N10-009 Network Implementation Practice Question
A network engineer is designing a new switched network and needs to ensure that broadcast traffic from one department does not reach another department's workstations. The engineer plans to use VLANs. Which of the following must be configured on the switches to isolate broadcast domains as intended?
⚠ Common exam trap
Candidates often think a firewall can filter Layer 2 broadcast traffic within the same VLAN, but firewalls operate at Layer 3 and above, so they cannot prevent broadcasts from flooding all ports in a single VLAN.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign each department's workstations to a unique VLAN and configure their switch ports as access ports in that VLAN.
VLANs segment a switched network into separate broadcast domains at Layer 2. By assigning each department's workstations to a unique VLAN and configuring their switch ports as access ports in that VLAN, broadcast traffic from one VLAN is confined to that VLAN and cannot reach workstations in another VLAN. This achieves the isolation required without additional filtering devices.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure all switch ports as trunk ports and use VLAN 1 for all departments.
Why it's wrong here
Configuring all switch ports as trunk ports is incorrect for end-user workstations, as trunk ports are designed to carry traffic for multiple VLANs between network devices like switches or routers. Furthermore, placing all departments into VLAN 1, even with trunk ports, completely negates any segmentation benefits. All workstations would remain in a single broadcast domain, leading to no traffic isolation and potential performance issues from excessive broadcast traffic.
When this WOULD be correct
This option would be correct if the question asked for a scenario where all devices need to be in the same broadcast domain (e.g., a flat network) and trunk ports are needed to carry multiple VLANs over a single link, but VLAN 1 is used as the native VLAN for management traffic.
- ✓
Assign each department's workstations to a unique VLAN and configure their switch ports as access ports in that VLAN.
Why this is correct
Assigning each department to a unique VLAN logically segments the network, creating separate broadcast domains for each department. Configuring switch ports as access ports ensures that each workstation's traffic is confined to its assigned VLAN, preventing direct Layer 2 communication and broadcast propagation between departments. This method effectively isolates departmental traffic, enhancing security, improving network performance, and reducing the potential for broadcast storms.
- ✗
Place all workstations in the same VLAN and use a firewall to filter broadcast traffic between departments.
Why it's wrong here
Placing all workstations in the same VLAN means they all reside within a single broadcast domain, inherently defeating any attempt at Layer 2 isolation. A firewall operates primarily at Layer 3 and above, and while it can filter unicast or multicast traffic between different IP subnets (which would correspond to different VLANs), it cannot filter broadcast traffic *within* the same VLAN. Broadcasts are forwarded to all ports in the same broadcast domain, making firewall intervention impossible for intra-VLAN traffic.
When this WOULD be correct
In a scenario where all workstations must be in the same broadcast domain (e.g., for legacy application discovery) but broadcast storms must be controlled, a firewall could be used to filter broadcast traffic at Layer 3 after routing, though this is inefficient and rarely recommended.
- ✗
Configure each switch port as a trunk and use a different native VLAN for each department.
Why it's wrong here
Configuring switch ports as trunks for end devices is fundamentally incorrect, as trunk ports are intended for inter-switch links to transport multiple tagged VLANs. While a native VLAN handles untagged traffic on a trunk, assigning a different native VLAN to each trunk port for workstations does not create isolation. Each workstation would still be on a trunk port, and more critically, the concept of a native VLAN doesn't segment individual end devices into distinct broadcast domains in the manner required for departmental isolation.
When this WOULD be correct
In a scenario where switches are connected via trunk links and each department's VLAN must be carried across multiple switches, configuring trunk ports with different native VLANs per department could be correct if the goal is to prevent VLAN hopping or to ensure untagged traffic on each trunk is associated with a specific VLAN.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓Assign each department's workstations to a unique VLAN and configure their switch ports as access ports in that VLAN.Correct answer▾
Why this is correct
Assigning each department to a unique VLAN logically segments the network, creating separate broadcast domains for each department. Configuring switch ports as access ports ensures that each workstation's traffic is confined to its assigned VLAN, preventing direct Layer 2 communication and broadcast propagation between departments. This method effectively isolates departmental traffic, enhancing security, improving network performance, and reducing the potential for broadcast storms.
✗Configure all switch ports as trunk ports and use VLAN 1 for all departments.Wrong answer — click to see why▾
Why this is wrong here
Configuring all switch ports as trunk ports and using VLAN 1 for all departments does not isolate broadcast domains; VLAN 1 is the default VLAN and all ports would still be in the same broadcast domain.
★ When this WOULD be the correct answer
This option would be correct if the question asked for a scenario where all devices need to be in the same broadcast domain (e.g., a flat network) and trunk ports are needed to carry multiple VLANs over a single link, but VLAN 1 is used as the native VLAN for management traffic.
Why candidates choose this
Candidates may think trunk ports are necessary for VLANs and that VLAN 1 is a special VLAN, but they overlook that trunk ports carry multiple VLANs and VLAN 1 is the default, not isolating traffic.
✗Place all workstations in the same VLAN and use a firewall to filter broadcast traffic between departments.Wrong answer — click to see why▾
Why this is wrong here
VLANs operate at Layer 2, and broadcast traffic is confined to the VLAN. A firewall filters at Layer 3 or above, so it cannot prevent Layer 2 broadcasts from reaching other departments if they are in the same VLAN.
★ When this WOULD be the correct answer
In a scenario where all workstations must be in the same broadcast domain (e.g., for legacy application discovery) but broadcast storms must be controlled, a firewall could be used to filter broadcast traffic at Layer 3 after routing, though this is inefficient and rarely recommended.
Why candidates choose this
Candidates may think firewalls can filter any traffic type, including broadcasts, and overlook that broadcasts are Layer 2 and not typically routed or filtered by firewalls.
✗Configure each switch port as a trunk and use a different native VLAN for each department.Wrong answer — click to see why▾
Why this is wrong here
Configuring each switch port as a trunk with a different native VLAN for each department does not isolate broadcast domains; trunk ports carry multiple VLANs and native VLANs are used for untagged traffic, not for separating broadcast domains. Broadcast isolation requires access ports assigned to unique VLANs.
★ When this WOULD be the correct answer
In a scenario where switches are connected via trunk links and each department's VLAN must be carried across multiple switches, configuring trunk ports with different native VLANs per department could be correct if the goal is to prevent VLAN hopping or to ensure untagged traffic on each trunk is associated with a specific VLAN.
Why candidates choose this
Candidates may mistakenly think that using different native VLANs on trunk ports can isolate broadcast domains, confusing native VLAN assignment with VLAN membership, or they may overcomplicate the solution by applying trunk configurations where access ports are sufficient.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Ethernet Switching and VLANs
Key term
VLAN
A VLAN (Virtual Local Area Network) is a logical grouping of network devices that behave as if they are on the same physical network segment, regardless of their actual physical location.
Key term
VLAN
A VLAN logically segments a physical network into isolated broadcast domains without requiring separate physical switches.
About these practice questions
One of 464 original N10-009 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.