4. Data Link Layer, Ethernet and Local Area Networks

Introduction and Context

Computer communication does not occur directly between applications. Data passes through a sequence of layers, each of which performs a defined function. The data link layer is responsible for reliable communication between directly connected devices across a single physical or logical link. It receives packets from the network layer, organizes them into frames, controls access to shared media, detects transmission errors, and uses hardware addresses to deliver data within a local network.

The data link layer is especially important in local area networks (LANs), where computers, servers, printers, wireless access points, and other devices communicate over Ethernet or related technologies. Although modern networks are often presented as IP-based systems, IP packets cannot be transmitted on a local medium without data-link-layer services. Ethernet frames, MAC addresses, switches, VLANs, trunk links, link aggregation, and the Spanning Tree Protocol together form the operational foundation of most enterprise LANs.

For data science professionals, knowledge of LAN operation is valuable for understanding distributed data platforms, cloud connectivity, edge devices, network performance, security monitoring, and the movement of data between analytical systems. A poorly designed LAN can create latency, congestion, packet loss, broadcast storms, and security exposure even when servers and applications are correctly configured.

Learning Objectives

By the end of this chapter, the learner should be able to:

• explain the role and services of the data link layer;
• distinguish framing, flow control, error detection, and error correction;
• describe Ethernet frame structure and MAC addressing;
• compare hubs, bridges, switches, and routers in a LAN;
• configure and interpret VLANs, access ports, trunk ports, and 802.1Q tagging;
• explain link aggregation and the purpose of the Spanning Tree Protocol;
• design a small, resilient, and logically segmented Ethernet LAN;
• analyze common LAN failures, security risks, and performance problems.

The Data Link Layer: Communication Across One Link

The data link layer is Layer 2 of the OSI reference model. In the TCP/IP model, its functions are generally associated with the link or network-access layer. Its scope is narrower than that of the network layer: it does not normally provide end-to-end delivery across multiple networks. Instead, it transfers a frame from one directly connected node to another.

A useful distinction is between a physical link and a logical link. A physical link may be a copper cable, fiber-optic cable, or radio channel. A logical link may be a VLAN carried across several switches. The data link layer creates the rules by which devices use that link and interpret the transmitted bit stream.

Its principal responsibilities include:

1. Framing: grouping network-layer packets into identifiable units called frames.

2. Physical addressing: identifying interfaces using MAC addresses.

3. Media access control: determining when a device may transmit on a shared medium.

4. Error detection: determining whether a frame was corrupted during transmission.

5. Flow control: preventing a fast sender from overwhelming a slower receiver in technologies that provide this function.

6. Link management: establishing, maintaining, or negotiating characteristics of a link.

The OSI model divides the data link layer into the Logical Link Control (LLC) and Media Access Control (MAC) sublayers. In practical Ethernet networks, the MAC sublayer is particularly visible because it defines addressing, frame format, and access rules. LLC concepts are less prominent in contemporary Ethernet operation but remain useful for understanding the layered architecture.

Framing

The network layer creates packets, but a receiving interface must know where one packet ends and the next begins. Framing solves this problem by adding a header and trailer around the packet. Framing methods may use fixed-size units, length fields, special delimiter patterns, byte stuffing, or bit stuffing.

Ethernet uses a preamble and start-of-frame delimiter for synchronization, followed by a frame header, payload, and frame check sequence. The receiving interface examines the structure and verifies whether the frame is valid. If the frame is damaged or malformed, it is normally discarded rather than delivered upward.

Framing also supports multiplexing. A field in the Ethernet header identifies the upper-layer protocol or payload type. In Ethernet II, this is the EtherType field; for example, IPv4 and IPv6 have different EtherType values. The receiver can therefore pass the payload to the appropriate network-layer protocol.

