hardMultiple Choice
300-410 Practice Question: Is troubleshooting a VRF-Lite deployment where…
A network engineer is troubleshooting a VRF-Lite deployment where two routers are connected via a trunk link. Each router has two VRFs (VRF_A and VRF_B). The engineer configures subinterfaces on the trunk link, assigning each subinterface to a different VRF. However, traffic between the two routers for VRF_A is not working. The 'show vrf' command shows the VRFs are active. What is the most likely issue?
⚠ Common exam trap
The trap here is that candidates see 'show vrf' output showing active VRFs and assume the VRF configuration is correct, overlooking the Layer 2 VLAN mismatch on the trunk subinterfaces.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The subinterface on Router1 is configured with 'encapsulation dot1q 10', but the subinterface on Router2 is configured with 'encapsulation dot1q 20'.
For VRF-Lite over a trunk, the subinterfaces on both ends of the link must use the same 802.1Q VLAN ID for the same VRF. If Router1 uses dot1q 10 for VRF_A and Router2 uses dot1q 20, the frames are tagged with different VLANs and each router will drop the other's traffic because the VLANs do not match. This is the most likely cause of the VRF_A traffic failure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The subinterface on Router1 is configured with 'encapsulation dot1q 10', but the subinterface on Router2 is configured with 'encapsulation dot1q 20'.
Why this is correct
VRF-Lite over a trunk requires matching 802.1Q VLAN tags on both ends of each subinterface pair. Mismatched encapsulation dot1q values place the two subinterfaces in different broadcast domains, so VRF_A traffic never reaches its peer despite both VRFs showing active.
- ✗
The 'ip vrf forwarding VRF_A' command is missing on the main interface.
Why it's wrong here
VRF-Lite binds each subinterface individually with 'ip vrf forwarding', so the main interface needs no VRF assignment; adding one there would not restore VRF_A reachability. It is tempting because VRF membership is normally configured on routed interfaces, but trunk subinterfaces carry their own encapsulation and forwarding table.
- ✗
The 'no ip routing' command is configured globally.
Why it's wrong here
'no ip routing' would halt all IPv4 forwarding, yet the stem shows VRFs active and other traffic presumably passing, so it cannot explain a single VRF failing. It is tempting because disabling routing is a known cause of silent forwarding failures, but that fault would affect every VRF, not just VRF_A.
- ✗
The 'mtu' command is set differently on the two subinterfaces.
Why it's wrong here
MTU mismatch could cause packet drops, but it is less likely than a VLAN mismatch for complete traffic failure.
Visual reference
Go deeper
Related to this question
About these practice questions
This 300-410 question is part of Courseiva's 1,401-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.