Three roles, one tag
Every VLAN question on this page comes down to one field: the 4-byte 802.1Q tag that a switch inserts into an Ethernet frame to carry the VLAN ID (IEEE 802.1Q-2022). Find out where that tag is present and where it is absent, and the three VLAN roles separate cleanly.
These sit in v1.1 topics 2.1 and 2.2.c, which map to v2.0 topics 2.1.b and 2.2.c. The wider territory, from MAC learning to inter-VLAN routing, is mapped in the switching, VLANs and trunking study area.
The terms, pinned down
- 802.1Q tag
- A 4-byte field inserted after the source MAC address. It holds the 12-bit VLAN ID and a priority value.
- Access port
- A port that belongs to one data VLAN and sends and receives untagged frames. End hosts connect here.
- Access VLAN
- The data VLAN of an access port. A host on that port never sees a tag.
- Voice VLAN
- A second VLAN on an access port, used by an attached IP phone. The phone tags its own frames with this VLAN ID; the PC behind it stays untagged in the access VLAN.
- Trunk port
- A port that carries many VLANs between switches, or between a switch and a router or server, and tags frames to keep them apart.
- Native VLAN
- The one VLAN whose frames cross a trunk untagged. It is set per trunk, and both ends must agree on it.
A phone port and an uplink trunk
Gi1/0/5 serves a desk phone with a PC daisy-chained behind it; Gi1/0/48 is the trunk to the distribution switch.
interface GigabitEthernet1/0/5 description Desk 4B phone + PC switchport mode access switchport access vlan 40 switchport voice vlan 41!interface GigabitEthernet1/0/48 description Uplink to DIST-1 switchport mode trunk switchport trunk native vlan 999 switchport trunk allowed vlan 40,41,999VLAN 999 carries no hosts. Parking the native VLAN on an unused ID keeps untagged trunk traffic away from user VLANs, and the far end of the trunk needs the same native VLAN line.
Tagged or untagged, port by port
| Question | Access VLAN | Voice VLAN | Native VLAN |
|---|---|---|---|
| Port type | Access | Access (same port) | Trunk |
| Tag on the wire | None | 802.1Q tag added by the phone | None |
| Who sends it | The PC or other end host | The IP phone | Either switch, for that one VLAN |
| Configured with | switchport access vlan | switchport voice vlan | switchport trunk native vlan |
| Must match the far end | No far-end switch | No far-end switch | Yes, on both trunk ends |
Frames on Native vs access VLAN
Before each frame, sketch the port: access or trunk, and which VLAN, if any, goes untagged on it. The commands in the options differ by one keyword, so read them to the end.
Practice frames written by our editors for study, not Cisco items. The 200-301 exam itself mixes multiple choice, drag-and-drop and lab-style items.
Frame 001 of 007 · 0 answered · 0 ok
Keys
1–5 or A–E pick an option (on choose-N frames they toggle; then Check answer) · ← → previous / next frame · ↑ ↓ move in the frame list
- Frame 001 of 007
A network engineer wants to ensure that traffic on a particular port will always be sent and received untagged, effectively disabling any VLAN tagging on that port. What command should they run to configure this?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
This picks the VLAN the port uses in access mode, but by itself it does not stop the port from negotiating a trunk.
Note on B
Correct: access mode makes the port a non-trunking member of a single VLAN, so its frames are always sent and received untagged.
Note on C
The native VLAN setting only applies when the port is a trunk, and a trunk still tags every other VLAN.
Note on D
An allowed-VLAN list limits which VLANs cross a trunk; the port stays a trunk and keeps tagging them.
Best answer: B · why
An access port belongs to one VLAN and never adds an 802.1Q tag. The command switchport mode access forces that behavior, so the port cannot turn into a trunk through negotiation. switchport access vlan 20 only chooses the VLAN for access mode. Native VLAN and allowed-VLAN settings are trunk settings: a trunk tags every VLAN except the native one.
- Frame 002 of 007
Which statement correctly identifies a difference between access ports and trunk ports on a switch?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Correct: a trunk carries frames for many VLANs, tagged with 802.1Q, while an access port belongs to one VLAN.
Note on B
A trunk is not pinned to any single VLAN; it carries whichever VLANs its allowed list permits, and that list can be edited.
Note on C
This reverses the rule: access ports send untagged frames, and trunks tag every VLAN except the native one.
Note on D
Swapping the roles makes this wrong, since the access port is the single-VLAN port and the trunk is the multi-VLAN link.
Best answer: A · why
Access ports connect end devices and belong to one data VLAN, with untagged frames. Trunk ports connect switches (or a switch to a router or server) and carry many VLANs, using 802.1Q tags to tell them apart; only the native VLAN crosses untagged. VLAN 1 is the default native VLAN, not a required assignment.
- Frame 003 of 007
What is the default native VLAN on Cisco switches?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
VLAN 0 is reserved: an 802.1Q tag with VLAN ID 0 marks a priority-only frame, and it cannot serve as a native VLAN.
Note on B
Correct: Cisco switches use VLAN 1 as the native VLAN on 802.1Q trunks unless you change it with switchport trunk native vlan.
