Question 448 of 464
At Which OSI Layer Does a Switch Forward Frames?
A network switch that forwards frames based on MAC addresses operates at which layer of the OSI model?
Quick Answer
The Data Link layer is correct because MAC-address-based forwarding is exactly the function this layer defines: it governs how devices on the same local network exchange frames using hardware addresses rather than the logical, routable addresses used at higher layers. A switch performs this by learning the source MAC address of every incoming frame and recording which port it arrived on, building a MAC address table it then uses to forward future frames only out the correct port instead of flooding them everywhere, which is what distinguishes switching from simply repeating signals to every connected device. This layer is also where error detection for frames happens, and its addressing scheme is defined by IEEE 802 standards rather than by IP addressing, which belongs to the layer above. Keeping this straight matters because a common mix-up is attributing MAC-based decisions to the Network layer simply because addressing is involved - the distinguishing factor is that MAC addresses are used for local delivery on a single network segment, not for routing between different networks. Whenever an exam question describes a device making forwarding decisions using MAC addresses or building an address table from frames it observes, that's the signature of Layer 2, the Data Link layer, at work.
⚠ Common exam trap
The N10-009 exam often tests the misconception that switches operate at Layer 3 because they can be configured with IP addresses for management (e.g., SVI), but the core frame-forwarding function remains at Layer 2 using MAC addresses.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Data Link
A network switch that forwards frames based on MAC addresses operates at Layer 2, the Data Link layer. This layer is responsible for node-to-node data transfer and error detection using MAC addresses, as defined by IEEE 802 standards. Switches build a MAC address table by learning source MAC addresses from incoming frames and use this table to make forwarding decisions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Physical
Why it's wrong here
Hubs and repeaters operate at Layer 1, not switches.
When this WOULD be correct
A question asking 'Which OSI layer defines electrical signals, cabling, and bit transmission?' would have Physical as the correct answer. Also, if the question were 'A repeater operates at which layer?', Physical would be correct.
- ✓
Data Link
Why this is correct
Switches make forwarding decisions based on MAC addresses, which is a Layer 2 function.
- ✗
Network
Why it's wrong here
Routers operate at Layer 3, using IP addresses for forwarding.
When this WOULD be correct
A question asking 'Which OSI layer routes packets based on IP addresses?' or 'At which layer does a router operate?' would have Network as the correct answer.
- ✗
Transport
Why it's wrong here
Transport layer (Layer 4) deals with protocols like TCP and UDP, not MAC forwarding.
When this WOULD be correct
A question asking which OSI layer provides reliable data transfer between hosts, such as TCP's connection-oriented service, would have Transport as the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓Data LinkCorrect answer▾
Why this is correct
Switches make forwarding decisions based on MAC addresses, which is a Layer 2 function.
✗PhysicalWrong answer — click to see why▾
Why this is wrong here
The Physical layer (Layer 1) handles raw bit transmission over a physical medium, not MAC address-based frame forwarding. A switch that forwards frames using MAC addresses operates at the Data Link layer (Layer 2).
★ When this WOULD be the correct answer
A question asking 'Which OSI layer defines electrical signals, cabling, and bit transmission?' would have Physical as the correct answer. Also, if the question were 'A repeater operates at which layer?', Physical would be correct.
Why candidates choose this
Candidates may confuse the switch's physical ports and cabling with the Physical layer, not realizing that the switching logic (MAC address table) is a Data Link layer function.
✗NetworkWrong answer — click to see why▾
Why this is wrong here
The Network layer (Layer 3) uses logical addressing (e.g., IP addresses) for routing packets between networks, not MAC addresses for forwarding frames within a single network.
★ When this WOULD be the correct answer
A question asking 'Which OSI layer routes packets based on IP addresses?' or 'At which layer does a router operate?' would have Network as the correct answer.
Why candidates choose this
Candidates may confuse MAC address forwarding with IP routing, or think that 'network' broadly refers to all networking functions, leading them to select the Network layer.
✗TransportWrong answer — click to see why▾
Why this is wrong here
The Transport layer (Layer 4) handles end-to-end communication, segmentation, and flow control, not MAC address-based frame forwarding, which is a Layer 2 function.
★ When this WOULD be the correct answer
A question asking which OSI layer provides reliable data transfer between hosts, such as TCP's connection-oriented service, would have Transport as the correct answer.
Why candidates choose this
Candidates may confuse the switch's forwarding decision with higher-layer protocols, or think that MAC addresses are part of the Transport layer because they are associated with network interfaces.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
OSI Model Reference
| Layer | Name | PDU | Key Protocols / Devices |
|---|---|---|---|
| 7 | Application | Data | HTTP, HTTPS, DNS, SMTP, FTP, SSH |
| 6 | Presentation | Data | TLS / SSL, JPEG, ASCII encoding |
| 5 | Session | Data | NetBIOS, RPC, SIP |
| 4 | Transport | Segment / Datagram | TCP, UDP |
| 3 | Network | Packet | IP, ICMP, OSPF — Routers |
| 2 | Data Link | Frame | Ethernet, Wi-Fi, PPP — Switches, Bridges |
| 1 | Physical | Bits | Cables, NICs, Hubs, Repeaters |
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on N10-009
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. At which layer of the OSI model does a switch that uses MAC addresses to forward frames operate?
easy- A.Layer 1
- ✓ B.Layer 2
- C.Layer 3
- D.Layer 4
Why B: A switch that uses MAC addresses to forward frames operates at Layer 2 (Data Link layer) of the OSI model. Layer 2 is responsible for node-to-node data transfer and error detection, using MAC addresses as the addressing scheme. The switch builds a MAC address table by learning source MAC addresses from incoming frames and then forwards frames based on the destination MAC address, making forwarding decisions at this layer.
Last reviewed: Jun 11, 2026
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.