A 1200-user manufacturing campus connects Cisco phones with PCs daisy-chained behind them, plus guest laptops and printers in the same closets, and voice quality suffers when users copy large files. Which classification and marking approach establishes a correct trust boundary for end-to-end QoS?

The correct approach works because the trust boundary belongs at the access switch where file-copy contention first hits voice, using conditional trust for the Cisco phone that preserves its voice CoS while the service-policy re-marks daisy-chained PC traffic to default and forces guest laptops and printers to DSCP 0 so no untrusted marking propagates end to end. Extending CoS trust to PCs through the phone fails on trustworthiness because PCs can set CoS 5 for bulk transfers, so policing upstream cannot undo priority queuing delay already imposed on the access uplink where quality suffers. Using NBAR to classify voice while honoring existing DSCP from printers and guests fails on remarking because untrusted domains must be reset at ingress, otherwise arbitrary high markings steal priority and invalidate EF guarantees despite accurate voice identification. Setting the trust boundary at the distribution layer to re-mark voice and data centrally fails on placement because QoS must classify and mark closest to the source, and voice has already experienced loss and jitter on the congested access uplink before central policy applies. For exams remember centralized or application-aware methods look attractive but never replace edge trust with phone conditional trust. Practically verify with show mls qos interface, confirm voice stays EF and PC resets to default during an iperf file copy, and check that guest and printer captures show zero.