CCNA Switching and Network Access Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  On the switch, create the necessary VLANs (e.g., VLAN 10 and VLAN 20) using the 'vlan' command.

  Why this is correct

  Before any port can be assigned to a VLAN or any trunk allowed to carry it, the VLAN must exist in the switch's VLAN database. The 'vlan' command in global configuration mode creates the VLAN and enters VLAN configuration mode, making the VLAN available across the entire switch. Omitting this step results in ports being placed into a shutdown or error-disabled state when referencing nonexistent VLANs, so creating the VLANs is the mandatory first step.

• ✓

  Assign switch access ports to the appropriate VLANs (e.g., interface FastEthernet0/1 in VLAN 10, FastEthernet0/2 in VLAN 20) with the 'switchport access vlan' command.

  Why this is correct

  After creating the VLANs, each switch port connected to an end device must be placed into the correct VLAN using the 'switchport access vlan' command. This command configures the port as an access port in that specific VLAN, so all frames received on that port are associated with that VLAN and forwarded only to other ports in the same VLAN. It also ensures that frames are sent untagged, isolating broadcast domains and preventing traffic from leaking between VLANs.

• ✓

  Configure the switch trunk port connecting to the router as an 802.1Q trunk, set the native VLAN to 99 (to avoid VLAN 1 issues), and allow the required VLANs using commands like 'switchport mode trunk', 'switchport trunk encapsulation dot1q', 'switchport trunk native vlan 99', and 'switchport trunk allowed vlan 10,20'.

  Why this is correct

  The link from the switch to the router must be configured as an 802.1Q trunk so that it can carry frames belonging to multiple VLANs simultaneously. Setting the native VLAN to 99 is a security best practice that avoids using VLAN 1, which is often targeted in VLAN-hopping attacks. The 'switchport trunk allowed vlan 10,20' command restricts which VLANs can traverse the trunk, and 'switchport trunk encapsulation dot1q' explicitly sets the tagging protocol, which is required on platforms that still support the older ISL.

• ✓

  On the router, enable the physical interface connected to the switch (e.g., 'interface GigabitEthernet0/0', 'no shutdown') and ensure it has no IP address.

  Why this is correct

  The router's physical interface must be enabled with 'no shutdown' to ensure the link is administratively up, otherwise the subinterfaces below it remain inactive. Additionally, it must not have an IP address because that would place the router as a host on a single VLAN and defeat the purpose of subinterface-based routing. The physical interface simply serves as the physical conduit for 802.1Q-tagged frames and must remain an untagged, Layer 1-only link.

• ✓

  Create subinterfaces for each VLAN on the router (e.g., 'interface GigabitEthernet0/0.10'), configure 802.1Q encapsulation with the appropriate VLAN ID ('encapsulation dot1q 10'), and assign an IP address (e.g., 'ip address 192.168.10.1 255.255.255.0'). Repeat for other VLANs.

  Why this is correct

  Subinterfaces on the router partition the physical interface into logical segments, each dedicated to a specific VLAN. The 'encapsulation dot1q 10' command maps the subinterface to VLAN 10 by matching frames tagged with that 802.1Q header, and the assigned IP address (e.g., 192.168.10.1) becomes the default gateway for that VLAN. Repeating this for each VLAN creates a router-on-a-stick configuration, enabling inter-VLAN traffic to be routed through a single physical connection.

Go deeper

Related to this question