Unit 3 is a path-and-policy unit, not a vocabulary unit
The strongest Unit 3 answers trace the exact path a frame or packet should follow: source access port, source VLAN, trunk carriage, Layer 3 gateway, route, firewall or filtering boundary, and destination segment. When one nearby path works, preserve that evidence instead of treating “the network” as one undifferentiated object.
When many connections are segmented, review the entire VLAN and gateway path. The switching and routing sets in AP Networking Practice Tests by Topic diagnose access/trunk interpretation, MAC-table scope, next hops, and routed policy before students revisit unit-level scenarios.
What this practice test is really measuring
3.1 Devices & Connections
Switch, router, firewall, access point, NIC, and which device owns which decision.
3.2 Switching Topologies
MAC learning, unknown unicast, access ports, trunks, VLAN carriage, broadcast domains.
3.3 Verification
Configured versus operational state, counters, tables, interfaces, and end-to-end tests.
3.4–3.6 Segmentation
VLAN boundaries, inter-VLAN routing, firewalls, filtering, and segmented-LAN troubleshooting.
Switch forwarding after learning
A switch learns MAC A on port 3. Later it receives a frame on port 7 destined for MAC A. What is the normal forwarding decision?
A. Forward toward port 3
B. Send only to the router regardless of VLAN
C. Drop because switches do not use MAC addresses
D. Convert the frame into a DNS query
Unknown unicast behavior
A switch has not learned the destination MAC for a frame. What generally happens?
A. Flood within the relevant VLAN except the incoming port
B. Flood to every routed network
C. Send the frame directly to DNS
D. Shut down the switch
One VLAN crosses the trunk; another does not
VLAN 10 works across two switches. VLAN 20 works locally on each switch but fails across the inter-switch link. What should you inspect first?
A. VLAN 20 allowance/tagging across the trunk
B. External DNS
C. ISP BGP
D. Client battery health
Inter-VLAN communication requires Layer 3 forwarding
A client in VLAN 30 must reach a server in VLAN 40. What function is required between the subnets?
A. Routing through an appropriate Layer 3 gateway
B. MAC learning alone
C. DNS recursion
D. A longer Ethernet cable
Firewall rule order
Rule 10 denies Guest to ServerNet any TCP. Rule 20 allows Guest to AppServer TCP/443. First-match processing applies. What happens to Guest HTTPS?
A. It is denied by rule 10
B. Rule 20 always wins because it is more specific
C. Both rules cancel out
D. The switch decides instead
Least privilege between segments
Staff needs HTTPS to AppServer but not SSH. Which policy best matches least privilege?
A. Allow TCP/443 to the required server and deny unnecessary access
B. Permit all traffic between VLANs
C. Put all users in one VLAN
D. Disable logging
Verify both positive and negative behavior
After adding a Staff HTTPS exception, what is the strongest verification?
A. Confirm Staff HTTPS succeeds and prohibited Guest/SSH controls still fail
B. Confirm only that the rule exists
C. Reboot every switch
D. Ping an unrelated printer
Gateway state for a VLAN
VLAN 50 clients have correct addresses but cannot reach 10.50.0.1. VLAN 60 clients reach their gateway. What evidence matters most?
A. VLAN 50 access/trunk state and its Layer 3 gateway interface
B. External web certificates
C. Public DNS roots
D. Wi-Fi password history
Broadcast domain reasoning
What is one operational effect of placing two groups in separate VLANs?
A. Ordinary Layer 2 broadcasts are bounded by the VLAN boundary
B. All traffic becomes encrypted
C. The groups can never be routed
D. MAC addresses disappear
MAC-table evidence
Switch A learns ServerMAC toward the trunk to Switch B. What does that support?
A. Frames sourced by that server arrived through the trunk path
B. DNS is definitely correct
C. The server application is definitely healthy
D. The WAN is saturated
A VLAN exists but the SVI is down
Clients communicate locally in VLAN 70, but none can reach the documented gateway. The VLAN exists and the trunk carries it. The SVI for VLAN 70 is administratively down. What is the first failed dependency?
A. Layer 3 gateway interface state
B. DNS
C. MAC learning
D. ISP routing
A route exists but policy denies the flow
VLAN 20 reaches its gateway. The router has a route to ServerNet. Firewall logs show DENY for VLAN 20 → AppServer TCP/443. What is the strongest conclusion?
A. Routing exists; policy is the first failed dependency
B. The source VLAN is missing
C. DNS is broken
D. The access switch is down
Configured is not operational
VLAN 80 appears in the configuration, but clients on one access switch receive no DHCP and cannot reach the gateway. What should be checked next?
