You're staring at the syllabus. Also, week 12. The words "Module 5.1.2 — Semester 2 Final Exam" sit there in bold, and your stomach does that thing it always does before a big test.
You've been here before. But this one feels different. Heavier. Because of that, maybe it's the cumulative weight of two semesters. Maybe it's the fact that this module pulls together everything from networking fundamentals to routing protocols and expects you to configure, troubleshoot, and explain it all in under two hours.
Here's the thing most students miss: the 5.1.2 exam isn't testing how much you memorized. It's testing whether you can think like a network engineer when things break Less friction, more output..
What Is the 5.1.2 Semester 2 Exam
If you're in a Cisco Networking Academy program — CCNAv7, specifically — you know the numbering scheme. That said, semester 1 covered the basics: networking models, physical layer, data link, IPv4/IPv6 addressing, basic router/switch configuration. Semester 2 goes deeper.
Module 5.That said, 1. 2 is the capstone assessment for the Switching, Routing, and Wireless Essentials (SRWE) course. Because of that, it's the practical final. Still, not multiple choice. Not drag-and-drop. Even so, you get a topology, a set of requirements, and a console cable. That's it.
The exam typically runs 90–120 minutes. You're graded on configuration accuracy, not just completion. Partial credit exists, but it's ruthless — a missing no shutdown on a trunk interface costs you the VLAN points, even if the VLAN database is perfect.
What the Topology Usually Looks Like
Most versions give you three switches, two routers, and a handful of PCs. On the flip side, two are access layer. One switch acts as the core. Routers handle inter-VLAN routing or WAN simulation Turns out it matters..
- VLANs 10, 20, 30, 99 (management)
- Trunk links between switches
- EtherChannel on at least one uplink
- DHCP pools on the router or a dedicated server
- Port security on access ports
- STP root bridge manipulation
- Wireless LAN controller or lightweight AP setup (in newer versions)
The exact IP scheme changes. Plus, the VLAN numbers change. The logic doesn't.
Why This Exam Matters More Than You Think
Plenty of students treat the 5.1.2 as "just another packet tracer activity." That's how you fail That's the part that actually makes a difference. Simple as that..
This exam is the gatekeeper. Pass it, and you've proven you can build a functioning switched network from scratch. Fail it, and you're retaking the semester — or worse, moving to CCNA Security or Enterprise without the switching foundation solid That's the whole idea..
Employers know what this exam represents. When a hiring manager sees "CCNAv7 SRWE completed" on a resume, they know you've configured EtherChannel. You've troubleshot a trunk mismatch. You've set up port security and watched it err-disable a port because you forgot to configure the sticky MAC before plugging in the device.
That's not theory. That's muscle memory.
And here's the part nobody tells you: the 5.Think about it: 1. Worth adding: 2 exam is the closest thing to a real network change window you'll get in academia. No hints. No "check your work" button. You type, you verify, you move on.
How the Exam Works — Step by Step
You sit down. Practically speaking, the proctor unlocks the Packet Tracer file. The clock starts.
1. Read Every Requirement Before You Type
This sounds obvious. Then they realize the DHCP pool needs to match the VLAN subnet they already configured — but they used a /26 instead of a /24. It's not. Most students start configuring VLANs on Switch 1 before they've read the DHCP requirement on Router 2. Now they're redoing work Still holds up..
Spend the first 10 minutes reading. Highlight. Annotate. Map requirements to devices.
2. Build the VLAN Database First
Every version of this exam requires VLAN creation. Do it on all switches before touching trunks.
vlan 10
name USERS
vlan 20
name SERVERS
vlan 30
name GUEST
vlan 99
name MGMT
Copy-paste into each switch. Worth adding: verify with show vlan brief. Don't move on until all four switches show the same VLANs.
3. Configure Trunks — Then Verify They're Actually Trunking
This is where points evaporate. You configure:
interface range g0/1-2
switchport trunk encapsulation dot1q
switchport mode trunk
But you forget switchport trunk allowed vlan 10,20,30,99. That said, or you forget to bring the interface up. Or you configure it on one side only No workaround needed..
