IP Routing and Network Security Basics
A Layer 3 switch routes between VLANs using switched virtual interfaces (SVIs), one per VLAN, each with an IP in that subnet. For routing to work, end hosts must point at the SVI as their default gateway, and the switch needs a route to any remote network - either connected, static, or learned dynamically. Know longest-prefix match: a /24 beats a /16 for the same destination regardless of metric.
Static routes have an administrative distance (typically 1) that beats most dynamic protocols (OSPF 110, RIP 120). A default route is 0.0.0.0/0. Watch for questions where a static route points to an unreachable next hop - it may still be installed if the interface is up, causing black-holing.
Security basics: management access should be restricted by source (ACLs on the management interface or VTY lines), use SSH not Telnet, and enable port security to limit MAC addresses per port. DHCP snooping and dynamic ARP inspection defend against rogue DHCP and ARP spoofing; they rely on trusted uplink ports. ACLs are processed top-down, first match wins, with an implicit deny at the end - a very common trap.
Rule of thumb: ACLs are read top to bottom; put specific rules above general ones. Worked example: an ACL with permit 10.0.0.0/8 on line 1 and deny 10.1.1.0/24 on line 2 will never deny 10.1.1.0/24, because the broader permit matches first. Reorder the deny above the permit to make it effective.