Fundamentals · Exam 1.2

Network Topologies & Architecture

CCNA exam topic 1.2 covers two ideas: topology architectures (how you wire routers and switches at scale — 3-tier, spine-leaf, SOHO, cloud) and physical vs logical layout (bus, star, ring, mesh). Know both — they show up in different question styles.

Back to resources Further reading — The CyberSec Guru

Network architecture models

A topology is the blueprint — it dictates traffic flow, failure domains, and how easily you add a new building or server rack. Campus LANs, data centers, SOHO sites, and cloud deployments each favor a different shape.

North-South vs East-West (spine-leaf context)

North-South

Traffic enters or leaves the data center (user → app, app → Internet). Classic 3-tier campus designs handle this well.

East-West

Server-to-server inside the DC (web → database, vMotion, microservices). Often 80%+ of modern DC traffic — why spine-leaf replaced 3-tier in data centers.

Which architecture fits?

Scenario	Typical design
Large campus LAN	3-Tier hierarchical
Medium campus, cost-sensitive	2-Tier collapsed core
Data center east-west traffic	Spine-leaf + ECMP
Home or small shop	SOHO single device
Regulated data, full control	On-premise
Elastic web scale	Public cloud
DB on-prem, web in cloud	Hybrid cloud + VPN

3-Tier Campus (Hierarchical Model)

CCNA 1.2 core

Access → Distribution → Core

The classic enterprise campus design. Each layer has a distinct job: connect users, apply policy, or move traffic at high speed between buildings.

Access

Edge — where end devices connect

• PCs, phones, printers, APs, IoT
• Port security, VLAN assignment, PoE
• QoS marking at the edge

Distribution

Policy and aggregation between access and core

• Inter-VLAN routing boundary (L2/L3 demarcation)
• ACLs between departments
• Redundant uplinks to core

Core

High-speed backbone between distribution blocks

• Raw speed and reliability
• Minimal processing — avoid ACLs and deep inspection
• Connects Building A to Building B, data center, WAN edge

•Highly scalable — add a new distribution block without rewiring the whole campus
•Deterministic traffic flow — security policy lives at distribution
•Best for large campuses with many buildings or departments

CCNA tip: Exam questions map functions to layers: PoE/VLANs → Access; inter-VLAN routing/ACLs → Distribution; fast switching only → Core.

Exam trap: Do not place heavy ACL inspection on the core — that belongs at distribution or the security edge.

Use when: Large enterprise campus LAN with room to grow.

2-Tier Collapsed Core

CCNA 1.2 core

Access + Collapsed Core/Distribution

Core and distribution functions merge into one pair of powerful switches. Access layer stays the same; the middle and top tiers collapse.

•Fewer devices and links than full 3-tier — lower cost
•Modern Catalyst-class switches handle routing + switching load for mid-size sites
•Simpler to operate but less headroom than dedicated core
•Still uses extended physical star from access uplinks

CCNA tip: If the exam says “collapsed core,” think: cheaper and simpler than 3-tier, slightly less scalable.

Exam trap: Collapsed core is not SOHO — it still has dedicated access switches and redundant core pair in most designs.

Use when: Small-to-medium enterprise campus that does not need a separate core tier.

Spine-Leaf (Data Center Fabric)

CCNA 1.2 core

Leaf ↔ Spine ↔ Leaf — every path same hop count

A flattened two-layer data center design optimized for server-to-server (east-west) traffic, not user-to-Internet (north-south) campus flows.

Leaf

Top-of-rack — servers and storage connect here

• Default gateway often on the leaf (routing on leaf)
• Every leaf uplinks to every spine
• Leaves never connect directly to other leaves

Spine

Non-blocking backbone between leaf switches

• Spines never connect to other spines
• Provides ECMP paths for load balancing
• Fixed latency: Leaf → Spine → Leaf (two hops)

•Deterministic hop count for any server pair
•ECMP uses all spine links — unlike STP which blocks redundant paths
•Built for east-west traffic (VM migration, microservices, database queries)
•Poor fit for traditional north-south campus user traffic patterns

CCNA tip: Leaf switches connect only to spines, not to each other. Spines connect only to leaves. Expect ECMP and equal hop count on the exam.

Exam trap: 3-tier campus design is not the answer for modern DC east-west scaling — that is spine-leaf.

Use when: Modern data center or cloud provider fabric with heavy server-to-server traffic.

SOHO (Small Office / Home Office)

Single integrated device, flat network

The simplest architecture — one router/firewall/AP combo serves the whole site with a single VLAN and no redundancy.

•Integrated services router (ISR) or consumer gateway: routing, switching, Wi-Fi, NAT, DHCP
•Flat topology — often one subnet (e.g. 192.168.1.0/24) for everything
•Single point of failure — device loss kills wired, wireless, and Internet
•CCNA expects NAT, DHCP, and WPA2-PSK configuration awareness

CCNA tip: SOHO = simple, cheap, no redundancy. Contrast with collapsed core (still has structured access layer).

Use when: Home, coffee shop, or very small office.

