CISCO NETACAD SRWE FINAL EXAM | COMPLETE PRACTICE QUESTIONS,
ANSWERS & STUDY GUIDE 2026/2027
alternate, designated, root, root
Answers Explanation & Hints:
Because S1 is the root bridge, B is a designated port, and C and D root ports. RSTP supports a new port
type, alternate port in discarding state, that can be port A in this scenario. - correct answer ✔✔Refer to
the exhibit. What are the possible port roles for ports A, B, C, and D in this RSTP-enabled network?
-designated, alternate, root, root
-designated, root, alternate, root
-alternate, root, designated, root
-alternate, designated, root, root
MAC address of the virtual router
Answers Explanation & Hints:
The IP address of the virtual router acts as the default gateway for all the workstations. Therefore, the
MAC address that is returned by the Address Resolution Protocol to the workstation will be the MAC
address of the virtual router. - correct answer ✔✔Refer to the exhibit. Which destination MAC address is
used when frames are sent from the workstation to the default gateway?
-MAC address of the virtual router
-MAC addresses of both the forwarding and standby routers
-MAC address of the standby router
-MAC address of the forwarding router
Configure SSH.
Answers Explanation & Hints:
Why It's Secure: SSH is a protocol that ensures secure network management and communications. It
encrypts data, including passwords, to protect against interception and provides secure channel
establishment. This makes it highly effective in safeguarding remote access.
Best Practice: Use SSH version 2 for enhanced security features. Implement strong authentication
methods like public key authentication and disable root login where possible. - correct answer ✔✔What
is a secure configuration option for remote access to a network device?
-Configure SSH.
-Configure 802.1x.
-Configure an ACL and apply it to the VTY lines.
-Configure Telnet.
The host sends an ICMPv6 neighbor solicitation message to the DHCP or SLAAC-learned address and if
no neighbor advertisement is returned, the address is considered unique.
,Answers Explanation & Hints:
Before a host can actually configure and use an IPv6 address learned through SLAAC or DHCP, the host
must verify that no other host is already using that address. To verify that the address is indeed unique,
the host sends an ICMPv6 neighbor solicitation to the address. If no neighbor advertisement is returned,
the host considers the address to be unique and configures it on the interface. - correct answer ✔✔After
a host has generated an IPv6 address by using the DHCPv6 or SLAAC process, how does the host verify
that the address is unique and therefore usable?
-The host checks the local neighbor cache for the learned address and if the address is not cached, it it
considered unique.
-The host sends an ICMPv6 neighbor solicitation message to the DHCP or SLAAC-learned address and if
no neighbor advertisement is returned, the address is considered unique.
-The host sends an ICMPv6 echo request message to the DHCPv6 or SLAAC-learned address and if no
reply is returned, the address is considered unique.
-The host sends an ARP broadcast to the local link and if no hosts send a reply, the address is considered
unique
Source MAC: 00E0.FE91.7799Source IP: 10.1.1.10
Explanation:
As a packet traverses the network, the Layer 2 addresses will change at every hop as the packet is de-
encapsulated and re-encapsulated, but the Layer 3 addresses will remain the same. - correct answer
✔✔Refer to the exhibit. Host A has sent a packet to host B. What will be the source MAC and IP
addresses on the packet when it arrives at host B?
-Source MAC: 00E0.FE91.7799Source IP: 10.1.1.10
-Source MAC: 00E0.FE91.7799Source IP: 10.1.1.1
-Source MAC: 00E0.FE10.17A3Source IP: 10.1.1.10
-Source MAC: 00E0.FE10.17A3Source IP: 192.168.1.1
-Source MAC: 00E0.FE91.7799Source IP: 192.168.1.1
wireless router
Explanation & Hint:
Wireless Router: A wireless router combines the functions of a router (directing traffic between
networks, typically including Internet connectivity), a switch (providing multiple Ethernet ports for wired
connections), and a wireless access point (allowing devices to connect to the network wirelessly). It also
often includes firewall capabilities to protect the network from external threats. This makes it the most
fitting choice for the scenario described, as it encompasses all the functionalities mentioned: switch
ports, wireless SSID and authentication configuration, and a firewall for Internet connectivity. - correct
answer ✔✔After attaching four PCs to the switch ports, configuring the SSID and setting authentication
properties for a small office network, a technician successfully tests the connectivity of all PCs that are
connected to the switch and WLAN. A firewall is then configured on the device prior to connecting it to
the Internet. What type of network device includes all of the described features?
