24 Network Access: VLANs, Trunks & STP Practice Questions & Answers

1. 1. A switch port connects an IP phone, and a PC plugs into the phone's built-in switch port. The switch port is an access port in VLAN 20 with voice VLAN 120 configured. How do frames from the two devices cross the switch-to-phone link?

   • A.Voice frames tagged with VLAN 120; PC frames untagged in VLAN 20✓ Answer
   • B.Both untagged; the switch separates them by source MAC address
   • C.Voice frames tagged with VLAN 120; PC frames tagged with VLAN 20
   • D.PC frames tagged with VLAN 20; voice frames untagged in VLAN 120

   With a voice VLAN, the phone learns the voice VLAN ID through CDP or LLDP-MED and sends its voice traffic with an 802.1Q tag (with CoS marking). The PC's data stays untagged and the switch places it in the access VLAN. The port stays an access port with a voice VLAN; it does not become a trunk.

   Ref QB-XHQS4PSource: Cisco CCNA 200-301 Exam Topics — 2.1.a Access ports (data and voice)Report a problem with this question

2. 2. A technician unboxes a new switch with no configuration, connects two PCs addressed in the same subnet to ports 3 and 17, and they can ping each other immediately. What explains this?

   • A.Ports stay in no VLAN and simply flood all traffic
   • B.Every port starts as an access port in default VLAN 1✓ Answer
   • C.Ports start as trunks that carry every VLAN by default
   • D.The switch auto-creates one VLAN per connected subnet

   VLAN 1 is the default VLAN: every switch port is a member of it until reassigned, so both PCs share one broadcast domain and can communicate. VLAN 1 cannot be deleted and is also the default native and management VLAN, which is why best practice moves user ports and the native VLAN off it.

   Ref QB-G29AVQSource: Cisco CCNA 200-301 Exam Topics — 2.1.b Default VLANReport a problem with this question

3. 3. Hosts in VLAN 10 (192.168.10.0/24) and VLAN 20 (192.168.20.0/24) must communicate. A router has one Ethernet interface cabled to switch port Gi0/24. Which design provides inter-VLAN routing over that single link?

   • A.Switch port as an 802.1Q trunk; one router subinterface per VLAN with its gateway IP✓ Answer
   • B.Switch port as an access port in VLAN 10; one router subinterface per VLAN with its gateway IP
   • C.Switch port as an 802.1Q trunk; one router physical IP plus a secondary IP per VLAN
   • D.Switch port as an access port in VLAN 1; the router's IP set as the gateway for both VLANs

   Router on a stick needs the link to carry both VLANs, so the switch port must be an 802.1Q trunk. The router uses one subinterface per VLAN, each set to the matching 802.1Q VLAN ID and given the IP address hosts in that VLAN use as their default gateway. An access port carries only one VLAN, and secondary IPs on an untagged interface cannot separate tagged traffic.

   Ref QB-YH35AQSource: Cisco CCNA 200-301 Exam Topics — 2.1.c InterVLAN connectivityReport a problem with this question

4. 4. On a Layer 3 switch with IP routing enabled, an engineer creates an SVI for VLAN 30 with IP 10.30.0.1/24 and enables it, but the SVI stays down/down. The VLAN database has no VLAN 30 and no port is assigned to it. What is the cause?

   • A.An SVI comes up only when a router subinterface uses the same VLAN
   • B.An SVI comes up only when its VLAN exists and has an active port✓ Answer
   • C.An SVI comes up only after a dynamic routing protocol is enabled
   • D.An SVI comes up only after IP routing is disabled on the switch

   An SVI is the routed interface for a VLAN, so it is up/up only when that VLAN exists on the switch and at least one access or trunk port is up and forwarding for it (unless autostate is turned off). Creating VLAN 30 and placing an active port in it brings the SVI up. Routing protocols and router subinterfaces play no part in SVI status.

   Ref QB-D27ACMSource: Cisco CCNA 200-301 Exam Topics — 2.1.c InterVLAN connectivityReport a problem with this question

5. 5. PC-7 is configured with 10.1.10.57/24 and default gateway 10.1.10.1, which is the SVI for VLAN 10. Other VLAN 10 hosts on the same access switch reach the gateway, but PC-7 cannot. The switchport status of PC-7's port shows static access mode with access VLAN 1. What is the most likely fix?

   • A.Change PC-7's default gateway to the VLAN 1 SVI
   • B.Assign PC-7's switch port to access VLAN 10✓ Answer
   • C.Add VLAN 10 to the uplink trunk's allowed VLAN list
   • D.Change the native VLAN on the uplink trunk to 10

   Because other VLAN 10 hosts on the same switch reach the gateway, the uplink trunk and the SVI are working. PC-7's port sits in VLAN 1, a different broadcast domain, so its frames never reach the VLAN 10 gateway. Placing the port in access VLAN 10 puts PC-7 in the right VLAN for its address and gateway.

