How many VLAN and Inter-VLAN Routing Scenarios questions are on this page?

This page has 15 VLAN and Inter-VLAN Routing Scenarios scenario questions for the 200-901 exam, each with detailed explanations and wrong-answer analysis.

How should I approach 200-901 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Cisco DevNet Associate 200-901 questions

Scenario-based practice

VLAN and Inter-VLAN Routing Scenarios

Practise 200-901 VLAN and trunking questions covering access ports, trunk ports, allowed VLAN lists, native VLAN, inter-VLAN routing, and command-output troubleshooting.

Start full practice test Read exam guide

scenario questions

200-901

exam code

Cisco

vendor

Scenario guide

How to approach vlan and inter-vlan routing scenarios

VLAN misconfiguration is one of the top sources of connectivity failures in real networks and one of the most tested areas on the CCNA. These questions cover VLAN access ports, 802.1Q trunks, native VLANs, and router-on-a-stick or layer-3 switch inter-VLAN routing.

Quick answer

Routing questions usually test route selection (administrative distance, metric), how static routes are configured and when they are preferred over dynamic routing.

Administrative distance comparing routing sources.

Static route configuration: next-hop vs exit interface.

Default route propagation and the gateway of last resort.

Recursive routing table lookups.

Practice scenarios

Question 1hardmultiple choice

Open the full BGP breakdown →

A company has a three-tier data center architecture with access, aggregation, and core layers. The network team is migrating to a leaf-spine architecture to support increasing east-west traffic. The current network uses STP for loop prevention, and the team wants to eliminate STP in the new design. They plan to use VXLAN overlays with BGP EVPN for control plane. During a pilot deployment, the team notices that some legacy servers that rely on traditional VLANs are not reachable across the new fabric. The servers are connected to access switches that are part of the leaf layer. The access switches are configured as VXLAN tunnel endpoints (VTEPs) but the legacy servers are still using traditional VLANs. The team needs to ensure connectivity between the legacy VLAN-based servers and the new VXLAN-based network. What is the best approach to integrate these legacy servers without changing their configuration?

A
Create a separate VRF for legacy VLANs and redistribute into BGP EVPN
Why wrong: This adds complexity and does not solve L2 connectivity.
B
Implement a Layer 2 gateway (L2GW) on the leaf switches to bridge VLANs to VXLAN using IRB
IRB provides seamless bridging between VLAN and VXLAN.
C
Configure the same VLAN on all leaf switches and use VXLAN to stretch the VLAN across the fabric
Why wrong: Stretching VLANs is not recommended for large fabrics.
D
Reconfigure the legacy servers to use VXLAN encapsulation
Why wrong: Server configuration change is to be avoided.

Full breakdown with real-world context →

Question 2mediummultiple choice

Open the full VLAN trunking answer →

An engineer configures a trunk port as shown. A device connected to this port sends an untagged frame. Which VLAN will the switch associate the frame with?

Exhibit

Refer to the exhibit.
```
interface GigabitEthernet0/1
 switchport mode trunk
 switchport trunk native vlan 99
 switchport trunk allowed vlan 10,20,30
```

A
VLAN 1
Why wrong: Native VLAN is configured as 99.
B
The frame is dropped
Why wrong: Untagged frames are accepted on trunk.
C
VLAN 10
Why wrong: Only tagged frames use allowed VLANs.
D
VLAN 99
Untagged frames are placed in native VLAN.

Full breakdown with real-world context →

Question 3easymultiple choice

Open the full VLAN trunking answer →

An engineer notices that a switch port configured as an access port in VLAN 10 is not forwarding traffic. The switch shows the port is up/up. What is the most likely cause?

A
Spanning Tree Protocol blocking the port
Why wrong: STP blocking would show in show spanning-tree.
B
The connected device is sending 802.1Q tagged frames
Access ports drop tagged frames.
C
Speed/duplex mismatch
Why wrong: Would cause errors or down state.
D
VLAN 10 does not exist in the VLAN database
Why wrong: VLAN 10 would be created automatically if not present.

