Examkin

Interswitch Connectivity and Trunking (802.1Q)

61 questions

All types61Multiple choice31Multiple select14Ordering16
Question 1Question →

A network engineer needs to configure a static IEEE 802.1Q trunk link on Cisco switch interface GigabitEthernet0/1, disable Dynamic Trunking Protocol (DTP) negotiation, and configure VLAN 99 as the untagged native VLAN. Place the following CLI configuration commands in the correct logical execution sequence from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct execution order is: interface GigabitEthernet0/1, switchport trunk encapsulation dot1q, switchport mode trunk, switchport nonegotiate, and switchport trunk native vlan 99.
The CLI commands follow strict Cisco IOS configuration order dependencies. First, access the interface mode with 'interface GigabitEthernet0/1'. Second, set encapsulation using 'switchport trunk encapsulation dot1q'. Third, enable static trunking with 'switchport mode trunk'. Fourth, disable DTP frames using 'switchport nonegotiate' (which fails if the port is in dynamic DTP mode). Finally, assign untagged traffic processing using 'switchport trunk native vlan 99'.

Step-by-Step Solution

1
Enter interface configuration mode
Context changes to Switch(config-if)# for GigabitEthernet0/1
CLI commands affecting a specific port require entering that interface context first.
2
Set trunk encapsulation to IEEE 802.1Q
Interface protocol encapsulation set to dot1q
Cisco IOS platforms supporting both ISL and 802.1Q require explicit encapsulation specification before changing mode to trunk.
3
Configure operational mode to static trunk
Interface changes state to unconditional trunking mode
Establishes trunk operational state.
4
Disable Dynamic Trunking Protocol negotiation
DTP frame transmission is stopped on the interface
The 'switchport nonegotiate' command is rejected by Cisco IOS if the interface remains in dynamic auto or dynamic desirable mode.
5
Modify the native VLAN identifier
VLAN 99 becomes the untagged VLAN for IEEE 802.1Q traffic
Applies non-default native VLAN parameter to prevent native VLAN mismatch security issues.

Key Concept

IEEE 802.1Q Trunk Configuration and DTP Suppression Sequence
Estimated Time:1m 30s
Question 2Question →

Place the steps of IEEE 802.1Q frame processing in sequential order, starting from when a host sends traffic on VLAN 20 until it is delivered to a host on another switch across an 802.1Q trunk link.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The sequence starts when the ingress switch receives an untagged frame from a host on a VLAN 20 access port, inserts a 4-byte 802.1Q tag into the frame header, transmits the tagged frame over the trunk link, the egress switch reads the VLAN ID from the tag, removes the 802.1Q header, and delivers the untagged frame out the access port to the destination host.
When a frame traverses an IEEE 802.1Q trunk link, the ingress switch inserts a 4-byte tag into the frame header to identify the originating VLAN (unless it is the native VLAN). The frame travels across the physical trunk link carrying this tag. Upon reaching the remote switch, the egress switch inspects the tag to determine the VLAN association, strips the 4-byte tag header, and delivers the original untagged Ethernet frame to the destination device connected to an access port in that VLAN.

Step-by-Step Solution

1
Receive untagged frame at ingress switch.
The ingress switch accepts the standard frame from the host on a port configured as an access port in VLAN 20.
Host end devices transmit standard untagged Ethernet frames.
2
Encapsulate frame with 802.1Q tag.
The switch inserts a 4-byte 802.1Q header between the Source MAC address and Length/Type fields.
IEEE 802.1Q tagging allows multiplexing multiple VLANs over a single interswitch trunk.
3
Send frame across trunk link.
The tagged frame is transmitted over the trunk interface toward the neighboring switch.
The tag remains intact during transmission across the trunk.
4
Process tag at egress switch.
The egress switch receives the frame and reads the 12-bit VLAN ID (VID) field in the 802.1Q header.
The receiving switch uses the VLAN ID to associate the frame with internal VLAN 20.
5
Decapsulate (strip) 802.1Q header.
The 4-byte 802.1Q tag is removed from the frame header.
End-user devices do not expect 802.1Q tags on access port connections.
6
Forward untagged frame to destination host.
The frame is sent out the matching VLAN 20 access port to the end device.
This completes the end-to-end Layer 2 delivery across switches.

Key Concept

IEEE 802.1Q Frame Encapsulation, Tagging, and Decapsulation Mechanics
Question 3Question →

A network administrator needs to manually configure a static IEEE 802.1Q trunk on a Cisco Catalyst switch interface (GigabitEthernet0/1), set the native VLAN to VLAN 50, and disable Dynamic Trunking Protocol (DTP) frame transmission. What is the correct sequence of Cisco IOS configuration commands to accomplish this task?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with entering interface configuration mode (`interface GigabitEthernet0/1`), explicitly setting the switchport mode to static trunk (`switchport mode trunk`), specifying the untagged native VLAN (`switchport trunk native vlan 50`), and finally disabling DTP frame negotiation (`switchport nonegotiate`).
To properly configure an 802.1Q trunk link with a custom native VLAN and suppressed DTP, an engineer must first enter interface configuration mode (`interface GigabitEthernet0/1`). Next, the port operational mode must be set to static trunking (`switchport mode trunk`). Once the port is in static trunk mode, the native VLAN can be configured (`switchport trunk native vlan 50`), followed by disabling DTP negotiations (`switchport nonegotiate`).

