CCNA VLANs and Trunking: Practice Questions

How to work these questions

1. Confirm the VLAN exists and is active on every switch in the path with show vlan brief. A port assigned to a missing VLAN is inactive and passes no traffic.
2. Check the access port: show interfaces switchport shows the administrative and operational mode, the access VLAN and the voice VLAN. Make sure the host port is in the VLAN you expect.
3. Check the trunk with show interfaces trunk on both ends: status must be trunking, the native VLAN must match, and the VLAN must appear in all three lists (allowed, active, forwarding and not pruned).
4. If the link is not trunking, compare the DTP modes on both ends. Two dynamic auto ports stay access; nonegotiate on one side needs a static trunk on the other.
5. For traffic between VLANs, verify the Layer 3 device: subinterfaces with the right encapsulation dot1Q VLAN on a router, or SVIs that are up/up plus ip routing on a multilayer switch.
6. Finally, test from the host: correct IP, mask and default gateway in that VLAN's subnet, then ping the gateway before anything farther away.

Practice questions

Pick an answer to see right away whether it is correct and why every option is right or wrong.

1. Question 1 of 10Exhibit

   Hosts in VLAN 30 on SW1 cannot reach hosts in VLAN 30 on SW2. VLAN 30 exists and is active on both switches, and hosts in VLANs 10, 20 and 40 communicate across the link without problems. Based on the output from SW1, which command on Gi1/0/24 fixes the problem without affecting other VLANs?

   SW1# show interfaces trunk
   
   Port        Mode         Encapsulation  Status        Native vlan
   Gi1/0/24    on           802.1q         trunking      1
   
   Port        Vlans allowed on trunk
   Gi1/0/24    10,20,40
   
   Port        Vlans allowed and active in management domain
   Gi1/0/24    10,20,40
   
   Port        Vlans in spanning tree forwarding state and not pruned
   Gi1/0/24    10,20,40

   1. switchport trunk allowed vlan add 30
   2. switchport trunk allowed vlan 30
   3. switchport mode dynamic desirable
   4. switchport trunk native vlan 30
   Show the answer

   Answer: A

   The trunk is up, but VLAN 30 is missing from the allowed list. Use switchport trunk allowed vlan add to extend the list. Without add, the command overwrites the list.

   • A. The add keyword appends VLAN 30 to the existing list, leaving 10, 20 and 40 in place.
   • B. This replaces the allowed list with only VLAN 30, so VLANs 10, 20 and 40 would stop crossing the trunk.
   • C. The port is already trunking (mode on). The DTP mode has nothing to do with which VLANs are allowed.
   • D. VLAN 30 is not allowed on the trunk at all, so changing the native VLAN does not help, and it would create a native VLAN mismatch with SW2.

2. Question 2 of 10Scenario

   You are checking the DTP configuration on several inter-switch links. Each choice shows the switchport mode on the two ends of one link. Which two combinations result in an operational 802.1Q trunk? (Choose two.)

   1. trunk and dynamic auto
   2. dynamic auto and dynamic auto
   3. dynamic desirable and dynamic auto
   4. trunk with switchport nonegotiate and dynamic desirable
   5. access and dynamic desirable
   Show the answer

   Answer: A and C

   A trunk forms through DTP when at least one side actively negotiates (desirable or trunk without nonegotiate) and the other side is willing (auto, desirable or trunk). Auto plus auto stays access. With nonegotiate, the other end must be statically set to trunk.

   • A. A static trunk port still sends DTP frames, and the dynamic auto side responds by trunking.
   • B. Both ends are passive and wait for the other to start negotiation, so the link comes up as an access link.
   • C. Desirable actively asks to trunk and auto agrees, so the link becomes a trunk.
   • D. Nonegotiate stops DTP frames, so the desirable side never hears an offer and stays access. One side trunks and the other does not, which is a broken link.
   • E. An access port never trunks, so the link stays an access link no matter what the other side wants.

3. Question 3 of 10Exhibit

   Looking at the output, port Fa0/5 is listed under both VLAN 10 and VLAN 110. What explains this?

