Free CCNA Exam Flashcards

The Open Systems Interconnection model is a 7-layer conceptual framework that standardizes network communication functions. Each layer (Physical, Data Link, Network, Transport, Session, Presentation, Application) has specific responsibilities, enabling different network technologies to interoperate. Understanding the OSI model is essential for troubleshooting network issues by isolating problems to specific layers.

The Transmission Control Protocol/Internet Protocol model is a 4-layer practical framework (Network Access, Internet, Transport, Application) used in modern networking. Unlike the theoretical OSI model, TCP/IP directly maps to real-world protocols and is the foundation of internet communication. It simplifies network design while maintaining interoperability across diverse systems.

An IP address identifies a network interface within an addressing context. IPv4 uses 32 bits; IPv6 uses 128 bits. A subnet mask or prefix length identifies the network prefix. A device may have several interfaces and addresses, and anycast deliberately assigns an address to multiple interfaces.

A subnet mask is a 32-bit number that divides an IPv4 address into network and host portions, defining which part identifies the network and which identifies individual devices. For example, 255.255.255.0 (/24) means the first 24 bits represent the network. Subnetting enables efficient IP address allocation and network segmentation for improved security and performance.

For an ordinary host, the default gateway is the next-hop router used when no more-specific host route matches an off-link destination. It may be a physical or virtual gateway address. Hosts can still reach remote networks through explicitly configured routes even without a default route.

An Ethernet MAC address is a 48-bit Layer 2 identifier, commonly written as six hexadecimal pairs. Manufacturers assign universally administered addresses, but software can use locally administered, randomized, or spoofed addresses. A MAC address is not necessarily permanent and does not authenticate a device.

IPv4 uses 32-bit dotted-decimal addresses; IPv6 uses 128-bit hexadecimal addresses. IPv6 expands address capacity and supports end-to-end addressing without routine IPv4-style NAT. IPv6 does not automatically encrypt traffic: IPsec support and an actual security policy are separate matters.

A broadcast domain is a logical network segment where broadcast frames can reach all devices without crossing a router. Switches forward broadcasts within the same VLAN, while routers block broadcasts between different networks. Large broadcast domains can cause network congestion, so VLANs are used to segment them for better performance.

A collision domain is a shared half-duplex Ethernet segment where simultaneous transmissions can collide. A hub shares one collision domain. A switch separates segments per port, but collisions disappear only when links use full duplex; a half-duplex link or duplex mismatch can still show collisions.

Unicast sends data from one source to one specific destination (one-to-one). Multicast sends data from one source to multiple specific destinations (one-to-many), using IPv4 multicast addresses (224.0.0.0-239.255.255.255). Broadcast sends data to all devices in a network segment (one-to-all), using addresses like 255.255.255.255 or subnet broadcast addresses. IPv6 uses multicast but has no broadcast addresses.

A Layer 2 switch learns source MAC addresses on ingress ports and uses destination MAC addresses for forwarding within a VLAN. Each port is a separate Ethernet segment. A multilayer switch can additionally route IP packets between subnets; full-duplex links avoid Ethernet collisions.

A VLAN is a logical Layer 2 broadcast domain. Its ports may be on one switch or span switches through trunks. Different VLANs normally use different IP subnets, and communication between them requires routing through a router or Layer 3 switch.

An 802.1Q trunk carries multiple VLANs over one link. A tag adds four bytes to identify the VLAN and priority. Ordinary native-VLAN traffic is untagged by default on Cisco trunks, unless native tagging is configured. An access port carries one data VLAN and may also support a separate voice VLAN.

Spanning Tree Protocol prevents Layer 2 loops in redundant switch topologies by blocking redundant paths and creating a loop-free logical topology. STP elects a root bridge and calculates the best path to it, placing ports in forwarding or blocking states. When a link fails, STP reconverges to activate backup paths, ensuring network availability.

RSTP uses discarding, learning, and forwarding states, with alternate and backup port roles. Proposal/agreement handshakes and edge-port behavior can restore connectivity much faster than classic STP. Exact convergence time depends on topology and failure conditions. Cisco Rapid PVST+ applies rapid spanning tree per VLAN.

EtherChannel combines compatible physical interfaces into one logical port-channel, providing aggregate capacity and member-link redundancy. LACP is standardized in IEEE 802.1AX, originating in 802.3ad; PAgP is Cisco proprietary. STP treats the bundle as one link. Hash-based distribution normally keeps one flow on one member.

