How many VLAN and Inter-VLAN Routing Scenarios questions are on this page?

This page has 14 VLAN and Inter-VLAN Routing Scenarios scenario questions for the 300-410 exam, each with detailed explanations and wrong-answer analysis.

How should I approach 300-410 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Cisco CCNP ENARSI 300-410 questions

Scenario-based practice

VLAN and Inter-VLAN Routing Scenarios

Practise 300-410 VLAN and trunking questions covering access ports, trunk ports, allowed VLAN lists, native VLAN, inter-VLAN routing, and command-output troubleshooting.

Start full practice test Read exam guide

scenario questions

300-410

exam code

Cisco

vendor

Scenario guide

How to approach vlan and inter-vlan routing scenarios

VLAN misconfiguration is one of the top sources of connectivity failures in real networks and one of the most tested areas on the CCNA. These questions cover VLAN access ports, 802.1Q trunks, native VLANs, and router-on-a-stick or layer-3 switch inter-VLAN routing.

Quick answer

Routing questions usually test route selection (administrative distance, metric), how static routes are configured and when they are preferred over dynamic routing.

Administrative distance comparing routing sources.

Static route configuration: next-hop vs exit interface.

Default route propagation and the gateway of last resort.

Recursive routing table lookups.

Practice scenarios

Question 1hardmultiple choice

Open the full VLAN trunking answer →

An engineer applies an IPv6 ACL to filter traffic between two VLANs on a switch using a router-on-a-stick configuration. The ACL is applied inbound on the subinterface. Traffic from VLAN 10 to VLAN 20 is permitted, but return traffic from VLAN 20 to VLAN 10 is dropped. Which is the most likely explanation?

A
The ACL is applied only on the VLAN 10 subinterface, so return traffic from VLAN 20 is not filtered but the ACL on VLAN 10 drops it because the source address matches a deny entry.
Why wrong: Incorrect. Return traffic enters via the VLAN 20 subinterface, not VLAN 10, so the ACL on VLAN 10 does not see it.
B
The ACL on the VLAN 20 subinterface is missing a permit entry for the return traffic, or the ACL is applied outbound on VLAN 10, which does not affect incoming return traffic.
Correct. The return traffic must be permitted by the ACL on the VLAN 20 subinterface (inbound) or on the VLAN 10 subinterface (outbound). If missing, traffic is dropped.
C
The router has 'ipv6 unicast-routing' disabled, preventing inter-VLAN routing.
Why wrong: Incorrect. Inter-VLAN routing would fail completely, not just return traffic.
D
The ACL uses 'deny ipv6 any any' which blocks all traffic, but the permit statement for VLAN 10 to VLAN 20 is placed after the deny, causing it to be ignored.
Why wrong: Incorrect. ACLs are processed sequentially; if a permit is before the deny, it works. The issue is asymmetric application.

Full breakdown with real-world context →

Question 2hardmulti select

Open the full VLAN trunking answer →

Which TWO actions will prevent a Cisco IOS router from acting as a DHCPv4 server for a specific VLAN? (Choose TWO.)

A
Configure 'no ip dhcp server' under the interface associated with the VLAN.
Correct. This command disables the DHCP server functionality on that specific interface, preventing it from responding to DHCP requests on that VLAN.
B
Configure 'ip dhcp excluded-address' for the entire subnet of the VLAN.
Why wrong: Incorrect. The 'ip dhcp excluded-address' command only prevents the server from assigning those specific addresses; it does not stop the server from offering DHCP services on the VLAN.
C
Disable DHCP snooping on the VLAN using 'no ip dhcp snooping vlan <vlan-id>'.
Correct. If DHCP snooping is enabled globally, disabling it on a specific VLAN prevents the router from acting as a DHCP server (since snooping is required for server operation in many deployments, but more accurately, disabling snooping on the VLAN stops the router from processing DHCP packets as a server on that VLAN).
D
Configure 'ip dhcp relay information trusted' on the interface.
Why wrong: Incorrect. This command is used to trust DHCP relay agent information (option 82) and does not affect the router's ability to act as a DHCP server.
E
Use the global command 'no service dhcp'.
Why wrong: Incorrect. This command disables the DHCP server and relay agent globally on the router, affecting all VLANs, not just a specific one.

