS 1.3
3. RFC 1918
4. IEEE 802.1Q

Correct answer: D. IEEE 802.1Q

802.1Q tags identify VLAN membership on Ethernet frames. RFC 1918 concerns private IPv4 addressing.

1. VLAN, MAC address, and port
2. DNS zone and TTL
3. Hostname and password
4. IP prefix and WAN subscription

Correct answer: A. VLAN, MAC address, and port

MAC forwarding entries are scoped to VLANs and identify output interfaces. They are not routing-table prefixes.

1. Their VLAN is deleted
2. They are removed unless refreshed by traffic
3. They become permanent routes
4. They are turned into DNS records

Correct answer: B. They are removed unless refreshed by traffic

Aging removes stale learned locations. Subsequent traffic can relearn a source or trigger unknown-unicast flooding.

1. The local gateway's MAC
2. The subnet broadcast MAC always
3. The remote server's MAC across the Internet
4. The DNS server's MAC always

Correct answer: A. The local gateway's MAC

The host sends the IP packet toward its next hop. Ethernet addresses identify the current local-link delivery.

1. 255.255.255.0
2. 00:00:00:00:00:00
3. FF:FF:FF:FF:FF:FF
4. 127.0.0.1

Correct answer: C. FF:FF:FF:FF:FF:FF

All-one MAC bits indicate Ethernet broadcast. IPv4 strings are not MAC addresses.

1. A DNS zone serial
2. The MAC corresponding to a local IPv4 address
3. The best WAN metric
4. A TCP password

Correct answer: B. The MAC corresponding to a local IPv4 address

ARP resolves an IPv4 address to a link-layer address on the local link. It does not resolve hostnames.

1. Every port in every VLAN
2. Port 3
3. Back to port 1
4. Only the uplink regardless of the table

Correct answer: B. Port 3

The learned destination entry selects port 3. Flooding is unnecessary when a valid entry identifies the destination.

1. Replacing STP
2. Restricting permitted MAC use according to configuration
3. Creating subnet masks
4. Providing DNS encryption

Correct answer: B. Restricting permitted MAC use according to configuration

Port security can limit allowed source MACs and respond to violations. It is one control, not complete authentication or encryption.

1. Eliminate all firewall rules
2. Separate Layer 2 domains and enable controlled routed policy
3. Increase copper length limits
4. Guarantee every packet is encrypted

Correct answer: B. Separate Layer 2 domains and enable controlled routed policy

VLANs provide segmentation; routing policy still determines permitted exchanges. Segmentation alone does not encrypt traffic.

1. Routing table
2. DNS zone file
3. Switch MAC table
4. DHCP reservation list

Correct answer: A. Routing table

Routing tables select Layer 3 paths. MAC tables handle local Ethernet forwarding within VLANs.

1. Increase DHCP TTL
2. Change all client DNS suffixes
3. Enable it according to the intended configuration
4. Rename the VLAN only

Correct answer: C. Enable it according to the intended configuration

An administrative shutdown blocks the interface regardless of correct endpoint IP settings.

1. All tagged traffic loses VLAN identity
2. Untagged ingress traffic is assigned to the configured native VLAN
3. Native VLAN means the fastest VLAN
4. All VLANs become one subnet

Correct answer: B. Untagged ingress traffic is assigned to the configured native VLAN

The native VLAN provides an untagged classification on conventional trunks. Both ends should use an intentional compatible design.

1. Yes; all VLAN 10 networks are global
2. No; a carrying Layer 2 path is also required
3. Yes; DNS joins them
4. Yes; the numeric ID creates a wireless link

Correct answer: B. No; a carrying Layer 2 path is also required

VLAN numbers label local configuration. A configured connected path must actually carry that VLAN.

1. DNS servers into one hostname automatically
2. Different subnets into one broadcast address
3. Passwords into one credential
4. Compatible physical links into one logical link

Correct answer: D. Compatible physical links into one logical link

Link aggregation provides a coordinated logical interface. Member configuration and peer behavior must be compatible.

1. Yes on every port
2. Only for DNS packets
3. Only in VLAN 1
4. No

Correct answer: D. No

TTL is decremented by Layer 3 forwarding hops. Ordinary Layer 2 frame forwarding is not an IP routing hop.

