25 STP and EtherChannel questions with answers for ccna roles — 6 easy, 11 medium, 8 hard.
About STP and EtherChannel
Redundant links need loop prevention. This topic covers Spanning Tree root election, port roles and states, Rapid PVST+ and MST, PortFast, BPDU Guard, Root Guard and Loop Guard, and EtherChannel with LACP and PAgP. Interviewers love scenarios here: broadcast storms, a wrong root bridge, suspended bundle members and uneven load sharing across links.
Sheet progressStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
Redundant Layer 2 links create loops, and Ethernet frames have no TTL, so broadcasts circulate forever, causing broadcast storms, MAC table instability and duplicate frames. STP (802.1D) blocks redundant paths so there is one loop-free path to every switch, and unblocks a backup link if the active one fails. Without it, a single loop can take down a whole campus within seconds.
Switches exchange BPDUs and the one with the lowest bridge ID becomes root. The bridge ID is the priority (default 32768 plus the VLAN number in PVST) followed by the MAC address, so if priorities tie, the lowest MAC wins. Because the oldest switch often has the lowest MAC, you should set priority manually, for example spanning-tree vlan 10 root primary on the core.
EtherChannel bundles 2 to 8 physical links into one logical port-channel. STP sees it as one link, so all members forward instead of one being blocked. It adds bandwidth and redundancy, as one member failing does not drop the channel. Traffic is load-balanced per flow using a hash of MAC, IP or port fields, so a single flow still uses only one member link.
Set priorities on the intended primary and secondary roots, then verify.
spanning-tree mode rapid-pvst
spanning-tree vlan 10,20 root primary
! on the backup switch
spanning-tree vlan 10,20 root secondary
show spanning-tree vlan 10
show spanning-tree root
show spanning-tree summary
05
How do you configure PortFast and BPDU Guard on access ports?
Apply per port or globally for all PortFast ports.
interface range GigabitEthernet1/0/1 - 46
switchport mode access
spanning-tree portfast
spanning-tree bpduguard enable
! or globally
spanning-tree portfast default
spanning-tree portfast bpduguard default
errdisable recovery cause bpduguard
errdisable recovery interval 300
06
How do you prioritise when several tickets arrive at the same time?
Situation: on a night shift I got a core link down alert, two user tickets and a printer issue at once. Task: handle everything with minimum impact. Action: I prioritised by business impact, confirmed redundancy had taken over for the core link, raised a priority ticket with the carrier, then fixed the user tickets and logged the printer for morning. Result: no SLA was breached and the handover was clear.
07
Explain root port, designated port and blocked port.
Every non-root switch picks one root port, its best path to the root based on lowest root path cost, then lowest sender bridge ID, then lowest sender port ID. On each segment, the switch with the best path becomes the designated port and forwards. Every remaining port becomes non-designated and blocks. All ports on the root bridge are designated.
08
What are the STP port states and timers in classic 802.1D?
States are blocking, listening, learning, forwarding and disabled. Timers are hello 2 seconds, forward delay 15 seconds and max age 20 seconds. A port moves from blocking through listening and learning, each 15 seconds, so convergence can take 30 to 50 seconds. That delay is why Rapid STP and PortFast are used in modern networks.
Rapid PVST+ runs 802.1w per VLAN. It uses a proposal and agreement handshake on point-to-point links so ports move to forwarding in under a second, instead of waiting on timers. It has port roles root, designated, alternate and backup, and states discarding, learning and forwarding. Alternate ports provide an instant backup root port. It is the default on most modern IOS switches.
10
What are the default STP path costs for common link speeds?
With short (802.1D revised) costs: 10 Mbps is 100, 100 Mbps is 19, 1 Gbps is 4 and 10 Gbps is 2. With the long pathcost method, 1 Gbps is 20000 and 10 Gbps is 2000, which distinguishes higher speeds. Root path cost is the sum of costs on ports toward the root, and the lowest total wins when choosing root ports.
LACP (802.3ad, now 802.1AX) is the open standard with modes active and passive; at least one side must be active. PAgP is proprietary with modes desirable and auto; at least one side must be desirable. Mode on forces the channel with no negotiation, which can cause loops if the other side is not configured. LACP is preferred because it works with servers, firewalls and other vendors.
Member interfaces must have the same speed and duplex, the same mode (access or trunk), the same access VLAN or the same native and allowed VLAN list on trunks, and compatible negotiation modes. Mismatched settings put members into suspended state. Configure settings on the port-channel interface so they are pushed to members, and verify with show etherchannel summary.
13
A broadcast storm brought the network down after someone connected a cable between two wall ports. How do you prevent this?
Two wall ports patched to the same switch formed a loop. To stop it now, I find the port with rising broadcast counters and shut it. To prevent repeats, enable PortFast with BPDU Guard on all access ports, keep Rapid PVST+ running everywhere, add storm-control broadcast thresholds on access ports and enable errdisable recovery with a sensible interval.
