VLANs and Access Port Configuration
A VLAN is a logical broadcast domain created inside a switch, letting one physical switch behave as several independent switches. Ports assigned to different VLANs cannot reach each other without a router or a layer 3 switch, so VLANs are used to separate departments, voice from data, and management from user traffic. An access port belongs to exactly one data VLAN and carries untagged frames to and from the endpoint, and it may additionally carry a voice VLAN so an IP phone and the PC behind it can use the same cable. VLAN 1 is the default for every port and cannot be deleted, which is why good practice moves user traffic, the native VLAN and management off VLAN 1. VLANs 1 and 1002 to 1005 are reserved; 2 to 1001 are the normal range and 1006 to 4094 are the extended range.
Exam tip. If two hosts on the same switch cannot ping each other, check that both ports are in the same VLAN and that the VLAN exists and is active in show vlan brief. A port assigned to a VLAN that was never created will not forward.
802.1Q Trunking and the Native VLAN
A trunk carries traffic for many VLANs over one link by inserting an 802.1Q tag into each Ethernet frame. The tag is a four-byte field added after the source MAC address containing the VLAN ID and a three-bit priority field used by QoS. One VLAN on each trunk is the native VLAN, and its frames are sent untagged; by default this is VLAN 1. Both ends of a trunk must agree on the native VLAN or the switches will report a mismatch through CDP and traffic from the two native VLANs will be merged, which is both a connectivity problem and a security problem. You should prune the allowed VLAN list on a trunk so it carries only the VLANs that are actually needed, and set trunks statically with switchport mode trunk rather than relying on the Dynamic Trunking Protocol to negotiate them.
Exam tip. A native VLAN mismatch does not bring the link down; it silently bridges two VLANs together. Look for it whenever a topology shows unexpected reachability between VLANs.
Interswitch Connectivity with CDP and LLDP
Discovery protocols let directly connected devices advertise who they are, which is invaluable for documenting and troubleshooting a network you did not build. Cisco Discovery Protocol is Cisco proprietary, enabled by default on Cisco gear, and advertises the neighbour's device ID, local and remote interface, platform and capabilities every 60 seconds with a 180 second holdtime. Link Layer Discovery Protocol is the IEEE 802.1AB open standard, disabled by default on Cisco devices, and must be enabled globally and optionally per interface for transmit and receive. Both operate over layer 2 only, so they show you what is on the other end of a cable even when IP addressing is broken. Because they leak topology information, both are usually disabled on ports facing untrusted networks or the internet edge.
Exam tip. If a question shows a mixed-vendor topology and asks how to discover neighbours, the answer is LLDP, and remember you must enable it because it is off by default.
Spanning Tree Protocol Fundamentals
Ethernet frames have no TTL, so a redundant layer 2 topology without protection produces broadcast storms, MAC table instability and endless duplicate frames. Spanning tree solves this by electing one root bridge and then blocking any port that would create a loop, leaving a single active path between any two points. The election compares bridge IDs, which are the bridge priority followed by the switch MAC address: the lowest bridge ID wins, and because the default priority of 32768 is the same everywhere, the oldest switch with the lowest MAC often wins by accident. Priority is set in increments of 4096 and the VLAN ID is added to it as the extended system ID. Every non-root switch then picks one root port, the port with the lowest cumulative cost back to the root, and each segment picks one designated port; everything else is blocked.
Exam tip. Work the election in strict order every time: lowest bridge ID becomes root, then lowest root path cost picks root ports, then ties break on lowest neighbour bridge ID and finally lowest port ID.
STP Port States, Roles and Edge Port Features
Classic 802.1D moves a port through blocking, listening, learning and finally forwarding, taking up to 50 seconds, which is far too slow for a PC waiting to get a DHCP address. Rapid spanning tree reduces the states to discarding, learning and forwarding and converges in seconds by using proposal and agreement handshakes on point-to-point links. On access ports facing endpoints you should enable PortFast so the port goes straight to forwarding, and pair it with BPDU Guard so that if a switch is ever plugged into that port and sends a BPDU, the port is immediately placed in err-disabled state. Root Guard protects the position of the root bridge by err-disabling a port that receives a superior BPDU, which is how you stop a rogue or badly configured switch from taking over the tree.
Exam tip. PortFast plus BPDU Guard belongs on every access port, and neither belongs on a trunk. A question describing a user port that takes nearly a minute to pass traffic is pointing at missing PortFast.
EtherChannel with LACP, PAgP and Static Mode
EtherChannel bundles up to eight physical links into one logical port channel so that spanning tree sees a single interface and no member link is blocked, which turns redundant uplinks into extra bandwidth instead of wasted capacity. Traffic is distributed across members by a hash of selected fields such as source and destination MAC or IP, so a single conversation still rides one physical link and load sharing is only even when there are many flows. Channels can be negotiated with the open standard LACP using active and passive modes, with Cisco's PAgP using desirable and auto modes, or configured unconditionally with mode on at both ends. Every member port must match in speed, duplex, allowed VLANs, native VLAN and switchport mode, otherwise the port is suspended from the bundle.
Exam tip. Expect a question giving the mode on each side and asking whether the bundle forms. Two passive or two auto ends never negotiate, and mixing LACP with PAgP never works.
Wireless Architectures, AP Modes and CAPWAP
Wireless deployments differ mainly in where the intelligence sits. In an autonomous design each access point holds its own configuration, SSIDs and security settings and connects to a trunk port, which is fine for a handful of APs and painful for hundreds. In a split-MAC or controller-based design the AP becomes lightweight and forms CAPWAP tunnels to a wireless LAN controller: a UDP 5246 control tunnel that is encrypted with DTLS and a UDP 5247 data tunnel that is not encrypted by default. The controller handles configuration, RF management, roaming and client policy while the AP handles the real-time radio work. Cloud-managed designs move the management plane to a hosted service. FlexConnect lets a branch AP switch client traffic locally instead of tunnelling it back over the WAN, and keeps working if the WAN link to the controller drops.
Exam tip. Learn the CAPWAP port numbers and remember that only the control tunnel is encrypted by default. A question about a branch AP that must keep serving clients when the WAN drops is describing FlexConnect.
Wireless RF Fundamentals, Bands and Channels
Wi-Fi is a half-duplex shared medium: only one station in a cell transmits at a time, and collisions are avoided rather than detected using CSMA/CA. The 2.4 GHz band offers greater range and better wall penetration but only three non-overlapping 20 MHz channels in most regulatory domains, which are 1, 6 and 11. The 5 GHz band offers many more non-overlapping channels and therefore much higher capacity, at the cost of shorter range, and some of its channels require dynamic frequency selection to protect radar. Wi-Fi 6E and Wi-Fi 7 add the 6 GHz band with even more spectrum. An SSID is the network name a client joins, while the BSSID is the radio MAC address of one AP's cell; several APs sharing an SSID form an extended service set that allows roaming. Overlapping cells on the same channel cause co-channel interference, so channel planning matters more than raw transmit power.
Exam tip. Any question that offers a 2.4 GHz channel plan other than 1, 6 and 11 is offering a wrong answer. Also remember Wi-Fi is half duplex, so a cell's throughput is shared by every client on it.