VTP is Cisco VLAN configuration distribution. In common VTP v1/v2 operation, servers manage VLANs, clients learn them, and transparent switches keep local VLAN configuration while forwarding compatible advertisements. Some versions/platforms also support off mode. Verify version-specific behavior; VTP configuration is supplemental background rather than a listed v1.1 objective.

On a Cisco 802.1Q trunk, untagged traffic is normally assigned to the configured native VLAN, which defaults to VLAN 1. Native-VLAN frames are normally transmitted untagged unless native tagging is enabled. Match the native VLAN at both ends to avoid unintended VLAN mapping.

Port security limits which Ethernet source MAC addresses may use a switch port. Configure a maximum, static secure addresses, or sticky learning. Shutdown err-disables the port; restrict drops violating frames and reports violations; protect drops them silently. MAC-based port security is not strong user authentication.

Inter-VLAN routing can use separate physical router interfaces, router-on-a-stick subinterfaces, or Layer 3 switch SVIs. Router-on-a-stick uses one physical 802.1Q trunk with a subinterface and gateway address per VLAN. An SVI supplies a VLAN gateway on a multilayer switch with IP routing enabled.

A router is a Layer 3 device that forwards packets between different networks based on IP addresses, making path selection decisions using routing tables. Routers separate broadcast domains, provide inter-network communication, and implement security through access control lists. They examine destination IP addresses and use routing protocols or static routes to determine the best path.

Static routes are manually configured. A next-hop static route can leave the routing table if its next hop can no longer be resolved; the configuration itself remains. Floating static routes provide a less-preferred backup. Detecting an upstream failure beyond a still-up interface may require tracking.

Dynamic routing uses protocols that automatically discover routes, share routing information, and adapt to network topology changes. Routers exchange routing updates to build and maintain routing tables dynamically. Dynamic routing provides automatic failover, load balancing, and scalability, but consumes bandwidth and processing resources for protocol overhead.

Administrative distance ranks competing route sources for the same prefix. Common Cisco defaults are connected 0, static 1, internal EIGRP 90, OSPF 110, and RIP 120. Distance 255 is not usable for installation. Packet forwarding separately chooses the longest matching installed prefix.

Metrics compare paths within a routing protocol, not unrelated protocols' units. RIP uses hop count; OSPF uses cumulative interface cost. With default EIGRP K values, the metric uses minimum path bandwidth and cumulative delay; load and reliability are not used by default.

OSPF is a link-state protocol that runs Dijkstra's shortest-path algorithm using interface costs. Routers exchange LSAs and form adjacencies to synchronize their databases. Topology changes trigger updates, but periodic LSA refreshes and Hello packets also occur. v1.1 specifically tests single-area OSPFv2 configuration.

EIGRP is an advanced distance-vector protocol using DUAL for loop-free path selection. With default K values, its composite metric uses minimum path bandwidth and cumulative delay. It supports unequal-cost load sharing through variance. EIGRP configuration is supplemental routing background, not a listed v1.1 configuration objective.

RIP is a distance-vector routing protocol that uses hop count as its metric (maximum 15 hops, 16 is unreachable). RIPv1 is classful without subnet mask support, while RIPv2 is classless and supports VLSM and authentication. RIP is simple but slow to converge and inefficient, making it suitable only for small networks.

BGP is a path-vector protocol used between autonomous systems and also within them through iBGP. It applies policy and path attributes such as local preference, AS path, origin, and MED. It does not select paths by a simple shortest-hop metric. BGP configuration is supplemental background for this deck.

A default route (0.0.0.0/0) is a catch-all route used when no specific route matches the destination address. Often called the 'gateway of last resort,' it directs traffic to a next-hop router when the destination network is unknown. Default routes are commonly used on edge routers to forward internet-bound traffic to ISPs.

A floating static route has a higher administrative distance than the primary route to the same prefix. It can enter the table after the preferred route is withdrawn, provided its next hop is reachable. A still-installed primary route does not disappear merely because some remote service fails.

Route summarization (aggregation) combines multiple contiguous networks into a single routing advertisement, reducing routing table size and update traffic. For example, 192.168.0.0/24 through 192.168.3.0/24 can be summarized as 192.168.0.0/22. Summarization improves scalability, reduces memory usage, and speeds up routing table lookups.

