How many VLAN and Inter-VLAN Routing Scenarios questions are on this page?

This page has 14 VLAN and Inter-VLAN Routing Scenarios scenario questions for the 200-901 exam, each with detailed explanations and wrong-answer analysis.

How should I approach 200-901 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Cisco DevNet Associate 200-901 questions

Scenario-based practice

VLAN and Inter-VLAN Routing Scenarios

Practise 200-901 VLAN and trunking questions covering access ports, trunk ports, allowed VLAN lists, native VLAN, inter-VLAN routing, and command-output troubleshooting.

Start full practice test Read exam guide

scenario questions

200-901

exam code

Cisco

vendor

Scenario guide

How to approach vlan and inter-vlan routing scenarios

VLAN misconfiguration is one of the top sources of connectivity failures in real networks and one of the most tested areas on the CCNA. These questions cover VLAN access ports, 802.1Q trunks, native VLANs, and router-on-a-stick or layer-3 switch inter-VLAN routing.

Quick answer

Routing questions usually test route selection (administrative distance, metric), how static routes are configured and when they are preferred over dynamic routing.

Administrative distance comparing routing sources.

Static route configuration: next-hop vs exit interface.

Default route propagation and the gateway of last resort.

Recursive routing table lookups.

Practice scenarios

Question 1mediummultiple choice

Open the full VLAN trunking answer →

A company uses a /24 subnet for its office LAN. The network must accommodate 30 hosts per VLAN. Which subnet mask would be most efficient for each VLAN while minimizing wasted IP addresses?

A
255.255.255.224
This is /27, provides 30 usable hosts, exactly meeting the requirement.
B
255.255.255.240
Why it fails: This is /28, provides 14 usable hosts, insufficient.
C
255.255.255.0
Why it fails: This is /24, provides 254 hosts, not efficient for 30 hosts.
D
255.255.255.128
Why it fails: This is /25, provides 126 usable hosts, too large.
E
255.255.255.192
Why it fails: This is /26, provides 62 usable hosts, wastes addresses.

Full breakdown with real-world context →

Question 2mediummultiple choice

Open the full VLAN trunking answer →

A network automation engineer needs to retrieve the Layer 2 topology for a specific VLAN from Cisco DNA Center. Which API endpoint should be used?

A
GET /dna/intent/api/v1/issues
Why it fails: The issues endpoint returns assurance problems and their details, not topology links, so no VLAN adjacency can be derived. It is tempting because issues reference affected devices and VLANs, making it the right call when you want to list open faults, their severity, or the categories of network health problems.
B
GET /dna/intent/api/v1/site
Why it fails: The site endpoint returns site hierarchy and building/floor metadata, not Layer 2 links, so it cannot map VLAN adjacencies. It is tempting because sites group devices geographically and are the correct choice when you need to enumerate locations, assign devices to a site, or query site health rather than topology.
C
GET /dna/intent/api/v1/network-device
Why it fails: The network-device endpoint returns device inventory records, not topology links, so it cannot supply per-VLAN Layer 2 adjacency. It is tempting because it lists every managed device and their interfaces, which is the right call when you need hostnames, management IPs, software versions or reachability status rather than connection data.
D
GET /dna/intent/api/v1/topology/l2/{vlanID}
The DNA Center topology API exposes layer 2 topology per VLAN through the intent path with the vlanID path parameter, returning nodes and links for that broadcast domain. This satisfies the stem's requirement to retrieve Layer 2 topology scoped to a specific VLAN.

Full breakdown with real-world context →

Question 3easymultiple choice

Open the full VLAN trunking answer →

A network engineer needs to automate the configuration of VLANs on a set of Cisco switches using Ansible. Which API should be targeted to ensure idempotent configuration updates?

A
NETCONF/YANG
NETCONF/YANG exposes structured, model-driven configuration with transactional semantics, letting Ansible's network modules push declarative VLAN state and detect drift, so repeated runs converge to the same result without duplicating VLANs — the idempotency the engineer requires.
B
REST API of Cisco DNA Center
Why it fails: Cisco DNA Center's REST API manages fabric, assurance and intent-based policies across the controller, not per-device VLAN provisioning on arbitrary switches, so it cannot deliver the idempotent updates required here. It is tempting because it is Cisco's modern automation platform, and would be correct for campus fabric-wide intent deployment.
C
SNMP
Why it fails: SNMP exposes read-mostly MIB objects and traps; it cannot express a declarative desired VLAN configuration, so Ansible cannot converge switch state idempotently through it. It is tempting because SNMP is already enabled for monitoring, and would be correct for polling interface counters, CPU or device health statistics.
D
CLI with SSH
Why it fails: SSH CLI sends raw configuration lines, so Ansible cannot read current device state and re-running the play reapplies commands rather than converging on a declared end state. It is tempting because CLI over SSH works on any Cisco device without extra licensing, and suits one-off or legacy changes where no model-driven interface exists.

