CCNA Switching and Network Access Practice Question
Exhibit
show interfaces status Gi1/0/10 connected 20 a-full a-100 10/100/1000BaseTX show vlan brief 10 Users active 30 Voice active 20 inactive
A PC connected to SW1 cannot reach the default gateway. The access port is assigned to VLAN 20, and the switch output shows that VLAN 20 is inactive. What is the most likely cause?
⚠ Common exam trap
Ensure the VLAN is created and active in the VLAN database when troubleshooting connectivity issues.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
VLAN 20 does not exist or is not active on the switch
The port is operationally up, but VLAN 20 is listed as inactive because that VLAN does not exist in the VLAN database. An access port assigned to a missing VLAN will not carry normal user traffic for that VLAN.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Port security has shut down the interface
Why it's wrong here
Port security violations that put an interface into error-disabled state cause the port to display as 'err-disabled' or 'shutdown' in show interface output. The exhibit shows the interface status as 'connected' (up/up), which indicates the port is operational and not disabled by a security violation. Therefore, port security is not the reason the PC cannot reach the default gateway.
When this WOULD be correct
In a different scenario where a question describes a switch interface that has been configured with port security and is now in an error-disabled state due to exceeding the maximum allowed MAC addresses, this option would be correct. The question would need to focus on port security violations impacting connectivity.
- ✓
VLAN 20 does not exist or is not active on the switch
Why this is correct
VLAN 20 must exist in the switch's VLAN database and be enabled (not shutdown) for the access port to forward frames. The exhibit's output indicates VLAN 20 is inactive, so the switch will not deliver the PC's frames to the default gateway in that VLAN. As a result, the PC cannot reach the gateway even if its IP address and gateway settings are correct.
- ✗
The port must be converted to a trunk
Why it's wrong here
An access port sends and receives untagged Ethernet frames, which is exactly what a normal PC generates. A trunk port, by default, expects 802.1Q-tagged frames and would drop or mishandle the PC's untagged traffic unless the native VLAN is configured to match. Converting the port to a trunk would not solve the reachability problem and could make it worse; the correct fix is to ensure the access VLAN is active.
When this WOULD be correct
In a different scenario, if the question stated that a device needs to communicate across multiple VLANs and the access port is incorrectly configured as a trunk, then converting it to a trunk would be necessary for proper communication. This would imply that the device needs to send and receive traffic from multiple VLANs.
- ✗
The default gateway must be configured on the physical switch port
Why it's wrong here
A default gateway is a Layer 3 setting required on hosts or on a switch's management SVI, not on physical access ports. Configuring a default gateway on the PC's access port would have no effect on forwarding the PC's traffic, because access ports operate at Layer 2 and do not make routing decisions. The actual default gateway for VLAN 20 would be on the router or the switch's VLAN 20 SVI.
When this WOULD be correct
In a scenario where a question states that a switch port is not forwarding traffic due to a misconfigured VLAN and also mentions that the default gateway is set incorrectly on the switch, this option could be correct. For example, if the switch is expected to route traffic for multiple VLANs and the gateway is misconfigured on the switch instead of the device.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓VLAN 20 does not exist or is not active on the switchCorrect answer▾
Why this is correct
VLAN 20 must exist in the switch's VLAN database and be enabled (not shutdown) for the access port to forward frames. The exhibit's output indicates VLAN 20 is inactive, so the switch will not deliver the PC's frames to the default gateway in that VLAN. As a result, the PC cannot reach the gateway even if its IP address and gateway settings are correct.
✗Port security has shut down the interfaceWrong answer — click to see why▾
Why this is wrong here
This option is wrong because the question specifies that the PC cannot reach the default gateway due to VLAN issues, not because of port security settings. Port security would typically result in the interface being in an error-disabled state, which is not indicated here.
★ When this WOULD be the correct answer
In a different scenario where a question describes a switch interface that has been configured with port security and is now in an error-disabled state due to exceeding the maximum allowed MAC addresses, this option would be correct. The question would need to focus on port security violations impacting connectivity.
Why candidates choose this
Candidates may choose this option because they recognize port security as a common cause of connectivity issues on switches, leading them to associate it with the inability to reach a default gateway without fully analyzing the VLAN context provided in the question.
✗The port must be converted to a trunkWrong answer — click to see why▾
Why this is wrong here
This option is incorrect because converting the port to a trunk would not resolve the issue of the PC not reaching the default gateway if VLAN 20 is not configured or active. The problem lies in the VLAN configuration, not the port type.
★ When this WOULD be the correct answer
In a different scenario, if the question stated that a device needs to communicate across multiple VLANs and the access port is incorrectly configured as a trunk, then converting it to a trunk would be necessary for proper communication. This would imply that the device needs to send and receive traffic from multiple VLANs.
Why candidates choose this
Candidates may choose this option because they associate VLAN communication issues with trunking, believing that a trunk configuration is universally required for VLAN traffic, leading to a misunderstanding of access port functionality.
✗The default gateway must be configured on the physical switch portWrong answer — click to see why▾
Why this is wrong here
This option is incorrect because the default gateway is typically configured on the device (e.g., a router or PC) rather than on the switch port itself. The issue in the question pertains to VLAN configuration, not gateway settings.
★ When this WOULD be the correct answer
In a scenario where a question states that a switch port is not forwarding traffic due to a misconfigured VLAN and also mentions that the default gateway is set incorrectly on the switch, this option could be correct. For example, if the switch is expected to route traffic for multiple VLANs and the gateway is misconfigured on the switch instead of the device.
Why candidates choose this
Candidates may choose this option due to a misunderstanding of where default gateway settings are applied, thinking that the switch port must have a gateway configured for VLAN traffic to flow correctly.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
OSI Model Reference
| Layer | Name | PDU | Key Protocols / Devices |
|---|---|---|---|
| 7 | Application | Data | HTTP, HTTPS, DNS, SMTP, FTP, SSH |
| 6 | Presentation | Data | TLS / SSL, JPEG, ASCII encoding |
| 5 | Session | Data | NetBIOS, RPC, SIP |
| 4 | Transport | Segment / Datagram | TCP, UDP |
| 3 | Network | Packet | IP, ICMP, OSPF — Routers |
| 2 | Data Link | Frame | Ethernet, Wi-Fi, PPP — Switches, Bridges |
| 1 | Physical | Bits | Cables, NICs, Hubs, Repeaters |
Go deeper
Related to this question
Learn chapter
Configuring Switch Ports for Desktops, VoIP Phones, APs, IoT, and Virtualized Hosts
Key term
Default gateway
A default gateway is a network device, typically a router, that acts as the exit point for traffic from a local network to other networks, including the internet.
Key term
Access port
An access port is a switch port that connects to a single end device, like a computer or printer, and carries traffic for only one VLAN.
About these practice questions
This 200-301 question is part of Courseiva's 1,389-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.