In the Cisco three-layer network model, QoS (Quality of Service) classification and port security are typically discovered at the Access layer.
The Access layer is primarily responsible for connecting end devices to the network and often implements features like port security to control which devices can connect to the network and QoS policies to manage traffic from users and devices.
The Distribution layer serves as an intermediary between the Access and Core layers, focusing on routing, filtering, and WAN access, while the Core layer is primarily concerned with high-speed and high-capacity data transport with minimal packet manipulation.