DiffServ Trust Boundary: Which Ports Need Explicit Trust?

300-420 By islever Editorial Last updated

Design end-to-end QoS policies Select QoS strategies to meet customer requirements (DiffServ, IntServ)

Short answer

B Configure explicit QoS trust on ingress ports F and G so the already-classified access-layer traffic is accepted into the DiffServ domain.

Question

Refer to the exhibit.
Exhibit: DiffServ Trust Boundary: Which Ports Need Explicit Trust?
Which two points in the network must an engineer configure the ports for explicit trust when using a DiffServ model?
  1. B and E
  2. F and G Correct Answer
  3. A and D
  4. C and D

Key Takeaways

It tests where to establish an explicit QoS trust boundary in DiffServ and the trap of configuring trust on egress or core-facing interfaces where markings are not accepted.

This Cisco 300-420 QoS item tests the DiffServ trust boundary; the ports requiring explicit trust are F and G (option B), because trust is evaluated on ingress traffic after access-layer classification.

Common mistake: A common mistake is choosing a pair that includes an egress or upstream interface, such as option A's B/E combination, just because it is near the traffic path; trust commands are ingress-only, so both selected points must receive the already-marked traffic.

Expert Analysis

Trust is an ingress decision. DiffServ separates classification at the edge from per-hop treatment in the core. Cisco QoS trust, whether configured with mls qos trust dscp, mls qos trust cos, or a policy-map that admits DSCP, is evaluated when traffic enters an interface; it does not act on egress. That behavior eliminates any choice that places trust on an outbound or unrelated core-facing link.

The trust boundary sits where marked traffic enters the DiffServ domain. In this exhibit, the access layer has already classified and marked the traffic. The two ingress ports labeled F and G are where that traffic enters the next QoS domain, so those interfaces need explicit trust. Accepting the DSCP/CoS values at F and G preserves the access-layer classification across the distribution layer; without trust there, the switch can overwrite or ignore the markings and the intended per-hop behavior is lost.

Why the other pairs fail. Option A (B and E) is tempting but mixes an ingress point with an egress or upstream point, where a trust setting cannot preserve incoming markings. The pairs in C and D include labels that do not represent the two ingress interfaces accepting the access-layer classification. The useful community observation is correct: QoS trust commands are processed only on ingress, so the chosen points must be the interfaces where the already-classified traffic is received. Placing trust closer to the source is a good general goal, but it does not justify configuring trust on ports that are not the ingress boundary.

Correct answer: B — F and G, because explicit trust must be configured on the two ingress ports that accept the access-layer markings into the DiffServ domain.

Exam Strategy

For trust-boundary questions, first eliminate any labeled point on an egress or core-facing link because QoS trust is evaluated only on ingress. Then identify where classification has already occurred and select the ingress interfaces that accept those markings into the DiffServ domain. This two-step filter also works for marking, policing, and queuing exhibit questions.

Frequently Asked Questions

Why are F and G the explicit trust points?

They are the ingress interfaces that receive traffic after it has been classified at the access layer; trusting their DSCP/CoS preserves the DiffServ marking as it enters the distribution domain.

Why can't a trust command be applied to an egress port?

QoS trust is evaluated on ingress. An egress port does not re-classify or accept incoming DSCP/CoS, so configuring trust there has no effect on the markings.

Does every endpoint-facing port need explicit trust?

No. Trust should be scoped to the boundary and to devices whose markings are trusted; unprotected PC or printer ports should generally remain untrusted or be re-marked.

More 300-420 FAQ →

Community Votes

B
57%
A
29%
D
14%

57% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 7 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 7

  1. TheGorn 👍 2 Answered B
    https://networklessons.com/quality-of-service/how-to-configure-qos-trust-boundary-on-cisco-switches
  2. G_Singh12 👍 1 Answered B
    QoS trust commands (like mls qos trust or modern class-maps/policy-maps) are processed only when traffic enters a port (Ingress). They do not do anything when traffic leaves a port (Egress).
  3. _MaGIC_13 👍 1 Answered B
    Access Switch already has the built-in trust. You should also place your Trust Boundary as close to the source as possible.
  4. salmarin 👍 1 Answered B
    F-G as traffic already classified by the access layer
  5. Ade43 👍 1 Answered D
    The printer and IP phone generate trusted traffic
Show 2 more comments
  1. VasiliyF 👍 1 Answered A
    Access → Distribution
  2. RexChen 👍 1 Answered A
    i think it's A

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

POV Report Builds the Customer Platform During Discovery

S-grade

VPLS design for sites sharing one IP subnet

S-grade

Inter-VN Communication in Cisco SD-WAN Architecture

S-grade

Advertising a Default Route from Core to Aggregation to Hide Instability

S-grade

Practice All 300-420 Questions

Access 150 questions with complete answers and detailed explanations.

View Full 300-420 Practice Test →

← Back to 300-420 Study Guide