Full breakdown with real-world context →

Question 3hardmultiple choice

Open the full VLAN trunking answer →

A network engineer configures a DHCP snooping trusted port on a switch to allow a legitimate DHCP server. However, clients connected to untrusted ports on the same VLAN cannot obtain IP addresses. The DHCP server is reachable and the switch shows no DHCP snooping drops. Which is the most likely explanation?

A
The DHCP server is not configured to trust the relay agent information option (option 82), causing it to discard the requests.
Correct: By default, DHCP snooping inserts option 82. Many servers reject packets with option 82 unless configured to trust it.
B
The trusted port is in the wrong VLAN; DHCP snooping only works when the trusted port is in the same VLAN as the clients.
Why wrong: Incorrect: The trusted port can be in any VLAN; DHCP snooping operates per VLAN.
C
The switch has 'ip dhcp snooping verify mac-address' enabled, causing MAC address mismatches.
Why wrong: Incorrect: This feature checks the source MAC in the DHCP packet against the Ethernet header, but the issue is about option 82.
D
The DHCP server is not configured with the correct subnet for the client VLAN.
Why wrong: Incorrect: This would cause server-side issues, but the symptom is that no clients get addresses, and the server is reachable.

Full breakdown with real-world context →

Question 4hardmultiple choice

Open the full VLAN trunking answer →

A router configured as a DHCPv6 relay agent is not forwarding DHCPv6 requests from clients to the server. The relay interface has 'ipv6 dhcp relay destination' configured. Clients are on a different VLAN. Which is the most likely explanation?

A
The relay destination is configured on the client-facing interface; it should be on the server-facing interface.
Correct: The 'ipv6 dhcp relay destination' command must be applied to the interface that receives client requests (client-facing), not the server-facing interface.
B
The DHCPv6 server is not reachable via the relay agent's routing table.
Why wrong: Incorrect: While this could be an issue, the more common misconfiguration is the interface placement.
C
The relay agent must have 'ipv6 dhcp server' configured to act as a server.
Why wrong: Incorrect: Relay and server functions are separate; a relay does not need server configuration.
D
The clients are using DHCPv4, not DHCPv6.
Why wrong: Incorrect: The configuration is for DHCPv6, but the question states DHCPv6.

Full breakdown with real-world context →

Question 5hardmultiple choice

Open the full VLAN trunking answer →

An engineer configures DHCP snooping on a switch to prevent rogue DHCP servers. After enabling, legitimate DHCP clients on VLAN 10 cannot obtain addresses. The DHCP server is connected to a trusted port. The switch shows 'show ip dhcp snooping binding' with no entries. Which is the most likely explanation?

A
The DHCP server is on a different subnet, and no DHCP relay is configured; the switch only snoops broadcast traffic within the VLAN.
Correct: DHCP snooping relies on seeing the DHCP packets. Without a relay, the server may not be reachable, or the packets may not traverse the switch.
B
The trusted port is configured as an access port in VLAN 10, but the server is in VLAN 20.
Why wrong: Incorrect: The trusted port should be in the same VLAN as the server, but the issue is about relay.
C
The switch has 'ip dhcp snooping information option' disabled, preventing binding creation.
Why wrong: Incorrect: Option 82 is not required for binding creation; it is an additional feature.
D
The DHCP server is using a different MAC address than expected, causing the switch to drop the packets.
Why wrong: Incorrect: DHCP snooping does not filter based on server MAC unless configured.

Full breakdown with real-world context →

Question 6mediummultiple choice

Open the full VLAN trunking answer →

An engineer is troubleshooting a network where IPv6 hosts on VLAN 20 are unable to communicate with each other. The switch is configured with IPv6 First Hop Security features including Private VLAN (PVLAN) and IPv6 Source Guard. The hosts are in the same VLAN but cannot ping each other. What is the most likely cause?