DHCP automatically assigns IP addresses and network configuration (subnet mask, default gateway, DNS servers) to devices. The DORA process (Discover, Offer, Request, Acknowledge) establishes the lease. DHCP reduces administrative overhead, helps avoid conflicting dynamic assignments, and enables centralized IP management. Lease times determine how long assignments remain valid.

DNS maps names to records, including IPv4 A and IPv6 AAAA addresses. Ordinary lookups commonly use UDP port 53, with TCP port 53 also supported, including for truncated-response retry and zone transfer. DNS is hierarchical, and caching can answer requests without contacting every level.

NAT translates IP addresses; PAT can distinguish multiple sessions sharing an address using transport identifiers such as ports. Static NAT provides fixed mappings, while dynamic NAT uses a pool. NAT is not a substitute for firewall policy or encryption, even if translation changes outside reachability.

IPv4 ACLs are ordered permit/deny entries with an implicit deny at the end. Standard ACLs match source IP addresses; extended ACLs can match source, destination, protocol, and ports. Numbered standard ranges are 1-99 and 1300-1999; extended ranges are 100-199 and 2000-2699. ACLs also classify traffic for features such as NAT and QoS.

NTP synchronizes clocks for log correlation and other time-dependent services. Stratum describes logical distance from a reference clock, not an absolute accuracy guarantee. Reference devices are called stratum 0; synchronized servers use strata 1-15, and stratum 16 means unsynchronized. Configure an IOS client with ntp server followed by the server address.

SNMP uses managers and device agents to access MIB objects. Get retrieves values, Set changes supported values, and Trap or Inform sends notifications. SNMPv3 supports authentication and privacy when the appropriate security level is configured; v3 alone does not mean encryption is enabled. v1/v2c commonly use community strings.

Syslog is a standard protocol for sending log messages from network devices to a centralized logging server. Messages have severity levels (0-7, from Emergency to Debug) and facility codes identifying the source. Centralized logging enables easier troubleshooting, security monitoring, and compliance auditing across the network.

FTP uses TCP port 21 for control, with port 20 for traditional active-mode server data connections; passive-mode data uses negotiated ports. TFTP starts requests at UDP port 69 and uses acknowledgments and retransmission for data blocks. Neither basic protocol encrypts transfers; TFTP lacks built-in user authentication and directory browsing.

Ethernet includes copper and fiber physical variants. Common twisted-pair BASE-T channels support up to 100 meters when the required cable category and installation limits are met; fiber reach depends on optics and fiber type. CSMA/CD applies to shared or half-duplex Ethernet, not modern full-duplex switching.

Common generations include 802.11a at 5 GHz, b/g at 2.4 GHz, n at 2.4/5 GHz, and ac at 5 GHz. Wi-Fi 6 uses 802.11ax at 2.4/5 GHz; Wi-Fi 6E extends ax operation into 6 GHz. Advertised PHY maxima are not guaranteed application throughput.

WEP and WPA/TKIP are obsolete. WPA2 commonly uses AES-CCMP; WPA3-Personal uses SAE to improve password authentication and resist passive offline guessing. Enterprise WLANs use 802.1X/EAP with an authentication server such as RADIUS. Personal security still requires a strong password; WPA3 does not remove the need for authentication.

QoS classification identifies traffic; marking labels it with fields such as Layer 3 DSCP or Layer 2 802.1Q PCP/CoS. Queuing and scheduling determine transmission order. Policing drops or remarks excess traffic, while shaping buffers it to smooth the rate. Marking alone does not guarantee priority treatment.

PoE supplies power and data over Ethernet cabling. Distinguish switch power from power delivered after cable loss: 802.3af supports 15.4 W at the PSE and 12.95 W at the PD; 802.3at supports 30 W and 25.5 W respectively. Higher-power 802.3bt Type 4 supports up to 90 W at the PSE.

CDP (Cisco Discovery Protocol) is a Cisco proprietary Layer 2 protocol that discovers directly connected Cisco devices and shares information like hostname, IP address, and platform. LLDP (Link Layer Discovery Protocol) is the vendor-neutral IEEE 802.1AB standard providing similar functionality. Both help with network mapping and troubleshooting.

TCP offers a connection-oriented, ordered byte stream with acknowledgments, retransmission, and flow control. UDP sends connectionless datagrams without transport-level delivery or ordering guarantees. UDP has lower header and setup overhead, but is not universally faster, and applications can implement their own reliability.

