CCNA VLAN Questions — Page 4 of 4

226

MCQhard

Refer to the exhibit. An engineer configured PortFast on interface GigabitEthernet0/1, which connects to a server that does not participate in spanning tree. However, the port remains in the listening state for the full forward delay period before transitioning to forwarding. The engineer issues the show spanning-tree vlan 10 detail command. Based on the output, what is the most likely cause?

A.The port is configured as a trunk, so PortFast is not active.

B.BPDU Guard is enabled on the port, causing it to block.

C.The forward delay timer is set too high, and PortFast cannot override it.

D.The server is sending BPDUs, causing the port to lose its PortFast state.

AnswerA

PortFast is only effective on access ports. The exhibit shows ‘Edge port: no (default) portfast: no (default)’ despite the engineer enabling PortFast, indicating the port is operating as a trunk (or not an access port). Therefore, PortFast has no effect and the normal STP listening/learning states apply.

Why this answer

PortFast is designed to immediately transition a port to the forwarding state, bypassing the listening and learning states. However, PortFast is only effective on access ports; if the interface is configured as a trunk port, PortFast is automatically disabled by the switch. The output of 'show spanning-tree vlan 10 detail' would confirm the port is a trunk, explaining why it still goes through the full forward delay.

Exam trap

Cisco often tests the misconception that PortFast works on any port type, but the trap here is that PortFast is only effective on access ports, and trunk ports automatically disable PortFast regardless of configuration.

Why the other options are wrong

The port is not in an err-disabled state; BPDU Guard causes the port to be shut down, not to stay in listening.

Misunderstanding that PortFast bypasses timers completely on access ports; the high forward delay is irrelevant if PortFast were active.

The assumption that the server is sending BPDUs is contradicted by the output showing zero BPDUs received.

Practice this question →

227

PBQhard

You are connected to R1, a multilayer switch acting as the STP root for VLAN 10. Configure Root Guard on port GigabitEthernet0/1 (designated port) to protect against superior BPDUs from an unauthorized switch, Loop Guard on uplink GigabitEthernet0/2 to prevent loops, and BPDU Guard on PortFast-enabled GigabitEthernet0/3. After configuration, a superior BPDU arrives on G0/1, blocking the port; verify the Root Guard state and ensure BPDU Guard triggers err-disable on G0/3.

Network Topology

Hints

•Root Guard is applied on ports that should never become root; use 'spanning-tree guard root'.
•Loop Guard prevents alternate or root ports from becoming designated when BPDUs stop; use 'spanning-tree guard loop' on uplinks.
•BPDU Guard combined with PortFast err-disables a port upon BPDU reception; enable with 'spanning-tree bpduguard enable' under the interface.

A.G0/1 is in root-inconsistent state; G0/3 is in err-disabled state.

B.G0/1 is in blocking state; G0/3 is in err-disabled state.

C.G0/1 is in root-inconsistent state; G0/3 is in blocking state.

D.G0/1 is in err-disabled state; G0/3 is in root-inconsistent state.

AnswerA

solution

! R1
interface GigabitEthernet0/1
spanning-tree guard root
interface GigabitEthernet0/2
spanning-tree guard loop
interface GigabitEthernet0/3
spanning-tree bpduguard enable

Why this answer

Root Guard is needed on the designated port (G0/1) to prevent an unauthorized switch from becoming root by sending superior BPDUs. Loop Guard on the uplink (G0/2) prevents loops if BPDUs stop arriving. BPDU Guard on PortFast ports (G0/3) immediately err-disables them upon BPDU reception.

The configuration uses 'spanning-tree guard root' on G0/1, 'spanning-tree guard loop' on G0/2, and 'spanning-tree bpduguard enable' on G0/3. Verification shows G0/1 blocked by root-inconsistent state and G0/3 in err-disabled state.