A
The switch has Private VLAN configured on VLAN 20, and the hosts are on isolated ports, which prevents direct communication.
Correct because PVLAN isolates traffic between hosts on isolated ports within the same VLAN.
B
IPv6 Source Guard is blocking inter-host traffic because the hosts' bindings are not in the binding table.
Why wrong: Incorrect because IPv6 Source Guard filters traffic based on source address to prevent spoofing, but it does not block all inter-host traffic; if both hosts have valid bindings, traffic should be allowed.
C
RA Guard is blocking Neighbor Advertisements between hosts.
Why wrong: Incorrect because RA Guard only filters Router Advertisements and Redirects, not Neighbor Advertisements between hosts.
D
DHCPv6 Guard is blocking DHCPv6 messages between hosts.
Why wrong: Incorrect because DHCPv6 Guard filters DHCPv6 server messages, not client-to-client traffic.

Full breakdown with real-world context →

Question 7mediummultiple choice

Open the full VLAN trunking answer →

A network engineer is troubleshooting an IPv6 neighbor discovery issue on a switch running IOS-XE. Hosts on VLAN 100 are intermittently losing connectivity to the default gateway. The switch is configured with IPv6 First Hop Security features including RA Guard and DHCPv6 Guard. The engineer notices that the switch is dropping valid Router Advertisements from the legitimate router. What is the most likely cause of this issue?

A
The RA Guard policy is configured with 'device-role router' on the port connected to the legitimate router, but the router's MAC address is not in the allowed list.
Correct because RA Guard requires explicit authorization of routers; if the legitimate router's MAC is not allowed, its RAs are dropped.
B
DHCPv6 Guard is blocking DHCPv6 Advertise messages from the router, preventing hosts from obtaining IPv6 addresses.
Why wrong: Incorrect because DHCPv6 Guard blocks DHCPv6 server messages, not RAs; the symptom is about RA loss, not DHCP.
C
IPv6 Source Guard is dropping packets from the router because the router's IPv6 address is not in the binding table.
Why wrong: Incorrect because IPv6 Source Guard filters traffic based on source IPv6 address and MAC, but RAs are multicast and typically not filtered by Source Guard.
D
The switch has IPv6 unicast-routing enabled, causing it to send its own RAs and override the legitimate router.
Why wrong: Incorrect because the switch would send RAs only if it is configured as a router; the issue is about dropping RAs, not sending conflicting ones.

Full breakdown with real-world context →

Question 8hardmultiple choice

Open the full VLAN trunking answer →

An engineer is troubleshooting an IPv6 connectivity issue where hosts on VLAN 10 cannot reach the internet. The switch is configured with IPv6 First Hop Security features including RA Guard and DHCPv6 Guard. The legitimate router is connected to port Gi1/0/1. The engineer notices that the router is sending RAs, but hosts are not receiving them. The switch shows that RA Guard is dropping packets on port Gi1/0/1. What is the most likely misconfiguration?

A
The RA Guard policy is configured with 'device-role host' on port Gi1/0/1, which causes the switch to drop all RAs received on that port.
Correct because 'device-role host' tells the switch that only hosts are allowed on that port; RAs from a router will be dropped.
B
DHCPv6 Guard is configured on port Gi1/0/1, blocking the router's DHCPv6 server messages.
Why wrong: Incorrect because DHCPv6 Guard blocks DHCPv6 server messages, not RAs; the symptom is about RAs being dropped.
C
IPv6 Source Guard is enabled on the VLAN, and the router's IPv6 address is not in the binding table.
Why wrong: Incorrect because IPv6 Source Guard filters traffic based on source address, not RAs; RAs are multicast and typically not filtered by Source Guard.
D
The switch has IPv6 unicast-routing enabled, and it is sending its own RAs, causing a conflict.
Why wrong: Incorrect because the issue is that the router's RAs are being dropped, not that there are conflicting RAs.

