N10-009 Networking Concepts Practice Question
At which layer of the OSI model does a switch that uses MAC addresses to forward frames operate?
⚠ Common exam trap
Many exam-takers confuse a switch's MAC address-based forwarding with a router's IP-based forwarding, mistakenly selecting Layer 3, or they think of a hub's operation at Layer 1 and incorrectly apply that to a switch.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Layer 2
A switch that uses MAC addresses to forward frames operates at Layer 2 (Data Link layer) of the OSI model. Layer 2 is responsible for node-to-node data transfer and error detection, using MAC addresses as the addressing scheme. The switch builds a MAC address table by learning source MAC addresses from incoming frames and then forwards frames based on the destination MAC address, making forwarding decisions at this layer.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Layer 1
Why it's wrong here
Layer 1, the Physical layer, is concerned with the electrical, mechanical, procedural, and functional specifications for activating, maintaining, and deactivating the physical link between network devices. Devices like hubs, repeaters, and cabling operate at this layer, transmitting raw bit streams without any knowledge of MAC addresses or data framing. Its primary function is the physical transmission of unstructured raw data over a communication medium.
When this WOULD be correct
A question asking 'At which OSI layer does a hub or repeater operate?' would have Layer 1 as the correct answer, as these devices simply regenerate signals without addressing.
- ✓
Layer 2
Why this is correct
A network switch operates primarily at the Data Link layer (Layer 2) of the OSI model. It utilizes Media Access Control (MAC) addresses to forward Ethernet frames to their intended destination within the same local area network (LAN) segment. By maintaining a MAC address table, the switch learns which MAC addresses are associated with specific physical ports, enabling efficient and targeted frame delivery rather than broadcasting to all ports. This intelligent forwarding mechanism significantly reduces network congestion compared to a hub.
- ✗
Layer 3
Why it's wrong here
The Network layer (Layer 3) is primarily responsible for logical addressing (IP addresses) and routing data packets across different networks. Devices like routers operate at this layer, determining the best path for data to travel from source to destination, potentially across multiple network segments. While a Layer 3 switch can perform some routing functions, a standard switch that uses MAC addresses for forwarding operates distinctly at Layer 2, not Layer 3.
When this WOULD be correct
This option would be correct if the question asked about a device that forwards packets based on IP addresses, such as a router, or if the question specified a multilayer switch performing routing functions at Layer 3.
- ✗
Layer 4
Why it's wrong here
The Transport layer (Layer 4) is responsible for end-to-end communication between applications on different hosts, managing data segmentation, reassembly, and reliable data transfer through protocols like TCP and UDP. It deals with port numbers to direct data to specific applications, ensuring data integrity and flow control. This layer operates at a much higher abstraction level than a switch, which is concerned with local frame delivery, not application-level communication.
When this WOULD be correct
A question asking 'At which OSI layer does a device that forwards data based on TCP/UDP port numbers operate?' would make Layer 4 correct, as such a device is a Layer 4 load balancer or firewall.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓Layer 2Correct answer▾
Why this is correct
A network switch operates primarily at the Data Link layer (Layer 2) of the OSI model. It utilizes Media Access Control (MAC) addresses to forward Ethernet frames to their intended destination within the same local area network (LAN) segment. By maintaining a MAC address table, the switch learns which MAC addresses are associated with specific physical ports, enabling efficient and targeted frame delivery rather than broadcasting to all ports. This intelligent forwarding mechanism significantly reduces network congestion compared to a hub.
✗Layer 1Wrong answer — click to see why▾
Why this is wrong here
Switches that forward frames based on MAC addresses operate at Layer 2 (Data Link layer), not Layer 1 (Physical layer). Layer 1 deals with raw bit transmission over physical media, not frame forwarding.
★ When this WOULD be the correct answer
A question asking 'At which OSI layer does a hub or repeater operate?' would have Layer 1 as the correct answer, as these devices simply regenerate signals without addressing.
Why candidates choose this
Candidates may confuse switches with hubs or repeaters, or think that because switches handle physical connections, they operate at Layer 1.
✗Layer 3Wrong answer — click to see why▾
Why this is wrong here
A switch that uses MAC addresses to forward frames operates at Layer 2 (Data Link layer), not Layer 3 (Network layer). Layer 3 involves IP addresses and routing, not MAC-based forwarding.
★ When this WOULD be the correct answer
This option would be correct if the question asked about a device that forwards packets based on IP addresses, such as a router, or if the question specified a multilayer switch performing routing functions at Layer 3.
Why candidates choose this
Candidates may confuse switches with routers, especially when considering multilayer switches that can perform Layer 3 functions, leading them to incorrectly select Layer 3.
✗Layer 4Wrong answer — click to see why▾
Why this is wrong here
Layer 4 (Transport) handles end-to-end communication, segmentation, and flow control using port numbers, not MAC addresses. A switch forwarding frames based on MAC addresses operates at Layer 2 (Data Link).
★ When this WOULD be the correct answer
A question asking 'At which OSI layer does a device that forwards data based on TCP/UDP port numbers operate?' would make Layer 4 correct, as such a device is a Layer 4 load balancer or firewall.
Why candidates choose this
Candidates may confuse the switch's use of MAC addresses with higher-layer functions, or mistakenly think that any forwarding decision involves Layer 4 because they associate 'forwarding' with transport layer protocols.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
OSI Model Reference
| Layer | Name | PDU | Key Protocols / Devices |
|---|---|---|---|
| 7 | Application | Data | HTTP, HTTPS, DNS, SMTP, FTP, SSH |
| 6 | Presentation | Data | TLS / SSL, JPEG, ASCII encoding |
| 5 | Session | Data | NetBIOS, RPC, SIP |
| 4 | Transport | Segment / Datagram | TCP, UDP |
| 3 | Network | Packet | IP, ICMP, OSPF — Routers |
| 2 | Data Link | Frame | Ethernet, Wi-Fi, PPP — Switches, Bridges |
| 1 | Physical | Bits | Cables, NICs, Hubs, Repeaters |
Go deeper
Related to this question
Learn chapter
OSI Model for Network+
Key term
MAC address table
A MAC address table is a data structure stored in a network switch that maps each of its ports to the MAC addresses of connected devices, enabling the switch to forward frames only to the correct destination.
Key term
Cyclic Redundancy Check
A Cyclic Redundancy Check (CRC) is an error-detecting code used to verify that data transmitted over a network or stored on a device has not been corrupted.
About these practice questions
One of 464 original N10-009 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.