easyMultiple ChoiceObjective-mapped
CISSP Practice Question: A company uses VLANs to separate traffic between…
A company uses VLANs to separate traffic between the IT, HR, and Finance departments. A user in the HR VLAN reports that she cannot access a file server located in the IT VLAN. The file server's default gateway is correctly set to the IT VLAN interface. All workstations have correct IP addresses and subnet masks. What is the most likely cause of this issue?
⚠ Common exam trap
Many exam-takers assume VLANs inherently block all cross-VLAN traffic, but the real issue is the absence of a Layer 3 routing mechanism; VLANs only separate broadcast domains, not routed traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
No routing is configured between the HR and IT VLANs.
VLANs create separate broadcast domains, so traffic between different VLANs must be routed. Since the HR workstation is in a different VLAN than the file server, and no routing is configured between the HR and IT VLANs, the HR workstation cannot reach the file server even though the server's default gateway is correctly set. This is the most likely cause because all other network settings (IP addresses, subnet masks, switch port configurations) are described as correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Spanning Tree Protocol (STP) is blocking the link between the HR and IT switches.
Why it's wrong here
Spanning Tree Protocol (STP) is designed to prevent Layer 2 switching loops by blocking redundant physical paths, not to selectively block inter-VLAN communication while allowing intra-VLAN traffic. If STP were blocking the entire link between the HR and IT switches, it would render that physical connection unusable for all traffic, including communication within the HR or IT VLANs if that link was part of their primary path. The problem specifically points to a failure in cross-VLAN communication, which is a Layer 3 issue, not a Layer 2 link blockage.
- ✗
The HR workstation has an incorrect subnet mask.
Why it's wrong here
An incorrect subnet mask on the HR workstation would fundamentally alter its perception of network boundaries. It would either incorrectly assume remote hosts are local, attempting ARP resolution instead of sending to a gateway, or vice-versa, sending local traffic to the gateway. However, the scenario explicitly states that all IP addresses and subnet masks are correctly configured, directly ruling out this common misconfiguration as the cause of the inter-VLAN communication failure.
- ✗
The HR VLAN switch port is incorrectly configured with the wrong VLAN ID.
Why it's wrong here
A VLAN mismatch on the access port would prevent the HR workstation from communicating within its own VLAN, but it would not affect routing to other VLANs if the port is correctly configured for HR.
- ✓
No routing is configured between the HR and IT VLANs.
Why this is correct
VLANs are designed to segment a network into distinct Layer 2 broadcast domains, meaning devices in separate VLANs reside on different logical networks. For communication to occur between these isolated VLANs, such as between HR and IT, traffic must be explicitly routed at Layer 3. Without a dedicated router or a Layer 3 switch configured with appropriate routing interfaces (like Switched Virtual Interfaces or SVIs) and routing protocols, packets attempting to traverse VLAN boundaries will be dropped, preventing inter-VLAN connectivity.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.