Cisco Certified Network Associate (CCNA) 200-301 Practice Test 15
Question 140
After an endpoint on VLAN 20 replies, SW1 learns its MAC address on Gi1/0/12. Operations wants to show that frames for that destination no longer flood on every eligible VLAN 20 port. Which collection of observations most directly verifies the expected forwarding change?
- Show that the STP root bridge has not changed, without inspecting destination MAC learning.
- Observe broadcast frames on VLAN 30 and assume their rate should decrease when VLAN 20 learns a destination.
- Check trunk native VLAN settings only, without looking at forwarding or captures of the tested unicast.
- Record the VLAN 20 destination MAC-to-Gi1/0/12 entry and compare SPAN captures before and after learning to confirm unicast is sent only to that port.
Explanation
Correct Answer
D:`show mac address-table` filtered by VLAN and destination confirms that the switch learned the target MAC on Gi1/0/12. A SPAN or equivalent capture then shows frames for that known destination exiting the learned port instead of being flooded to all eligible VLAN 20 ports. Comparing observations before and after a reply ties forwarding behavior to MAC learning. This is a verification decision and not the separate conceptual fault-isolation question about whether unknown unicast flooding should cross VLAN boundaries.
Incorrect Answers
A:Spanning Tree Protocol protects against Layer 2 loops and influences which ports can forward. Stable root-bridge election is useful topology evidence, but it does not show that a particular destination MAC has been learned or that its unknown-unicast flooding has ceased. The requested acceptance test is narrower: a known destination frame should be forwarded to its learned egress port. Inspect the destination's VLAN-specific MAC-table entry and capture actual traffic, rather than relying on unrelated STP stability.
B:A broadcast on VLAN 30 is intentionally distributed within that VLAN and is not the same traffic class as an unknown unicast addressed to a host in VLAN 20. Learning a VLAN 20 destination does not imply that broadcasts elsewhere should decrease. Comparing broadcast rates across VLANs would therefore be a noisy and irrelevant proxy. The acceptance criteria require the tested destination MAC and the exact VLAN 20 egress behavior before and after the forwarding-table entry is learned.
C:Native VLAN configuration determines how untagged frames are classified on an 802.1Q trunk. It does not establish that a switch has learned a particular destination MAC or stopped unknown-unicast flooding. The configuration could be correct while the destination entry ages out or is learned on the wrong port. The useful evidence is the VLAN-tagged MAC address table correlated with captures for the tested unicast flow, not a static native-VLAN setting alone.
Question 141
A Windows PC on Gi1/0/14 must belong to data VLAN 120. The switch already has VLAN 120 in its database; the port serves one untagged host, not another switch. Which interface configuration correctly places that host in VLAN 120?
- Configure `switchport mode trunk` and set native VLAN 120 for this single host.
- Apply `encapsulation dot1q 120` under the switch physical interface instead of access mode.
- Configure `switchport mode access` followed by `switchport access vlan 120` on Gi1/0/14.
- Assign `interface vlan 120` an IP address without changing Gi1/0/14 switchport membership.
Explanation
Correct Answer
C:An ordinary end-host access port carries one data VLAN without expecting an 802.1Q tag from the PC. For an IOS switchport, `switchport mode access` fixes operational access mode and `switchport access vlan 120` associates untagged ingress/egress host traffic with VLAN 120. Because the VLAN already exists, no database creation is needed for this step. Verify using `show interfaces gi1/0/14 switchport` and `show vlan brief`, then check the host obtains or uses the intended subnet configuration. An SVI or trunk setting performs a different job and does not substitute for port membership.
Incorrect Answers
A:A trunk is generally designed to carry multiple VLANs with 802.1Q tags, plus a possible untagged native VLAN. A single ordinary workstation port need not negotiate a trunk; exposing a trunk to it changes the security and traffic model unnecessarily. The requirement explicitly specifies an untagged host in one data VLAN, so access mode is appropriate.
