Cisco CCNA VLANs and 802.1Q Trunking 3 — Questions and Answers
Question 1: Which of the following correctly describes a VLAN hopping attack using double tagging?
- An attacker sends a frame with two 802.1Q tags to reach a different VLAN (Correct answer)
- An attacker floods the CAM table to force traffic to all VLANs
- An attacker spoofs VTP advertisements to add VLANs
- An attacker uses DTP to negotiate a trunk and access all VLANs
Correct answer: An attacker sends a frame with two 802.1Q tags to reach a different VLAN
Double tagging embeds an inner VLAN tag so the frame is forwarded to a target VLAN after the outer tag is stripped at the first switch.
Question 2: To prevent double-tagging VLAN hopping attacks, which best practice should be applied?
- Change the native VLAN to an unused VLAN ID (Correct answer)
- Disable 802.1Q on all ports
- Set all ports to dynamic auto
- Enable VTP transparent mode
Correct answer: Change the native VLAN to an unused VLAN ID
Using an unused, non-default native VLAN prevents double-tagging attacks because the attacker cannot predict or match the native VLAN.
Question 3: Which command removes VLAN 30 from the allowed list on a trunk without affecting other VLANs?
- switchport trunk allowed vlan remove 30 (Correct answer)
- no switchport trunk allowed vlan 30
- switchport trunk allowed vlan except 30
- switchport trunk vlan remove 30
Correct answer: switchport trunk allowed vlan remove 30
The `remove` keyword modifies the allowed VLAN list by removing a specific VLAN without replacing the entire list.
Question 4: What is the maximum number of VLANs supported in the normal range on a Cisco switch?
- 1005 (Correct answer)
- 1024
- 4094
- 4096
Correct answer: 1005
Normal-range VLANs span IDs 1–1005, giving 1005 total VLANs in the normal range.
Question 5: A trunk link shows VLAN 40 in the 'VLANs allowed and active in management domain' but not in 'VLANs in spanning tree forwarding state'. What is the most likely cause?
- STP has blocked VLAN 40 on that port (Correct answer)
- VLAN 40 does not exist in the VLAN database
- VLAN 40 was pruned by VTP
- The native VLAN is set to 40
Correct answer: STP has blocked VLAN 40 on that port
If a VLAN is allowed and active but not forwarding, STP has placed that VLAN's port in a blocking or non-forwarding state.
Question 6: Which encapsulation type must both ends of a trunk link agree upon for the trunk to function?
- 802.1Q
- ISL
- Either 802.1Q or ISL, but they must match (Correct answer)
- No encapsulation is required on Cisco switches
Correct answer: Either 802.1Q or ISL, but they must match
Both ends of a trunk must use the same encapsulation (802.1Q or ISL); a mismatch prevents the trunk from forming.
Question 7: On a Cisco switch, where is the VLAN database for normal-range VLANs stored?
- vlan.dat in flash memory (Correct answer)
- running-config in RAM
- startup-config in NVRAM
- nvram.dat in NVRAM
Correct answer: vlan.dat in flash memory
Normal-range VLAN configurations are stored in the vlan.dat file in flash memory, separate from the running or startup config.
Cisco CCNA VLANs and 802.1Q Trunking 3
Which of the following correctly describes a VLAN hopping attack using double tagging?