Which type of port must be an 802.1Q tagged port?

A trunk port is specifically designed to carry traffic for multiple VLANs over a single physical link. This is accomplished by using 802.1Q tagging, which adds a VLAN identifier to Ethernet frames. The tag provides information about which VLAN the frame belongs to, allowing switches to properly route the traffic to the correct destination based on its VLAN membership.

In contrast, an access port is intended for a single VLAN and does not employ tagging, as it connects end devices (like computers or printers) to the network and assumes the devices are part of that specific VLAN. Link Aggregation Groups (LAG) and the Link Aggregation Control Protocol (LACP) refer to methods for bundling multiple physical links into a single logical link for increased bandwidth and redundancy but do not inherently dictate whether the ports are tagged or untagged.

Hence, trunk ports are the required 802.1Q tagged ports, as tagging enables them to support multiple VLANs effectively.