   Ref QB-VHZ4SKSource: Cisco CCNA 200-301 Exam Topics — 2.1 Configure and verify VLANs (normal range) spanning multiple switchesReport a problem with this question

6. 6. Which statement correctly describes the IEEE 802.1Q tag that a switch adds to a frame sent on a trunk?

   • A.A 26-byte header wrapping the whole frame, with a 15-bit VLAN ID
   • B.A 4-byte trailer appended after the FCS, with a 10-bit VLAN ID
   • C.A 2-byte tag inserted before the destination MAC, with a 12-bit VLAN ID
   • D.A 4-byte tag inserted after the source MAC, with a 12-bit VLAN ID✓ Answer

   802.1Q inserts a 4-byte tag between the source MAC address and the EtherType/Length field: a 2-byte TPID (0x8100) and a 2-byte TCI holding a 3-bit priority (PCP/CoS), a 1-bit DEI and a 12-bit VLAN ID. The FCS is recalculated. The 26-byte header that encapsulates the whole frame describes the obsolete Cisco ISL method.

   Ref QB-E2JMHNSource: IEEE 802.1QReport a problem with this question

7. 7. The trunk between DSW1 and ASW3 allows VLANs 10, 20 and 30. To add VLAN 40, an engineer enters the trunk allowed-VLAN command listing only VLAN 40, without the keyword that appends to the existing list. What happens?

   • A.The trunk carries all VLANs because the list was cleared
   • B.The trunk now carries VLANs 10, 20, 30 and 40 as intended
   • C.The command is rejected because VLAN 40 is not in the list
   • D.The trunk now carries only VLAN 40, so VLANs 10, 20 and 30 stop✓ Answer

   Setting the allowed-VLAN list without the add keyword replaces the whole list rather than appending to it. The trunk therefore permits only VLAN 40, and traffic for VLANs 10, 20 and 30 stops crossing it. The add (and remove) forms change the list incrementally.

   Ref QB-WHCFXMSource: Cisco CCNA 200-301 Exam Topics — 2.2.a Trunk portsReport a problem with this question

8. 8. Trunk port Gi0/1 on SW1 uses native VLAN 1, while the connected trunk port on SW2 uses native VLAN 99. Both ends are trunking. Which symptom should the engineer expect?

   • A.Both trunk ports immediately go err-disabled and stop forwarding
   • B.The link renegotiates as an access port in the lower native VLAN
   • C.The trunk drops all tagged VLANs until both native VLANs match
   • D.CDP reports a native VLAN mismatch error on the switch consoles✓ Answer

   CDP advertises each port's native VLAN, so when the two ends differ it logs a native VLAN mismatch message. Native VLAN frames cross the trunk untagged, and each switch places untagged frames into its own native VLAN, so traffic can leak between VLAN 1 and VLAN 99, and spanning tree may block those VLANs as inconsistent. Tagged VLANs keep working, and the trunk is not err-disabled.

   Ref QB-K2BADUSource: Cisco CCNA 200-301 Exam Topics — 2.2.c Native VLANReport a problem with this question

9. 9. On DSW1, the trunk verification for Gi1/0/1 shows VLAN 50 in the list of VLANs allowed on the trunk, but VLAN 50 is missing from the list of VLANs that are allowed and active. What does this indicate?

   • A.VLAN 50 does not exist in DSW1's local VLAN database✓ Answer
   • B.VLAN 50 has no active access ports on the neighbor switch
   • C.VLAN 50 is the trunk's native VLAN and is sent untagged
   • D.VLAN 50 is in a spanning-tree blocking state on this trunk

   The trunk output has three lists: allowed; allowed and active (the VLAN exists on this switch); and allowed, active and not pruned (forwarding in spanning tree). A VLAN that is allowed but not active has not been created locally. A VLAN blocked by spanning tree or pruned would still appear as active but be missing from the third list.

   Ref QB-3J55TTSource: Cisco CCNA 200-301 Exam Topics — 2.2.a Trunk portsReport a problem with this question

10. 10. Two switches are connected, and both ports are left in DTP dynamic auto mode with no other trunking configuration. What is the operational mode of the link?