On-Premise (Private Cloud)

You own the facility, hardware, and operations

Servers, switches, cooling, and power live in your building or colocation. You control the entire stack.

•Capital expenditure (CapEx) — buy hardware upfront
•Full control and data sovereignty — important for compliance
•Slow to scale — ordering and racking new gear takes weeks
•You maintain patching, backups, and physical security

CCNA tip: On-prem vs cloud is about where infrastructure lives and who operates it — not a cabling pattern.

Use when: Strict compliance, low-latency local apps, or legacy systems that cannot move.

Public Cloud

Rent compute, storage, and networking from a provider

AWS, Azure, Google Cloud, and similar providers run the physical data centers; you consume virtual networks and VMs as a service.

•Operational expenditure (OpEx) — pay for what you use
•Near-instant scale — spin up hundreds of VMs in minutes
•Provider manages physical hardware and facility
•Visibility into underlying switching/routing is abstracted

CCNA tip: Cloud still uses VLANs, routing, and security groups conceptually — but the physical topology is the provider's problem.

Use when: Web front-ends, dev/test, bursty workloads, global reach without building DCs.

Hybrid Cloud

On-prem + public cloud connected by VPN or dedicated line

The most common enterprise model today: sensitive data stays on-prem while scalable tiers run in the public cloud.

•Database or AD on-prem; web tier in cloud is a classic split
•Connected via site-to-site IPsec VPN, Direct Connect, ExpressRoute, etc.
•Requires consistent IP addressing, routing, and security policy across both sides
•DNS and identity federation often span both environments

CCNA tip: Hybrid = intentional split. Know that WAN/VPN links the private and public portions — see WAN/VPN topic notes.

Use when: Need cloud elasticity without moving regulated or latency-sensitive workloads.

Physical vs logical topologies

Separate physical topology (how cables and devices are laid out) from logical topology (how data actually flows). They are not always the same — the classic example is a physical star with a hub, which is a logical bus.

Quick exam reference

Physical	Logical	Central device / medium
Bus	Bus	Coax segment
Star	Bus	Hub (repeater)
Star	Star	Switch
Ring	Ring	Token Ring / FDDI
Mesh	Mesh / P2P	WAN routers
Point-to-point	Point-to-point	Serial / WAN link

Bus

CCNA core

Shared backbone — legacy Ethernet

Physical bus

All devices connect to one continuous cable (the backbone).

•Single coax or shared medium with T-connectors or taps.
•Terminators at both ends absorb signals and prevent reflection.
•A break in the cable can bring down the entire segment.

Logical bus

One shared collision domain — every device hears every frame.

•CSMA/CD governs access: listen before transmit, backoff on collision.
•Physical and logical topology match on a classic bus LAN.
•Broadcast traffic reaches all stations on the segment.

CCNA tip: Know that physical bus and logical bus are the same here. Legacy 10BASE2/10BASE5 is the classic CCNA example.

Real world: Early coax Ethernet (10BASE2 thinnet, 10BASE5 thicknet). Rare today but still tested conceptually.

Star (Hub)

CCNA core

Physical star, logical bus — classic exam trap

Physical star

Each device has its own cable to a central hub.

•Cables radiate outward like spokes — easy to add/remove hosts.
•A single host cable failure usually affects only that host.
•The hub is a single point of failure for the whole segment.

Logical bus

The hub repeats every signal to all ports — one shared collision domain.

•Only one device can transmit at a time (half duplex).
•All ports share bandwidth; behaves like a bus electrically.
•This is the answer Cisco expects for “star with a hub.”

CCNA tip: Most important mismatch on the exam: star physical topology + hub = logical bus. Do not confuse with a switch.

Real world: 10/100BASE-T with an old repeater hub. Switches replaced hubs in modern LANs.

Star (Switch)

CCNA core

Modern switched Ethernet LAN

Physical star

Each device connects with its own cable to a central switch.

•Same cabling pattern as a hub-based star — UTP to a central device.
•Looks identical in a wiring closet; the central device type changes behavior.
•Access switches often uplink to distribution switches (extended star).

Logical star

The switch forwards frames only to the destination port.

•Each port is typically its own collision domain (full duplex).
•Unicast traffic is not flooded to every host — unlike a hub.
•Physical star + switch = logical star on CCNA.

CCNA tip: If the central device is a switch, both physical and logical topologies are star. Exam questions specify hub vs switch.

Real world: Virtually every modern office LAN — access-layer switches to PCs, APs, and IP phones.

Ring

CCNA core

Token-passing loop

Physical ring

Devices are cabled in a closed loop, each connected to its neighbors.

•Each station connects to the previous and next station in the ring.
•Dual-ring designs add a second counter-rotating loop for fault tolerance (FDDI).
•A single break can be bypassed in dual-ring implementations.

Logical ring

Data or a token travels in one direction around the loop.

•Only the station holding the token may transmit (Token Ring).
•Order of access follows the ring sequence — deterministic access.
•Physical and logical ring align; contrast with hub-based star.

CCNA tip: Ring = physical ring and logical ring. Mention Token Ring or FDDI if the question asks for an example.

Real world: IBM Token Ring (legacy). FDDI used dual physical rings for backbone redundancy.