Step-by-Step Solution

1
Enter interface configuration mode
Prompt changes to Switch(config-if)# for GigabitEthernet0/1
Cisco IOS requires navigating to the specific interface context before executing port configuration commands.
2
Set interface mode to trunk
Interface transitions to static trunk operational mode
Static trunking must be active before setting trunk-specific parameters or disabling dynamic DTP negotiation.
3
Specify custom native VLAN
VLAN 50 is assigned as the native VLAN for untagged ingress and egress frames
Overrides the default native VLAN 1 setting on the trunk link.
4
Disable DTP negotiation
Switch stops sending DTP negotiation frames out GigabitEthernet0/1
The switchport nonegotiate command is only valid on interfaces configured in static access or static trunk mode.

Key Concept

Static IEEE 802.1Q trunk configuration and DTP negotiation suppression on Cisco IOS switchports
Question 4Question →

Two Cisco Catalyst switches, SW1 and SW2, are connected via an IEEE 802.1Q trunk link. Interface GigabitEthernet0/1 on SW1 is configured with native VLAN 10, while interface GigabitEthernet0/1 on SW2 is configured with native VLAN 20. When a host in VLAN 10 connected to SW1 sends a broadcast frame across the trunk link, how does SW2 process this frame upon arrival?

Show answer & explanation

Answer: SW2 receives the untagged frame on its trunk interface and forwards it to all active ports assigned to VLAN 20, causing inter-VLAN traffic leakage.

Answer

SW2 receives the untagged frame on its trunk interface and forwards it to all active ports assigned to VLAN 20, causing inter-VLAN traffic leakage.
Under IEEE 802.1Q trunking rules, frames belonging to the native VLAN are sent across the trunk link untagged. When SW1 sends a frame for VLAN 10, it strips any tag because VLAN 10 is its native VLAN. When SW2 receives this untagged frame on a trunk interface configured with native VLAN 20, SW2 associates all untagged incoming traffic with its local native VLAN (VLAN 20) and forwards it accordingly, resulting in inter-VLAN leakage between VLAN 10 and VLAN 20.

Step-by-Step Solution

1
Analyze how 802.1Q handles native VLAN egress traffic on SW1
By default, IEEE 802.1Q trunk interfaces transmit frames belonging to the configured native VLAN without inserting a 4-byte 802.1Q tag header. Thus, SW1 transmits the VLAN 10 broadcast frame untagged.
802.1Q maintains backward compatibility with legacy non-trunking devices by omitting VLAN tags on the designated native VLAN.
2
Analyze how SW2 handles untagged ingress traffic on an 802.1Q trunk
When a switch receives an untagged frame on an 802.1Q trunk port, it automatically maps that frame to whichever VLAN is locally configured as the native VLAN on that specific interface. On SW2, the native VLAN is VLAN 20.
Switches rely entirely on local interface configuration to classify incoming untagged frames.
3
Determine the operational outcome of the mismatch
The broadcast frame sent by VLAN 10 on SW1 is flooded out ports in VLAN 20 on SW2, creating an unintended security vulnerability and cross-VLAN traffic leakage.
Mismatched native VLAN configurations merge separate broadcast domains at Layer 2.

Key Concept

802.1Q Native VLAN Tagging Mechanics and Mismatch Behavior
Estimated Time:1m 30s
Question 5Question →

A network administrator is setting up interswitch connectivity using standard IEEE 802.1Q trunking. Which action does IEEE 802.1Q take on Ethernet frames to identify VLAN membership as traffic traverses the trunk link?

Show answer & explanation

Answer: It inserts a 4-byte tag containing the VLAN ID directly into the Ethernet frame header between the Source MAC address and Type/Length fields.

Answer

IEEE 802.1Q identifies VLAN membership by inserting a 4-byte header field into the Ethernet frame between the Source MAC address and the Length/Type fields.
IEEE 802.1Q performs internal frame tagging by inserting a 4-byte VLAN tag directly into the Ethernet header between the Source MAC address and the Length/Type fields. This tag includes the Tag Protocol Identifier (0x8100) and the 12-bit VLAN ID.

Step-by-Step Solution

1
Identify the standard frame modification mechanism specified by IEEE 802.1Q for interswitch trunking.
IEEE 802.1Q inserts an in-line 4-byte VLAN tag into the existing Ethernet header.
In-line tagging allows switches on both ends of the trunk link to recognize which VLAN the frame belongs to without wrapping the entire frame in a separate encapsulation wrapper.
2
Analyze the position and structure of the 802.1Q tag.
The tag is placed between the Source MAC Address field and the Length/Type field.
This 4-byte tag includes the Tag Protocol Identifier (TPID 0x8100) and Tag Control Information (TCI), which holds the 12-bit VLAN Identifier (VID).

