Question 131 of 464
N10-009 Network Implementation Practice Question
A network administrator is configuring a router-on-a-stick to route between two VLANs (VLAN 10 and VLAN 20). The router has two subinterfaces: GigabitEthernet0/1.10 with encapsulation dot1Q 10 and IP 10.10.10.1/24, and GigabitEthernet0/1.20 with encapsulation dot1Q 20 and IP 10.10.20.1/24. The switch port connected to the router is configured as an access port in VLAN 10. Hosts in VLAN 10 can ping the router's VLAN 10 interface, but hosts in VLAN 20 cannot ping the router's VLAN 20 interface. What is the most likely cause?
⚠ Common exam trap
CompTIA often tests the distinction between access and trunk ports in router-on-a-stick scenarios, trapping candidates who assume that configuring subinterfaces alone is sufficient without ensuring the switch port is set to trunk mode.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The switch port connecting to the router should be configured as a trunk.
The router-on-a-stick design requires the switch port connecting to the router to be configured as a trunk port, not an access port. An access port only carries traffic for a single VLAN (VLAN 10 in this case), so frames from VLAN 20 are dropped at the switch port before reaching the router. Configuring the port as a trunk with allowed VLANs 10 and 20 would enable the router's subinterfaces to receive and forward traffic for both VLANs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The router subinterface for VLAN 20 is not enabled.
Why it's wrong here
If the router's VLAN 20 subinterface were administratively down or not enabled, traffic for VLAN 20 would not be processed by the router at all. However, the problem description implies that other VLANs (e.g., VLAN 10) are functioning correctly, suggesting the router itself is operational and its subinterfaces are generally active. A disabled subinterface would typically manifest as a complete lack of connectivity for that VLAN, not just an inability to reach the gateway from the hosts, especially if other VLANs are routing successfully. The core issue lies in the switch's inability to forward VLAN 20 traffic to the router.
- ✓
The switch port connecting to the router should be configured as a trunk.
Why this is correct
For a "router on a stick" configuration to function, the single physical link between the switch and the router must carry traffic for multiple VLANs. This requires the switch port connected to the router to be configured as an 802.1Q trunk port. A trunk port allows frames from different VLANs, identified by their respective VLAN tags, to traverse the same physical link, enabling the router's subinterfaces to receive and send tagged traffic for each configured VLAN. Without this, the switch would treat the port as an access port for a single VLAN, blocking traffic from other VLANs.
- ✗
The hosts in VLAN 20 do not have a default gateway configured.
Why it's wrong here
If hosts in VLAN 20 lacked a default gateway configuration, they would only be able to communicate with other devices within their own VLAN. However, the issue described is that hosts *cannot ping their default gateway*, implying that a gateway *is* configured but is unreachable. This indicates a problem preventing traffic from reaching the gateway, rather than a missing configuration on the host itself. The root cause is the switch port not correctly forwarding VLAN 20 traffic to the router, making the configured gateway inaccessible.
When this WOULD be correct
In a scenario where hosts in a VLAN can ping other hosts in the same VLAN but cannot reach devices in other VLANs or the internet, and the router's subinterface is correctly configured and trunking is verified, the likely cause is that the hosts lack a default gateway pointing to the router's subinterface IP.
- ✗
The router's VLAN 20 subinterface has an incorrect IP address.
Why it's wrong here
If the router's VLAN 20 subinterface had an incorrect IP address, hosts in VLAN 20 would still be able to send ARP requests for their default gateway, but the router would not respond, or its response would be for a different IP, leading to ARP resolution failures. The problem statement suggests traffic isn't even reaching the router for VLAN 20, indicating a layer 2 issue on the switch port rather than an incorrect layer 3 address on the router's subinterface. The inability to ping the gateway points to a fundamental connectivity breakdown at the data link layer.
When this WOULD be correct
In a scenario where hosts in VLAN 20 cannot ping the router, but the switch port is correctly configured as a trunk, and the router subinterface encapsulation is correct, an incorrect IP address on the subinterface (e.g., 10.10.30.1/24) would prevent routing. This would be the correct answer if the IP address does not match the VLAN's subnet.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓The switch port connecting to the router should be configured as a trunk.Correct answer▾
Why this is correct
For a "router on a stick" configuration to function, the single physical link between the switch and the router must carry traffic for multiple VLANs. This requires the switch port connected to the router to be configured as an 802.1Q trunk port. A trunk port allows frames from different VLANs, identified by their respective VLAN tags, to traverse the same physical link, enabling the router's subinterfaces to receive and send tagged traffic for each configured VLAN. Without this, the switch would treat the port as an access port for a single VLAN, blocking traffic from other VLANs.
✗The hosts in VLAN 20 do not have a default gateway configured.Wrong answer — click to see why▾
Why this is wrong here
The hosts in VLAN 20 cannot ping the router's VLAN 20 interface because the switch port is an access port in VLAN 10, so frames from VLAN 20 are not received by the router. Even if hosts lacked a default gateway, they could still ping the router's directly connected interface IP if Layer 2 connectivity existed.
★ When this WOULD be the correct answer
In a scenario where hosts in a VLAN can ping other hosts in the same VLAN but cannot reach devices in other VLANs or the internet, and the router's subinterface is correctly configured and trunking is verified, the likely cause is that the hosts lack a default gateway pointing to the router's subinterface IP.
Why candidates choose this
Candidates often assume that inter-VLAN routing issues are due to missing default gateways, overlooking Layer 2 misconfigurations like trunking. They may not realize that direct ping to the router's interface IP does not require a default gateway.
✗The router's VLAN 20 subinterface has an incorrect IP address.Wrong answer — click to see why▾
Why this is wrong here
The router's VLAN 20 subinterface IP address (10.10.20.1/24) is correct for the VLAN 20 network. The issue is that the switch port is an access port in VLAN 10, so VLAN 20 traffic never reaches the router, making the IP configuration irrelevant.
★ When this WOULD be the correct answer
In a scenario where hosts in VLAN 20 cannot ping the router, but the switch port is correctly configured as a trunk, and the router subinterface encapsulation is correct, an incorrect IP address on the subinterface (e.g., 10.10.30.1/24) would prevent routing. This would be the correct answer if the IP address does not match the VLAN's subnet.
Why candidates choose this
Candidates may assume that if hosts cannot reach the router, the IP address must be wrong, overlooking the more fundamental trunking issue. They focus on IP configuration because it's a common misconfiguration, but here the problem is at Layer 2.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 30, 2026
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.