CCNA 200-301
The single exam for Cisco Certified Network Associate certification.
Getting Started: Your CCNA Journey
Free knowledge base
Cisco CCNA (200-301) — key terms, tricks & tips
Everything from the course in one searchable place: 323 entries. Use it to review before a practice test or look up a word you forgot.
323 results · showing first 300, refine your search
Exam Domains
Major topic areas covered by the exam with specific weightings.
Getting Started: Your CCNA Journey
Simlet
A simulation-based question requiring CLI interaction on a virtual device.
Getting Started: Your CCNA Journey
Recertification
Process to renew a Cisco certification before it expires.
Getting Started: Your CCNA Journey
Continuing Education (CE)
Credits earned through approved activities to recertify.
Getting Started: Your CCNA Journey
Weighting
Percentage of exam questions from a specific domain.
Getting Started: Your CCNA Journey
Cisco Learning Network
Official Cisco platform for exam topics and study resources.
Getting Started: Your CCNA Journey
Understanding the CCNA 200-301 Exam Structure
To remember the exam domains, think: 'Net Access Connects Services Securely with Automation.' (Network Fundamentals, Network Access, IP Connectivity, IP Services, Security Fundamentals, Automation & Programmability)
Getting Started: Your CCNA Journey
Understanding the CCNA 200-301 Exam Structure
The CCNA 200-301 exam is 120 minutes long and typically has 90-120 questions. The official passing score is not published but is generally around 825-850 out of 1000. Recertification is required every three years.
Getting Started: Your CCNA Journey
Understanding the CCNA 200-301 Exam Structure
Underestimating the breadth of topics: The CCNA is a single exam but covers a wide range of foundational networking concepts.
Getting Started: Your CCNA Journey
Understanding the CCNA 200-301 Exam Structure
Ignoring exam weightings: Not prioritizing study time based on the percentage of questions from each domain.
Getting Started: Your CCNA Journey
Understanding the CCNA 200-301 Exam Structure
Neglecting official Cisco resources: Not reviewing the official exam topics list on the Cisco Learning Network.
Getting Started: Your CCNA Journey
Active Recall
Retrieving information from memory without external cues.
Getting Started: Your CCNA Journey
Packet Tracer
Cisco's free network simulation tool for learning.
Getting Started: Your CCNA Journey
GNS3
Graphical Network Simulator-3, advanced network emulation software.
Getting Started: Your CCNA Journey
EVE-NG
Emulated Virtual Environment - Next Generation, powerful network emulator.
Getting Started: Your CCNA Journey
Physical Lab
Using actual hardware devices for hands-on practice.
Getting Started: Your CCNA Journey
Virtual Lab
Software-based simulation or emulation of network devices.
Getting Started: Your CCNA Journey
Study Plan
A structured schedule for covering exam topics and practice.
Getting Started: Your CCNA Journey
Effective Study Strategies & Lab Setup for CCNA
LABS: Learn, Apply, Build, Study. Always be doing LABS!
Getting Started: Your CCNA Journey
Effective Study Strategies & Lab Setup for CCNA
The exam expects you to not just know commands, but to understand their output and use them for verification and troubleshooting. Practice interpreting 'show' commands.
Getting Started: Your CCNA Journey
Effective Study Strategies & Lab Setup for CCNA
Relying solely on reading and watching videos without hands-on practice.
Getting Started: Your CCNA Journey
Effective Study Strategies & Lab Setup for CCNA
Not creating a structured study plan or sticking to it inconsistently.
Getting Started: Your CCNA Journey
Effective Study Strategies & Lab Setup for CCNA
Avoiding troubleshooting in labs; only configuring successful scenarios.
Getting Started: Your CCNA Journey
Router
Connects different networks and forwards packets based on IP addresses.
Network Fundamentals: The Building Blocks
Switch
Connects devices within a LAN and forwards frames based on MAC addresses.
Network Fundamentals: The Building Blocks
Firewall
Monitors and controls network traffic based on security rules.
Network Fundamentals: The Building Blocks
Access Point (AP)
Allows wireless devices to connect to a wired network.
Network Fundamentals: The Building Blocks
Wireless LAN Controller (WLC)
Centrally manages and configures multiple Access Points.
Network Fundamentals: The Building Blocks
MAC Address Table
Table on a switch mapping MAC addresses to ports.