Key Concept

IEEE 802.1Q Frame Tagging Mechanics
Question 6Question →

A Cisco Catalyst switch interface configured as an 802.1Q trunk receives an incoming frame. Place the internal operational steps executed by the switch to process this frame into the correct chronological order from frame arrival to egress forwarding.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence for 802.1Q ingress frame processing is: 1) Inspect header for TPID (0x8100), 2) Extract tagged VLAN ID or assign configured Native VLAN ID if untagged, 3) Verify VLAN against the allowed VLAN list (ingress filtering), 4) Update MAC address table for the VLAN domain, 5) Forward or flood the frame to egress ports in that VLAN.
The correct operational sequence begins when an ingress frame arrives on an 802.1Q trunk. The switch ASIC first checks for the 802.1Q TPID (0x8100). Next, it extracts the 12-bit VLAN ID from tagged frames or assigns the configured native VLAN ID to untagged frames. After determining the VLAN, the switch applies ingress filtering to verify if that VLAN ID is on the trunk's allowed VLAN list. If permitted, it updates its MAC address table associating the source MAC with that VLAN and ingress port, and finally makes the egress forwarding or flooding decision within that VLAN context.

Step-by-Step Solution

1
Inspect the Ethernet header for 802.1Q encapsulation
Identifies if the frame contains a 4-byte 802.1Q header with EtherType 0x8100.
The switch must determine whether the frame is tagged before interpreting VLAN fields.
2
Derive the internal VLAN context
Extracts the 12-bit VID from the tag header, or maps untagged traffic to the native VLAN.
802.1Q rules dictate that untagged frames belong to the native VLAN, while tagged frames belong to their explicit VID.
3
Execute ingress VLAN pruning check (allowed list filtering)
Checks if the derived VLAN is permitted by the 'switchport trunk allowed vlan' configuration.
If the VLAN is pruned/disallowed, the switch drops the frame immediately prior to MAC table processing.
4
Learn source MAC address
Adds or updates the source MAC address entry in the CAM table for the derived VLAN context.
Dynamic MAC learning occurs per-VLAN after verifying ingress permission.
5
Perform egress forwarding decision
Forwards frame to egress destination interface(s) in the matching VLAN domain.
Layer 2 forwarding logic constrains broadcast and unicast traffic strictly within the matched VLAN boundary.

Key Concept

802.1Q Trunk Ingress Frame Processing Pipeline
Estimated Time:2m 0s
Question 7Question →

An administrator is configuring an IEEE 802.1Q trunk link between two Cisco Catalyst switches. By default, how does an IEEE 802.1Q trunk process Ethernet frames that belong to the configured native VLAN across the interswitch link?

Show answer & explanation

Answer: It forwards frames belonging to the native VLAN untagged without inserting a 4-byte 802.1Q header.

Answer

IEEE 802.1Q trunks forward Ethernet frames belonging to the native VLAN untagged without inserting a 4-byte 802.1Q tag header.
Under default IEEE 802.1Q operational mechanics, frames associated with the native VLAN are forwarded across interswitch trunk links in their original Ethernet format without an inserted 4-byte 802.1Q header tag. When the receiving switch accepts an untagged frame on its trunk port, it places that frame into its local native VLAN.

Step-by-Step Solution

1
Identify the standard frame-handling behavior of IEEE 802.1Q trunking for native VLAN traffic.
IEEE 802.1Q specifies that traffic belonging to the designated native VLAN is transmitted across trunk links without a tag.
Transmitting native VLAN frames untagged allows backward compatibility with legacy switches or end-user devices that do not support VLAN tagging.
2
Compare native VLAN frame processing against tagged VLAN frame processing.
Non-native VLAN frames receive a 4-byte 802.1Q tag header, whereas native VLAN frames remain untagged.
The receiving switch inspects incoming frames on a trunk link; any frame lacking an 802.1Q tag is automatically assigned to the trunk port's configured native VLAN.

Key Concept

IEEE 802.1Q Native VLAN Untagged Traffic Handling
Question 8Question →

Two Cisco Catalyst switches, SW1 and SW2, are connected via their GigabitEthernet0/1 interfaces. SW1 is configured with `switchport mode dynamic desirable` and `switchport trunk native vlan 99`. SW2 is configured with `switchport mode dynamic auto` and retains its default native VLAN 1. Assuming default IEEE 802.1Q trunking behavior, what is the resulting operational state of this interswitch link?

Show answer & explanation

Answer: A trunking operational mode is successfully established via DTP negotiation, but PVST+ places VLAN 1 and VLAN 99 into a blocking state on the link due to a PVID inconsistency.