B:`encapsulation dot1q` is a router-subinterface style command on supported router-on-a-stick interfaces, not the usual way to assign a Catalyst Layer 2 access port to a data VLAN. The PC connects to a switched interface and does not send a tag for this VLAN. Use access switchport membership instead.
D:A switched virtual interface provides a Layer 3 gateway address or management presence for a VLAN on a multilayer switch. It does not automatically move the physical Gi1/0/14 access port to VLAN 120. The VLAN can have a valid SVI while the PC remains in another broadcast domain until its access membership is corrected.
Question 142
A switching team is evaluating a deployment. An IP phone and attached computer share a physical switch access port; voice packets use a dedicated VLAN and the PC remains on a data VLAN. What approach correctly addresses the stated requirement?
- Set `switchport access vlan 110` without a voice VLAN; leave the PC connected behind the phone.
- Change the port to `switchport mode trunk` and assume the untagged PC will self-tag VLAN 20.
- Enable `ip routing` on the access switch and leave both VLAN assignments unconfigured.
- Configure `switchport mode access`, `switchport access vlan 20` and `switchport voice vlan 110` on the phone-facing interface.
Explanation
Correct Answer
D:Cisco access plus voice VLAN mode permits the workstation data traffic to remain untagged in access VLAN 20 while a supported IP phone tags voice traffic for VLAN 110. Both VLANs must exist and the upstream path must carry them.
Incorrect Answers
A:This maps the untagged PC data to voice VLAN 110 and does not separately classify voice from workstation traffic.
B:An ordinary PC sends untagged data and an access-plus-voice design does not require the access switchport to be configured as a standard trunk.
C:Layer 3 routing cannot establish the required Layer 2 voice/data classification on the shared switchport.
Question 143
A proposed network design has this requirement: On a new Catalyst switch, an unconfigured access port defaults to VLAN 1, which is separate from the concept of a trunk's untagged native VLAN. Which choice is technically appropriate for that deployment?
- All new Cisco switchports operate as 802.1Q trunks in VLAN 1 unless DTP is disabled.
- Changing the uplink native VLAN automatically changes the VLAN of every access port on the switch.
- The trunk native VLAN always carries only tagged frames and cannot classify untagged traffic.
- A new switchport in access mode belongs to access VLAN 1 by default; a trunk uses its own `switchport trunk native vlan` assignment for untagged traffic.
Explanation
Correct Answer
D:Access VLAN membership and a trunk native VLAN are attributes of different switchport modes. Changing the native VLAN on a trunk does not move an unconfigured endpoint access port out of VLAN 1.
Incorrect Answers
A:An unconfigured access membership of VLAN 1 does not make a port an operational trunk.
B:An access port retains its locally assigned access VLAN until explicitly reassigned.
C:The native VLAN commonly classifies untagged frames on a standard 802.1Q trunk; nonnative VLANs are tagged.
Question 144
A router uses Gi0/0 to connect to a switch trunk carrying VLAN 10 (192.0.2.0/24) and VLAN 20 (198.51.100.0/24). The router needs to be the default gateway for both groups. Which configuration model permits the one physical router link to route each tagged VLAN correctly?
- Assign both IPv4 subnet gateway addresses directly to the same untagged Gi0/0 interface and keep the switch port in access mode.
- Configure VLAN 10 as the trunk native VLAN on both sides and expect VLAN 20 traffic to route without a second tagged subinterface.
- Configure Gi0/0.10 and Gi0/0.20 subinterfaces with `encapsulation dot1q 10` and `encapsulation dot1q 20`, assigning a gateway IP in the corresponding subnet to each.
- Enable PortFast on Gi0/0 and remove both subinterface encapsulation statements so the router learns both VLANs from STP.