    • A.Err-disabled, because two passive DTP ports are in conflict
    • B.Trunk, because both sides are willing to negotiate a trunk
    • C.Trunk, but only after both switches share a VTP domain name
    • D.Access, because neither side actively asks to form a trunk✓ Answer

    Dynamic auto is passive: it agrees to trunk only if the other side asks. When both ends are passive, no one sends the request, so the link stays an access link. A trunk forms with auto plus desirable, desirable plus desirable, or trunk plus either dynamic mode. Because negotiation is unpredictable and a security risk, best practice hard-codes the mode and disables DTP.

    Ref QB-27GX6FSource: Cisco CCNA 200-301 Exam Topics — 2.2.a Trunk portsReport a problem with this question

11. 11. On switch ACC-2, the CDP neighbor summary shows one entry: Device ID CORE-1, Local Interface Gi0/1, Holdtime 152, Capability R S I, Port ID Gi1/0/24. Which conclusion is correct?

    • A.ACC-2 Gi1/0/24 connects to CORE-1 port Gi0/1
    • B.ACC-2 Gi0/1 connects to CORE-1 port Gi1/0/24✓ Answer
    • C.CORE-1 may be several switch hops beyond Gi0/1
    • D.CORE-1 entry expires if no update within 60 s

    Local Interface is the port on the device where the command is run, and Port ID is the neighbor's port, so ACC-2 Gi0/1 connects to CORE-1 Gi1/0/24. CDP frames are not forwarded by switches, so every neighbor is directly connected. Holdtime counts down from 180 seconds by default, so this entry would expire in 152 seconds without a new advertisement.

    Ref QB-JPN4SFSource: Cisco CCNA 200-301 Exam Topics — 2.3 Layer 2 discovery protocols (Cisco Discovery Protocol and LLDP)Report a problem with this question

12. 12. An engineer must discover a third-party switch connected to a Cisco switch using a vendor-neutral Layer 2 neighbor discovery protocol. Which protocol fits this requirement?

    • A.LLDP, a Cisco-proprietary protocol licensed to other vendors
    • B.CDP, an open IEEE 802.1AB standard supported across vendors
    • C.LLDP, an open IEEE 802.1AB standard supported across vendors✓ Answer
    • D.VTP, an open IEEE 802.1Q extension that advertises neighbors

    LLDP is defined by IEEE 802.1AB, so any vendor can implement it, which makes it the choice for mixed-vendor discovery. CDP performs the same job but is Cisco-proprietary. On Cisco switches LLDP usually has to be turned on, and its transmit and receive directions can be controlled separately per interface. VTP propagates VLAN information and does not discover neighbors.

    Ref QB-37U9CGSource: IEEE 802.1ABReport a problem with this question

13. 13. A security review recommends disabling CDP and LLDP on switch ports that face guest users and on a router interface that faces an ISP. What is the reason for this recommendation?

    • A.They negotiate trunks with any attached device, enabling VLAN hopping attacks
    • B.They relay neighbor tables across routers, exposing the whole internal network
    • C.Their cleartext adverts reveal device names, models, software and addresses✓ Answer
    • D.Their frequent adverts consume enough bandwidth to cause a denial of service

    CDP and LLDP advertisements are unauthenticated and sent in cleartext, carrying the hostname, platform, software version, management address and VLAN details. Anyone on an untrusted port can capture them for reconnaissance. They are link-local and not relayed beyond the directly connected neighbor, they use little bandwidth, and trunk negotiation is the job of DTP, not discovery protocols.

    Ref QB-KPZEXGSource: Cisco CCNA 200-301 Exam Topics — 2.3 Layer 2 discovery protocols (Cisco Discovery Protocol and LLDP)Report a problem with this question

14. 14. An engineer is bundling two links between SW1 and SW2. Which pair of channel negotiation modes, one on each switch, will form an EtherChannel?

    • A.PAgP auto on SW1 and PAgP auto mode on SW2
    • B.Static on mode on SW1 and LACP active on SW2
    • C.LACP active on SW1 and LACP passive on SW2✓ Answer
    • D.LACP passive on SW1 and LACP passive on SW2

    LACP active sends LACPDUs and passive only responds, so active with passive (or active with active) forms a bundle. Two passive ends never start negotiation, and PAgP auto with auto fails for the same reason. Static on mode sends no negotiation packets and forms a channel only with on at the other end, so it does not bundle with LACP active.

    Ref QB-Y6S9UCSource: IEEE 802.1AX (LACP)Report a problem with this question

15. 15. Two Layer 3 switches will be joined by a two-link Layer 3 EtherChannel using subnet 10.0.12.0/30. Where should SW1's address 10.0.12.1 be configured?

