Cisco Certified Network Associate (CCNA) 200-301 Practice Test 17
Question 160
A switching team is validating a repair. Earlier, VLAN 20 hosts have a working switch trunk but the router lacks Gi0/0.20 with encapsulation dot1q 20 and an IP gateway. Which postchange check most directly establishes the specific problem is resolved?
- Confirm only the physical router Gi0/0 has carrier, while Gi0/0.20 remains absent.
- Check that VLAN 30 can ping its own gateway and assume VLAN 20 must now route too.
- `show running-config interface Gi0/0.20` confirms `encapsulation dot1Q 20` and a valid VLAN 20 gateway IP; a VLAN 20 host can reach that address.
- Change only the trunk native VLAN and do not inspect VLAN 20 router tagging.
Explanation
Correct Answer
C:The prior root cause was a missing router subinterface. Inspect the exact subinterface tag and IP, plus an endpoint gateway reachability test, to establish both configuration and function.
Incorrect Answers
A:An up physical parent cannot supply the missing per-VLAN Layer 3 interface.
B:One VLAN’s success does not prove another absent router-on-a-stick subinterface exists.
D:The necessary 802.1Q ID and gateway IP for VLAN 20 remain unverified.
Question 161
The earlier fault was recorded as follows: show ip interface brief lists Vlan20 as down/down because the VLAN has no active forwarding Layer 2 member; the physical trunk itself is up. After corrective work, which observation provides direct evidence that the affected function now behaves correctly?
- The physical interswitch trunk is up but `Vlan20` still shows down/down and no eligible VLAN 20 forwarding member.
- A different SVI `Vlan30` is up/up while `Vlan20` stays down.
- VLAN 20 has an IP address in running configuration but remains administratively shut.
- `show ip interface brief` now shows SVI `Vlan20` up/up with an active Layer 2 VLAN 20 path, and client gateway connectivity succeeds.
Explanation
Correct Answer
D:On many Catalyst platforms, SVI line protocol depends on the VLAN being active and having an eligible forwarding Layer 2 member. Restoring an eligible port and verifying SVI protocol and host reachability tests the reported failure.
Incorrect Answers
A:The earlier symptom persists even though physical carrier is healthy.
B:Another VLAN’s operational SVI cannot prove the faulty VLAN 20 SVI is restored.
C:Configured addressing without up/up line state does not demonstrate restored usable gateway function.
Question 162
Hosts in VLAN 30 are on different switches linked by an 802.1Q trunk. Both local access ports are in VLAN 30, but frames do not reach the remote switch. Which combined validation directly checks that VLAN 30 exists on both switches and traverses the trunk?
- Inspect only show mac address-table on the source switch
- Check physical link status with show interfaces status on one switch
- Read the default gateway route table without examining switchports
- Compare show vlan brief on both switches and show interfaces trunk for allowed and forwarding VLAN 30
Explanation
Correct Answer
D:VLAN 30 must exist and be active in both switches for ordinary VLAN-specific switching. The 802.1Q link must operate as a trunk and include VLAN 30 in its permitted and forwarding set, rather than pruning it or having spanning tree block it. Use show vlan brief on each switch to confirm local VLAN presence, then show interfaces trunk at both ends to examine operational trunk status and the VLAN lists. If those checks pass, inspect spanning-tree vlan 30 for a blocking state and MAC learning or traffic counters for actual frame transit. This paired check distinguishes local access membership from end-to-end trunk propagation and directly addresses the failure.
Incorrect Answers
A:A learned MAC on the source switch establishes that the source frame was seen on a local Layer 2 segment. It does not prove the destination VLAN exists on the remote switch, that the trunk permits the VLAN, or that spanning tree allows forwarding. MAC learning is valuable during later troubleshooting, but it is insufficient for the stated end-to-end VLAN existence and trunk propagation test.