Run show interfaces trunk on both ends. Consider this: every. Day to day, single. Time.
4. EtherChannel — LACP, Not PAgP
The exam almost always specifies LACP. Active on both sides.
interface range g0/1-2
channel-group 1 mode active
Then configure the PortChannel interface, not the physical ones:
interface port-channel 1
switchport trunk encapsulation dot1q
switchport mode trunk
switchport trunk allowed vlan 10,20,30,99
If you configure the physical interfaces after bundling, the settings won't apply. This trips up 40% of first-timers Which is the point..
5. Spanning Tree — Root Primary and Secondary
You'll be told: "Make Switch 1 root for VLAN 10 and 20. Make Switch 2 root for VLAN 30 and 99."
spanning-tree vlan 10,20 root primary
spanning-tree vlan 30,99 root secondary
Do this on the correct switches. Verify with show spanning-tree vlan 10. Check the bridge priority. It should be 24576 for primary, 28672 for secondary (default 32768 minus 4096/8192) Easy to understand, harder to ignore..
6. Inter-VLAN Routing — Router-on-a-Stick or SVI
Depends on the version. Older exams use router-on-a-stick. Newer ones use Layer 3 switching with SVIs It's one of those things that adds up..
If it's router-on-a-stick:
interface g0/0.10
encapsulation dot1q 10
ip address 192.168.10.1 255.255.255.0
If it's SVI on a multilayer switch:
interface vlan 10
ip address 192.168.10.1 255.255.255.0
no shutdown
Either way — the gateway IP must match what you put in the DHCP pool.
7. DHCP — Exclude the Gateway. Always.
ip dhcp excluded-address 192.168.10.1
ip dhcp pool VLAN10
network 192.1
Continuing from the DHCP snippet, the pool must be completed so that every device in the VLAN receives a usable address while the router’s interface remains excluded.
network 192.168.10.0 255.255.255.0 default-router 192.168.10.1 dns-server 8.8.8.8 8.8.4.4 lease 0 12 0 ! 12‑hour lease
The `default-router` line guarantees that clients learn the correct gateway, which must be the same address you assigned to the SVI or sub‑interface on the router. After the pool is defined, issue a quick verification:
show ip dhcp binding show ip dhcp server statistics
Both commands confirm that leases are being handed out and that the excluded address (192.10.168.1) never appears in the binding table.
---
### 8. Validate End‑to‑End Connectivity
With the VLANs, trunk, port‑channel, STP, routing, and DHCP all in place, perform a systematic test:
1. **Intra‑VLAN ping** – From a host in VLAN 10, ping the gateway (192.168.10.1). Success indicates the SVI is up and the host’s default gateway is correct.
2. **Inter‑VLAN ping** – From a host in VLAN 10, ping a host in VLAN 20. If the ping succeeds, the Layer 3 device is correctly routing between subnets.
3. **DHCP lease verification** – After a client renews its lease, run `show ip dhcp binding` again and ensure the assigned address belongs to the proper subnet and that the lease time matches the configuration.
4. **STP convergence** – Use `show spanning-tree vlan 10` (and the other VLANs) to confirm that the designated router for each VLAN is the intended switch and that no alternate paths are blocking traffic.
If any of these tests fail, revisit the relevant section: a mismatched VLAN on a trunk, a missing `no shutdown` on the SVI, a priority mismatch in STP, or an incorrect `ip dhcp excluded-address` entry.
---
### 9. Documentation and Exam‑Day Checklist
A well‑written config file is as valuable as the CLI commands themselves. Record the following items in a brief lab note:
- VLAN IDs and names on every switch.
- Trunk ports and the allowed VLAN list.
- Port‑channel number, member interfaces, and its SVI configuration.
- Root bridge priority values for each VLAN.
- DHCP pool parameters (network, gateway, DNS, lease).
- Verification commands and expected output snippets.
During the exam, allocate the first ten minutes to:
1. **Read the entire scenario** – Identify which VLANs are required, the type of routing (router‑on‑a‑stick vs. SVI), and any special instructions (e.g., “exclude the gateway” or “use LACP”).