-standalone wireless access point
-firewall appliance
,-switch
-wireless router
WPA2 with AES
Explanation & Hint:
WPA2 with AES:Security Level: Highest among the listed options. AES is a more advanced and secure
encryption algorithm. WPA2 with AES is currently considered the industry standard for wireless network
security.Usage Recommendation: Strongly recommended for securing wireless networks. Provides
robust security and is widely supported by modern wireless devices. - correct answer ✔✔Which wireless
encryption method is the most secure?
-WPA2 with AES
-WPA2 with TKIP
-WEP
-WPA
an IP address and subnet mask are assigned to this VLAN, allowing the switch to be accessed by HTTP,
Telnet, SSH, or SNMP
-management VLAN
carries untagged traffic
-native VLAN
configured to carry user generated traffic
-data VLANs
all switch ports are assigned to this VLAN after initial bootup of the switch
-default VLAN
Answers Explanation & Hints:
A data VLAN is configured to carry user-generated traffic. A default VLAN is the VLAN where all switch
ports belong after the initial boot up of a switch loading the default configuration. A native VLAN is
assigned to an 802.1Q trunk port, and untagged traffic is placed on it. A management VLAN is any VLAN
that is configured to access the management capabilities of a switch. An IP address and subnet mask are
assigned to it, allowing the switch to be managed via HTTP, Telnet, SSH, or SNMP. - correct answer
✔✔Match the description to the correct VLAN type. (Not all options are used.)
-default VLAN
-management VLAN
-data VLANs
-native VLAN
-configured to carry user generated traffic
-all switch ports are assigned to this VLAN after initial bootup of the switch
-carries untagged traffic
-an IP address and subnet mask are assigned to this VLAN, allowing the switch to be accessed by HTTP,
Telnet, SSH, or SNMP
, -only accessible by the network administrator
STP will block one of the redundant links.
Answers Explanation & Hints:
Cisco switches support two protocols for negotiating a channel between two switches: LACP and PAgP.
PAgP is Cisco-proprietary. In the topology shown, the switches are connected to each other using
redundant links. By default, STP is enabled on switch devices. STP will block redundant links to prevent
loops. - correct answer ✔✔Refer to the exhibit. A network administrator has connected two switches
together using EtherChannel technology. If STP is running, what will be the end result?
-The switches will load balance and utilize both EtherChannels to forward packets.
-Both port channels will shutdown.
-The resulting loop will create a broadcast storm.
-STP will block one of the redundant links.
Enable trunking manually.
Disable DTP.
Set the native VLAN to an unused VLAN.
Answers Explanation & Hints:
Mitigating a VLAN attack can be done by disabling Dynamic Trunking Protocol (DTP), manually setting
ports to trunking mode, and by setting the native VLAN of trunk links to VLANs not in use. - correct
answer ✔✔What are three techniques for mitigating VLAN attacks? (Choose three.)
-Enable BPDU guard.
-Set the native VLAN to an unused VLAN.
-Use private VLANs.
-Disable DTP.
-Enable Source Guard.
-Enable trunking manually.
Because these VLANs are stored in a file that is called vlan.dat that is located in flash memory, this file
must be manually deleted.
Answers Explanation & Hints:
Standard range VLANs (1-1005) are stored in a file that is called vlan.dat that is located in flash memory.
Erasing the startup configuration and reloading a switch does not automatically remove these VLANs.
The vlan.dat file must be manually deleted from flash memory and then the switch must be reloaded. -
correct answer ✔✔An administrator is trying to remove configurations from a switch. After using the
command erase startup-config and reloading the switch, the administrator finds that VLANs 10 and 100
still exist on the switch. Why were these VLANs not removed?
-These VLANs cannot be deleted unless the switch is in VTP client mode.
-These VLANs can only be removed from the switch by using the no vlan 10 and no vlan 100 commands.
-These VLANs are default VLANs that cannot be removed.
-Because these VLANs are stored in a file that is called vlan.dat that is located in flash memory, this file
must be manually deleted.
