If VLANs confuse you, the fastest fix is not rereading the definition ten more times. It is practicing scenarios where you have to decide what broke: the access port, the trunk, the native VLAN, DHCP relay, the subnet, or the security policy.
Here is the short version: a VLAN separates Layer 2 broadcast domains on a switch. Devices in different VLANs usually need a router, Layer 3 switch, or firewall to talk to each other. A user port normally belongs to one access VLAN. A switch-to-switch or switch-to-router link often uses trunking to carry multiple VLANs. Most real problems come from a mismatch between those simple ideas and the actual config.
Use these Network+ VLAN practice questions as scenario reps. Pick an answer before reading the explanation. If you need warmups first, review our networking basics guide, Network+ subnetting practice questions, and Network+ common ports practice questions.
Quick VLAN cheat sheet
| Concept | What it means | Common exam trap |
|---|---|---|
| Access port | Carries traffic for one VLAN to an endpoint | User is patched into the wrong VLAN |
| Trunk port | Carries multiple VLANs between network devices | One side trunks, the other side does not |
| Native VLAN | Untagged traffic on an 802.1Q trunk | Native VLAN mismatch |
| Inter-VLAN routing | Routing between VLANs through a Layer 3 device | Expecting VLANs to talk without routing |
| DHCP relay | Forwards DHCP requests to a server on another network | Client gets APIPA because relay/helper is missing |
| VLAN segmentation | Separating users, guests, servers, voice, IoT, or management | Allowing sensitive networks to mix casually |
Network+ VLAN practice questions
Question 1: wrong department network
A user in accounting plugs into a desk jack after moving offices. Their laptop receives an IP address from the guest network instead of the internal employee network. Other users in the same area are fine. What should you check first?
A. The internet service provider B. The switch port VLAN assignment for that jack C. The DNS forwarders on the domain controller D. The default route on the firewall
Answer: B.
This is a classic access-port problem. The jack maps back to a switch port, and that port is probably assigned to the guest VLAN instead of the employee VLAN. DNS, ISP routing, and firewall routes do not explain why one physical jack lands in the wrong Layer 2 segment.
Question 2: phones work, PCs do not
A company uses IP phones with PCs plugged into the phone pass-through ports. After a switch replacement, phones boot correctly, but PCs behind the phones cannot reach the network. What is the most likely issue?
A. The switch port is missing the data VLAN configuration B. The DHCP server is offline for every VLAN C. The phone firmware is incompatible with Ethernet D. The ISP is blocking private IP addresses
Answer: A.
Voice setups often use a voice VLAN for phones and a data VLAN for computers. If the voice VLAN is configured but the access/data VLAN is wrong or missing, phones can register while PCs fail. The clue is that phones work and PCs behind the phones do not.
Question 3: trunk mismatch
Two switches are connected together. Devices on VLAN 10 can communicate across both switches, but devices on VLAN 20 only work when they are on the same switch. What should you verify?
A. Whether VLAN 20 is allowed on the trunk between switches B. Whether the DNS server has an A record for VLAN 20 C. Whether users know the Wi-Fi password D. Whether the default gateway has a public IP address
Answer: A.
If VLAN 20 works locally but not across switches, the trunk is the suspect. VLAN 20 may not exist on one switch, may not be allowed across the trunk, or the trunk may not actually be trunking. DNS does not move Layer 2 traffic between switches.
Question 4: native VLAN warning
A network monitoring tool reports a native VLAN mismatch on a trunk link. What does that mean?
A. Both sides are using the same tagged VLAN for all traffic B. Untagged traffic is assigned to different VLANs on each side of the trunk C. The switch does not support any VLANs D. DHCP has assigned duplicate IP addresses
Answer: B.
The native VLAN is the VLAN used for untagged traffic on an 802.1Q trunk. If each side expects untagged traffic to belong to a different VLAN, traffic can leak into the wrong segment or behave unpredictably. Network+ will not expect vendor-specific commands here; it wants the concept.
Question 5: APIPA after VLAN move
A printer is moved from VLAN 30 to VLAN 40. After the move, it receives a 169.254.x.x address. Other VLAN 40 devices work. What is a reasonable first check?
A. Confirm the printer port is actually assigned to VLAN 40 B. Replace the core router immediately C. Change the public DNS resolver D. Disable all firewall rules between VLANs
Answer: A.
A 169.254.x.x address means the device did not receive a DHCP lease. Since other VLAN 40 devices work, the DHCP scope is probably alive. Check the simple physical/logical mapping first: the port, patch panel, and VLAN assignment.
Question 6: server isolation
A small business wants guest Wi-Fi users to access the internet but not internal file servers. Which design best matches that goal?
A. Put guest Wi-Fi and file servers in the same VLAN for simplicity B. Put guest Wi-Fi in a separate VLAN and restrict access with firewall or ACL rules C. Disable DHCP on the guest network D. Give guest users local administrator rights
Answer: B.