    • A.On the lowest-numbered member link, with the others as standby
    • B.On an SVI whose number matches the port-channel group number
    • C.On the logical port-channel, with members set as routed ports✓ Answer
    • D.On each member link, using a different address from the subnet

    In a Layer 3 EtherChannel the member interfaces are converted to routed (no switchport) ports and the bundle acts as one routed link, so the single IP address belongs on the logical port-channel interface. Addresses on individual members would break the bundle, and an SVI is for a VLAN, not for a routed port-channel.

    Ref QB-GPXEEDSource: Cisco CCNA 200-301 Exam Topics — 2.4 Configure and verify (Layer 2/Layer 3) EtherChannel (LACP)Report a problem with this question

16. 16. An EtherChannel summary on SW1 shows Po1 in use as a Layer 2 bundle; Gi0/1 is flagged as bundled and Gi0/2 as suspended. Po1 and Gi0/1 are 802.1Q trunks, while Gi0/2 is still an access port in VLAN 20. Why is Gi0/2 suspended?

    • A.The load-balancing hash has assigned no flows to Gi0/2 yet
    • B.Members must match switchport mode and VLAN settings to bundle✓ Answer
    • C.Gi0/2 is kept as a hot-standby member held in reserve by LACP
    • D.LACP allows only one active member until the peer confirms it

    All members of a bundle must share the same speed, duplex, switchport mode, access or native VLAN, allowed VLAN list and spanning-tree settings. Gi0/2 is an access port while the bundle is a trunk, so the switch suspends it. A hot-standby member would carry a different flag, and load-balancing hashing never changes a member's bundle status.

    Ref QB-Z65MZDSource: Cisco CCNA 200-301 Exam Topics — 2.4 Configure and verify (Layer 2/Layer 3) EtherChannel (LACP)Report a problem with this question

17. 17. SW1 and SW2 are joined by a healthy EtherChannel of two 1 Gbps links. A single large file transfer between two servers never exceeds about 1 Gbps. What explains this?

    • A.LACP keeps the second link as an idle standby link
    • B.Packets round-robin, so reordering throttles TCP
    • C.The bundle hashes each flow onto one member link✓ Answer
    • D.Spanning tree blocks one member link of the bundle

    EtherChannel load balancing is per flow, not per packet: a hash of MAC addresses, IP addresses or ports picks one member link for each flow, which keeps frames in order. One transfer between the same two hosts is one flow, so it is limited to a single 1 Gbps link, while many different flows spread across both. Spanning tree treats the bundle as one logical link and does not block a member.

    Ref QB-HPASKESource: Cisco CCNA 200-301 Exam Topics — 2.4 Configure and verify (Layer 2/Layer 3) EtherChannel (LACP)Report a problem with this question

18. 18. In VLAN 10, four switches advertise these bridge IDs (priority including the extended system ID, then MAC address): SW1 32778, 0000.0c11.1111; SW2 28682, 0019.aaaa.0001; SW3 32778, 0019.0000.0002; SW4 24586, 00a0.ffff.ffff. Which switch becomes the root bridge for VLAN 10?

    • A.SW4✓ Answer
    • B.SW1
    • C.SW2
    • D.SW3

    The root bridge is the switch with the lowest bridge ID, and the priority field is compared first; the MAC address matters only when priorities tie. SW4's priority of 24586 (24576 plus VLAN 10) is the lowest, so it wins even though it has the highest MAC address. SW1's low MAC would only decide a tie among equal priorities.

    Ref QB-W63MGASource: Cisco CCNA 200-301 Exam Topics — 2.5.a Root port, root bridge (primary/secondary), and other port namesReport a problem with this question

19. 19. In VLAN 20 every switch still uses the default bridge priority. An engineer applies the Rapid PVST+ feature that makes DSW1 the primary root bridge for VLAN 20. What priority value, including the extended system ID, will DSW1 now show for VLAN 20?

    • A.24596✓ Answer
    • B.4116
    • C.28692
    • D.24576

    When the current root uses the default 32768, the root primary feature sets the configured priority to 24576 (it drops 4096 below the root only if the current root priority is already lower than 24576). The displayed priority adds the extended system ID, which equals the VLAN number, so 24576 + 20 = 24596. The secondary root feature would give 28672 + 20 = 28692.

    Ref QB-EP8S3BSource: Cisco CCNA 200-301 Exam Topics — 2.5.a Root port, root bridge (primary/secondary), and other port namesReport a problem with this question

20. 20. Using short-mode path costs, non-root switch ASW3 has two paths to root bridge CORE1 in VLAN 10. Gi0/1 connects directly to CORE1 over a 1 Gbps link. Te1/1 connects over 10 Gbps to DSW2, which reaches CORE1 over another 10 Gbps link. All port priorities are default. Which port becomes ASW3's root port, and why?