Network Fundamentals: The Building Blocks
Routing Table
Table on a router mapping network destinations to next hops.
Network Fundamentals: The Building Blocks
Network Devices: Routers, Switches, Firewalls, APs, WLCs
To remember the core devices: 'RSF AW' - Routers, Switches, Firewalls, Access Points, WLCs. It's like 'RSVP' but for network gear!
Network Fundamentals: The Building Blocks
Network Devices: Routers, Switches, Firewalls, APs, WLCs
The exam frequently tests the OSI layer at which devices operate. Remember: Switches are primarily Layer 2, Routers are Layer 3, and Firewalls can operate at multiple layers but are often associated with Layer 3/4 and above for filtering.
Network Fundamentals: The Building Blocks
Network Devices: Routers, Switches, Firewalls, APs, WLCs
Confusing the function of a switch (Layer 2, MAC addresses, within a LAN) with a router (Layer 3, IP addresses, between networks).
Network Fundamentals: The Building Blocks
Network Devices: Routers, Switches, Firewalls, APs, WLCs
Underestimating the importance of a firewall's role in network security; it's not just a fancy router.
Network Fundamentals: The Building Blocks
Network Devices: Routers, Switches, Firewalls, APs, WLCs
Forgetting that APs are just the 'on-ramp' for wireless devices, while WLCs manage the whole wireless highway system.
Network Fundamentals: The Building Blocks
Physical Topology
The actual physical layout of network devices and cables.
Network Fundamentals: The Building Blocks
Logical Topology
How data flows through the network, independent of physical layout.
Network Fundamentals: The Building Blocks
Twisted-Pair Cable
Copper cable with pairs of wires twisted to reduce interference, used for Ethernet.
Network Fundamentals: The Building Blocks
Fiber Optic Cable
Cable using glass or plastic fibers to transmit data via light pulses.
Network Fundamentals: The Building Blocks
TCP
Connection-oriented, reliable transport protocol; guarantees delivery.
Network Fundamentals: The Building Blocks
UDP
Connectionless, unreliable transport protocol; fast, no delivery guarantee.
Network Fundamentals: The Building Blocks
Three-Way Handshake
TCP process to establish a connection (SYN, SYN-ACK, ACK).
Network Fundamentals: The Building Blocks
Auto-MDIX
Feature allowing network devices to automatically detect and correct cable type.
Network Fundamentals: The Building Blocks
Network Topologies, Cabling & TCP/UDP Basics
TCP is 'Tender, Caring, Protocol' – it cares about delivery. UDP is 'Uncaring, Don't-care, Protocol' – it just sends and hopes!
Network Fundamentals: The Building Blocks
Network Topologies, Cabling & TCP/UDP Basics
The CCNA exam frequently tests your understanding of TCP vs. UDP characteristics. Memorize that TCP is 'connection-oriented' and 'reliable', while UDP is 'connectionless' and 'unreliable'. Also, know the common applications associated with each, e.g., HTTP/FTP for TCP, DNS/VoIP for UDP.
Network Fundamentals: The Building Blocks
Network Topologies, Cabling & TCP/UDP Basics
Confusing physical and logical topologies; they are distinct concepts.
Network Fundamentals: The Building Blocks
Network Topologies, Cabling & TCP/UDP Basics
Incorrectly using crossover vs. straight-through cables on older equipment (though Auto-MDIX helps).
Network Fundamentals: The Building Blocks
Network Topologies, Cabling & TCP/UDP Basics
Assuming all network problems are due to physical cabling; sometimes it's protocol-related.
Network Fundamentals: The Building Blocks
IPv4 Address
32-bit identifier for devices on a network.
Network Fundamentals: The Building Blocks
Subnet Mask
Defines network and host portions of an IPv4 address.
Network Fundamentals: The Building Blocks
Subnetting
Dividing a large network into smaller subnetworks.
Network Fundamentals: The Building Blocks
Default Gateway
Router IP address for traffic leaving the local network.
Network Fundamentals: The Building Blocks
DNS
Translates domain names to IP addresses.
Network Fundamentals: The Building Blocks
IPv6 Address
128-bit identifier, next-generation IP addressing.
Network Fundamentals: The Building Blocks
Unicast
IPv6 address type for one-to-one communication.
Network Fundamentals: The Building Blocks
Link-Local Address
IPv6 address valid only on the local link.
