How a switch handles a frame
- 0000 access port in VLAN 30, or tagged on a trunk
- 0010 source MAC, port and VLAN go into the table
- 0020 in that VLAN’s entries only
- 0030 unknown and broadcast frames flood the VLAN
- 0040 trunks add 802.1Q, except the native VLAN
Access, voice and trunk ports
Cisco’s v1.1 list puts four topics here: switching concepts such as MAC learning and aging (1.13), VLANs across switches (2.1), trunks and the native VLAN (2.2), and the discovery protocols CDP and LLDP (2.3).
An access port belongs to one data VLAN and sends frames untagged. A voice VLAN lets the same port carry an IP phone’s traffic tagged in a second VLAN while frames from the PC plugged into the phone travel without a tag in the data VLAN; the switch tells the phone which VLAN to use through CDP or LLDP.
A trunk carries many VLANs over one link by inserting a 4-byte IEEE 802.1Q tag after the source MAC address. The tag’s 12-bit VLAN ID allows VLANs 1 to 4094. One VLAN per trunk crosses untagged, the native VLAN, which is VLAN 1 until someone changes it, and both ends must agree on it. How that differs from an access VLAN has its own page: native VLAN vs access VLAN.
Leaving the VLAN
Hosts in different VLANs need a Layer 3 hop. The topic list names the designs: router-on-a-stick, with one router interface split into a subinterface per VLAN; a switched virtual interface (SVI) per VLAN on a Layer 3 switch; and a routed port, a Layer 3 switch port that has given up its switchport role.
Reading show vlan brief
Trimmed show vlan brief from an access switch (lab values)
SW1#show vlan briefVLAN Name Status Ports---- -------------------------------- --------- -------------------------------1 default active Gi1/0/5, Gi1/0/630 ENG active Gi1/0/1, Gi1/0/299 MGMT activeThe uplink Gi1/0/48 is a trunk, and trunk ports are not listed here: this output shows access ports only. VLAN 99 with no ports can still be carried across the uplink, so check trunks with the trunk-specific show command before deciding a VLAN is unused.
CDP, LLDP and the frame’s path when it fails
The Cisco Discovery Protocol (CDP) runs by default on Cisco IOS. The Link Layer Discovery Protocol (LLDP) is the IEEE 802.1AB equivalent that other vendors’ equipment speaks, and on many Cisco switches it has to be turned on first. Both report the neighbor’s device ID, the port on its side, its platform and its management address, which is how you check a cabling diagram against what is actually plugged in.
The Address Resolution Protocol (ARP, RFC 826) is the link between the IPv4 address a host wants and the MAC address the switch forwards on. A host sending off its subnet ARPs for its default gateway, never for the remote host; when the gateway is an SVI, the SVI’s MAC address is the reply.
A host cannot reach its gateway: check in this order
- The access port is up/up and assigned to the VLAN you expect.
- The VLAN exists on this switch and is active.
- Every trunk on the path is trunking and allows that VLAN.
- The native VLAN matches at both ends of each trunk.
- The gateway interface, SVI or subinterface, is up and tied to the right VLAN.
- Spanning tree is forwarding on the path; see Rapid PVST+ and EtherChannel.
- Only then ping, extended ping from the gateway’s VLAN interface, and traceroute.
Frames: Switching & VLANs
MAC learning, VLAN assignment, trunk verification and neighbor discovery, roughly in the order a frame meets them. A mixed-order pass is on the practice test, switching filter.
Practice frames written by our editors for study, not Cisco items. The 200-301 exam itself mixes multiple choice, drag-and-drop and lab-style items.
Frame 001 of 017 · 0 answered · 0 ok
Keys
1–5 or A–E pick an option (on choose-N frames they toggle; then Check answer) · ← → previous / next frame · ↑ ↓ move in the frame list
- Frame 001 of 017
To thoroughly verify the operational status of an access port, including assigned VLAN, trunk status, and native VLAN details, which command is most effective?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
show vlan brief lists VLANs and their access ports, but says nothing about trunking or the native VLAN.
Note on B
show running-config shows only the configured commands, not the operational mode or the negotiated trunk state.
Note on C
show interfaces trunk lists only ports that are trunking right now, so an access port would not appear in it.
Note on D
Correct: show interfaces switchport reports the administrative and operational mode, access VLAN, native VLAN and trunking details per port.
Best answer: D · why
The ‘show interfaces switchport’ command provides detailed port configuration and status information, making it ideal for troubleshooting access port issues.
- Frame 002 of 017
What type of network device routes traffic between different VLANs within a single switch using a routed interface?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
A hub only repeats bits out every port; it knows nothing of VLANs or IP routing.
Note on B
A router can route between VLANs, but over a router-on-a-stick trunk to the switch, not inside the switch itself.
