The answer is to configure the interface with switchport mode access and switchport access vlan 20. This is correct because an access port is designed to carry traffic for a single VLAN only, and it explicitly disables any Dynamic Trunking Protocol (DTP) negotiation, preventing the switch from accidentally forming a trunk with the end host. On the CCNA 200-301 v2 exam, this question tests your understanding of basic switch port roles and VLAN assignment, a core switching concept that often appears in both multiple-choice and simulation labs. A common trap is selecting switchport mode dynamic desirable or auto, which leaves the port open to trunk negotiation—something you never want on a user-facing connection. Remember the memory tip: “Access for end devices, trunk for switches.” This ensures your access port configuration for end hosts is both secure and predictable, aligning with real-world best practices.
CCNA Switching and Network Access Practice Question
This 200-301 practice question tests your understanding of switching and network access. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. A key principle to apply: a switch port configured as an access port carries traffic for only one VLAN and does not participate in VLAN trunking protocols.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A switch port connected to a user PC should be placed in VLAN 20 and must not negotiate trunking. Which configuration is the most appropriate?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
switchport mode access
switchport access vlan 20
The most appropriate configuration is to force the interface into access mode and assign it to VLAN 20. In practical terms, a normal user-facing switch port is supposed to carry one VLAN only. There is no reason to rely on dynamic trunk negotiation for a desktop or laptop connection. Explicit access-port configuration is cleaner, more predictable, and safer.
This is a common switching best-practice question. The wrong answers usually leave room for unwanted trunking behavior or move the interface into a completely different role. The right answer combines the correct port role with the correct VLAN membership.
Key principle: A switch port configured as an access port carries traffic for only one VLAN and does not participate in VLAN trunking protocols.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
switchport mode access
switchport access vlan 20
Why this is correct
This is correct because it explicitly makes the port an access port in VLAN 20.
Related concept
A switch port configured as an access port carries traffic for only one VLAN and does not participate in VLAN trunking protocols.
This is wrong because it makes the port a trunk instead of a one-VLAN host port.
When this WOULD be correct
This option would be correct in a scenario where the question specifies that the switch port is intended to connect to another switch or a device that requires trunking, and the native VLAN needs to be set to 20 for proper communication between VLANs.
This is wrong because it still allows DTPtrunk negotiation behavior.
When this WOULD be correct
In a different question setup where a switch port needs to connect to another switch and allow multiple VLANs, configuring the port as a trunk with 'switchport mode trunk' and specifying 'switchport trunk native vlan 20' would be appropriate to manage VLAN traffic effectively.
✗
no switchport
ip address 192.168.20.1 255.255.255.0
Why it's wrong here
This is wrong because it converts the port into a Layer 3 routed interface on supported platforms.
When this WOULD be correct
This option would be correct in a scenario where the question asks for the configuration of a router interface that needs to be assigned an IP address in VLAN 20 for inter-VLAN routing. In that case, the interface would not be a switchport but rather a routed interface.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
This is correct because it explicitly makes the port an access port in VLAN 20.
✗switchport mode trunk
switchport trunk native vlan 20Wrong answer — click to see why▾
Why this is wrong here
This configuration makes the port a trunk port, which is used to carry multiple VLANs between switches, not for a single user PC. The 'switchport trunk native vlan 20' command sets the native VLAN for untagged traffic on the trunk, but the port still actively negotiates trunking via DTP, violating the requirement to not negotiate trunking.
★ When this WOULD be the correct answer
This option would be correct in a scenario where the question specifies that the switch port is intended to connect to another switch or a device that requires trunking, and the native VLAN needs to be set to 20 for proper communication between VLANs.
Why candidates choose this
A student might confuse 'native VLAN' with 'access VLAN' and think that setting the native VLAN to 20 on a trunk port achieves the same result as assigning VLAN 20 to an access port. They may also overlook that trunk ports are designed for inter-switch links, not end-user connections.
✗switchport mode dynamic desirable
switchport trunk allowed vlan 20Wrong answer — click to see why▾
Why this is wrong here
The 'switchport mode dynamic desirable' command actively attempts to form a trunk with the connected device via DTP, which contradicts the requirement to not negotiate trunking. Additionally, 'switchport trunk allowed vlan 20' only restricts which VLANs are allowed on the trunk, but the port is still in trunking mode, not an access port.
★ When this WOULD be the correct answer
In a different question setup where a switch port needs to connect to another switch and allow multiple VLANs, configuring the port as a trunk with 'switchport mode trunk' and specifying 'switchport trunk native vlan 20' would be appropriate to manage VLAN traffic effectively.
Why candidates choose this
Students may think that 'dynamic desirable' is a safe mode that only becomes a trunk if the other side agrees, but it still initiates DTP negotiation. They might also incorrectly assume that 'trunk allowed vlan 20' limits the port to a single VLAN, similar to an access port.
✗no switchport
ip address 192.168.20.1 255.255.255.0Wrong answer — click to see why▾
Why this is wrong here
The 'no switchport' command converts the Layer 2 switch port into a Layer 3 routed interface, which cannot be assigned to a VLAN. This configuration is used for routing between VLANs or connecting to routers, not for connecting a user PC to a specific VLAN.
★ When this WOULD be the correct answer
This option would be correct in a scenario where the question asks for the configuration of a router interface that needs to be assigned an IP address in VLAN 20 for inter-VLAN routing. In that case, the interface would not be a switchport but rather a routed interface.