   SW3# show vlan brief
   
   VLAN Name                             Status    Ports
   ---- -------------------------------- --------- -------------------------------
   1    default                          active    Fa0/6, Fa0/7, Fa0/8, Gi0/2
   10   STAFF                            active    Fa0/1, Fa0/2, Fa0/3, Fa0/4, Fa0/5
   110  PHONES                           active    Fa0/5
   1002 fddi-default                     act/unsup
   1003 token-ring-default               act/unsup
   1004 fddinet-default                  act/unsup
   1005 trnet-default                    act/unsup

   1. Fa0/5 is an 802.1Q trunk port carrying only VLANs 10 and 110.
   2. Fa0/5 is an access port in VLAN 10 with voice VLAN 110 configured.
   3. Fa0/5 has a duplicate VLAN assignment and is err-disabled.
   4. Fa0/5 is a member of a port channel that spans VLANs 10 and 110.
   Show the answer

   Answer: B

   When a port has both an access VLAN and a voice VLAN, show vlan brief lists it under both. The PC traffic goes untagged in VLAN 10, and the phone tags its traffic with VLAN 110.

   • A. Operational trunk ports are not listed in show vlan brief at all, so a trunk would not appear under either VLAN.
   • B. An access port with switchport voice vlan configured appears under its access (data) VLAN and under its voice VLAN. This is the normal IP phone setup.
   • C. IOS does not allow two access VLANs on one port, and an err-disabled port would not be explained by this output.
   • D. Port channel membership does not make a port show up in two VLANs; the bundle follows one access VLAN or trunks.

4. Question 4 of 10Exhibit

   The neighboring switch port connected to Gi0/2 is configured as switchport mode dynamic auto, and you are not allowed to change it. Based on the output from SW1, which single command on SW1 Gi0/2 makes the link a trunk?

   SW1# show interfaces gi0/2 switchport
   Name: Gi0/2
   Switchport: Enabled
   Administrative Mode: dynamic auto
   Operational Mode: static access
   Administrative Trunking Encapsulation: dot1q
   Operational Trunking Encapsulation: native
   Negotiation of Trunking: On
   Access Mode VLAN: 1 (default)
   Trunking Native Mode VLAN: 1 (default)
   Administrative Native VLAN tagging: enabled
   Voice VLAN: none
   Administrative private-vlan host-association: none
   Operational private-vlan: none
   Trunking VLANs Enabled: ALL
   Pruning VLANs Enabled: 2-1001
   Capture Mode Disabled
   Capture VLANs Allowed: ALL

   1. switchport trunk native vlan 99
   2. switchport mode dynamic auto
   3. switchport mode dynamic desirable
   4. switchport trunk allowed vlan all
   Show the answer

   Answer: C

   Both ends are dynamic auto, so neither starts negotiation and the operational mode is static access. Making one end dynamic desirable (or a static trunk) brings the trunk up.

   • A. The native VLAN only matters once the port is trunking; it does not change the negotiated mode, which is currently static access.
   • B. Dynamic auto only answers DTP requests. With a dynamic auto neighbor, neither side asks to trunk, so the link stays access.
   • C. Desirable actively sends DTP requests to trunk, and the dynamic auto neighbor agrees, so the link becomes a trunk.
   • D. The allowed list is already ALL. It defines what a trunk carries, not whether the link trunks.

5. Question 5 of 10Scenario

   SW1 and SW2 are connected by an 802.1Q trunk that carries VLANs 10, 20 and 99. On SW1 the trunk uses the default native VLAN. On SW2, someone configured switchport trunk native vlan 99 on the same link. What is the expected result?

   1. The trunk stays up, tagged VLANs keep flowing, and CDP logs a native VLAN mismatch.
   2. The port on SW2 is placed in err-disabled state until the native VLANs match.
   3. All VLANs stop forwarding because the switches reject each other's 802.1Q tags.
   4. The trunk goes down until the native VLANs match on both ends.
   Show the answer

   Answer: A

   The native VLAN is sent untagged, so each side puts untagged frames into its own native VLAN. A mismatch keeps the trunk up but can mix or block native VLAN traffic, and CDP warns about it. Always set the same native VLAN on both ends.

   • A. Tagged frames are unaffected. Only untagged traffic is at risk: it can land in VLAN 1 on one side and VLAN 99 on the other, and PVST+ may block the native VLANs as inconsistent. CDP logs the mismatch.
   • B. Native VLAN mismatch is not an err-disable cause.
   • C. Tags for VLANs 10 and 20 are read normally by both switches; only the untagged (native) traffic is mismatched.
   • D. A native VLAN mismatch does not bring the trunk down; the link keeps trunking.

6. Question 6 of 10Config

   Router R2 connects with Gi0/0 to a switch trunk port. The switch uses native VLAN 1 and tags VLAN 20. Hosts in VLAN 20 use 10.20.0.1/24 as their default gateway. Which configuration on R2 provides that gateway?

