How many VLAN and Inter-VLAN Routing Scenarios questions are on this page?

This page has 15 VLAN and Inter-VLAN Routing Scenarios scenario questions for the 200-301 exam, each with detailed explanations and wrong-answer analysis.

How should I approach 200-301 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to CCNA 200-301 v2 questions

Scenario-based practice

VLAN and Inter-VLAN Routing Scenarios

Practise 200-301 VLAN and trunking questions covering access ports, trunk ports, allowed VLAN lists, native VLAN, inter-VLAN routing, and command-output troubleshooting.

Start full practice test Read exam guide

scenario questions

200-301

exam code

Cisco

vendor

Scenario guide

How to approach vlan and inter-vlan routing scenarios

VLAN misconfiguration is one of the top sources of connectivity failures in real networks and one of the most tested areas on the CCNA. These questions cover VLAN access ports, 802.1Q trunks, native VLANs, and router-on-a-stick or layer-3 switch inter-VLAN routing.

Quick answer

Routing questions usually test route selection (administrative distance, metric), how static routes are configured and when they are preferred over dynamic routing.

Administrative distance comparing routing sources.

Static route configuration: next-hop vs exit interface.

Default route propagation and the gateway of last resort.

Recursive routing table lookups.

Practice scenarios

Question 1hardmultiple choice

Open the full VLAN trunking answer →

A switchport connected to another switch should carry multiple VLANs, but it was manually configured as an access port. What is the most likely operational result?

A
The link will not carry multiple VLANs as intended because an access port handles one VLAN only.
This is correct because access mode is the wrong role for a multi-VLAN inter-switch link.
B
The switch automatically converts the access port into a proper trunk.
Why wrong: This is wrong because the device does not simply self-correct the design requirement.
C
The port becomes a routed Layer 3 interface.
Why wrong: This is wrong because access-port configuration does not create a routed port.
D
The VLANs are summarized into one prefix automatically.
Why wrong: This is wrong because VLAN transport and route summarization are unrelated concepts.

Full breakdown with real-world context →

Question 2hardmultiple choice

Study the full AAA explanation →

A switchport is configured for 802.1X authentication. What is the usual role of the RADIUS server in that design?

A
It provides Layer 2 trunk negotiation for the supplicant.
Why wrong: RADIUS does not negotiate switchport trunking.
B
It validates authentication credentials for the supplicant.
Correct. The RADIUS server performs centralized AAA decisions.
C
It replaces the need for DHCP on the access layer.
Why wrong: RADIUS and DHCP have different functions.
D
It generates ARP replies on behalf of the default gateway.
Why wrong: RADIUS does not perform ARP gateway functions.

Full breakdown with real-world context →

Question 3mediummulti select

Open the full VLAN trunking answer →

Which three of the following statements about VLAN Trunking Protocol (VTP) are correct? (Choose three.)

Question 4hardmultiple choice

Full question →

A network administrator notices that a switchport in access mode with PortFast enabled has transitioned to an err-disabled state. What is the most likely cause?

Exhibit

interface GigabitEthernet1/0/9
 switchport mode access
 spanning-tree portfast
 spanning-tree bpduguard enable

Event:
%SPANTREE-2-BLOCK_BPDUGUARD: Received BPDU on PortFast enabled port. Disabling interface.

A
BPDU Guard disabled the PortFast-enabled access port after it received a BPDU.
This is correct because the event message explicitly identifies a BPDU Guard violation.
B
Port security shut down the port because the VLAN was wrong.
Why wrong: This is wrong because the event shown is about BPDUs, not MAC-based port security.
C
DHCP snooping disabled the interface because a host requested an address.
Why wrong: This is wrong because DHCP snooping does not produce this spanning-tree error.
D
EtherChannel suspended the interface because the bundle was incomplete.
Why wrong: This is wrong because the event message points to BPDU Guard, not EtherChannel.

Full breakdown with real-world context →

Question 5hardmultiple choice

Open the full VLAN trunking answer →

An engineer configures 802.1X port-based authentication on a Cisco IOS-XE switch for a voice VLAN deployment. After applying the configuration, IP phones on interface GigabitEthernet1/0/1 fail to receive a voice VLAN and remain in an unauthenticated state. The switchport is configured as an access port with voice VLAN 10. What is the most likely cause of the failure?

