Free CCNA Exam Flashcards

The Open Systems Interconnection model is a 7-layer conceptual framework that standardizes network communication functions. Each layer (Physical, Data Link, Network, Transport, Session, Presentation, Application) has specific responsibilities, enabling different network technologies to interoperate. Understanding the OSI model is essential for troubleshooting network issues by isolating problems to specific layers.

The Transmission Control Protocol/Internet Protocol model is a 4-layer practical framework (Network Access, Internet, Transport, Application) used in modern networking. Unlike the theoretical OSI model, TCP/IP directly maps to real-world protocols and is the foundation of internet communication. It simplifies network design while maintaining interoperability across diverse systems.

An Internet Protocol address is a unique numerical identifier assigned to each device on a network, enabling communication and routing. IPv4 uses 32-bit addresses (e.g., 192.168.1.1) while IPv6 uses 128-bit addresses for expanded capacity. IP addresses consist of network and host portions, determined by the subnet mask.

A subnet mask is a 32-bit number that divides an IP address into network and host portions, defining which part identifies the network and which identifies individual devices. For example, 255.255.255.0 (/24) means the first 24 bits represent the network. Subnetting enables efficient IP address allocation and network segmentation for improved security and performance.

The default gateway is the router interface IP address that devices use to send traffic destined for networks outside their local subnet. When a device needs to communicate with an external network, it forwards packets to the default gateway for routing. Without a properly configured default gateway, devices cannot access the internet or other networks.

A Media Access Control address is a unique 48-bit hardware identifier assigned to network interface cards by manufacturers. Formatted as six hexadecimal pairs (e.g., 00:1A:2B:3C:4D:5E), MAC addresses operate at Layer 2 for local network communication. Unlike IP addresses, MAC addresses are permanent and used for device identification within the same broadcast domain.

IPv4 uses 32-bit addresses (4.3 billion addresses) in dotted decimal notation, while IPv6 uses 128-bit addresses (340 undecillion addresses) in hexadecimal notation. IPv6 eliminates the need for NAT, includes built-in security (IPsec), and simplifies header structure for faster routing. The transition to IPv6 addresses the exhaustion of IPv4 addresses.

A broadcast domain is a logical network segment where broadcast frames can reach all devices without crossing a router. Switches forward broadcasts within the same VLAN, while routers block broadcasts between different networks. Large broadcast domains can cause network congestion, so VLANs are used to segment them for better performance.

A collision domain is a network segment where data packets can collide with each other when transmitted simultaneously. Hubs create one large collision domain, while switches create separate collision domains for each port, eliminating collisions. Modern switched networks have largely eliminated collision issues through full-duplex communication.

Unicast sends data from one source to one specific destination (one-to-one). Multicast sends data from one source to multiple specific destinations (one-to-many), using special IP addresses (224.0.0.0-239.255.255.255). Broadcast sends data to all devices in a network segment (one-to-all), using addresses like 255.255.255.255 or subnet broadcast addresses.

A network switch is a Layer 2 device that forwards frames based on MAC addresses, creating separate collision domains for each port. Switches learn MAC addresses by examining source addresses of incoming frames and building a MAC address table. They provide full-duplex communication, increased bandwidth, and improved network performance compared to hubs.

A VLAN is a logical grouping of devices on different physical switches that communicate as if on the same network segment. VLANs improve security by isolating traffic, reduce broadcast domains, and enable flexible network design without physical recabling. Each VLAN is a separate broadcast domain requiring a router or Layer 3 switch for inter-VLAN communication.

A trunk port carries traffic for multiple VLANs between switches or between a switch and router, using VLAN tagging to identify which VLAN each frame belongs to. The 802.1Q protocol adds a 4-byte tag to Ethernet frames. Trunk ports enable VLAN communication across multiple switches while access ports connect end devices to a single VLAN.

Spanning Tree Protocol prevents Layer 2 loops in redundant switch topologies by blocking redundant paths and creating a loop-free logical topology. STP elects a root bridge and calculates the best path to it, placing ports in forwarding or blocking states. When a link fails, STP reconverges to activate backup paths, ensuring network availability.

Rapid Spanning Tree Protocol (802.1w) is an evolution of STP that provides faster convergence (seconds instead of 30-50 seconds). RSTP introduces new port roles (alternate, backup) and states (discarding, learning, forwarding) for quicker topology changes. It's backward compatible with STP and is the preferred spanning tree implementation.

EtherChannel bundles multiple physical links between switches into a single logical link, increasing bandwidth and providing redundancy. It uses either PAgP (Cisco proprietary) or LACP (IEEE 802.3ad standard) protocols for negotiation. EtherChannel provides load balancing across links and prevents STP from blocking redundant paths.

VLAN Trunking Protocol is a Cisco proprietary protocol that propagates VLAN configuration changes across all switches in a domain. VTP operates in three modes: server (can create/modify VLANs), client (receives updates), and transparent (forwards updates but doesn't apply them). VTP reduces administrative overhead but requires careful configuration to avoid accidental VLAN deletion.