Error Detection and Error Recovery

Transmission errors may result from electromagnetic interference, weak optical signals, damaged cables, faulty transceivers, or hardware defects. Ethernet uses a Cyclic Redundancy Check (CRC), carried in the Frame Check Sequence (FCS), to detect corruption. The sender calculates a value from the frame contents. The receiver performs the same calculation and compares the result.

A CRC can detect many common error patterns, including burst errors, but it does not repair a damaged frame. Ethernet normally discards a frame that fails the FCS check. Recovery is usually provided by a higher layer, such as TCP, which retransmits missing data. This illustrates an important design principle: error detection may occur at Layer 2, while reliable end-to-end recovery may occur at Layer 4.

Some link technologies use forward error correction, acknowledgements, or automatic repeat request mechanisms. The appropriate method depends on the medium, cost of retransmission, latency requirements, and expected error rate. Engineers must distinguish error detection from error correction; they are not interchangeable.

Flow Control and Duplex Operation

Flow control coordinates transmission rates between communicating devices. In a full-duplex switched Ethernet link, each endpoint can transmit and receive independently, so collisions do not occur. Ethernet pause frames may provide limited link-level flow control, although their use must be carefully considered because pausing a link can propagate congestion.

Half-duplex Ethernet permits transmission in only one direction at a time. Devices using Carrier Sense Multiple Access with Collision Detection (CSMA/CD) listen before transmitting and detect collisions while transmitting. When a collision occurs, devices wait for a calculated backoff period before trying again. CSMA/CD was essential for shared coaxial Ethernet and hubs, but it is largely historical in modern switched full-duplex networks.

Ethernet as the Dominant LAN Technology

Ethernet began as a shared-medium technology and evolved into a family of standards supporting copper, fiber, and various speeds. Ethernet's continuing importance arises from its interoperability, relatively low cost, high performance, and extensive ecosystem of switches, network interface cards, transceivers, and management tools.

A conventional Ethernet frame contains the following fields:

• Preamble and Start Frame Delimiter: allow receiver synchronization and indicate the beginning of the frame.
• Destination MAC address: identifies the intended receiving interface or group.
• Source MAC address: identifies the transmitting interface.
• 802.1Q tag, when present: carries VLAN and priority information.
• EtherType or length field: identifies the payload protocol or payload size.
• Payload: commonly an IP packet, although other protocols may be carried.
• Frame Check Sequence: contains the CRC used for error detection.

Ethernet frames have a minimum size, historically associated with collision detection, and a maximum standard payload size commonly called the Maximum Transmission Unit (MTU) for the network-layer packet. An 802.1Q VLAN tag adds four bytes to the Ethernet header. Oversized frames, sometimes called jumbo frames, may be supported in controlled environments, but all participating devices must agree on the configuration.

MAC Addresses

A MAC address is a data-link-layer identifier assigned to a network interface. A traditional Ethernet MAC address is 48 bits and is usually written as six hexadecimal octets, such as `00:1A:2B:3C:4D:5E`. The address contains an organizationally assigned portion and an interface-specific portion, although locally administered addresses are also possible.

The least significant bit of the first octet distinguishes unicast from multicast. A unicast address identifies one interface. A multicast address identifies a group of interfaces. The all-ones address, `FF:FF:FF:FF:FF:FF`, is the Ethernet broadcast address and reaches all devices in the broadcast domain.

MAC addresses are not equivalent to IP addresses. A MAC address is used for local delivery, while an IP address represents logical network-layer addressing and supports communication across networks. Address Resolution Protocol (ARP) maps an IPv4 address to a MAC address on the local network. IPv6 uses Neighbor Discovery rather than ARP.

A MAC address is not a permanent proof of identity. It can be changed or spoofed by software, and virtualization may generate or assign addresses dynamically. Consequently, MAC-based controls should be treated as one security signal rather than a complete authentication mechanism.