Network Fundamentals: The Building Blocks
IPv4 Addressing, Subnetting & IPv6 Addressing Types
N-H-S: Network, Host, Subnet. Remember the order for IPv4 address parts and how the subnet mask helps separate them!
Network Fundamentals: The Building Blocks
IPv4 Addressing, Subnetting & IPv6 Addressing Types
Memorize the default subnet masks for Class A (/8), B (/16), and C (/24) IPv4 networks, even though CIDR is prevalent. Also, know the common IPv6 address types: Global Unicast, Link-Local, Unique Local, Multicast, and Anycast. The exam often asks to identify these.
Network Fundamentals: The Building Blocks
IPv4 Addressing, Subnetting & IPv6 Addressing Types
Confusing network address with host address: The network address has all host bits as 0, and the broadcast address has all host bits as 1. Neither can be assigned to a host.
Network Fundamentals: The Building Blocks
IPv4 Addressing, Subnetting & IPv6 Addressing Types
Incorrectly calculating usable host addresses: Always subtract 2 (for network and broadcast addresses) from the total possible host addresses in a subnet.
Network Fundamentals: The Building Blocks
IPv4 Addressing, Subnetting & IPv6 Addressing Types
Forgetting the default gateway or DNS: These are common culprits for 'can't reach the internet' issues.
Network Fundamentals: The Building Blocks
WPA3
Latest Wi-Fi security standard, offering enhanced encryption and authentication.
Network Fundamentals: The Building Blocks
802.1X
IEEE standard for port-based network access control, often used with RADIUS.
Network Fundamentals: The Building Blocks
Virtual Machine (VM)
Software-based emulation of a physical computer system.
Network Fundamentals: The Building Blocks
Hypervisor
Software that creates and runs virtual machines on a physical host.
Network Fundamentals: The Building Blocks
IaaS
Cloud service model providing virtualized computing resources over the internet.
Network Fundamentals: The Building Blocks
PaaS
Cloud service model providing a platform for developing and running applications.
Network Fundamentals: The Building Blocks
SaaS
Cloud service model delivering ready-to-use software applications over the internet.
Network Fundamentals: The Building Blocks
Wireless Principles & Virtualization Concepts
To remember the cloud service models, think 'I P S': Infrastructure, Platform, Software. Or, 'I Can See' for Infrastructure, Control, Software.
Network Fundamentals: The Building Blocks
Wireless Principles & Virtualization Concepts
The exam often tests your knowledge of wireless security standards (WPA2 vs. WPA3), frequency bands (2.4 GHz vs. 5 GHz characteristics), and the differences between cloud service models (IaaS, PaaS, SaaS). Pay attention to the 'who manages what' aspect of cloud services.
Network Fundamentals: The Building Blocks
Wireless Principles & Virtualization Concepts
Confusing the characteristics of 2.4 GHz and 5 GHz bands (e.g., thinking 2.4 GHz has higher speed).
Network Fundamentals: The Building Blocks
Wireless Principles & Virtualization Concepts
Mixing up WPA2 and WPA3 security features or thinking WEP is still a viable security option.
Network Fundamentals: The Building Blocks
Wireless Principles & Virtualization Concepts
Not understanding the 'who manages what' responsibility split between IaaS, PaaS, and SaaS.
Network Fundamentals: The Building Blocks
VLAN
Logically segments a physical network into multiple broadcast domains.
Network Access: Connecting Devices
Broadcast Domain
Area where a broadcast frame will reach all devices.
Network Access: Connecting Devices
Access Port
Switch port assigned to a single VLAN, for end devices.
Network Access: Connecting Devices
Trunk Port
Switch port carrying traffic for multiple VLANs, between switches/routers.
Network Access: Connecting Devices
802.1Q
IEEE standard for VLAN tagging on Ethernet frames.
Network Access: Connecting Devices
VLAN ID (VID)
12-bit identifier in 802.1Q tag, identifying the VLAN.
Network Access: Connecting Devices
Native VLAN
VLAN assigned to untagged traffic on an 802.1Q trunk link.
Network Access: Connecting Devices
DTP
Cisco protocol for dynamic trunk negotiation between switches.
Network Access: Connecting Devices
VLANs, Trunking (802.1Q) & DTP Fundamentals
VLANs: 'Virtual LANs, Less Annoying Networks'. Think of them as invisible walls separating departments in a big open office.
