CCN TH

1.When the Trunk port send the data frame, how to deal with?

• A. When the VLAN ID is the same as the PVID of the port and is a VLAN ID allowed by the port, remove the Tag and send the message

• B. When the VLAN ID is different from the PVID of the port, the data frame is dropped

• C. When the VLAN ID is different from the PVID of the port, replace it with PVID forwarding

• D. When the VLAN ID is different from the PVID of the port, strip off the TAG and forward

Answer explanation

Explanation (simple and beginner-friendly):

A Trunk port is used to carry data for multiple VLANs. It adds a tag (VLAN ID) to each data frame so switches know which VLAN it belongs to.

When sending data out of a Trunk port:

• If the frame’s VLAN ID is the same as the port’s PVID (default VLAN) and that VLAN is allowed,
  → the port removes the VLAN tag and sends the frame normally.

This is done so that devices (like computers) that don’t understand VLAN tags can still receive the data.

The other options are incorrect because they describe dropping or wrongly changing the frame when it's not needed.

2.How many bits are there in the VLAN ID in the VLAN format defined by IEEE802.1Q?

• A.12

• B.6

• C.10

• D.8

Answer explanation

Explanation (easy and short):

The IEEE 802.1Q standard is used for VLAN tagging in Ethernet frames.

It adds a tag to the frame that includes a VLAN ID field.

• This VLAN ID is 12 bits long,
  → which means it can support up to 4096 VLANs (from 0 to 4095).

So, the VLAN ID part in the tag is 12 bits.

3.In the network shown in the figure below, the output information of switch A is shown in the figure. Then in the MAC address table of switch A, which interface does the MAC address of host B correspond to?

• A.GigabitEtheret 0/0/3

• B.GigabitEthemet0/0/2

• C.Eth-Trunk 1

• D.GigabitEthernet0/0/1

Answer explanation

Explanation (simple and beginner-friendly):

Looking at the network diagram:

• Host B is connected to Switch B (SWB).

• Switch B is connected to Switch A (SWA) through a Trunk link, which is named Eth-Trunk 1 on SWA.

• If Host B sends a frame to Host A, it goes through Switch B → Trunk → Switch A.

So, when Switch A learns Host B’s MAC address, it sees it coming from the Trunk port, which is:

→ Eth-Trunk 1

That’s why in the MAC address table of Switch A, Host B’s MAC will appear under Eth-Trunk 1.

4.All ports on the root-bridge switch are designated ports.

• A.True

• B.False

Answer explanation

Explanation (simple and beginner-friendly):

In STP (Spanning Tree Protocol):

• The root bridge is the main switch that all others connect to.

• On the root bridge, all ports are considered designated ports.

Why?

• Because the root bridge is the center of the tree, and it doesn’t need to block any ports.

• Designated ports are the ones that send traffic toward the rest of the network.

5.In the configuration BPDU sent by the switch, which bridge ID is unlikely to appear?

• A.8192 00-01-02-03-04-CC

• B.4096 00-01-02-03-04-CC

• C.0 00-01-02-03-04-CC

• D.2048 00-01-02-03-04-CC

Answer explanation

Explanation (simple and easy):

In STP (Spanning Tree Protocol), switches send BPDUs (Bridge Protocol Data Units) to share their Bridge ID.
The Priority is usually a multiple of 4096, like:

• 0

• 4096

• 8192

• 12288

• … up to 61440

👉 So, 2048 is not a valid STP priority value (not a multiple of 4096), which makes option D unlikely to appear.

6.The number of VLANs that can be created using the commands "vlan batch 10 20" and "vlan batch 10

to 20" respectively is

• A.11 and 11

• B.11 and 2

• C.2 and 2

• D. 2 and 11

7.By default, the root path cost of the root bridge in the STP protocol must be 0.

• A.True

• B.False

Answer explanation

Explanation (simple and noob-friendly):

In STP (Spanning Tree Protocol):

• The Root Path Cost shows how far a switch is from the root bridge.

