CCNA Switching and Network Access Practice Question
Exhibit
Goal: - VLAN 10 and VLAN 20 must communicate through a multilayer switch
A multilayer switch must route traffic between VLAN 10 and VLAN 20. Which condition is required for that to happen?
⚠ Common exam trap
Don't confuse trunking with routing; trunk ports carry VLAN traffic but don't route it.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SVIs for the VLANs plus Layer 3 routing enabled on the switch
Inter-VLAN routing on a multilayer switch depends on having functional Layer 3 gateway interfaces for the VLANs and routing enabled on the switch. In plain language, the switch needs a routed brain for each VLAN, usually in the form of SVIs, and it must actually be operating as a Layer 3 device rather than only as a pure Layer 2 switch. Without those conditions, traffic may switch inside a VLAN but cannot be routed between different VLANs. This is a core CCNA design idea because people often assume creating VLANs alone automatically gives them inter-VLAN communication. In reality, VLANs create separation, and routing is what reconnects them under controlled conditions. A trunk between switches can carry VLAN traffic, but it does not itself perform Layer 3 routing between the VLANs. The correct answer is the requirement that makes the switch act as the gateway between VLANs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
SVIs for the VLANs plus Layer 3 routing enabled on the switch
Why this is correct
On a multilayer switch, inter-VLAN routing is accomplished by creating a Switch Virtual Interface (SVI) for each VLAN and assigning each SVI an IP address in its respective subnet. These SVIs act as the default gateway for hosts in their VLAN, and the switch must have IP routing globally enabled with 'ip routing' so it can forward packets between the SVIs at Layer 3. This is the standard method for inter-VLAN routing on a multilayer switch, as opposed to using an external router or router-on-a-stick.
- ✗
All ports in both VLANs configured as trunks
Why it's wrong here
Configuring all ports in both VLANs as trunk ports is a Layer 2 operation that allows multiple VLANs to traverse a single link using 802.1Q tagging, which is designed for links between switches or between a switch and a router, not for connecting end hosts. Trunking does not perform any Layer 3 routing; it simply preserves VLAN tags so that traffic remains isolated at Layer 2. Even if every port is a trunk, the switch still lacks the Layer 3 interfaces and routing table entries necessary to forward packets between VLAN 10 and the other VLAN, so no inter-VLAN routing would occur.
When this WOULD be correct
If the question asked about ensuring VLAN traffic can traverse between switches without specifying routing, and focused on the physical connection setup, then having all ports configured as trunks would be correct to allow VLAN tagging and traffic flow.
- ✗
A separate OSPF process on every access port
Why it's wrong here
OSPF is a dynamic routing protocol that operates at Layer 3 to exchange route information between routers or multilayer switches, not between individual access ports. Access ports are Layer 2 interfaces that carry untagged traffic for a single VLAN and cannot run OSPF because they lack an IP address and are not routed interfaces. Even if you could enable OSPF, it would not create a routing path between VLANs; you would still need SVIs with IP addresses and a routing table. For simple inter-VLAN routing, OSPF is unnecessary and adds complexity without providing any benefit.
When this WOULD be correct
If the question asked about configuring a Layer 3 switch to support dynamic routing protocols for VLANs, and it specified that OSPF should be used for inter-VLAN routing, then having a separate OSPF process on every access port would be relevant to the configuration.
- ✗
Port security disabled on every edge port
Why it's wrong here
Port security is a Layer 2 security feature that restricts the MAC addresses allowed on a port to prevent unauthorized devices or MAC flooding attacks; it has absolutely no effect on the switch's ability to route at Layer 3. Disabling port security on edge ports only affects MAC address table learning and security policy enforcement, not the presence of SVIs or the IP routing configuration. Inter-VLAN routing is determined by whether the switch has routed interfaces for each VLAN and has IP routing enabled, so disabling port security cannot enable or disable routing between VLAN 10 and the other VLAN.