Exhibit

Interface: GigabitEthernet1/0/1
MAC Address: aaaa.bbbb.cccc
IP Address: Unknown
Status: Authz Success
Domain: DATA
Oper host mode: single-host
Oper control dir: both
Session timeout: N/A
Common Session ID: 0A1B2C3D4E5F6G7H8I9J
Acct Session ID: 0x00000001
Handle: 0x81000001

Current Policy: DEFAULT

Server Policies:
    Vlan Group: Vlan: 10

Method status list:
   Method           State
   dot1x            Authc Success

A
Re-authenticate the phone using 'dot1x reauthenticate interface Gi1/0/1'
Why wrong: Re-authentication would not change the domain assignment because the port is still in single-host mode.
B
Configure 'authentication host-mode multi-domain' on the interface
This command allows the switch to authorize both data and voice domains separately on the same port, enabling the phone to receive the voice VLAN.
C
Add 'switchport voice vlan 10' under the interface
Why wrong: The voice VLAN is already configured; the issue is not the VLAN assignment but the authentication domain.
D
Change the port to 'authentication port-control force-authorized'
Why wrong: This would bypass 802.1X entirely, which is not desired for a secure deployment and would not resolve the domain issue.

Full breakdown with real-world context →

Question 6harddrag order

Open the full VLAN trunking answer →

Drag and drop the following steps into the correct order to configure a Cisco IOS-XE router as a DHCP server for a client VLAN and then enable a DHCP relay agent on a different interface to forward client requests to a remote server.

A
Enter global configuration mode, create the DHCP pool, configure the network and default gateway, exclude addresses, enable DHCP relay on the required interface, and verify.
Why wrong: This is the correct sequence: first enter global configuration mode, then create the DHCP pool with network and default gateway, exclude addresses to prevent conflicts, enable DHCP relay on the interface that needs to forward requests, and finally verify the configuration.
B
Enter global configuration mode, enable DHCP relay on the required interface, create the DHCP pool, configure the network and default gateway, exclude addresses, and verify.
This is incorrect because DHCP relay should be configured after the DHCP pool is created and addresses are excluded, not before. The relay configuration depends on the interface and the DHCP server address, which is independent of the pool, but the logical order is to set up the server first.
C
Enter global configuration mode, create the DHCP pool, enable DHCP relay on the required interface, configure the network and default gateway, exclude addresses, and verify.
This is incorrect because the network and default gateway must be configured within the DHCP pool before excluding addresses. The pool configuration includes the network and default gateway, and excluding addresses is part of the pool configuration.
D
Enter global configuration mode, exclude addresses, create the DHCP pool, configure the network and default gateway, enable DHCP relay on the required interface, and verify.
Correct order: exclusions first to protect reserved addresses, then pool configuration, relay agent, and verification.

Full breakdown with real-world context →

Question 7hardmultiple choice

Open the full VLAN trunking answer →

A network engineer configures an EtherChannel between two Cisco switches SW1 and SW2 using LACP. After configuration, hosts connected to SW1 report intermittent connectivity to hosts on SW2. The engineer checks the EtherChannel status and sees that the trunk is up but only allows VLAN 1, while the hosts communicate across VLANs 10 and 20. Which command should the engineer apply to both switches to resolve the issue?

Network Topology

A
channel-group 1 mode active
Why wrong: The ports are already in LACP active mode (as shown by the protocol being LACP and the ports being bundled). Reapplying this command will not fix the intermittent connectivity.
B
switchport trunk allowed vlan 1,10,20
This command ensures that all member ports of the EtherChannel have the same VLAN list. Inconsistent allowed VLANs across member ports can cause traffic to be dropped intermittently. Applying this to all member interfaces on both switches resolves the issue.
C
lacp rate fast
Why wrong: This command changes the LACP rate to fast, which sends LACP packets every second instead of every 30 seconds. This would not cause intermittent connectivity; it is used for faster failure detection.
D
switchport mode trunk
Why wrong: The ports are already configured as trunk ports (the Po1 is Layer2 and trunking is implied). Reapplying this command will not resolve the intermittent connectivity.

Full breakdown with real-world context →

Question 8mediumdrag order

Open the full VLAN trunking answer →

Drag and drop the steps into the recommended configuration order for setting up VLANs, assigning access ports, configuring 802.1Q trunking with a non-default native VLAN, and verifying the setup on a Cisco IOS-XE switch.

A
1. Create VLANs, 2. Assign access ports to VLANs, 3. Configure trunking with non-default native VLAN, 4. Verify configuration
Why wrong: This is the correct order because VLANs must exist before ports can be assigned to them. Trunking configuration comes after port assignment, and verification is always the final step.
B
1. Assign access ports to VLANs, 2. Create VLANs, 3. Configure trunking with non-default native VLAN, 4. Verify configuration
Why wrong: This is incorrect because you cannot assign ports to VLANs that do not yet exist. VLANs must be created first.
C
1. Create VLANs, 2. Configure trunking with non-default native VLAN, 3. Assign access ports to VLANs, 4. Verify configuration
Creating VLANs first is essential. Configuring trunking with a non-default native VLAN next sets the trunk parameters before assigning access ports, following a recommended workflow that reduces native VLAN mismatches.
D
1. Configure trunking with non-default native VLAN, 2. Create VLANs, 3. Assign access ports to VLANs, 4. Verify configuration
Why wrong: This is incorrect because trunking configuration requires that VLANs already exist to be allowed on the trunk. Also, access port assignment should precede trunking.

