How many VLAN and Inter-VLAN Routing Scenarios questions are on this page?

This page has 7 VLAN and Inter-VLAN Routing Scenarios scenario questions for the 300-410 exam, each with detailed explanations and wrong-answer analysis.

How should I approach 300-410 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Cisco CCNP ENARSI 300-410 questions

Scenario-based practice

VLAN and Inter-VLAN Routing Scenarios

Practise 300-410 VLAN and trunking questions covering access ports, trunk ports, allowed VLAN lists, native VLAN, inter-VLAN routing, and command-output troubleshooting.

Start full practice test Read exam guide

scenario questions

300-410

exam code

Cisco

vendor

Scenario guide

How to approach vlan and inter-vlan routing scenarios

VLAN misconfiguration is one of the top sources of connectivity failures in real networks and one of the most tested areas on the CCNA. These questions cover VLAN access ports, 802.1Q trunks, native VLANs, and router-on-a-stick or layer-3 switch inter-VLAN routing.

Quick answer

Routing questions usually test route selection (administrative distance, metric), how static routes are configured and when they are preferred over dynamic routing.

Administrative distance comparing routing sources.

Static route configuration: next-hop vs exit interface.

Default route propagation and the gateway of last resort.

Recursive routing table lookups.

Practice scenarios

Question 1mediummultiple choice

Review the full OSPF breakdown →

A network engineer is troubleshooting an OSPFv2 adjacency issue between two routers connected via a VLAN trunk. R1 and R2 are in different VLANs but are connected through a Layer 2 switch. The engineer has configured 'ip ospf 1 area 0' on the subinterfaces. The adjacency forms but is stuck in INIT state. What is the most likely cause?

A
The routers have the same OSPF router ID.
When a router receives a hello packet with its own router ID, it ignores it, causing the adjacency to stay in INIT.
B
The OSPF hello interval is mismatched between the two routers.
Why wrong: A hello interval mismatch would cause the adjacency to not form at all, not to be stuck in INIT.
C
The subinterfaces are in different VLANs, preventing Layer 2 communication.
Why wrong: If they were in different VLANs, the routers would not receive each other's hellos, so no adjacency would form.
D
The OSPF network type is set to point-to-point on one side and broadcast on the other.
Why wrong: A network type mismatch would cause the adjacency to be stuck in EXSTART or EXCHANGE, not INIT.

Full breakdown with real-world context →

Question 2mediummultiple choice

Open the full VLAN trunking answer →

An engineer is troubleshooting a network where IPv6 hosts on VLAN 20 are unable to communicate with each other. The switch is configured with IPv6 First Hop Security features including Private VLAN (PVLAN) and IPv6 Source Guard. The hosts are in the same VLAN but cannot ping each other. What is the most likely cause?

A
The switch has Private VLAN configured on VLAN 20, and the hosts are on isolated ports, which prevents direct communication.
Correct because PVLAN isolates traffic between hosts on isolated ports within the same VLAN.
B
IPv6 Source Guard is blocking inter-host traffic because the hosts' bindings are not in the binding table.
Why wrong: Incorrect because IPv6 Source Guard filters traffic based on source address to prevent spoofing, but it does not block all inter-host traffic; if both hosts have valid bindings, traffic should be allowed.
C
RA Guard is blocking Neighbor Advertisements between hosts.
Why wrong: Incorrect because RA Guard only filters Router Advertisements and Redirects, not Neighbor Advertisements between hosts.
D
DHCPv6 Guard is blocking DHCPv6 messages between hosts.
Why wrong: Incorrect because DHCPv6 Guard filters DHCPv6 server messages, not client-to-client traffic.

Full breakdown with real-world context →

Question 3hardmultiple choice

Open the full VLAN trunking answer →

A large enterprise network is experiencing intermittent IPv6 connectivity loss for hosts on VLAN 100. Router R1 has the following relevant configuration:

interface GigabitEthernet0/0.100
 encapsulation dot1Q 100

ipv6 address 2001:DB8:1:100::1/64 ipv6 nd raguard ipv6 nd prefix default ipv6 dhcp relay destination 2001:DB8:1:200::1 !

Router R2 shows: debug ipv6 dhcp relay output indicates that DHCPv6 requests from VLAN 100 are being relayed, but the server never receives the SOLICIT messages. What is the root cause?

A
The 'ipv6 nd raguard' command on the interface filters DHCPv6 SOLICIT messages, preventing relay.
Why wrong: RA Guard filters Router Advertisements, not DHCPv6 messages.
B
The DHCPv6 relay destination is in a different VRF, and the relay is not configured to use that VRF.
Why wrong: No VRF configuration is shown; the relay destination is reachable via the global table.
C
An IPv6 ACL applied to GigabitEthernet0/0.100 has an implicit deny that blocks the relayed DHCPv6 traffic.
The implicit deny at the end of an IPv6 ACL can block DHCPv6 relay packets if no explicit permit statement exists for the relay destination.
D
The DHCPv6 server is not configured to accept relayed messages from this relay agent.
Why wrong: DHCPv6 servers accept relayed messages by default; the issue is on the relay side.

Full breakdown with real-world context →

Question 4hardmulti select

Open the full VLAN trunking answer →

Which THREE symptoms indicate a misconfiguration in a VRF-Lite deployment where two routers are connected via a trunk link and each VRF should have connectivity? (Choose THREE.)