1. An IP interface associated with a VLAN
2. A physical optical connector
3. A DNS alias only
4. A replacement MAC address for every client

Correct answer: A. An IP interface associated with a VLAN

An SVI can provide management or Layer 3 gateway functions depending on device configuration and capabilities.

1. Send to DNS first
2. Flood every VLAN
3. Return to port 1
4. Unicast to port 4 in VLAN 10

Correct answer: D. Unicast to port 4 in VLAN 10

The destination is known in the correct VLAN, so the switch selects B's learned port.

1. Learn C on port 2 and flood D within VLAN 20
2. Learn D on port 2 and route to VLAN 10
3. Create a DNS record for C
4. Block every VLAN automatically

Correct answer: A. Learn C on port 2 and flood D within VLAN 20

Source learning and destination forwarding are separate operations. The switch learns C's location, not D's, from this frame.

1. A /24 prevents switching
2. Private addresses cannot use VLANs
3. ARP requires DNS
4. They are in separate Layer 2 domains despite matching IP prefixes

Correct answer: D. They are in separate Layer 2 domains despite matching IP prefixes

The hosts expect direct local delivery, but the VLAN boundary blocks their broadcast discovery. Address and VLAN design must agree.

1. The local DNS suffix only
2. The provider modem only
3. Whether VLAN 30 is intentionally allowed on the trunk
4. The browser cache

Correct answer: C. Whether VLAN 30 is intentionally allowed on the trunk

The trunk list excludes VLAN 30. Verify the VLAN exists and is carried end to end before modifying unrelated services.

1. Source learning updates the MAC location
2. The old port is permanently authoritative
3. DNS created the new path
4. The workstation changed subnets necessarily

Correct answer: A. Source learning updates the MAC location

A switch can update a dynamic entry when it sees the source arrive at a different interface.

1. Flood it to all VLANs
2. Filter it rather than send it back out that port
3. Rewrite the IP destination
4. Request a DHCP lease

Correct answer: B. Filter it rather than send it back out that port

The learned destination is already on the ingress segment. Ordinary switching avoids returning the frame to the same port.

1. Identical VLAN names
2. Appropriate routed firewall or ACL policy
3. Longer patch cords
4. Disabling every DNS record

Correct answer: B. Appropriate routed firewall or ACL policy

VLANs separate Layer 2 domains; a permitted routed path can still join them. Policy must explicitly enforce allowed and denied destinations.

1. Untagged traffic may be classified into different VLANs
2. Every IP becomes public
3. All optical wavelengths change
4. DNS names stop containing dots

Correct answer: A. Untagged traffic may be classified into different VLANs

An untagged frame sent under one native-VLAN assumption can enter the other VLAN. Align the intended design and verify forwarding.

1. VLAN IDs are DNS names
2. The port has an explicit voice/data exception
3. Both devices must have the same MAC
4. A phone cannot use Ethernet

Correct answer: B. The port has an explicit voice/data exception

Voice configurations can carry tagged voice traffic alongside an untagged data VLAN. Inspect actual configuration instead of assuming a simple access case.

1. A Layer 2 loop without effective loop prevention
2. A missing DNS alias
3. A longer DHCP lease
4. A faster uplink necessarily

Correct answer: A. A Layer 2 loop without effective loop prevention

Repeated frame circulation can cause storms and apparent MAC movement. Check topology and STP before broad endpoint changes.

1. Yes; every SVI routes everything
2. Yes; an SVI bypasses ACLs
3. No; routing, interface state, and policy must also support the path
4. Yes; a VLAN name supplies routes

Correct answer: C. No; routing, interface state, and policy must also support the path

The configured interface is one dependency. Forwarding capability, active state, routes, and access policy still matter.

1. DNS changed its cable category
2. Its MAC became a subnet mask
3. The WAN subscription changed
4. The VLAN change placed it in a different DHCP broadcast domain

Correct answer: D. The VLAN change placed it in a different DHCP broadcast domain

Broadcast-domain membership affects which local server or relay receives discovery. Confirm the new VLAN's intended scope.