Exam trap

Do not confuse the states caused by Root Guard (root-inconsistent) and BPDU Guard (err-disable). Also, remember that Root Guard is applied to designated ports, not root or alternate ports.

Why the other options are wrong

Root Guard uses a specific 'root-inconsistent' state, not the generic 'blocking' state.

BPDU Guard triggers err-disable, not blocking. Blocking is an STP state, not an error state.

Root Guard and BPDU Guard have different effects: root-inconsistent vs. err-disable. Mixing them up is a common error.

Practice this question →

228

MCQmedium

Users on a new access switch can reach devices in their own VLAN but cannot reach the default gateway on the distribution switch. Based on the exhibit, what is the most likely cause?

A.VLAN 30 is missing from the allowed VLAN list on the trunk.

B.The user ports should be configured as trunks.

C.The SVI for VLAN 30 must be shutdown for inter-VLAN routing to work.

D.The trunk native VLAN must be changed to VLAN 30.

AnswerA

On a trunk, a VLAN must be present in the allowed VLAN list for its frames to traverse the link. If VLAN 30 was not explicitly added to the allowed list, frames from that VLAN are dropped at the trunk port, so they never reach the distribution switch. This prevents inter-VLAN routing even though local hosts within VLAN 30 on the access switch can communicate. Adding 'allowed vlan add 30' to the trunk configuration restores connectivity.

Why this answer

The trunk allows only VLANs 10 and 20, so VLAN 30 traffic never crosses the uplink. Local switching inside VLAN 30 on the access switch can still work, which is why same-VLAN communication succeeds. Adding VLAN 30 to the allowed list is the direct fix.

Exam trap

A common exam trap is assuming that user ports must be trunks to enable VLAN communication beyond the local switch. In reality, user ports should remain access ports assigned to a single VLAN. Another trap is thinking that the SVI for VLAN 30 must be shut down to fix routing issues, but an active SVI is necessary for inter-VLAN routing.

Additionally, candidates may incorrectly focus on native VLAN mismatches, which do not block VLAN 30 traffic if the VLAN is not allowed on the trunk. The real issue is the missing VLAN 30 in the trunk's allowed VLAN list, which prevents VLAN 30 frames from reaching the distribution switch and the default gateway.

Why the other options are wrong

Incorrect because user ports should be configured as access ports, not trunks. Configuring user ports as trunks is unnecessary and can cause security and connectivity issues.

Incorrect because the SVI for VLAN 30 must be active for inter-VLAN routing to function. Shutting down the SVI would prevent routing, not enable it.

Incorrect because changing the trunk native VLAN to VLAN 30 is unrelated to the problem. Native VLAN mismatches affect untagged traffic but do not block VLAN 30 tagged frames if the VLAN is allowed.

Practice this question →

229

PBQhard

You are connected to a Cisco 9800 WLC (WLC1) via its management interface. A wireless client reports association failures with SSID 'CorpNet'. The client uses WPA3-Personal, but the WLAN is configured for WPA2. Additionally, the SSID is hidden and the client is on the wrong VLAN (VLAN 20 instead of VLAN 100). Fix these issues so the client can associate successfully with WPA3, on VLAN 100, and with the SSID broadcast enabled.

Network Topology

Hints

•Check the WLAN security settings: WPA3 requires 'security wpa wpa3' and removal of 'wpa2'.
•The SSID is hidden; use 'broadcast-ssid' under the WLAN configuration.
•The policy tag assigns VLAN 20; change it to VLAN 100 to match client requirements.

A.Enable SSID broadcast, change security to WPA3-Personal, and assign VLAN 100 in the policy tag.

B.Enable SSID broadcast, change security to WPA2-PSK, and assign VLAN 20 in the policy tag.

C.Disable SSID broadcast, change security to WPA3-Personal, and assign VLAN 100 in the policy tag.

D.Enable SSID broadcast, change security to WPA3-Enterprise, and assign VLAN 100 in the policy tag.