When this WOULD be correct
In a scenario where the question asks about ensuring that a switch can handle traffic without any security restrictions, such as in a lab environment where security is not a concern, the requirement to disable port security on edge ports would be correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓SVIs for the VLANs plus Layer 3 routing enabled on the switchCorrect answer▾
Why this is correct
On a multilayer switch, inter-VLAN routing is accomplished by creating a Switch Virtual Interface (SVI) for each VLAN and assigning each SVI an IP address in its respective subnet. These SVIs act as the default gateway for hosts in their VLAN, and the switch must have IP routing globally enabled with 'ip routing' so it can forward packets between the SVIs at Layer 3. This is the standard method for inter-VLAN routing on a multilayer switch, as opposed to using an external router or router-on-a-stick.
✗All ports in both VLANs configured as trunksWrong answer — click to see why▾
Why this is wrong here
This option is wrong because configuring all ports as trunks does not facilitate inter-VLAN routing; SVIs and Layer 3 routing are necessary for that functionality.
★ When this WOULD be the correct answer
If the question asked about ensuring VLAN traffic can traverse between switches without specifying routing, and focused on the physical connection setup, then having all ports configured as trunks would be correct to allow VLAN tagging and traffic flow.
Why candidates choose this
Candidates may choose this option because they associate trunking with VLAN communication and may overlook the requirement for Layer 3 routing to enable inter-VLAN traffic.
✗A separate OSPF process on every access portWrong answer — click to see why▾
Why this is wrong here
This option is wrong because OSPF is a routing protocol used for dynamic routing, and access ports do not participate in routing processes. Routing between VLANs requires SVIs and Layer 3 capabilities, not OSPF on access ports.
★ When this WOULD be the correct answer
If the question asked about configuring a Layer 3 switch to support dynamic routing protocols for VLANs, and it specified that OSPF should be used for inter-VLAN routing, then having a separate OSPF process on every access port would be relevant to the configuration.
Why candidates choose this
Candidates may find this option tempting because they associate OSPF with routing and may incorrectly believe that it is necessary for VLANs to communicate, overlooking the need for SVIs and Layer 3 routing instead.
✗Port security disabled on every edge portWrong answer — click to see why▾
Why this is wrong here
Port security being disabled on every edge port is not a requirement for routing traffic between VLANs; it pertains to security configurations rather than routing functionality. VLAN routing can occur regardless of port security settings.
★ When this WOULD be the correct answer
In a scenario where the question asks about ensuring that a switch can handle traffic without any security restrictions, such as in a lab environment where security is not a concern, the requirement to disable port security on edge ports would be correct.
Why candidates choose this
Candidates may confuse the need for proper VLAN configurations with security settings, mistakenly believing that disabling port security is essential for routing capabilities, especially if they associate VLANs with access control measures.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
Routing Protocol Comparison
| Protocol | Metric | Max Hops | Algorithm | Type |
|---|---|---|---|---|
| RIP v2 | Hop count | 15 | Bellman-Ford | Distance vector |
| OSPF | Cost (bandwidth) | Unlimited | Dijkstra (SPF) | Link state |
| EIGRP | Composite metric | Unlimited | DUAL | Hybrid |
| IS-IS | Cost | Unlimited | Dijkstra | Link state |
| BGP | Policy / attributes | Unlimited | Path vector | Path vector |
RIP's 15-hop limit makes it unsuitable for large networks. OSPF and EIGRP dominate modern enterprise deployments.
Go deeper
Related to this question
Learn chapter
Configuring Switch Ports for Desktops, VoIP Phones, APs, IoT, and Virtualized Hosts
Key term
Route
A route is a path that data takes through a network from one device or network to another, determined by routing protocols and configured rules.
Key term
Cisco Discovery Protocol
A proprietary Layer 2 network protocol used by Cisco devices to discover information about directly connected neighbor devices.
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.