1. The DHCP lease expiry
2. Its VLAN-scoped MAC forwarding table
3. The browser hostname
4. Its management DNS cache instead

Correct answer: B. Its VLAN-scoped MAC forwarding table

A management ARP cache is not a substitute for Layer 2 forwarding state. Device functions must be distinguished.

1. Only the WAN modem
2. Only the DNS zone serial
3. Every client battery
4. VLAN 20 allowed lists, existence, and forwarding state along the path

Correct answer: D. VLAN 20 allowed lists, existence, and forwarding state along the path

Successful VLAN 10 traffic shows the link can carry some data. Selective failure warrants VLAN-specific evidence.

1. DNS expired the MAC record
2. The IP changed necessarily
3. The dynamic entry aged out
4. The VLAN was deleted necessarily

Correct answer: C. The dynamic entry aged out

MAC aging and DNS TTL are distinct. A quiet destination can become unknown until its own traffic refreshes learning.

1. Only subnet size
2. Violation logs and authorized MAC policy on that port
3. Only DNS TTL
4. Only fiber distance

Correct answer: B. Violation logs and authorized MAC policy on that port

A working physical link does not prove forwarding is permitted. The policy violation is more specific evidence.

1. Only hostnames
2. Switch trunk and server VLAN-tagging configuration
3. Only WAN addresses
4. Only cable color

Correct answer: B. Switch trunk and server VLAN-tagging configuration

Both ends must agree on VLAN handling and the carried VLANs. An ordinary untagged endpoint cannot interpret arbitrary tagged traffic correctly.

1. Yes; every packet is always striped equally
2. Yes; DNS combines the speeds
3. No; hashing often keeps one flow on one member
4. No; the bundle has zero capacity

Correct answer: C. No; hashing often keeps one flow on one member

Aggregation can increase aggregate capacity across flows, but common hashing designs assign a flow to one member.

1. The VLAN cannot exist
2. A redundant path is being held inactive to prevent a loop
3. The blocked cable is definitely damaged
4. DNS denied the port

Correct answer: B. A redundant path is being held inactive to prevent a loop

A healthy link can intentionally block for topology control. Check STP roles before interpreting the state as hardware failure.

1. No; private addresses cannot ARP
2. No; ARP must traverse every router
3. Yes; ARP discovery stays on the local Layer 2 domain
4. No; DNS must forward it

Correct answer: C. Yes; ARP discovery stays on the local Layer 2 domain

The gateway should be locally reachable in the intended VLAN. Routing moves IP packets, not ordinary ARP broadcasts between LANs.

1. DNS created fake MACs
2. Several downstream devices send frames through it
3. The cable is necessarily looped
4. All devices have duplicate IPs

Correct answer: B. Several downstream devices send frames through it

A link to another switch aggregates downstream source traffic. Multiple learned MACs are not alone evidence of a fault.

1. VLAN availability and allowed membership on every relevant hop
2. Only the endpoint browser
3. Only DHCP lease duration
4. Only the external DNS service

Correct answer: A. VLAN availability and allowed membership on every relevant hop

End-to-end Layer 2 service requires each participating switch/link to support the VLAN. A local VLAN definition is insufficient.

1. DNS routes local packets
2. The down SVI must be up
3. Their local frames can be switched without routing
4. Their IP packets need no Ethernet frames

Correct answer: C. Their local frames can be switched without routing

Local communication can bypass the Layer 3 gateway. Remote communication is a separate dependency.

1. The trunk sends native VLAN 20 traffic untagged under its configured behavior
2. The capture proves VLAN 20 is not configured
3. VLAN 20 can never carry traffic
4. DNS removed the tags

Correct answer: A. The trunk sends native VLAN 20 traffic untagged under its configured behavior

Tag absence must be interpreted with native-VLAN configuration and capture placement. It does not alone prove VLAN absence.

1. Use the old VLAN's broadcast as gateway
2. Change all MAC addresses
3. Make every VLAN a trunk
4. Refresh or correct the client's IP configuration for VLAN 60

Correct answer: D. Refresh or correct the client's IP configuration for VLAN 60

Layer 2 membership and Layer 3 addressing must align. Renewing DHCP or correcting static settings can restore the intended configuration.