AnswerA

solution

! WLC1
configure terminal
wlan CorpNet 1 CorpNet
broadcast-ssid
no security wpa wpa2
security wpa wpa3
security wpa psk set-ccmp 0 7 1234567890
exit
wireless tag policy default-policy
vlan 100
end
write memory

Why this answer

The WLAN was configured for WPA2-PSK with a hidden SSID, and the policy tag assigned VLAN 20 instead of VLAN 100. To fix: (1) Enable SSID broadcast with 'broadcast-ssid'. (2) Change security to WPA3-Personal by removing WPA2 and enabling WPA3 with 'security wpa wpa3' and 'security wpa psk set-ccmp'. (3) Assign VLAN 100 in the policy tag with 'vlan 100'. The client should then associate.

Exam trap

Be careful to distinguish between WPA2 and WPA3, and between Personal (PSK) and Enterprise (802.1X). Also, remember that a hidden SSID must be broadcast for clients to discover it, and VLAN assignment is done in the policy tag, not the SSID configuration.

Why the other options are wrong

The specific factual error is that the client uses WPA3-Personal, so changing to WPA2-PSK does not meet the requirement. Also, VLAN 20 is the wrong VLAN.

The specific factual error is that the SSID is currently hidden and the client cannot see it; enabling broadcast is required, not disabling.

The specific factual error is that WPA3-Personal uses a pre-shared key, while WPA3-Enterprise requires 802.1X authentication. The client is configured for Personal mode.

Practice this question →

230

MCQhard

A user reports that their computer cannot access the network. The technician checks the computer's IP configuration and finds an APIPA address (169.254.x.x). The computer is connected to a switch port on VLAN 20. The DHCP server is located on VLAN 1. The technician then examines the router's interfaces using 'show ip interface brief' and sees that all interfaces shown are up/up. What should the technician do next?

A.Check the DHCP server logs to see if it is receiving Discover messages.

B.Verify that the ip helper-address command is configured on the router's VLAN 20 interface.

C.Attempt to ping the DHCP server's IP address from the host's APIPA address.

D.Restart the DHCP service on the server and recheck the host.

AnswerB

The router is the intervlan router, and the DHCP server is on a different subnet. For a DHCP Discover broadcast to cross VLANs, the router must have an IP helper-address pointing to the DHCP server's IP address on the VLAN 20 interface. Since all ports are up/up, the problem is almost certainly the missing relay. Checking this config directly addresses the most probable cause.

Why this answer

The APIPA address (169.254.x.x) indicates the host failed to obtain a DHCP lease. Since the DHCP server is on VLAN 1 and the host is on VLAN 20, a DHCP relay (ip helper-address) must be configured on the router's VLAN 20 interface to forward DHCP broadcast messages to the server. The 'show ip interface brief' shows all interfaces are up/up, so the next logical step is to verify the relay configuration.

Exam trap

Cisco often tests the concept that a DHCP relay (ip helper-address) is required when the DHCP server is on a different subnet, and candidates mistakenly focus on server-side issues or ping tests instead of the router configuration.

Why the other options are wrong

This action assumes the DHCP request has already reached the server; it bypasses verifying the network path that would deliver the broadcast to the server, which is the most likely missing piece.

Candidates might think that if the ping fails, the problem is network connectivity, but APIPA addresses are non-routable and the test itself is invalid in this context.

Many techs jump to rebooting a service when a simple configuration check would reveal the real problem. This violates the principle of least intrusive troubleshooting.

Practice this question →

231

MCQeasy

A network technician is connecting a new access switch to an existing distribution switch. The access switch will carry multiple VLANs, and the technician wants to ensure that the link is configured as a trunk and that only VLANs 10, 20, and 30 are allowed. Which command should be used on the access switch interface to restrict the allowed VLANs?