Full breakdown with real-world context →

Question 4hardmultiple choice

Open the full VLAN trunking answer →

A network engineer is tasked with segmenting a large broadcast domain into smaller ones using VLANs. In the OSI model, at which layer does a VLAN operate?

A
Layer 2 - Data Link
VLAN tags are carried in the Ethernet frame header, so segmentation of a broadcast domain occurs at Layer 2, the Data Link layer. Layer 3 handles logical IP addressing and routing between VLANs, not the broadcast domain boundary itself.
B
Layer 4 - Transport
Why it fails: VLANs operate at Layer 2, tagging Ethernet frames to partition broadcast domains; the Transport layer handles end-to-end connections and port-based multiplexing, not broadcast containment. Layer 4 would be the correct answer if the question concerned TCP or UDP segmentation rather than VLAN broadcast domain separation.
C
Layer 1 - Physical
Why it fails: VLANs are defined by 802.1Q frame tagging at Layer 2, so they cannot operate at the Physical layer, which deals with cabling, voltages and bit transmission. Layer 1 would be the correct answer if the question asked where repeaters or physical media specifications sit in the OSI model.
D
Layer 3 - Network
Why it fails: VLANs tag Ethernet frames, so they operate at Layer 2, not Layer 3. Layer 3 is where routing between those VLANs occurs, which is why the answer is tempting: routers and Layer 3 switches do interconnect segmented broadcast domains. The question asks where VLAN segmentation itself happens, which is the data-link layer.

Full breakdown with real-world context →

Question 5mediummultiple choice

Open the full VLAN trunking answer →

A network administrator configures a switch port to belong to VLAN 10. Which OSI layer is primarily involved in VLAN tagging?

A
Layer 1 (Physical)
Why it fails: Tagging modifies the Ethernet frame header, a Layer 2 construct, whereas Layer 1 carries only raw bits and signalling without frame fields. It tempts because VLANs map to physical switch ports, but the port's membership is logical, and the tag is added at the data-link layer.
B
Layer 3 (Network)
Why it fails: VLAN tags sit in the Ethernet frame header, which is Layer 2, so Layer 3 never encapsulates them; routing between VLANs is where Layer 3 applies. It tempts because IP addressing is commonly associated with VLAN subnets, but tagging itself is switched, not routed.
C
Layer 2 (Data Link)
VLAN tagging inserts 802.1Q tags into Ethernet frames, which are Layer 2 constructs. The switch examines these tags to segregate broadcast domains, so VLAN membership is determined at the Data Link layer rather than Layer 3.
D
Layer 4 (Transport)
Why it fails: VLAN tags are inserted into the Layer 2 Ethernet frame, not into TCP or UDP headers, so Layer 4 plays no part in tagging. It tempts because transport-layer ports are often filtered per VLAN, yet that is policy applied to traffic, not the tagging mechanism itself.

Full breakdown with real-world context →

Question 6mediumdrag order

Open the full VLAN trunking answer →

Drag and drop the steps to configure a new VLAN on a Cisco switch into the correct order.

Drag or tap steps into the slots.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

A
1. Enter global configuration mode, 2. Create the VLAN using the 'vlan' command, 3. Assign switch ports to the VLAN using 'switchport access vlan', 4. Exit and verify with 'show vlan brief'.
This is the correct order because the VLAN must exist before ports can be assigned. The standard workflow is to enter global config, create the VLAN, assign ports, and then verify.
B
1. Enter global configuration mode, 2. Assign switch ports to the VLAN using 'switchport access vlan', 3. Create the VLAN using the 'vlan' command, 4. Exit and verify.
Why it fails: This is incorrect because you cannot assign ports to a VLAN that has not yet been created. The VLAN must be created first.
C
1. Enter global configuration mode, 2. Create the VLAN using the 'vlan' command, 3. Exit and verify, 4. Assign switch ports to the VLAN.
Why it fails: This is incorrect because you must assign ports to the VLAN before exiting configuration mode; otherwise, the port assignment step is missed and the VLAN will have no ports.
D
1. Create the VLAN using the 'vlan' command, 2. Enter global configuration mode, 3. Assign switch ports to the VLAN, 4. Exit and verify.
Why it fails: This is incorrect because the 'vlan' command can only be issued in global configuration mode. You must enter global configuration mode before creating the VLAN.

