A wall jack in a warehouse office feeds one PC. The switch port should accept only that PC's untagged user VLAN and should refuse tagged frames from the user. How should the port be set?
Select an answer to reveal the explanation.
Short Explanation
A jack that serves one PC should be a single door into one room, not a loading dock that accepts every label the user sticks on a frame. You set the port as an access port in the user VLAN so it takes that VLAN untagged and does not honor tags from the PC. A trunk, even one that allows only that VLAN, or a spanning-tree root election, does not do that job.
Full Explanation
An access port belongs to one VLAN and expects untagged frames from the PC. The switch places those frames in the user VLAN and does not treat the PC as allowed to send tags for other VLANs. A trunk accepts tagged frames, which is the opposite of the requirement. A trunk that allows only the user VLAN is the tempting twin because the VLAN list looks narrow. It still accepts a tag, and the stem says the port should refuse tagged frames from the user. Making the switch the spanning-tree root changes which bridge is the center of the layer-2 tree. It does not select the VLAN or reject tags. Exam caveat: an access port can still have a voice VLAN for a phone that tags voice. That exception is for the phone, not permission for the PC to tag arbitrary VLANs. Operational check: confirm the port is an access port in the user VLAN, send an untagged frame and see it stay there, and confirm a tagged frame from the same jack is not accepted into another VLAN. Record the reading before the change and the reading after it so the next shift can see the symptom actually moved.