CCNA Switching and Network Access Practice Question
A network engineer notices that Host A in VLAN 10 (10.10.10.50/24) can successfully ping its default gateway 10.10.10.1, but cannot ping the VLAN 20 SVI (10.20.20.1) or any hosts in VLAN 20. The SVIs for both VLAN 10 and VLAN 20 are in an up/up state, and the switch's trunk ports are correctly allowing both VLANs. What is the most likely cause?
⚠ Common exam trap
Cisco often tests the distinction between a switch operating as a Layer 2 device versus a Layer 3 device, and the trap here is that candidates assume SVIs in an up/up state automatically provide inter-VLAN routing, forgetting the mandatory 'ip routing' command.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The ip routing global configuration command is missing.
Host A can reach its default gateway (10.10.10.1), which is the VLAN 10 SVI, but cannot reach the VLAN 20 SVI (10.20.20.1) or any hosts in VLAN 20. This indicates that Layer 2 connectivity is working (trunk allows both VLANs, SVIs are up/up), but inter-VLAN routing is failing. On a multilayer switch, inter-VLAN routing requires the global command 'ip routing' to enable the switch's IP routing engine; without it, the switch acts as a Layer 2 device only and cannot forward packets between different VLANs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The ip routing global configuration command is missing.
Why this is correct
The 'ip routing' global configuration command is what enables IPv4 forwarding between VLANs on a multilayer switch. With SVIs created and IP addresses assigned, the switch can answer pings to those addresses for local subnet traffic, but it will not route packets between VLANs unless 'ip routing' is enabled. Since Host A can successfully ping 10.10.10.1 (its own SVI gateway) but fails to reach Host B on VLAN 20, the missing command precisely explains the failure: the switch is essentially acting as a host on each VLAN rather than a router.
- ✗
The VLAN 20 SVI is administratively shut down.
Why it's wrong here
If the VLAN 20 SVI were administratively shut down, the interface would be in an 'administratively down, line protocol down' state. The scenario explicitly states that both SVIs are in an up/up state, meaning the SVI is operational at both Layer 1 and Layer 2. An administratively down SVI would prevent the SVI from replying to any pings, but here the issue is inter‑VLAN routing failure—not unreachability of the SVI itself—so this option contradicts the given facts.
- ✗
The trunk between the access switch and the Layer 3 switch is misconfigured as an access port.
Why it's wrong here
A trunk misconfigured as an access port would only carry a single VLAN (either VLAN 10 or VLAN 20), preventing the Layer 3 switch from receiving frames from both VLANs. However, the stem confirms that the trunk ports are correctly configured to allow both VLANs, so the L2 path from the access switch to the Layer 3 switch is intact. Host A can already reach its own gateway, proving that L2 connectivity for VLAN 10 is working; the failure lies solely in the L3 switch's inability to make routing decisions between VLANs.
- ✗
The default gateway on Host A is configured incorrectly.
Why it's wrong here
Host A's default gateway is correctly configured to 10.10.10.1, the VLAN 10 SVI address, and this is verified by Host A's successful ping to that address. If the gateway were configured incorrectly, the ping would fail because the host would either send packets to a nonexistent IP or not have a valid route for off‑subnet destination. Since the ping to the gateway succeeds, the host's Layer 3 configuration is not the problem; the traffic is reaching the default gateway, but the gateway is unable to forward it toward VLAN 20.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓The ip routing global configuration command is missing.Correct answer▾
Why this is correct
The 'ip routing' global configuration command is what enables IPv4 forwarding between VLANs on a multilayer switch. With SVIs created and IP addresses assigned, the switch can answer pings to those addresses for local subnet traffic, but it will not route packets between VLANs unless 'ip routing' is enabled. Since Host A can successfully ping 10.10.10.1 (its own SVI gateway) but fails to reach Host B on VLAN 20, the missing command precisely explains the failure: the switch is essentially acting as a host on each VLAN rather than a router.
✗The VLAN 20 SVI is administratively shut down.Wrong answer — click to see why▾
Why this is wrong here
Candidates may overlook the explicit mention that the SVIs are up/up, mistakenly thinking a shut SVI could be the problem.
✗The trunk between the access switch and the Layer 3 switch is misconfigured as an access port.Wrong answer — click to see why▾
Why this is wrong here
Trunk misconfiguration is a common inter-VLAN issue, but the scenario explicitly says the trunks are working properly, making this answer invalid.
✗The default gateway on Host A is configured incorrectly.Wrong answer — click to see why▾
Why this is wrong here
The successful ping to the default gateway proves the gateway is correct. Without 'ip routing', the switch can't forward packets from VLAN 10 to VLAN 20, but it can respond to local VLAN requests.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Configuring Switch Ports for Desktops, VoIP Phones, APs, IoT, and Virtualized Hosts
Key term
Ping
Ping is a network utility used to test whether a remote computer or device is reachable across an IP network and to measure the round-trip time of data packets.
Key term
CAN
A CAN (Controller Area Network) is a robust vehicle bus standard designed to allow microcontrollers and devices to communicate with each other without a host computer.
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.