CCNP VLANs and Trunking — 15 Questions

Question 1

A network engineer is troubleshooting a connectivity issue between two switches, SW1 and SW2, connected via a trunk link. SW1 is a Cisco Catalyst 3850 running IOS-XE, and SW2 is a Cisco Catalyst 2960 running IOS. The trunk is configured as a dynamic desirable mode on SW1 and dynamic auto on SW2. The engineer notices that the trunk is not forming. What is the most likely cause?

Accepted Answer

The native VLAN is different on SW1 and SW2.. Option A is correct because when DTP modes are dynamic desirable (SW1) and dynamic auto (SW2), the trunk should form successfully if both switches support DTP and the encapsulation matches. However, if the native VLAN is mismatched, the trunk will not form because Cisco switches use DTP frames to negotiate trunking, and a native VLAN mismatch causes DTP to fail, preventing the trunk from coming up. This is a common issue that overrides the DTP negotiation.

Answer

SW2 does not support DTP.

Answer

The trunk encapsulation is set to ISL on SW1.

Answer

VLAN 1 is not allowed on the trunk.

Question 2

An engineer is configuring a new access switch for a branch office. The switch must support multiple VLANs for different departments: VLAN 10 (Engineering), VLAN 20 (Sales), and VLAN 30 (Management). The uplink to the distribution switch is a trunk. The engineer wants to ensure that only the required VLANs are allowed on the trunk and that the native VLAN is changed from the default to VLAN 99 for security reasons. Which configuration commands should the engineer apply on the access switch's uplink interface?

Accepted Answer

switchport mode trunk; switchport trunk native vlan 99; switchport trunk allowed vlan 10,20,30. Option A is correct because it explicitly sets the interface to trunk mode, changes the native VLAN from the default VLAN 1 to VLAN 99 for security, and uses the 'allowed vlan' command to permit only VLANs 10, 20, and 30 on the trunk. This ensures that only the required department VLANs are carried, reducing unnecessary broadcast traffic and preventing VLAN hopping attacks by changing the native VLAN.

Answer

switchport mode trunk; switchport trunk native vlan 99; switchport trunk allowed vlan except 10,20,30

Answer

switchport mode dynamic desirable; switchport trunk native vlan 99; switchport trunk allowed vlan 10,20,30

Answer

switchport trunk encapsulation dot1q; switchport mode trunk; switchport trunk native vlan 99

Question 3

A network engineer is deploying a new server farm with multiple servers connected to a Cisco Nexus 9000 switch. Each server is dual-homed to two separate access switches for redundancy. The servers are configured with NIC teaming in active-standby mode. The engineer wants to ensure that if the active link fails, traffic continues without interruption. The access switches are connected to each other via a trunk. Which technology should the engineer implement on the access switches to prevent loops and allow both uplinks to be active?

Accepted Answer

Configure a vPC domain between the two access switches and use a vPC on the server-facing ports.. A is correct because a vPC (Virtual Port Channel) allows two access switches to appear as a single logical device to the server, enabling both uplinks to be active simultaneously while preventing loops. This is essential for active-standby NIC teaming, as vPC ensures that if one link fails, the other continues forwarding traffic without requiring STP to block a port, thus providing seamless failover and loop-free operation.

Answer

Enable Spanning Tree Protocol (STP) to block one of the links to prevent loops.

Answer

Configure an EtherChannel between the server and each access switch individually.

Answer

Implement Virtual Switching System (VSS) on the access switches.

Question 4

An engineer is troubleshooting a problem where a host in VLAN 20 cannot communicate with a host in VLAN 30, even though both are connected to the same access switch. The access switch is configured with VLANs 20 and 30, and the uplink to the distribution switch is a trunk that allows both VLANs. The distribution switch has SVIs for both VLANs and IP routing is enabled. The engineer verifies that the trunk is up and both VLANs are allowed. What is the most likely cause of the communication failure?

Accepted Answer

The hosts are not configured with the correct default gateway pointing to the SVI on the distribution switch.. Hosts in different VLANs must communicate through a Layer 3 device. The correct default gateway for each host should be the IP address of the SVI on the distribution switch for its respective VLAN. If the hosts are configured with an incorrect or no default gateway, traffic cannot be routed between VLAN 20 and VLAN 30, even though the trunk and SVIs are properly configured.