Full breakdown with real-world context →

Question 9hardmultiple choice

Open the full VLAN trunking answer →

A network administrator is troubleshooting a connectivity issue between two remote sites connected via a WAN link. Hosts on VLAN 10 at Site A (192.168.10.0/24) cannot ping the server at Site B (10.10.20.100). The router at Site A has a default route configured with the next-hop IP address 10.10.10.2. The administrator checks the routing table on Router A and notices that the default route is not installed. What is the most likely cause of the problem?

Exhibit

RouterA# show ip route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
       a - application route
       + - replicated route, % - next hop override, p - overrides from PfR

Gateway of last resort is 10.10.10.2 to network 0.0.0.0

S*    0.0.0.0/0 [1/0] via 10.10.10.2, GigabitEthernet0/0
      10.0.0.0/8 is variably subnetted, 3 subnets, 2 masks
C        10.10.10.0/30 is directly connected, GigabitEthernet0/0
L        10.10.10.1/32 is directly connected, GigabitEthernet0/0
S        10.10.20.0/24 [1/0] via 10.10.10.2, GigabitEthernet0/0
      192.168.10.0/24 is variably subnetted, 2 subnets, 2 masks
C        192.168.10.0/24 is directly connected, Vlan10
L        192.168.10.1/32 is directly connected, Vlan10

A
The static route for 10.10.20.0/24 is missing from the routing table.
Why wrong: The exhibit shows that a static route to 10.10.20.0/24 via 10.10.10.2 is present in the routing table.
B
The GigabitEthernet0/0 interface is administratively down.
Why wrong: The interface is shown as directly connected with a local address, indicating it is up and operational.
C
The default route is not configured; the gateway of last resort is missing.
Why wrong: The output shows 'Gateway of last resort is 10.10.10.2 to network 0.0.0.0', meaning the default route is present.
D
The next-hop router 10.10.10.2 is unreachable.
A static route with a next-hop IP is only installed in the routing table when that next-hop is reachable. Since the default route is missing from the routing table, the next-hop 10.10.10.2 must be unreachable, making option D the correct diagnosis.

Full breakdown with real-world context →

Question 10hardmultiple choice

Open the full VLAN trunking answer →

A switch port is configured with `switchport voice vlan 150` and `switchport access vlan 20`. Which statement best explains the design purpose?

A
It separates voice and data traffic on the same edge port by assigning them to different VLANs.
This is correct because that is the classic voice-VLAN access-port design.
B
It turns the port into a routed WAN interface.
Why wrong: This is wrong because the configuration is for a switched access/voice-port role.
C
It forces the phone to use CAPWAP before receiving power.
Why wrong: This is wrong because CAPWAP is unrelated here.
D
It makes VLAN 150 the native VLAN on all trunks automatically.
Why wrong: This is wrong because the command affects the edge port, not all trunks.

Full breakdown with real-world context →

Question 11mediummulti select

Open the full VLAN trunking answer →

Which four of the following are correct statements about VLAN configuration and verification on a Cisco switch? (Choose four.)

Question 12hardmultiple choice

Open the full VLAN trunking answer →

In a network running STP, SW2 became the root bridge for VLAN 10. Both SW1 and SW2 have the same bridge priority. Why did SW2 become the root?

Exhibit

SW1# show spanning-tree vlan 10
VLAN0010
  Root ID    Priority    32778
             Address     0011.2233.4456
  Bridge ID  Priority    32778
             Address     0011.2233.4456

SW2# show spanning-tree vlan 10
VLAN0010
  Root ID    Priority    32778
             Address     0011.2233.4455
  Bridge ID  Priority    32778
             Address     0011.2233.4455

A
Because SW2 has the lower bridge ID due to the lower MAC address.
This is correct because the priorities are equal, so the lower MAC address wins the root election.
B
Because SW2 has the higher VLAN number configured.
Why wrong: This is wrong because VLAN number does not decide the root bridge election.
C
Because SW2 has more trunk ports than SW1.
Why wrong: This is wrong because port count does not determine root bridge election.
D
Because SW2 has the highest bridge priority.
Why wrong: This is wrong because lower, not higher, bridge ID wins.

Full breakdown with real-world context →

Question 13mediummultiple choice

Open the full VLAN trunking answer →

A switch displays the following output:

Interface        Status         VLAN

Gi1/0/5 connected 20 Gi1/0/6 notconnect 1 Gi1/0/24 trunk trunk

Which interface is operating as an access port in VLAN 20?

