Network Access questions reward precise Layer 2 reasoning. Trace the VLAN, trunk, spanning-tree, and wireless control path in order, then verify operational state on both ends of every link.
What to know and how to practise it
VLANs and 802.1Q trunks
Configure and verify access ports for data and voice VLANs, default VLAN behavior, and inter-VLAN connectivity. On trunks, check encapsulation, allowed VLANs, native VLAN agreement, and the operational trunk state on both devices.
Discovery and EtherChannel
Use CDP and LLDP output to verify the expected neighbor, port, and platform. Distinguish Layer 2 and Layer 3 EtherChannels, understand LACP negotiation, and keep member-port settings consistent so the bundle forms correctly.
Rapid PVST+ operation and protections
Identify the root bridge, root port, designated port, and alternate port from bridge IDs and path costs. Understand PortFast, BPDU Guard, Root Guard, Loop Guard, and BPDU Filter by the failure each feature prevents—not as interchangeable commands.
Wireless architecture and management
Compare autonomous, controller-based, cloud-managed, and embedded wireless designs. Know common AP modes, controller and AP connections, management access options, and the GUI workflow used to create a WLAN, map it to a VLAN interface, apply security, and verify clients.
Example Layer 2 fault isolation
A user in VLAN 20 reaches local peers on one switch but not peers across an EtherChannel. Confirm the access VLAN, verify VLAN 20 exists, inspect the operational trunk and allowed list on the port-channel, then check spanning-tree forwarding state.
show vlan brief
show interfaces trunk
show etherchannel summary
show spanning-tree vlan 20
show cdp neighbors detailReadiness checklist
- Configure and verify data, voice, and trunk VLAN behavior.
- Explain LACP modes and identify a suspended member cause.
- Determine Rapid PVST+ root and port roles from evidence.
- Match each STP protection to the condition it guards against.
- Complete a WLAN-to-VLAN controller workflow coherently.
Common mistakes to remove
- Checking the physical EtherChannel member but not the logical port-channel.
- Assuming 2-WAY or blocking state always represents a fault.
- Creating an SSID before defining the addressing and VLAN dependencies.