A community college district wants the guest VLAN pruned from the courts closet trunk. What trunk feature enforces that least-privilege filtering?
Select an answer to reveal the explanation.
Short Explanation
Trunks can carry everything—or only what you allow. Trim the allowed VLAN list so the guest VLAN never rides into the courts closet. That is least privilege for Layer 2 highways, not a CDP or PortFast trick.
Full Explanation
Least-privilege filtering of the guest VLAN from the courts closet trunk is enforced with an allowed VLAN list that omits the guest VLAN on that interswitch link. Trunks can carry every VLAN by default in many deployments; explicitly allowing only required court-related VLANs prevents guest broadcast domains from extending into closets that have no business hosting them. That pruning is a Layer 2 policy control complementary to SSID mapping and firewall rules. Allowed-VLAN configuration is the CCNA trunk feature that matches the stem. CDP version negotiation that drops guest SSID names from neighbor TLVs affects discovery metadata, not which VLANs the trunk forwards. PortFast edge timers on trunk members are STP edge optimizations for access ports and do not filter guest VLANs on trunks. Static ARP entries for every guest client on the distribution SVI scale poorly and do not prune a VLAN from a courts closet trunk. Exam caveat: “allowed VLAN list” is pruning/filtering on the trunk—distinct from VTP pruning automation, though both relate to limiting VLAN flood scope. Operational check: on the courts uplink, configure switchport trunk allowed vlan to exclude guest, verify show interfaces trunk no longer lists guest as active toward courts, and confirm guest clients still work only where the guest VLAN is intentionally extended.