Note on C
A Layer 2 switch forwards only within a VLAN; traffic between VLANs needs a Layer 3 device.
Note on D
Correct: a Layer 3 switch routes between its own VLANs internally, using SVIs or routed ports, with no external router.
Best answer: D · why
A Layer 3 switch can route between VLANs inside one chassis. Each VLAN gets an SVI (interface vlan) holding the hosts’ gateway address, or a port becomes a routed port with no switchport, and the switch forwards between them in hardware. A Layer 2 switch only forwards within a VLAN, a hub repeats bits, and an external router needs a trunk to the switch (router on a stick).
- Frame 003 of 017
What is the purpose of a voice VLAN on a switch port?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
A voice VLAN adds no bandwidth; it only keeps phone traffic in its own VLAN so that QoS can be applied to it.
Note on B
The port still carries the PC’s data traffic in the access VLAN; nothing non-voice is blocked.
Note on C
Correct: a voice VLAN puts the IP phone’s tagged traffic in its own VLAN while the attached PC stays untagged in the data VLAN on the same port.
Note on D
Links between switches are trunks; a voice VLAN is set on an access port that faces a phone.
Best answer: C · why
A voice VLAN on a switch port allows the port to carry voice traffic in a separate VLAN from data traffic. This enables quality of service (QoS) to be applied specifically to voice traffic, ensuring good call quality, while maintaining a separate VLAN for regular data traffic.
- Frame 004 of 017
In the context of interswitch VLAN connectivity, what is the purpose of the ‘switchport trunk allowed vlan’ command?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Correct: switchport trunk allowed vlan sets which VLANs may cross the trunk, with add, remove, except, all and none to adjust the list.
Note on B
Encapsulation is set with switchport trunk encapsulation, needed only on platforms that also support ISL.
Note on C
The native VLAN is set with switchport trunk native vlan; the allowed list does not change which VLAN is untagged.
Note on D
Negotiation is controlled with the dynamic modes or switchport nonegotiate, not with the allowed VLAN list.
Best answer: A · why
The ‘switchport trunk allowed vlan’ command is used to specify which VLANs are allowed to traverse a trunk link between switches. By default, all VLANs are allowed on a trunk, but this command can restrict which VLANs’ traffic can pass through the trunk, enhancing security and reducing unnecessary traffic. The command can be used with options like ‘add’, ‘remove’, ‘except’, and ‘all’ to modify the list of allowed VLANs.
- Frame 005 of 017
Which command would you use to verify the status of all interfaces configured as trunk ports on a switch?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
display commands belong to other vendors’ CLIs; Cisco IOS uses show.
Note on B
Correct: show interfaces trunk lists every trunking port with its mode, encapsulation, native VLAN, allowed VLANs and VLANs forwarding in STP.
Note on C
show vlan trunk is not an IOS command; show vlan lists VLANs and their access ports.
Note on D
show trunk all is not valid IOS syntax.
Best answer: B · why
The ‘show interfaces trunk’ command displays information about all interfaces configured as trunk ports on a switch, including which VLANs are allowed on each trunk, which VLANs are forwarding on each trunk, and the encapsulation type used.
- Frame 006 of 017
How do MAC learning and frame forwarding in a switch work together to improve traffic handling within a local area network?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
A Layer 2 switch forwards on destination MAC addresses; IP addresses matter to routers and Layer 3 switches.
Note on B
Correct: the switch learns each source MAC on its arrival port, then sends frames for known destinations out only the port where that MAC lives.
Note on C
Static entries are an exception set by an administrator; normal learning is automatic and needs no per-port configuration.
Note on D
Flooding every frame is how a hub behaves; a switch floods only broadcasts and unknown unicasts, which saves bandwidth.
Best answer: B · why
A switch learns MAC addresses dynamically and uses its MAC address table to forward frames only to the appropriate port, reducing unnecessary traffic.
- Frame 007 of 017
What happens when a switch receives a frame destined for a MAC address that is not in its MAC address table?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
A switch knows nothing about default gateways; that is a host setting used for off-subnet traffic.
Note on B
Correct: an unknown unicast is flooded out every port in the VLAN except the one it came in on, and the reply then teaches the switch the MAC.
Note on C
Dropping it would break first contact with any new host, so the switch floods the frame instead of discarding it.
Note on D
ARP is a host protocol that maps IP addresses to MACs; a Layer 2 switch does not send ARP requests to fill its MAC table.
Best answer: B · why
When a switch receives a frame destined for a MAC address that is not in its MAC address table, it floods the frame out all ports except the one on which it was received. This ensures that the frame reaches its destination if it exists on the network. After the destination device responds, the switch learns its location and adds the MAC address to its table.
