A2.2 Network architecture

The school needs logical separation between student labs, staff, and public terminals, reduced broadcast traffic, and controlled access between groups. These are precisely the problems that VLANs, subnetting, and ACLs are designed to solve.

VLANs create logical groups at Layer 2, so broadcast traffic from student machines stays within the student VLAN and never reaches staff ports. Each group (labs, staff, library) is assigned its own VLAN regardless of physical switch location.

Subnetting maps each VLAN to a distinct IP address range at Layer 3. For example, staff might use 192.168.10.0/24 and students 192.168.20.0/24. Devices in different subnets must route through a Layer 3 device to communicate.

ACLs on the router define which inter-VLAN traffic is permitted. A rule can explicitly deny students from reaching staff file servers while allowing all groups to access the internet gateway. This meets the security requirement.

The combination of VLANs + subnetting + ACLs is the only option that addresses all three requirements simultaneously: logical isolation, reduced broadcasts, and controlled inter-group access.

The question asks for the technology combination that provides logical separation, broadcast reduction, and access control between three distinct user groups on the same physical infrastructure.

A flat network puts all devices in one broadcast domain, so broadcast traffic is not reduced and there is no internal separation. A perimeter firewall only protects against external threats, not internal lateral movement between student and staff devices.

A P2P model describes how devices share resources, not how they are segmented. It offers no mechanism to prevent a student device from browsing staff shares — security is actually harder to enforce in a P2P model.

Full mesh topology concerns physical cabling redundancy, not logical separation. A full mesh of all school devices would be extremely expensive (a school with 60 devices would need $\frac{60\times 59}{2}=1770$ connections) and provides no access control between groups.

VLANs + subnetting + ACLs is the only option that directly addresses all three stated needs. This is the standard enterprise approach to multi-group network design.

In a full mesh topology, every device connects directly to every other device. The number of connections required for $n$ devices is given by: $\text{Connections}=\frac{n(n-1)}{2}$

Substituting $n=9$: $\frac{9\times 8}{2}=\frac{72}{2}=36$

Each of the 9 devices connects to 8 others, giving $9\times 8=72$ directed connections. But each cable connects two devices, so we divide by 2 to avoid counting each link twice. This gives 36 unique connections.

The correct answer is 36. This illustrates why full mesh becomes impractical at scale — adding just one more device (10 total) would require $\frac{10\times 9}{2}=45$ connections.

The question requires applying the full mesh connection formula $\frac{n(n-1)}{2}$ where $n=9$.

18 would result from $\frac{9\times 4}{2}=18$, which is incorrect. This might come from using $n/2$ instead of $n-1$, a common arithmetic error.

72 equals $9\times 8$, which counts each connection twice (once from each end). The formula divides by 2 because a cable between device A and device B is one connection, not two.

45 is $\frac{10\times 9}{2}$, the correct answer for a 10-device full mesh — not a 9-device one. This is a common off-by-one error.

36 is correct: $\frac{9\times 8}{2}=36$. This is the exact number of unique direct links needed in a full mesh of 9 devices.