CompTIA Network+ (N10-009)Network SecurityMedium
A hotel wants guest devices connected to the same VLAN and IP subnet to be completely unable to communicate with one another, while every guest device must still reach the internet gateway. Which switch feature should be configured to achieve this?
- APrivate VLAN (protected/isolated ports)
- B802.1Q trunking
- CSpanning Tree Protocol
- DLink aggregation
Show answer & explanationAnswer & explanation
Correct answer: A. Private VLAN (protected/isolated ports)
Private VLANs (or protected/isolated switch ports) allow devices within the same VLAN and subnet to reach an uplink (like a gateway) while being blocked from communicating with each other at Layer 2, which is exactly the isolation needed for guest networks. Trunking, STP, and link aggregation serve unrelated purposes.
Why the other options are wrong
- B. Trunking carries multiple VLANs over one link, not host isolation.
- C. STP prevents Layer 2 loops, not host-to-host isolation.
- D. Link aggregation bundles multiple physical links for bandwidth/redundancy.
Private VLAN / Protected Ports
A configuration where hosts in the same VLAN/subnet can reach an uplink port but cannot communicate directly with each other, commonly used for guest Wi-Fi and hotel networks.
- Also called isolated or protected ports
- Preserves single subnet while blocking peer-to-peer traffic
- Common use case: guest networks, hotel/hospitality Wi-Fi
Memory trick: Everyone can see the door, nobody can see each other.