- Frame 008 of 017
Which command is used to verify LLDP neighbor information on a Cisco switch?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
show lldp devices is not an IOS command; the neighbor table is shown with show lldp neighbors.
Note on B
The word order is wrong; IOS expects show lldp neighbors, not show neighbors lldp.
Note on C
display is used by other vendors’ CLIs; Cisco IOS uses show.
Note on D
Correct: show lldp neighbors lists device ID, local interface, hold time, capabilities and port ID; add detail for addresses and the system description.
Best answer: D · why
The ‘show lldp neighbors’ command displays information about neighbors discovered through LLDP (Link Layer Discovery Protocol), including device ID, local interface, hold time, capability, and port ID.
- Frame 009 of 017
Which command is used to assign a VLAN to a switch port?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
interface vlan 10 creates or enters the SVI for VLAN 10, a Layer 3 interface; it does not put a port into the VLAN.
Note on B
switchport vlan access 10 is not IOS syntax; the keywords run switchport access vlan, in that order.
Note on C
port vlan 10 is not IOS syntax for access-port membership.
Note on D
Correct: in interface configuration mode, switchport access vlan 10 makes VLAN 10 the port’s access VLAN, usually alongside switchport mode access.
Best answer: D · why
VLAN membership is set per interface. In interface configuration mode, switchport mode access fixes the port as an access port and switchport access vlan 10 places it in VLAN 10. interface vlan 10 creates the Layer 3 SVI for that VLAN, and the other two forms are not IOS commands.
- Frame 010 of 017
Which command globally enables LLDP on a Cisco device?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
lldp start is not an IOS command.
Note on B
lldp init is not an IOS command.
Note on C
lldp enable is not how IOS turns LLDP on; per-interface control uses lldp transmit and lldp receive.
Note on D
Correct: lldp run in global configuration mode turns LLDP on for the whole device, and no lldp run turns it off.
Best answer: D · why
On Cisco IOS, LLDP is enabled for the whole device with lldp run in global configuration mode. Individual interfaces can then be tuned with lldp transmit and lldp receive, or their no forms, and show lldp neighbors verifies what was learned.
- Frame 011 of 017
What is the primary difference between a collision domain and a broadcast domain in a network?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
This reverses the roles: a hub puts all its ports in one collision domain, and it is a switch that splits collision domains.
Note on B
Correct: every switch port is its own collision domain, while a router (or a VLAN boundary) is what ends a broadcast domain.
Note on C
The layers are reversed: collisions belong to a shared Layer 1 and 2 segment, and broadcast domains end at a Layer 3 boundary.
Note on D
They are still different: a switched VLAN is one broadcast domain but has a separate collision domain on every port.
Best answer: B · why
A collision domain is a network segment where collisions can occur because devices share the same bandwidth and must follow CSMA/CD rules when transmitting. Hubs create a single collision domain where only one device can transmit at a time. Switches separate collision domains by providing dedicated bandwidth between ports, allowing multiple simultaneous transmissions. In contrast, a broadcast domain is a network segment where broadcast traffic is heard by all devices. Routers separate broadcast domains, while switches (by default) maintain a single broadcast domain unless VLANs are configured.
- Frame 012 of 017
Which command creates a new VLAN with ID 20 and name ‘Marketing’ on a Cisco switch?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
vlan name 20 Marketing is not valid; the name is set inside VLAN configuration mode.
Note on B
Correct: vlan 20 creates the VLAN and enters VLAN configuration mode, where name Marketing labels it.
Note on C
create vlan is not IOS syntax; VLANs are created with the vlan command.
Note on D
vlan create is not an IOS command; the order is vlan 20, then name Marketing on the next line.
Best answer: B · why
To create a new VLAN with ID 20 and name ‘Marketing’, you would use the following commands in global configuration mode: ‘vlan 20’ to create the VLAN, and then ‘name Marketing’ to assign the name.
- Frame 013 of 017
Which command is used to configure a switch port as a trunk port?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
interface trunk is not an IOS command; you enter the physical interface and set its mode there.
Note on B
switchport access sets access-port parameters such as the access VLAN; trunk is not one of them.
Note on C
Correct: switchport mode trunk makes the port a permanent 802.1Q trunk that carries traffic for multiple VLANs.
Note on D
switchport trunk allowed vlan edits the allowed VLAN list of a trunk; it does not turn the port into one, and it needs a VLAN list.
Best answer: C · why
The command ‘switchport mode trunk’ is used to configure a switch port as a trunk port, which allows it to carry traffic for multiple VLANs. This is essential for inter-switch connectivity in a network with multiple VLANs.
- Frame 014 of 017
Which statement is true about VLANs and switchports on a network switch?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
A switchport is a physical port, but it also has a logical setup: access or trunk mode, VLAN membership and more.