Answer

A trunking operational mode is successfully established via DTP negotiation, but PVST+ places VLAN 1 and VLAN 99 into a blocking state on the link due to a PVID inconsistency.
Dynamic Trunking Protocol (DTP) operates independently of native VLAN configurations, allowing a port in dynamic desirable mode to successfully negotiate an operational 802.1Q trunk with a port in dynamic auto mode. However, Cisco PVST+ sends Spanning Tree BPDUs with VLAN tagging metadata (SSTP). When the switches receive BPDUs indicating different native VLAN IDs (VLAN 99 vs VLAN 1), PVST+ flags a PVID inconsistency and places VLAN 1 and VLAN 99 into a blocking state on the interface to prevent unauthorized cross-VLAN data leakage and loops.

Step-by-Step Solution

1
Analyze DTP mode negotiation between SW1 and SW2
SW1 (`dynamic desirable`) actively sends DTP frames to SW2 (`dynamic auto`), negotiating the link into an operational 802.1Q trunk.
DTP negotiation only evaluates DTP operational modes and encapsulation settings, not native VLAN IDs.
2
Evaluate Native VLAN configuration parameter compatibility
SW1 uses Native VLAN 99, while SW2 uses Native VLAN 1, creating a native VLAN mismatch across the trunk.
Untagged frames sent from VLAN 99 on SW1 would arrive on SW2 and be incorrectly ingested into VLAN 1.
3
Determine Spanning Tree Protocol (PVST+) operational behavior
PVST+ detects the Port VLAN ID (PVID) mismatch using Cisco Shared Spanning Tree Protocol (SSTP) BPDUs and places VLAN 1 and VLAN 99 into a `PVID-inc` (blocking) state on GigabitEthernet0/1.
Blocking the mismatched native VLANs prevents potential Layer 2 loops and cross-VLAN traffic leakage while allowing other matching VLANs to continue forwarding normally.

Key Concept

802.1Q Native VLAN Mismatch and PVST+ PVID Inconsistency Protection
Estimated Time:2m 0s
Question 9Question →

A network administrator is troubleshooting interswitch trunking between SW-Core1 and SW-Access1. The administrator issues the `show interfaces trunk` command on SW-Core1 and observes the following output:

PortModeEncapsulationStatusNative vlan
Gi0/24on802.1qtrunking10
PortVlans allowed on trunk
Gi0/241-4094
PortVlans allowed and active in management domain
Gi0/241,10,20,30
PortVlans in spanning tree forwarding state and not pruned
Gi0/241,10,30

Users in VLAN 20 connected to SW-Access1 report complete loss of connectivity to resources in VLAN 20 connected to SW-Core1, whereas users in VLAN 10 and VLAN 30 report normal operation. Based on the command output, what is the cause of the communication failure for VLAN 20?

Show answer & explanation

Answer: VLAN 20 is not in the Spanning Tree Protocol forwarding state (or has been pruned) on interface GigabitEthernet0/24.

Answer

VLAN 20 is missing from the Spanning Tree Protocol forwarding state list on the trunk interface, preventing frames in VLAN 20 from being forwarded across the link.
The correct answer identifies that VLAN 20 is absent from the final section of the output: 'Vlans in spanning tree forwarding state and not pruned'. For traffic to pass across an 802.1Q trunk, a VLAN must be allowed on the trunk, active in the VLAN database, and in the STP forwarding state.

Step-by-Step Solution

1
Analyze the 'Vlans allowed on trunk' field in the CLI output.
Interface GigabitEthernet0/24 allows VLANs 1-4094, meaning no explicit manual pruning (`switchport trunk allowed vlan`) is blocking VLAN 20.
Verifies that trunk port configuration permits VLAN 20 traffic.
2
Analyze the 'Vlans allowed and active in management domain' field.
VLAN 20 is listed alongside VLAN 1, 10, and 30, confirming VLAN 20 exists in the local VLAN database and is active.
Rules out local VLAN creation or state issues on SW-Core1.
3
Compare active management VLANs against 'Vlans in spanning tree forwarding state and not pruned'.
VLANs 1, 10, and 30 are forwarding, but VLAN 20 is absent from this list.
If a VLAN is missing from the final STP forwarding section, traffic for that VLAN is either blocked by STP or dynamic VTP pruning, preventing frame transmission across the link.

Key Concept

802.1Q Trunk Operational Verification and STP Per-VLAN Forwarding States
Estimated Time:1m 30s
Question 10Question →

An engineer connects two Cisco Catalyst switches using their GigabitEthernet0/1 interfaces. Interface GigabitEthernet0/1 on Switch-1 is configured with `switchport mode dynamic auto`. Interface GigabitEthernet0/1 on Switch-2 is configured with `switchport mode trunk` followed by `switchport nonegotiate`. What is the resulting operational state of the GigabitEthernet0/1 interface on Switch-1?

Show answer & explanation

Answer: It operates as an access port because dynamic trunking negotiation frames are suppressed by Switch-2.

Answer

The interface on Switch-1 operates as an access port because dynamic trunking negotiation frames are suppressed by Switch-2.
When an interface is in dynamic auto mode, it does not initiate DTP negotiation; it only responds to incoming DTP frames. Since the remote switch interface is configured with 'switchport nonegotiate', no DTP packets are sent across the link. Consequently, the local interface remains in its default access operational state.