Full breakdown with real-world context →

Question 4easymultiple choice

Open the full VLAN trunking answer →

A network engineer needs to automate the configuration of VLANs across 50 switches. Which approach best follows Cisco’s recommended practices for programmability?

A
Write an Ansible playbook using the ios_vlan module to configure VLANs on all switches.
Ansible with idempotent modules is a best practice for network automation.
B
Use a REST API on each switch to push the VLAN configuration individually.
Why wrong: REST API is good but without idempotency and version control it is less recommended.
C
Use a Python script that manually SSHes into each switch and applies CLI commands.
Why wrong: Manual SSH scripting is error-prone and not scalable.
D
Configure all VLANs via SNMP MIBs.
Why wrong: SNMP is primarily for monitoring, not reliable for configuration.

Full breakdown with real-world context →

Question 5mediummultiple choice

Open the full VLAN trunking answer →

Refer to the exhibit. A Python script using RESTCONF sends a GET request to retrieve the interface configuration. The response is shown. What is the VLAN assigned to GigabitEthernet1/0/1?

Exhibit

Refer to the exhibit.

{
  "Cisco-IOS-XE-native:interface": {
    "GigabitEthernet": [
      {
        "name": "1/0/1",
        "description": "Server port",
        "ip": {
          "address": {
            "primary": {
              "address": "192.168.1.1",
              "mask": "255.255.255.0"
            }
          }
        },
        "switchport": {
          "access": {
            "vlan": 10
          },
          "mode": "access"
        }
      }
    ]
  }
}

A
10
The JSON clearly shows 'vlan': 10.
B
1
Why wrong: The exhibit shows vlan 10.
C
100
Why wrong: Not in the exhibit.
D
20
Why wrong: Not in the exhibit.

Full breakdown with real-world context →

Question 6hardmultiple choice

Open the full VLAN trunking answer →

A large enterprise operates a multi-vendor network with Cisco routers and switches, as well as Juniper devices. The network team uses Ansible for automation, with a centralized control node running RHEL. They have been using the 'ios_config' module for Cisco devices and 'junos_config' for Juniper devices. Recently, they added a new Cisco Catalyst 9300 switch to the network. They wrote a playbook to configure VLAN 100 on the switch, but the task fails with the error: 'module_stderr: Could not find platform module for Cisco IOS XE'. The playbook uses the 'cisco.ios.ios_config' module. The control node has the 'cisco.ios' collection installed (version 2.0.0). The target switch runs IOS XE 16.12.3. The control node can SSH to the switch successfully. Which action will most likely resolve the issue?

A
Upgrade the 'cisco.ios' Ansible collection to the latest version.
Older collection versions may lack support for newer IOS XE versions.
B
Configure the switch to allow SSH connections from the control node IP.
Why wrong: SSH connectivity is already successful.
C
Use the 'raw' module instead of 'ios_config' to send CLI commands directly.
Why wrong: Raw module is not idempotent and not recommended for configuration management.
D
Install Python 3.8 on the control node and update the ansible.cfg to use it.
Why wrong: The issue is with the collection, not Python version.

Full breakdown with real-world context →

Question 7hardmultiple choice

Open the full VLAN trunking answer →

During a network migration, an engineer needs to replace a legacy core switch with a new one without disrupting the existing STP topology. The new switch supports RSTP and will be connected via two trunk links. Which configuration should be applied to the new switch to prevent it from becoming the root bridge?

A
Enable root guard on the trunk ports
Why wrong: Root guard protects against inferior BPDUs, does not prevent this switch from becoming root.
B
Configure the bridge priority to 61440
High priority makes it less likely to become root.
C
Enable BPDU guard on the trunk ports
Why wrong: BPDU guard disables ports if BPDU received, not related to root election.
D
Set the bridge priority to 0
Why wrong: Priority 0 makes it the root.

Full breakdown with real-world context →

Question 8easymultiple choice

Open the full VLAN trunking answer →

An engineer needs to automate the deployment of a new VLAN across multiple switches. Which tool is best suited for this task?