VLANs help create segmentation, but a VLAN by itself is not a complete security policy. Put guests in a separate VLAN, then control what that VLAN can reach with routing, firewall rules, or access control lists.
Question 7: inter-VLAN routing
Users in VLAN 10 can ping each other. Users in VLAN 20 can ping each other. Users in VLAN 10 cannot reach a server in VLAN 20, and the business expects them to. What is missing or misconfigured?
A. Inter-VLAN routing B. A crossover cable on every desktop C. A stronger Wi-Fi signal D. A different keyboard layout
Answer: A.
VLANs split broadcast domains. Devices inside the same VLAN can communicate at Layer 2, but devices in different VLANs need routing. That routing might happen on a router, firewall, or Layer 3 switch.
Question 8: management network exposure
An admin discovers that normal user workstations can browse to switch management interfaces. What is the best fix?
A. Move management interfaces to a dedicated management VLAN and restrict access B. Rename the switches with friendlier names C. Change the desktop wallpaper on user machines D. Disable spanning tree everywhere
Answer: A.
Management interfaces should not be casually reachable from every user network. A dedicated management VLAN plus access restrictions reduces the blast radius if a user machine is compromised.
Question 9: VLAN vs subnet
Which statement is most accurate for the Network+ exam?
A. A VLAN and subnet are always exactly the same thing B. A VLAN is a Layer 2 segmentation concept; a subnet is a Layer 3 IP addressing concept C. A subnet only exists on wireless networks D. VLANs replace all need for IP addressing
Answer: B.
In many simple networks, one VLAN maps to one IP subnet. But they are not the same concept. VLANs segment Ethernet broadcast domains. Subnets organize IP addresses and routing. If subnetting still feels shaky, use the CIDR subnetting guide next.
Question 10: allowed VLAN list
A new access point supports employee and guest SSIDs. The AP is connected to a switch trunk. The employee SSID works, but guest clients cannot get addresses. What should you check?
A. Whether the guest VLAN is allowed on the AP switch trunk B. Whether every guest has a static public IP address C. Whether the AP has a mechanical hard drive D. Whether the employee VLAN is renamed to guest
Answer: A.
Multiple SSIDs often map to multiple VLANs. If the guest VLAN is not allowed on the trunk to the AP, guest traffic never reaches the right network. After that, check DHCP scope, DHCP relay, and firewall policy.
How to think through VLAN questions
When a VLAN question shows up, slow down and identify the failure boundary.
- One device or many? One device often means a port, cable, endpoint, or patching problem. Many devices usually points to trunking, routing, DHCP, or a shared network service.
- Same VLAN or different VLANs? Same VLAN communication is mostly Layer 2. Different VLAN communication requires routing.
- Local switch or across switches? If it works locally but not across switches, inspect trunk configuration and allowed VLANs.
- IP address present or APIPA? No lease means DHCP path trouble: wrong VLAN, exhausted scope, missing relay, or blocked DHCP.
- Security goal or connectivity goal? Segmentation questions often want separation plus controlled access, not just “make everything reachable.”
Mini troubleshooting checklist
Use this sequence when a VLAN ticket lands in your queue:
- Confirm the device IP, subnet mask, gateway, and DNS servers.
- Check whether the IP matches the expected VLAN/subnet.
- Trace the wall jack to the switch port if you can.
- Verify access VLAN on endpoint ports.
- Verify trunk status and allowed VLANs between switches, APs, routers, or firewalls.
- Confirm DHCP scope, DHCP relay/helper, and available leases.
- Test same-VLAN connectivity before testing cross-VLAN routing.
- Escalate with the exact VLAN, port, IP, gateway, and symptoms instead of “network broken.”
That last bullet matters in real help desk work. A useful escalation note saves everyone time. Our help desk ticket notes examples has examples you can copy.
FAQ
Are VLANs on the Network+ exam?
Yes. Expect scenario questions around segmentation, access ports, trunking, native VLANs, inter-VLAN routing, and DHCP behavior. You usually need the concept more than vendor command syntax.
Is a VLAN the same as a subnet?
No. A VLAN is Layer 2 segmentation. A subnet is Layer 3 addressing. They often line up one-to-one in small networks, but the exam may test the difference.
Do VLANs provide security by themselves?
Not completely. VLANs separate traffic, but routing and access rules decide what can talk across those boundaries. For guest, management, server, and voice networks, segmentation plus policy is the safer answer.
What should I study after VLANs?
Rotate into subnetting, wireless, common ports, and basic security controls. For a broader path, compare Network+ vs CCNA and decide whether you need fundamentals or deeper Cisco practice next.
Next step
Do not just read the answers. Re-answer the ten questions tomorrow without looking, then explain each answer in one sentence. If you can say why the wrong answers are wrong, you are much closer to exam-ready than someone who memorized a VLAN definition and called it studying.
If you are using Network+ as part of a career move, check the IT certifications hub and the study guides page so your practice connects to an actual job plan, not just another tab you keep open forever.