hardMultiple ChoiceObjective-mapped
How to Read show interfaces trunk for Allowed and Active VLANs
A network engineer runs the following command on Switch SW1:
SW1# show interfaces trunk
Port Mode Encapsulation Status Native vlan Gi0/1 on 802.1q trunking 1 Gi0/2 on 802.1q trunking 1
Port Vlans allowed on trunk Gi0/1 1-1005 Gi0/2 1-1005
Port Vlans allowed and active in management domain Gi0/1 1,10,20 Gi0/2 1,10,20
Port Vlans in spanning tree forwarding state and not pruned Gi0/1 1,10,20 Gi0/2 1,10,20
Based on this output, what can be concluded?
Quick Answer
The answer is that VLANs 2-9 are allowed but not active on the trunk. This conclusion is drawn directly from comparing the “Vlans allowed on trunk” section, which lists VLANs 1-1005, against the “Vlans allowed and active in management domain” section, which shows only VLANs 1, 10, and 20. The technical concept here is that a trunk can be configured to permit a wide range of VLANs, but traffic will only forward for those VLANs that are both allowed and active—meaning the VLAN must exist in the switch’s VLAN database and have at least one active port in that VLAN. On the ENCOR 350-401 exam, this output interpretation tests your ability to distinguish between allowed, active, and forwarding states, a common trap being that candidates assume all allowed VLANs are forwarding. A reliable memory tip is “Allowed is the door, active is the key”—the trunk permits the VLANs, but only active ones can actually pass traffic.
⚠ Common exam trap
Cisco often tests the difference between 'allowed on trunk' and 'active in management domain' to trick candidates into thinking all allowed VLANs are forwarding, when in fact only active VLANs forward traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
VLANs 2-9 are allowed but not active on the trunk.
The output shows that VLANs 1-1005 are allowed on the trunk, but only VLANs 1, 10, and 20 are listed as active in the management domain. This means VLANs 2-9 are configured on the trunk but are not active (i.e., not created or not present on the switch), so they do not forward traffic. Option A correctly identifies this condition.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
VLANs 2-9 are allowed but not active on the trunk.
Why this is correct
The 'allowed' list includes 1-1005, but only VLANs 1,10,20 are active; thus VLANs 2-9 are allowed but not active (not created in VLAN database).
- ✗
The trunk is using ISL encapsulation.
Why it's wrong here
The encapsulation is shown as 802.1q.
- ✗
VLAN 1 is pruned from the trunk.
Why it's wrong here
VLAN 1 is in the forwarding state, so it is not pruned.
- ✗
Only VLANs 10 and 20 are forwarding traffic.
Why it's wrong here
VLAN 1 is also forwarding.
Visual reference
About these practice questions
One of 1,175 original 350-401 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on 350-401
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A network engineer runs the following command on Switch SW1: SW1# show interfaces gi0/1 trunk Port Mode Encapsulation Status Native vlan Gi0/1 desirable n-802.1q trunking 1 Port Vlans allowed on trunk Gi0/1 1-1005 Port Vlans allowed and active in management domain Gi0/1 1,10,20 Port Vlans in spanning tree forwarding state and not pruned Gi0/1 1,10,20 Based on this output, what can be concluded?
medium- A.The interface is configured as an access port.
- B.The trunk is using ISL encapsulation.
- ✓ C.VLANs 2-9 are allowed but not active.
- D.The native VLAN is 10.
Why C: The output shows that VLANs 1-1005 are allowed on the trunk, but only VLANs 1, 10, and 20 are active in the management domain. This means VLANs 2-9 and 11-19, 21-1005 are allowed but not active (i.e., not created or not present on the switch). Option C correctly identifies that VLANs 2-9 are among those allowed but not active.
Variation 2. A network engineer runs the following command on Switch SW1: SW1# show interfaces gi0/1 trunk Port Mode Encapsulation Status Native vlan Gi0/1 on 802.1q trunking 1 Port Vlans allowed on trunk Gi0/1 10,20 Port Vlans allowed and active in management domain Gi0/1 10,20 Port Vlans in spanning tree forwarding state and not pruned Gi0/1 10,20 Based on this output, what can be concluded?
hard- A.VLAN 1 is allowed on this trunk.
- B.The trunk is using DTP dynamic desirable mode.
- ✓ C.Only VLANs 10 and 20 are allowed on this trunk.
- D.The native VLAN is 10.
Why C: The output shows that the 'Vlans allowed on trunk' list contains only VLANs 10 and 20. This means the trunk has been explicitly configured to permit only those VLANs, and all other VLANs (including VLAN 1) are pruned or blocked from traversing the trunk. Therefore, only VLANs 10 and 20 are allowed, making option C correct.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.