A VLAN is a logical network on a switch: broadcasts and unknown frames are flooded only to ports in that VLAN. An access port carries one VLAN untagged, while an 802.1Q trunk carries many VLANs between switches by adding a tag, and sends its native VLAN untagged. Traffic between VLANs must be routed, for example by a switch virtual interface (SVI) on a Layer 3 switch.
Access ports and trunks
Cisco's VLAN guide says unicast, broadcast and multicast packets are forwarded and flooded only to end stations in the VLAN. Normal-range VLAN IDs are 1 to 1005 and extended-range IDs are 1006 to 4094. VLAN 1 is the default.
An access port belongs to and carries the traffic of only one VLAN, unless it is configured as a voice VLAN port. Frames on it are untagged, so printers and PCs need no VLAN awareness.
A trunk is a point-to-point link between a switch and another switch or a router that carries traffic for multiple VLANs. Traffic between VLANs must be routed.
The 802.1Q tag and the native VLAN
IANA's IEEE 802 Numbers registry assigns Ethertype 0x8100 to the IEEE 802.1Q Customer VLAN Tag (formerly the Q-Tag). On a trunk, 0x8100 sits where the frame's type field would be, the tag follows, and the original type field comes after it. Seeing 0x8100 in a capture means 802.1Q tagging is in use.
A trunk can carry tagged and untagged traffic. The switch forwards untagged traffic in the native VLAN configured for the port, VLAN 1 by default.
Voice VLANs and SVIs
The voice VLAN feature lets an access port carry IP voice traffic from an IP phone. The phone sends voice in 802.1Q frames for the voice VLAN with a Layer 2 CoS priority, 5 by default. Untagged traffic from the PC plugged into the phone passes through the phone unchanged. The switch tells the phone which VLAN to use with Cisco Discovery Protocol.
A switch virtual interface represents a VLAN of switch ports as one interface to the switch's routing function. Only one SVI can be associated with a VLAN. Give each VLAN's SVI an IP address and it becomes that VLAN's default gateway, so a Layer 3 switch routes between VLAN 10 and VLAN 20 without an external router.
Where the exam catches people
Believing a voice VLAN needs the phone's port configured as a trunk: the port stays an access port with a voice VLAN added.
Believing the native VLAN is tagged on a trunk: the native VLAN carries the untagged traffic.
Believing hosts in two VLANs on the same switch can talk without routing: traffic between VLANs must be routed, for example through SVIs.
Believing 0x8100 marks link aggregation or jumbo frames: it is the 802.1Q VLAN tag type.