2. **Map each requirement to a device** – Note which switch must become the root for VLAN 10/20, which ports need to be trunks, and where the DHCP pool must be applied.
3. **Create a mental checklist** – Follow the order: VLANs → trunks → port‑channel → STP → routing → DHCP → final validation.
Sticking to this disciplined approach prevents the common pitfalls that cause point loss: forgotten `switchport trunk allowed vlan` statements, mismatched STP roles, or a DHCP pool that hands out the router’s IP.
---
## Conclusion
Success on this networking exam hinges on a methodical sequence: define the VLAN infrastructure first, verify that every trunk carries the correct traffic, bundle links with LACP before applying advanced settings, elect the proper STP roots, configure Layer 3 routing that aligns with the DHCP gateway, and finally lock down address
…and finally lock down address reservations by configuring DHCP static bindings for critical devices (servers, printers, and the gateway itself). This prevents accidental address conflicts and guarantees that essential hosts always receive the same IP, which simplifies troubleshooting and satisfies any exam requirement for “reserved addresses.”
After the reservations are in place, run a final validation pass:
1. **DHCP snooping verification** – On each switch, issue `show ip dhcp snooping binding` to confirm that only the expected MAC‑IP pairs are learned and that the binding table matches the static reservations you just created.
2. **IP source guard** – Enable `ip verify source port-security` on access ports facing end‑devices and verify with `show ip verify source` that no unauthorized traffic is allowed.
3. **ARP inspection** – If the scenario calls for dynamic ARP inspection, run `show ip arp inspection statistics` and ensure the drop counters remain zero for legitimate traffic while any spoofed ARP attempts are logged.
4. **ACL sanity check** – Apply any inbound/outbound ACLs on the SVIs or trunk ports as dictated by the lab, then use `show access-lists` and `show ip interface` to confirm the correct ACL is attached and that hit counts increase as expected when you generate test traffic.
5. **Logging and timestamps** – Enable `logging buffered` and `service timestamps log datetime msec` so that, during the exam, you can quickly review recent events with `show log` if a problem surfaces.
When all of the above checks return the expected results, you have a fully functional, secure, and exam‑ready network:
- VLANs are correctly created and named.
- Trunks carry precisely the VLANs required, with no stray VLANs leaking.
- The LACP port‑channel is up, load‑balancing traffic, and its SVI hosts the Layer 3 gateway for each subnet.
- STP has converged with the designated root bridges matching the priority values you set.
- Inter‑VLAN routing works, as evidenced by successful pings across subnets.
- DHCP hands out addresses from the proper pools, respects exclusions, and provides the correct gateway, DNS, and lease time.
- Static reservations lock in vital devices, while DHCP snooping, IP source guard, and ARP inspection protect against address spoofing.
- Any ACLs in place enforce the stipulated traffic filters without breaking legitimate connectivity.
By following this disciplined, top‑down workflow—VLANs → trunks → port‑channel → STP → routing → DHCP → security hardening → final validation—you minimize the chance of overlooking a minor detail that could cost points. Think about it: keep the checklist handy, allocate a few minutes for each phase, and trust the verification commands to confirm that your configuration matches the scenario’s expectations. With this approach, you’ll walk into the exam confident that the network you build will not only function but also withstand the typical troubleshooting probes the examiners will throw at it. Good luck!
This methodical validation process not only ensures compliance with the exam requirements but also instills confidence in the robustness of your network design. Finally, always save your running configuration with `copy running-config startup-config` before exiting, ensuring that your hard work persists through a reload and eliminating the risk of losing points due to unsaved changes. Remember to document each step as you configure it; a well-annotated configuration file can be invaluable if you need to backtrack or explain your reasoning under pressure. Additionally, practice configuring these elements under time constraints to simulate the exam environment—this will help you develop muscle memory for critical commands and reduce the likelihood of syntax errors. By combining thorough preparation with disciplined execution, you’ll be well-equipped to tackle even the most demanding networking scenarios.