Answer

The trunk is not allowing VLAN 20 or VLAN 30.

Answer

Spanning Tree Protocol is blocking the SVI interfaces.

Answer

The native VLAN mismatch on the trunk is causing the issue.

Question 5

A network engineer is configuring a new Cisco Catalyst 9300 switch to connect to an existing network. The uplink to the core switch is configured as a trunk. The engineer wants to ensure that all VLANs except VLAN 1 are allowed on the trunk, and that the native VLAN is set to VLAN 999. Which configuration should the engineer apply on the uplink interface?

Accepted Answer

switchport mode trunk; switchport trunk native vlan 999; switchport trunk allowed vlan except 1. Option A is correct because the 'switchport trunk allowed vlan except 1' command explicitly permits all VLANs except VLAN 1 on the trunk, while the 'switchport trunk native vlan 999' command sets the native VLAN to 999, ensuring that untagged frames on the trunk belong to VLAN 999 instead of the default VLAN 1. This meets the requirement to exclude VLAN 1 from the allowed list and change the native VLAN.

Answer

switchport mode trunk; switchport trunk native vlan 999; switchport trunk allowed vlan remove 1

Answer

switchport mode trunk; switchport trunk native vlan 999; switchport trunk allowed vlan 2-4094

Answer

switchport mode trunk; switchport trunk native vlan 999; switchport trunk allowed vlan none

Question 6

An engineer is troubleshooting a connectivity issue between two switches, SW1 and SW2, connected via a trunk. The trunk is configured with switchport mode trunk on both sides. The engineer notices that some VLANs are not passing traffic, even though they are in the allowed list. The output of 'show interfaces trunk' on SW1 shows that VLANs 10, 20, and 30 are in the allowed list and are active. However, hosts in VLAN 30 cannot reach the distribution switch. What is the most likely cause?

Accepted Answer

VLAN 30 is not created in the VLAN database on SW2.. VLAN 30 must exist in the VLAN database on both switches for traffic to be forwarded across the trunk. Even if VLAN 30 is in the allowed list and active on SW1, if it has not been created on SW2, SW2 will discard frames tagged with VLAN 30 because it has no VLAN 30 interface or forwarding table entry. This is a common misconfiguration where the VLAN is allowed on the trunk but not present on the remote switch.

Answer

The native VLAN is mismatched between SW1 and SW2.

Answer

VTP pruning is removing VLAN 30 from the trunk.

Answer

The trunk is not forming due to DTP negotiation.

Question 7

A network engineer is configuring a new Cisco Catalyst switch to connect to an existing network. The uplink to the distribution switch is configured as a trunk. The engineer wants to ensure that the trunk uses 802.1Q encapsulation and that the native VLAN is set to VLAN 100. The distribution switch is a Cisco Catalyst 3850. Which configuration should the engineer apply on the uplink interface?

Accepted Answer

switchport mode trunk; switchport trunk native vlan 100. Option A is correct because on modern Cisco Catalyst switches that run LAN Base or IP Base software, the default trunk encapsulation is 802.1Q, so the 'switchport trunk encapsulation dot1q' command is not required. The 'switchport mode trunk' forces the interface into trunking mode, and 'switchport trunk native vlan 100' sets the native VLAN to 100, which matches the requirement.

Answer

switchport trunk encapsulation dot1q; switchport mode trunk; switchport trunk native vlan 100

Answer

switchport mode dynamic desirable; switchport trunk native vlan 100

Answer

switchport mode trunk; switchport trunk allowed vlan 100

Question 8

An engineer is troubleshooting a problem where a trunk link between two Cisco switches is not passing traffic for VLAN 10, but other VLANs are working. The trunk is configured with switchport mode trunk on both sides. The engineer checks the allowed VLAN list and sees VLAN 10 is included. The native VLAN is set to 1 on both sides. What is the most likely cause?

Accepted Answer

VLAN 10 is not created in the VLAN database on one of the switches.. The most likely cause is that VLAN 10 is not created in the VLAN database on one of the switches. Even if VLAN 10 is included in the allowed VLAN list on the trunk, a switch will not forward traffic for a VLAN that does not exist in its local VLAN database. The trunk interface will be operationally down for that specific VLAN, preventing traffic from passing.

Answer

VTP pruning has removed VLAN 10 from the trunk.

Answer

The native VLAN is mismatched.