• The root bridge is the starting point, so its own cost to reach itself is 0.

👉 That’s why the root path cost on the root bridge is always 0 by default.
No distance = No cost!

8.The administrator wants all hosts to be unable to access the Internet between 8:00-17:00 every day, so

which ACL rule needs to be bound to the traffic-filter outbound in the GO/0/1 interface allocation?

• A.time-range am9topm5 08:00 to working.day

  Acl number 2003

  rule 5 deny time-range am9topjni5

• B.time-range am9topm5 08:00 to 17:00 off-day

  #

  acl number 2004

  rule 5 permit time-range

• C. time-range am9topm5 08:00 to 17:00 daily

  acl number 2001

  rule 5 deny time-range am9topm5

• D.time-range am9topm5 07:00 to 18:00 daily

  Acl number 2002

Answer explanation

Explanation (in a noob-friendly way):
👉 Block all hosts from accessing the Internet between 8:00 AM and 5:00 PM every day.

Let’s break down Option C:

---

• time-range am9topm5 08:00 to 17:00 daily
  → This creates a time range named am9topm5 that applies every day from 08:00 to 17:00.

• acl number 2001
  → Creates an ACL (Access Control List) with number 2001 (standard or extended depending on use).

• rule 5 deny time-range am9topm5
  → Rule 5 blocks traffic during that time range (08:00–17:00 daily).

---

Why the other options are incorrect:

• A: Incorrect format for the time-range (also uses "working.day" which is not standard).

• B: Says "off-day", which would block on holidays/weekends — not what we want.

• D: Time is from 07:00 to 18:00, which is not exactly 08:00 to 17:00.

9.As shown in the figure below, the wrong statement is: acl number 2000] rule 5 deny source 200.0.12.00.0.0.7 rule 10permit source200.0.12.00.0.0.15 # interface GigabitEthernetO/0/1 traffic-filteroutbound acl2000

• A. The host whose source IP address is 200.0.12.4 cannot access the Internet

• B. The host whose source IP address is 200.0.12.2 cannot access the Internet

• C. The host whose source IP address is 200.0.12.8 cannot access the Internet

• D. The host whose source IP address is 200.0.12.6 cannot access the Internet

Answer explanation

Explanation (simple and noob-friendly):

Let’s look at the ACL (Access Control List) rules:

acl number 2000

rule 5 deny source 200.0.12.0 0.0.0.7

rule 10 permit source 200.0.12.0 0.0.0.15

---

Understanding the rules:

• Rule 5:
  deny source 200.0.12.0 0.0.0.7
  → This blocks traffic from IPs 200.0.12.0 to 200.0.12.7
  (Wildcard mask 0.0.0.7 means last 3 bits vary: 0–7)

• Rule 10:
  permit source 200.0.12.0 0.0.0.15
  → This allows traffic from IPs 200.0.12.0 to 200.0.12.15

ACLs are checked top to bottom, first match applies.

---

Checking the options:

• A. 200.0.12.4 → In 0–7 range, so DENIED ✅

• B. 200.0.12.2 → In 0–7 range, so DENIED ✅

• C. 200.0.12.8 → In 0–15 range, but not denied in rule 5, so rule 10 permits it ❌ (this can access Internet)

• D. 200.0.12.6 → In 0–7 range, so DENIED ✅

---

So, the wrong statement is C, because it says the host can't access, but actually it can.

10.On Huawei equipment, if you use aaa authentication for authorization. When the remote server does

not respond, you can authorize from the network equipment side.

• A.True

• B.False

Answer explanation

Explanation (beginner-friendly):

On Huawei devices, when you're using AAA authentication (like with a RADIUS or TACACS+ server):

• Normally, the device asks the remote server for permission (authorization).

• But if the remote server doesn't respond (maybe it's down or unreachable),
  → the device can fall back to local authorization (from its own config).

✅ So yes, the device can still authorize users locally if the remote server fails — as a backup.