1. Only the host's DNS record
2. Whichever was learned last across all VLANs
3. VLAN 10's port 8 entry
4. VLAN 20's port 5 entry

Correct answer: C. VLAN 10's port 8 entry

Forwarding state is scoped by VLAN. A matching MAC in another VLAN does not override the relevant VLAN 10 entry.

1. Only switch hostname
2. Only access-port link LED
3. Only cable length
4. ACL counters and a service-port test along the routed path

Correct answer: D. ACL counters and a service-port test along the routed path

Existing link and route evidence still leaves policy and service dependencies. Compare allowed/denied counters and actual destination-port behavior.

1. Increase DNS TTL
2. Review and authorize the intended phone/PC MAC policy
3. Disable all campus security
4. Change every VLAN ID

Correct answer: B. Review and authorize the intended phone/PC MAC policy

The new legitimate device can exceed the configured limit. Adjust only the approved port policy and verify both devices.

1. Change the native VLAN randomly
2. Increase DHCP lease time
3. Replace every NIC
4. Carry VLAN 30 on both ends and verify the path

Correct answer: D. Carry VLAN 30 on both ends and verify the path

The two allowed lists differ for VLAN 30. Correct that specific permitted path and verify traffic in both directions.

1. Inspect for loops or unintended bridging and compare STP state
2. Increase every routing metric
3. Assume normal host roaming without more evidence
4. Delete all DNS records

Correct answer: A. Inspect for loops or unintended bridging and compare STP state

Rapid oscillation plus storm evidence is stronger than a single MAC move. Inspect topology before masking the symptom.

1. DNS cannot resolve switch names with digits
2. The management VLAN lacks an end-to-end Layer 2 path
3. The switch cannot forward if management fails
4. User VLAN 10 proves every VLAN works

Correct answer: B. The management VLAN lacks an end-to-end Layer 2 path

Management-plane reachability can fail independently of user forwarding. Verify VLAN 99's path and Layer 3 configuration.

1. Measure WAN subscription rate
2. Run a DNS lookup only
3. Compare ingress VLAN classification of a controlled untagged frame at each end
4. Check the application password

Correct answer: C. Compare ingress VLAN classification of a controlled untagged frame at each end

The proposed cause concerns VLAN classification, so inspect that state directly. Tagged traffic may follow different handling.

1. Replace the DNS server
2. Disable all ARP
3. Increase subnet size
4. Restore safe loop prevention and identify the redundant path

Correct answer: D. Restore safe loop prevention and identify the redundant path

Bypassing topology control can create an active loop. Restore a supported loop-free design before higher-layer troubleshooting.

1. Authorized virtualization requirements with an appropriately scoped MAC policy
2. Only one VM can use IPv4
3. Ten MACs prove a loop
4. DNS must hide guest MACs

Correct answer: A. Authorized virtualization requirements with an appropriately scoped MAC policy

Multiple guest MACs are expected in many bridged virtualization designs. Security limits should match the authorized endpoint architecture.

1. Current forwarding needs testing
2. Configuration changed path availability
3. Entries may remain until aging
4. The VLAN's traffic still has a working path because entries exist

Correct answer: D. The VLAN's traffic still has a working path because entries exist

A learned entry can outlive a usable path temporarily. Verify operational VLAN forwarding rather than relying on stale state.

1. It is automatically rerouted into VLAN 10
2. It is resolved by DNS
3. It is not admitted to the intended VLAN forwarding path
4. It is sent to every access port

Correct answer: C. It is not admitted to the intended VLAN forwarding path

Allowed-VLAN policy limits carried traffic. Do not assume an excluded tag falls back to some arbitrary permitted VLAN.

1. SSID labels can differ
2. The names alone provide Layer 2 isolation
3. Additional policy may still exist
4. Both can use radio

Correct answer: B. The names alone provide Layer 2 isolation

SSID names do not establish distinct broadcast domains. Check actual VLAN mappings and enforcement policy.

1. Only the remote server certificate
2. Only Internet DNS queries
3. The affected port's VLAN/policy and the gateway ARP exchange
4. Only the WAN modem LED

Correct answer: C. The affected port's VLAN/policy and the gateway ARP exchange

A local peer test does not eliminate selective policy, addressing, or gateway-path problems. Observe the unanswered exchange and compare working clients.

