200-901 Network Fundamentals Practice Question
An engineer is troubleshooting a connectivity issue between two devices on different VLANs. The switch connecting the devices is configured with 802.1Q trunking. At which OSI layer do VLANs operate?
⚠ Common exam trap
It's easy for candidates to confuse the layer where VLANs are defined (Layer 2 tagging) with the layer required to route between them (Layer 3), causing candidates to pick Layer 3.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Layer 2
VLANs operate at Layer 2 (the Data Link layer) of the OSI model because they segment a single physical switch into multiple logical broadcast domains using 802.1Q tags inserted into Ethernet frames. The 802.1Q tag adds a 12-bit VLAN ID field to the Ethernet frame header, which is a Layer 2 construct. Routing between VLANs requires a Layer 3 device (router or Layer 3 switch), but the VLAN membership and tagging itself is strictly a Layer 2 function.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Layer 2
Why this is correct
VLAN tags and 802.1Q trunk encapsulation are defined in Ethernet frames, so VLANs operate at Layer 2 of the OSI model. This satisfies the stem's requirement to identify the layer governing inter-VLAN connectivity across the trunked switch.
- ✗
Layer 4
Why it's wrong here
VLANs operate at Layer 2, where 802.1Q tags are inserted into Ethernet frames; Layer 4 concerns TCP/UDP ports and has no bearing on VLAN membership or trunking. Layer 4 is tempting because access control lists and firewall rules often filter traffic using port numbers, which engineers associate with segmentation.
- ✗
Layer 1
Why it's wrong here
VLANs are defined by 802.1Q tags in Ethernet frames at Layer 2, not by physical signalling, cabling or encoding at Layer 1. Layer 1 is tempting because trunk links and interface states are physical concerns, and a down port certainly breaks connectivity, but that does not place VLAN operation at the physical layer.
- ✗
Layer 3
Why it's wrong here
VLANs are Layer 2 constructs; Layer 3 addressing is required only when routing between VLANs via an SVI or router. Layer 3 is tempting because inter-VLAN communication needs a Layer 3 device, so engineers conflate the layer that forwards traffic between VLANs with the layer at which VLANs themselves are defined.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-901 question from scratch — 975 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-901 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-901 exam.