A
NetFlow
Why wrong: NetFlow is for traffic analysis, not automation.
B
Syslog
Why wrong: Syslog is for logging, not automation.
C
Ansible
Ansible is designed for configuration management and automation.
D
SNMP
Why wrong: SNMP is for monitoring, not configuration automation.

Full breakdown with real-world context →

Question 9mediummultiple choice

Open the full VLAN trunking answer →

A network engineer is automating the deployment of VLANs across multiple switches using Ansible. The playbook fails with an error indicating that the VLAN ID already exists on one of the switches. Which approach should the engineer use to ensure the playbook completes without errors?

A
Modify the playbook to skip switches where the VLAN already exists.
Why wrong: This is not scalable and requires manual mapping.
B
Remove the VLAN from all switches before creating it again.
Why wrong: This would cause unnecessary traffic disruption.
C
Use an idempotent Ansible module that checks for existing VLANs before creating them.
Idempotent modules handle existing configurations gracefully.
D
Add ignore_errors: yes to the VLAN creation task.
Why wrong: This would suppress other important errors.

Full breakdown with real-world context →

Question 10easymultiple choice

Open the full VLAN trunking answer →

A developer is automating VLAN configuration on a Cisco switch using REST API. Which HTTP method should be used to create a new VLAN?

A
PUT
Why wrong: PUT replaces an existing resource.
B
POST
POST creates a new resource.
C
GET
Why wrong: GET retrieves data, does not create resources.
D
PATCH
Why wrong: PATCH applies partial modifications.
E
DELETE
Why wrong: DELETE removes a resource.

Full breakdown with real-world context →

Question 11hardmultiple choice

Open the full VLAN trunking answer →

Refer to the exhibit. A switch is configured with the shown trunk port. After connecting the uplink, the switch logs show repeated 'errdisable' state transitions on this port. The core switch is configured with the same allowed VLAN list. Which configuration change is most likely to resolve the issue?

Exhibit

Refer to the exhibit.

"""
interface GigabitEthernet0/1
 description Uplink to Core
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30
 spanning-tree portfast trunk
"""

A
Change the switchport mode to dynamic desirable.
Why wrong: The core is likely configured as trunk, so dynamic desirable may cause negotiation issues, not errdisable.
B
Add VLAN 1 to the allowed VLAN list.
Why wrong: VLAN 1 is native by default and does not need to be explicitly allowed; adding it would not fix errdisable.
C
Remove the spanning-tree portfast trunk command from the interface.
Portfast trunk is designed for host-facing trunks (e.g., to servers) and can cause STP issues when connecting to another switch.
D
Add the spanning-tree bpduguard enable command to the interface.
Why wrong: BPDU guard would disable the port if it receives BPDUs, which is normal on a trunk to another switch, worsening the issue.

Full breakdown with real-world context →

Question 12easymultiple choice

Open the full VLAN trunking answer →

An engineer wants to verify that a switch port is configured as an access port in VLAN 10. Which command provides this information?

A
show running-config interface
This displays the running configuration of the interface, including switchport settings.
B
show interfaces status
Why wrong: This shows operational status, not configuration details like VLAN assignment.
C
show ip interface brief
Why wrong: This shows IP address and status, not Layer 2 configuration.
D
show vlan brief
Why wrong: This shows VLANs and their ports, but not the specific configuration details of an interface.

Full breakdown with real-world context →

Question 13mediumdrag order

Open the full VLAN trunking answer →

Drag and drop the steps to configure a new VLAN on a Cisco switch into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 14mediummulti select

Open the full VLAN trunking answer →

A network engineer is troubleshooting an issue where hosts in VLAN 100 cannot reach a server at 10.1.1.100. The switch interfaces are configured as access ports in VLAN 100, and the default gateway is 10.1.1.1. The engineer checks the switch and finds that the ARP table does not contain the server's MAC address. Which two actions should the engineer take to resolve the issue? (Choose two.)