Explanation
Correct Answer
C:Router-on-a-stick places one logical routed interface per VLAN on a shared physical Ethernet link. On each router subinterface, `encapsulation dot1q` identifies the associated VLAN tag; the router gives that subinterface an IPv4 gateway in the correct subnet. The switch-facing link must operationally trunk both VLANs and allow their tags. After configuration, inspect the subinterfaces, the switch trunk's allowed and active VLAN lists, and reachability to each gateway. A connected route for each subnet should appear when the logical and physical interfaces are operational. The router does not learn VLAN membership from spanning tree.
Incorrect Answers
A:One untagged router interface cannot simultaneously distinguish frames arriving from two separately tagged Layer 2 VLANs solely by holding multiple IPv4 addresses. Keeping the switch link in access mode also restricts its traffic to one data VLAN. Routing needs a distinct logical ingress context for VLAN 10 and VLAN 20 or separate routed physical links.
B:A native VLAN covers the special handling of untagged frames on an 802.1Q trunk; it does not automatically make all other VLANs accessible to a routed interface. VLAN 20's tagged frames still require a matching router subinterface or other appropriate Layer 3 endpoint. Trunk native settings are not substitutes for subinterface encapsulation.
D:PortFast affects spanning-tree edge behavior on suitable switch-facing hosts; it is not a router subinterface tagging mechanism. Removing the `encapsulation dot1q` commands prevents the router from selecting the appropriate logical VLAN context for tagged traffic. The design should preserve correct trunking and separate VLAN gateway subinterfaces.
Question 145
A multilayer distribution switch routes VLAN 10 and VLAN 20 through switch virtual interfaces with IP routing enabled. The team needs a solution consistent with this requirement. Which option is the most appropriate design or configuration decision?
- Create two VLAN IDs only and disable `ip routing` while expecting traffic to cross subnet boundaries.
- Put both subnets on one unnumbered access port with no SVI addresses.
- Configure only a switchport native VLAN on the distribution uplink, leaving SVIs down.
- Create `interface vlan 10` and `interface vlan 20` with valid gateway IPv4 addresses, enable `ip routing`, and ensure the SVIs are operational.
Explanation
Correct Answer
D:A multilayer switch routes between directly connected SVI subnets when their Layer 3 interfaces are up and IP forwarding is enabled. Hosts must use the appropriate SVI gateway addresses and the VLANs need active Layer 2 connectivity.
Incorrect Answers
A:VLAN creation provides Layer 2 separation; it does not supply the Layer 3 routing process and SVI gateway function.
B:One unnumbered Layer 2 port cannot serve as an IP next-hop for two separate routed VLAN networks.
C:Trunk native classification cannot substitute for operational routed gateways on the multilayer switch.
Question 146
A switching team is evaluating a deployment. VLAN 30 devices on two access switches must share one Layer 2 broadcast domain through an 802.1Q trunk. What approach correctly addresses the stated requirement?
- Create VLAN 30 on each relevant switch, allow VLAN 30 across the operational 802.1Q trunk, and confirm spanning-tree forwarding for that VLAN.
- Allow VLAN 30 only on SW1 while pruning it on SW2; expect SW2 VLAN 30 broadcasts to arrive.
- Place SW1 hosts in access VLAN 30 and SW2 hosts in access VLAN 31 without any VLAN translation.
- Assign a default gateway for VLAN 30 but leave VLAN 30 absent on the far switch.
Explanation
Correct Answer
A:A VLAN remains one broadcast domain across switches only if it exists on both ends and traverses their working trunk without filtering or STP blocking. `show interfaces trunk` and VLAN membership verify those conditions.
Incorrect Answers
B:The remote operational trunk must carry that VLAN in both directions; pruning at one end defeats the L2 extension.
C:Different VLAN IDs remain distinct broadcast domains even if the trunks are physically up.
D:A routed gateway does not create missing Layer 2 VLAN membership across a trunk.
Question 147
Switch SW1 has VLAN 30 assigned to Gi1/0/4 and Gi1/0/5. Both ports carry production clients. VLAN 30 will be retired and clients moved to existing VLAN 40 with a different gateway and DHCP scope. Which change sequence best avoids stranding clients?
