CCNA Switching and Network Access Practice Question
A switch trunk is carrying several VLANs, but VLAN 99 traffic is failing. The trunk allowed list includes VLAN 99 on both sides. Which statement best explains why a VLAN can still fail even when it is allowed?
⚠ Common exam trap
A common exam trap is assuming that simply including VLAN 99 in the trunk allowed list guarantees that VLAN 99 traffic will pass. Many candidates stop troubleshooting once they see the VLAN is allowed on the trunk, neglecting to verify if VLAN 99 is actually created and active on each switch. This mistake leads to incorrect conclusions, as the allowed list only controls trunk forwarding permissions, not VLAN existence or operational status. The exam tests your understanding that VLAN configuration and status are equally critical for successful VLAN traffic flow.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Because the VLAN may still be absent, inactive, or otherwise not operational locally even if it is allowed on the trunk
A VLAN can still fail across a trunk even when it is allowed because the allowed list is only one part of the overall design. In plain language, a switch may permit the VLAN on the link, but if the VLAN does not actually exist locally, is not active, or if some other trunk characteristic is inconsistent, traffic can still fail. This is an important CCNA troubleshooting principle: one correct line of configuration does not guarantee the full end-to-end condition is correct. Candidates often stop at the allowed VLAN list because it is visible in common show commands. However, VLAN presence, local status, and other trunk parameters still matter. The best answer is the one recognizing that permission on the trunk does not automatically prove the entire VLAN path is healthy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Because the VLAN may still be absent, inactive, or otherwise not operational locally even if it is allowed on the trunk
Why this is correct
An entry in the trunk's allowed VLAN list only authorizes 802.1Q frames for that VLAN to pass; it does not create or activate the VLAN. If VLAN 99 is absent from the local VLAN database, is administratively shutdown with the 'shutdown vlan' command, or has no active member ports or up SVI, it is not operational locally. Therefore, even though the trunk configuration permits VLAN 99, end-to-end connectivity will fail because the VLAN is not functioning on the switch itself.
- ✗
Because allowing a VLAN on a trunk automatically disables it
Why it's wrong here
The command 'switchport trunk allowed vlan add 99' merely adds VLAN 99 to the list of VLANs whose tagged frames may traverse the trunk. This does not disable the VLAN; in fact, it explicitly permits it. A VLAN is disabled by using the 'no vlan 99' to remove it or 'shutdown vlan 99' to administratively bring it down. Thus, allowing a VLAN on a trunk never automatically disables it; the two operations are completely independent.
When this WOULD be correct
In a different scenario, if a question stated that enabling a VLAN on a trunk link would automatically disable it due to a misconfiguration or a specific switch model behavior, then this option could be correct. For example, a question could involve a legacy switch that has a unique feature where enabling VLANs on a trunk link disables them until explicitly activated.
- ✗
Because VLANs can cross trunks only when PAT is enabled
Why it's wrong here
PAT (Port Address Translation) is a Network Address Translation technique that maps multiple private IP addresses to a single public IP address for outbound Internet traffic. Trunk operation is a Layer 2 function where 802.1Q tags in Ethernet frames identify different VLANs as they traverse a trunk link. PAT has no relationship to Layer 2 VLAN tagging or carriage across a trunk. VLANs cross trunks purely via 802.1Q or ISL encapsulation, not through PAT or any other Layer 3 translation mechanism.
When this WOULD be correct
In a scenario where the question asks about the conditions under which VLANs can only communicate across trunks if Port Address Translation (PAT) is enabled, this option would be correct. For example, if the exam focused on specific configurations that require PAT for inter-VLAN routing, then this statement would apply.