A
Pings between hosts in the same VRF across the trunk link fail.
Indicates that the VRF forwarding or subinterface configuration may be incorrect.
B
The 'show ip route vrf <vrf-name>' command shows no routes for the connected subnet.
Missing routes suggest that the interface is not correctly assigned to the VRF or the routing protocol is not configured.
C
The interface assigned to the VRF is in 'up/down' state.
Often caused by mismatched VLAN encapsulation or VRF misconfiguration on the subinterface.
D
The global routing table contains a default route pointing to the ISP.
Why wrong: This is normal for Internet connectivity and not a symptom of VRF-Lite misconfiguration.
E
The router CPU utilization is consistently above 90%.
Why wrong: High CPU can have many causes; it is not a specific symptom of VRF-Lite issues.

Full breakdown with real-world context →

Question 5hardmultiple choice

Open the full VLAN trunking answer →

A network engineer configures a DHCP snooping trusted port on a switch to allow a legitimate DHCP server. However, clients connected to untrusted ports on the same VLAN cannot obtain IP addresses. The DHCP server is reachable and the switch shows no DHCP snooping drops. Which is the most likely explanation?

A
The DHCP server is not configured to trust the relay agent information option (option 82), causing it to discard the requests.
Correct: By default, DHCP snooping inserts option 82. Many servers reject packets with option 82 unless configured to trust it.
B
The trusted port is in the wrong VLAN; DHCP snooping only works when the trusted port is in the same VLAN as the clients.
Why wrong: Incorrect: The trusted port can be in any VLAN; DHCP snooping operates per VLAN.
C
The switch has 'ip dhcp snooping verify mac-address' enabled, causing MAC address mismatches.
Why wrong: Incorrect: This feature checks the source MAC in the DHCP packet against the Ethernet header, but the issue is about option 82.
D
The DHCP server is not configured with the correct subnet for the client VLAN.
Why wrong: Incorrect: This would cause server-side issues, but the symptom is that no clients get addresses, and the server is reachable.

Full breakdown with real-world context →

Question 6hardmultiple choice

Open the full VLAN trunking answer →

An engineer configures ERSPAN on Router R1 to monitor traffic from VLAN 100 to a remote collector at 192.168.10.10 via a GRE tunnel. The source interface is GigabitEthernet0/0/0. After configuration, the collector receives no mirrored packets. R1's configuration: monitor session 1 type erspan-source source interface Gi0/0/0 both destination erspan-id 100 ip address 192.168.10.10 origin ip address 10.1.1.1 no shutdown. R1's routing table shows a default route via 10.1.1.2, and a static route to 192.168.10.0/24 via 10.1.1.2. The tunnel interface Tunnel0 is up/up with IP 10.1.1.1/30. What is the most likely root cause?

A
The monitor session is administratively down due to a missing 'no shutdown' command.
Why wrong: The configuration shows 'no shutdown' is present.
B
The ERSPAN destination IP address is in a different VRF that is not reachable from the source VRF.
Why wrong: There is no VRF configuration mentioned; the routing table shows a default route, implying global routing table.
C
The GRE tunnel interface is used for the ERSPAN source IP, causing a recursive routing loop because the destination IP is routed via the tunnel's next-hop.
The source IP 10.1.1.1 is the tunnel interface IP, and the destination 192.168.10.10 is routed via 10.1.1.2, which is the tunnel's next-hop. This recursion causes the encapsulated packet to be dropped.
D
The ERSPAN session ID 100 conflicts with an existing GRE key on the tunnel.
Why wrong: ERSPAN ID is a session identifier, not a GRE key; no conflict is indicated.

Full breakdown with real-world context →

Question 7hardmultiple choice

Open the full VLAN trunking answer →

A network engineer runs the following command to troubleshoot an ERSPAN issue:

R1# show monitor session 6 detail

Session 6 --------- Type : ERSPAN Source Session Source VLANs : Both : 10-20 Destination IP : 10.1.1.3 ERSPAN ID : 200

What does this output indicate?

A
The session is correctly configured to monitor VLANs 10 through 20.
ERSPAN can use VLANs as the source for monitoring.
B
The session is misconfigured because ERSPAN cannot use VLANs as source.
Why wrong: ERSPAN supports VLANs as source.
C
The session is misconfigured because the ERSPAN ID must be less than 100.
Why wrong: ERSPAN IDs can range from 1 to 1023.
D
The session is misconfigured because the destination IP must be on the same subnet.
Why wrong: The destination IP can be any reachable IP address.

Full breakdown with real-world context →

These 300-410 practice questions are part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style 300-410 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

VLAN and Inter-VLAN Routing Scenarios

How to approach vlan and inter-vlan routing scenarios

Quick answer

Related 300-410 topic practice pages

Layer 3 Technologies practice questions

VPN Technologies practice questions

Infrastructure Security practice questions

Infrastructure Services practice questions

300-410 fundamentals practice questions

300-410 scenario practice questions

300-410 troubleshooting practice questions

Practice scenarios

Which THREE symptoms indicate a misconfiguration in a VRF-Lite deployment where two routers are connected via a trunk link and each VRF should have connectivity? (Choose THREE.)