Note on C
VLAN 100 is just a normal-range VLAN that someone could configure; nothing makes it the default.
Note on D
VLAN 1000 is an ordinary normal-range VLAN ID with no default role on a trunk.
Best answer: B · why
On an 802.1Q trunk, frames in the native VLAN cross untagged. By default that is VLAN 1 on Cisco switches. Many designs move it to an unused VLAN, and the native VLAN must match on both ends of the trunk, or CDP reports a mismatch and traffic from the two VLANs merges. VLAN 0 is reserved for priority tagging.
- Frame 004 of 007
Which command correctly changes the native VLAN on a trunk port to VLAN 10?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
This restricts the trunk to carrying only VLAN 10; it does not change which VLAN travels untagged.
Note on B
IOS has no switchport native vlan command; the native keyword only exists under switchport trunk.
Note on C
This sets the VLAN a port uses in access mode and has no effect on the untagged VLAN of a trunk.
Note on D
Correct: in interface configuration mode, switchport trunk native vlan 10 makes VLAN 10 the untagged VLAN on that trunk.
Best answer: D · why
The native VLAN is set per trunk interface with switchport trunk native vlan <id>. Configure the same value on the other end, or the switches report a native VLAN mismatch. switchport access vlan applies only in access mode, and switchport trunk allowed vlan controls which VLANs may cross the trunk.
- Frame 005 of 007
An administrator is troubleshooting interVLAN connectivity across two interconnected switches. Which configuration inconsistency on a trunk link is most likely to result in untagged frames being misinterpreted?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Mismatched modes can stop the trunk from forming, but they do not make the switches read untagged frames as the wrong VLAN.
Note on B
Spanning-tree priority affects which switch becomes root, not how untagged frames on a trunk are assigned to VLANs.
Note on C
Correct: each switch puts untagged frames into its own native VLAN, so different native VLANs on the two ends move traffic into the wrong VLAN.
Note on D
A speed mismatch takes the link down or causes errors; it has nothing to do with VLAN tagging.
Best answer: C · why
Frames in the native VLAN cross an 802.1Q trunk without a tag. Each receiving switch puts untagged frames into its own configured native VLAN. If one end uses VLAN 1 and the other VLAN 99, traffic leaks between those two VLANs, and CDP logs a native VLAN mismatch. A mode mismatch decides whether a trunk forms at all; STP priority and speed settings are unrelated to tagging.
- Frame 006 of 007
In a multi-switch network, if a trunk port is misconfigured with an incorrect native VLAN, what typical symptom might occur?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Correct: untagged frames land in whatever native VLAN the receiving switch has, so they end up in the wrong VLAN.
Note on B
Endless spanning-tree recalculation is not the hallmark; the classic signs are CDP mismatch messages and traffic leaking between VLANs.
Note on C
Switches do not fix this on their own: CDP only logs the mismatch, and an administrator has to correct the configuration.
Note on D
High CPU load is not the typical sign; the mismatch shows up as traffic in the wrong VLAN and as CDP log messages.
Best answer: A · why
Each end of an 802.1Q trunk assigns untagged frames to its own native VLAN. When the native VLANs differ, untagged traffic sent in one VLAN is received in another, so hosts lose connectivity or appear in the wrong subnet. Cisco switches log a CDP native VLAN mismatch message, and with per-VLAN spanning tree the port can be blocked as inconsistent. Nothing corrects it automatically.
- Frame 007 of 007
What is the purpose of the ‘switchport voice vlan’ command on a Cisco switch?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
A PC can still use the same port in the access (data) VLAN; the voice VLAN adds a VLAN for the phone rather than blocking anything.
Note on B
Gateway functions that connect calls to the phone network run on routers or voice gateways, not on a switch port command.
Note on C
The command does not prioritize all traffic; the phone marks its own voice frames, and only that traffic goes in the voice VLAN.
Note on D
Correct: switchport voice vlan tells an attached IP phone, through CDP, to tag its voice frames with a separate VLAN while the PC stays in the access VLAN.
Best answer: D · why
A Cisco access port can carry two VLANs: an untagged access VLAN for the PC and a tagged voice VLAN for the IP phone. switchport voice vlan <id> sets the voice VLAN, and the switch tells the phone which VLAN to use through CDP. Keeping voice separate puts it in its own subnet and makes QoS easier, but the command itself neither prioritizes nor blocks traffic.
Where the map goes from here
Trunks are also where spanning tree does its per-VLAN work: Rapid PVST+ runs one instance per VLAN and chooses which trunk ports forward. The STP root bridge and port roles page picks up from the uplink in the exhibit above.
Securing access ports with port security, DHCP snooping and dynamic ARP inspection belongs to a later study area; DHCP snooping and DAI is the concept page for it.
References
- [1]Cisco technote 24063: spanning tree PVID and type inconsistenciesChecked October 29, 2026.
- [2]Cisco Learning Network: CCNA v1.1 exam topicsChecked October 29, 2026.
- [3]Cisco Learning Network: CCNA v2.0 exam topicsChecked October 29, 2026.