Examkin

Question

Difficulty: HardVLAN Configuration and 802.1Q Trunking

A network engineer is configuring an 802.1Q trunk link between two switches, SW-CORE-01 and SW-ACCESS-02, to carry traffic for VLAN 10 (Data), VLAN 20 (Voice), and VLAN 99 (Native/Management). Interface GigabitEthernet0/1 on SW-CORE-01 is configured with `switchport trunk native vlan 99`. However, interface GigabitEthernet0/1 on SW-ACCESS-02 was accidentally left with default settings (`switchport trunk native vlan 1`). If a host on SW-ACCESS-02 transmits unencapsulated (untagged) Ethernet frames into GigabitEthernet0/1, how will SW-CORE-01 handle these incoming frames, and what security/operational issue will occur?

  1. SW-CORE-01 will associate the untagged frames with VLAN 99, causing traffic sent on VLAN 1 from SW-ACCESS-02 to leak into VLAN 99 on SW-CORE-01.Answer
  2. B
    SW-CORE-01 will drop all untagged frames automatically because 802.1Q trunk ports reject any frame that lacks a 4-byte 802.1Q VLAN header.
  3. C
    SW-CORE-01 will forward the untagged frames to all ports across all configured VLANs because untagged frames act as global switch broadcasts.
  4. D
    SW-CORE-01 will encapsulate the untagged frames with an 802.1Q header for VLAN 1 and relay them to SW-ACCESS-02 without generating operational logs.

Answer

SW-CORE-01 will associate the untagged frames with VLAN 99, leading to cross-VLAN traffic leakage between VLAN 1 (on SW-ACCESS-02) and VLAN 99 (on SW-CORE-01).
IEEE 802.1Q trunking sends frames belonging to the native VLAN untagged over the link. When a receiving switch gets an untagged frame on a trunk interface, it maps that frame to its local native VLAN configuration. Because SW-CORE-01 has its native VLAN set to VLAN 99, any untagged frame sent by SW-ACCESS-02 (originating from its native VLAN 1) will be placed directly into VLAN 99 on SW-CORE-01, causing cross-VLAN traffic leakage and potential Spanning Tree Protocol (STP) inconsistencies.

Step-by-Step Solution

1
Analyze the trunk configuration and 802.1Q native VLAN operation
IEEE 802.1Q trunks transmit frames belonging to the configured native VLAN without adding a 4-byte 802.1Q tag.
By default, native VLAN traffic is sent untagged across the link.
2
Evaluate ingress frame processing on SW-CORE-01
When SW-CORE-01 receives an untagged frame on GigabitEthernet0/1, it assigns the frame to its own locally configured native VLAN, which is VLAN 99.
Trunk interfaces determine the VLAN membership of untagged incoming frames solely based on their local native VLAN assignment.
3
Identify the cross-VLAN traffic leakage anomaly
Frames originated on VLAN 1 on SW-ACCESS-02 are egressed untagged and subsequently placed into VLAN 99 upon ingress at SW-CORE-01.
A native VLAN mismatch bridges two separate broadcast domains at Layer 2 without a router, breaking VLAN segmentation.

Key Concept

802.1Q Native VLAN Ingress Processing and Mismatch Behavior
Rate this question

Topics

VLAN Configuration and 802.1Q Trunking

More questions from this topic