   1. interface gi0/0.20 ip address 10.20.0.1 255.255.255.0
   2. interface gi0/0.20 encapsulation dot1Q 20 native ip address 10.20.0.1 255.255.255.0
   3. interface gi0/0.20 encapsulation dot1Q 20 ip address 10.20.0.1 255.255.255.0
   4. interface gi0/0 encapsulation dot1Q 20 ip address 10.20.0.1 255.255.255.0
   Show the answer

   Answer: C

   In router-on-a-stick, each VLAN gets a subinterface with encapsulation dot1Q <vlan> and the gateway IP. Use the native keyword only for the VLAN that is native on the switch trunk. The subinterface number does not have to match the VLAN, but matching it keeps things readable.

   • A. IOS refuses an IP address on a LAN subinterface until encapsulation is configured, so this config is incomplete.
   • B. The native keyword makes the router send and expect VLAN 20 untagged, but the switch tags VLAN 20 and uses VLAN 1 as native, so traffic would not match.
   • C. The subinterface is tied to VLAN 20 with encapsulation dot1Q 20, so it accepts frames tagged 20 and replies with that tag.
   • D. On a router, encapsulation dot1Q goes on a subinterface, not on the physical interface. The physical interface stays without an IP address in router-on-a-stick.

7. Question 7 of 10Scenario

   On multilayer switch DSW1 you configured interface Vlan10 with 172.16.10.1/24 and interface Vlan20 with 172.16.20.1/24. Both SVIs are up/up. Hosts in VLAN 10 can ping 172.16.10.1, and hosts in VLAN 20 can ping 172.16.20.1, but hosts in VLAN 10 cannot ping hosts in VLAN 20. Host gateways are correct. What is the most likely cause?

   1. VLANs 10 and 20 must be on the same trunk port to communicate.
   2. IP routing is not enabled on DSW1.
   3. A router-on-a-stick is required because a switch cannot route between VLANs.
   4. The SVIs need encapsulation dot1Q 10 and encapsulation dot1Q 20.
   Show the answer

   Answer: B

   SVIs that are up/up only give you gateways. To forward between VLANs, the multilayer switch needs the ip routing global command. Hosts reaching their own gateway but not other VLANs is the classic symptom.

   • A. Inter-VLAN traffic is routed at Layer 3; trunk membership does not let VLANs talk to each other.
   • B. Without ip routing, the multilayer switch acts as a host on each VLAN: it answers on each SVI but does not forward packets between them. show ip route would show no routing table.
   • C. A multilayer switch routes between VLANs with SVIs once ip routing is enabled; no external router is needed.
   • D. SVIs do not use encapsulation commands; they are already bound to their VLAN by the interface number.

8. Question 8 of 10Exhibit

   DSW2 has no trunk links. Interface Vlan40 was configured with an IP address and no shutdown, but it stays down. The PCs for VLAN 40 are connected to Gi1/0/5 and Gi1/0/6. Based on the output, what must you do to bring Vlan40 up/up?

   DSW2# show ip interface brief | include Vlan
   Vlan1                  unassigned      YES unset  administratively down down
   Vlan40                 10.40.0.1       YES manual down                  down
   
   DSW2# show vlan brief
   
   VLAN Name                             Status    Ports
   ---- -------------------------------- --------- -------------------------------
   1    default                          active    Gi1/0/1, Gi1/0/2, Gi1/0/3, Gi1/0/4
                                                   Gi1/0/5, Gi1/0/6, Gi1/0/7, Gi1/0/8
   40   LAB                              active
   1002 fddi-default                     act/unsup
   1003 token-ring-default               act/unsup
   1004 fddinet-default                  act/unsup
   1005 trnet-default                    act/unsup

   1. Enter ip routing in global configuration mode so the SVI can route.
   2. Put Gi1/0/5 and Gi1/0/6 in VLAN 40 with switchport access vlan 40.
   3. Create VLAN 40 in the VLAN database with the vlan 40 command.
   4. Issue no shutdown on interface Vlan40 again to clear the down state.
   Show the answer

   Answer: B

   An SVI is up/up only when its VLAN exists, is active, and has at least one up port in it (an access port, or a trunk forwarding that VLAN). Here the PC ports are still in VLAN 1, so Vlan40 stays down.

   • A. ip routing controls forwarding between VLANs; it does not change whether an SVI is up or down.
   • B. VLAN 40 exists but has no ports. Once an up port is in VLAN 40, the SVI comes up/up.
   • C. VLAN 40 already exists and is active in the output.
   • D. The SVI is down/down, not administratively down, so it is already enabled. no shutdown changes nothing.

