A university connects IP phones, lab PCs and guest kiosks through access switches to a distribution layer, with voice needing priority and guest traffic rate-limited. Markings from PCs and kiosks cannot be trusted, but phone markings can if verified. Which classification and marking approach at trust boundaries enforces this policy?

The correct design enforces the trust boundary at access ingress by conditionally trusting only verified phone markings on the voice VLAN while overwriting PC and kiosk CoS/DSCP, which stops spoofed EF from hijacking priority queues and gives distribution switches reliable markings to provide LLQ for voice and policed forwarding for data. The alternative trusting lab PCs alongside phones fails on trust scope because PCs remain user-controlled and can mark EF to steal priority, violating the explicit untrusted-PC fact though its guest handling is sound. The alternative deferring PC and guest re-marking to distribution fails on boundary location because access egress scheduling and uplink congestion happen before correction, so untrusted markings already affect QoS. The alternative performing correct ingress trust and re-marking but without guest policers fails on enforcement completeness because marking without policing cannot rate-limit, letting guest bursts congest uplinks despite correct DSCP. For exams, distinguish where trust is applied from what is trusted, since conditional phone trust still requires CDP/LLDP verification and voice-VLAN ACLs. Practically verify with show mls qos interface and show policy-map interface that phone ports preserve CoS 5 to EF, PC and guest ports reset to configured DSCP, and guest class shows drops above CIR while voice queue shows priority service.