CCNA Switching and Network Access Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  On a router-on-a-stick configuration, each subinterface must be configured with an IP address and the encapsulation dot1Q command to specify the VLAN ID.

  Why this is correct

  In router-on-a-stick, a single physical router interface is divided into logical subinterfaces, each dedicated to a distinct VLAN. For every subinterface, you must assign an IP address that falls within the VLAN's subnet and issue the `encapsulation dot1Q <vlan-id>` command so the router tags outgoing frames and recognizes incoming tagged frames for that VLAN. Without this encapsulation, the router cannot distinguish which VLAN a frame belongs to, breaking inter-VLAN routing.

• ✗

  The native VLAN is always tagged on an 802.1Q trunk link.

  Why it's wrong here

  This statement is false because the native VLAN is specifically exempt from 802.1Q tagging on a trunk link. In 802.1Q, frames belonging to the native VLAN are transmitted without a VLAN tag to maintain backward compatibility with legacy switches that do not understand tagging. Only non-native VLANs receive a 4-byte 802.1Q tag; therefore, stating that the native VLAN is always tagged contradicts the very definition of native VLAN behavior.

• ✗

  The command switchport trunk native vlan 10 is used to restrict which VLANs are allowed on a trunk.

  Why it's wrong here

  The `switchport trunk native vlan 10` command does not filter or restrict which VLANs traverse the trunk; it simply designates VLAN 10 as the native VLAN for that trunk port. Allowed VLANs on a trunk are controlled with `switchport trunk allowed vlan` (or `remove`), which builds the permitted VLAN list. Misinterpreting this command often leads to native VLAN mismatch or unintended VLAN pruning, so it is important to distinguish between native VLAN assignment and allowed VLAN filtering.

• ✓

  When configuring a router-on-a-stick, the native VLAN must match on both the switch and the router subinterface to avoid miscommunication.

  Why this is correct

  On a router-on-a-stick setup, the native VLAN must be identical on the switch trunk and the router subinterface to prevent untagged frames from being assigned to the wrong VLAN. When the router receives untagged traffic from the switch's native VLAN, it assumes the frame belongs to the VLAN configured as native on the subinterface (often using `encapsulation dot1Q <vlan> native`). If the native VLAN IDs differ, the router may place frames into an incorrect subnet, causing connectivity failures or security risks.

• ✗

  The command show interfaces trunk displays the IP addresses configured on router subinterfaces.

  Why it's wrong here

  This is incorrect because `show interfaces trunk` is a switch-only command used to display trunk status, the native VLAN, and the list of allowed VLANs on each trunk interface. It does not show IP addresses, because Layer 3 addressing is not part of a switch's trunk port configuration. To view IP addresses configured on router subinterfaces, you would use `show ip interface brief` or `show running-config` on the router, not the switch's trunk verification command.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question