9. Question 9 of 10Config

   An IP phone is connected to Fa0/9, and a PC is connected to the phone's PC port. PC traffic must go into VLAN 15 (data) and phone traffic into VLAN 150 (voice). Which configuration on Fa0/9 does this?

   1. switchport mode access switchport access vlan 150 switchport voice vlan 150
   2. switchport mode access switchport access vlan 15 switchport voice vlan 150
   3. switchport mode access switchport access vlan 150 switchport voice vlan 15
   4. switchport mode access switchport access vlan 15 switchport trunk allowed vlan 150
   Show the answer

   Answer: B

   For a phone with a PC behind it, use switchport access vlan for data and switchport voice vlan for voice. The PC sends untagged frames and the phone tags voice frames with the voice VLAN.

   • A. This puts both PC and phone traffic in VLAN 150, with no separate data VLAN.
   • B. The access VLAN carries the untagged PC traffic, and the voice VLAN tells the phone (through CDP or LLDP) to tag its traffic with VLAN 150.
   • C. The VLANs are swapped: the PC would land in the voice VLAN and the phone would tag traffic with the data VLAN.
   • D. Trunk allowed lists do not apply to an access port, and the phone would never learn a voice VLAN.

10. Question 10 of 10Scenario

    You capture traffic on an 802.1Q trunk between two switches that use the default native VLAN. You see some frames with an 802.1Q tag showing VLAN 10 and some frames with no tag at all. Which statement is correct?

    1. The untagged frames are errors, because every frame on an 802.1Q trunk must carry a tag.
    2. Untagged frames are in native VLAN 1; tagged frames carry a 4-byte 802.1Q tag after the source MAC.
    3. 802.1Q encapsulates the whole original frame inside a new 26-byte header, and the untagged frames use ISL.
    4. The 802.1Q tag uses a 10-bit VLAN ID after the source MAC, so only 1024 VLANs can be tagged.
    Show the answer

    Answer: B

    802.1Q inserts a 4-byte tag (TPID 0x8100, 3-bit priority, DEI bit, 12-bit VLAN ID) after the source MAC. The native VLAN travels untagged, and VLAN 1 is the default native VLAN.

    • A. Untagged frames on an 802.1Q trunk are valid; the receiver places them in its native VLAN, so no tag is required.
    • B. The native VLAN (VLAN 1 by default) is sent untagged. Other VLANs get a 4-byte tag between the source MAC and the EtherType, and the FCS is recalculated.
    • C. Encapsulating the full frame in a 26-byte header describes Cisco ISL, which 802.1Q replaced. 802.1Q only inserts a tag.
    • D. The VLAN ID field is 12 bits, giving IDs 1 to 4094 usable (0 and 4095 are reserved).

Common mistakes

• Typing switchport trunk allowed vlan 50 when you meant to add VLAN 50. Without the add keyword the list is replaced and every other VLAN is removed from the trunk.
• Assuming dynamic auto on both ends forms a trunk. Both sides wait for the other to ask, so the link comes up as an access link.
• Treating a native VLAN mismatch as a link-down problem. The trunk stays up; the danger is untagged traffic landing in the wrong VLAN, plus CDP and STP complaints.
• Configuring SVIs on a multilayer switch and forgetting ip routing. Hosts reach their own gateway but nothing in other VLANs.
• Expecting an SVI to come up just because it has an IP address. The VLAN must exist and have at least one up port (access or trunk in forwarding state) in it.

Questions people ask

More CCNA topics

• CCNA Subnetting Practice Questions
• CCNA OSPF Practice Questions: Single-Area OSPFv2
• CCNA ACL Practice Questions
• CCNA NAT, PAT and Port Forwarding Practice Questions
• CCNA Spanning Tree Protocol: Practice Questions
• CCNA IPv6 Practice Questions: Addressing, EUI-64, SLAAC and NDP
• CCNA EtherChannel: Practice Questions
• CCNA First-Hop Redundancy Practice Questions: HSRP, VRRP and GLBP
• CCNA Wireless Fundamentals Practice Questions
• CCNA Static Routing Practice Questions: ip route and the Routing Table
• CCNA IP Services Practice Questions
• CCNA Layer 2 Security Practice Questions
• CCNA Security Fundamentals Practice Questions (200-301)
• CCNA QoS Practice Questions (200-301)
• CCNA Automation and Programmability Practice Questions
• CCNA practice test: all domains