Virtual Local Area Network (VLAN)

A Virtual Local Area Network partitions a physical switch fabric into logically separate networks at layer 2 of the OSI model. Ports are assigned to a VLAN, frames crossing trunk links carry an 802.1Q tag naming theirs, and each VLAN forms its own broadcast domain: a broadcast from finance never reaches engineering, even when both departments share the same switch. It is the cheapest form of network segmentation, separation by configuration rather than by hardware.

The caveat that decides questions: a VLAN isolates traffic only at layer 2. Moving between VLANs requires a layer 3 device, which is exactly where firewall rules and access controls belong. And the isolation can be subverted: VLAN hopping attacks use switch spoofing (negotiating a trunk with a switch left free to auto-trunk) or double tagging (nesting two 802.1Q tags so the second survives into the victim VLAN) to cross the boundary. VLANs are a segmentation tool, not a substitute for physical separation of truly sensitive systems.

Exam relevance: if a scenario asks how to isolate broadcast domains or segment departments without buying hardware, the answer is VLANs; if it mentions double tagging or an unexpected trunk port, the answer is VLAN hopping. Contrast subnetting, which divides networks at layer 3 by IP addressing; a VLAN divides them at layer 2 by switch configuration.