Full breakdown with real-world context →

Question 9mediummultiple choice

Open the full VLAN trunking answer →

A network engineer runs the following command on Router R1:

R1# show ipv6 snooping binding

IPv6 Address MAC Address VLAN Interface State 2001:DB8:1::100 aaaa.bbbb.cccc 10 Gi0/0/0 ACTIVE 2001:DB8:1::101 aaaa.bbbb.cccd 10 Gi0/0/0 ACTIVE 2001:DB8:1::102 aaaa.bbbb.ccce 10 Gi0/0/1 ACTIVE 2001:DB8:1::103 aaaa.bbbb.cccf 10 Gi0/0/1 ACTIVE

Based on this output, which statement is correct?

A
All entries are in the ACTIVE state, meaning they are valid bindings.
ACTIVE state indicates the binding is valid and being used.
B
The binding for 2001:DB8:1::103 is invalid.
Why wrong: It is ACTIVE, so it is valid.
C
The table shows only IPv6 addresses from SLAAC.
Why wrong: The binding table can include DHCPv6 and static entries as well.
D
There are no entries for VLAN 10.
Why wrong: All entries are in VLAN 10.

Full breakdown with real-world context →

Question 10hardmultiple choice

Open the full VLAN trunking answer →

A large enterprise network is experiencing intermittent IPv6 connectivity loss for hosts on VLAN 100. Router R1 has the following relevant configuration:

interface GigabitEthernet0/0.100
 encapsulation dot1Q 100

ipv6 address 2001:DB8:1:100::1/64 ipv6 nd raguard ipv6 nd prefix default ipv6 dhcp relay destination 2001:DB8:1:200::1 !

Router R2 shows: debug ipv6 dhcp relay output indicates that DHCPv6 requests from VLAN 100 are being relayed, but the server never receives the SOLICIT messages. What is the root cause?

A
The 'ipv6 nd raguard' command on the interface filters DHCPv6 SOLICIT messages, preventing relay.
Why wrong: RA Guard filters Router Advertisements, not DHCPv6 messages.
B
The DHCPv6 relay destination is in a different VRF, and the relay is not configured to use that VRF.
Why wrong: No VRF configuration is shown; the relay destination is reachable via the global table.
C
An IPv6 ACL applied to GigabitEthernet0/0.100 has an implicit deny that blocks the relayed DHCPv6 traffic.
The implicit deny at the end of an IPv6 ACL can block DHCPv6 relay packets if no explicit permit statement exists for the relay destination.
D
The DHCPv6 server is not configured to accept relayed messages from this relay agent.
Why wrong: DHCPv6 servers accept relayed messages by default; the issue is on the relay side.

Full breakdown with real-world context →

Question 11hardmultiple choice

Open the full VLAN trunking answer →

A network engineer is troubleshooting IPv6 neighbor discovery issues on a VLAN. Router R1 is configured with IPv6 First Hop Security features. Hosts are unable to communicate with each other, even though they have valid IPv6 addresses. Router R1 has the following relevant configuration:

interface Vlan100

ipv6 address 2001:DB8:1:100::1/64 ipv6 nd raguard ipv6 dhcp guard ipv6 source guard !

Router R2 shows: debug ipv6 nd output indicates that Neighbor Solicitations from hosts are being dropped. What is the root cause?

A
RA Guard is blocking Neighbor Solicitations because they are mistaken for RAs.
Why wrong: RA Guard only filters Router Advertisements, not Neighbor Solicitations.
B
DHCP Guard is dropping Neighbor Solicitations because they contain DHCP options.
Why wrong: DHCP Guard filters DHCP messages, not Neighbor Solicitations.
C
IPv6 Source Guard is dropping Neighbor Solicitations because the source address is not in the binding table.
Source Guard validates source addresses against the binding table; if the host is not bound, the NS is dropped.
D
The VLAN interface is not in a state to forward ND messages due to a spanning tree issue.
Why wrong: No spanning tree issue is indicated; the debug shows drops due to security features.