B:An Ethernet uplink can show connected while a trunk prunes VLAN 30 or the neighboring switch lacks that VLAN entirely. Link and speed information do not reveal which 802.1Q tags are allowed and active. The problem states local access ports are correctly assigned; the missing question is whether their broadcast domain reaches both switches. Link status alone cannot establish that, even with a clean error-counter reading.
C:The gateway route table describes Layer 3 forwarding and may be completely correct while VLAN 30 frames fail to cross the intervening Layer 2 trunk. The source and destination hosts are in the same VLAN, so they rely on switching across that link before routing comes into play. Reading only the gateway cannot prove VLAN presence, allowed VLANs, or spanning-tree forwarding on the switch uplink.
Question 163
A campus team plans to remove VLAN 220 from two connected access switches. Several printers still use access ports in VLAN 220, and the team has approved their move to VLAN 230. Which final acceptance test demonstrates that the old VLAN was removed safely without stranding the printers?
- Confirm only that VLAN 220 no longer appears in show vlan brief on the first switch
- Check the voice-VLAN settings of one unrelated IP phone on VLAN 10
- Check only the VLAN database and one port assignment on the second switch, without end-to-end traffic tests
- Verify every affected printer port now uses VLAN 230 on both switches, confirm VLAN 220 is absent on both, and test printer-to-gateway connectivity through the replacement VLAN
Explanation
Correct Answer
D:A safe VLAN migration requires checking both configuration and the operational result. First verify that each previously attached printer port was reassigned to VLAN 230 on both access switches, then confirm that VLAN 220 is no longer present where removal was approved. Finally test reachability from representative printers through VLAN 230 to their intended default gateway and any required local destination. This establishes that active endpoints were not left in a nonexistent VLAN and that the interswitch and routed path still carry their traffic. Simply deleting a VLAN or reading one switch's database is insufficient proof of successful migration.
Incorrect Answers
A:Deleting VLAN 220 on the first switch proves only that its local VLAN database changed. A printer connected to the second switch might still be assigned to the removed VLAN or lose connectivity when the interswitch trunk no longer carries it. The acceptance criterion requires that all live access ports were migrated and the replacement path works end to end. One switch's VLAN absence cannot demonstrate those operational outcomes.
B:Voice-VLAN configuration is relevant for IP phones sharing access links with workstations. It has no direct bearing on whether printers attached to VLAN 220 were moved to VLAN 230 across both switches. A properly configured phone on VLAN 10 could coexist with printers being stranded by an incomplete migration. The test must target the actual affected endpoints and their Layer 2 and Layer 3 connectivity, not unrelated service settings.
C:Inspecting the VLAN database and one access port on the second switch checks only a subset of the migration. Other printer ports may remain assigned to the removed VLAN, and a trunk allowed-list or gateway configuration problem could prevent traffic from reaching the intended subnet even when local membership looks correct. A valid signoff needs complete affected-port coverage and a live connectivity test across the intended path.
Question 164
Two switches must carry data VLANs 100 and 200 across one Gi1/0/48 uplink. Host-facing switch ports should remain access ports. Which uplink configuration is appropriate when the switches support 802.1Q?
- Configure the uplink as access VLAN 100 only, relying on VLAN 200's different IP addresses to cross the link.
- Give the link two static IPv4 routes and leave both physical switchports untagged in VLAN 1.
- Configure Gi1/0/48 as an 802.1Q trunk on both switches and permit VLANs 100 and 200 consistently.
- Configure PortFast and BPDU Guard on the interswitch link as though it served an endpoint.
Explanation
Correct Answer
C:An interswitch link that carries more than one Layer 2 broadcast domain needs a method to distinguish VLAN membership in the frames. An 802.1Q trunk inserts VLAN tags for nonnative VLAN traffic and can be restricted with an allowed-VLAN list. Set compatible trunk and native VLAN policies at both ends, allow VLANs 100 and 200, and verify with `show interfaces trunk` plus VLAN state. Access ports facing PCs continue to carry their assigned VLAN untagged. This solution preserves separation instead of expecting IP addresses alone to multiplex multiple VLANs on a single access port.
