Topologies, architectures and network types

Why this matters

A topology is a claim about two things at once: how the cables run, and how the traffic moves. Those are not the same claim, and most confusion about this objective comes from treating them as one.

You need this for more than recall. Topology decides what a single failure takes down, where congestion appears, and whether adding the fiftieth device is cheap or a rebuild. When domain 5 asks why a fault has the blast radius it has, the honest answer is usually "because of the shape of the network".

The lesson

Physical versus logical, first

The physical topology is where the cable goes. The logical topology is the path a frame actually takes. Classic Ethernet made the difference obvious: everything plugged into a hub looked like a star physically, but electrically every device shared one collision domain, so it behaved like a bus. Modern switched Ethernet is a physical star that is also a logical star.

Whenever a question describes a shape, check which one it means.

The shapes

Point to point. Two devices, one link, nothing else on it. A leased line, a microwave shot between buildings, a switch uplink. Simple, predictable, straightforward to troubleshoot — and it fails completely when the one link fails. Point-to-point links are the building block the other topologies are made from.

Star / hub and spoke. Every device connects to one central node. This is what essentially every modern LAN is: hosts to an access switch. In WAN terms, hub and spoke means every branch office connects back to a head office and branch-to-branch traffic goes through the hub.

Its property is the exam answer: adding or removing a device affects nobody else, and a single cable failure kills exactly one device — but the central node is a single point of failure for everything. In hub-and-spoke WANs there is a second cost: branch-to-branch traffic takes two hops through the hub, which adds latency and concentrates load.

Mesh. Devices interconnect directly. In a full mesh every node has a link to every other node, which gives the best possible resilience and the worst possible scaling: the number of links is n(n−1)/2, so ten sites need forty-five links. In a partial mesh only some pairs are linked — the practical compromise, and what most WANs actually are.

The arithmetic is worth memorising because it gets asked directly: 5 nodes = 10 links, 6 = 15, 10 = 45.

Hybrid. Any deliberate combination — which, in practice, is every real network of size. A campus is stars of hosts, aggregated by a partially meshed core. Calling something hybrid is not a cop-out; it is the accurate answer when a design mixes shapes on purpose.

Spine and leaf. A two-tier data-centre design. Every leaf switch (which hosts connect to) links to every spine switch, and leaves never connect to leaves, spines never to spines. The result is that any server is exactly the same distance from any other server — two hops, always. That predictability is the whole point: it makes latency uniform and lets you add capacity by adding a spine rather than redesigning.

It exists because of what happened to data-centre traffic, which is the next section.

The three-tier hierarchical model

The classic campus design, and the one N10-009 names explicitly. Three layers, each with a job:

Access layer. Where end devices plug in. High port count, cheap per port, usually layer 2. This is where you do port security, PoE for phones and access points, and VLAN assignment.

Distribution layer. Aggregates access switches. This is the policy layer: routing between VLANs, access control lists, filtering, and the boundary between layer 2 below and layer 3 above. It keeps broadcast domains from spreading across the whole building.

Core layer. The high-speed backbone that connects distribution blocks to each other and to the data centre or WAN edge. The core's job is to forward as fast as possible and do nothing clever — no filtering, no policy, because anything that adds latency here adds it to everything.

Collapsed core merges the core and distribution layers into one tier. For a single building or a small campus, a separate core is expensive hardware forwarding traffic that a distribution switch could have handled. You lose some scalability and some failure isolation; you save a lot of money. The exam expects you to know it is a two-tier design used where a full three tiers is not justified.

Traffic flows: north-south and east-west

This is the vocabulary that explains why data-centre design changed.

North-south traffic goes in and out of the network — a user on the internet reaching a web server, or a client in the office reaching a cloud service. Draw the network with the outside world at the top and clients at the bottom, and this traffic runs vertically.

East-west traffic moves between devices inside the network — a web tier talking to an application tier talking to a database, a hypervisor migrating a VM, replication between storage nodes.

The three-tier model was designed when traffic was mostly north-south: users pulled data from servers, and the path up through distribution to core was the busy one. Virtualisation, microservices and distributed storage inverted that. In a modern data centre most traffic is east-west, and a three-tier design handles it badly — two servers on different access switches have to travel up to distribution or core and back down, so server-to-server latency depends on where the servers happen to be.

Spine and leaf exists to fix exactly that. Every leaf is one hop from every spine, so every server is two hops from every other server, and east-west traffic no longer has a bad case.

If you understand that one causal chain — traffic went east-west, so the shape changed — you can answer most architecture questions on this exam without memorising anything else.