| 🏠 Back to Exam Syllabus | 📺 RooCloud on YouTube | 🌐 RooCloud Practice Exams |
CISSP 12.9 - Switching & Virtual LANs
This episode of the ISC2 Certified Information Systems Security Professional (CISSP) exam prep series gets inside the switch and the segments it creates from Domain 4. It looks at the switch as the quiet workhorse that decides who hears what on a network, and at how its features build separation, allow monitoring, and open the door to attacks when they are left poorly configured.
What this episode covers
- The switch’s four actions — learning, forwarding, dropping, and flooding, with managed switches giving you real control.
- Virtual LANs — hardware segmentation that reassigns ports into zones, most often separating user traffic from management traffic.
- Why VLANs isolate — crossing between VLANs needs routing under deny by default, and blocked broadcasts help stop broadcast storms.
- Port isolation — private ports where members talk only to each other and reach outside through one reserved uplink.
- Switch eavesdropping — port mirrors and span ports copy traffic to a monitor port, while a port tap splices into the cable inline.
- Trunk ports and VLAN hopping — tagging stretches VLANs across switches, and double-tagged frames can jump the boundary.
- MAC flooding and cloning — flooding forces hub-like behavior, cloning impersonates trusted devices, countered by address limiting and inventory.
Watch the full episode above for the worked examples and detailed explanations of each concept.
Frequently Asked Questions
What are the core jobs a switch performs?
A switch moves frames, operating mainly at Layer 2, and runs on four simple actions. Learning records which device sits on which port in a memory table. Forwarding sends a frame straight to the right port. Dropping discards a frame already on the correct segment. Flooding sends an unknown destination out every port in hopes of reaching home. Think of it as a mail sorter that memorizes each desk as letters arrive.
What is a virtual LAN and why does it isolate traffic so well?
A virtual LAN, or VLAN, is network segmentation the switch creates in hardware by reassigning ports into separate zones. Devices in the same VLAN talk freely, while crossing between VLANs demands a routing step from a router or a Layer 3 switch. The guiding rule is deny by default and allow by exception, and because the routing function refuses to forward Layer 2 broadcasts between VLANs, it also helps stop a broadcast storm.
How can a switch itself be used to eavesdrop?
Through two legitimate features that also enable snooping. A port mirror copies traffic from one or more ports out to a chosen monitoring port, and a dedicated version is often called a span port; security teams use it for traffic analysis, packet capture, evidence collection, and intrusion detection. When mirroring is not available, a port tap does the job physically by breaking into a cable inline and quietly copying whatever passes.
What is VLAN hopping and how do trunk ports enable it?
Trunk ports are high-capacity switch-to-switch links that let a VLAN extend across several switches through VLAN tagging, a small tag inserted into the Ethernet header. In a VLAN hopping attack, the attacker crafts a frame carrying two stacked tags. On older switches the first tag gets overwritten by the second, so the frame lands in a VLAN the attacker was never supposed to reach, jumping the boundary you built.
What are MAC flooding and MAC cloning attacks?
MAC flooding abuses the learning function by flooding the switch with thousands of fake source addresses until the address table fills and older entries fall out. The switch then reverts to flooding like a hub, letting everyone eavesdrop; the defense is address limiting plus intrusion detection. MAC cloning spoofs an address already in use to impersonate a trusted device, countered by smart switches, intrusion detection, and a maintained device inventory.
📚 Master the ISC2 CISSP Exam!
Ready to test your knowledge? Access chapter-specific Multiple Choice Questions (MCQs) and full-length practice exams for the ISC2 CISSP certification at RooCloud.com. Solve the chapter-wise questions to reinforce this lesson before moving to the next episode.
Reference: This article is based on concepts discussed in CISSP 12.9 - Switching & Virtual LANs.