    • A.Gi0/1, because it has the lower local interface number on ASW3
    • B.Te1/1, because DSW2 sends BPDUs with the lower port priority
    • C.Gi0/1, because the tie is broken by the lower sender bridge ID✓ Answer
    • D.Te1/1, because its local link has the higher bandwidth and cost 2

    Root path cost is the total to the root: Gi0/1 costs 4 (1 Gbps), and Te1/1 costs 2 + 2 = 4, so they tie. The next tiebreaker is the lowest sender bridge ID: Gi0/1 receives BPDUs from CORE1 itself, the root, whose bridge ID is lower than DSW2's. Neighbor port priority and port number are checked only after that, and the local port number is never the deciding factor.

    Ref QB-VEHFZKSource: Cisco CCNA 200-301 Exam Topics — 2.5.a Root port, root bridge (primary/secondary), and other port namesReport a problem with this question

21. 21. Under Rapid PVST+, switch SW5 has ports Fa0/1 and Fa0/2 both connected to the same legacy hub segment. Fa0/1 is the designated port for that segment. Which role and state does Fa0/2 take?

    • A.Edge port, in the forwarding state
    • B.Backup port, in the discarding state✓ Answer
    • C.Alternate port, in the discarding state
    • D.Root port, in the forwarding state

    An RSTP backup port is a discarding port that backs up the switch's own designated port on the same shared segment, which happens only when one switch has two ports on a shared medium such as a hub. An alternate port instead receives a better BPDU from a different switch and offers a backup path to the root. Neither forwards while the designated port is up.

    Ref QB-CXBAEKSource: Cisco CCNA 200-301 Exam Topics — 2.5.b Port states and rolesReport a problem with this question

22. 22. An 802.1D port that would be in the blocking, listening or disabled state is represented by which single port state in RSTP and Rapid PVST+?

    • A.Learning
    • B.Blocking
    • C.Listening
    • D.Discarding✓ Answer

    RSTP reduces the five 802.1D states to three: discarding, learning and forwarding. Blocking, listening and disabled all neither forward frames nor learn MAC addresses, so RSTP merges them into discarding. Learning and forwarding keep their meanings, and RSTP has no separate blocking or listening state.

    Ref QB-WEVS6NSource: Cisco CCNA 200-301 Exam Topics — 2.5.b Port states and rolesReport a problem with this question

23. 23. Distribution switch DSW1 is the root for all VLANs. A contractor-managed access switch connects to DSW1 port Gi1/0/10. If that switch ever sends a superior BPDU, DSW1 must block the port and then resume forwarding automatically once the superior BPDUs stop. Which feature should be enabled on Gi1/0/10?

    • A.Root guard✓ Answer
    • B.BPDU filter
    • C.BPDU guard
    • D.Loop guard

    Root guard goes on designated ports facing switches that must never become root. A superior BPDU puts the port in a root-inconsistent (blocked) state, and it recovers on its own when the superior BPDUs stop. BPDU guard err-disables a port on any BPDU and needs manual or err-disable recovery, loop guard reacts to BPDUs stopping on root or alternate ports, and BPDU filter suppresses BPDUs entirely.

    Ref QB-DXPMKMSource: Cisco CCNA 200-301 Exam Topics — 2.5.d Root guard, loop guard, BPDU filter, and BPDU guardReport a problem with this question

24. 24. Access port Fa0/12 has PortFast and BPDU guard enabled. A user connects a small managed switch that runs spanning tree, and it sends a BPDU into Fa0/12. What happens to Fa0/12?

    • A.Fa0/12 keeps forwarding and silently ignores incoming BPDUs
    • B.Fa0/12 goes root-inconsistent and recovers when BPDUs stop
    • C.Fa0/12 loses PortFast status and runs normal spanning tree
    • D.Fa0/12 is err-disabled and stays down until it is recovered✓ Answer

    PortFast lets an edge port skip straight to forwarding, which is safe only toward end hosts. BPDU guard protects that assumption: any received BPDU means a switch is attached, so the port is err-disabled and stays down until an administrator bounces it or err-disable recovery is configured. Automatic recovery is root guard behavior, and ignoring BPDUs is what BPDU filter does.

    Ref QB-TETSNHSource: Cisco CCNA 200-301 Exam Topics — 2.5.c PortFast and 2.5.d BPDU guardReport a problem with this question

Practice questions written to Cisco's published CCNA 200-301 exam topics and the IEEE and IETF standards behind them. Cisco and CCNA are trademarks of Cisco Systems, Inc.; this site is not affiliated with or endorsed by Cisco. Exam topics are revised periodically — check the current official topic list before you book. About the CCNA exam (Cisco) →