CCNA Switching and Network Access Practice Question
A switch displays the following output:
Switch# show interfaces trunk
Port Mode Encapsulation Status Native vlan Gi1/0/24 on 802.1q trunking 99
Port Vlans allowed on trunk Gi1/0/24 10,20,30
Port Vlans active in management domain Gi1/0/24 10,20,30,40
Users in VLAN 40 cannot reach resources across this trunk.
What is the most likely reason?
⚠ Common exam trap
Ensure you differentiate between VLANs configured on the switch and those allowed on the trunk. Just because a VLAN is active doesn't mean it's allowed on a trunk.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
VLAN 40 is not permitted on the trunk
The trunk is not carrying VLAN 40 because VLAN 40 is missing from the allowed VLAN list (only 10, 20, 30 are allowed). Option A is incorrect because spanning tree does not block VLANs by default without evidence of a loop; the output shows no STP blocking. Option B is incorrect because native VLAN only affects tagging, not whether a VLAN can traverse a trunk; all VLANs can cross a trunk if permitted. Option D is incorrect because 802.1Q can carry up to 4094 VLANs, not just three. The key distinction is that a VLAN may be active on the switch but still fail to cross a specific trunk if it is not in the allowed list.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
VLAN 40 is active, so spanning tree must be blocking it
Why it's wrong here
Spanning tree blocks redundant paths to prevent loops, but the trunk status shows "trunking" and VLANs 10, 20, and 30 are active across it; VLAN 40 is listed as active in the management domain but is absent from the "Vlans allowed on trunk" list, meaning it is not permitted on the trunk link. This option is tempting because spanning tree does block VLAN traffic on blocked ports in a looped topology, but here the issue is a missing allowed VLAN in the trunk configuration, not a spanning-tree state.
When this WOULD be correct
In a different scenario, if a question stated that VLAN 40 is configured but the switch output showed that spanning tree was blocking the port due to a loop, then this option would be correct. For example, if the question indicated that VLAN 40 was indeed allowed but was not reachable due to spanning tree blocking it.
- ✗
VLAN 40 is not in the native VLAN, so it cannot cross the trunk
Why it's wrong here
A VLAN does not need to be the native VLAN in order to cross an 802.1Q trunk. Most VLANs cross as tagged traffic. The native VLAN is only the VLAN carried untagged on that trunk. VLAN 40 could still be transported normally if it were permitted on the trunk, but it is not.
When this WOULD be correct
In a different scenario, if the question stated that VLAN 40 was configured as the native VLAN and the trunk port was set to only allow tagged traffic, then this option would be correct. This would mean VLAN 40's untagged traffic would not be transmitted across the trunk.
- ✓
VLAN 40 is not permitted on the trunk
Why this is correct
Correct. This is correct. The allowed VLAN list controls which VLANs are transported across the trunk. Because VLAN 40 is absent from that list, users in VLAN 40 cannot use that trunk to reach resources on the far side.
- ✗
802.1Q trunks can carry only three VLANs at a time
Why it's wrong here
The 802.1Q standard uses a 12-bit VLAN ID field, which allows up to 4,094 usable VLANs on a trunk, not merely three. The output's list of VLANs 10, 20, and 30 reflects the currently configured allowed-VLAN list, not an inherent protocol cap. A trunk can simultaneously carry many more VLANs when they are permitted and active, so this option mistakes a configuration choice for a protocol limitation.
When this WOULD be correct
In a different scenario where the question states that a switch is configured to only allow a maximum of three VLANs on a trunk, and the output confirms that only three VLANs are listed, this option would be correct. The question would need to specify a limitation on the number of VLANs allowed on the trunk.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓VLAN 40 is not permitted on the trunkCorrect answer▾
Why this is correct
Correct. This is correct. The allowed VLAN list controls which VLANs are transported across the trunk. Because VLAN 40 is absent from that list, users in VLAN 40 cannot use that trunk to reach resources on the far side.
✗VLAN 40 is active, so spanning tree must be blocking itWrong answer — click to see why▾
Why this is wrong here
Spanning Tree Protocol (STP) can block a VLAN if there is a loop, but the output shows VLAN 40 is active in the management domain and not listed as blocked. The explicit absence of VLAN 40 from the allowed VLAN list is the direct cause, not STP.
★ When this WOULD be the correct answer
In a different scenario, if a question stated that VLAN 40 is configured but the switch output showed that spanning tree was blocking the port due to a loop, then this option would be correct. For example, if the question indicated that VLAN 40 was indeed allowed but was not reachable due to spanning tree blocking it.
Why candidates choose this
Students may confuse STP blocking with VLAN filtering, especially when a VLAN is active but not forwarding. However, STP blocking would affect all VLANs on a port, not a single VLAN, and the trunk status shows 'trunking' indicating STP is not blocking the entire port.
✗VLAN 40 is not in the native VLAN, so it cannot cross the trunkWrong answer — click to see why▾
Why this is wrong here
The native VLAN is only for untagged traffic on an 802.1Q trunk. All other VLANs are tagged and can cross the trunk regardless of the native VLAN. VLAN 40 is not the native VLAN, but that does not prevent it from being carried if permitted.
★ When this WOULD be the correct answer
In a different scenario, if the question stated that VLAN 40 was configured as the native VLAN and the trunk port was set to only allow tagged traffic, then this option would be correct. This would mean VLAN 40's untagged traffic would not be transmitted across the trunk.
Why candidates choose this
There is a common misconception that only the native VLAN can cross a trunk, or that non-native VLANs require special configuration. In reality, any VLAN can be tagged and carried as long as it is in the allowed list.
✗802.1Q trunks can carry only three VLANs at a timeWrong answer — click to see why▾
Why this is wrong here
802.1Q has no limit of three VLANs per trunk; it can support up to 4094 VLANs. The output shows only three VLANs allowed because of configuration, not a protocol limitation.
★ When this WOULD be the correct answer
In a different scenario where the question states that a switch is configured to only allow a maximum of three VLANs on a trunk, and the output confirms that only three VLANs are listed, this option would be correct. The question would need to specify a limitation on the number of VLANs allowed on the trunk.
Why candidates choose this
The output shows exactly three VLANs in the allowed list, which might lead a student to think there is a limit. However, this is just a coincidence of the configuration, not a protocol constraint.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Configuring Switch Ports for Desktops, VoIP Phones, APs, IoT, and Virtualized Hosts
Key term
CAN
A CAN (Controller Area Network) is a robust vehicle bus standard designed to allow microcontrollers and devices to communicate with each other without a host computer.
Key term
VLAN
A VLAN logically segments a physical network into isolated broadcast domains without requiring separate physical switches.
About these practice questions
This 200-301 question is part of Courseiva's 1,389-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.