From Hubs to Switches

A hub repeats an incoming electrical or optical signal to all ports. It does not interpret MAC addresses and creates one shared collision domain. A bridge, by contrast, examines source MAC addresses, builds a forwarding table, and sends frames selectively. A modern Ethernet switch is essentially a high-performance multiport bridge.

When a switch receives a frame, it normally performs three operations. First, it learns the source MAC address on the incoming port and records it in its forwarding database. Second, it examines the destination address. If the destination is known and associated with a different port, the switch forwards the frame only through that port. If the destination is unknown, the switch floods the frame within the relevant VLAN. Broadcast and appropriate multicast frames are also flooded. Third, if the destination is associated with the same incoming port, the switch filters the frame rather than sending it back.

This learning process is dynamic. Entries age out because devices may move, interfaces may change, and stale information can cause incorrect forwarding. A switch does not normally inspect IP addresses to make ordinary Layer 2 forwarding decisions, although multilayer switches can also perform Layer 3 routing.

Switches create a separate collision domain per port, which enables full-duplex communication. They do not automatically create a separate broadcast domain for every port. Broadcast separation requires a router, Layer 3 switch, or VLAN boundary.

VLANs and Logical Segmentation

A Virtual Local Area Network (VLAN) divides a physical switching infrastructure into multiple logical broadcast domains. Devices in different VLANs cannot communicate directly at Layer 2; communication between them requires a Layer 3 routing function. VLANs therefore provide organization, traffic containment, and a foundation for policy enforcement.

For example, an organization might define separate VLANs for data-science workstations, servers, voice devices, guest access, and network management. Physical location no longer determines membership exclusively. A switch port can be assigned to a VLAN according to the attached device, user policy, or authentication result.

An access port normally carries traffic for one VLAN and connects to an end device. The device generally sends and receives ordinary untagged Ethernet frames. A trunk port carries traffic for multiple VLANs between switches, between a switch and a router, or between a switch and a virtualization host. VLAN identification is commonly conveyed using IEEE 802.1Q tags.

An 802.1Q tag includes a VLAN identifier and priority-related information. One VLAN may be designated as the native VLAN on a trunk, allowing its frames to be transmitted untagged in certain configurations. Native VLAN settings must match at both ends; mismatches can cause traffic leakage, connectivity failures, or security weaknesses.

VLANs are logical boundaries, not complete security boundaries. Misconfigured trunks, unauthorized switch access, VLAN hopping, compromised hosts, and incorrectly configured inter-VLAN routing can defeat intended isolation. Sensitive environments should combine VLANs with authentication, access-control lists, firewalls, encryption, monitoring, and least-privilege policies.

Inter-VLAN Routing

When a workstation in one VLAN must communicate with a server in another, a Layer 3 device routes the traffic. A traditional router may use one physical interface per network or a single trunk interface with multiple logical subinterfaces. A multilayer switch can route between VLAN interfaces at high speed.

The gateway address configured on an endpoint belongs to its VLAN. The endpoint sends traffic destined for another IP subnet to that gateway. The Layer 3 device removes the incoming data-link header, makes a routing decision, and creates a new data-link frame appropriate for the outgoing VLAN. Thus, the MAC addresses change at each routed hop, while the IP packet normally continues end to end, subject to routing and security policies.

Trunking and Link Aggregation

Trunking allows a single physical link to transport several VLANs. It reduces the number of cables required and supports scalable switch-to-switch designs. A trunk must be configured consistently, including the allowed VLAN list, tagging method, native VLAN, speed, duplex mode, and negotiation settings.

Link aggregation combines multiple physical links into one logical bundle. IEEE 802.1AX, historically associated with Link Aggregation Control Protocol (LACP), permits devices to negotiate and maintain an aggregate link. Aggregation can increase total capacity and provide resilience if one member link fails.

Link aggregation does not usually make one individual flow use every link simultaneously. Traffic is distributed using a hashing algorithm based on fields such as source and destination MAC addresses, IP addresses, and transport ports. A single large flow may therefore be limited to the speed of one member link, while multiple flows can share the aggregate capacity.

