N10-009 - Network Implementation (20% of the exam) - Section 2.1

Configure and deploy common Ethernet switching features, including VLANs, trunking, spanning tree, and port security.

Configure VLANs and 802.1Q trunk links to segment broadcast domains, and apply inter-VLAN routing where hosts on different VLANs must communicate. Deploy spanning tree (STP/RSTP) to prevent switching loops, and harden access ports with port security, DHCP snooping, and the correct native-VLAN and tagging configuration.

VLANs802.1Q trunkingSpanning Tree ProtocolPort security

Practice question for this objective

Free sampleNetwork Implementationmedium

On a single access switch, PC-A sits in VLAN 10 (subnet 10.1.10.0/24) and PC-B sits in VLAN 20 (subnet 10.1.20.0/24). Both link lights are up and each PC reaches other hosts inside its own VLAN, but PC-A cannot ping PC-B. What is required to let the two PCs communicate while keeping the VLANs separate?

AEnable an 802.1Q trunk between the two switchports so the VLAN tags carry the traffic across.
BAdd a Layer 3 device such as a router or multilayer switch to route between the VLAN 10 and VLAN 20 subnets. Correct
CEnable Spanning Tree Protocol for VLAN 10 and VLAN 20 to open a forwarding path between them.
DConfigure port security on both switchports to permit each PC's MAC address.

Hosts in different VLANs occupy different subnets and broadcast domains, so a Layer 3 device is required to route traffic between them. VLANs are separate Layer 2 broadcast domains mapped to different IP subnets, so traffic between them must be routed by a Layer 3 device; a router subinterface or a multilayer switch SVI supplies that inter-VLAN gateway.

Why A is wrong: Trunking sounds like it connects VLANs, but an 802.1Q trunk multiplexes several VLANs onto one switch-to-switch link; it does not route packets from one VLAN subnet into another.

Why B is correct: Each VLAN is a separate broadcast domain on its own IP subnet, so traffic between them must cross a Layer 3 boundary provided by a router subinterface or a multilayer switch SVI.

Why C is wrong: STP is tempting because it manages forwarding paths, but it only prevents Layer 2 loops within a broadcast domain and never routes traffic between two different VLAN subnets.

Why D is wrong: Port security is tempting when a host cannot pass traffic, but it only limits which MAC addresses a port accepts and does nothing to forward traffic between two separate VLAN subnets.

See more N10-009 practice questions, answers explained.

Exam traps in Network Implementation

Answers that look right on this material and are not. Each one is a distractor from a different question in the N10-009 bank for this domain.

An access port carries traffic for several VLANs by tagging each frame, whereas a trunk port belongs to exactly one VLAN and forwards untagged frames.
Why it is wrong: This states the real distinction but reverses it: tagging many VLANs is the trunk's job and single-VLAN untagged forwarding is the access port's.
The native VLAN is set to 60 on both ends of the trunk, which strips and discards the VLAN 60 tags.
Why it is wrong: This looks plausible because the native VLAN is carried untagged, but if both ends agreed on native VLAN 60 the untagged frames would still be delivered, so this would not break VLAN 60 connectivity.
Add VLAN 30 to the trunk's allowed VLAN list on the switch's uplink port to the core.
Why it is wrong: Editing the uplink allowed list is tempting because VLAN 30 is involved, but the workstation's own access port is misassigned to VLAN 1, and the host port is not a trunk.

Examworthy is not affiliated with or endorsed by CompTIA. Original, blueprint-aligned practice material only.