A.switchport access vlan 10,20,30

B.switchport trunk allowed vlan add 10,20,30

C.switchport trunk native vlan 10,20,30

D.switchport trunk allowed vlan 10,20,30

AnswerD

This command explicitly sets the allowed VLAN list on a trunk port to only VLANs 10, 20, and 30. By default, all VLANs are allowed on a trunk, so this command is necessary to restrict traffic. It is the correct way to limit VLANs on a Cisco switch trunk interface. The other options either add to the existing list or are used for different purposes, making this the right choice.

Why this answer

To restrict a trunk port to specific VLANs, the 'switchport trunk allowed vlan' command with a list of VLAN IDs is used. This replaces the default allowed list (all VLANs) with the specified ones. The 'add' keyword would append rather than replace, and other commands either set native VLAN or are for access ports.

Thus, the correct command is the one that sets the allowed VLAN list directly.

Exam trap

The trap here is confusing the 'add' keyword with the base command; using 'add' would not remove the default all-VLANs allowance.

Practice this question →

232

PBQhard

You are connected to a single switch, SW1, which is a Cisco Catalyst 2960 running Cisco IOS. Configure port GigabitEthernet0/1 as an access port for a Cisco IP phone and a PC on the same VLAN (Voice VLAN 20, Data VLAN 10). The switch must provide PoE to the phone. Additionally, configure GigabitEthernet0/2 as an access port for a wireless access point (AP) that requires PoE. Verify both configurations using the appropriate show commands. The current running-config is incomplete; you must add the necessary commands.

Hints

•Voice VLAN is configured with a separate command on the interface.
•PoE may be disabled; use 'power inline auto' to enable it.
•Use 'show interfaces switchport' to confirm voice VLAN assignment.

A.interface GigabitEthernet0/1 switchport mode access switchport access vlan 10 switchport voice vlan 20 power inline auto interface GigabitEthernet0/2 switchport mode access switchport access vlan 10 power inline auto

B.interface GigabitEthernet0/1 switchport mode trunk switchport trunk allowed vlan 10,20 power inline auto interface GigabitEthernet0/2 switchport mode access switchport access vlan 10 power inline auto

C.interface GigabitEthernet0/1 switchport mode access switchport access vlan 10 switchport voice vlan 20 power inline never interface GigabitEthernet0/2 switchport mode access switchport access vlan 10 power inline auto

D.interface GigabitEthernet0/1 switchport mode access switchport access vlan 20 switchport voice vlan 10 power inline auto interface GigabitEthernet0/2 switchport mode access switchport access vlan 10 power inline auto

AnswerA

solution

! SW1
configure terminal
interface gigabitEthernet 0/1
switchport voice vlan 20
power inline auto
exit
interface gigabitEthernet 0/2
power inline auto
end
write memory

Why this answer

The configuration was missing the voice VLAN assignment on Gi0/1 and PoE settings on both ports. For Gi0/1, the command 'switchport voice vlan 20' is required to separate voice traffic from data traffic. For both Gi0/1 and Gi0/2, PoE must be enabled; by default 'power inline auto' is set, but since the ports show 'off', they may have been disabled.

The solution ensures PoE is enabled with 'power inline auto' and sets the voice VLAN correctly. Verification with 'show interfaces switchport' should show 'Voice VLAN: 20' and 'show power inline' should show 'auto' for both ports.

Exam trap

Candidates often confuse the need for a trunk port when multiple VLANs are involved, but the voice VLAN feature allows an access port to carry both data and voice traffic. Also, remember that 'power inline auto' is the default but may need to be explicitly configured if disabled. Always verify with 'show interfaces switchport' to see the voice VLAN and 'show power inline' to see PoE status.

Why the other options are wrong

The specific factual error is that trunk ports are used to carry multiple VLANs between switches, not for connecting end devices like phones and PCs. The correct method is to use an access port with a voice VLAN.

The specific factual error is that 'power inline never' explicitly disables PoE, which would prevent the phone from powering on. The correct command is 'power inline auto' to enable PoE detection and delivery.