Step-by-Step Solution

1
Analyze Switch-1 DTP configuration
Switch-1 is configured as 'dynamic auto', meaning it will operate as an access port unless it actively receives DTP desirable or trunk negotiation frames.
Ports in dynamic auto mode wait passively for DTP proposals from the neighboring switch.
2
Analyze Switch-2 DTP configuration
Switch-2 has 'switchport nonegotiate' applied, which completely stops the interface from transmitting DTP frames.
The 'switchport nonegotiate' command disables DTP frame generation on static trunk or access ports.
3
Determine the resulting link operational state on Switch-1
Because Switch-1 receives no DTP negotiation frames, it never transitions to trunk mode and remains operating as an access port.
Without receiving incoming DTP frames, a dynamic auto interface defaults to operational access mode.

Key Concept

DTP Mode Negotiation and Nonegotiate Behavior
Question 11Question →

Two Cisco Catalyst switches, SwitchA and SwitchB, are connected via their GigabitEthernet0/1 interfaces. SwitchA is configured with the commands `switchport mode dynamic desirable` and `switchport trunk native vlan 20`. SwitchB is configured with `switchport mode dynamic auto` and default interface settings (`switchport trunk native vlan 1`). Based on this operational configuration, which statement correctly describes the trunking state and frame handling across this link?

Show answer & explanation

Answer: The link successfully negotiates an 802.1Q trunk, but untagged frames sent from SwitchA's native VLAN 20 will be processed in VLAN 1 on SwitchB, causing a cross-VLAN traffic leak and triggering CDP error logs.

Answer

The link successfully negotiates an 802.1Q trunk, but untagged frames sent from SwitchA's native VLAN 20 will be processed in VLAN 1 on SwitchB, causing a cross-VLAN traffic leak and triggering CDP error logs.
The combination of dynamic desirable on one side and dynamic auto on the other successfully forms an 802.1Q trunk via Dynamic Trunking Protocol. Because native VLAN traffic is sent untagged by default under 802.1Q, frames originating in VLAN 20 on the first switch are received untagged on the second switch and mapped to its native VLAN 1. This creates a cross-VLAN leak and causes Cisco Discovery Protocol to log warning messages regarding the native VLAN mismatch.

Step-by-Step Solution

1
Evaluate DTP negotiation between SwitchA and SwitchB.
SwitchA is set to dynamic desirable (actively seeking to form a trunk) and SwitchB is set to dynamic auto (willing to form a trunk if requested). This combination successfully negotiates an operational trunk link.
DTP operational mode matrix dictates that desirable + auto results in a trunking state.
2
Analyze 802.1Q native VLAN tagging mechanics across the trunk.
SwitchA sends VLAN 20 traffic without an 802.1Q tag. When SwitchB receives untagged traffic on a trunk port, it forwards that traffic to its own configured native VLAN (VLAN 1).
By default, 802.1Q trunks transmit native VLAN frames without inserting a 4-byte VLAN tag header.
3
Determine control plane diagnostic behavior.
CDP exchanges native VLAN information via TLVs and generates console log warnings about the native VLAN mismatch, but traffic forwarding continues and the interface remains up/up.
CDP provides notification of misconfigurations but does not automatically shut down interfaces or block native VLAN traffic unless explicitly combined with STP loop guard/BPDU guard mechanisms.

Key Concept

802.1Q Native VLAN Tagging Mechanics and DTP Negotiation
Estimated Time:2m 0s
Question 12Question →

A network administrator needs to manually configure an 802.1Q trunk on switch port GigabitEthernet0/1 and assign VLAN 99 as the untagged native VLAN. Place the Cisco IOS CLI configuration commands in the correct sequential order required to accomplish this task.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of configuration commands is: enter interface context ('interface GigabitEthernet0/1'), specify 802.1Q encapsulation ('switchport trunk encapsulation dot1q'), set operational mode to trunk ('switchport mode trunk'), and set native VLAN 99 ('switchport trunk native vlan 99').
To successfully establish an 802.1Q trunk link with a custom native VLAN on a Cisco switch interface, commands must be entered in hierarchical CLI order: first select the targeted interface ('interface GigabitEthernet0/1'), define the trunk encapsulation standard ('switchport trunk encapsulation dot1q'), force the link into trunking mode ('switchport mode trunk'), and finally designate the untagged native VLAN ('switchport trunk native vlan 99').

Step-by-Step Solution

1
Navigate to the targeted physical interface context.
Switch enters interface configuration mode for GigabitEthernet0/1.
Trunk configuration commands are applied directly under the specific switchport interface context.
2
Set the trunk encapsulation type to 802.1Q.
The interface uses 802.1Q frame tagging for VLAN multiplexing.
On Cisco Catalyst switches supporting legacy ISL and 802.1Q, encapsulation type must be explicitly specified before enabling trunk mode.
3
Enable static trunking mode.
The port transitions to a permanent 802.1Q trunking operational state.
The command 'switchport mode trunk' forces the interface into trunking mode.
4
Configure the native VLAN assignment.
VLAN 99 is assigned as the native (untagged) VLAN on the trunk.
Untagged frames sent and received over the 802.1Q trunk will be mapped to VLAN 99.

