350-401 · topic practice
Practise 350-401 VLAN and trunking questions covering access ports, trunk ports, allowed VLAN lists, native VLAN, inter-VLAN routing, and command-output troubleshooting.
Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.
What the exam tests
Why learners struggle
VLAN questions are commonly missed because learners assume a VLAN configured on one switch exists everywhere, or that a trunk being active means all VLANs are allowed. The real problem is usually in the details: VLAN membership, allowed VLAN lists, native VLAN, or inter-VLAN routing setup.
Watch out for
Practice set
20 questions · select your answer, then reveal the explanation
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Trap 1: Step 1: Configure trunk ports → Step 2: Configure VTP mode → Step…
This is incorrect because trunk ports should be configured after VTP mode and domain are set; otherwise, VTP advertisements may not be propagated correctly without a proper domain.
Trap 2: Step 1: Configure VTP domain name → Step 2: Configure VTP mode →…
This is incorrect because while domain name can be set before mode, the recommended order is to set mode first; domain is necessary but mode defines the switch's behavior. Still, this order might work but deviates from best practice.
Trap 3: Step 1: Configure VTP mode → Step 2: Configure trunk ports → Step…
This is incorrect because the VTP domain name must be set before or simultaneously with trunking; without a domain, VTP advertisements are not accepted on trunk ports.
Step 1: Configure VTP mode (server/client/transparent) → Step 2: Configure VTP domain name → Step 3: Configure trunk ports → Step 4: Verify VTP status
This is the correct order because VTP mode must be set first to define the switch's role, followed by the domain name to group switches, then trunk ports to propagate advertisements, and finally verification to confirm operation.
Step 1: Configure trunk ports → Step 2: Configure VTP mode → Step 3: Configure VTP domain name → Step 4: Verify VTP status
Why wrong: This is incorrect because trunk ports should be configured after VTP mode and domain are set; otherwise, VTP advertisements may not be propagated correctly without a proper domain.
Step 1: Configure VTP domain name → Step 2: Configure VTP mode → Step 3: Configure trunk ports → Step 4: Verify VTP status
Why wrong: This is incorrect because while domain name can be set before mode, the recommended order is to set mode first; domain is necessary but mode defines the switch's behavior. Still, this order might work but deviates from best practice.
Step 1: Configure VTP mode → Step 2: Configure trunk ports → Step 3: Configure VTP domain name → Step 4: Verify VTP status
Why wrong: This is incorrect because the VTP domain name must be set before or simultaneously with trunking; without a domain, VTP advertisements are not accepted on trunk ports.
A network engineer runs the following command on Switch SW1:
SW1# show interfaces trunk
Port Mode Encapsulation Status Native vlan Gi0/1 on 802.1q trunking 1 Gi0/2 on 802.1q trunking 1
Port Vlans allowed on trunk Gi0/1 1-1005 Gi0/2 1-1005
Port Vlans allowed and active in management domain Gi0/1 1,10,20 Gi0/2 1,10,20
Port Vlans in spanning tree forwarding state and not pruned Gi0/1 1,10,20 Gi0/2 1,10,20
Based on this output, what can be concluded?
Trap 1: The trunk is using ISL encapsulation.
The encapsulation is shown as 802.1q.
Trap 2: VLAN 1 is pruned from the trunk.
VLAN 1 is in the forwarding state, so it is not pruned.
Trap 3: Only VLANs 10 and 20 are forwarding traffic.
VLAN 1 is also forwarding.
VLANs 2-9 are allowed but not active on the trunk.
The 'allowed' list includes 1-1005, but only VLANs 1,10,20 are active; thus VLANs 2-9 are allowed but not active (not created in VLAN database).
The trunk is using ISL encapsulation.
Why wrong: The encapsulation is shown as 802.1q.
VLAN 1 is pruned from the trunk.
Why wrong: VLAN 1 is in the forwarding state, so it is not pruned.
Only VLANs 10 and 20 are forwarding traffic.
