200-901 Network Fundamentals Practice Question
A network engineer is tasked with segmenting a large broadcast domain into smaller ones using VLANs. In the OSI model, at which layer does a VLAN operate?
⚠ Common exam trap
200-901 often tests the OSI layer of VLANs, and candidates might incorrectly choose Layer 3 because VLANs can be routed, but the segmentation itself is Layer 2.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Layer 2 - Data Link
VLANs operate at Layer 2 (Data Link) of the OSI model because they segment broadcast domains by tagging Ethernet frames with VLAN IDs (802.1Q). This allows logical separation of networks without regard to physical location, and switches use MAC addresses to forward frames within VLANs. Layer 2 is where framing, MAC addressing, and VLAN tagging occur.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Layer 2 - Data Link
Why this is correct
VLAN tags are carried in the Ethernet frame header, so segmentation of a broadcast domain occurs at Layer 2, the Data Link layer. Layer 3 handles logical IP addressing and routing between VLANs, not the broadcast domain boundary itself.
- ✗
Layer 4 - Transport
Why it's wrong here
VLANs operate at Layer 2, tagging Ethernet frames to partition broadcast domains; the Transport layer handles end-to-end connections and port-based multiplexing, not broadcast containment. Layer 4 would be the correct answer if the question concerned TCP or UDP segmentation rather than VLAN broadcast domain separation.
- ✗
Layer 1 - Physical
Why it's wrong here
VLANs are defined by 802.1Q frame tagging at Layer 2, so they cannot operate at the Physical layer, which deals with cabling, voltages and bit transmission. Layer 1 would be the correct answer if the question asked where repeaters or physical media specifications sit in the OSI model.
- ✗
Layer 3 - Network
Why it's wrong here
VLANs tag Ethernet frames, so they operate at Layer 2, not Layer 3. Layer 3 is where routing between those VLANs occurs, which is why the answer is tempting: routers and Layer 3 switches do interconnect segmented broadcast domains. The question asks where VLAN segmentation itself happens, which is the data-link layer.
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
This 200-901 question is part of Courseiva's 975-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-901 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-901 exam.