Network Access: Connecting Devices
VLANs, Trunking (802.1Q) & DTP Fundamentals
The exam often tests the difference between access and trunk ports, and the purpose of 802.1Q tagging. Remember that 802.1Q is the industry standard for tagging, while DTP is Cisco proprietary. Pay attention to the default native VLAN (VLAN 1) and how it handles untagged traffic.
Network Access: Connecting Devices
VLANs, Trunking (802.1Q) & DTP Fundamentals
Forgetting to configure the native VLAN to match on both ends of a trunk link, leading to connectivity issues for untagged traffic.
Network Access: Connecting Devices
VLANs, Trunking (802.1Q) & DTP Fundamentals
Leaving DTP enabled on ports connected to non-Cisco devices or end devices, which can cause unexpected trunk formation or security vulnerabilities.
Network Access: Connecting Devices
VLANs, Trunking (802.1Q) & DTP Fundamentals
Confusing the purpose of an access port (single VLAN, end device) with a trunk port (multiple VLANs, inter-switch/router link).
Network Access: Connecting Devices
CDP
Cisco Discovery Protocol, proprietary Layer 2 neighbor discovery.
Network Access: Connecting Devices
LLDP
Link Layer Discovery Protocol, open standard Layer 2 neighbor discovery.
Network Access: Connecting Devices
EtherChannel
Groups multiple physical links into one logical link.
Network Access: Connecting Devices
LACP
Link Aggregation Control Protocol, dynamic EtherChannel negotiation (802.3ad).
Network Access: Connecting Devices
PAgP
Port Aggregation Protocol, Cisco proprietary dynamic EtherChannel negotiation.
Network Access: Connecting Devices
RSTP
Rapid Spanning Tree Protocol (802.1w), faster STP convergence.
Network Access: Connecting Devices
Rapid PVST+
Cisco's implementation of RSTP per VLAN.
Network Access: Connecting Devices
CDP/LLDP, EtherChannel (LACP) & Rapid PVST+
LACP: 'L' for 'Link' and 'A' for 'Aggregation' – it aggregates links dynamically!
Network Access: Connecting Devices
CDP/LLDP, EtherChannel (LACP) & Rapid PVST+
Memorize the default STP mode on Cisco switches (PVST+ for older IOS, Rapid PVST+ for newer IOS) and the port states/roles for RSTP (discarding, learning, forwarding; root, designated, alternate, backup). Know that LACP is 802.3ad.
Network Access: Connecting Devices
CDP/LLDP, EtherChannel (LACP) & Rapid PVST+
Forgetting to configure 'spanning-tree mode rapid-pvst' globally before setting root bridges, leading to slower STP convergence.
Network Access: Connecting Devices
CDP/LLDP, EtherChannel (LACP) & Rapid PVST+
Mixing LACP 'active' and 'passive' modes incorrectly, or trying to mix LACP with PAgP or static ON mode on a single EtherChannel.
Network Access: Connecting Devices
CDP/LLDP, EtherChannel (LACP) & Rapid PVST+
Not ensuring all physical interfaces in an EtherChannel have identical speed, duplex, and VLAN configurations, which will prevent the channel from forming.
Network Access: Connecting Devices
Autonomous AP
Standalone AP, self-contained, manages its own configuration and clients.
Network Access: Connecting Devices
Lightweight AP (LAP)
AP managed by a WLC, primarily acts as a radio transceiver.
Network Access: Connecting Devices
CAPWAP
Control and Provisioning of Wireless Access Points protocol, tunnels traffic.
Network Access: Connecting Devices
Local Mode
Default AP mode, serves clients and tunnels traffic to WLC.
Network Access: Connecting Devices
FlexConnect Mode
AP mode allowing local data switching when WLC is unreachable.
Network Access: Connecting Devices
SSID
Service Set Identifier, the name of a wireless network.
Network Access: Connecting Devices
WLAN Architectures, AP Modes & WLC GUI Overview
Think of a WLC as a 'Wireless LAndlord Controller' – it manages all the 'AP-artments' (APs), tells them what to do, and collects all the 'traffic-rent' (data) before sending it out.
