CCNA 200-301 opens Domain 1 by asking whether a candidate can recognize what each piece of network hardware is actually for -- not just define acronyms, but know which device a given scenario calls for. Every exam scenario in this domain assumes you can tell a router's job apart from a switch's, and a firewall's from an access point's, because the wrong device in the wrong place is the most common root cause the exam tests.
Layer 3 Forwarding: Routers
A router's core job is to forward packets between different networks (different subnets or different sites) based on IP addresses, using a routing table it builds from directly connected networks, static routes, and dynamic routing protocols. Routers are also the natural place to implement Network Address Translation (NAT) between a private internal network and a public network, and to terminate WAN links (like an internet circuit) that connect a site to the outside world. If a scenario describes traffic needing to cross from one IP subnet to another, a router (or a Layer 3-capable device) is the device that has to be involved.
Layer 2 and Layer 3 Switches
A Layer 2 switch forwards frames within a single broadcast domain based on MAC addresses it learns by examining source addresses on incoming frames, building and maintaining a MAC address table. A Layer 3 switch adds routing capability on top of that switching function, letting it route between VLANs at wire speed without sending traffic out to a separate router -- the standard design in modern wiring closets and data centers, where "router on a stick" (a single router interface trunked to handle inter-VLAN routing) has mostly given way to Layer 3 switching for performance reasons.
Security at the Edge: Firewalls and IPS
A next-generation firewall (NGFW) inspects traffic well beyond simple port/protocol filtering -- it does deep packet inspection, application awareness, and user-identity-based policy, typically sitting at the network edge or between security zones. An intrusion prevention system (IPS) actively inspects traffic for known attack signatures and anomalous behavior and can block malicious traffic inline, distinct from an intrusion detection system (IDS), which only alerts rather than blocking. Many NGFWs bundle IPS functionality, but the exam still expects you to know the two roles are conceptually separate: a firewall enforces a security policy about what traffic is allowed, while an IPS is watching for and blocking traffic that matches known attack patterns.
Wireless Infrastructure and Endpoints
Access points (APs) provide the actual RF connection wireless clients associate to, while a wireless LAN controller (WLC) centrally manages many APs -- pushing configuration, coordinating radio channels/power to reduce interference, and handling client roaming between APs so a device doesn't drop its session walking across a building. Endpoints (laptops, phones, IoT devices) and servers are what all of the above infrastructure ultimately exists to connect; servers specifically host the applications and services endpoints consume.
Powering the Edge: PoE
Power over Ethernet (PoE) delivers electrical power to devices like APs, IP phones, and security cameras over the same Ethernet cable that carries data, removing the need for a separate power outlet at every device location -- a detail the exam expects you to recognize when a scenario describes powering a device with no nearby outlet.
Key Mechanics
- Routers forward between different IP networks/subnets using a routing table; that's the "different subnet" signal.
- Layer 2 switches forward by MAC address within one broadcast domain; Layer 3 switches add inter-VLAN routing at wire speed.
- NGFWs enforce policy on what traffic is allowed (deep inspection, app awareness); IPS blocks traffic matching known attack signatures -- IDS only alerts, it doesn't block.
- A WLC centrally manages many APs: channel/power coordination and client roaming, not just individual AP configuration.
- PoE delivers power and data over one Ethernet cable -- the answer whenever a scenario needs to power a device without a nearby outlet.
Exam Tip: If a scenario says traffic needs to move between two different IP subnets, the device doing the work is a router or a Layer 3 switch -- a Layer 2 switch alone cannot do this.
Exam Tip: Distinguish "blocks known attack traffic inline" (IPS) from "only alerts on suspicious traffic" (IDS) -- the exam tests this pairing directly, often without naming either acronym outright.
Exam Tip: "Centrally manages multiple access points, coordinates RF channels, and handles client roaming" is a WLC's signature description -- don't confuse it with a single AP's own configuration.
Worked example: A growing office wants new ceiling-mounted access points in a space with no nearby power outlets, centralized management of RF channels across the floor to avoid interference, and inline blocking of known attack traffic at the network edge. They run PoE-capable switch ports to each AP (power and data over one cable), register the APs to a wireless LAN controller for centralized channel/power coordination and roaming, and place an NGFW with IPS functionality enabled at the edge to inspect and block malicious traffic before it reaches the internal network.