14
Traffic is taking a slow path because an old access switch became root bridge. How do you fix it?
The old switch has the lowest MAC with default priority, so it won the election. I set the core or distribution switch as root with spanning-tree vlan 1-4094 priority 4096, or root primary, and the secondary with 8192. I add Root Guard on distribution downlinks so access switches can never become root again. Then I verify with show spanning-tree root.
15
An EtherChannel shows members in suspended state. What do you check?
Suspended (s) usually means a configuration mismatch between members or with the far end. I compare speed, duplex, trunk mode, native VLAN and allowed VLANs on each member and the port-channel with show run interface, check LACP modes on both sides, and look at logs. I fix the config on the port-channel, then shut and no shut members so they rejoin. show etherchannel summary should show P flags.
Put members in a channel group with mode active, then configure the port-channel.
interface range GigabitEthernet1/0/47 - 48
channel-group 1 mode active
interface Port-channel1
switchport mode trunk
switchport trunk allowed vlan 10,20,99
port-channel load-balance src-dst-ip
show etherchannel summary
17
Tell me about a time you had to learn a new technology quickly.
Situation: our team moved from PVST to MST for a data center with 600 VLANs, and I had not used MST. Task: be ready for the migration in two weeks. Action: I read the configuration guides, built the design in a GNS3 lab, broke it deliberately and wrote a step-by-step checklist. Result: the migration ran in one window without outage, and I ran a short knowledge session for the team.
Root Guard on a designated port puts it into root-inconsistent state if a superior BPDU arrives, protecting the planned root bridge, so it is used on distribution ports facing access switches. Loop Guard stops a non-designated port from becoming designated when BPDUs stop arriving, such as with a unidirectional fiber fault. UDLD complements Loop Guard by detecting one-way links.
Multiple Spanning Tree (802.1s) maps many VLANs to a small number of STP instances, so a switch does not run one instance per VLAN as PVST does. Switches in the same MST region must share the name, revision and VLAN-to-instance mapping. It suits large networks with hundreds of VLANs and multi-vendor environments, and supports load sharing by making different instances root on different switches.
20
A 4 x 1G EtherChannel to a server shows one link at 95 percent and others nearly idle. Why?
Load balancing is per flow based on a hash. If the method is src-mac and most traffic comes from one router MAC, all flows hash to one link. I change port-channel load-balance to src-dst-ip or src-dst-mixed-ip-port so many flows spread across members. If the traffic is a single large flow, it can never exceed one member, so faster links would be needed.
21
Users report short outages every few minutes and logs show topology changes. How do you troubleshoot?
Frequent TCNs flush MAC tables and cause flooding. I run show spanning-tree detail to find the port and switch originating topology changes, then follow it hop by hop. Common causes are a flapping link, a host port without PortFast that changes state each time a PC reboots, or a failing NIC. I fix the link and enable PortFast on edge ports so they do not generate TCNs.
Make members routed ports first, then put the IP on the port-channel.
interface range TenGigabitEthernet1/1/1 - 2
no switchport
channel-group 10 mode active
interface Port-channel10
no switchport
ip address 10.0.0.1 255.255.255.252
show etherchannel 10 summary
show ip interface brief
23
How would you influence which port becomes the root port on a switch?
The root port is chosen by lowest cost, then sender bridge ID, then sender port ID. To prefer a link I lower its cost.
interface GigabitEthernet1/0/49
spanning-tree vlan 10 cost 2
On the upstream switch you can change port priority instead.
interface GigabitEthernet1/0/1
spanning-tree vlan 10 port-priority 64
24
What is UDLD and why is it important on fiber links?
UniDirectional Link Detection sends probes to confirm a neighbour receives traffic in both directions. On fiber, one strand can fail so a port receives but cannot send, which may make STP unblock a port and create a loop. UDLD normal mode logs and marks the port, while aggressive mode err-disables it. It is commonly enabled on fiber uplinks together with Loop Guard.
25
Tell me about a time a change you approved caused an outage. What did you do and what changed afterwards?
Situation: I approved a change that set a new root bridge priority, but the engineer applied it on the wrong switch and the campus reconverged during business hours. Task: restore service and find the gap. Action: we rolled back in ten minutes, informed users and ran a blameless review. Result: we added device name checks to the change template, peer review of exact commands and a maintenance window rule for any STP change. There was no repeat incident that year.
Frequently asked questions
How important is STP and EtherChannel in CCNA interviews?
Redundant links need loop prevention. This topic covers Spanning Tree root election, port roles and states, Rapid PVST+ and MST, PortFast, BPDU Guard, Root Guard and Loop Guard, and EtherChannel with LACP and PAgP. Interviewers love scenarios here: broadcast storms, a wrong root bridge, suspended bundle members and uneven load sharing across links.
How should I use the STP and EtherChannel sheet?
Go top to bottom — easy to hard. Answer before opening each answer, tick what you solved and save misses to Last-Minute Revision.