ANSWERS & STUDY GUIDE 2026/2027
alternate, designated, root, root
Answers Explanation & Hints:
Because S1 is the root bridge, B is a designated port, and C and D root ports. RSTP supports a new port
type, alternate port in discarding state, that can be port A in this scenario. - correct answer ✔✔Refer to
the exhibit. What are the possible port roles for ports A, B, C, and D in this RSTP-enabled network?
-designated, alternate, root, root
-designated, root, alternate, root
-alternate, root, designated, root
-alternate, designated, root, root
MAC address of the virtual router
Answers Explanation & Hints:
The IP address of the virtual router acts as the default gateway for all the workstations. Therefore, the
MAC address that is returned by the Address Resolution Protocol to the workstation will be the MAC
address of the virtual router. - correct answer ✔✔Refer to the exhibit. Which destination MAC address is
used when frames are sent from the workstation to the default gateway?
-MAC address of the virtual router
-MAC addresses of both the forwarding and standby routers
-MAC address of the standby router
-MAC address of the forwarding router
Configure SSH.
Answers Explanation & Hints:
Why It's Secure: SSH is a protocol that ensures secure network management and communications. It
encrypts data, including passwords, to protect against interception and provides secure channel
establishment. This makes it highly effective in safeguarding remote access.
Best Practice: Use SSH version 2 for enhanced security features. Implement strong authentication
methods like public key authentication and disable root login where possible. - correct answer ✔✔What
is a secure configuration option for remote access to a network device?
-Configure SSH.
-Configure 802.1x.
-Configure an ACL and apply it to the VTY lines.
-Configure Telnet.
The host sends an ICMPv6 neighbor solicitation message to the DHCP or SLAAC-learned address and if
no neighbor advertisement is returned, the address is considered unique.
,Answers Explanation & Hints:
Before a host can actually configure and use an IPv6 address learned through SLAAC or DHCP, the host
must verify that no other host is already using that address. To verify that the address is indeed unique,
the host sends an ICMPv6 neighbor solicitation to the address. If no neighbor advertisement is returned,
the host considers the address to be unique and configures it on the interface. - correct answer ✔✔After
a host has generated an IPv6 address by using the DHCPv6 or SLAAC process, how does the host verify
that the address is unique and therefore usable?
-The host checks the local neighbor cache for the learned address and if the address is not cached, it it
considered unique.
-The host sends an ICMPv6 neighbor solicitation message to the DHCP or SLAAC-learned address and if
no neighbor advertisement is returned, the address is considered unique.
-The host sends an ICMPv6 echo request message to the DHCPv6 or SLAAC-learned address and if no
reply is returned, the address is considered unique.
-The host sends an ARP broadcast to the local link and if no hosts send a reply, the address is considered
unique
Source MAC: 00E0.FE91.7799Source IP: 10.1.1.10
Explanation:
As a packet traverses the network, the Layer 2 addresses will change at every hop as the packet is de-
encapsulated and re-encapsulated, but the Layer 3 addresses will remain the same. - correct answer
✔✔Refer to the exhibit. Host A has sent a packet to host B. What will be the source MAC and IP
addresses on the packet when it arrives at host B?
-Source MAC: 00E0.FE91.7799Source IP: 10.1.1.10
-Source MAC: 00E0.FE91.7799Source IP: 10.1.1.1
-Source MAC: 00E0.FE10.17A3Source IP: 10.1.1.10
-Source MAC: 00E0.FE10.17A3Source IP: 192.168.1.1
-Source MAC: 00E0.FE91.7799Source IP: 192.168.1.1
wireless router
Explanation & Hint:
Wireless Router: A wireless router combines the functions of a router (directing traffic between
networks, typically including Internet connectivity), a switch (providing multiple Ethernet ports for wired
connections), and a wireless access point (allowing devices to connect to the network wirelessly). It also
often includes firewall capabilities to protect the network from external threats. This makes it the most
fitting choice for the scenario described, as it encompasses all the functionalities mentioned: switch
ports, wireless SSID and authentication configuration, and a firewall for Internet connectivity. - correct
answer ✔✔After attaching four PCs to the switch ports, configuring the SSID and setting authentication
properties for a small office network, a technician successfully tests the connectivity of all PCs that are
connected to the switch and WLAN. A firewall is then configured on the device prior to connecting it to
the Internet. What type of network device includes all of the described features?
