Parks and recreation wants to harden city-hall trunks by moving the native VLAN away from its factory default. Which change best matches that hygiene step?
Select an answer to reveal the explanation.
Short Explanation
Leaving the native VLAN on VLAN 1 is like leaving the spare key under the doormat—everybody knows where to look. Move native to a unused, dedicated VLAN on both ends and keep user traffic off that ID.
Full Explanation
Parks-and-recreation trunk hygiene starts by moving the native VLAN off the factory default. Cisco trunks default native to VLAN 1, which is widely assumed and historically targeted by untagged-frame tricks and VLAN-hopping techniques. Configuring a dedicated, unused non-default native VLAN on both ends of each city-hall trunk keeps untagged traffic on a controlled ID that carries no user data, while tagged municipal VLANs continue to carry production traffic. Both trunk ends must still match after the change so untagged frames land in the same broadcast domain.
Disabling 802.1Q and carrying every VLAN untagged collapses the design into access-style single-VLAN links and destroys multi-VLAN trunking the campus needs. Setting every trunk native back to VLAN 1 reaffirms the weak default rather than hardening it. Replacing trunks with access ports plus router-on-a-stick for every closet uplink is an architectural rewrite, not the targeted native-VLAN hygiene step the question asks for, and it adds unnecessary Layer 3 hops for ordinary interswitch VLAN extension.
Exam caveat: changing the native VLAN on only one end creates a silent mismatch that can be worse than leaving VLAN 1 in place. Always change and verify both sides together, and keep the dedicated native VLAN out of access ports used by end users.
Operational check: pick an unused VLAN ID reserved only for native use, set it as native on both trunk ends, prune user VLANs from that ID, verify with trunk status commands, and record the civic standard so every new trunk follows the same non-default native policy.