CCNP Security Practice Question
A campus switch connects to an IP phone that has a PC daisy-chained behind it. The engineer wants the phone to reside in VLAN 100 and the PC in VLAN 200, with the phone tagging its own voice traffic. Which interface configuration accomplishes this?
⚠ Common exam trap
The trap here is believing that a trunk must be configured to support an IP phone, when an access port with a voice VLAN already handles tagged phone traffic and untagged PC traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
switchport mode access, switchport access vlan 200, switchport voice vlan 100
Cisco's voice VLAN feature allows a single access port to serve two devices in different VLANs. The PC, which sends untagged frames, is placed in the access VLAN, while the IP phone, which tags its traffic with 802.1Q, is placed in the voice VLAN. Setting the access VLAN to 200 for the PC and the voice VLAN to 100 for the phone matches the requirement exactly.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
switchport mode access, switchport access vlan 100, switchport voice vlan 200
Why it's wrong here
This reverses the VLANs: the PC's untagged traffic would be placed in VLAN 100 and the phone's tagged voice traffic in VLAN 200. That is the opposite of the stated requirement. The access VLAN always governs the untagged device (the PC) and the voice VLAN governs the tagging device (the phone), so the values must be swapped to match the design.
- ✗
switchport mode access, switchport access vlan 200, switchport trunk encapsulation dot1q
Why it's wrong here
Configuring trunk encapsulation on an access port does not create a voice VLAN. Without the switchport voice vlan command, the phone's tagged frames are not associated with a separate VLAN, and the phone would either fail to tag properly or have its traffic dropped. The encapsulation command alone cannot separate phone and PC traffic into different VLANs.
- ✗
switchport mode trunk, switchport trunk native vlan 200, switchport trunk allowed vlan 100,200
Why it's wrong here
A trunk port would let the phone tag traffic, but the PC's untagged frames would land in the native VLAN, and mixing a native VLAN with a voice VLAN on a trunk is not the intended design here. This also changes the port's operational mode away from access, which alters how the phone and PC are treated and can cause spanning-tree and VLAN assignment surprises.
- ✓
switchport mode access, switchport access vlan 200, switchport voice vlan 100
Why this is correct
An access port with a voice VLAN configured uses Cisco's multi-VLAN access behavior: untagged frames from the attached PC are placed in the access VLAN, while 802.1Q-tagged frames from the phone are placed in the voice VLAN. Setting the access VLAN to 200 and the voice VLAN to 100 satisfies the requirement that the PC sit in VLAN 200 and the phone in VLAN 100.
Visual reference
About these practice questions
One of 1,923 original 350-401 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.