N10-009 Question 153
Single answer2.2 Given a scenario, configure switching technologies and features.A network administrator is replacing an unmanaged switch with a managed Layer 2 switch in a small office. The office has three groups that must remain logically separated: employees, VoIP phones, and guest devices in the lobby. The company has only one switch uplink to the router-on-a-stick device that provides inter-VLAN routing. Employee PCs and phones will share the same wall jack at each desk, with the phone's internal switch passing PC traffic through. Which switch configuration should the administrator implement to support this design while keeping traffic segmented?
- A
Configure access ports for employee VLANs on desk-facing interfaces, assign a voice VLAN for IP phones on those same interfaces, and configure the uplink as an 802.1Q trunk carrying the employee, voice, and guest VLANs.
- B
Configure every switch port as an 802.1Q trunk so PCs, phones, and guest devices can tag their own traffic and reach the router directly.
- C
Configure port mirroring on desk-facing interfaces so voice and employee traffic can be separated and forwarded to the router uplink.
- D
Configure the guest lobby ports as part of a link aggregation group with the router uplink so guest traffic remains isolated from employee and voice traffic.
Show answer and explanation
Correct answer: A
Explanation
The best practice in this scenario is to use VLANs to create logical separation and an 802.1Q trunk on the uplink because only one physical uplink is available. For desks with IP phones and PCs sharing a port, the access port is placed in the data VLAN and a voice VLAN is assigned so the phone can place voice traffic into the correct VLAN while the attached PC remains in the employee data VLAN. Guest devices should be placed in their own VLAN on the appropriate access ports. The uplink to the router-on-a-stick must carry all required VLANs using 802.1Q tagging. This aligns with standard enterprise switching practices and common vendor documentation for VLANs, voice VLANs, and trunking. Port mirroring is for monitoring, and link aggregation is for bandwidth/redundancy, not segmentation.
- A. Correct.
Correct. This is the standard design for a converged access layer. User-facing switch ports are typically configured as access ports in the data VLAN for employee PCs, with a separate voice VLAN assigned for the IP phone. The switch can distinguish voice traffic from PC traffic on the same physical port. The single uplink to a router-on-a-stick must be configured as an 802.1Q trunk so multiple VLANs can traverse that one link for inter-VLAN routing. This preserves segmentation for employees, voice, and guests.
- B. Incorrect.
Incorrect. End-user ports are not normally configured as trunks for general PCs and guest devices. Most PCs and guest devices do not tag traffic, and allowing trunks on user-facing ports creates unnecessary security and management risks. A trunk is appropriate on the uplink carrying multiple VLANs, not on every endpoint-facing interface.
- C. Incorrect.
Incorrect. Port mirroring, also called SPAN, is used to copy traffic to a monitoring device for analysis, troubleshooting, or intrusion detection. It does not provide segmentation or VLAN separation. Someone might choose this option if they confuse traffic copying with traffic isolation.
- D. Incorrect.
Incorrect. Link aggregation combines multiple physical links into one logical link to increase bandwidth and/or redundancy. It does not isolate guest traffic. Guest isolation in this scenario is achieved with a separate VLAN that is carried over the uplink trunk to the router for policy enforcement.