When a tagged packet is received on a SAP configured with dot1q encapsulation, the VLAN tag must match the value configured on the SAP in order to be forwarded.

The statement is true. The fundamental purpose of dot1q encapsulation on a Service Access Point (SAP) is to use the IEEE 802.1Q VLAN tag as the service delimiter. When a tagged Ethernet frame arrives at a physical port, the router inspects the VLAN ID in the frame's header. If this VLAN ID matches the value configured for a specific SAP on that port (e.g., sap 1/1/1:100), the frame is accepted and processed by the service associated with that SAP. Frames with VLAN tags that do not match any configured SAP on the port are discarded.

This is a true/false question. The statement accurately describes the behavior of a dot1q SAP, so "False" would be incorrect. This mechanism is essential for multiplexing multiple Layer 2 services on a single physical interface.

1. Nokia 7750 SR OS Services Guide, Release 21.10.R1, "Service Access Points (SAPs)" section. The documentation states: "For dot1q and qinq encapsulations, the VLAN tags are used to identify the SAP. When a packet is received on a port, the VLAN tag determines which SAP the packet belongs to." This directly confirms the statement.