nerdexam
Cisco

350-701 · Question #421

Refer to the exhibit. All servers are in the same VLAN/Subnet. DNS Server-1 and DNS Server-2 must communicate with each other, and communicate with default gateway multilayer switch. Which type of pri

The correct answer is D. Configure GigabitEthernet0/1 as promiscuous port, GigabitEthernet0/2 as isolated port, and. To allow DNS servers to communicate with each other and the gateway while isolating the file server, the gateway port should be promiscuous and the file server port should be isolated.

Submitted by tunde_lagos· Mar 30, 2026Network Security

Question

Refer to the exhibit. All servers are in the same VLAN/Subnet. DNS Server-1 and DNS Server-2 must communicate with each other, and communicate with default gateway multilayer switch. Which type of private VLAN ports should be configured to prevent communication and the file server?

Exhibit

350-701 question #421 exhibit

Options

  • AConfigure GigabitEthernet0/1 as community port, GigabitEthernet0/2 as promiscuous port,
  • BConfigure GigabitEthernet0/1 as community port, GigabitEthernet0/2 as isolated port, and
  • CConfigure GigabitEthernet0/1 as promiscuous port, GigabitEthernet0/2 as community port, and
  • DConfigure GigabitEthernet0/1 as promiscuous port, GigabitEthernet0/2 as isolated port, and

How the community answered

(15 responses)
  • A
    7% (1)
  • B
    13% (2)
  • C
    7% (1)
  • D
    73% (11)

Why each option

To allow DNS servers to communicate with each other and the gateway while isolating the file server, the gateway port should be promiscuous and the file server port should be isolated.

AConfigure GigabitEthernet0/1 as community port, GigabitEthernet0/2 as promiscuous port,

Configuring GigabitEthernet0/2 as promiscuous would allow the File Server (if G0/2) to communicate with all other ports, violating the isolation requirement.

BConfigure GigabitEthernet0/1 as community port, GigabitEthernet0/2 as isolated port, and

Configuring GigabitEthernet0/1 as a community port would restrict the default gateway's communication, preventing it from interacting with isolated ports and thus breaking essential connectivity for the File Server.

CConfigure GigabitEthernet0/1 as promiscuous port, GigabitEthernet0/2 as community port, and

Configuring GigabitEthernet0/2 as a community port would allow the File Server (if G0/2) to communicate with other community ports and the promiscuous port, failing to isolate it from the DNS servers.

DConfigure GigabitEthernet0/1 as promiscuous port, GigabitEthernet0/2 as isolated port, andCorrect

To prevent the File Server from communicating with other servers while allowing it to reach the default gateway, its port (assumed GigabitEthernet0/2) must be configured as an isolated port. The default gateway's port (assumed GigabitEthernet0/1), which needs to communicate with all devices in the private VLAN, must be configured as a promiscuous port. The DNS servers would then be configured as community ports to communicate with each other and the promiscuous gateway, but not the isolated file server.

Concept tested: Private VLAN port types

Source: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750/software/release/12-2_44_se/configuration/guide/scg/swpvlan.html

Topics

#Private VLANs#PVLAN port types#Network segmentation#Switch security

Community Discussion

No community discussion yet for this question.

Full 350-701 Practice