nerdexam
Palo_Alto_Networks

PCNSE · Question #94

A network design calls for a "router on a stick" implementation with a PA-5060 performing inter- VLAN routing All VLAN-tagged traffic will be forwarded to the PA-5060 through a single dot1q trunk inte

The correct answer is D. Layer 3 subinterface type with specified tag. For a 'router on a stick' implementation on a Palo Alto Networks firewall, a Layer 3 subinterface with a specified VLAN tag is the required interface type to perform inter-VLAN routing.

Submitted by tom_us· Apr 18, 2026Deploy and Configure

Question

A network design calls for a "router on a stick" implementation with a PA-5060 performing inter- VLAN routing All VLAN-tagged traffic will be forwarded to the PA-5060 through a single dot1q trunk interface Which interface type and configuration setting will support this design?

Options

  • ATrunk interface type with specified tag
  • BLayer 3 interface type with specified tag
  • CLayer 2 interface type with a VLAN assigned
  • DLayer 3 subinterface type with specified tag

How the community answered

(20 responses)
  • A
    10% (2)
  • C
    5% (1)
  • D
    85% (17)

Why each option

For a 'router on a stick' implementation on a Palo Alto Networks firewall, a Layer 3 subinterface with a specified VLAN tag is the required interface type to perform inter-VLAN routing.

ATrunk interface type with specified tag

A 'Trunk interface type' is not a standard, configurable interface type in Palo Alto Networks PAN-OS; the functionality of carrying multiple VLANs on a single physical link is achieved through subinterfaces.

BLayer 3 interface type with specified tag

A standard Layer 3 interface handles untagged traffic or a single subnet, and it cannot process multiple tagged VLANs over one physical interface without being configured as subinterfaces.

CLayer 2 interface type with a VLAN assigned

A Layer 2 interface operates at the data link layer and forwards frames within a VLAN; it does not perform inter-VLAN routing, which is a Layer 3 function.

DLayer 3 subinterface type with specified tagCorrect

A Layer 3 subinterface, configured with a specific VLAN tag (dot1q tag), allows a single physical interface to process traffic for multiple VLANs, effectively serving as the default gateway for each VLAN and enabling routing between them.

Concept tested: Inter-VLAN routing with subinterfaces (router on a stick)

Source: https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/networking/configure-interfaces/configure-a-layer-3-interface/configure-a-layer-3-subinterface

Topics

#Inter-VLAN Routing#Router on a Stick#Interface Configuration#Subinterfaces

Community Discussion

No community discussion yet for this question.

Full PCNSE Practice