A. Access assignment, trunk carriage, SVI/gateway state, and DHCP path
B. Only the VLAN name
C. External DNS
D. Browser cache
Native VLAN mismatch
Tagged VLANs work across a trunk, but untagged traffic lands in different VLANs on each side. What configuration should be compared?
A. Native VLAN settings
B. DHCP lease time
C. DNS suffix
D. TCP window size
Connected route evidence
An SVI for VLAN 90 is up/up with address 10.90.0.1/24. What route should normally appear?
A. A connected route for 10.90.0.0/24
B. A default route to DNS
C. A host route to every client
D. No route at all
Working VLAN as control evidence
VLAN 100 crosses a trunk; VLAN 110 does not. Both use the same cable and switch uplink. Which claim is weakest?
A. The trunk cable is completely dead
B. VLAN 110 may be omitted from the allowed list
C. VLAN 110 tagging may be inconsistent
D. VLAN 110 may be missing on one switch
Firewall hit counters
After a policy change, which artifact best confirms the intended allow rule is actually handling Staff HTTPS?
A. The matching rule's hit/counter or log entry
B. The switch hostname
C. The client wallpaper
D. The WAN contract
Correct deny is not a fault
Guests cannot SSH to the management VLAN, and policy explicitly says Guests must not reach management. What is the correct interpretation?
A. The deny is expected behavior
B. The firewall is broken
C. The trunk cable must be replaced
D. DNS is failing
MAC learning but application failure
The client switch learns the server MAC correctly and the gateway is reachable, but TCP/443 fails. What should you do?
A. Move beyond Layer 2 and inspect routing/policy/service state
B. Replace the switch immediately
C. Delete the VLAN
D. Change DNS without testing
Segmented-LAN capstone
VLAN 25 clients reach same-switch peers. Their MACs are learned correctly. The trunk toward the Layer 3 switch carries VLANs 10 and 20 but not 25. The VLAN 25 SVI upstream is up. What is the first configuration fact that explains the failure?
A. VLAN 25 is missing from trunk carriage
B. The SVI address must be wrong
C. DNS must be down
D. The firewall must deny the traffic
Use one working VLAN to prove the physical uplink is alive
The observed behavior matches the trunk configuration exactly. Replacing the cable is unsupported because VLAN 10 proves that cable and inter-switch link carry traffic.
Read the first matching rule, then verify the requirement
Staff HTTPS succeeds and Guest HTTPS fails. That behavior matches policy. If Staff SSH fails, that is not automatically a defect because no SSH permission was stated.
Build a new segment without leaving hidden gaps
Requirement: VLAN 90 for lab devices, subnet 10.90.0.0/24, gateway 10.90.0.1, DHCP, Internet access, and no direct access to Management VLAN 10.
Fix one required flow without creating a broad exception
Correct the rule logic so the intended narrow flow can match, but review the entire relevant rule order before simply moving an allow to the top. Then test Staff HTTPS, Staff SSH, and Guest HTTPS as separate controls.
Keep Layer 2, Layer 3, and policy evidence separate
| Artifact | What it proves | What it does not prove |
|---|---|---|
| MAC learned on trunk | Source frames traversed that Layer 2 path | Application health |
| VLAN exists | Logical VLAN is defined | Trunk carriage or gateway state |
| Gateway responds | Local Layer 3 boundary works | Remote policy/application |
| Route exists | Forwarding path is selected | Firewall allows traffic |
| Firewall allow hit | Policy allowed the flow | Server application responded |
Swipe horizontally to see the evidence boundaries.
Rework every missed question as a packet path
For each scenario, write the source VLAN, source access port, any trunk, the Layer 3 gateway, route, firewall boundary, and destination. Then mark the first point where observed state differs from intended state.
Use misses to choose the next study page
| Miss pattern | Review next |
|---|---|
| Device-role confusion | 3.1 Network Devices and Connections |
| MAC/trunk/VLAN confusion | 3.2 Switching Topologies |
| Configured vs operational misses | 3.3 Configuration Verification |
| Segmentation/policy misses | 3.4 Segmentation & Security |
| Firewall rule misses | 3.5 Firewalls & Filtering |
| Boundary troubleshooting misses | 3.6 Segmented LAN Troubleshooting |
Swipe horizontally to see the score map.
24 AP Networking Unit 3 digital flashcards
Practice MAC learning, VLANs, trunks, gateways, inter-VLAN routing, firewall order, least privilege, configured-vs-operational state, rule hits, working-VLAN controls, and segmented-LAN troubleshooting.