CCNA Switching and Network Access Practice Question
A switch receives a unicast frame for a destination MAC address that is not yet in its MAC address table. What does the switch do?
⚠ Common exam trap
Do not confuse switch flooding behavior for unknown unicast frames with dropping or routing behaviors.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Floods the frame out all ports in the same VLAN except the incoming port
An unknown unicast frame is flooded within the VLAN because the switch does not yet know which port leads to the destination MAC. The frame is not sent back out the receiving port.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Drops the frame immediately
Why it's wrong here
A normal Layer 2 switch does not drop frames just because the destination MAC is unknown; dropping would cause frames to be lost even when the target host is reachable on another port in the same VLAN. The switch has no mechanism to determine that the destination is unreachable, so it must forward the frame to all possible ports in the broadcast domain. Drops occur only under explicit conditions such as port-security violations, ACEs, or buffer exhaustion, not in response to an unknown unicast.
When this WOULD be correct
In a scenario where a switch is configured to drop all unicast frames for security reasons, such as in a highly restrictive network policy exam question, this option could be correct. For example, if the question specifies that the switch is in a security mode that prohibits unknown unicast traffic, dropping the frame would be the expected behavior.
- ✓
Floods the frame out all ports in the same VLAN except the incoming port
Why this is correct
When a switch receives a unicast frame whose destination MAC address is absent from its MAC address table (or has aged out), it treats the frame as an unknown unicast. Standard transparent bridging behavior is to flood the frame out every port that is a member of the same VLAN as the incoming port, but not the incoming port itself. This maximizes the chance that the intended recipient, which may be on any segment in that broadcast domain, receives the frame without any Layer 3 routing or address rewriting.
- ✗
Sends the frame to the default gateway first
Why it's wrong here
The default gateway is a router that facilitates IP traffic between different subnets, but the switch is purely operating at Layer 2 and makes its forwarding decision based on the destination MAC address. When that MAC address is unknown, the switch has no reason to forward the frame to the router, because the frame is not destined for the router's MAC and the switch does not consult routing tables. The gateway would only be involved if the frame's destination MAC were the router's own interface MAC, which is not the situation for an unknown unicast within a single VLAN.
When this WOULD be correct
In a scenario where a question asks about the behavior of a Layer 3 device, such as a router, when it receives a packet destined for an unknown IP address, the correct answer could involve sending the packet to the default gateway for further processing. This would clarify the role of the default gateway in routing decisions.
- ✗
Converts the frame to a broadcast packet
Why it's wrong here
Converting an unknown unicast into a broadcast would require changing the frame's destination MAC address from the specific unicast address to the broadcast MAC FF:FF:FF:FF:FF:FF, which fundamentally alters the frame's semantics. A switch does not modify the Layer 2 header during normal forwarding; flooding sends multiple copies of the exact original unicast frame, preserving the original destination MAC. Hosts that receive the flooded frame compare that original unicast destination against their own NIC addresses, so the frame is not treated as a broadcast at the receiving stations.
When this WOULD be correct
If the question asked about a network device that explicitly converts unicast frames to broadcast for specific purposes, such as a network appliance designed to propagate certain types of traffic, then this option could be correct. For example, a device configured to broadcast certain control messages might convert unicast frames accordingly.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Floods the frame out all ports in the same VLAN except the incoming portCorrect answer▾
Why this is correct
When a switch receives a unicast frame whose destination MAC address is absent from its MAC address table (or has aged out), it treats the frame as an unknown unicast. Standard transparent bridging behavior is to flood the frame out every port that is a member of the same VLAN as the incoming port, but not the incoming port itself. This maximizes the chance that the intended recipient, which may be on any segment in that broadcast domain, receives the frame without any Layer 3 routing or address rewriting.
✗Drops the frame immediatelyWrong answer — click to see why▾
Why this is wrong here
Switches are designed to forward unknown unicast frames by flooding, not dropping them. Dropping would occur only if the frame is malformed or security features like port security are violated.
★ When this WOULD be the correct answer
In a scenario where a switch is configured to drop all unicast frames for security reasons, such as in a highly restrictive network policy exam question, this option could be correct. For example, if the question specifies that the switch is in a security mode that prohibits unknown unicast traffic, dropping the frame would be the expected behavior.
Why candidates choose this
Students might think that if a switch doesn't know the destination, it should discard the frame to avoid unnecessary traffic, but this is incorrect because flooding ensures delivery.
✗Sends the frame to the default gateway firstWrong answer — click to see why▾
Why this is wrong here
A Layer 2 switch operates at the data link layer and does not involve the default gateway for forwarding decisions. The default gateway is used for routing between VLANs or subnets, not for unknown unicast flooding within a VLAN.
★ When this WOULD be the correct answer
In a scenario where a question asks about the behavior of a Layer 3 device, such as a router, when it receives a packet destined for an unknown IP address, the correct answer could involve sending the packet to the default gateway for further processing. This would clarify the role of the default gateway in routing decisions.
Why candidates choose this
Students may confuse the switch's behavior with that of a host or router, where unknown destinations are sent to the default gateway. However, switches flood unknown unicasts within the VLAN.
✗Converts the frame to a broadcast packetWrong answer — click to see why▾
Why this is wrong here
Switches flood the original unicast frame unchanged; they do not modify the frame type to broadcast. Broadcasting would change the destination MAC to FF:FF:FF:FF:FF:FF, which is not the case for unknown unicast flooding.
★ When this WOULD be the correct answer
If the question asked about a network device that explicitly converts unicast frames to broadcast for specific purposes, such as a network appliance designed to propagate certain types of traffic, then this option could be correct. For example, a device configured to broadcast certain control messages might convert unicast frames accordingly.
Why candidates choose this
The term 'flood' might be misinterpreted as 'broadcast', but flooding means sending the frame out all ports except the incoming port while preserving the original unicast destination MAC.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
OSI Model Reference
| Layer | Name | PDU | Key Protocols / Devices |
|---|---|---|---|
| 7 | Application | Data | HTTP, HTTPS, DNS, SMTP, FTP, SSH |
| 6 | Presentation | Data | TLS / SSL, JPEG, ASCII encoding |
| 5 | Session | Data | NetBIOS, RPC, SIP |
| 4 | Transport | Segment / Datagram | TCP, UDP |
| 3 | Network | Packet | IP, ICMP, OSPF — Routers |
| 2 | Data Link | Frame | Ethernet, Wi-Fi, PPP — Switches, Bridges |
| 1 | Physical | Bits | Cables, NICs, Hubs, Repeaters |
Go deeper
Related to this question
Learn chapter
Configuring Switch Ports for Desktops, VoIP Phones, APs, IoT, and Virtualized Hosts
Key term
MAC address table
A MAC address table is a data structure stored in a network switch that maps each of its ports to the MAC addresses of connected devices, enabling the switch to forward frames only to the correct destination.
Key term
Frame
A frame is a unit of data at the Data Link layer of networking, containing header, payload, and trailer information for local network delivery.
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.