At Which OSI Layer Does a Switch Forward Frames?
A network switch that forwards frames based on MAC addresses operates at which layer of the OSI model?
Quick Answer
The Data Link layer is correct because MAC-address-based forwarding is exactly the function this layer defines: it governs how devices on the same local network exchange frames using hardware addresses rather than the logical, routable addresses used at higher layers. A switch performs this by learning the source MAC address of every incoming frame and recording which port it arrived on, building a MAC address table it then uses to forward future frames only out the correct port instead of flooding them everywhere, which is what distinguishes switching from simply repeating signals to every connected device. This layer is also where error detection for frames happens, and its addressing scheme is defined by IEEE 802 standards rather than by IP addressing, which belongs to the layer above. Keeping this straight matters because a common mix-up is attributing MAC-based decisions to the Network layer simply because addressing is involved - the distinguishing factor is that MAC addresses are used for local delivery on a single network segment, not for routing between different networks. Whenever an exam question describes a device making forwarding decisions using MAC addresses or building an address table from frames it observes, that's the signature of Layer 2, the Data Link layer, at work.
⚠ Common exam trap
The N10-009 exam often tests the misconception that switches operate at Layer 3 because they can be configured with IP addresses for management (e.g., SVI), but the core frame-forwarding function remains at Layer 2 using MAC addresses.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Data Link
A network switch that forwards frames based on MAC addresses operates at Layer 2, the Data Link layer. This layer is responsible for node-to-node data transfer and error detection using MAC addresses, as defined by IEEE 802 standards. Switches build a MAC address table by learning source MAC addresses from incoming frames and use this table to make forwarding decisions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Physical
Why it's wrong here
Layer 1 concerns signalling, cabling and bit transmission, with no frame or MAC awareness. Forwarding frames by MAC address requires reading the Layer 2 header, so Physical describes a repeater or hub; it would be correct for media and connector specifications.
When this WOULD be correct
A question asking 'Which OSI layer defines electrical signals, cabling, and bit transmission?' would have Physical as the correct answer. Also, if the question were 'A repeater operates at which layer?', Physical would be correct.
- ✓
Data Link
Why this is correct
MAC address forwarding is a Layer 2 function: switches build a MAC address table and forward frames based on destination MAC, which is the Data Link layer's addressing scheme. Layer 3 handles IP routing, so Data Link is the correct OSI layer for this behaviour.
- ✗
Network
Why it's wrong here
Layer 3 forwarding relies on IP addresses and routing tables, not MAC addresses. A switch reading destination MAC addresses operates at Layer 2, so Network describes a router's function; it would be correct for a device choosing paths between subnets.
When this WOULD be correct
A question asking 'Which OSI layer routes packets based on IP addresses?' or 'At which layer does a router operate?' would have Network as the correct answer.
- ✗
Transport
Why it's wrong here
Layer 4 handles end-to-end transport via TCP or UDP port numbers, not hardware addressing. MAC-based forwarding is a Layer 2 function, so Transport misplaces the switch's role; Transport would be cited for a device routing by port, such as a load balancer.
When this WOULD be correct
A question asking which OSI layer provides reliable data transfer between hosts, such as TCP's connection-oriented service, would have Transport as the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓Data LinkCorrect answer▾
Why this is correct
MAC address forwarding is a Layer 2 function: switches build a MAC address table and forward frames based on destination MAC, which is the Data Link layer's addressing scheme. Layer 3 handles IP routing, so Data Link is the correct OSI layer for this behaviour.
✗PhysicalWrong answer — click to see why▾
Why this is wrong here
The Physical layer (Layer 1) handles raw bit transmission over a physical medium, not MAC address-based frame forwarding. A switch that forwards frames using MAC addresses operates at the Data Link layer (Layer 2).
★ When this WOULD be the correct answer
A question asking 'Which OSI layer defines electrical signals, cabling, and bit transmission?' would have Physical as the correct answer. Also, if the question were 'A repeater operates at which layer?', Physical would be correct.
Why candidates choose this
Candidates may confuse the switch's physical ports and cabling with the Physical layer, not realizing that the switching logic (MAC address table) is a Data Link layer function.
✗NetworkWrong answer — click to see why▾
Why this is wrong here
The Network layer (Layer 3) uses logical addressing (e.g., IP addresses) for routing packets between networks, not MAC addresses for forwarding frames within a single network.
★ When this WOULD be the correct answer
A question asking 'Which OSI layer routes packets based on IP addresses?' or 'At which layer does a router operate?' would have Network as the correct answer.
Why candidates choose this
Candidates may confuse MAC address forwarding with IP routing, or think that 'network' broadly refers to all networking functions, leading them to select the Network layer.
✗TransportWrong answer — click to see why▾
Why this is wrong here
The Transport layer (Layer 4) handles end-to-end communication, segmentation, and flow control, not MAC address-based frame forwarding, which is a Layer 2 function.
★ When this WOULD be the correct answer
A question asking which OSI layer provides reliable data transfer between hosts, such as TCP's connection-oriented service, would have Transport as the correct answer.
Why candidates choose this
Candidates may confuse the switch's forwarding decision with higher-layer protocols, or think that MAC addresses are part of the Transport layer because they are associated with network interfaces.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
OSI Model Reference
| Layer | Name | PDU | Key Protocols / Devices |
|---|---|---|---|
| 7 | Application | Data | HTTP, HTTPS, DNS, SMTP, FTP, SSH |
| 6 | Presentation | Data | TLS / SSL, JPEG, ASCII encoding |
| 5 | Session | Data | NetBIOS, RPC, SIP |
| 4 | Transport | Segment / Datagram | TCP, UDP |
| 3 | Network | Packet | IP, ICMP, OSPF — Routers |
| 2 | Data Link | Frame | Ethernet, Wi-Fi, PPP — Switches, Bridges |
| 1 | Physical | Bits | Cables, NICs, Hubs, Repeaters |
Go deeper
Related to this question
Learn chapter
TCP/IP Model and Protocol Suite
Key term
MAC address table
A MAC address table is a data structure stored in a network switch that maps each of its ports to the MAC addresses of connected devices, enabling the switch to forward frames only to the correct destination.
Key term
OSI model
The OSI model is a conceptual framework that standardizes the functions of a telecommunication or computing system into seven distinct layers, from physical hardware to application software.
About these practice questions
Courseiva writes every N10-009 question from scratch — 472 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on N10-009
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. At which layer of the OSI model does a switch that uses MAC addresses to forward frames operate?
easy- A.Layer 1
- ✓ B.Layer 2
- C.Layer 3
- D.Layer 4
Why B: A switch that uses MAC addresses to forward frames operates at Layer 2 (Data Link layer) of the OSI model. Layer 2 is responsible for node-to-node data transfer and error detection, using MAC addresses as the addressing scheme. The switch builds a MAC address table by learning source MAC addresses from incoming frames and then forwards frames based on the destination MAC address, making forwarding decisions at this layer.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.