All links in a bundle should have compatible characteristics, including speed, duplex, VLAN configuration, and operational state. Partial or asymmetric configuration can cause loops, dropped traffic, or an apparently unstable connection. LACP is generally preferable to a manually forced bundle because it can detect some configuration inconsistencies.

Preventing Loops with Spanning Tree

Redundant links improve availability but can create Layer 2 loops. Unlike a routed network, Ethernet has no general-purpose hop count in the frame header to stop a frame indefinitely circulating. A loop can produce repeated frames, MAC-table instability, and a broadcast storm that consumes link capacity and switch resources.

The Spanning Tree Protocol (STP) prevents loops by placing selected redundant ports into a blocking or alternate state while maintaining a loop-free active topology. Switches exchange Bridge Protocol Data Units (BPDUs) and collectively select a root bridge. The root is determined using bridge identifiers, which include a configurable priority and a MAC address as a tiebreaker. Each non-root switch selects a root port, and designated ports are chosen for network segments. Other redundant paths are blocked for ordinary traffic.

Rapid Spanning Tree Protocol (RSTP) improves convergence compared with classic STP by using more efficient port roles and transition mechanisms. Multiple Spanning Tree Protocol (MSTP) can map groups of VLANs to spanning-tree instances, reducing control-plane overhead while permitting some traffic engineering.

STP should not be treated as a substitute for good design. The root bridge should be deliberately placed, redundant links should be documented, and edge ports should be configured for rapid transition where appropriate. Features such as BPDU Guard can disable an edge port if unexpected BPDUs arrive, protecting the topology from an unauthorized switch. Loop Guard and Root Guard can provide additional protection in suitable designs.

Designing a Reliable Ethernet LAN

LAN design begins with requirements rather than equipment selection. The designer should identify users, applications, traffic volumes, availability objectives, security zones, growth expectations, and management constraints. Data-intensive analytics environments may require high-speed uplinks, low oversubscription, and careful treatment of east-west traffic between servers.

A hierarchical design commonly separates access, distribution, and core functions. Access switches connect endpoints. Distribution devices aggregate access switches, enforce policy, provide routing, and support redundancy. A core layer provides fast, highly available interconnection in larger networks. Smaller sites may combine distribution and core functions in a collapsed-core design.

A sound design normally includes:

• structured addressing and clearly documented VLAN purposes;
• redundant uplinks where availability justifies the cost;
• correctly selected STP roots and controlled Layer 2 boundaries;
• link aggregation for appropriate high-capacity connections;
• separate management, user, server, voice, and guest access where required;
• restricted trunk VLAN lists rather than unnecessarily allowing every VLAN;
• monitoring of interface errors, utilization, MAC-table changes, and STP events;
• tested configurations, backups, and a documented change process.

Oversubscription deserves particular attention. If many 1-Gbps access ports share a 1-Gbps uplink, simultaneous traffic may exceed uplink capacity. Oversubscription is not automatically wrong; it is a design assumption that must reflect expected traffic patterns and service-level requirements. Server-heavy analytical workloads may make a lower oversubscription ratio appropriate.

Applied Case: Segmentation and Resilience in a Research Analytics Centre

Background

This illustrative case concerns a university research analytics centre that operates laboratory instruments, analyst workstations, virtualization hosts, and a public guest network. The centre initially used a flat Layer 2 LAN with several unmanaged switches. All devices shared one broadcast domain, and a single uplink connected the laboratory area to the server room.

Situation and Problem

Users reported intermittent delays when transferring large datasets to virtual machines. Network staff also observed excessive broadcasts and occasional loss of connectivity after a small unmanaged switch was connected. Laboratory instruments required stable connectivity, while guest devices needed Internet access but no access to internal systems.