Incorrect Answers
A:A switchport in access mode assigns its untagged frames to one VLAN at a time. Choosing VLAN 100 does not transport VLAN 200 frames simply because some devices have VLAN 200 IP addresses. Those frames need an allowed tag or a separate physical link, not a second address range on the same access port.
B:Static routes are Layer 3 forwarding entries; they cannot make two Layer 2 switches carry multiple VLANs across an untagged access uplink. Even if a routed gateway exists elsewhere, the intermediate switchport must properly transport the data and VLAN 200 frames. Configure and verify trunking instead.
D:A switch-to-switch link is not a normal host-facing edge port. PortFast can bypass a key transition in spanning-tree control, and BPDU Guard can errdisable a port upon receiving BPDUs from the neighbor switch. Both settings are inappropriate as a default replacement for trunk configuration on an infrastructure link.
Question 165
An interswitch trunk must permit VLANs 10, 20 and 30 while intentionally restricting unused VLANs. The team needs a solution consistent with this requirement. Which option is the most appropriate design or configuration decision?
- Set operational trunks on both switch ends and permit precisely `10,20,30` with `switchport trunk allowed vlan 10,20,30`.
- Use `switchport trunk allowed vlan 10,20` and assume VLAN 30 is forwarded because it exists in the database.
- Set both ends to access VLAN 10 while expecting VLAN 20 and 30 tags to pass.
- Permit all VLANs indiscriminately and rely solely on native VLAN 10 to restrict VLAN 40.
Explanation
Correct Answer
A:The allowed list determines which VLAN tags may traverse a trunk. Apply the intended list on both peers, ensure the VLANs exist and check `show interfaces trunk` for forwarding state.
Incorrect Answers
B:Existing VLAN configuration does not override an allowed list that explicitly omits VLAN 30.
C:An operational access port carries its selected access VLAN rather than a multi-VLAN dot1q trunk.
D:Changing the native VLAN does not limit the set of other allowed tagged VLAN IDs.
Question 166
A switching team is evaluating a deployment. Both sides of an 802.1Q trunk must agree on how untagged frames are mapped to the native VLAN. What approach correctly addresses the stated requirement?
- Set native VLAN 99 on the first switch but native VLAN 1 on the second switch.
- Set the same `switchport trunk native vlan 99` on both peers and ensure VLAN 99 is configured where needed.
- Set identical access VLANs on unrelated host ports and leave the trunk native IDs different.
- Allow VLAN 99 on both ends but leave distinct native VLAN IDs unchanged.
Explanation
Correct Answer
B:Ordinary untagged frames entering an 802.1Q trunk are associated with the local native VLAN. Using the same native VLAN at both ends prevents the peers from classifying those frames into different VLANs.
Incorrect Answers
A:An untagged frame sent as native 99 would be classified by the receiving switch as VLAN 1; this is a mismatch.
C:Endpoint access membership does not resolve a mismatch on the interswitch trunk.
D:The VLAN allowlist and native untagged classification are separate operational properties.
Question 167
A proposed network design has this requirement: An interswitch link carries more than one VLAN, whereas an endpoint access link carries one untagged data VLAN. Which choice is technically appropriate for that deployment?
- Use an access port between switches and expect simultaneous independent VLAN 10 and VLAN 20 frames to remain separated.
- Configure the PC-facing access port as a trunk and require an unmodified PC to interpret multiple 802.1Q VLANs.
- Use an operational 802.1Q trunk for the interswitch multi-VLAN uplink; keep ordinary single-VLAN PC connections in access mode.
- Use a router static default route to substitute for VLAN tags across the shared physical switch link.
Explanation
Correct Answer
C:The trunk carries traffic from multiple VLAN broadcast domains by tagging nonnative frames, while an access switchport normally maps untagged desktop Ethernet to its one access VLAN.