Why wrong: VLAN 1 is also forwarding.
Trap 1: Spanning Tree Protocol (STP) must always be enabled on virtual…
Incorrect because virtual switches do not use STP; loops are avoided by design (no redundant paths within a single vSwitch).
Trap 2: A virtual switch can only be configured with a single port group…
Incorrect because a virtual switch supports multiple port groups, each with different VLAN or policy settings.
A standard virtual switch (vSwitch) operates at Layer 2 and can forward frames between virtual machines on the same host.
Correct because a vSwitch is a Layer 2 switch that connects VMs within a host.
A distributed virtual switch (DVS) provides consistent network configuration across multiple ESXi hosts in a cluster.
Correct because a DVS centralizes network settings and spans multiple hosts.
Virtual switches support VLAN tagging using IEEE 802.1Q trunking between the hypervisor and physical switches.
Correct because virtual switches can be configured with VLAN IDs to segregate traffic.
Spanning Tree Protocol (STP) must always be enabled on virtual switches to prevent loops in the virtual network.
Why wrong: Incorrect because virtual switches do not use STP; loops are avoided by design (no redundant paths within a single vSwitch).
A virtual switch can only be configured with a single port group for all virtual machines.
Why wrong: Incorrect because a virtual switch supports multiple port groups, each with different VLAN or policy settings.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag a concept onto its matching description — or click a concept then click the description.
Normal VLANs
Extended VLANs
Reserved VLANs
Reserved for legacy token ring and FDDI
Trap 1: 1–1005: Normal VLANs
Correct. 1-1005 is the standard normal VLAN range, though 1002-1005 are reserved for legacy.
Trap 2: 1006–4094: Extended VLANs
Correct. 1006-4094 are extended VLANs.
Trap 3: 0, 4095: Reserved VLANs
Correct. 0 and 4095 are reserved VLANs.
1–1005: Normal VLANs
Why wrong: Correct. 1-1005 is the standard normal VLAN range, though 1002-1005 are reserved for legacy.
1006–4094: Extended VLANs
Why wrong: Correct. 1006-4094 are extended VLANs.
0, 4095: Reserved VLANs
Why wrong: Correct. 0 and 4095 are reserved VLANs.
1002–1005: Reserved for legacy token ring and FDDI
Why wrong: Correct. 1002-1005 are reserved for legacy Token Ring and FDDI.
2–1001: Normal VLANs (default range)
Why wrong: Incorrect. Normal VLANs start at 1, not 2, and include 1-1001 as usable; the full range is 1-1005.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag a concept onto its matching description — or click a concept then click the description.
Actively sends DTP frames to form trunk
Passively waits for DTP frames to form trunk
Forces the port to become a trunk regardless of neighbor
Forces the port to be an access port, no trunking
Disables DTP, trunking only if manually configured
Trap 1: The 'switchport access vlan 10' command automatically creates VLAN…
Incorrect because the command assigns the port to VLAN 10, but VLAN 10 must already be created; otherwise the port remains inactive.
Trap 2: The 'no switchport' command on a switch port places it into the…
Incorrect because 'no switchport' makes the interface a Layer 3 routed port, removing it from VLAN operation.
Trap 3: Extended VLANs (1006-4094) are stored in the vlan.dat file by…
Incorrect because extended VLANs are stored in the running configuration, not in vlan.dat, unless VTP version 3 is used.
VLAN 1 and VLANs 1002-1005 cannot be deleted.
Correct because these are default VLANs that are automatically created and cannot be removed.
The 'show vlan brief' command only displays VLANs that have been created on the switch.
Correct because it shows only configured VLANs, not all possible VLAN numbers.
The 'switchport access vlan 10' command automatically creates VLAN 10 if it does not exist.
Why wrong: Incorrect because the command assigns the port to VLAN 10, but VLAN 10 must already be created; otherwise the port remains inactive.
The 'no switchport' command on a switch port places it into the default VLAN.