-standalone wireless access point
-firewall appliance
,-switch
-wireless router
WPA2 with AES
Explanation & Hint:
WPA2 with AES:Security Level: Highest among the listed options. AES is a more advanced and secure
encryption algorithm. WPA2 with AES is currently considered the industry standard for wireless network
security.Usage Recommendation: Strongly recommended for securing wireless networks. Provides
robust security and is widely supported by modern wireless devices. - correct answer ✔✔Which wireless
encryption method is the most secure?
-WPA2 with AES
-WPA2 with TKIP
-WEP
-WPA
an IP address and subnet mask are assigned to this VLAN, allowing the switch to be accessed by HTTP,
Telnet, SSH, or SNMP
-management VLAN
carries untagged traffic
-native VLAN
configured to carry user generated traffic
-data VLANs
all switch ports are assigned to this VLAN after initial bootup of the switch
-default VLAN
Answers Explanation & Hints:
A data VLAN is configured to carry user-generated traffic. A default VLAN is the VLAN where all switch
ports belong after the initial boot up of a switch loading the default configuration. A native VLAN is
assigned to an 802.1Q trunk port, and untagged traffic is placed on it. A management VLAN is any VLAN
that is configured to access the management capabilities of a switch. An IP address and subnet mask are
assigned to it, allowing the switch to be managed via HTTP, Telnet, SSH, or SNMP. - correct answer
✔✔Match the description to the correct VLAN type. (Not all options are used.)
-default VLAN
-management VLAN
-data VLANs
-native VLAN
-configured to carry user generated traffic
-all switch ports are assigned to this VLAN after initial bootup of the switch
-carries untagged traffic
-an IP address and subnet mask are assigned to this VLAN, allowing the switch to be accessed by HTTP,
Telnet, SSH, or SNMP
, -only accessible by the network administrator
STP will block one of the redundant links.
Answers Explanation & Hints:
Cisco switches support two protocols for negotiating a channel between two switches: LACP and PAgP.
PAgP is Cisco-proprietary. In the topology shown, the switches are connected to each other using
redundant links. By default, STP is enabled on switch devices. STP will block redundant links to prevent
loops. - correct answer ✔✔Refer to the exhibit. A network administrator has connected two switches
together using EtherChannel technology. If STP is running, what will be the end result?
-The switches will load balance and utilize both EtherChannels to forward packets.
-Both port channels will shutdown.
-The resulting loop will create a broadcast storm.
-STP will block one of the redundant links.
Enable trunking manually.
Disable DTP.
Set the native VLAN to an unused VLAN.
Answers Explanation & Hints:
Mitigating a VLAN attack can be done by disabling Dynamic Trunking Protocol (DTP), manually setting
ports to trunking mode, and by setting the native VLAN of trunk links to VLANs not in use. - correct
answer ✔✔What are three techniques for mitigating VLAN attacks? (Choose three.)
-Enable BPDU guard.
-Set the native VLAN to an unused VLAN.
-Use private VLANs.
-Disable DTP.
-Enable Source Guard.
-Enable trunking manually.
Because these VLANs are stored in a file that is called vlan.dat that is located in flash memory, this file
must be manually deleted.
Answers Explanation & Hints:
Standard range VLANs (1-1005) are stored in a file that is called vlan.dat that is located in flash memory.
Erasing the startup configuration and reloading a switch does not automatically remove these VLANs.
The vlan.dat file must be manually deleted from flash memory and then the switch must be reloaded. -
correct answer ✔✔An administrator is trying to remove configurations from a switch. After using the
command erase startup-config and reloading the switch, the administrator finds that VLANs 10 and 100
still exist on the switch. Why were these VLANs not removed?
-These VLANs cannot be deleted unless the switch is in VTP client mode.
-These VLANs can only be removed from the switch by using the no vlan 10 and no vlan 100 commands.
-These VLANs are default VLANs that cannot be removed.
-Because these VLANs are stored in a file that is called vlan.dat that is located in flash memory, this file
must be manually deleted.