Answer

Spanning Tree Protocol is blocking VLAN 10 on the trunk.

Question 9

A network engineer is configuring a new Cisco Nexus 9000 switch to connect to an existing Cisco Catalyst 3850 switch. The link between them should be a trunk carrying VLANs 10, 20, and 30. The engineer configures the Nexus switch with 'switchport mode trunk' and 'switchport trunk allowed vlan 10,20,30'. However, the trunk does not come up. The Catalyst switch is configured with 'switchport mode trunk' and 'switchport trunk allowed vlan 10,20,30'. What is the most likely cause?

Accepted Answer

The Nexus switch does not have the 'switchport trunk encapsulation dot1q' command configured.. The most likely cause is that the Nexus switch defaults to 802.1Q encapsulation, but the Cisco Catalyst 3850 switch requires the explicit 'switchport trunk encapsulation dot1q' command to be configured on the Nexus side. Without this command, the Nexus switch may not properly negotiate or establish the trunk, as the Catalyst switch expects a specific encapsulation type. This is a common issue when interconnecting different Cisco switch platforms that handle trunk encapsulation defaults differently.

Answer

The Catalyst switch is set to dynamic auto mode.

Answer

The allowed VLAN list on the Nexus switch is missing VLAN 1.

Answer

The native VLAN is set to 999 on the Nexus switch.

Question 10

A network engineer runs the following command on Switch SW1:

SW1# show vlan brief

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Gi0/1, Gi0/2, Gi0/3
10   Sales                            active    Gi0/4, Gi0/5
20   Engineering                      active    Gi0/6, Gi0/7
1002 fddi-default                     act/unsup
1003 token-ring-default               act/unsup
1004 fddinet-default                  act/unsup
1005 trnet-default                    act/unsup

Based on this output, what can be concluded?

Accepted Answer

Interfaces Gi0/1, Gi0/2, and Gi0/3 are in VLAN 1.. Option C is correct because the 'show vlan brief' output explicitly lists Gi0/1, Gi0/2, and Gi0/3 under VLAN 1 (default), confirming these interfaces are access ports assigned to VLAN 1. VLAN 1 is the default VLAN on Cisco switches, and all ports not explicitly configured otherwise belong to it.

Answer

All ports shown are in trunk mode.

Answer

VLANs 1002-1005 are active and supported.

Answer

VLAN 20 has no ports assigned.

Question 11

A network engineer runs the following command on Switch SW1:

SW1# show interfaces trunk

Port        Mode         Encapsulation  Status        Native vlan
Gi0/1      on           802.1q         trunking      1
Gi0/2      on           802.1q         trunking      1

Port        Vlans allowed on trunk
Gi0/1       1-1005
Gi0/2       1-1005

Port        Vlans allowed and active in management domain
Gi0/1       1,10,20
Gi0/2       1,10,20

Port        Vlans in spanning tree forwarding state and not pruned
Gi0/1       1,10,20
Gi0/2       1,10,20

Based on this output, what can be concluded?

Accepted Answer

VLANs 2-9 are allowed but not active on the trunk.. The output shows that VLANs 1-1005 are allowed on the trunk, but only VLANs 1, 10, and 20 are listed as active in the management domain. This means VLANs 2-9 are configured on the trunk but are not active (i.e., not created or not present on the switch), so they do not forward traffic. Option A correctly identifies this condition.

Answer

The trunk is using ISL encapsulation.

Answer

VLAN 1 is pruned from the trunk.

Answer

Only VLANs 10 and 20 are forwarding traffic.

Question 12

A network engineer runs the following command on Switch SW1:

SW1# show interfaces gi0/1 switchport

Name: Gi0/1
Switchport: Enabled
Administrative Mode: trunk
Operational Mode: trunk
Administrative Trunking Encapsulation: dot1q
Operational Trunking Encapsulation: dot1q
Negotiation of Trunking: On
Access Mode VLAN: 1 (default)
Trunking Native Mode VLAN: 1 (default)
Administrative Native VLAN tagging: enabled
Voice VLAN: none
Administrative private-vlan host-association: none
Administrative private-vlan mapping: none
Administrative private-vlan trunk native VLAN: none
Administrative private-vlan trunk Native VLAN tagging: enabled
Administrative private-vlan trunk encapsulation: dot1q
Administrative private-vlan trunk normal VLANs: none
Administrative private-vlan trunk private VLANs: none
Operational private-vlan: none
Trunking VLANs Enabled: ALL
Pruning VLANs Enabled: 2-1001
Capture Mode Disabled
Capture VLANs Allowed: ALL

Based on this output, what can be concluded?

