CCNA Switching and Network Access Practice Question
Which TWO commands are required to configure a switch port to support both a desktop PC and a VoIP phone using voice VLAN?
⚠ Common exam trap
Candidates often mistakenly include 'switchport access vlan' as one of the two required commands, but the question specifically asks for voice VLAN configuration, not the full port setup.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
switchport mode access
'switchport mode access,' is required because voice VLAN only operates on an access port. Option C, 'switchport voice vlan <vlan-id>,' is the command that actually assigns the voice VLAN ID. Option B is incorrect because a trunk port would not properly separate voice and data traffic as the phone expects an access port. Option D is a common data VLAN configuration but is not strictly necessary for voice VLAN operation; the access VLAN can be left as the default or configured separately. Option E is wrong because 'switchport port-security maximum 1' would allow only a single MAC address, while the port must support two devices (the phone and the PC), second MAC being the phone's internal switch.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
switchport mode access
Why this is correct
This command configures the port as an access port, which is required for connecting a desktop PC and a VoIP phone (the phone typically uses the access port for data and a separate voice VLAN).
- ✗
switchport mode trunk
Why it's wrong here
Configuring switchport mode trunk on a port that connects to a desktop PC and a VoIP phone is incorrect because trunk ports are designed to carry multiple VLANs with 802.1Q tagging between switches or router-on-a-stick interfaces. End devices like a PC do not understand VLAN tags and would drop tagged frames, while the phone may not receive the untagged access VLAN traffic it expects, causing both data and voice to fail. The correct design uses an access port with an assigned data VLAN and a separate voice VLAN, not a trunk.
- ✓
switchport voice vlan <vlan-id>
Why this is correct
The switchport voice vlan <vlan-id> command is a required configuration because it tells the attached Cisco IP phone which VLAN to use for voice traffic, typically learned via CDP or LLDP. Once configured, the phone tags its own frames with the voice VLAN, while the PC’s traffic remains untagged on the access VLAN. This allows the two traffic types to traverse the same physical link in separate VLANs, ensuring proper QoS classification and separation, which is essential for a functional PC+phone deployment.
- ✗
switchport access vlan <vlan-id>
Why it's wrong here
While this command is used to assign the data VLAN, it is not one of the two required commands for the specific scenario described (the question asks for the two correct configurations, and both A and C are essential).
- ✗
switchport port-security maximum 1
Why it's wrong here
Setting switchport port-security maximum 1 is wrong for a PC+phone port because port security limits the number of MAC addresses allowed on the interface, and a real-world VoIP phone introduces at least two or three MAC addresses (the phone itself and the connected PC, sometimes multiple internal interfaces). With a maximum of 1, the switch would either block the PC or the phone, breaking connectivity. Moreover, port security is an optional layer-2 hardening feature and not part of the essential configuration required to get data and voice working on a single access port.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓switchport mode accessCorrect answer▾
Why this is correct
This command configures the port as an access port, which is required for connecting a desktop PC and a VoIP phone (the phone typically uses the access port for data and a separate voice VLAN).
✗switchport mode trunkWrong answer — click to see why▾
Why this is wrong here
Trunk mode is inappropriate for access ports connecting desktops and phones.
✗switchport access vlan <vlan-id>Wrong answer — click to see why▾
Why this is wrong here
This command is valid but not one of the two correct answers for this multi-select question; the correct pair is A and C.
✗switchport port-security maximum 1Wrong answer — click to see why▾
Why this is wrong here
Port security is not mandatory for the scenario; it is an additional security measure.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Configuring Switch Ports for Desktops, VoIP Phones, APs, IoT, and Virtualized Hosts
Key term
Media Access Control
Media Access Control (MAC) is a sublayer of the Data Link Layer in networking that controls how devices on the same network share access to the physical medium and uniquely identifies each device with a hardware address.
Key term
MAC
MAC (Media Access Control) is a unique hardware identifier assigned to network interfaces for communication on a local network segment.
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.