Interview prep · 8 questions
Switching and VLAN interview questions
What do interviewers test with switching and VLAN questions?
They test whether you understand how a switch learns and forwards frames, and how VLANs split one switch into separate broadcast domains. Expect follow-ups on trunks, Spanning Tree and link bundling, because those are where real outages start.
Updated
Mock interview
One question at a time. Answer it out loud as you would in the room, then reveal the model answer and rate yourself honestly. Your progress stays in this browser.
What does a switch do with a frame for a MAC address it has not learned yet?
Entry level
It floods the frame out of every port in the same VLAN except the one it arrived on. It also learns the frame's source MAC address on the incoming port, so the reply can be forwarded only where it needs to go.
A switch builds its MAC address table from source addresses, never from destinations. Entries age out when a host goes quiet, which is why the table can be empty after a while.
Broadcasts such as ARP requests are always flooded within the VLAN, which is why a VLAN is called a broadcast domain.
Common weak answer: Saying the switch drops the frame or sends it to the router. Unknown unicast is flooded, not dropped.
Likely follow-ups
- How do you see which port a MAC address was learned on?
- What is the difference between a hub and a switch here?
- What happens to the MAC table when you move a PC to another port?
What is the difference between an access port and a trunk port?
Entry level
An access port belongs to one VLAN and carries that VLAN's frames untagged, which is what a PC or a printer expects. A trunk carries many VLANs between switches or to a router, and marks each frame with an 802.1Q tag so the far end knows which VLAN it belongs to.
The tag is a 4-byte field inserted into the Ethernet frame that holds the VLAN ID. Frames in the native VLAN cross the trunk untagged.
A trunk usually has an allowed list. A VLAN missing from that list on either end simply does not cross, a classic outage that only the trunk view of the switch makes obvious.
Common weak answer: Calling a trunk a faster or bigger link. It is about carrying several VLANs, not about speed.
Likely follow-ups
- What is the native VLAN?
- How would you check which VLANs a trunk allows?
- Why would you remove VLANs from a trunk's allowed list?
What is the native VLAN, and what goes wrong when the two ends of a trunk disagree?
Mid level
The native VLAN is the one VLAN whose frames cross a trunk without a tag. If the two ends use different native VLANs, untagged frames from one VLAN land in another, so traffic leaks between VLANs and hosts in both lose connectivity.
Leaving the native VLAN as VLAN 1 is a common hardening finding; many teams move it to an unused VLAN that carries no hosts.
Neighbour discovery protocols often log a native VLAN mismatch, which is the quickest clue when a trunk only half works.
Common weak answer: Saying the trunk goes down. It usually stays up, which is exactly why the fault is easy to miss.
Likely follow-ups
- Why is VLAN 1 a poor choice for the native VLAN?
- What is VLAN hopping?
- Which command shows a trunk's native VLAN?
How do hosts in different VLANs talk to each other?
Entry level
Through a layer 3 device, because each VLAN is its own subnet. The two common designs are router-on-a-stick, with one subinterface per VLAN on a trunk to a router, and a layer 3 switch with one virtual interface (SVI) per VLAN and IP routing turned on.
Each host uses the layer 3 device's address in its own VLAN as its default gateway. A switch with SVIs routes between them only after IP routing is enabled on it, the step people forget.
Router-on-a-stick is simple and cheap, but every routed packet crosses the one trunk twice. A layer 3 switch routes between VLANs inside the switch itself.
Common weak answer: Saying the switch forwards between VLANs on its own. A layer 2 switch never does.
Likely follow-ups
- What does each subinterface need in a router-on-a-stick design?
- Why must the router's port to the switch be a trunk?
- When would you choose a layer 3 switch instead?
Why do switched networks need Spanning Tree, and how is the root bridge chosen?
Entry level
Redundant links between switches create loops, and Ethernet frames have no hop limit, so a single broadcast would circle forever and take the network down. Spanning Tree elects one root bridge, the switch with the lowest bridge ID (priority first, then MAC address), and blocks just enough ports to leave one loop-free path.
The symptoms of a loop are a broadcast storm, MAC addresses flapping between ports in the table, and switch CPUs pinned at their maximum.
Setting the priority on the switch you want as root beats leaving the election to the lowest MAC address, which is usually the oldest switch in the building.
Common weak answer: Saying Spanning Tree balances load across links. Classic Spanning Tree blocks the extra links; it does not use them.
Likely follow-ups
- What are the port roles in Spanning Tree?
- How would you make a particular switch the root?
- What happens when the link toward the root fails?
What does PortFast do, and where must you never enable it?
Mid level
PortFast lets an edge port that connects a single host go straight to forwarding instead of waiting through Spanning Tree's listening and learning states. Never enable it on a link to another switch, because a port that skips those checks can open a loop before Spanning Tree notices.
The wait PortFast removes can be long enough to make a client's DHCP request time out at boot, which is why it is standard on access ports.
It is usually paired with BPDU guard, which shuts an edge port down if a switch is ever plugged into it.
Common weak answer: Calling PortFast a way to make links faster. It only shortens the time before the port starts forwarding.
Likely follow-ups
- What does BPDU guard do when it triggers?
- How does Rapid Spanning Tree treat edge ports?
- Why can PortFast help a PC that fails to get an address at boot?
Why bundle links with EtherChannel instead of letting Spanning Tree block the extra cable?
Mid level
Spanning Tree sees two parallel cables as a loop and blocks one, so half the capacity sits idle. EtherChannel bundles them into one logical link, so both carry traffic and the bundle survives losing a member without waiting for Spanning Tree.
LACP is the standard protocol that negotiates the bundle: one end active and the other passive works, but both passive never forms. The member links must match on speed, duplex and VLAN settings.
Traffic is spread per flow, not per packet, so one large transfer still uses a single member link.
Common weak answer: Saying the bundle doubles the speed of every transfer. Load is shared per flow.
Likely follow-ups
- What happens if both ends are set to passive?
- Which settings must match on every member link?
- How do you check that the bundle is up?
How would you find which switch port a device is plugged into?
Mid level
Start from its IP address: the ARP table on its default gateway gives its MAC address, and the switch's MAC address table shows the port that MAC was learned on. If that port is an uplink to another switch, follow it with the neighbour table and repeat on the next switch.
The access port is the one where that MAC is learned and that is not an uplink. Neighbour discovery (CDP or LLDP) tells you which switch sits at the far end of an uplink.
Ping the device first if its entries have aged out: the tables only hold addresses that have sent traffic recently.
Common weak answer: Checking only one switch. In a larger network the first switch usually learned the MAC on an uplink, not on the access port.
Likely follow-ups
- Why might one MAC address appear on several switches?
- What if the device sits behind a small unmanaged switch?
- How would you find a device when you only have its MAC address?