Network Access
The Network Access domain (20%) tests VLAN segmentation, trunking, Spanning Tree, EtherChannel, and wireless access. Expect configuration-style questions: which VLAN is allowed on a trunk, which switch becomes root, or why an EtherChannel stayed down.
VLANs and trunking
An access port belongs to one VLAN and carries untagged frames; a trunk carries multiple VLANs using 802.1Q tags. The native VLAN is sent untagged, and both ends must agree or CDP reports a native VLAN mismatch. Allowed VLAN lists limit flooded traffic. Inter-VLAN routing uses a router-on-a-stick subinterface with encapsulation dot1q <vlan> or a switch virtual interface with ip routing enabled. Voice VLANs use a separate VLAN ID and often trust CoS from the phone.
Spanning Tree Protocol
STP prevents Layer 2 loops. The root bridge is elected by lowest bridge priority (default 32768, increments of 4096), then lowest MAC address. Non-root switches choose one root port by lowest path cost to the root, then lowest neighbor bridge ID, then lowest port ID. RSTP (802.1w) uses root, designated, alternate, and backup roles and converges faster; Edge/PortFast bypasses listening and learning on access ports. BPDU Guard err-disables a PortFast port that receives a BPDU; Root Guard protects root placement.
EtherChannel and discovery
EtherChannel bundles links for bandwidth and redundancy. LACP (802.3ad) uses active/passive; PAgP uses desirable/auto; static mode is on. All member ports need matching speed, duplex, VLAN/trunk configuration, and the same protocol and mode. CDP and LLDP discover neighbors and expose mismatches; LLDP is vendor-neutral.
Wireless access
A WLC manages lightweight APs over CAPWAP. AP modes include local, flexconnect, monitor, and sniffer. WPA2 uses AES-CCMP; WPA3 adds SAE and strengthens open networks. 2.4 GHz has longer range; 5 GHz has more channels and less interference.
Worked example
SW1 has priority 32768 and MAC 0000.0c00.1111; SW2 has priority 4096 and MAC 0000.0c00.2222; SW3 has priority 32768. SW2 becomes root because 4096 is the lowest priority. If SW1 and SW3 tied, the lower MAC would win. Each non-root switch then selects the port with the lowest cumulative cost to SW2 as its root port.
Traps
Mismatched native VLANs; forgetting STP priority changes are in 4096 steps; mismatched EtherChannel modes (auto/auto does not form); and assuming a trunk carries all VLANs when an allowed list restricts it.