VLANs and Layer 2 Technologies
A VLAN is a broadcast domain enforced in software by the switch. Ports are either access (one VLAN, untagged frames to the attached device) or trunk (many VLANs, 802.1Q tags on the wire). The single most tested fact: frames on a trunk carry a tag except for the native VLAN, which is sent untagged. Mismatched native VLANs between two switches cause silent VLAN leakage - traffic from one VLAN appears in another.
Know the 802.1Q tag: 4 bytes inserted after the source MAC, carrying a 12-bit VLAN ID (1–4094 usable). VLAN 1 is the default and should not carry user traffic in a hardened design. Understand voice VLANs (often untagged data plus tagged voice on one access port), and the mechanics of MAC learning: the switch learns source MAC to port, floods unknown unicast, and ages entries out.
Traps: questions that assume a trunk forwards all VLANs by default (many platforms require an allowed-VLAN list, and pruning matters); questions confusing tagged/untagged direction; and questions about GVRP or dynamic VLAN assignment where the answer hinges on whether the feature is enabled on both ends.
Rule of thumb: if both ends don't agree on native VLAN and allowed list, assume it's broken. Worked example: Switch A trunk allows VLANs 10,20 with native 1; Switch B allows 10 only with native 1. A frame tagged 20 arriving at B is dropped because 20 isn't in the allowed list - even though the physical link is up. The link light being green tells you nothing about VLAN correctness.