CCNA Switching and Network Access Practice Question
A switch interface connected to another switch must carry VLANs 10, 20, and 30 only. Which command best enforces that requirement on the trunk?
⚠ Common exam trap
A common exam trap is selecting commands that do not correctly restrict VLANs on a trunk. For example, using 'switchport access vlan 10,20,30' is invalid because access ports support only one VLAN. Another trap is confusing the native VLAN setting with allowed VLANs; 'switchport trunk native vlan' only defines the untagged VLAN and does not filter VLANs. Also, relying on dynamic trunk negotiation commands like 'switchport mode dynamic auto' does not restrict VLANs and can lead to trunks carrying all VLANs by default. These mistakes cause VLAN traffic to flow where it shouldn’t, violating design requirements.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
switchport trunk allowed vlan 10,20,30
The correct command is the one that explicitly sets the allowed VLAN list on the trunk. In plain language, the administrator wants the inter-switch link to carry only the named VLANs instead of every VLAN by default. Cisco trunks can transport multiple VLANs, but that does not mean every VLAN should always be permitted. Restricting the allowed list supports cleaner design and helps reduce unnecessary VLAN transport. This is a common CCNA switching task because it distinguishes between creating a trunk and controlling what the trunk actually carries. Simply enabling trunking is not enough when the requirement names exact VLANs. The answer must directly restrict the allowed list rather than change the native VLAN or apply an unrelated access-port command.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
switchport trunk allowed vlan 10,20,30
Why this is correct
The correct command for a trunk interface is `switchport trunk allowed vlan 10,20,30`; it explicitly defines the allowed VLAN list for IEEE 802.1Q tagging. By specifying only VLANs 10, 20, and 30, the administrator ensures that frames from other VLANs are not forwarded across this trunk, providing precise traffic segmentation between the two switches.
- ✗
switchport access vlan 10,20,30
Why it's wrong here
An access port is assigned to exactly one untagged VLAN, and the `switchport access vlan` command accepts a single VLAN ID, not a comma-separated list. The syntax `switchport access vlan 10,20,30` is invalid on any IOS platform because multiple VLANs on a switch-to-switch link require trunking, not access mode. To carry those VLANs, the interface must be configured as a trunk with the allowed VLAN list.
When this WOULD be correct
In a different scenario where the question asks for the configuration of a switch port that should only allow traffic from a single VLAN, such as 'Which command sets the access VLAN for a port to VLAN 10?' this option would be correct, as it would specify the single VLAN for that access port.
- ✗
switchport mode dynamic auto
Why it's wrong here
The `switchport mode dynamic auto` setting makes the interface willing to become a trunk if the neighboring switch actively initiates trunk negotiation via DTP, but it has no direct effect on the VLANs allowed across the link. The actual set of VLANs that traverse a trunk is governed by the `switchport trunk allowed vlan` command, not by the negotiation mode. Therefore, this option fails to restrict or specify the VLANs and does not meet the requirement.
When this WOULD be correct
In a scenario where the question asks for configuring a switch port to automatically negotiate trunking without specifying VLAN restrictions, 'switchport mode dynamic auto' would be the correct answer. For example, if the question required enabling trunking without VLAN filtering, this command would be appropriate.
- ✗
switchport trunk native vlan 10,20,30
Why it's wrong here
The `switchport trunk native vlan` command sets the single untagged VLAN used on an IEEE 802.1Q trunk, and it requires one VLAN ID as its argument, not a list. It does not filter or restrict which VLANs are permitted across the trunk; that role belongs exclusively to `switchport trunk allowed vlan`. Thus, specifying `10,20,30` here is both syntactically invalid and semantically unrelated to the goal of carrying those VLANs.
When this WOULD be correct
In a different scenario where the question asks for configuring the native VLAN for untagged traffic on a trunk link, and it specifies that VLAN 10 should be the native VLAN while VLANs 20 and 30 are allowed, then 'switchport trunk native vlan 10' would be the correct command.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓switchport trunk allowed vlan 10,20,30Correct answer▾
Why this is correct
The correct command for a trunk interface is `switchport trunk allowed vlan 10,20,30`; it explicitly defines the allowed VLAN list for IEEE 802.1Q tagging. By specifying only VLANs 10, 20, and 30, the administrator ensures that frames from other VLANs are not forwarded across this trunk, providing precise traffic segmentation between the two switches.
✗switchport access vlan 10,20,30Wrong answer — click to see why▾
Why this is wrong here
The 'switchport access vlan' command is used on access ports to assign a single VLAN, not on trunk ports. It cannot specify multiple VLANs, and using it on a trunk would misconfigure the port, potentially causing connectivity issues.
★ When this WOULD be the correct answer
In a different scenario where the question asks for the configuration of a switch port that should only allow traffic from a single VLAN, such as 'Which command sets the access VLAN for a port to VLAN 10?' this option would be correct, as it would specify the single VLAN for that access port.
Why candidates choose this
Students might confuse 'access vlan' with 'trunk allowed vlan' because both involve VLAN configuration. The word 'access' might be misinterpreted as allowing access to multiple VLANs, but it is strictly for a single VLAN on an access port.
✗switchport mode dynamic autoWrong answer — click to see why▾
Why this is wrong here
The 'switchport mode dynamic auto' command sets the port to negotiate trunking using DTP, but it does not restrict which VLANs are allowed. The port may become a trunk or access port depending on the neighbor, and even if it becomes a trunk, all VLANs are allowed by default.
★ When this WOULD be the correct answer
In a scenario where the question asks for configuring a switch port to automatically negotiate trunking without specifying VLAN restrictions, 'switchport mode dynamic auto' would be the correct answer. For example, if the question required enabling trunking without VLAN filtering, this command would be appropriate.
Why candidates choose this
Students may think 'dynamic auto' automatically handles VLANs or that it implies trunking with specific VLANs. However, it only controls trunk negotiation, not the allowed VLAN list.
✗switchport trunk native vlan 10,20,30Wrong answer — click to see why▾
Why this is wrong here
The 'switchport trunk native vlan' command specifies the native VLAN for untagged traffic on a trunk, and it accepts only a single VLAN ID, not a list. Using it with multiple VLANs is syntactically invalid and would be rejected by the switch.
★ When this WOULD be the correct answer
In a different scenario where the question asks for configuring the native VLAN for untagged traffic on a trunk link, and it specifies that VLAN 10 should be the native VLAN while VLANs 20 and 30 are allowed, then 'switchport trunk native vlan 10' would be the correct command.
Why candidates choose this
Students might confuse 'native vlan' with 'allowed vlan' because both are trunk-related commands. The word 'native' might be misread as 'allowed', leading to the incorrect assumption that it can specify multiple VLANs.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Configuring Switch Ports for Desktops, VoIP Phones, APs, IoT, and Virtualized Hosts
Key term
Cisco Discovery Protocol
A proprietary Layer 2 network protocol used by Cisco devices to discover information about directly connected neighbor devices.
Key term
VLAN
A VLAN (Virtual Local Area Network) is a logical grouping of network devices that behave as if they are on the same physical network segment, regardless of their actual physical location.
About these practice questions
This 200-301 question is part of Courseiva's 1,389-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.