Full breakdown with real-world context →

Question 7easymulti select

Open the full VLAN trunking answer →

Which TWO are benefits of using VLANs in a network? (Choose two.)

A
Reducing the size of broadcast domains
VLANs segment the network into smaller broadcast domains.
B
Simplifying Layer 3 routing
Why it fails: Routing between VLANs is required.
C
Improving network security by isolating traffic
VLANs can isolate sensitive traffic.
D
Reducing the number of collision domains
Why it fails: Switches create collision domains per port, not VLANs.
E
Guaranteeing faster routing performance
Why it fails: VLANs do not guarantee performance.

Full breakdown with real-world context →

Question 8hardmultiple choice

Open the full VLAN trunking answer →

During a network migration, an engineer needs to replace a legacy core switch with a new one without disrupting the existing STP topology. The new switch supports RSTP and will be connected via two trunk links. Which configuration should be applied to the new switch to prevent it from becoming the root bridge?

A
Enable root guard on the trunk ports
Why it fails: Root guard protects against inferior BPDUs, does not prevent this switch from becoming root.
B
Configure the bridge priority to 61440
High priority makes it less likely to become root.
C
Enable BPDU guard on the trunk ports
Why it fails: BPDU guard disables ports if BPDU received, not related to root election.
D
Set the bridge priority to 0
Why it fails: Priority 0 makes it the root.

Full breakdown with real-world context →

Question 9easymultiple choice

Open the full VLAN trunking answer →

An engineer needs to automate the deployment of a new VLAN across multiple switches. Which tool is best suited for this task?

A
NetFlow
Why it fails: NetFlow exports metadata about IP flows traversing an interface for traffic analysis and accounting; it cannot modify device configuration. It is tempting because it is a widely deployed network protocol, but automating VLAN creation across switches requires a configuration management tool such as Ansible.
B
Syslog
Why it fails: Syslog transports and stores event and log messages from network devices; it has no mechanism to push configuration changes to switches. It is tempting because it is a standard network management protocol, but configuration automation across devices requires Ansible or a comparable tool that applies declarative changes.
C
Ansible
Ansible's agentless architecture pushes declarative configuration over SSH, letting a single playbook apply identical VLAN definitions across many switches simultaneously. This directly satisfies the stem's requirement to automate deployment across multiple devices, unlike manual CLI entry or per-device scripting, and needs no software installed on the switches themselves.
D
SNMP
Why it fails: SNMP supports monitoring and, via MIB writes, some device management, but it is not designed for orchestrating multi-device configuration deployments. It is tempting because it is a standard management protocol, yet automating a VLAN rollout across many switches requires Ansible-style declarative playbooks.

Full breakdown with real-world context →

Question 10easymultiple choice

Open the full VLAN trunking answer →

A network engineer is troubleshooting a connectivity issue between two hosts in different VLANs on the same switch. The hosts are in VLAN 10 and VLAN 20, respectively. The switch has an SVI for each VLAN and IP routing is enabled. Which command should be used to verify that the switch is forwarding traffic between the VLANs?

A
show interfaces trunk
Why it fails: show interfaces trunk reports trunk encapsulation, allowed and active VLANs and pruning, which concerns Layer 2 links carrying multiple VLANs, not inter-VLAN forwarding. It is tempting because trunk misconfiguration commonly breaks VLAN connectivity, but it would be correct when verifying that a trunk carries VLAN 10 and VLAN 20 between switches.
B
show vlan
Why it fails: show vlan lists VLAN membership and port assignments, confirming VLAN existence and access-port placement rather than inter-VLAN routing. It is tempting because it quickly verifies VLAN 10 and VLAN 20 are configured, but it would be correct when checking that access ports are assigned to the intended VLANs.
C
show ip route
Inter-VLAN routing depends on the switch's routing table holding connected routes for both VLAN 10 and VLAN 20 via their SVIs. 'show ip route' confirms those routes exist and are installed, verifying the switch can forward traffic between the two subnets.
D
show mac address-table
Why it fails: show mac address-table lists MAC-to-port-to-VLAN mappings, confirming Layer 2 learning only; it cannot show whether the switch routes between VLAN 10 and VLAN 20. It is tempting because it verifies host reachability at Layer 2, but it would be correct when locating which port a specific MAC address was learned on.

