N10-009 Question 157
Single answerA network administrator is deploying IP phones with built-in PC pass-through ports on an access switch. Users report that phones are registering correctly, but PCs connected through the phones cannot reach the corporate network. The switch port connected to each phone is currently configured as an 802.1Q trunk with VLAN 10 for data, VLAN 20 for voice, and the native VLAN left at the default. The administrator wants a secure, standards-based configuration that supports both the phone and the attached PC on a single switch port. Which of the following is the BEST configuration change?
- A
Configure the port as an access port in VLAN 10 and assign VLAN 20 as the voice VLAN
- B
Leave the port as a trunk, set VLAN 20 as the native VLAN, and allow VLANs 10 and 20
- C
Configure the port as an access port in VLAN 20 and use untagged traffic for both phone and PC
- D
Enable link aggregation on the phone-facing port so voice and data traffic can use separate logical links
Show answer and explanation
Correct answer: A
Explanation
The best answer is to configure the switchport as an access port in the data VLAN and assign a separate voice VLAN. In a typical IP phone deployment, the phone acts as a small Layer 2 bridge: the attached PC sends untagged traffic, which the switch maps to the access VLAN, while the phone tags its own voice traffic into the configured voice VLAN. This provides proper segmentation, aligns with common enterprise switch configuration practices, and supports QoS and security policies more cleanly than using a trunk to the endpoint.
In 802.1Q, the native VLAN is the VLAN that carries untagged frames on a trunk. Using the native VLAN incorrectly can cause traffic placement problems and increase the risk of VLAN hopping misconfigurations. For endpoint-facing ports with a phone and attached workstation, vendors commonly recommend an access VLAN plus a dedicated voice VLAN rather than a full trunk configuration. This also fits Network+ expectations around interface configuration, native VLAN behavior, and voice VLAN implementation.
These practices are consistent with standard enterprise switching guidance from major vendors such as Cisco and Aruba for converged access-layer phone deployments.
- A. Correct.
Correct. A common best practice for an IP phone with a PC connected through the phone is to configure the switch interface as an access port for the user data VLAN and assign a separate voice VLAN for the phone. In this design, the PC sends untagged traffic that is placed into the access VLAN (VLAN 10), while the phone tags voice traffic for the configured voice VLAN (VLAN 20). This is the standard enterprise access-layer approach on many vendor platforms and avoids the need to configure the endpoint-facing port as a general-purpose trunk.
- B. Incorrect.
Incorrect. Although the phone may be capable of tagging voice traffic, making the endpoint-facing port a trunk and setting the voice VLAN as the native VLAN is not the best practice here. The native VLAN carries untagged traffic on an 802.1Q trunk, and using it for voice would place untagged PC traffic into the voice VLAN unless the endpoint behavior is carefully controlled. This creates segmentation and security issues and is not the typical design for user/phone access ports.
- C. Incorrect.
Incorrect. Configuring the access VLAN as VLAN 20 would place untagged traffic, including PC traffic, into the voice network. That would prevent proper separation between user data and voice traffic and could interfere with security policy, QoS expectations, and address assignment. Phones and PCs sharing the same untagged VLAN defeats the purpose of a dedicated voice VLAN.
- D. Incorrect.
Incorrect. Link aggregation is used to combine multiple physical interfaces into one logical link for redundancy or increased bandwidth between compatible devices, such as switches or servers with multiple NICs. It does not solve the issue of separating voice and data VLANs on a single phone-facing access port. Most IP phones connect with a single Ethernet uplink and do not use link aggregation for this purpose.