Why wrong: Incorrect because 'no switchport' makes the interface a Layer 3 routed port, removing it from VLAN operation.
Extended VLANs (1006-4094) are stored in the vlan.dat file by default.
Why wrong: Incorrect because extended VLANs are stored in the running configuration, not in vlan.dat, unless VTP version 3 is used.
Trap 1: DTP frames are sent continuously on a trunk port to maintain the…
DTP frames are sent only during negotiation; once a trunk is established, DTP frames are no longer sent.
Trap 2: The 'switchport nonegotiate' command enables DTP on an interface.
The 'switchport nonegotiate' command disables DTP, preventing the interface from sending DTP frames.
Trap 3: DTP supports both 802.1Q and ISL trunking encapsulation.
DTP can negotiate both 802.1Q and ISL, but ISL is obsolete and not supported on modern switches; the statement is technically true but misleading in modern contexts, and the question focuses on current implementations where ISL is deprecated.
DTP is a Cisco proprietary protocol.
DTP is indeed Cisco proprietary and is not standardized in IEEE 802.1Q.
The default switchport mode on a Cisco Catalyst switch is dynamic desirable.
By default, Cisco Catalyst switches use dynamic desirable mode, which actively sends DTP frames to negotiate trunking.
DTP frames are sent continuously on a trunk port to maintain the trunk.
Why wrong: DTP frames are sent only during negotiation; once a trunk is established, DTP frames are no longer sent.
The 'switchport nonegotiate' command enables DTP on an interface.
Why wrong: The 'switchport nonegotiate' command disables DTP, preventing the interface from sending DTP frames.
DTP supports both 802.1Q and ISL trunking encapsulation.
Why wrong: DTP can negotiate both 802.1Q and ISL, but ISL is obsolete and not supported on modern switches; the statement is technically true but misleading in modern contexts, and the question focuses on current implementations where ISL is deprecated.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Enter MST configuration mode
Enter MST configuration mode, which is the second step after enabling MST globally.
Assign region name
Assign the region name within MST configuration mode, the third step.
Set revision number
Set the revision number, typically the fourth step after naming the region.
Map VLANs to MST instance
Map VLANs to MST instances, the final configuration step before exiting MST configuration mode.
Set spanning-tree mode mst globally
Set spanning-tree mode mst globally – this must be done first to enable MSTP on the switch.
Trap 1: Configure the port as a dynamic desirable port.
Dynamic desirable is a DTP mode, not a trunk.
Trap 2: Configure the port as a routed port.
Routed ports are Layer 3 interfaces.
Trap 3: Configure the port as an access port.
Access ports carry only one VLAN.
Configure the port as a dynamic desirable port.
Why wrong: Dynamic desirable is a DTP mode, not a trunk.
Configure the port as a trunk port.
Trunk ports carry multiple VLANs.
Configure the port as a routed port.
Why wrong: Routed ports are Layer 3 interfaces.
Configure the port as an access port.
Why wrong: Access ports carry only one VLAN.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Trap 1: The 'channel-group 1 mode on' command enables LACP negotiation on…
Incorrect because 'mode on' forces the channel without any negotiation protocol (neither LACP nor PAgP).
Trap 2: If a member link is configured as a trunk but the port-channel…
Incorrect because all member ports must have the same Layer 2 mode (all trunk or all access) to form a channel.
All member ports in an EtherChannel must have the same speed and duplex settings.
Correct because mismatched speed or duplex will prevent the channel from being established.
The 'channel-group 1 mode on' command enables LACP negotiation on the interface.
Why wrong: Incorrect because 'mode on' forces the channel without any negotiation protocol (neither LACP nor PAgP).
The command 'show etherchannel summary' displays the port-channel interface status and which member ports are bundled.
Correct because this command provides a concise view of the EtherChannel, including the 'SU' (Layer 2 up) and 'P' (bundled) flags.
If a member link is configured as a trunk but the port-channel interface is an access port, the channel will still form.