The specific factual error is that the VLAN numbers are reversed. The access VLAN should be the data VLAN (10), and the voice VLAN should be 20. Swapping them would place data traffic in VLAN 20 and voice in VLAN 10, which is not the intended configuration.

Practice this question →

233

Drag & Dropmedium

Drag and drop the following steps into the correct order to configure a Cisco switch access port with a data VLAN and a voice VLAN.

Drag or tap steps into the slots.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Why this order

First, enter global configuration mode with 'configure terminal'. Next, select the interface using 'interface GigabitEthernet0/1'. Then, set the port to access mode with 'switchport mode access' to prevent trunk negotiation.

After that, assign the data VLAN with 'switchport access vlan 10'. Finally, assign the voice VLAN with 'switchport voice vlan 20'. This order ensures the interface is properly configured before VLAN assignment and prevents DTP from creating a trunk.

Practice this question →

234

MCQhard

A technician is troubleshooting a connectivity issue where a workstation connected to a Cisco switch port cannot ping other hosts that are in the same VLAN 10 segment. The technician runs the show mac address-table command and notices that the workstation's MAC address is listed on VLAN 1, not VLAN 10. What is the most likely cause?

A.The switch port is not configured with the switchport access vlan 10 command.

B.The switch port is configured as a trunk with native VLAN 1.

C.The MAC address table contains a stale entry that must be cleared.

D.Spanning Tree Protocol has placed the port in a blocking state.

AnswerA

When an access port's VLAN is not explicitly set, the port defaults to VLAN 1. The workstation's MAC is learned on VLAN 1, causing connectivity failure with VLAN 10 hosts. Adding the switchport access vlan 10 command resolves the issue.

Why this answer

The workstation's MAC address appears in VLAN 1 instead of VLAN 10 because the switch port is operating in the default VLAN (VLAN 1). The most likely cause is that the port has not been explicitly assigned to VLAN 10 using the `switchport access vlan 10` command. Without this command, the port remains in its default access VLAN (VLAN 1), so all frames from the workstation are associated with VLAN 1, preventing communication with hosts in VLAN 10.

Exam trap

Cisco often tests the default VLAN behavior (VLAN 1) and the fact that an access port without an explicit VLAN assignment remains in VLAN 1, leading candidates to overlook the missing `switchport access vlan` command and instead blame trunking, STP, or MAC table aging.

Why the other options are wrong

Candidates often assume any VLAN mismatch with VLAN 1 indicates a trunk misconfiguration, but a missing access VLAN is the more common and direct cause.

Candidates might think that an outdated MAC record is causing the VLAN display, but the dynamic learning process reflects the actual port VLAN.

Tempting because a blocked port can disrupt connectivity, but the MAC address table entry would still appear on the correct VLAN, not default to VLAN 1.

Practice this question →

235

MCQmedium

Exhibit: A host on VLAN 10 can ping the local SVI but not a server in VLAN 20. The Layer 3 switch has both VLAN interfaces up. What is the next item to verify first?

A.Whether the server in VLAN 20 has the correct default gateway

B.Whether the switch should disable IP routing

C.Whether VLAN 10 should be the native VLAN

D.Whether the host should use a /8 mask instead of /24

AnswerA

The most likely fault is that the server in VLAN 20 lacks a properly configured default gateway (or has a gateway that points to a different router/switch). When the VLAN 10 host pings the server, the ICMP echo request is routed by the switch's SVI to VLAN 20, but if the server cannot send the echo reply back through the correct next hop, the ping fails. This creates a one-way reachability issue that is a classic symptom of an end-host gateway misconfiguration, not a problem with the switch's routing table or trunking.

Why this answer

If the source host can reach its own default gateway, the local VLAN and access port are probably fine. The next practical check is whether the server in VLAN 20 has the correct IP address, mask, and default gateway configured.