Network Access: Connecting Devices
WLAN Architectures, AP Modes & WLC GUI Overview
On the exam, be ready to distinguish between autonomous and controller-based architectures. Keywords like 'centralized management' or 'seamless roaming' point to controller-based, while 'individual configuration' suggests autonomous. Memorize the primary function of CAPWAP.
Network Access: Connecting Devices
WLAN Architectures, AP Modes & WLC GUI Overview
Confusing autonomous APs with lightweight APs: Autonomous APs don't need a WLC, LAPs do.
Network Access: Connecting Devices
WLAN Architectures, AP Modes & WLC GUI Overview
Forgetting that CAPWAP is the protocol used for communication between LAPs and WLCs.
Network Access: Connecting Devices
WLAN Architectures, AP Modes & WLC GUI Overview
Not understanding that AP modes like Monitor or Sniffer do NOT serve wireless clients.
Network Access: Connecting Devices
Port Channel
The logical interface created by EtherChannel.
Network Access: Connecting Devices
IOS CLI: VLANs, Trunks, EtherChannel Configuration
VLANs, Trunks, EtherChannel: 'V-T-E' – 'Very Tough Exam' if you don't know these commands!
Network Access: Connecting Devices
IOS CLI: VLANs, Trunks, EtherChannel Configuration
The CCNA exam expects you to know the exact commands for configuring VLANs, 802.1Q trunks, and LACP EtherChannels. Pay close attention to 'switchport mode access', 'switchport mode trunk', 'switchport trunk encapsulation dot1q', and 'channel-group [number] mode active'.
Network Access: Connecting Devices
IOS CLI: VLANs, Trunks, EtherChannel Configuration
Forgetting to set 'switchport trunk encapsulation dot1q' before 'switchport mode trunk' on older switches (though newer ones often default to dot1q).
Network Access: Connecting Devices
IOS CLI: VLANs, Trunks, EtherChannel Configuration
Not configuring the Port Channel interface itself (e.g., as a trunk) after creating the channel group.
Network Access: Connecting Devices
IOS CLI: VLANs, Trunks, EtherChannel Configuration
Assigning an interface to a VLAN that doesn't exist, leading to the port being inactive or in a default state.
Network Access: Connecting Devices
Route Source
Indicates how a route was learned (e.g., Connected, Static, OSPF).
IP Connectivity: Routing Traffic
Destination Network
The IP network and subnet mask of the target network.
IP Connectivity: Routing Traffic
Next-Hop IP
The IP address of the next router in the path.
IP Connectivity: Routing Traffic
Exit Interface
The local interface used to forward a packet.
IP Connectivity: Routing Traffic
Longest Prefix Match
Rule: router chooses the most specific route (longest subnet mask).
IP Connectivity: Routing Traffic
Administrative Distance
Trustworthiness of a route source; lower is preferred.
IP Connectivity: Routing Traffic
Metric
Value used by routing protocols to determine best path.
IP Connectivity: Routing Traffic
Routing Table Components & Longest Prefix Match
Route Source, Destination, AD, Metric, Next-Hop, Exit Interface. Remember: 'RDAMNE' – Routing Decisions Are Made Next, Eventually!
IP Connectivity: Routing Traffic
Routing Table Components & Longest Prefix Match
The 'show ip route' command is your best friend for examining the routing table. Pay close attention to the codes (C, S, O, D, R, etc.) which indicate the route source, and always remember that the longest prefix match takes precedence over administrative distance.
IP Connectivity: Routing Traffic
Routing Table Components & Longest Prefix Match
Confusing administrative distance with metric: AD compares different route sources, while metric compares routes from the same source.
IP Connectivity: Routing Traffic
Routing Table Components & Longest Prefix Match
Forgetting that longest prefix match is evaluated *before* administrative distance.
IP Connectivity: Routing Traffic
Routing Table Components & Longest Prefix Match
Not understanding that a missing default route will cause packets to unknown destinations to be dropped.
IP Connectivity: Routing Traffic
Administrative Distance (AD)
A value (0-255) indicating route source trustworthiness; lower is better.
IP Connectivity: Routing Traffic
Static Route
A manually configured route entry in a router's routing table.
IP Connectivity: Routing Traffic
Default Route
A static route (0.0.0.0/0) used for destinations not explicitly known.
IP Connectivity: Routing Traffic
Floating Static Route
A static route with a higher AD, acting as a backup for a primary route.