Analysis

The flat design allowed unnecessary broadcast traffic to reach every endpoint. The single uplink was a potential bottleneck and single point of failure. The unmanaged switch made it impossible to control VLAN membership or detect a possible Layer 2 loop. In addition, guest traffic was not logically separated from research traffic.

Approach and Solution

The centre replaced unmanaged switches with managed access switches and introduced VLANs for laboratory instruments, analyst workstations, servers, management, and guests. Access ports were assigned explicitly. Trunks between access and distribution switches were configured to carry only the required VLANs, with a consistently defined native VLAN policy.

Layer 3 interfaces on the distribution switches became the default gateways for internal VLANs. Firewall rules restricted guest traffic to the Internet and permitted only the necessary flows between laboratory systems and analytical servers. Two distribution switches were connected using an LACP bundle. STP root placement was configured deliberately, and edge-port protections were enabled on user-facing ports. Interface counters and flow data were monitored to evaluate the effect of the redesign.

Outcome

The new design reduced the scope of broadcasts, eliminated the unmanaged switching risk, and provided resilience for the principal uplink. Large transfers still required capacity planning, but congestion could now be measured by VLAN and interface rather than inferred from user complaints. The separation of guest and research traffic also improved governance and incident response.

Learning Points

The case demonstrates that LAN performance and security are closely related to architecture. VLANs alone do not create security; routing policy and access controls are essential. Redundancy must be combined with loop prevention. Finally, monitoring should be designed into the network rather than added only after a failure.

Operational Risks, Limitations, and Common Mistakes

A frequent error is confusing a VLAN with an encrypted or fully secure network. VLAN configuration reduces broadcast scope but does not protect traffic from a compromised device within the same VLAN. Another mistake is allowing all VLANs on every trunk, which expands the impact of configuration errors and increases unnecessary exposure.

Duplex mismatches, speed negotiation failures, damaged cables, and faulty transceivers may produce late collisions, CRC errors, or input errors. Administrators should examine interface counters, optical power where relevant, logs, and physical connections rather than assuming that every problem is caused by an application.

Incorrect STP priorities can place the root bridge in an unintended location. Connecting a small unmanaged switch to two access ports can create a loop. Manually configuring link aggregation on only one side can produce unreliable behavior. An MTU mismatch can cause some large packets to fail while smaller tests succeed, making the problem difficult to diagnose.

MAC flooding and spoofing are additional concerns. A switch with an exhausted or manipulated MAC table may flood frames, increasing exposure. Port security, 802.1X authentication, DHCP snooping, Dynamic ARP Inspection, IP Source Guard, and storm-control features can reduce risk when correctly implemented. These controls require careful testing because overly restrictive policies may interrupt legitimate devices.

Professional and Governance Considerations

Enterprise LANs carry personal, financial, research, and operational data. Network segmentation should support data-classification policies and regulatory obligations, but technical separation must be validated rather than assumed. Logs should be collected proportionately, access to management interfaces should be restricted, and configuration changes should be attributable and reviewable.

Network administrators should maintain an inventory of switches, interfaces, VLANs, firmware versions, and dependencies. Vendor support status and software vulnerabilities should be monitored. Management traffic should use secure protocols, strong authentication, role-based authorization, and preferably a dedicated management network. Changes to STP, trunks, or aggregation should follow a documented rollback plan because a small Layer 2 error can affect a large population of users.

Automation and analytics are increasingly relevant. Configuration-management systems can standardize VLAN and interface settings, while telemetry platforms can detect unusual broadcast rates, MAC movement, interface errors, and abnormal utilization. Machine-learning methods may help identify anomalies, but they do not replace engineering validation: a legitimate experiment, backup operation, or planned migration may resemble an attack. Automated remediation should therefore include safeguards, approval thresholds, and audit trails.