Exam trap

A frequent exam trap is to overlook the remote device’s default gateway configuration and instead suspect the Layer 3 switch’s routing or VLAN setup. Candidates often assume that because the VLAN interfaces are up, routing must be functional. However, if the server in VLAN 20 lacks the correct default gateway pointing to its VLAN SVI, it cannot return traffic to the source host, causing failed pings.

This one-way communication failure can mislead candidates into troubleshooting switch settings unnecessarily, wasting time and missing the root cause.

Why the other options are wrong

Disabling IP routing on the Layer 3 switch would prevent inter-VLAN routing entirely. Since both VLAN interfaces are up and the host can ping its local SVI, IP routing is likely enabled, so this is not the first item to verify.

The native VLAN setting affects untagged traffic on trunk links but does not directly impact inter-VLAN routing or the ability of hosts to communicate across VLANs. It is not the primary cause of the described symptom.

Using a /8 mask instead of /24 would cause subnetting issues, but since the host can ping its own VLAN interface, the subnet mask is likely correct. This is not the first or most probable cause of the problem.

Practice this question →

236

PBQmedium

You are connected to SW1 via the console. SW1 is a Layer 2 switch with two VLANs (10 - Sales, 20 - Engineering). Port G0/1 is connected to a PC in VLAN 10, and port G0/2 is connected to a PC in VLAN 20. The switch needs to be configured to allow inter-VLAN communication using an external router connected to port G0/3. Currently, the PCs cannot communicate across VLANs. Configure the switch to support Router-on-a-Stick with VLAN 10 as the native VLAN on the trunk.

Network Topology

Hints

•Remember to set the trunk port encapsulation if needed (though modern switches default to dot1q).
•The native VLAN on the trunk must match what the router expects.
•Use switchport mode access for ports connecting to end devices.

A.Configure G0/1 as access VLAN 10, G0/2 as access VLAN 20, G0/3 as trunk with native VLAN 10, and allow VLANs 10 and 20 on the trunk.

B.Configure G0/1 as access VLAN 10, G0/2 as access VLAN 20, G0/3 as trunk with native VLAN 1, and allow VLANs 10 and 20 on the trunk.

C.Configure G0/1 as access VLAN 10, G0/2 as access VLAN 20, G0/3 as trunk with native VLAN 10, but do not allow VLAN 10 on the trunk.

D.Configure G0/1 as trunk with native VLAN 10, G0/2 as trunk with native VLAN 20, G0/3 as trunk with native VLAN 10, and allow VLANs 10 and 20 on all trunks.

AnswerA

solution

! SW1
vlan 10
name Sales
vlan 20
name Engineering
interface GigabitEthernet0/1
switchport mode access
switchport access vlan 10
interface GigabitEthernet0/2
switchport mode access
switchport access vlan 20
interface GigabitEthernet0/3
switchport mode trunk
switchport trunk native vlan 10

Why this answer

Router-on-a-Stick requires the switch port facing the router (G0/3) to be a trunk carrying both VLANs, with the native VLAN matching the router's subinterface configuration. Setting native VLAN 10 and allowing VLANs 10 and 20 on the trunk ensures both VLANs can reach the router's subinterfaces for inter-VLAN routing. The access ports G0/1 and G0/2 must remain access ports in their respective VLANs.

Exam trap

200-301 often tests the misconception that the native VLAN is optional or can be left at default — candidates pick native VLAN 1, missing that the question explicitly requires VLAN 10 as the native VLAN and that a mismatch breaks untagged traffic.

Why the other options are wrong

The native VLAN must match the VLAN that the router's subinterface handles as untagged. Setting it to VLAN 1 violates the requirement.

The trunk must carry all VLANs that need inter-VLAN communication. Excluding VLAN 10 prevents its traffic from reaching the router.

PCs are end devices that expect untagged frames; they should be connected to access ports, not trunk ports.