Study Hub / Cisco CCNA (200-301) / Domain 2.0
Cisco CCNA (200-301) Domain 2.0: Network Access — Explained
Domain 2.0 is how devices get onto the network: carving switches into virtual LANs, connecting switches with trunks, keeping loops from melting the network, and bonding links for speed. Switching concepts, explained without the jargon fog.
VLANs: one switch, many networks
- What a VLAN is — a virtual LAN: ports on the same switch grouped into separate broadcast domains. VLAN 10 (sales) can't see VLAN 20 (engineering) without a router — segmentation without buying more switches.
- Access vs. trunk ports — access ports belong to exactly one VLAN (end devices: PCs, printers); trunk ports carry multiple VLANs between switches (or to a router). Servers and uplinks live on trunks.
- 802.1Q tagging — trunks tag each frame with its VLAN ID so the far switch knows which VLAN it belongs to. The native VLAN is the one exception: its frames cross untagged — and a native-VLAN mismatch between trunk ends is a classic misconfiguration.
- Inter-VLAN routing — VLANs don't route to each other by themselves: a router (or Layer 3 switch) with an interface per VLAN — or one trunked subinterface per VLAN ("router on a stick") — does the routing.
STP and EtherChannel: loops and bonds
- Why loops are lethal — redundant switch links create loops; broadcast frames circle forever, multiplying until the network collapses (a broadcast storm). Redundancy without loop prevention is self-destruction.
- Spanning Tree (STP / RSTP) — elects a root bridge, then blocks redundant ports to leave exactly one loop-free path — unblocking them if the active path fails. RSTP (rapid) converges in seconds; classic STP takes ~50.
- Port states that matter — a port becoming forwarding vs. blocking tells you whether STP considers it part of the active topology. "Port is up but not forwarding" → check STP.
- EtherChannel — bond 2–8 physical links into one logical link: more bandwidth and redundancy (one member fails, traffic uses the rest). LACP is the standards-based negotiation protocol — both ends must agree, or you get a misconfigured bundle.
Wireless access essentials
- WLC architecture — enterprise wireless uses a wireless LAN controller: lightweight access points tunnel client traffic to the controller, which applies policy centrally. One config point for hundreds of APs.
- Security: WPA2 vs. WPA3 — WPA2-Personal (pre-shared key, everyone shares one password) vs. WPA2/WPA3-Enterprise (802.1X + RADIUS: unique per-user credentials). Enterprise = individual accountability; Personal = shared secret.
- Channels and interference — 2.4 GHz has three non-overlapping channels (1, 6, 11); 5 GHz has many more. Neighboring APs on overlapping channels interfere — channel planning is real engineering, not vibes.
- AP modes — APs join the controller, get their config, and serve clients; a site survey (or controller RF management) sets power and channels. "The Wi-Fi is slow in the corner office" is usually coverage, not bandwidth.
The must-memorize table: access-port vs. trunk-port
The single most-tested switching distinction.
| Trait | Access port | Trunk port |
|---|---|---|
| VLANs carried | Exactly one | Multiple (tagged with 802.1Q) |
| Connects to | End devices (PCs, printers) | Switches, routers, servers |
| Tagging | Untagged | Tagged — except the native VLAN |
| Classic mistake | Device in the wrong VLAN | Native-VLAN mismatch between ends |
Try it: 4 sample questions
Sample questions to check your understanding of this domain. Answers and full reasoning are tucked under each one.
1. Two switches are connected, and hosts on VLAN 10 on switch A can't reach hosts on VLAN 10 on switch B. The link between switches is configured as access. What's wrong?
- A. A. Nothing — access links carry all VLANs
- B. B. Access ports carry only one VLAN untagged; the inter-switch link must be a trunk carrying VLAN 10 (tagged)
- C. C. VLAN 10 needs a different number on each switch
- D. D. Switches can't connect to each other
Show answer & reasoning
B. Switch-to-switch links carrying multiple VLANs must be trunks (802.1Q tagged). An access port drops anything not in its single VLAN — so VLAN 10 frames die at the link. "VLAN works locally, fails across switches" → check the trunk.
2. A network has redundant links between switches for resilience. What prevents the resulting loops from causing a broadcast storm?
- A. A. EtherChannel
- B. B. VLANs
- C. C. Spanning Tree Protocol — blocks redundant ports to leave one loop-free path, unblocking on failure
- D. D. Static routes
Show answer & reasoning
C. STP's entire job is loop prevention: elect a root bridge, compute the loop-free topology, block the redundant ports — and unblock them if the active path dies. EtherChannel (A) bonds links but doesn't prevent loops across different paths; VLANs (B) segment, they don't de-loop.
3. Four 1Gbps links are bonded between two switches for 4Gbps total with failover if one link dies. What is this, and which protocol negotiates it?
- A. A. STP with RSTP
- B. B. EtherChannel, negotiated with LACP
- C. C. A trunk with 802.1Q
- D. D. Static routing with four default routes
Show answer & reasoning
B. EtherChannel bundles physical links into one logical link — aggregated bandwidth plus member-level redundancy. LACP is the standards-based protocol where both ends negotiate the bundle; misconfigured LACP (one side passive-passive, mismatched params) is the classic "bundle won't form" fault.
4. A company wants Wi-Fi where each employee has unique credentials and deprovisioning is instant when someone leaves. Which design?
- A. A. WPA2-Personal with a strong shared password
- B. B. WPA2/WPA3-Enterprise with 802.1X + RADIUS — per-user authentication
- C. C. Open network with MAC filtering
- D. D. One AP per employee
Show answer & reasoning
B. Enterprise wireless (802.1X + RADIUS) authenticates individuals: unique credentials, per-user policies, instant revocation. Personal (A) shares one password — a departure means rotating it everywhere. MAC filtering (C) is spoofable theater, not authentication.
This was one domain. The simulator drills all 6.
This free preview covered Network Access (Domain 2.0, 20%). Not covered here: IP Connectivity (Domain 3.0, 25%); Automation & Programmability (Domain 6.0, 10%). Routing configuration and automation — the heaviest hands-on CCNA material — stay in the paid guide and practice bank. The ByteBar Practice Exam Simulator drills every domain with 1,000 exam-style questions — $9.99 one-time unlocks all 28 exams. Prefer to read? The full CCNA Study Guide is in the ByteBar shop on Etsy.
Practice Exam Simulator — $9.99 one-time, all 28 exams Full Study Guides on Etsy