Full breakdown with real-world context →

Question 11hardmultiple choice

Open the full VLAN trunking answer →

A DevOps team is automating network configuration using Ansible. They want to push a new VLAN configuration to a switch but ensure that only one switch is updated at a time to avoid network disruption. Which Ansible strategy or feature should they use?

A
Use 'strategy: free' to manage execution order.
Why it fails: The free strategy lets each host proceed independently as tasks finish, so switches update in unpredictable order. It is tempting because it speeds execution; that would be correct for maximising throughput on independent hosts, not for enforcing sequential single-switch updates.
B
Set 'forks: 1' in the playbook.
Why it fails: Forks controls parallel process count, not task batching per host, so all switches still receive the VLAN change concurrently. It is tempting because it limits concurrency generally; that would be correct for reducing overall parallelism, not for serialising updates across hosts.
C
Use 'throttle: 1' on each task.
Why it fails: Throttle limits concurrent task executions across all hosts, but does not guarantee one switch completes before the next begins. It is tempting because it caps parallelism; that would be correct for rate-limiting task concurrency, not for strictly serialising host-by-host rollout.
D
Set 'serial: 1' in the playbook.
The serial keyword controls how many hosts Ansible executes per play iteration. Setting serial: 1 runs the play against one switch at a time, completing each before starting the next, which prevents simultaneous VLAN changes from disrupting the network.

Full breakdown with real-world context →

Question 12easymultiple choice

Open the full VLAN trunking answer →

A DevOps team manages a hybrid cloud environment with on-premises Cisco Nexus switches and AWS VPCs using Terraform. They have a configuration management tool that pushes VLAN and interface configurations to the Nexus switches. Recently, they noticed that after a Terraform run that updates the AWS VPC subnets, some on-premises switches lose connectivity to the cloud. The team suspects a mismatch between the VLAN configurations on the Nexus switches and the AWS VPC subnets. They have a centralized source of truth stored in a Git repository containing YAML files for network definitions. Which action should the team take first to resolve the issue and prevent future occurrences?

A
Restore the Nexus switch configurations from the most recent backup.
Why it fails: Restoring a backup reverts the switches to a pre-change state without reconciling them against the Git YAML definitions, so the VLAN mismatch recurs on the next run. It is tempting as fast recovery, and would be correct after an accidental device misconfiguration rather than a source-of-truth drift.
B
Modify the Terraform scripts to automatically update Nexus switches when AWS VPC subnets change.
Why it fails: Embedding Nexus updates inside Terraform couples the tool to devices it does not manage, bypassing the Git YAML source of truth and the existing configuration management tool. It is tempting because automated remediation feels proactive, and would be right if Terraform already owned the switch configuration lifecycle.
C
Compare the Git repository's YAML definitions with the actual switch configurations and AWS VPC subnets, then correct any discrepancies.
Reconciling the Git YAML source of truth against live Nexus and AWS VPC state exposes the VLAN/subnet mismatch causing connectivity loss. This satisfies the requirement to identify the drift first before applying any corrective automation.
D
Manually reconfigure the VLANs on the Nexus switches to match the AWS VPC subnets.
Why it fails: Manual reconfiguration fixes the immediate VLAN mismatch but leaves the Git YAML source of truth and the configuration management tool out of sync, so drift returns. It is tempting as a quick fix, and would be correct for a one-off device change outside any automated pipeline.

Full breakdown with real-world context →

Question 13mediummultiple choice

Open the full VLAN trunking answer →

An engineer needs to automate the deployment of VLAN configurations on a fleet of Cisco Catalyst 9000 switches running IOS-XE. The team uses Ansible Tower for automation. Which Ansible module should be used to push VLAN configuration idempotently?