Incorrect Answers
A:Without a tagged trunk or special encapsulation, one access port cannot transport both VLAN identities independently.
B:A typical workstation NIC does not automatically manage a switch trunk; the stated endpoint needs one untagged data VLAN.
D:Layer 3 forwarding configuration does not encode multiple VLAN IDs on a Layer 2 trunk.
Question 168
A switching team must implement a change. Two Cisco switch ports should form a trunk using explicit switchport mode trunk or complementary DTP negotiation modes. Which technical decision most directly meets these requirements?
- Configure `switchport mode dynamic auto` at both ends and expect each side to initiate negotiation.
- Configure `switchport mode access` at both ends and assume DTP will force tagging.
- Turn off DTP negotiation with `switchport nonegotiate` while leaving both ports in dynamic auto mode.
- Configure `switchport mode trunk` on the intended Cisco trunk peers, or pair `dynamic desirable` with `dynamic auto` where DTP is supported and permitted.
Explanation
Correct Answer
D:A hard trunk does not require negotiation, whereas DTP desirable actively negotiates and auto waits for a compatible neighbor. Both peers in dynamic auto ordinarily will not initiate a trunk.
Incorrect Answers
A:Neither auto port initiates the DTP request needed to form the trunk in this pairing.
B:An explicit access-mode port is not negotiating an operational trunk.
C:Disabling negotiation cannot create a DTP-negotiated trunk from two passive auto ports.
Question 169
An 802.1Q switch trunk connects to a router with separate dot1q-tagged subinterfaces for each routed VLAN. The team needs a solution consistent with this requirement. Which option is the most appropriate design or configuration decision?
- Put all the VLAN gateway IPs on the router physical parent without VLAN encapsulation.
- Configure every router subinterface with `encapsulation dot1Q 1` while the switch sends VLAN 20 and 30 tags.
- Set the uplink to ordinary access mode and expect simultaneous VLAN 20 and 30 tags to reach router subinterfaces.
- Make the switch-facing router link a trunk and configure each routed router subinterface with its correct `encapsulation dot1Q <vlan-id>` and gateway address.
Explanation
Correct Answer
D:Router-on-a-stick distinguishes VLANs with matching dot1q subinterfaces. Frames for nonnative VLANs are tagged with their VLAN IDs on the switch trunk and are terminated by corresponding router subinterfaces.
Incorrect Answers
A:A physical parent without matching VLAN subinterfaces does not identify which arriving tagged frames belong to each logical routed VLAN.
B:The VLAN IDs would not match the nonnative tags received for those logical networks.
C:An access port does not carry the required distinct VLAN 802.1Q tags.
Question 170
A switching team is evaluating a deployment. A plain PC access port sends untagged Ethernet, while the uplink trunk adds 802.1Q tags to nonnative VLAN traffic. What approach correctly addresses the stated requirement?
- Leave the PC link in access VLAN 20 for untagged frames, and use a trunk that tags VLAN 20 if VLAN 20 is not the trunk native VLAN.
- Tag every PC Ethernet frame with a trunk VLAN header before the host receives it, despite its ordinary untagged access NIC.
- Strip all VLAN IDs from the trunk and infer the original VLAN purely from source MAC addresses.
- Use the PC default gateway address as the 802.1Q VLAN tag field.
Explanation
Correct Answer
A:Cisco access ports associate ordinary untagged Ethernet with one access VLAN. An 802.1Q trunk includes a tag for nonnative VLANs to preserve separate broadcast domains over one link.
Incorrect Answers
B:An ordinary access port presents untagged frames to the PC; internal trunk tagging is a separate switch-uplink function.
C:Without encapsulation the receiving switch cannot generally recover several simultaneous VLAN identities from one interswitch link.
D:A VLAN ID is a Layer 2 dot1q identifier, not an IPv4 next-hop address.