1. Only endpoint lease times
2. Only application settings
3. Member configuration consistency and negotiated bundle state
4. Only DNS suffixes

Correct answer: C. Member configuration consistency and negotiated bundle state

Aggregated members must satisfy the platform's consistency requirements. A mismatched member may suspend or fail to join the bundle.

1. Only their DNS aliases
2. VLAN 70 presence, allowance, and forwarding across intermediate links
3. Only the WAN route
4. Only their public IPs

Correct answer: B. VLAN 70 presence, allowance, and forwarding across intermediate links

Correct endpoint ports do not establish the intermediate path. Trace the VLAN across each relevant hop.

1. Trace the learned path and confirm current cabling before rewiring
2. Assume the diagram overrides live evidence
3. Force all ports to route
4. Delete the VLAN

Correct answer: A. Trace the learned path and confirm current cabling before rewiring

Live learning suggests the server is reached downstream. Confirm topology so changes do not disconnect the actual path.

1. VLAN 20 becomes VLAN 10 automatically
2. VLAN 20 may lack its intended Layer 3 gateway service
3. Both VLANs must lose physical link
4. DNS must fail for VLAN 10

Correct answer: B. VLAN 20 may lack its intended Layer 3 gateway service

The trunk carries VLAN traffic, but routing also needs matching logical interfaces. The missing subinterface can selectively break VLAN 20 routing.

1. Only the campus domain name
2. Only the VLAN names
3. Inter-VLAN routes and effective access-control policy
4. Only Ethernet frame size

Correct answer: C. Inter-VLAN routes and effective access-control policy

Routed connections may be allowed between segmented domains. Security claims need actual forwarding and enforcement evidence.

1. The server transmits a frame that reaches the switch
2. The client changes DNS TTL
3. The server changes its subnet to /16
4. The administrator adds a default route only

Correct answer: A. The server transmits a frame that reaches the switch

Source learning refreshes the server's location when the server sends. Receiving a frame addressed to it does not by itself teach its port.

1. ARP should always cross all VLANs
2. DNS must relay ARP
3. STP forwards ARP between IP subnets
4. ARP broadcasts normally remain inside their VLAN

Correct answer: D. ARP broadcasts normally remain inside their VLAN

Broadcast isolation is expected. Hosts needing inter-VLAN communication use routing rather than cross-VLAN ARP flooding.

1. The switch is a DNS server
2. Multiple learned downstream MACs are expected; count alone does not prove a loop
3. A loop is proven
4. The VLAN must be public

Correct answer: B. Multiple learned downstream MACs are expected; count alone does not prove a loop

Interpret the count with topology and counters. An uplink naturally carries many distinct sources.

1. All office traffic is permitted
2. Segmentation can coexist with a deliberately allowed routed exception
3. The printer bypasses Ethernet
4. The VLANs have merged

Correct answer: B. Segmentation can coexist with a deliberately allowed routed exception

A narrow policy exception does not erase the Layer 2 boundary. Verify the rule's destination/service scope and other denied paths.

1. Only the PC's hostname
2. Only cable color
3. The trunk's native/untagged handling and effective configuration
4. Only DHCP server brand

Correct answer: C. The trunk's native/untagged handling and effective configuration

Untagged traffic depends on trunk configuration. Do not assume all trunks place such traffic in the same VLAN universally.

1. Any MAC move proves a persistent loop
2. The move can be normal path convergence; monitor for instability
3. Failover cannot change learned ports
4. DNS caused the move

Correct answer: B. The move can be normal path convergence; monitor for instability

A path change can legitimately relocate learned sources. Rate, duration, topology, and traffic symptoms distinguish convergence from a loop.

1. Ethernet identifies the local next hop while IP identifies the remote destination
2. The switch must know every Internet MAC
3. The gateway rewrites all DNS answers
4. VLAN tags contain the server MAC

Correct answer: A. Ethernet identifies the local next hop while IP identifies the remote destination

Link-layer addressing is hop-specific. The gateway routes the packet and creates the appropriate next-link frame.