A
ios_vlan
The ios_vlan module manages VLANs on Cisco IOS and IOS-XE devices through the network_cli connection, pushing configuration idempotently by comparing desired VLAN definitions against the device's running state. It satisfies the Catalyst 9000 IOS-XE constraint directly, unlike generic modules or those targeting other network operating systems.
B
ios_command
Why it fails: ios_command only executes show commands and returns their output; it cannot change device configuration, so it cannot deploy VLANs at all. It is tempting for gathering current VLAN state before a change, but pushing configuration idempotently requires a module that manages VLAN resources declaratively.
C
ios_config
Why it fails: ios_config pushes raw CLI lines; it does not provide VLAN-specific idempotency or validation.
D
ios_interface
Why it fails: ios_interface manages Layer 2/3 attributes on physical or logical interfaces, not VLAN database entries, so it cannot create or reconcile VLAN definitions idempotently. It is tempting because interface configuration often carries VLAN membership, which is the correct use case when assigning switchports to existing VLANs rather than defining them.

Full breakdown with real-world context →

Question 14mediummultiple choice

Open the full VLAN trunking answer →

A network administrator is tasked with automating the deployment of a new VLAN configuration across a fabric of Cisco ACI switches. Which automation tool is best suited for interacting with the APIC REST API?

A
Bash scripting with curl
Why it fails: Bash with curl issues raw HTTP calls, leaving authentication token handling, JSON payload construction and error retries to hand-written shell code, which does not scale across a fabric. It is tempting because curl is the correct choice for quick one-off API tests or troubleshooting, not repeatable multi-switch automation.
B
Chef
Why it fails: Chef converges nodes by pulling cookbooks from a Chef server; it has no native APIC REST API client, so VLAN deployment would need custom Ruby HTTP code. It is tempting because Chef is the correct choice for configuration management of servers and network devices via agents, not for direct API-driven fabric provisioning.
C
Puppet
Why it fails: Puppet manages desired state through its own agent and manifest model, requiring a custom resource or module to translate manifests into APIC REST calls. It is tempting because Puppet is the correct choice for enforcing ongoing configuration state on managed nodes, not for direct imperative API interaction with the APIC.
D
Ansible
Ansible provides a native Cisco ACI module that interacts directly with the APIC REST API, letting the administrator declaratively push VLAN configuration across the fabric. It satisfies the automation requirement without bespoke scripting, unlike manual CLI or generic tools lacking ACI-aware modules.

Full breakdown with real-world context →

These 200-901 practice questions are part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style 200-901 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

VLAN and Inter-VLAN Routing Scenarios

How to approach vlan and inter-vlan routing scenarios

Quick answer

Related 200-901 topic practice pages

Infrastructure and Automation practice questions

Application Deployment and Security practice questions

Understanding and Using APIs practice questions

Software Development and Design practice questions

Cisco Platforms and Development practice questions

Network Fundamentals practice questions

200-901 fundamentals practice questions

200-901 scenario practice questions

200-901 troubleshooting practice questions

Practice scenarios

A company uses a /24 subnet for its office LAN. The network must accommodate 30 hosts per VLAN. Which subnet mask would be most efficient for each VLAN while minimizing wasted IP addresses?

A network automation engineer needs to retrieve the Layer 2 topology for a specific VLAN from Cisco DNA Center. Which API endpoint should be used?

A network engineer needs to automate the configuration of VLANs on a set of Cisco switches using Ansible. Which API should be targeted to ensure idempotent configuration updates?

A network engineer is tasked with segmenting a large broadcast domain into smaller ones using VLANs. In the OSI model, at which layer does a VLAN operate?

A network administrator configures a switch port to belong to VLAN 10. Which OSI layer is primarily involved in VLAN tagging?

Drag and drop the steps to configure a new VLAN on a Cisco switch into the correct order.

Which TWO are benefits of using VLANs in a network? (Choose two.)

An engineer needs to automate the deployment of a new VLAN across multiple switches. Which tool is best suited for this task?

A DevOps team is automating network configuration using Ansible. They want to push a new VLAN configuration to a switch but ensure that only one switch is updated at a time to avoid network disruption. Which Ansible strategy or feature should they use?

An engineer needs to automate the deployment of VLAN configurations on a fleet of Cisco Catalyst 9000 switches running IOS-XE. The team uses Ansible Tower for automation. Which Ansible module should be used to push VLAN configuration idempotently?

A network administrator is tasked with automating the deployment of a new VLAN configuration across a fabric of Cisco ACI switches. Which automation tool is best suited for interacting with the APIC REST API?