How many SW1 and SW2 VLAN Trunking Practice Questions questions are on this page?

This page has 12 SW1 and SW2 VLAN Trunking Practice Questions scenario questions for the 350-701 exam, each with detailed explanations and wrong-answer analysis.

How should I approach 350-701 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Cisco SCOR / CCNP Security Core 350-701 questions

Scenario-based practice

SW1 and SW2 VLAN Trunking Practice Questions

Practise 350-701 VLAN and trunking questions covering access ports, trunk ports, allowed VLAN lists, native VLAN, inter-VLAN routing, and command-output troubleshooting.

Start full practice test Read exam guide

scenario questions

350-701

exam code

Cisco

vendor

Scenario guide

How to approach sw1 and sw2 vlan trunking practice questions

Practise switch scenarios involving SW1, SW2, VLANs, trunk links, allowed VLAN lists and show interfaces trunk output.

Quick answer

VLAN and trunking questions usually test whether the VLAN exists, whether the trunk is active and whether the VLAN is allowed across the link.

Access ports, trunk ports and native VLAN behaviour.

Allowed VLAN lists and trunk verification.

How to read show vlan brief and show interfaces trunk output.

Why hosts in the same VLAN may fail across switches.

Practice scenarios

Question 1hardmultiple choice

Open the full VLAN trunking answer →

A financial company is deploying Cisco ISE with TrustSec to enforce segmentation between application tiers (web, app, DB). They have a Cisco Catalyst 9500 as the core, and Catalyst 9300s as access switches. The SXP is configured between ISE and core switch, and the core switch propagates SGTs to access switches via SGT inline tagging on trunk ports. The engineer has configured SGTs for web (SGT=2), app (SGT=3), DB (SGT=4). However, when testing from a web server (IP 10.1.1.10, SGT=2) to an app server (IP 10.1.2.20, SGT=3), the app server sees the traffic without SGT in the packet, so the access switch cannot enforce policy. The engineer checks 'show cts role-based sgt-map' on the core and sees the mapping for 10.1.1.10 -> 2. What is the most likely issue?

A
The ISE policy does not allow the traffic from web to app
Why wrong: Policy is not evaluated if the SGT is not delivered.
B
The access switch does not have the security group ACL configured
Why wrong: SGACL is used for enforcement, but first the SGT must be present.
C
The trunk between core and access is not configured for SGT inline tagging
Without 'cts manual' or 'trust sec' on the trunk, the core switch will not insert the SGT into packets going to the access switch.
D
The SXP connection between ISE and core is not established
Why wrong: If SXP between ISE and core was down, the core would not have the mapping, but the engineer checked and it has mapping.

Full breakdown with real-world context →

Question 2mediummultiple choice

Open the full VLAN trunking answer →

In a Cisco ISE deployment, a network administrator needs to dynamically change the VLAN assignment for an endpoint after a posture assessment determines that the endpoint is non-compliant. Which ISE feature enables this dynamic change without re-authentication?

A
MAB
Why wrong: MAB is an authentication method, not a mechanism for dynamic policy changes.
B
Profiling
Why wrong: Profiling identifies device type, but does not dynamically change access policies.
C
TrustSec
Why wrong: TrustSec uses SGTs for access control, but CoA is the mechanism for dynamic VLAN changes.
D
Change of Authorization (CoA)
Correct. CoA enables real-time policy changes after posture assessment.

Full breakdown with real-world context →

Question 3mediummultiple choice

Open the full VLAN trunking answer →

A network engineer is troubleshooting an issue where users on a specific VLAN cannot access the internet through a Cisco ASA firewall. The ASA has a default route pointing to the ISP router. The security policy includes an ACL that permits all traffic from the inside interface to the outside interface. What is the most likely cause of the problem?

A
The default route is misconfigured
Why wrong: The default route exists and points to the ISP router.
B
DNS is not resolving domain names
Why wrong: DNS failure would affect name resolution but not basic IP connectivity.
C
NAT (Network Address Translation) is not configured
Without NAT, private IP addresses cannot reach the internet because they are not routable.
D
The ACL is blocking the traffic
Why wrong: The ACL permits all traffic, so it is not blocking.

Full breakdown with real-world context →

Question 4hardmultiple choice

Open the full VLAN trunking answer →

A large enterprise with over 2,000 employees recently experienced a security breach. An attacker gained initial access through a phishing email and then moved laterally across the network to reach a critical database server. The network currently has a flat Layer 2 topology with all devices in a single large VLAN. The company wants to prevent lateral movement in the future while maintaining operational simplicity. They have a Cisco ISE deployment already but it is only used for wireless guest access. The security team is evaluating options. Option A: Deploy 802.1X with dynamic VLAN assignment across all wired ports. This would authenticate users and assign them to different VLANs based on identity. Option B: Implement micro-segmentation using Cisco TrustSec with Security Group Tags (SGTs) on the existing switches and enforce SGT-based policies on the firewalls. This would allow traffic control between groups regardless of IP. Option C: Install a next-generation firewall at the internet edge and enable IPS to block known attack signatures. Option D: Upgrade all access switches to support Private VLANs (PVLANs) and configure promiscuous ports for servers. Which solution BEST addresses the lateral movement problem while leveraging existing infrastructure?