Full Mesh

Common on exam

Every node connected to every other node

Physical full mesh

Direct links exist between every pair of devices.

•Maximum redundancy — many alternate paths if a link fails.
•Link count grows quickly: n(n−1)/2 links for n nodes.
•Common in small critical WAN cores, not large campus access layers.

Logical mesh

Any two nodes communicate over a direct dedicated path.

•Routing is straightforward — often one hop between peers.
•No dependency on a single intermediate device for peer traffic.
•Physical and logical mesh typically match in WAN full-mesh designs.

CCNA tip: Full mesh = maximum redundancy, highest cost. CCNA may ask you to count links or pick the most fault-tolerant WAN layout.

Real world: Small data-center interconnects, critical site-to-site VPN meshes, some ISP core designs.

Partial Mesh

Common on exam

Selective redundancy — typical WAN pattern

Physical partial mesh

Some nodes have multiple links; not every pair is directly connected.

•Balances cost and redundancy — more links than a hub-and-spoke, fewer than full mesh.
•Core or regional sites tend to have more links; branch sites may have one.
•Most enterprise WANs are partial mesh at the routing layer.

Logical mesh

Multiple paths exist, but traffic may traverse intermediate routers.

•End-to-end paths can use redundant routes when links fail.
•Not every logical path is a single hop — routing selects best path.
•OSPF/EIGRP over a partial-mesh WAN is a common CCNA scenario.

CCNA tip: Partial mesh is the practical WAN compromise. Contrast with full mesh (all links) and hub-and-spoke (spokes only to hub).

Real world: Regional offices with dual MPLS/SD-WAN links to two data centers, not to each other.

Point-to-Point

CCNA core

Dedicated link between two endpoints

Physical point-to-point

Exactly one link connects two devices — no shared medium.

•Serial WAN links, fiber runs, or router-to-router connections.
•Simplest topology to troubleshoot — one cable, two ends.
•Foundation building block for mesh and hub-and-spoke designs.

Logical point-to-point

Communication is strictly between the two connected endpoints.

•No other device shares the link at Layer 1.
•Often mapped to a /30 or /31 subnet on WAN links in IPv4.
•PPP or HDLC commonly runs on serial point-to-point links.

CCNA tip: Point-to-point WAN links appear constantly in lab topologies. Know PPP, clock rate (DCE), and /30 addressing.

Real world: T1/E1 serial links, Metro Ethernet point-to-point, dark fiber between two sites.

Extended Star

Common on exam

Star of stars — hierarchical LAN

Physical extended star

Access switches connect to distribution/core switches in layers.

•Also called hierarchical star or tree topology.
•Each access switch forms a small star; uplinks create a larger star.
•Scales beyond a single switch port count.

Logical star

Each switched segment forwards intelligently — no shared hub domain.

•Traffic aggregates up the hierarchy toward the core.
•VLANs and inter-VLAN routing often happen at distribution/core.
•Still switched star behavior at each tier, not a logical bus.

CCNA tip: Three-tier design (access / distribution / core) is an extended physical star. Know where routing and switching happen.

Real world: Campus and enterprise LANs — closet switches uplink to distribution, then core.

Hub-and-Spoke

Common on exam

WAN star — spokes cannot talk directly

Physical hub-and-spoke

Branch sites (spokes) connect only to a central hub site.

•Spokes have no direct physical links to each other.
•All WAN circuits home to one or two hub routers.
•Cheaper than mesh — fewer total circuits.

Logical point-to-point

Each spoke has a dedicated virtual or physical path to the hub.

•Spoke-to-spoke traffic must transit the hub (hairpin routing).
•Frame Relay hub-and-spoke and DMVPN hub are CCNA-class examples.
•Hub router is a single point of failure unless a second hub exists.

CCNA tip: Contrast hub-and-spoke with partial mesh: spokes here do not connect to each other. Know hairpinning and hub redundancy.

Real world: Retail branch networks, DMVPN headend designs, classic Frame Relay hub sites.

Hybrid

Combines two or more topology types

Physical hybrid

Different segments of the network use different physical layouts.

•Example: star access layers joined by a routed core or legacy bus backbone.
•Large networks are almost always hybrid in practice.
•Draw each segment separately on exams — do not force one label on the whole diagram.

Logical hybrid

Logical behavior follows each segment’s technology — may differ from overall shape.

•A hybrid physical diagram may include both switched stars and point-to-point WAN links.
•Logical bus only exists where a shared medium (hub/coax) still lives.
•Identify the device in the center: hub → logical bus; switch → logical star.

CCNA tip: When a question shows multiple segments, label each part. Hybrid is the real world — star LAN + point-to-point WAN is hybrid.

Real world: Campus stars at each building, MPLS WAN hub-and-spoke, data-center mesh core — all combined.

How to read exam diagrams

Identify the center device first: hub → likely logical bus; switch → logical star.
WAN questions often use point-to-point, partial mesh, or hub-and-spoke — LAN questions focus on bus, star, and ring.
Hybrid networks are normal. Label each segment separately instead of forcing one topology name on the entire drawing.