Accepted Answer

DTP is enabled on this interface.. The output shows 'Negotiation of Trunking: On', which indicates that Dynamic Trunking Protocol (DTP) is enabled on the interface. DTP is a Cisco proprietary protocol used to negotiate trunking between switches. Since the interface is in trunk mode and DTP is on, option B is correct.

Answer

The interface is configured as an access port.

Answer

The native VLAN is tagged with 802.1Q.

Answer

All VLANs except 2-1001 are pruned.

Question 13

A network engineer runs the following command on Switch SW1:

SW1# show spanning-tree vlan 10

VLAN0010
  Spanning tree enabled protocol ieee
  Root ID    Priority    32778
             Address     0011.2233.4455
             This bridge is the root
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

Bridge ID  Priority    32778  (priority 32768 sys-id-ext 10)
             Address     0011.2233.4455
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time  300 sec

Interface        Role Sts Cost      Prio.Nbr Type
---------------- ---- --- --------- -------- --------------------------------
Gi0/1            Desg FWD 4         128.1    P2p
Gi0/2            Desg FWD 4         128.2    P2p
Gi0/3            Desg FWD 4         128.3    P2p

Based on this output, what can be concluded?

Accepted Answer

This switch is the root bridge for VLAN 10.. The output explicitly states 'This bridge is the root' for VLAN 10, and the Root ID and Bridge ID are identical (same priority 32778 and address 0011.2233.4455), confirming SW1 is the root bridge for VLAN 10. All interfaces are in the Designated (Desg) role and Forwarding (FWD) state, which is expected for a root bridge because root bridges have no root ports.

Answer

Gi0/2 is a root port.

Answer

The spanning-tree mode is PVST+.

Answer

VLAN 10 has a forwarding delay of 30 seconds.

Question 14

A network engineer runs the following command on Switch SW1:

SW1# show etherchannel summary

Flags:  D - down        P - bundled in port-channel
        I - stand-alone s - suspended
        H - Hot-standby (LACP only)
        R - Layer3      S - Layer2
        U - in use      N - not in use, no aggregation
        f - failed to allocate aggregator

M - not in use, minimum links not met
        u - unsuitable for bundling
        w - waiting to be aggregated
        d - default port

Number of channel-groups in use: 1
Number of aggregators:           1

Group  Port-channel  Protocol    Ports
------+-------------+-----------+--------------------------------------------
1      Po1(SU)         LACP      Gi0/1(P)   Gi0/2(P)   Gi0/3(D)

Based on this output, what can be concluded?

Accepted Answer

The EtherChannel has two active member links.. The output shows that Gi0/1 and Gi0/2 have a flag of 'P' (bundled in port-channel), while Gi0/3 has a flag of 'D' (down). Therefore, only two ports are actively bundled, making option D correct. The 'SU' flags on Po1 indicate the port-channel is Layer 2 (S) and in use (U), not Layer 3.

Answer

The EtherChannel is using PAgP.

Answer

Port Gi0/3 is bundled in the channel.

Answer

The port-channel is a Layer 3 interface.

Question 15

A network engineer runs the following command on Switch SW1:

SW1# show vlan id 10

VLAN ID: 10
VLAN Name: Sales
VLAN Type: Ethernet
VLAN State: active
MTU: 1500

Remote SPAN VLAN: No

Primary VLAN ID: 10

Private VLAN Type: Primary

Associated Secondary VLAN IDs: 100, 200

Based on this output, what can be concluded?

Accepted Answer

VLAN 10 is a primary private VLAN.. The output shows VLAN 10 configured as a Primary VLAN with associated secondary VLANs 100 and 200, which is the defining characteristic of a primary private VLAN. This is confirmed by the fields 'Private VLAN Type: Primary' and 'Associated Secondary VLAN IDs: 100, 200'. Therefore, VLAN 10 is a primary private VLAN, not a normal data VLAN.

Answer

VLAN 10 is a community VLAN.

Answer

VLAN 10 is an isolated VLAN.

Answer

VLAN 10 is a normal data VLAN with no private VLAN features.