A
Gi1/0/5
Correct. It is connected and assigned to VLAN 20.
B
Gi1/0/6
Why wrong: Gi1/0/6 is an access port in VLAN 1, but it is not in VLAN 20.
C
Gi1/0/24
Why wrong: Gi1/0/24 is a trunk, not an access port.
D
None of the interfaces
Why wrong: Gi1/0/5 clearly matches.

Full breakdown with real-world context →

Question 14mediummultiple choice

Open the full VLAN trunking answer →

A switch stack is running PVST+. Users on VLAN 40 lose connectivity for roughly 30 seconds every time the uplink on SW2 flaps. Based on the exhibit, which change would most directly improve convergence for this VLAN?

Exhibit

show spanning-tree summary
Switch is in pvst mode
Root bridge for: VLAN0001 VLAN0010 VLAN0020
Extended system ID is enabled
Portfast Default is disabled

show spanning-tree vlan 40
Spanning tree enabled protocol ieee
Root ID    Priority    327...

A
Configure spanning-tree mode rapid-pvst.
Rapid PVST+ is the direct fix for slow STP convergence in this case.
B
Increase the bridge priority on SW2 for VLAN 40.
Why wrong: That changes root election, not the underlying convergence speed shown here.
C
Disable PortFast on all access ports.
Why wrong: PortFast is for edge ports and is not the cause of the 30-second reconvergence.
D
Convert the uplink to a routed port.
Why wrong: That changes the design, but the exhibit specifically points to STP mode.

Full breakdown with real-world context →

Question 15hardmultiple choice

Open the full VLAN trunking answer →

Users in VLAN 60 on switch SW2 cannot reach the default gateway located on switch SW1. The trunk between SW1 and SW2 is operational and allows VLAN 60. What is the most likely reason for this issue?

Exhibit

SW1# show vlan brief
60  Users-60     active

SW2# show vlan brief
10  Users-10     active
20  Users-20     active

SW2# show interfaces trunk
Port        Mode         Encapsulation  Status        Native vlan
Gi0/1       on           802.1q         trunking      1

Port        Vlans allowed on trunk
Gi0/1       10,20,60

A
VLAN 60 does not exist locally on SW2.
This is correct because trunk allowance alone is not enough if the VLAN is missing from the local switch.
B
The native VLAN must be changed to 60 on both switches.
Why wrong: This is wrong because the issue is local VLAN existence, not native VLAN choice.
C
VLAN 60 is not allowed on the trunk link.
Why wrong: This is wrong because PPP is unrelated to 802.1Q VLAN forwarding.
D
The default gateway must be configured as a loopback on SW2.
Why wrong: This is wrong because the problem is VLAN handling, not loopback gateway design.

Full breakdown with real-world context →

These 200-301 practice questions are part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style 200-301 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

VLAN and Inter-VLAN Routing Scenarios

How to approach vlan and inter-vlan routing scenarios

Quick answer

Related 200-301 topic practice pages

Network Infrastructure and Connectivity practice questions

Switching and Network Access practice questions

IP Routing practice questions

Network Services and Security practice questions

AI and Network Operations practice questions

CCNA subnetting practice questions

CCNA OSPF practice questions

CCNA VLAN practice questions

CCNA STP practice questions

CCNA EtherChannel practice questions

CCNA ACL practice questions

CCNA NAT practice questions

Practice scenarios

A switchport connected to another switch should carry multiple VLANs, but it was manually configured as an access port. What is the most likely operational result?

A switchport is configured for 802.1X authentication. What is the usual role of the RADIUS server in that design?

Which three of the following statements about VLAN Trunking Protocol (VTP) are correct? (Choose three.)

A network administrator notices that a switchport in access mode with PortFast enabled has transitioned to an err-disabled state. What is the most likely cause?

Exhibit

Exhibit

Drag and drop the following steps into the correct order to configure a Cisco IOS-XE router as a DHCP server for a client VLAN and then enable a DHCP relay agent on a different interface to forward client requests to a remote server.

Drag and drop the steps into the recommended configuration order for setting up VLANs, assigning access ports, configuring 802.1Q trunking with a non-default native VLAN, and verifying the setup on a Cisco IOS-XE switch.

Exhibit

A switch port is configured with `switchport voice vlan 150` and `switchport access vlan 20`. Which statement best explains the design purpose?

Which four of the following are correct statements about VLAN configuration and verification on a Cisco switch? (Choose four.)

In a network running STP, SW2 became the root bridge for VLAN 10. Both SW1 and SW2 have the same bridge priority. Why did SW2 become the root?

Exhibit

A switch stack is running PVST+. Users on VLAN 40 lose connectivity for roughly 30 seconds every time the uplink on SW2 flaps. Based on the exhibit, which change would most directly improve convergence for this VLAN?

Exhibit

Users in VLAN 60 on switch SW2 cannot reach the default gateway located on switch SW1. The trunk between SW1 and SW2 is operational and allows VLAN 60. What is the most likely reason for this issue?

Exhibit