N10-009 Networking Concepts Practice Question
A network engineer is designing a network for a large organization. The engineer needs to ensure that broadcast traffic from one VLAN does not propagate to other VLANs while still allowing inter-VLAN communication. Which of the following devices is required to route between VLANs?
⚠ Common exam trap
Many exam-takers confuse a Layer 3 switch with a Layer 2 switch and assume any switch can route between VLANs, but a standard Layer 2 switch lacks the routing engine and IP forwarding table required for inter-VLAN communication.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Router
A router is required to route between VLANs because VLANs segment a Layer 2 broadcast domain, and inter-VLAN communication must occur at Layer 3. The router performs routing by receiving frames tagged with the source VLAN, stripping the tag, making a forwarding decision based on the destination IP, and then re-encapsulating the frame with the destination VLAN tag. This process is often implemented using a router-on-a-stick configuration with 802.1Q trunking.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Layer 2 switch
Why it's wrong here
A Layer 2 switch primarily forwards frames based on MAC addresses and is instrumental in creating and managing VLANs, effectively segmenting a network into multiple distinct broadcast domains. However, despite its ability to separate traffic into VLANs, a standard Layer 2 switch does not possess the Layer 3 intelligence or routing capabilities required to forward IP packets *between* these different VLANs. It can only forward frames within the same VLAN, necessitating a Layer 3 device for communication across VLAN boundaries.
When this WOULD be correct
When the question asks for a device to segment a network into multiple collision domains or to connect devices within the same VLAN, a Layer 2 switch is the correct answer.
- ✓
Router
Why this is correct
A router is a Layer 3 device specifically designed to forward IP packets between different IP networks or subnets, which directly correspond to distinct VLANs. It achieves inter-VLAN routing by having an IP interface (either physical or logical sub-interface on a trunk port) configured within each VLAN, acting as the default gateway for hosts in that VLAN. When traffic from one VLAN needs to reach another, the router processes the destination IP address and forwards the packet accordingly.
- ✗
Bridge
Why it's wrong here
A bridge operates exclusively at Layer 2 of the OSI model, forwarding Ethernet frames based on MAC addresses within a single broadcast domain. While it connects two network segments, it lacks any understanding of IP addresses or routing protocols necessary to direct traffic between separate IP subnets or VLANs. Therefore, a bridge cannot perform inter-VLAN routing, as its functionality is limited to extending a single Layer 2 segment.
When this WOULD be correct
A bridge would be correct in a scenario where the question asks for a device to connect two separate network segments at Layer 2, such as extending a single VLAN across two physical locations without requiring routing.
- ✗
Firewall
Why it's wrong here
A firewall can route between VLANs if it has multiple interfaces and routing capabilities, but the primary device for inter-VLAN routing is a router or Layer 3 switch; the question asks for the required device, and a router is the standard answer.
When this WOULD be correct
In a scenario where the network requires both inter-VLAN routing and security policy enforcement (e.g., access control lists, stateful inspection) between VLANs, a firewall would be the correct device. For example, a question stating 'Which device provides inter-VLAN routing with advanced security filtering?' would make a firewall the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓RouterCorrect answer▾
Why this is correct
A router is a Layer 3 device specifically designed to forward IP packets between different IP networks or subnets, which directly correspond to distinct VLANs. It achieves inter-VLAN routing by having an IP interface (either physical or logical sub-interface on a trunk port) configured within each VLAN, acting as the default gateway for hosts in that VLAN. When traffic from one VLAN needs to reach another, the router processes the destination IP address and forwards the packet accordingly.
✗Layer 2 switchWrong answer — click to see why▾
Why this is wrong here
A Layer 2 switch forwards frames based on MAC addresses and does not perform routing; it cannot route between VLANs without a Layer 3 device.
★ When this WOULD be the correct answer
When the question asks for a device to segment a network into multiple collision domains or to connect devices within the same VLAN, a Layer 2 switch is the correct answer.
Why candidates choose this
Candidates may confuse a Layer 2 switch's ability to handle VLANs (via trunking) with the ability to route between them, not realizing that routing requires Layer 3 functionality.
✗BridgeWrong answer — click to see why▾
Why this is wrong here
A bridge operates at Layer 2 and forwards frames based on MAC addresses, but it does not perform routing between VLANs. It cannot forward traffic between different VLANs because it lacks the ability to make Layer 3 routing decisions.
★ When this WOULD be the correct answer
A bridge would be correct in a scenario where the question asks for a device to connect two separate network segments at Layer 2, such as extending a single VLAN across two physical locations without requiring routing.
Why candidates choose this
Candidates may confuse bridges with routers because both connect network segments, but bridges operate at Layer 2 and cannot route between VLANs, which requires Layer 3 functionality.
✗FirewallWrong answer — click to see why▾
Why this is wrong here
A firewall can route between VLANs if configured with routing capabilities, but it is not the primary device required for routing between VLANs; a router or Layer 3 switch is typically used. The question specifically asks for the device required to route between VLANs, and a router is the standard answer.
★ When this WOULD be the correct answer
In a scenario where the network requires both inter-VLAN routing and security policy enforcement (e.g., access control lists, stateful inspection) between VLANs, a firewall would be the correct device. For example, a question stating 'Which device provides inter-VLAN routing with advanced security filtering?' would make a firewall the correct answer.
Why candidates choose this
Candidates may think a firewall can handle routing because modern firewalls often include routing features, leading them to choose it over a router. They might also confuse the need for security with the basic requirement of routing between VLANs.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Interior vs Exterior Routing Protocols
Key term
Route
A route is a path that data takes through a network from one device or network to another, determined by routing protocols and configured rules.
Key term
Broadcast domain
A broadcast domain is a network segment where any device can send a broadcast message that all other devices on that segment will receive and process.
About these practice questions
Courseiva writes every N10-009 question from scratch — 464 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.