The native VLAN is the VLAN assigned to untagged frames on an 802.1Q trunk port, defaulting to VLAN 1. Frames in the native VLAN traverse the trunk without 802.1Q tags. For security, it's recommended to change the native VLAN from the default and ensure it matches on both ends of a trunk link.

Port security restricts which devices can connect to a switch port based on MAC addresses, preventing unauthorized access. Administrators can specify maximum MAC addresses, statically configure allowed MACs, or use sticky learning. Violation modes include shutdown (default, disables port), restrict (drops packets, logs), and protect (drops packets silently).

Inter-VLAN routing enables communication between different VLANs using either a router with multiple interfaces (router-on-a-stick with subinterfaces) or a Layer 3 switch with switched virtual interfaces (SVIs). Router-on-a-stick uses a single trunk connection with 802.1Q tagging, while Layer 3 switches provide faster, hardware-based routing between VLANs.

A router is a Layer 3 device that forwards packets between different networks based on IP addresses, making path selection decisions using routing tables. Routers separate broadcast domains, provide inter-network communication, and implement security through access control lists. They examine destination IP addresses and use routing protocols or static routes to determine the best path.

Static routing uses manually configured routes that administrators enter into the routing table. Static routes don't change unless manually updated, providing predictable paths and minimal router overhead. They're ideal for small networks, stub networks, or default routes, but don't adapt to network changes and require manual intervention for failures.

Dynamic routing uses protocols that automatically discover routes, share routing information, and adapt to network topology changes. Routers exchange routing updates to build and maintain routing tables dynamically. Dynamic routing provides automatic failover, load balancing, and scalability, but consumes bandwidth and processing resources for protocol overhead.

Administrative Distance (AD) is a value (0-255) that indicates the trustworthiness of a routing information source, with lower values being more trusted. Common ADs: Connected (0), Static (1), EIGRP (90), OSPF (110), RIP (120). When multiple routing protocols provide routes to the same destination, the router selects the route with the lowest AD.

A routing metric is a value used by routing protocols to determine the best path when multiple routes to the same destination exist. Different protocols use different metrics: RIP uses hop count, OSPF uses cost (based on bandwidth), EIGRP uses composite metric (bandwidth, delay, reliability, load). Lower metric values indicate better paths.

OSPF is a link-state routing protocol that uses Dijkstra's algorithm to calculate the shortest path based on cost (bandwidth). It supports hierarchical design with areas, converges quickly, and sends updates only when topology changes. OSPF uses multicast addresses (224.0.0.5, 224.0.0.6) and forms neighbor relationships before exchanging routing information.

EIGRP is a Cisco advanced distance-vector (hybrid) protocol that uses DUAL algorithm for loop-free paths. It considers bandwidth, delay, reliability, and load in its composite metric. EIGRP supports unequal-cost load balancing, fast convergence, and sends partial updates only when changes occur, making it efficient and scalable.

RIP is a distance-vector routing protocol that uses hop count as its metric (maximum 15 hops, 16 is unreachable). RIPv1 is classful without subnet mask support, while RIPv2 is classless and supports VLSM and authentication. RIP is simple but slow to converge and inefficient, making it suitable only for small networks.

BGP is the exterior gateway protocol used to route traffic between autonomous systems on the internet. It's a path-vector protocol that makes routing decisions based on paths, policies, and rules rather than metrics. BGP is highly scalable, supports complex routing policies, and is essential for internet service providers and large enterprises.

A default route (0.0.0.0/0) is a catch-all route used when no specific route matches the destination address. Often called the 'gateway of last resort,' it directs traffic to a next-hop router when the destination network is unknown. Default routes are commonly used on edge routers to forward internet-bound traffic to ISPs.

A floating static route is a backup static route configured with a higher administrative distance than the primary route. It remains inactive in the routing table until the primary route fails, then automatically becomes active. Floating static routes provide redundancy and failover without the overhead of dynamic routing protocols.

Route summarization (aggregation) combines multiple contiguous networks into a single routing advertisement, reducing routing table size and update traffic. For example, 192.168.0.0/24 through 192.168.3.0/24 can be summarized as 192.168.0.0/22. Summarization improves scalability, reduces memory usage, and speeds up routing table lookups.

DHCP automatically assigns IP addresses and network configuration (subnet mask, default gateway, DNS servers) to devices. The DORA process (Discover, Offer, Request, Acknowledge) establishes the lease. DHCP reduces administrative overhead, prevents IP conflicts, and enables centralized IP management. Lease times determine how long assignments remain valid.

DNS translates human-readable domain names (www.example.com) into IP addresses that computers use for communication. DNS operates hierarchically with root servers, TLD servers, and authoritative name servers. It uses UDP port 53 for queries and TCP port 53 for zone transfers. DNS caching improves performance by storing recent lookups.

NAT translates private IP addresses to public IP addresses, enabling multiple devices to share a single public IP. Static NAT provides one-to-one mapping, Dynamic NAT uses a pool of public IPs, and PAT (Port Address Translation/NAT Overload) uses port numbers to multiplex connections. NAT conserves public IP addresses and provides basic security.

