ICND1 VLAN Management 5 — Questions and Answers
Question 1: Which security threat exploits the default behavior of DTP to gain access to multiple VLANs?
- VLAN hopping via switch spoofing (Correct answer)
- MAC flooding
- DHCP starvation
- ARP poisoning
Correct answer: VLAN hopping via switch spoofing
Switch spoofing is a VLAN hopping attack where a rogue device negotiates a trunk link using DTP, gaining access to all VLANs on the switch.
Question 2: A network engineer configures 'switchport mode dynamic desirable' on a port. Under what condition will the port become a trunk?
- Only when the other end is set to 'mode trunk' or 'dynamic desirable' (Correct answer)
- Always, regardless of the other end
- Only when VTP is enabled
- Only when the port is connected to a router
Correct answer: Only when the other end is set to 'mode trunk' or 'dynamic desirable'
'dynamic desirable' actively initiates trunking and forms a trunk if the opposite side is set to trunk, dynamic desirable, or dynamic auto.
Question 3: What is the result of a native VLAN mismatch on the two ends of an 802.1Q trunk?
- The trunk link shuts down automatically
- Spanning Tree generates a topology change and CDP logs a mismatch warning
- Untagged frames are delivered to the wrong VLAN, causing traffic leakage (Correct answer)
- Both A and C
Correct answer: Untagged frames are delivered to the wrong VLAN, causing traffic leakage
A native VLAN mismatch causes untagged frames from one switch to be placed in the wrong VLAN on the other switch, creating a traffic leakage security issue.
Question 4: When configuring inter-VLAN routing on a Layer 3 switch, which command enables IP routing globally?
- ip routing (Correct answer)
- router vlan
- enable routing
- switchport ip routing on
Correct answer: ip routing
The global configuration command 'ip routing' enables the Layer 3 switch to perform IP routing between VLAN interfaces (SVIs).
Question 5: Which statement best describes a Switched Virtual Interface (SVI)?
- A physical port configured for Layer 3 operation
- A logical Layer 3 interface associated with a VLAN used for inter-VLAN routing or management (Correct answer)
- A tunnel interface connecting two VLANs across a WAN
- A special port reserved for spanning tree root election
Correct answer: A logical Layer 3 interface associated with a VLAN used for inter-VLAN routing or management
An SVI is a virtual Layer 3 interface on a multilayer switch tied to a VLAN, providing a gateway IP address for hosts in that VLAN.
Question 6: An access port is assigned to VLAN 10, but VLAN 10 does not exist in the VLAN database. What is the port's operational state?
- The port forwards traffic normally using default settings
- The port is inactive and will not forward frames (Correct answer)
- The port automatically creates VLAN 10
- The port falls back to VLAN 1
Correct answer: The port is inactive and will not forward frames
A port assigned to a non-existent VLAN becomes inactive; traffic will not be forwarded until the VLAN is created in the database.
Question 7: Which command removes VLAN 20 from the list of VLANs allowed on a trunk port without affecting other VLANs?
- switchport trunk allowed vlan remove 20 (Correct answer)
- no switchport trunk allowed vlan 20
- switchport trunk remove vlan 20
- vlan 20 no trunk
Correct answer: switchport trunk allowed vlan remove 20
'switchport trunk allowed vlan remove 20' removes only VLAN 20 from the allowed list while leaving all other VLANs intact.
ICND1 VLAN Management 5
Which security threat exploits the default behavior of DTP to gain access to multiple VLANs?