Current Developments

Modern data centres increasingly use high-speed Ethernet, software-defined networking, virtualization-aware switching, and overlay technologies. Virtual extensible LAN (VXLAN), often combined with an Ethernet VPN control plane, can extend logical segmentation across routed data-centre fabrics and support large numbers of virtual networks. These technologies address scale limitations of traditional large Layer 2 domains but introduce additional control-plane and operational complexity.

Intent-based and controller-managed networks can express desired policies and automatically generate device configurations. Network telemetry, streaming statistics, and programmable interfaces improve visibility and integration with security and data platforms. At the same time, conventional Ethernet fundamentals remain essential: frames still require valid addressing, links still experience errors, and redundancy still requires loop control.

Best Practices for Practice and Examination

A disciplined approach to LAN problems follows the path of a frame. Identify the source and destination, determine the VLAN, inspect the access or trunk configuration, examine MAC-table learning, verify the gateway and routing boundary, and then check physical errors and control protocols. This method is more reliable than changing several settings at once.

Use explicit documentation for VLAN purpose, addressing, trunk membership, STP roles, and aggregation members. Prefer secure management and centralized monitoring. Design redundancy intentionally, test failure scenarios, and measure utilization under realistic workloads. Treat MAC addresses as local forwarding identifiers, not as proof of user identity. Finally, remember that a well-designed LAN is not merely fast: it is observable, segmented, resilient, supportable, and aligned with organizational risk.

Chapter Summary

The data link layer transfers data across a single link by framing packets, using MAC addresses, controlling media access, and detecting transmission errors. Ethernet frames contain addressing, payload identification, payload, and error-checking fields. Switches learn MAC addresses and selectively forward frames, while VLANs divide a physical switching infrastructure into logical broadcast domains. Access ports connect end devices; trunks carry multiple VLANs using 802.1Q tagging. Inter-VLAN communication requires Layer 3 routing. Link aggregation combines compatible links for capacity and resilience, while STP and its modern variants prevent redundant Layer 2 paths from forming loops. Effective LAN design combines segmentation, controlled redundancy, monitoring, security controls, and disciplined operational procedures.

Key Terms

Data link layer: OSI Layer 2, responsible for link-local delivery, framing, MAC addressing, and media access.

Frame: The data-link-layer unit containing a header, payload, and usually an error-detection trailer.

MAC address: A link-layer identifier assigned to an Ethernet interface.

Ethernet: A family of wired and related LAN technologies using Ethernet framing and MAC operation.

FCS: Frame Check Sequence containing a CRC for detecting frame corruption.

CRC: Cyclic Redundancy Check, an algorithm used to detect transmission errors.

Switch: A multiport Layer 2 device that forwards frames using learned MAC addresses.

Collision domain: A network segment in which simultaneous transmissions can collide.

Broadcast domain: The set of devices that receive a Layer 2 broadcast.

VLAN: A logical Layer 2 broadcast domain configured within switching infrastructure.

Access port: A switch port normally associated with one VLAN and an end device.

Trunk port: A port that carries traffic for multiple VLANs.

802.1Q: The Ethernet VLAN-tagging standard commonly used on trunk links.

Native VLAN: The VLAN whose frames may be transmitted untagged on a trunk.

Inter-VLAN routing: Layer 3 forwarding between different VLANs or subnets.

LACP: A protocol for negotiating and maintaining link aggregation.

STP: Spanning Tree Protocol, which prevents Layer 2 loops by controlling redundant paths.

BPDU: Bridge Protocol Data Unit exchanged by switches for spanning-tree operation.

Oversubscription: A condition in which potential access-port demand exceeds shared uplink capacity.

Port security: Controls that restrict or validate devices and MAC addresses on switch ports.