Why wrong: Incorrect because all member ports must have the same Layer 2 mode (all trunk or all access) to form a channel.
When using LACP, the 'lacp rate fast' command reduces the interval for sending LACPDUs from 30 seconds to 1 second.
Correct because fast rate sets the LACPDU interval to 1 second, speeding up convergence.
Trap 1: The native VLAN must always be VLAN 1.
Incorrect because the native VLAN is configurable and can be any VLAN, though it defaults to VLAN 1.
Trap 2: The 802.1Q tag uses a TPID value of 0x88A8.
Incorrect because 0x88A8 is the TPID for Q-in-Q (802.1ad); 802.1Q uses 0x8100.
Trap 3: 802.1Q supports a maximum of 4096 VLANs.
Incorrect because the 12-bit VID allows 4096 values, but VLANs 0 and 4095 are reserved, leaving 4094 usable VLANs.
The 802.1Q tag includes a 12-bit VLAN ID field.
Correct because the 802.1Q header contains a 12-bit VLAN ID (VID) allowing up to 4094 VLANs.
The native VLAN is not tagged on an 802.1Q trunk.
Correct because 802.1Q leaves frames on the native VLAN untagged for interoperability.
The native VLAN must always be VLAN 1.
Why wrong: Incorrect because the native VLAN is configurable and can be any VLAN, though it defaults to VLAN 1.
The 802.1Q tag uses a TPID value of 0x88A8.
Why wrong: Incorrect because 0x88A8 is the TPID for Q-in-Q (802.1ad); 802.1Q uses 0x8100.
802.1Q supports a maximum of 4096 VLANs.
Why wrong: Incorrect because the 12-bit VID allows 4096 values, but VLANs 0 and 4095 are reserved, leaving 4094 usable VLANs.
A network engineer runs the following command on Switch SW1:
SW1# show dtp interface gi0/1
DTP information on GigabitEthernet0/1: DTP: Enabled DTP mode: Desirable DTP negotiate: TRUE DTP status: Trunk DTP trunk status: Trunking DTP timer: 30 DTP max-age: 2 DTP encapsulation: 802.1q DTP refresh rate: Both DTP requests: 10 DTP errors: 0
Based on this output, what can be concluded?
Trap 1: The interface is in access mode.
DTP status is Trunk, not access.
Trap 2: The interface is using ISL encapsulation.
Encapsulation is 802.1q.
Trap 3: DTP is disabled on this interface.
DTP is Enabled.
The interface is in access mode.
Why wrong: DTP status is Trunk, not access.
The interface will not form a trunk unless the neighbor is set to trunk or desirable.
DTP mode desirable actively sends DTP frames to form a trunk; it can form a trunk with a neighbor set to trunk, desirable, or auto.
The interface is using ISL encapsulation.
Why wrong: Encapsulation is 802.1q.
DTP is disabled on this interface.
Why wrong: DTP is Enabled.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Free account
Create a free account to save your results and see which topics improve across sessions.
Focused Vlans And Trunking sessions
Every question in these sessions is drawn from the Vlans And Trunking domain — nothing else.
Related practice questions
Move into related areas when this topic feels solid.
Sharpen your 350-401 knowledge of Architecture.
Work through 350-401 questions on Virtualization.
Practise 350-401 questions linked to Infrastructure.
Sharpen your 350-401 knowledge of Network Assurance.
Security practice questions for 350-401.
Work through 350-401 questions on Automation.
Practise eBGP/iBGP peering, path attributes, route selection and BGP troubleshooting.
Practise OSPF area types, LSA types, neighbour states and multi-area design.
Practise EIGRP DUAL, metrics, stub routing and route redistribution.
Practise VLAN configuration, trunk negotiation and inter-VLAN routing.
Practise RSTP, MSTP, port roles and STP protection features.
Practise extended ACLs, CoPP rate-limiting and control-plane protection.
A free account saves results across sessions and highlights which topics need work.
Sign up free