Key Concept

IEEE 802.1Q Trunk CLI Configuration Sequence
Question 13Question →

A network administrator needs to manually configure an 802.1Q trunk link on a switch port supporting multi-encapsulation according to security best practices. Place the Cisco IOS configuration commands in the correct execution sequence from initial interface selection to traffic pruning.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct configuration sequence is: 1) Enter interface context, 2) Define 802.1Q encapsulation, 3) Set switchport mode to trunk, 4) Reassign the native VLAN ID, and 5) Define allowed VLANs for traffic pruning.
The correct operational sequence begins with entering the interface configuration context. Next, on switches supporting multiple encapsulation protocols, 802.1Q encapsulation must be explicitly configured prior to setting the interface mode to trunk. Once the trunk state is active, security hardening steps follow: reassigning the untagged native VLAN away from VLAN 1, and finally filtering trunk traffic by restricting allowed VLANs.

Step-by-Step Solution

1
Select the target interswitch physical interface context.
Enters interface configuration prompt context.
CLI commands must target the specific interface designated for trunking.
2
Execute switchport trunk encapsulation dot1q.
Defines IEEE 802.1Q frame tagging for the port.
On legacy or multi-layer Catalyst switches, attempting switchport mode trunk before selecting encapsulation results in a CLI error.
3
Execute switchport mode trunk.
Forces interface into permanent trunking state.
Establishes trunk operation and stops unconditional access behavior.
4
Execute switchport trunk native vlan 99.
Changes untagged frame handling to VLAN 99.
Enhances security by avoiding the default native VLAN 1.
5
Execute switchport trunk allowed vlan 10,20,99.
Restricts broadcast/multicast forwarding to specified VLANs.
Implements traffic filtering and pruning across interswitch links.

Key Concept

Manual 802.1Q Trunk CLI Configuration Order
Question 14Question →

When IEEE 802.1Q encapsulation is applied to an Ethernet frame traversing a trunk link, how many bytes are inserted into the original frame header for the 802.1Q tag?

Show answer & explanation

Answer: 4 bytes

Answer

The 802.1Q header inserts a total of 4 bytes into the original Ethernet frame header.
The correct answer is 4 bytes. An IEEE 802.1Q tag inserts 4 bytes (32 bits) into the Ethernet frame header. This includes 2 bytes for the Tag Protocol Identifier (TPID, fixed at 0x8100) and 2 bytes for Tag Control Information (TCI, containing 802.1p priority bits, DEI, and the 12-bit VLAN ID).

Step-by-Step Solution

1
Identify the structure of an IEEE 802.1Q tagged frame.
The 802.1Q header is inserted directly after the Source MAC address field.
This allows intermediate switches to identify VLAN membership without re-encapsulating the entire payload.
2
Break down the components of the 802.1Q tag.
The tag consists of a 2-byte Tag Protocol Identifier (TPID: 0x8100) and a 2-byte Tag Control Information (TCI) field containing Priority Code Point (3 bits), Drop Eligible Indicator (1 bit), and VLAN ID (12 bits).
Summing 2 bytes for TPID and 2 bytes for TCI equals a total header size of 4 bytes.

Key Concept

802.1Q Frame Tagging Header Architecture
Estimated Time:45s
Question 15Question →

A network engineer needs to manually configure an IEEE 802.1Q trunk link on a Cisco Catalyst switch interface (GigabitEthernet1/0/1) while following security best practices to disable Dynamic Trunking Protocol (DTP) and restrict active VLANs. What is the correct sequence of Cisco IOS CLI commands to accomplish this configuration on an interface supporting multi-protocol trunk encapsulation?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of commands begins with entering interface configuration mode (`interface GigabitEthernet1/0/1`), setting 802.1Q encapsulation (`switchport trunk encapsulation dot1q`), enabling trunk mode statically (`switchport mode trunk`), turning off DTP negotiation (`switchport nonegotiate`), and finally restricting the allowed VLAN list (`switchport trunk allowed vlan 10,20,30`).
The correct sequence respects Cisco IOS CLI syntax dependency rules: interface mode must be accessed first, followed by defining 802.1Q encapsulation prior to setting static trunk mode. Static trunking must be active before DTP frame transmission can be disabled with `switchport nonegotiate`, and allowed VLAN parameters are applied to restrict trunk traffic.