ARP maps an IPv4 next-hop address to a MAC address on the local link. A host broadcasts a request and normally receives a unicast reply. For an off-subnet destination, it resolves the gateway's MAC rather than the remote host's MAC. IPv6 uses Neighbor Discovery instead of ARP.

ICMP is used for network diagnostics and error reporting. Ping uses ICMP Echo Request/Reply to test connectivity and measure round-trip time. Traceroute uses ICMP Time Exceeded messages to map network paths. ICMP also reports unreachable destinations, TTL expiration, and other network conditions. It operates at Layer 3 but supports IP.

HTTP commonly uses TCP port 80 without encryption. HTTPS protects HTTP with TLS, commonly on port 443, providing confidentiality, integrity, and server authentication when certificates are validated. HTTP/3 uses QUIC over UDP, so HTTPS is not universally TCP-only. SSL is obsolete terminology for modern TLS.

LACP active initiates negotiation; passive responds. Active-active and active-passive can form a bundle, while passive-passive cannot. The on mode creates a static bundle without LACP negotiation.

Use switchport access vlan for untagged data and switchport voice vlan for a compatible phone's tagged voice. One data VLAN plus a separate voice VLAN is a supported access-port exception.

For a spanning-tree instance, the lowest bridge ID wins. Compare bridge priority, then the MAC address when priorities tie. This differs from OSPF DR election, which prefers higher priority.

PortFast permits immediate edge-port forwarding. BPDU Guard err-disables a protected port receiving a BPDU, guarding against an unexpected switch. PortFast alone does not filter BPDUs or prevent every loop.

Root Guard blocks acceptance of superior root information on a protected downstream port. Loop Guard prevents a non-designated port from forwarding when expected BPDUs disappear. Their triggering conditions differ.

A FlexConnect AP can bridge selected WLAN traffic locally at a branch while remaining controller managed. Carrying several locally switched VLANs normally requires an 802.1Q trunk on its wired uplink.

CAPWAP links an AP and controller, using UDP 5246 for control and UDP 5247 for data. In centralized switching, client traffic crosses the data tunnel; locally switched FlexConnect traffic can stay at the branch.

For client connectivity, verify that the WLAN is enabled and assigned to the intended AP policy, VLAN/interface, security mode, and QoS settings. Creating an SSID entry alone does not establish a working WLAN.

show interfaces trunk reports operating trunks, native VLANs, and allowed/forwarding VLAN information. A VLAN must exist locally and be allowed across the relevant links; a native-VLAN match does not override an allowed list.

Forwarding uses the most specific installed prefix containing the destination. An installed /25 beats a matching /24 even when the /25 has a higher administrative distance.

In an IOS route such as O 192.0.2.0/24 [110/20] via 10.0.0.2, the brackets show administrative distance 110 and metric 20. The address after via is the next hop.

An operational IPv4 interface commonly installs a connected route for its subnet and an L /32 local route for its exact interface address. The local route identifies traffic destined to the router itself.

A static route with mask 255.255.255.255 matches one IPv4 address. For example, ip route 192.0.2.44 255.255.255.255 10.0.0.1 creates a host route through that next hop.

Use /128 to match a single IPv6 address and ::/0 for a default route. Both use the ipv6 route command; the IPv4 ip route command cannot configure IPv6 routes.

An IPv6 static route using a link-local next hop must include the exit interface, since the same link-local address can appear on different links. A link-local next hop has meaning only on its own link.

An IOS OSPF network statement matches local interface IPv4 addresses using a wildcard mask. Zero bits must match; one bits are ignored. Matching interfaces join the specified area rather than advertising the wildcard range as a single subnet.

Neighbors need compatible area, hello/dead timers, and relevant authentication and network settings. On a broadcast link, masks must match. OSPF process IDs are locally significant and need not match.

At process startup, IOS normally prefers an explicit router ID, then the highest eligible loopback IPv4 address, then the highest eligible physical-interface address. Router IDs must be unique in the OSPF domain.

At an initial election, eligible routers prefer higher interface priority, then higher router ID. Priority 0 is ineligible. Elections are nonpreemptive; a newly joining better candidate does not automatically replace the current DR.

A point-to-point OSPF link elects no DR or BDR. The two routers can form a full adjacency directly, even when the underlying physical medium is Ethernet.

