CCNA Switching and Network Access Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  On an 802.1Q trunk, frames in the native VLAN are always tagged with a VLAN ID.

  Why it's wrong here

  On an 802.1Q trunk, the native VLAN is deliberately left untagged to preserve interoperability with legacy devices that do not understand the 802.1Q tag. All other VLANs have a 4-byte tag inserted, but native VLAN frames traverse the trunk without any VLAN tag, and the receiving switch assigns them to the native VLAN based on the absence of a tag. Therefore, the statement that native VLAN frames are always tagged is false; they are the exception to the tagging rule.

• ✓

  The native VLAN should be changed from the default VLAN 1 to an unused VLAN for security reasons.

  Why this is correct

  Changing the native VLAN from the default VLAN 1 to an unused VLAN is a Cisco-recommended hardening step because VLAN 1 is well-documented and often carries control-plane traffic such as CDP, VTP, and PAgP. Attackers can exploit the default native VLAN to launch double-tagging (VLAN hopping) attacks, so moving native VLAN to a dedicated unused VLAN reduces the risk of layer 2 traffic being intercepted or misforwarded. Additionally, using an unused VLAN ensures that no legitimate user traffic is accidentally sent untagged on the trunk, which prevents VLAN misclassification.

• ✗

  802.1Q is a Cisco proprietary trunking protocol.

  Why it's wrong here

  802.1Q is an open IEEE standard (IEEE 802.1Q) that defines a common trunking encapsulation, allowing switches and other network devices from multiple vendors to interoperate on the same trunk link. Cisco's proprietary trunking protocol is ISL (Inter-Switch Link), which has been deprecated in modern Catalyst switches and is considered obsolete. Therefore, saying 802.1Q is proprietary is incorrect; it is an industry-standard protocol used by virtually all networking vendors.

• ✓

  802.1Q supports up to 4094 VLANs (VLAN IDs 1–4094).

  Why this is correct

  The 802.1Q tag uses a 12-bit VLAN ID field, which provides 4096 possible values (0 to 4095), but VLAN IDs 0 and 4095 are reserved for special purposes, specifically priority tagging and future standards. This leaves a usable range of 1 through 4094, for a maximum of 4094 VLANs supported on an 802.1Q network. Some switching platforms may limit this further due to hardware constraints, but the protocol itself supports up to 4094 active VLANs.

• ✗

  The native VLAN must be the same on both ends of an 802.1Q trunk for the trunk to operate.

  Why it's wrong here

  An 802.1Q trunk can actually come up and pass traffic even if the native VLAN differs at each end, but a native VLAN mismatch causes serious operational problems: frames sent on the native VLAN from one switch will be interpreted as belonging to a different VLAN by the other, leading to layer 2 loops, VLAN leakage, and connectivity issues. Because of these risks, it is a best practice to ensure native VLANs match, but it is not a hard requirement for the trunk to operate. In fact, some Cisco switches will detect the mismatch and log error messages or block the port, but the trunk itself is not prevented from becoming administratively up.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question