Step-by-Step Solution

1
Enter interface configuration mode
Access the interface context for GigabitEthernet1/0/1.
CLI commands affecting a specific switchport can only be applied within interface configuration mode.
2
Specify 802.1Q encapsulation protocol
Set trunk encapsulation type to dot1q.
On multi-encapsulation Catalyst switches, Cisco IOS requires explicit encapsulation definition before allowing the port mode to be changed to trunk.
3
Set port mode to static trunking
Force port state into unconditional trunk mode.
Static trunk mode disables dynamic negotiation behavior requirement and prepares the port for non-negotiation.
4
Disable Dynamic Trunking Protocol (DTP)
Stop sending DTP frames out of the interface.
The `switchport nonegotiate` command prevents DTP negotiation but is rejected by Cisco IOS if the interface is still set to dynamic auto or dynamic desirable.
5
Configure allowed VLAN list
Restrict VLAN traffic traversing the trunk to VLANs 10, 20, and 30.
Prunes unauthorized VLAN traffic from crossing the interswitch trunk link as part of security hardening.

Key Concept

Cisco IOS CLI trunk configuration sequence and DTP operational state requirements for 802.1Q trunking
Estimated Time:1m 30s
Question 16Question →

An administrator executes the command `show interfaces trunk` on a Cisco Catalyst switch and notices that VLAN 50 is included in the "VLANs allowed on trunk" section, but it does not appear in the "VLANs allowed and active in management domain" section. Which condition accounts for this operational state?

Show answer & explanation

Answer: VLAN 50 has not been created in the switch's local VLAN database.

Answer

VLAN 50 has not been created in the switch's local VLAN database.
For a VLAN to appear under 'VLANs allowed and active in management domain' in the `show interfaces trunk` output, it must be permitted by the trunk allowed list AND exist locally in the switch's VLAN database. If the VLAN has not been created using the `vlan 50` global configuration command, it remains inactive on the switch and will not appear in the active management domain output.

Step-by-Step Solution

1
Analyze the operational sections of the `show interfaces trunk` CLI output.
The 'VLANs allowed on trunk' output reflects the interface configuration (e.g., `switchport trunk allowed vlan`), while 'VLANs allowed and active in management domain' shows VLANs from that allowed list that currently exist in the local VLAN database and are not in a shut-down state.
Understanding Cisco IOS trunk verification logic is essential for accurately interpreting command output.
2
Identify why an allowed VLAN is excluded from the active management domain.
Because VLAN 50 is allowed by configuration but absent from the active list, it has not been instantiated in the switch database (using `vlan 50` in global configuration mode) or is currently disabled.
A switch cannot forward or locally activate trunk traffic for a VLAN that does not exist in its VLAN database.

Key Concept

802.1Q Trunk Verification and Local VLAN Database Dependencies
Estimated Time:1m 15s
Question 17Question →

A network administrator needs to manually configure a switch port as an IEEE 802.1Q trunk link and limit the traffic traversing the link to specific VLANs. What is the correct sequence of CLI configuration commands to perform this setup on a Cisco Catalyst switch interface from first to last?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of configuration commands is: 1) Enter interface configuration mode (interface GigabitEthernet0/1), 2) Set encapsulation to dot1q (switchport trunk encapsulation dot1q), 3) Set mode to trunk (switchport mode trunk), and 4) Specify allowed VLANs (switchport trunk allowed vlan 10,20).
The proper administrative sequence requires entering the target interface configuration mode first, setting the 802.1Q encapsulation protocol second, forcing the port into permanent trunking mode third, and finally defining the list of allowed VLANs to prune unwanted traffic.

Step-by-Step Solution

1
Navigate to the targeted physical interface context.
Enters interface configuration sub-mode prompt Switch(config-if)#.
Interface parameters can only be altered from within interface configuration sub-mode.
2
Define 802.1Q encapsulation.
Configures IEEE 802.1Q frame tagging as the trunking method.
Cisco IOS switches supporting both ISL and 802.1Q reject the 'switchport mode trunk' command until encapsulation is explicitly defined.
3
Configure static trunk mode.
Forces the interface into an active trunking operational state.
This command turns off dynamic port mode negotiation and forces the port into a permanent trunking state.
4
Apply allowed VLAN list filtering.
Limits trunk traffic to VLAN 10 and VLAN 20.
Pruning unneeded VLANs improves security and reduces broadcast traffic across switch links.

Key Concept

IEEE 802.1Q Trunk Interface CLI Configuration Workflow
Question 18Question →

A Cisco Catalyst switch receives an untagged Ethernet frame on an interface configured as an 802.1Q trunk port. Place the operational steps performed by the switch in the correct order from ingress frame arrival to egress transmission.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence is: (1) Frame reception on 802.1Q trunk, (2) Internal classification into ingress native VLAN, (3) Ingress trunk allowed VLAN list verification, (4) MAC address table lookup within native VLAN context, and (5) Egress transmission untagged on matching native VLAN trunk.
When an untagged frame is received on an 802.1Q trunk port, the switch first accepts the frame and assigns it internally to the interface's native VLAN. It then validates whether that native VLAN is permitted according to the trunk's allowed VLAN configuration. Next, it performs a Layer 2 MAC table lookup restricted to that native VLAN's broadcast domain to select the egress port. Finally, when transmitting out another trunk port configured with the same native VLAN, the switch leaves the frame untagged according to 802.1Q specification.

