N10-009 Network Implementation Practice Question
A network administrator is configuring a trunk link between two switches. The link is up, but devices on VLAN 30 cannot communicate across the trunk. Devices on VLAN 10 and 20 can communicate. What should the administrator verify?
⚠ Common exam trap
It's easy for candidates to confuse native VLAN mismatch (which causes spanning-tree or BPDU issues) with a missing allowed VLAN, or they assume encapsulation must be checked even though the trunk is already operational for other VLANs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Verify that VLAN 30 is included in the allowed VLAN list on both switches
The trunk link is operational for VLANs 10 and 20 but not for VLAN 30, which indicates that VLAN 30 is likely not permitted on the trunk. By default, a trunk allows all VLANs, but if an administrator has manually configured an allowed VLAN list, VLAN 30 may have been omitted. Verifying that VLAN 30 is included in the allowed VLAN list on both switches will resolve the issue.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Ensure the native VLAN is the same on both switches
Why it's wrong here
A native VLAN mismatch primarily impacts untagged traffic, which is typically management traffic or frames from devices unaware of VLAN tagging. While such a mismatch can lead to security vulnerabilities or communication issues for untagged frames, it would not selectively block traffic for a *tagged* VLAN like VLAN 30. Tagged VLANs utilize 802.1Q headers for identification, which are processed independently of the native VLAN configuration.
When this WOULD be correct
This would be correct if devices on all VLANs (including native VLAN) cannot communicate across the trunk, or if there are symptoms like unexpected behavior with untagged frames, such as VLAN hopping or management access issues.
- ✓
Verify that VLAN 30 is included in the allowed VLAN list on both switches
Why this is correct
This is the most direct and common reason for a single VLAN's traffic failing to traverse an otherwise operational trunk link. Trunk ports are often explicitly configured with a list of allowed VLANs that are permitted to send and receive traffic across the link. If VLAN 30 is inadvertently excluded from this allowed list on either switch, its tagged frames will be dropped, preventing communication for that specific VLAN while others may function correctly.
- ✗
Check the trunk encapsulation type on both switches
Why it's wrong here
Trunk encapsulation type, almost universally 802.1Q in modern networks, must match on both ends of a trunk link for any VLAN-tagged traffic to pass. A mismatch (e.g., one switch expecting 802.1Q and the other expecting a deprecated protocol like ISL) would cause a complete failure for *all* VLAN-tagged traffic, not just a selective blockage of VLAN 30. This makes it an unlikely cause for the described symptom of only one VLAN being affected.
When this WOULD be correct
A network administrator configures a trunk link between two switches, but no VLAN traffic passes across the link. The link is up, but all VLANs fail to communicate. In that case, verifying the trunk encapsulation type on both switches would be appropriate.
- ✗
Confirm that port security is not enabled on the trunk interfaces
Why it's wrong here
Port security is a Layer 2 feature that restricts the number of MAC addresses learned on a port, preventing unauthorized devices. While it can be configured on trunk ports, its filtering mechanism operates based on MAC addresses, not VLAN IDs. Therefore, port security would not selectively block traffic for a particular VLAN like VLAN 30 while allowing other VLANs to pass, as its function is unrelated to VLAN tagging.
When this WOULD be correct
A network administrator configures a trunk link between two switches. After enabling port security on the trunk interfaces, devices on all VLANs cannot communicate across the trunk. The administrator should confirm that port security is not enabled on the trunk interfaces.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓Verify that VLAN 30 is included in the allowed VLAN list on both switchesCorrect answer▾
Why this is correct
This is the most direct and common reason for a single VLAN's traffic failing to traverse an otherwise operational trunk link. Trunk ports are often explicitly configured with a list of allowed VLANs that are permitted to send and receive traffic across the link. If VLAN 30 is inadvertently excluded from this allowed list on either switch, its tagged frames will be dropped, preventing communication for that specific VLAN while others may function correctly.
✗Ensure the native VLAN is the same on both switchesWrong answer — click to see why▾
Why this is wrong here
The native VLAN mismatch would cause issues with untagged traffic, but the problem is specific to VLAN 30, which is a tagged VLAN. Since VLANs 10 and 20 work, the trunk is operational; the issue is that VLAN 30 is not allowed on the trunk.
★ When this WOULD be the correct answer
This would be correct if devices on all VLANs (including native VLAN) cannot communicate across the trunk, or if there are symptoms like unexpected behavior with untagged frames, such as VLAN hopping or management access issues.
Why candidates choose this
Candidates often confuse native VLAN configuration with allowed VLAN lists, assuming that a mismatch in native VLANs can cause specific VLAN communication failures, but native VLAN issues affect untagged traffic, not tagged VLANs like VLAN 30.
✗Check the trunk encapsulation type on both switchesWrong answer — click to see why▾
Why this is wrong here
The trunk encapsulation type (e.g., 802.1Q vs ISL) must match on both ends for trunking to work at all. Since VLANs 10 and 20 already communicate, the trunk is operational, so encapsulation mismatch is not the issue.
★ When this WOULD be the correct answer
A network administrator configures a trunk link between two switches, but no VLAN traffic passes across the link. The link is up, but all VLANs fail to communicate. In that case, verifying the trunk encapsulation type on both switches would be appropriate.
Why candidates choose this
Candidates may confuse trunk encapsulation with allowed VLAN lists, or assume that any trunk issue involves encapsulation mismatch, especially when only some VLANs fail.
✗Confirm that port security is not enabled on the trunk interfacesWrong answer — click to see why▾
Why this is wrong here
Port security restricts traffic based on MAC addresses, but the issue is VLAN-specific communication across a trunk. Since VLANs 10 and 20 work, port security is not blocking the trunk; the problem is VLAN 30 not being allowed on the trunk.
★ When this WOULD be the correct answer
A network administrator configures a trunk link between two switches. After enabling port security on the trunk interfaces, devices on all VLANs cannot communicate across the trunk. The administrator should confirm that port security is not enabled on the trunk interfaces.
Why candidates choose this
Candidates may think port security could block VLAN traffic, but it operates at the port level, not per VLAN. The symptom of only one VLAN failing points away from port security.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Ethernet Switching and VLANs
Key term
CAN
A CAN (Controller Area Network) is a robust vehicle bus standard designed to allow microcontrollers and devices to communicate with each other without a host computer.
Key term
VLAN
A VLAN (Virtual Local Area Network) is a logical grouping of network devices that behave as if they are on the same physical network segment, regardless of their actual physical location.
About these practice questions
Courseiva writes every N10-009 question from scratch — 464 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.