The common progression is Down, Init, 2-Way, ExStart, Exchange, Loading, Full. Full means database synchronization. Two DROTHER routers on one broadcast segment normally remain 2-Way with each other.

Cisco OSPF normally calculates cost from reference bandwidth divided by interface bandwidth, with a minimum of 1. A default 100-Mbps reference gives 100-Mbps and faster links cost 1; increase it consistently to distinguish faster speeds.

A passive OSPF interface sends no Hellos and forms no neighbor adjacencies, while its matched connected subnet can still be advertised. This suits end-user LANs where routing peers are not expected.

HSRP and VRRP let hosts use a resilient virtual gateway. GLBP adds multiple active forwarders. Gateway redundancy does not guarantee upstream reachability; tracking and routing redundancy can be needed beyond the local LAN.

Configure ip helper-address on the client-facing routed interface when the DHCP server is on another subnet. The relay forwards the request toward the server and identifies the client network for address selection.

A vulnerability is a weakness; an exploit is a technique that uses it. A threat is a potential cause of harm. Mitigations such as patching reduce exposure or impact.

Train users to recognize and report social engineering, and control entry to rooms containing network equipment. A secure configuration cannot compensate for unrestricted physical access to a device.

enable secret configures the privileged EXEC secret using a platform-supported one-way hash. Legacy service password-encryption merely obfuscates certain configuration passwords and is not equivalent to a strong secret hash.

Combine different factor types, such as a password the user knows and a hardware token the user has. Two passwords or two knowledge questions still use only one factor type.

Authentication verifies identity; authorization determines permitted actions; accounting records activity. RADIUS and TACACS+ can support AAA. The AAA framework is distinct from the protocol carrying its requests.

DHCP snooping blocks server replies arriving on untrusted ports and records legitimate client bindings. Ports default to untrusted; explicitly trust only paths toward legitimate servers. A trunk is not automatically trusted.

DAI validates ARP on untrusted ports against allowed bindings. DHCP snooping supplies dynamic bindings; ARP ACLs support static hosts. DAI is an ARP control, while IP Source Guard filters client IP traffic.

IOS ACLs are checked in order and stop at the first match. A broad deny before a specific permit blocks the intended exception. Put exceptions before broader rules and account for the implicit deny.

Remote-access VPNs connect individual users; site-to-site VPNs connect networks. IPsec ESP can encrypt user traffic, and IKE negotiates keys and security associations. Encryption choices must be configured; tunneling alone is not confidentiality.

Personal uses a shared PSK/passphrase with AES-CCMP. Enterprise uses 802.1X/EAP and an authentication server such as RADIUS. An SSID name or hidden-SSID setting does not replace authentication and encryption.

A tested workflow makes repeated changes more consistent and can reduce typing errors. It still needs correct inputs, validation, and recovery planning; automation can also spread a mistaken configuration quickly.

The control plane builds routing and forwarding state. The data plane forwards packets using that state. Software-defined control can be logically centralized while controllers are physically distributed and device forwarding remains local.

Northbound APIs connect applications or orchestrators to a controller. Southbound APIs connect the controller to infrastructure devices. The direction describes architectural roles, not a particular cable or geographic direction.

The underlay provides transport reachability between network nodes. An overlay creates logical networks over it, often using tunnels. Overlay isolation still depends on correct underlay connectivity and security policies.

Generative AI drafts new material such as configurations or documentation. Predictive AI forecasts outcomes such as capacity demand from observed patterns. Validate an AI-generated change against the intended policy and test its behavior.

GET retrieves; POST commonly creates or submits; PUT creates or replaces at a known URI; PATCH makes partial changes; DELETE removes. Credentials or tokens authenticate requests. Check the API contract rather than assuming every endpoint supports every method.

JSON objects use braces with quoted member names and colon-separated values. Arrays use square brackets and ordered comma-separated values. Strings need double quotes; numbers, booleans, and null are distinct value types.

Ansible commonly uses agentless network connections such as SSH, NETCONF, or APIs with YAML playbooks and modules. Idempotent modules avoid extra changes once the desired state is met, but not every arbitrary command is idempotent.

Terraform uses declarative configuration and provider plugins to manage infrastructure resources. plan previews actions, apply executes them, and state maps configuration to managed objects. Passing a saved plan applies that plan; an ordinary apply first makes a new one.