A
Install a next-generation firewall at the internet edge and enable IPS.
Why wrong: This protects inbound threats but does not prevent an attacker already inside from moving laterally.
B
Upgrade all access switches to support Private VLANs (PVLANs).
Why wrong: PVLANs can isolate ports, but they add administrative overhead and do not provide identity-based policy control like TrustSec.
C
Deploy 802.1X with dynamic VLAN assignment across all wired ports.
Why wrong: While it segments users into VLANs, intra-VLAN traffic is still allowed, enabling lateral movement within the same VLAN.
D
Implement micro-segmentation using Cisco TrustSec with SGTs and enforce policies on firewalls.
SGTs allow traffic control based on group identity, preventing lateral movement even within the same subnet, and leverages existing ISE.

Full breakdown with real-world context →

Question 5hardmultiple choice

Open the full VLAN trunking answer →

In a Cisco ISE deployment, after a device passes posture assessment, ISE needs to dynamically change the VLAN assignment for the device. Which protocol or feature enables ISE to send a new authorization policy to the network access device without requiring the endpoint to reauthenticate?

A
TrustSec SGT assignment
Why wrong: TrustSec assigns SGTs but typically requires reauthentication for changes unless CoA is used.
B
RADIUS Accounting
Why wrong: RADIUS Accounting is used for logging and does not trigger authorization changes.
C
CoA (Change of Authorization)
Correct. CoA dynamically changes authorization attributes like VLAN or ACL.
D
MAB
Why wrong: MAB is an authentication method, not a mechanism for dynamic authorization changes.

Full breakdown with real-world context →

Question 6hardmultiple choice

Open the full VLAN trunking answer →

A network administrator is configuring Cisco ISE for posture assessment. A Windows laptop connects to the network and passes 802.1X authentication. ISE then checks if the antivirus software is running and if the OS patches are up to date. If the posture check fails, ISE should dynamically restrict the endpoint to a remediation VLAN. Which mechanism allows ISE to change the VLAN assignment after authentication without requiring the user to reauthenticate?

A
Change of Authorization (CoA)
CoA enables dynamic change of authorization attributes like VLAN or ACL after authentication.
B
802.1X reauthentication
Why wrong: Reauthentication re-initiates the 802.1X process, which is slower and not as dynamic as CoA.
C
MAB reauthentication
Why wrong: MAB reauthentication is not used for dynamic VLAN changes; CoA is the correct mechanism.
D
RADIUS Disconnect
Why wrong: RADIUS Disconnect tears down the session but does not reassign VLAN; CoA is used for dynamic changes.

Full breakdown with real-world context →

Question 7hardmultiple choice

Open the full VLAN trunking answer →

A hospital is deploying Cisco ISE for network access control. They have a mix of employee laptops, medical devices (e.g., infusion pumps), and guest smartphones. The network uses Cisco Catalyst 9300 switches and Aironet 3700 series access points. For medical devices, the policy must use Machine Authentication (MAB) since they are 802.1X incapable. The ISE policy authenticates via MAB and then assigns the device to a specific VLAN for medical devices. During a pilot, the network team notices that some infusion pumps (MAC: 00:1A:2B:3C:4D:5E) are failing MAB authentication. The switch logs show 'Authentication failed for MAC 001a.2b3c.4d5e on interface GigabitEthernet1/0/10'. ISE logs show 'Authentication failed - RADIUS server rejected - Reason: Invalid Endpoint ID'. The engineer has verified the MAC address is in the ISE endpoint repository with correct identity group. What should the engineer check next to resolve this issue?

A
Verify that the switch port is configured with 'authentication port-control auto'
Why wrong: That is needed but the logs show authentication attempt, so the port is configured.
B
Check the MAC address format in the ISE endpoint identity store (such as using lowercase with a hyphen separator)
The switch sends MAC in form '001a.2b3c.4d5e' (no delimiter) or '00-1a-2b-3c-4d-5e'? ISE expects a specific format; mismatch causes 'Invalid Endpoint ID'.
C
Confirm that the ISE policy for MAB allows the device to authenticate
Why wrong: If the endpoint ID is invalid, the policy is never evaluated.
D
Ensure the RADIUS shared secret is correct on the switch and ISE
Why wrong: If shared secret was wrong, the authentication would not reach ISE or would be rejected with a different error.

Full breakdown with real-world context →

Question 8mediummultiple choice

Open the full VLAN trunking answer →

A network security engineer is deploying Cisco Firepower Threat Defense (FTD) in a data center. The requirement is to inspect traffic between two internal VLANs while allowing the firewall to enforce access control policies based on source and destination zones. Which deployment mode should the engineer use?

A
Routed mode
Why wrong: Routed mode requires IP changes and is not optimal for same-subnet traffic inspection between VLANs.
B
Inline mode
Why wrong: Inline mode is not a standard FTD deployment mode; it refers to inline tap/set on Firepower sensors.
C
Transparent mode
Transparent mode operates at layer 2, allowing inspection between VLANs without IP renumbering.
D
Hybrid mode
Why wrong: Hybrid mode is not a valid deployment mode for FTD.