Why candidates choose this
A student might think that assigning an IP address to the port is necessary for the PC to communicate, but on a Layer 2 switch, VLAN membership is handled at Layer 2, not by IP addressing. They may also confuse this with configuring a switch virtual interface (SVI) for VLAN 20, which is done on a different interface.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Common exam traps
Common exam trap: answer the scenario, not the keyword
Avoid assuming 'auto' mode is always safe; it can lead to unintended trunking.
Detailed technical explanation
How to think about this question
VLANs (Virtual Local Area Networks) segment a physical switch into multiple logical networks, isolating broadcast domains. Switch ports can operate in access mode, carrying traffic for a single VLAN, or trunk mode, carrying traffic for multiple VLANs tagged with IEEE 802.1Q headers. Access ports send and receive untagged frames, associating all traffic with a single VLAN. This behavior is essential for end-user devices like PCs that do not understand VLAN tagging.
The command 'switchport mode access' explicitly sets the port to access mode, disabling Dynamic Trunking Protocol (DTP) negotiation. DTP is Cisco's proprietary protocol that dynamically negotiates trunk links between switches. While useful for switch-to-switch links, DTP can cause unintended trunk formation on user ports if left enabled, leading to security vulnerabilities and VLAN leakage. Assigning 'switchport access vlan 20' binds the port to VLAN 20, ensuring all untagged frames are handled within that VLAN.
A common exam trap is selecting configurations that enable trunking or convert the port to Layer 3 mode. For example, 'switchport mode trunk' or 'switchport mode dynamic desirable' allows trunk negotiation, which is inappropriate for user PC ports. Similarly, 'no switchport' converts the interface into a routed port, removing VLAN membership and disabling Layer 2 switching features. Understanding these distinctions prevents misconfiguration and aligns with best practices for secure and predictable network design.
KKey Concepts to Remember
A switch port configured as an access port carries traffic for only one VLAN and does not participate in VLAN trunking protocols.
The command 'switchport mode access' forces a switch port to operate as a non-trunking access port, preventing Dynamic Trunking Protocol (DTP) negotiation.
Assigning a VLAN to an access port with 'switchport access vlan <vlan-id>' ensures all untagged frames on that port belong to the specified VLAN.
Dynamic Trunking Protocol (DTP) enables automatic negotiation of trunk links but can cause unintended trunk formation if not explicitly disabled.
Configuring a port as a trunk with 'switchport mode trunk' allows multiple VLANs to traverse the link, which is inappropriate for user PC connections.
Using 'no switchport' converts a switch port into a Layer 3 routed interface, which is unsuitable for typical end-user PC connections requiring VLAN membership.
Explicitly configuring access ports improves network security and stability by eliminating unexpected VLAN tagging or trunk negotiation behaviors.
A user-facing switch port should never rely on dynamic trunk negotiation to avoid accidental VLAN leakage or security risks.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
A switch port configured as an access port carries traffic for only one VLAN and does not participate in VLAN trunking protocols.
Real-world example
How this comes up in practice
A help-desk technician troubleshoots why a newly connected PC cannot reach shared printers on the same floor. The cable is good, the switch port is active, but the PC is in VLAN 20 and the printers are in VLAN 10. The uplink trunk only allows VLAN 10. A trunk being up does not mean every VLAN crosses it.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this 200-301 question in full detail.
Review a switch port configured as an access port carries traffic for only one VLAN and does not participate in VLAN trunking protocols., then practise related 200-301 questions on the same topic to reinforce the concept.
Switching and Network Access — This question tests Switching and Network Access — A switch port configured as an access port carries traffic for only one VLAN and does not participate in VLAN trunking protocols..
What is the correct answer to this question?
The correct answer is: switchport mode access
switchport access vlan 20 — The most appropriate configuration is to force the interface into access mode and assign it to VLAN 20. In practical terms, a normal user-facing switch port is supposed to carry one VLAN only. There is no reason to rely on dynamic trunk negotiation for a desktop or laptop connection. Explicit access-port configuration is cleaner, more predictable, and safer.
This is a common switching best-practice question. The wrong answers usually leave room for unwanted trunking behavior or move the interface into a completely different role. The right answer combines the correct port role with the correct VLAN membership.
What should I do if I get this 200-301 question wrong?
Review a switch port configured as an access port carries traffic for only one VLAN and does not participate in VLAN trunking protocols., then practise related 200-301 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
A switch port configured as an access port carries traffic for only one VLAN and does not participate in VLAN trunking protocols.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A switch port connected to an end host should forward traffic for one VLAN only and should not negotiate trunking. Which configuration approach best fits that requirement?
medium
✓ A.Configure the interface with `switchport mode access`
B.Configure the interface with `switchport mode trunk`
C.Configure the interface with `switchport mode dynamic desirable`
D.Configure the interface with `no switchport`
Why A: The best approach is to configure the interface as an access port. In plain language, this tells the switch that the interface is for a normal endpoint and should belong to one VLAN rather than carry multiple VLANs like a trunk. It also avoids reliance on dynamic trunk negotiation, which is usually unnecessary and potentially confusing for a user-facing connection.
This is a standard access-layer design principle. End hosts such as PCs and printers usually connect to access ports, not trunks. That is why the correct answer is the one centered on explicit access-port behavior.
Last reviewed: May 17, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.