A
Ping the server's IP address from the switch management interface.
Why wrong: The switch management interface may be in a different VLAN, so this does not test the specific VLAN 100 path.
B
Ping the default gateway from a host in VLAN 100.
Why wrong: This checks Layer 3 connectivity but does not directly address the missing ARP entry for the server.
C
Check the ARP table on the default gateway router.
The hosts need to resolve the server's MAC, not the gateway's. The issue is on the switch or host side.
D
Check the MAC address table on the switch for the server's MAC.
Why wrong: The MAC address table shows Layer 2 paths, but the issue is ARP resolution which is Layer 3.
E
Verify that the switch port connected to the server is in VLAN 100.
If the server is on an access port in a different VLAN, the hosts in VLAN 100 cannot reach it.

Full breakdown with real-world context →

Question 15hardmultiple choice

Open the full VLAN trunking answer →

Refer to the exhibit. A Meraki network has a group policy 'Block Social Media' that references a content filtering rule. The policy is applied to VLAN 1. Users in that VLAN cannot access instagram.com but can access facebook.com. What is the most likely reason?

Exhibit

{
  "network": {"id": "N_12345", "name": "Office"},
  "vlan": {"id": "1", "subnet": "192.168.1.0/24"},
  "groupPolicy": {"name": "Block Social Media", "contentFiltering": {"blockedUrlPatterns": {"id": "456"}}}
}

A
The content filtering rule blocks only a specific set of URLs, but not all social media sites.
Why wrong: This statement is true, but the more precise cause is that the blocked list does not include facebook.com.
B
The group policy is not applied to the VLAN.
Why wrong: The exhibit shows the policy is applied to VLAN 1.
C
The blocked URL patterns list does not include all social media sites.
The blocked list likely contains patterns for instagram but not facebook, so users can access facebook.
D
The content filtering is not enabled on the MX appliance.
Why wrong: The group policy includes content filtering, so it is enabled.

Full breakdown with real-world context →

These 200-901 practice questions are part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style 200-901 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

VLAN and Inter-VLAN Routing Scenarios

How to approach vlan and inter-vlan routing scenarios

Quick answer

Related 200-901 topic practice pages

Software Development and Design practice questions

Understanding and Using APIs practice questions

Cisco Platforms and Development practice questions

Application Deployment and Security practice questions

Infrastructure and Automation practice questions

Network Fundamentals practice questions

200-901 fundamentals practice questions

200-901 scenario practice questions

200-901 troubleshooting practice questions

Practice scenarios

An engineer configures a trunk port as shown. A device connected to this port sends an untagged frame. Which VLAN will the switch associate the frame with?

Exhibit

An engineer notices that a switch port configured as an access port in VLAN 10 is not forwarding traffic. The switch shows the port is up/up. What is the most likely cause?

A network engineer needs to automate the configuration of VLANs across 50 switches. Which approach best follows Cisco’s recommended practices for programmability?

Refer to the exhibit. A Python script using RESTCONF sends a GET request to retrieve the interface configuration. The response is shown. What is the VLAN assigned to GigabitEthernet1/0/1?

Exhibit

An engineer needs to automate the deployment of a new VLAN across multiple switches. Which tool is best suited for this task?

A network engineer is automating the deployment of VLANs across multiple switches using Ansible. The playbook fails with an error indicating that the VLAN ID already exists on one of the switches. Which approach should the engineer use to ensure the playbook completes without errors?

A developer is automating VLAN configuration on a Cisco switch using REST API. Which HTTP method should be used to create a new VLAN?

Exhibit

An engineer wants to verify that a switch port is configured as an access port in VLAN 10. Which command provides this information?

Drag and drop the steps to configure a new VLAN on a Cisco switch into the correct order.

Refer to the exhibit. A Meraki network has a group policy 'Block Social Media' that references a content filtering rule. The policy is applied to VLAN 1. Users in that VLAN cannot access instagram.com but can access facebook.com. What is the most likely reason?

Exhibit