Full breakdown with real-world context →

Question 9hardmultiple choice

Open the full VLAN trunking answer →

Refer to the exhibit. A network administrator is troubleshooting device tracking on a Cisco switch. The output shows two devices in VLAN 100. The switch is configured with IPv6 first-hop security features. The administrator notices that the device with MAC address aaaa.bbbb.cccc is not receiving RA guard protection. What is the most likely reason?

Exhibit

Router# show device-tracking database
 Device-tracking database for Vlan 100:
  Device ID     MAC Address      Interface      VLAN     Last seen
  *             0050.7966.6800   Gi0/1/0        100      00:00:12
  *             aaaa.bbbb.cccc   Gi0/1/1        100      00:00:05

A
The interface Gi0/1/1 is not configured as a trusted interface for RA guard.
RA guard only applies to trusted interfaces.
B
The device is not in the same VLAN as the RA guard policy.
Why wrong: Both devices are in VLAN 100.
C
The device tracking entry for aaaa.bbbb.cccc is invalid.
Why wrong: The asterisk indicates a valid binding.
D
The device tracking table has reached its limit.
Why wrong: The table shows only two entries.

Full breakdown with real-world context →

Question 10easymultiple choice

Open the full VLAN trunking answer →

A junior engineer is configuring MAB (MAC Authentication Bypass) on a Cisco switch for legacy printers. After configuration, the printers are still being placed into the default VLAN instead of the authorized VLAN. Which configuration is missing?

A
authentication port-control auto
Why wrong: This command enables authentication, but without order, MAB may not be attempted.
B
authentication order mab
This sets MAB as the first authentication method, ensuring it is used.
C
dot1x pae authenticator
Why wrong: This is for 802.1X and not required for MAB.
D
spanning-tree portfast
Why wrong: Portfast affects STP convergence, not authentication.

Full breakdown with real-world context →

Question 11mediummultiple choice

Open the full VLAN trunking answer →

An organization uses Cisco ISE to enforce posture compliance. After a user's machine is patched, ISE sends a command to the switch to reclassify the endpoint from a restricted VLAN to a full-access VLAN. Which ISE feature accomplishes this?

A
Posture Assessment
Why wrong: Posture assessment evaluates compliance but does not enforce changes; CoA does that.
B
Profiling
Why wrong: Profiling identifies device type, not dynamic policy enforcement.
C
Guest Access
Why wrong: Guest access provides temporary network access, not dynamic VLAN changes.
D
Change of Authorization (CoA)
CoA enables dynamic changes to session attributes like VLAN or ACL based on posture updates.

Full breakdown with real-world context →

Question 12mediummultiple choice

Open the full VLAN trunking answer →

A network engineer is troubleshooting an issue where users on VLAN 10 cannot access the internet, but they can reach internal resources. The firewall is configured with a default route pointing to the ISP router. The engineer notices that NAT is configured but traffic is not being translated. Which configuration is most likely missing?

A
An ACL to match the traffic to be translated
The ACL defines interesting traffic for NAT; without it, no packets are matched for translation.
B
A NAT pool with available public IP addresses
Why wrong: A NAT pool is needed for dynamic NAT, but the immediate issue is the missing ACL to match traffic.
C
Port Address Translation (PAT) configuration
Why wrong: PAT is a type of NAT, but the missing element is the ACL to identify traffic for translation.
D
A route map to apply NAT based on destination
Why wrong: Route maps are optional for policy-based NAT; standard NAT requires an ACL first.

Full breakdown with real-world context →

These 350-701 practice questions are part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style 350-701 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

SW1 and SW2 VLAN Trunking Practice Questions

How to approach sw1 and sw2 vlan trunking practice questions

Quick answer

Related 350-701 topic practice pages

Security Concepts practice questions

Network Security practice questions

Cloud Security practice questions

Content Security practice questions

Endpoint Protection and Detection practice questions

Secure Network Access, Visibility and Enforcement practice questions

350-701 fundamentals practice questions

350-701 scenario practice questions

350-701 troubleshooting practice questions

Practice scenarios

In a Cisco ISE deployment, a network administrator needs to dynamically change the VLAN assignment for an endpoint after a posture assessment determines that the endpoint is non-compliant. Which ISE feature enables this dynamic change without re-authentication?

In a Cisco ISE deployment, after a device passes posture assessment, ISE needs to dynamically change the VLAN assignment for the device. Which protocol or feature enables ISE to send a new authorization policy to the network access device without requiring the endpoint to reauthenticate?

Exhibit

A junior engineer is configuring MAB (MAC Authentication Bypass) on a Cisco switch for legacy printers. After configuration, the printers are still being placed into the default VLAN instead of the authorized VLAN. Which configuration is missing?

An organization uses Cisco ISE to enforce posture compliance. After a user's machine is patched, ISE sends a command to the switch to reclassify the endpoint from a restricted VLAN to a full-access VLAN. Which ISE feature accomplishes this?