IP Connectivity: Routing Traffic
Stub Network
A network with only one entry and exit point, often using static routes.
IP Connectivity: Routing Traffic
Administrative Distance & Static Routes (IPv4/IPv6)
AD: 'A'lways 'D'ecide with the 'D'irectly connected (0) first, then 'S'tatic (1), then 'E'IGRP (90), then 'O'SPF (110), then 'R'IP (120).
IP Connectivity: Routing Traffic
Administrative Distance & Static Routes (IPv4/IPv6)
Memorize the default AD values for directly connected (0), static (1), EIGRP (90), OSPF (110), and RIP (120). The exam frequently tests your understanding of how AD influences route selection, especially in scenarios involving multiple routing protocols or floating static routes.
IP Connectivity: Routing Traffic
Administrative Distance & Static Routes (IPv4/IPv6)
Forgetting to specify the subnet mask for IPv4 static routes, or prefix length for IPv6, leading to incorrect routing.
IP Connectivity: Routing Traffic
Administrative Distance & Static Routes (IPv4/IPv6)
Configuring a floating static route with an AD that is too low, making it preferred over the primary route instead of acting as a backup.
IP Connectivity: Routing Traffic
Administrative Distance & Static Routes (IPv4/IPv6)
Using an exit interface for a static route on a multi-access network (like Ethernet) without also specifying a next-hop IP, which can cause ARP issues.
IP Connectivity: Routing Traffic
OSPF
Open Shortest Path First, a link-state routing protocol.
IP Connectivity: Routing Traffic
Link-State
Routing protocol type that builds a full network topology map.
IP Connectivity: Routing Traffic
Router ID (RID)
A 32-bit value uniquely identifying an OSPF router.
IP Connectivity: Routing Traffic
LSA
Link-State Advertisement, used to share link-state information.
IP Connectivity: Routing Traffic
LSDB
Link-State Database, a router's complete topology map.
IP Connectivity: Routing Traffic
SPF Algorithm
Shortest Path First (Dijkstra's), calculates best paths.
IP Connectivity: Routing Traffic
Area 0
The backbone area in OSPF, all single-area routers belong here.
IP Connectivity: Routing Traffic
Wildcard Mask
Inverse of a subnet mask, used in OSPF network commands.
IP Connectivity: Routing Traffic
OSPFv2 Single Area Concepts & Configuration
OSPF: Oysters Serve Perfect Freshness. (Open Standard, SPF Algorithm, Process ID, Full Adjacency)
IP Connectivity: Routing Traffic
OSPFv2 Single Area Concepts & Configuration
The CCNA exam frequently tests OSPF Router ID selection. Remember, it's the highest active loopback IP, then highest active physical interface IP, or manually configured. Also, know that OSPF uses cost as its metric, and its default Administrative Distance is 110.
IP Connectivity: Routing Traffic
OSPFv2 Single Area Concepts & Configuration
Forgetting to specify the 'area' keyword in the network command, leading to interfaces not participating in OSPF.
IP Connectivity: Routing Traffic
OSPFv2 Single Area Concepts & Configuration
Using an incorrect wildcard mask, causing OSPF to advertise the wrong networks or not advertise any at all.
IP Connectivity: Routing Traffic
OSPFv2 Single Area Concepts & Configuration
Mismatched Hello/Dead intervals or Area IDs between neighbors, preventing adjacency formation.
IP Connectivity: Routing Traffic
Virtual IP Address
Shared IP address used as default gateway by end devices.
IP Connectivity: Routing Traffic
Virtual MAC Address
Shared MAC address associated with the virtual IP.
IP Connectivity: Routing Traffic
HSRP
Cisco proprietary FHRP, active/standby router roles.
IP Connectivity: Routing Traffic
VRRP
Open standard FHRP, similar to HSRP.
IP Connectivity: Routing Traffic
GLBP
Cisco proprietary FHRP, provides load balancing.
IP Connectivity: Routing Traffic
Active Router
Router currently forwarding traffic for the virtual IP.
IP Connectivity: Routing Traffic
Standby Router
Monitors active router, takes over if active fails.
IP Connectivity: Routing Traffic
Preemption
Allows higher-priority router to become active immediately.
IP Connectivity: Routing Traffic
First Hop Redundancy Protocols (FHRP)
HSRP: 'H' stands for 'Hot' and 'Hold' – Hot Standby, and it uses a Hold timer. VRRP: 'V' for 'Vendor-neutral' – it's an Open Standard.