- Delete VLAN 30 immediately, then wait for the switches to reassign both ports automatically.
- Change the trunk native VLAN to 40 but leave both access ports assigned to VLAN 30.
- Prepare VLAN 40 and its gateway, reassign both access ports and confirm client connectivity, then delete VLAN 30.
- Remove VLAN 30 from the router interface but leave VLAN 30 configured on all access ports permanently.
Explanation
Correct Answer
C:First ensure the replacement VLAN exists where required, is permitted on the relevant trunks, has a functioning default gateway and DHCP scope, and satisfies the destination security policy. Move Gi1/0/4 and Gi1/0/5 using the access VLAN setting, then verify both clients lease appropriate addresses and reach their gateway and required services. Only after inventory and connectivity checks confirm no production dependencies remain should VLAN 30 be removed. This sequence controls the actual interruption risk. It distinguishes access-VLAN membership from the trunk native VLAN and treats client addressing as part of successful migration, rather than assuming deleting the old VLAN will move devices automatically.
Incorrect Answers
A:Deleting an in-use VLAN does not safely migrate access ports to the replacement VLAN. Depending on platform, ports assigned to a deleted VLAN may remain configured for that missing VLAN and become inactive for normal user forwarding. Devices may retain old DHCP leases or gateway settings. Removing the VLAN first creates avoidable downtime instead of a validated client migration.
B:A native VLAN is a trunk-side treatment for untagged 802.1Q frames; it is not a replacement for the data VLAN assignment on two host-facing access ports. If Gi1/0/4 and Gi1/0/5 remain access VLAN 30, changing a trunk native VLAN to 40 can create additional traffic mapping inconsistencies. It does not update client addressing or prove the VLAN 40 gateway works.
D:Removing the old router VLAN interface while clients still use VLAN 30 strips their Layer 3 gateway before migration. Keeping the unused access VLAN indefinitely defeats the retirement objective and leaves a confusing, potentially broken state. The safe sequence provisions the new path, moves hosts and tests services, then removes obsolete connectivity. Merely preserving switch configuration does not preserve operational reachability.
Question 148
A switching team must implement a change. A phone sends tagged voice frames in VLAN 110 and passes workstation frames untagged in access data VLAN 20. Which technical decision most directly meets these requirements?
- Assign access VLAN 20 and voice VLAN 110 on the edge switchport; let the phone tag VLAN 110 and bridge the PC untagged in VLAN 20.
- Assign access VLAN 110 and voice VLAN 20, reversing the required phone and desktop roles.
- Leave only access VLAN 20, so both phone and desktop send untagged traffic in VLAN 20.
- Configure the desktop NIC to tag 110 while leaving the phone untagged in VLAN 20.
Explanation
Correct Answer
A:With Cisco voice-VLAN operation, the phone can prioritize tagged voice frames while passing desktop data as ordinary untagged access traffic. On a supported phone/switch combination, CDP or LLDP-MED can advertise the voice VLAN policy.
Incorrect Answers
B:The stated design explicitly requires voice in 110 and untagged PC data in 20.
C:That loses the specified separate tagged voice broadcast domain.
D:This swaps which endpoint uses the tagged voice VLAN and does not meet the given phone/PC roles.
Question 149
A PC connected to Gi1/0/18 has carrier and learns a MAC-table entry on that interface. Its address is 10.120.4.18/24 and the gateway should be 10.120.4.1, but `show interfaces gi1/0/18 switchport` reports access VLAN 130 while the gateway SVI is on VLAN 120. What is the first correction?
- Move Gi1/0/18's access membership to VLAN 120 and verify its Layer 2 reachability to the VLAN 120 gateway.
- Make Gi1/0/18 a trunk and leave the workstation untagged to carry both VLAN 120 and 130.
- Change the gateway address to 10.130.4.1 but keep the PC in the 10.120.4.0/24 subnet.