- ✗
Because VLAN 99 must always be the native VLAN
Why it's wrong here
The native VLAN is a special VLAN on an 802.1Q trunk that carries its frames untagged, typically configured with 'switchport trunk native vlan <vlan-id>'. There is no requirement that VLAN 99 be the native VLAN; any VLAN can be configured as native, and any VLAN can be carried across a trunk as a tagged VLAN. If VLAN 99 is not the native VLAN, it simply sends and receives 802.1Q-tagged frames. Therefore, needing VLAN 99 to be the native VLAN is a misconception; its operability depends on it being defined and active, not on its native status.
When this WOULD be correct
In a different question, if it were stated that VLAN 99 must be the native VLAN for traffic to be allowed on the trunk, then this option would be correct. For example, if the question specified that any VLAN must be configured as the native VLAN to pass traffic, then this statement would apply.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Because the VLAN may still be absent, inactive, or otherwise not operational locally even if it is allowed on the trunkCorrect answer▾
Why this is correct
An entry in the trunk's allowed VLAN list only authorizes 802.1Q frames for that VLAN to pass; it does not create or activate the VLAN. If VLAN 99 is absent from the local VLAN database, is administratively shutdown with the 'shutdown vlan' command, or has no active member ports or up SVI, it is not operational locally. Therefore, even though the trunk configuration permits VLAN 99, end-to-end connectivity will fail because the VLAN is not functioning on the switch itself.
✗Because allowing a VLAN on a trunk automatically disables itWrong answer — click to see why▾
Why this is wrong here
This option is incorrect because allowing a VLAN on a trunk does not disable it; rather, it simply permits traffic for that VLAN to traverse the trunk link. VLANs can be allowed on a trunk while still being operational if configured correctly.
★ When this WOULD be the correct answer
In a different scenario, if a question stated that enabling a VLAN on a trunk link would automatically disable it due to a misconfiguration or a specific switch model behavior, then this option could be correct. For example, a question could involve a legacy switch that has a unique feature where enabling VLANs on a trunk link disables them until explicitly activated.
Why candidates choose this
Candidates may find this option tempting because it suggests a direct relationship between VLAN configuration and operational status, which aligns with common misconceptions about VLAN management and trunking behavior.
✗Because VLANs can cross trunks only when PAT is enabledWrong answer — click to see why▾
Why this is wrong here
This option is incorrect because allowing a VLAN on a trunk does not disable it; rather, it simply permits the VLAN's traffic to traverse the trunk link. VLANs can still function normally if they are allowed on the trunk, regardless of the trunk's configuration.
★ When this WOULD be the correct answer
In a scenario where the question asks about the conditions under which VLANs can only communicate across trunks if Port Address Translation (PAT) is enabled, this option would be correct. For example, if the exam focused on specific configurations that require PAT for inter-VLAN routing, then this statement would apply.
Why candidates choose this
Candidates may choose this option due to a misunderstanding of VLAN configurations and trunking principles, mistakenly believing that enabling a VLAN on a trunk link could somehow interfere with its functionality.
✗Because VLAN 99 must always be the native VLANWrong answer — click to see why▾
Why this is wrong here
This option is wrong because VLAN 99 can be operational and still not be the native VLAN; being the native VLAN is not a requirement for VLAN traffic to traverse a trunk link.
★ When this WOULD be the correct answer
In a different question, if it were stated that VLAN 99 must be the native VLAN for traffic to be allowed on the trunk, then this option would be correct. For example, if the question specified that any VLAN must be configured as the native VLAN to pass traffic, then this statement would apply.
Why candidates choose this
Candidates may choose this option due to a misunderstanding of native VLANs and trunk configurations, believing that a VLAN must be the native VLAN to function properly on a trunk link.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Configuring Switch Ports for Desktops, VoIP Phones, APs, IoT, and Virtualized Hosts
Key term
VLAN
A VLAN logically segments a physical network into isolated broadcast domains without requiring separate physical switches.
Key term
Switch
A switch is a networking device that connects devices on a local area network and uses MAC addresses to forward data only to the intended recipient.
About these practice questions
This 200-301 question is part of Courseiva's 1,389-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.