IP Connectivity: Routing Traffic
First Hop Redundancy Protocols (FHRP)
The CCNA exam expects you to differentiate between HSRP, VRRP, and GLBP. Remember HSRP and GLBP are Cisco proprietary, while VRRP is an open standard. Also, know that GLBP uniquely offers load balancing across multiple active gateways.
IP Connectivity: Routing Traffic
First Hop Redundancy Protocols (FHRP)
Forgetting to enable preemption: A higher priority router won't take over as active if it comes online unless preemption is enabled.
IP Connectivity: Routing Traffic
First Hop Redundancy Protocols (FHRP)
Using different HSRP group numbers on routers for the same virtual IP: This prevents them from forming a single standby group.
IP Connectivity: Routing Traffic
First Hop Redundancy Protocols (FHRP)
Not configuring the virtual IP address on the correct interface: HSRP must be configured on the interface connected to the end devices' VLAN.
IP Connectivity: Routing Traffic
OSPFv2
Link-state routing protocol for IPv4, using areas.
IP Connectivity: Routing Traffic
Router ID
A unique 32-bit identifier for an OSPF router.
IP Connectivity: Routing Traffic
Adjacency
Relationship between OSPF neighbors for exchanging routing info.
IP Connectivity: Routing Traffic
IOS CLI: Static Routes, OSPFv2 Configuration & Verification
For OSPF 'N-A-R-D': Network, Area, Router-ID, Done! (Don't forget the process ID first!)
IP Connectivity: Routing Traffic
IOS CLI: Static Routes, OSPFv2 Configuration & Verification
The CCNA exam often includes output from 'show ip route' and expects you to identify static routes ('S') and OSPF routes ('O'), their administrative distances, and next-hop information. Be prepared to interpret these outputs.
IP Connectivity: Routing Traffic
IOS CLI: Static Routes, OSPFv2 Configuration & Verification
Forgetting the 'network' command's wildcard mask in OSPF, or using the subnet mask instead.
IP Connectivity: Routing Traffic
IOS CLI: Static Routes, OSPFv2 Configuration & Verification
Not verifying static routes with 'show ip route' after configuration, leading to traffic black holes.
IP Connectivity: Routing Traffic
IOS CLI: Static Routes, OSPFv2 Configuration & Verification
Mismatching OSPF area IDs between directly connected routers, preventing adjacency formation.
IP Connectivity: Routing Traffic
NAT
Network Address Translation; translates private IP addresses to public.
IP Services: Essential Network Functions
PAT
Port Address Translation; translates multiple private IPs to one public IP using ports.
IP Services: Essential Network Functions
Inside Local
Private IP address of a host on the internal network.
IP Services: Essential Network Functions
Inside Global
Public IP address of an internal host as seen by the outside.
IP Services: Essential Network Functions
Outside Global
Public IP address of a host on an external network.
IP Services: Essential Network Functions
NAT Pool
A range of public IP addresses used for dynamic NAT translations.
IP Services: Essential Network Functions
Overload
Keyword used in Cisco CLI to enable PAT (many-to-one translation).
IP Services: Essential Network Functions
Private IP
Non-routable IP addresses (e.g., 192.168.x.x) used within private networks.
IP Services: Essential Network Functions
NAT/PAT Concepts & Configuration
To remember the NAT types and their mappings: 'S'tatic is 'S'ingle, 'D'ynamic is 'D'iverse (from a pool), 'P'AT is 'P'lenty (many to one).
IP Services: Essential Network Functions
NAT/PAT Concepts & Configuration
The CCNA exam often tests your understanding of NAT terminology (inside local, inside global, outside global) and the specific commands for configuring PAT, especially the 'overload' keyword. Pay attention to which interface is 'inside' and 'outside'.
IP Services: Essential Network Functions
NAT/PAT Concepts & Configuration
Forgetting to configure `ip nat inside` and `ip nat outside` on the correct interfaces, leading to no translations.
IP Services: Essential Network Functions
NAT/PAT Concepts & Configuration
Incorrectly defining the access list for dynamic NAT or PAT, causing some internal IPs to not be translated.