- Enable OSPF on Gi1/0/18 so the access switch can route frames to the VLAN 120 SVI.
Explanation
Correct Answer
A:A link-up state and a learned source MAC establish that Ethernet frames arrive, but not that the port belongs to the correct VLAN. An access port in VLAN 130 cannot ordinarily use the Layer 2 broadcast domain of VLAN 120 to ARP for the intended 10.120.4.1 gateway. Correct `switchport access vlan 120`, preserve access mode, and verify the VLAN exists and is carried on any required uplink. Afterward inspect VLAN membership, ARP and IP reachability. Changing routing before fixing this specific VLAN mismatch would address the wrong layer.
Incorrect Answers
B:A trunk expects tagged VLAN traffic for most VLANs and is intended for infrastructure or VLAN-aware endpoints. The PC is an ordinary untagged workstation; converting the port to a trunk does not automatically put its traffic into VLAN 120 and may instead map it to a native VLAN. The direct issue is wrong access membership.
C:Changing only a router's gateway IP to a different third-octet network would make it inconsistent with the PC's existing 10.120.4.0/24 address. The stated design requires VLAN 120 and gateway 10.120.4.1. Fix the port's Layer 2 domain first; do not introduce a new IP mismatch to mask it.
D:OSPF is a Layer 3 routing protocol between participating routers, not a method to turn a host-facing Layer 2 access port into a routed gateway. An Ethernet switch can learn the workstation MAC while the host still cannot ARP for an SVI in another VLAN. Verify correct access VLAN association before considering routing.
Question 150
A switchport connects a Cisco IP phone with a PC behind its PC port. The design requires PC data VLAN 20 and phone voice VLAN 120. `show interfaces Gi1/0/7 switchport` instead reports access VLAN 20 and voice VLAN 20. Phones and PCs receive addresses from the same subnet. What is the most direct diagnosis?
- The configured voice VLAN matches the data access VLAN, so voice and PC traffic are not placed in the intended distinct VLANs.
- The trunk native VLAN on an unrelated switch uplink must be 120, so all user devices share a subnet.
- The IP phone cannot pass untagged PC traffic unless the access port is administratively shut down.
- The switch must disable CDP to let the phone learn its voice VLAN.
Explanation
Correct Answer
A:The switchport explicitly places both roles into VLAN 20. A supported Cisco phone typically tags voice traffic for the configured voice VLAN while forwarding attached PC data via the access VLAN. The intended design calls for voice VLAN 120 and data VLAN 20; using 20 for both defeats the segmentation. Correct the `switchport voice vlan` configuration to 120, ensure the VLAN and routing/DHCP paths exist, then verify the phone and PC obtain addresses from their intended networks. This fault is visible in the access-port switchport output itself; changing unrelated trunks first is not justified. Verify both devices' leases after the change rather than assuming matching VLAN IDs are harmless.
Incorrect Answers
B:A trunk's native VLAN controls untagged treatment across an 802.1Q trunk, not the per-host voice VLAN value shown on Gi1/0/7. A native-VLAN mismatch elsewhere can disrupt certain traffic, but it does not explain why this access interface explicitly reports voice VLAN 20 instead of the required 120. First repair the direct configuration discrepancy.
C:Cisco phones commonly bridge an attached PC through the phone's integrated switch, with PC traffic untagged on the access data VLAN and voice traffic tagged according to the voice VLAN policy. An administrative shutdown would prevent the needed link rather than allow separation. The observation is an incorrect VLAN assignment, not proof that PC traffic requires the switchport to be disabled.
D:CDP can advertise voice VLAN information to compatible phones. Disabling it can remove useful discovery data and does not correct the access-port `switchport voice vlan` setting. Some environments use LLDP-MED, but the essential problem is that the configured voice VLAN equals the data VLAN, not the specific neighbor discovery protocol. Verify the intended advertised policy and the data/voice VLANs after correcting configuration.