ACLs are ordered lists of permit or deny statements that filter traffic based on criteria like source/destination IP, protocol, and port numbers. Standard ACLs (1-99, 1300-1999) filter by source IP only, while Extended ACLs (100-199, 2000-2699) filter by multiple criteria. ACLs provide security, traffic control, and QoS implementation.

NTP synchronizes clocks across network devices to ensure accurate timestamps for logs, authentication, and troubleshooting. NTP uses a hierarchical stratum system (0-15) where lower stratum numbers indicate more accurate time sources. Synchronized time is critical for security protocols, log correlation, and certificate validation.

SNMP monitors and manages network devices by collecting information and configuring parameters remotely. It uses managers (monitoring stations) and agents (on devices) communicating via MIBs (Management Information Bases). SNMPv3 provides authentication and encryption, while earlier versions (v1, v2c) use community strings for basic security.

Syslog is a standard protocol for sending log messages from network devices to a centralized logging server. Messages have severity levels (0-7, from Emergency to Debug) and facility codes identifying the source. Centralized logging enables easier troubleshooting, security monitoring, and compliance auditing across the network.

FTP (File Transfer Protocol) uses TCP ports 20/21, supports authentication, and provides reliable file transfer with directory navigation. TFTP (Trivial FTP) uses UDP port 69, has no authentication, and offers simple, lightweight file transfer ideal for device configuration backups and IOS upgrades. TFTP is faster but less reliable than FTP.

Ethernet is the most common LAN technology, operating at Layer 2 using CSMA/CD (legacy) or full-duplex switching. Standards include 10BASE-T (10 Mbps), 100BASE-TX (Fast Ethernet, 100 Mbps), 1000BASE-T (Gigabit, 1 Gbps), and 10GBASE-T (10 Gbps). Ethernet uses RJ-45 connectors and twisted-pair cabling with maximum distances of 100 meters.

802.11 defines WiFi standards: 802.11a (5 GHz, 54 Mbps), 802.11b (2.4 GHz, 11 Mbps), 802.11g (2.4 GHz, 54 Mbps), 802.11n (2.4/5 GHz, 600 Mbps), 802.11ac (5 GHz, 6.9 Gbps), and 802.11ax/WiFi 6 (2.4/5/6 GHz, 9.6 Gbps). Higher frequencies provide faster speeds but shorter range.

WEP (Wired Equivalent Privacy) is deprecated and easily cracked. WPA (WiFi Protected Access) uses TKIP encryption. WPA2 uses AES encryption and is the current standard. WPA3 provides enhanced security with SAE (Simultaneous Authentication of Equals). Enterprise modes use 802.1X with RADIUS servers, while Personal modes use pre-shared keys.

QoS prioritizes network traffic to ensure critical applications receive adequate bandwidth and low latency. Classification marks packets using DSCP or CoS values. Queuing mechanisms (FIFO, Priority, WFQ, CBWFQ) determine transmission order. Policing and shaping control traffic rates. QoS is essential for voice, video, and real-time applications.

PoE delivers electrical power over Ethernet cables to devices like IP phones, wireless access points, and cameras. IEEE 802.3af (PoE) provides 15.4W, 802.3at (PoE+) provides 25.5W, and 802.3bt (PoE++) provides up to 90W. PoE eliminates the need for separate power supplies and enables flexible device placement.

CDP (Cisco Discovery Protocol) is a Cisco proprietary Layer 2 protocol that discovers directly connected Cisco devices and shares information like hostname, IP address, and platform. LLDP (Link Layer Discovery Protocol) is the vendor-neutral IEEE 802.1AB standard providing similar functionality. Both help with network mapping and troubleshooting.

TCP (Transmission Control Protocol) is connection-oriented, providing reliable, ordered delivery with error checking, flow control, and retransmission. UDP (User Datagram Protocol) is connectionless, offering faster, lightweight transmission without reliability guarantees. TCP is used for web, email, and file transfer; UDP for streaming, VoIP, and DNS.

ARP resolves IP addresses to MAC addresses for local network communication. When a device needs to send data, it broadcasts an ARP request asking 'Who has this IP?' The device with that IP responds with its MAC address. ARP tables cache these mappings to reduce broadcast traffic. Gratuitous ARP announces IP-to-MAC mappings proactively.

ICMP is used for network diagnostics and error reporting. Ping uses ICMP Echo Request/Reply to test connectivity and measure round-trip time. Traceroute uses ICMP Time Exceeded messages to map network paths. ICMP also reports unreachable destinations, TTL expiration, and other network conditions. It operates at Layer 3 but supports IP.

HTTP (Hypertext Transfer Protocol) transmits web content over TCP port 80 without encryption, making it vulnerable to eavesdropping. HTTPS (HTTP Secure) uses TLS/SSL encryption over TCP port 443 to protect data confidentiality and integrity. HTTPS authenticates servers using digital certificates and is essential for secure web transactions and privacy.