Review Questions

Short Answer Questions

1. What functions does the data link layer perform in a LAN?

2. How does a switch learn the location of a MAC address?

3. What is the purpose of the Ethernet FCS field?

4. Distinguish an access port from a trunk port.

5. Why is inter-VLAN communication a Layer 3 function?

Long Answer Questions

1. Explain Ethernet frame structure and describe the purpose of its major fields.

2. Discuss how VLANs, trunking, and inter-VLAN routing support scalable LAN design.

3. Explain link aggregation, including its benefits, requirements, and limitations for individual flows.

4. Describe the operation of STP and explain why redundant Ethernet links can be dangerous without it.

5. Develop a design for a resilient LAN serving users, servers, management systems, and guest devices.

Analytical / Application Questions

1. A switch reports rapidly changing MAC addresses on one port, while broadcasts increase sharply. Analyze the likely causes and propose a troubleshooting sequence.

2. An organization has four 1-Gbps access uplinks and one 1-Gbps distribution uplink. Assess the oversubscription implications and recommend factors that should guide redesign.

3. A guest laptop can reach an internal research server after a VLAN redesign. Identify possible configuration failures and explain how VLAN, trunk, routing, and firewall checks would isolate the problem.

22. Multiple Choice Questions with Answers

Question 1

A switch receives a frame whose destination MAC address is not present in its forwarding table. What does it normally do?

A. Drops the frame immediately

B. Floods the frame within the relevant VLAN

C. Routes the frame to the default gateway

D. Sends the frame only to the trunk port

Correct Answer: B. Floods the frame within the relevant VLAN

Question 2

Which mechanism detects corruption in a received Ethernet frame?

A. ARP

B. 802.1Q tagging

C. Frame Check Sequence using CRC

D. Spanning Tree Protocol

Correct Answer: C. Frame Check Sequence using CRC

Question 3

A trunk link is required primarily because it can

A. carry multiple VLANs over one physical link

B. convert MAC addresses into IP addresses

C. eliminate the need for Layer 3 routing

D. prevent all broadcast traffic

Correct Answer: A. carry multiple VLANs over one physical link

Question 4

Two hosts belong to different VLANs and need to communicate. Which function is required?

A. MAC flooding

B. Inter-VLAN Layer 3 routing

C. A hub-based collision domain

D. A second native VLAN

Correct Answer: B. Inter-VLAN Layer 3 routing

Question 5

What is the principal purpose of Spanning Tree Protocol?

A. Encrypting Ethernet payloads

B. Assigning IP addresses to hosts

C. Preventing Layer 2 forwarding loops

D. Increasing the MTU of every interface

Correct Answer: C. Preventing Layer 2 forwarding loops

Question 6

A network engineer configures four physical links with LACP. Which statement is most accurate?

A. Every individual flow must use all four links

B. The links can form one logical bundle and distribute multiple flows

C. The links automatically become four separate broadcast domains

D. LACP replaces the need for MAC learning

Correct Answer: B. The links can form one logical bundle and distribute multiple flows

Question 7

Which device creates separate collision domains for its individual ports in a conventional switched Ethernet LAN?

A. Hub

B. Repeater

C. Switch

D. Passive patch panel

Correct Answer: C. Switch

Question 8

A native VLAN mismatch on opposite ends of a trunk can cause

A. all MAC addresses to become globally unique

B. untagged traffic to be placed in unintended VLANs

C. CRC checking to be disabled permanently

D. STP to be unnecessary

Correct Answer: B. untagged traffic to be placed in unintended VLANs

Question 9

Why is a MAC address not sufficient as a complete identity or security control?

A. MAC addresses exist only on routers

B. MAC addresses cannot be used for local delivery

C. MAC addresses can be changed or spoofed

D. MAC addresses are always encrypted

Correct Answer: C. MAC addresses can be changed or spoofed

Question 10

A single 1-Gbps uplink connects several busy 1-Gbps access ports. What design issue should be examined first?

A. Whether the network has too many MAC address bits

B. Uplink oversubscription and expected traffic concurrency

C. Whether Ethernet frames need an IP address in their FCS

D. Whether VLANs eliminate physical cabling

Correct Answer: B. Uplink oversubscription and expected traffic concurrency