Step-by-Step Solution

1
Identify the ingress frame state upon arrival.
The frame arrives on the 802.1Q trunk interface lacking a 4-byte 802.1Q VLAN header.
802.1Q trunks expect untagged frames to belong to the designated native VLAN.
2
Map untagged ingress traffic to the port's native VLAN.
The switch internal ASIC assigns the frame to the configured native VLAN ID of the receiving trunk port.
All frames moving through a Catalyst switch fabric must be associated with a specific VLAN domain.
3
Check interface trunk filtering rules (allowed VLAN list).
The switch confirms that the native VLAN ID is present in the `switchport trunk allowed vlan` filter for that interface.
If the native VLAN was explicitly removed from the allowed list, the switch would drop the frame at ingress.
4
Determine the Layer 2 egress destination.
The switch queries its MAC address table within the scope of the assigned native VLAN.
VLAN isolation requires that MAC lookups occur strictly within the MAC table instance dedicated to that specific VLAN.
5
Apply egress 802.1Q tagging rules prior to transmission.
The frame is forwarded out the destination trunk port untagged because its VLAN matches the destination port's configured native VLAN.
Standard IEEE 802.1Q behavior specifies that frames belonging to a trunk's native VLAN are transmitted across the link without an 802.1Q tag header.

Key Concept

IEEE 802.1Q Native VLAN Ingress Classification, Filtering, and Egress Tagging Lifecycle
Estimated Time:2m 0s
Question 19Question →

A Cisco switch receives an untagged Ethernet frame on an IEEE 802.1Q trunk link and forwards it out another 802.1Q trunk link. Arrange the operational steps in the correct order from initial frame arrival to final frame transmission.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence begins with the arrival of an untagged Ethernet frame on an 802.1Q trunk port, followed by internal mapping to the ingress port's native VLAN, executing a MAC address table lookup within that native VLAN, and finally transmitting the frame untagged out an egress trunk configured with a matching native VLAN.
IEEE 802.1Q trunks handle untagged traffic by implicitly classifying ingress frames into the configured native VLAN. The switch uses that native VLAN's MAC address table for forwarding decisions and sends the frame out an egress trunk untagged if the egress interface shares the same native VLAN configuration.

Step-by-Step Solution

1
Identify ingress frame format
The switch identifies that the incoming frame lacks a 4-byte IEEE 802.1Q tag header.
Trunk ports process both tagged and untagged frames depending on whether traffic belongs to tagged VLANs or the native VLAN.
2
Classify frame to native VLAN
The frame is internally tagged/associated with the ingress port's native VLAN ID.
IEEE 802.1Q specification requires untagged frames traversing a trunk to be implicitly assigned to the native VLAN.
3
Execute Layer 2 forwarding lookup
The switch consults the MAC address table for the destination address within the native VLAN domain.
VLANs maintain isolated broadcast domains and separate MAC lookup tables to prevent cross-VLAN frame leakage.
4
Evaluate egress tagging behavior
The frame is forwarded across the egress trunk port without inserting an 802.1Q header tag.
To maintain compatibility, 802.1Q does not tag frames belonging to the native VLAN when sending them over trunk links.

Key Concept

IEEE 802.1Q Native VLAN Ingress and Egress Processing Mechanics
Question 20Question →

A network technician is verifying the operational characteristics of an IEEE 802.1Q trunk link established between two Cisco Catalyst switches. Which two statements describe correct behavior or features of IEEE 802.1Q trunking? (Select two.)

Select all that apply

Show answer & explanation

Answer: Frames belonging to the configured native VLAN are transmitted across the trunk link untagged by default.; IEEE 802.1Q inserts a 4-byte header into the standard Ethernet frame to carry VLAN identification information.

Answer

The correct statements are that native VLAN frames are transmitted untagged across an 802.1Q trunk by default, and that IEEE 802.1Q inserts a 4-byte header into the Ethernet frame.
IEEE 802.1Q trunking inserts a 4-byte tag between the MAC Source Address and EtherType fields of an Ethernet frame for tagged VLAN traffic. By default, frames originating from or destined for the native VLAN are sent across the trunk link without any 802.1Q tag attached.

Step-by-Step Solution

1
Analyze frame tagging mechanics for IEEE 802.1Q trunk links.
IEEE 802.1Q inserts a 4-byte tag into the frame header for tagged VLANs, while natively configured VLAN traffic remains untagged by default.
This maintains backward compatibility with legacy non-trunking devices.
2
Evaluate operational misconfiguration consequences on trunks.
Native VLAN mismatches generate warnings (via CDP/STP) without err-disabling ports, and PortFast is explicitly restricted from switch-to-switch links.
PortFast bypasses listening/learning states which can cause bridging loops on interswitch trunk paths.

Key Concept

IEEE 802.1Q Trunking Fundamentals and Native VLAN Mechanics
Page 1 / 4Next