Full breakdown with real-world context →

Question 12mediummultiple choice

Open the full VLAN trunking answer →

A network engineer runs the following command to verify IPv6 binding table:

R1# show ipv6 neighbors binding

IPv6 Address Age Link-layer Addr State Interface VLAN Policy 2001:db8::1 10 0011.2233.4455 REACH Fa0/1 10 TRUSTED 2001:db8::2 5 00aa.bbcc.ddee STALE Fa0/0 10 INSPECT 2001:db8::3 0 1111.2222.3333 INCOMP Fa0/0 10 -

What does this output indicate?

A
The binding table shows three entries: one reachable on trusted port, one stale on untrusted port, and one incomplete, indicating active ND learning.
The output correctly shows the state and policy for each entry.
B
The binding table is empty, indicating no ND activity.
Why wrong: There are three entries, so it is not empty.
C
The binding table shows all entries as reachable, indicating stable neighbor relationships.
Why wrong: One entry is STALE and one is INCOMP, not all reachable.
D
The binding table is only for DHCPv6-learned addresses.
Why wrong: The table includes ND-learned addresses, not just DHCPv6.

Full breakdown with real-world context →

Question 13mediummultiple choice

Open the full VLAN trunking answer →

A network engineer runs the following command to verify IPv6 device tracking:

R1# show ipv6 device-tracking database

  Interface  MAC Address       VLAN  IPv6 Address                    State         Age  Policy

Fa0/0 0011.2233.4455 10 2001:db8::1 ACTIVE 10 TRUSTED Fa0/0 00aa.bbcc.ddee 10 2001:db8::2 ACTIVE 5 INSPECT Fa0/0 1111.2222.3333 10 2001:db8::3 VERIFY 0 -

What does this output indicate?

A
Device tracking shows two devices in ACTIVE state and one in VERIFY state, indicating ongoing ND verification for the third device.
The VERIFY state means the device is being validated before becoming active.
B
All devices are in ACTIVE state, indicating stable tracking.
Why wrong: One device is in VERIFY state, not active.
C
Device tracking is disabled, and the database is empty.
Why wrong: The database has three entries, so it is not empty.
D
Device tracking only tracks IPv4 addresses.
Why wrong: The output shows IPv6 addresses, so it tracks IPv6.

Full breakdown with real-world context →

Question 14hardmultiple choice

Open the full VLAN trunking answer →

A network administrator configures 'ipv6 dhcp guard' on a switch and sets the policy to 'allow only' for a specific DHCPv6 server. However, clients are still receiving DHCPv6 replies from a rogue server on the same VLAN. The engineer verifies that the rogue server's port is not trusted. What is the most likely reason the rogue server's advertisements are not being blocked?

A
IPv6 snooping is not enabled globally, so DHCPv6 Guard cannot inspect DHCPv6 messages.
DHCPv6 Guard depends on IPv6 snooping for packet inspection.
B
The rogue server is using a different UDP port for DHCPv6.
Why wrong: DHCPv6 uses well-known ports 546 and 547.
C
The 'allow only' policy only works for DHCPv6 requests, not replies.
Why wrong: It works for both.
D
The rogue server is on a trunk port, and DHCPv6 Guard does not apply to trunk ports.
Why wrong: It applies to all ports.

Full breakdown with real-world context →

These 300-410 practice questions are part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style 300-410 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

VLAN and Inter-VLAN Routing Scenarios

How to approach vlan and inter-vlan routing scenarios

Quick answer

Related 300-410 topic practice pages

Layer 3 Technologies practice questions

EIGRP Troubleshooting practice questions

OSPF Troubleshooting (v2/v3) practice questions

BGP Troubleshooting practice questions

Route Redistribution practice questions

Policy-Based Routing (PBR) practice questions

VRF-Lite practice questions

Route Maps and Route Filtering practice questions

Administrative Distance practice questions

Route Summarization practice questions

Bidirectional Forwarding Detection (BFD) practice questions

VPN Technologies practice questions

Practice scenarios

Which TWO actions will prevent a Cisco IOS router from acting as a DHCPv4 server for a specific VLAN? (Choose TWO.)

A router configured as a DHCPv6 relay agent is not forwarding DHCPv6 requests from clients to the server. The relay interface has 'ipv6 dhcp relay destination' configured. Clients are on a different VLAN. Which is the most likely explanation?