Note on B
They are not interchangeable; a port is a physical interface, and a VLAN is a logical group of ports that forms one broadcast domain.
Note on C
This reverses the two terms; the port is the hardware, and the VLAN is the logical grouping.
Note on D
Correct: a switchport is a physical interface on the switch, and a VLAN is a logical Layer 2 segment that one or many ports can belong to.
Best answer: D · why
A switchport is a physical interface that sends and receives frames. A VLAN is a logical Layer 2 segment, one broadcast domain, that one or many switchports can belong to as access ports or carry as trunks. Ports therefore have logical settings too, such as their mode and VLAN, but the two terms describe different things.
- Frame 015 of 017
For a port that is intended to carry only untagged traffic for a single VLAN, which mode must be configured on a Cisco switch?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
A trunk carries many VLANs and tags all of them except the native VLAN, so it does not fit a single untagged VLAN.
Note on B
A routed port (no switchport) drops Layer 2 VLAN membership entirely and behaves like a router interface.
Note on C
Dynamic modes negotiate the port’s role with the neighbor and can end up trunking, so single-VLAN untagged behavior is not fixed.
Note on D
Correct: switchport mode access fixes the port to one VLAN, and its frames are sent and received untagged.
Best answer: D · why
Access mode is specifically designed for a single VLAN, ensuring that all traffic on the port is untagged and associated with that VLAN.
- Frame 016 of 017
What happens to a MAC address entry in a switch’s MAC address table when its aging timer expires?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
There is no backup table; an aged-out entry is gone, and the address is learned again the next time the host sends.
Note on B
Switches do not send ARP to refresh MAC entries; ARP is a host protocol for mapping IP addresses to MACs.
Note on C
Static entries are configured by hand and never age out; aging applies only to dynamically learned entries.
Note on D
Correct: a dynamic entry whose timer runs out (300 seconds by default on Cisco switches) is deleted from the table.
Best answer: D · why
Dynamically learned MAC entries age out. On Cisco switches the default aging time is 300 seconds; if the switch sees no frame from that source MAC in that time, it removes the entry. Frames for that address are then flooded as unknown unicasts until the host sends again and is learned again. Static entries do not age.
- Frame 017 of 017
A router must route traffic for several VLANs through a single physical interface connected to a switch. What kind of link is required on that connection?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
An EtherChannel only bundles links. Access ports in a bundle still carry one untagged VLAN, so the router could not tell the VLANs apart.
Note on B
An access link carries a single VLAN with no tags, so the router would see only that one VLAN on the interface.
Note on C
Correct. A trunk tags each frame with its VLAN ID, and the router uses one subinterface per VLAN to route between them.
Note on D
A console link is an out-of-band management connection. It carries no user traffic at all.
Best answer: C · why
Routing between VLANs over one router interface, often called router on a stick, needs every VLAN to reach the router on the same cable. Only a trunk does that: the switch tags each frame with its 802.1Q VLAN ID, and the router has one subinterface per VLAN, each with ‘encapsulation dot1q <vlan-id>’ and the gateway address of that VLAN. An access link carries one VLAN untagged, so the router would see only that VLAN.
This area in the v2.0 topic list
| Version | Topic IDs | What it asks |
|---|---|---|
| v1.1 (current) | 1.13, 2.1, 2.2, 2.3 | Switching concepts, VLANs across switches, trunks and the native VLAN, CDP and LLDP |
| v2.0 | 2.1, 2.2, 2.3, 2.4 | Switch links including SVIs; edge ports for PCs, phones, APs and IoT, with PoE; CDP and LLDP against documentation; troubleshooting with show, ping, traceroute and packet capture |
Sources: v1.1 exam topics and v2.0 exam topics. When the switch happens: v2.0 changeover page.
Switching questions
What separates Layer 2 switching from Layer 3 switching?
A Layer 2 switch forwards inside a VLAN on MAC addresses and never looks at the IP header. A Layer 3 switch does that and also routes between VLANs on IP addresses, through SVIs or routed ports, in hardware. On a diagram, the Layer 3 switch is where the default gateways for the access VLANs usually live.
Why does a voice VLAN not need a trunk?
Nothing on the link has to be negotiated. The switch tags only the voice VLAN and announces that VLAN to the phone through CDP or LLDP; the phone tags its own voice frames, the PC’s frames stay untagged, and IOS treats the port as a multi-VLAN access port with one data VLAN and one voice VLAN.
Which switch commands do I need to type, and which only to read?
Topics 2.1 and 2.2 use the verbs configure and verify, so practice both: type the VLAN and trunk configuration, then read it back in the show output. Topic 1.13 is describe-level, so for the MAC address table, knowing how it behaves matters more than a command list.
Concepts in this study area
- Native vs access VLANUntagged trunk traffic, access and voice VLANs, and native VLAN mismatches.