IP Services: Essential Network Functions
NAT/PAT Concepts & Configuration
Confusing static NAT (1:1 fixed) with dynamic NAT (1:1 from pool) or PAT (many:1 using ports).
IP Services: Essential Network Functions
NTP
Network Time Protocol, synchronizes device clocks across a network.
IP Services: Essential Network Functions
Stratum
A hierarchical level in the NTP system indicating clock accuracy.
IP Services: Essential Network Functions
DHCP
Dynamic Host Configuration Protocol, assigns IP addresses automatically.
IP Services: Essential Network Functions
DORA
Discover, Offer, Request, Acknowledge; the DHCP lease process steps.
IP Services: Essential Network Functions
SNMP
Simple Network Management Protocol, monitors network devices.
IP Services: Essential Network Functions
NMS
Network Management System, a console for monitoring SNMP devices.
IP Services: Essential Network Functions
Community String
A password-like string used for authentication in SNMP.
IP Services: Essential Network Functions
NTP, DHCP, DNS & SNMP Fundamentals
DNS is like a phonebook for the internet: you look up a name to find a number.
IP Services: Essential Network Functions
NTP, DHCP, DNS & SNMP Fundamentals
For NTP, remember the stratum hierarchy and that 'ntp server' configures a client, while 'ntp master' makes a device a server. For DHCP, know the DORA process. For DNS, understand its role in name resolution. For SNMP, identify the three components (managed device, agent, NMS) and the purpose of community strings.
IP Services: Essential Network Functions
NTP, DHCP, DNS & SNMP Fundamentals
Forgetting to configure NTP on all critical devices, leading to inconsistent logs.
IP Services: Essential Network Functions
NTP, DHCP, DNS & SNMP Fundamentals
Not having enough IP addresses in a DHCP pool, causing new devices to fail to connect.
IP Services: Essential Network Functions
NTP, DHCP, DNS & SNMP Fundamentals
Misconfiguring DNS server addresses, leading to internet access issues.
IP Services: Essential Network Functions
NTP, DHCP, DNS & SNMP Fundamentals
Using default or weak SNMP community strings, creating security vulnerabilities.
IP Services: Essential Network Functions
Syslog
Protocol for collecting and sending event messages from network devices.
IP Services: Essential Network Functions
Severity Level
Indicates the importance/urgency of a Syslog message (e.g., error, warning).
IP Services: Essential Network Functions
Facility
Identifies the source process or application generating a Syslog message.
IP Services: Essential Network Functions
QoS
Quality of Service; prioritizes network traffic to ensure performance.
IP Services: Essential Network Functions
Classification
Identifying specific types of traffic for QoS treatment.
IP Services: Essential Network Functions
SSH
Secure Shell; encrypted network protocol for secure remote access.
IP Services: Essential Network Functions
Telnet
Insecure protocol for remote access, transmits data in plain text.
IP Services: Essential Network Functions
RSA Keys
Cryptographic keys used by SSH for secure authentication and encryption.
IP Services: Essential Network Functions
Syslog, QoS Basics & Secure Shell (SSH)
SSH is 'Secure SHell', so remember it's the SECURE way to access your devices, unlike Telnet, which just 'Tells Net' everything in plain text.
IP Services: Essential Network Functions
Syslog, QoS Basics & Secure Shell (SSH)
The exam expects you to know the purpose of Syslog, basic QoS concepts (classification, queuing), and how to configure and verify SSH. Remember that Telnet is insecure and SSH is preferred. Be prepared for commands like `crypto key generate rsa` and `transport input ssh`.
IP Services: Essential Network Functions
Syslog, QoS Basics & Secure Shell (SSH)
Using Telnet instead of SSH for remote management, exposing sensitive credentials.
IP Services: Essential Network Functions
Syslog, QoS Basics & Secure Shell (SSH)
Not configuring a domain name or hostname before generating RSA keys for SSH.
IP Services: Essential Network Functions
Syslog, QoS Basics & Secure Shell (SSH)
Ignoring Syslog messages until a problem occurs, missing early warning signs.
IP Services: Essential Network Functions
TFTP
Trivial File Transfer Protocol, UDP port 69, simple, no authentication.
IP Services: Essential Network Functions
FTP
File Transfer Protocol, TCP ports 20/21, authentication, reliable.
IP Services: Essential Network Functions
Control Channel
FTP's dedicated TCP connection (port 21) for commands and responses.
IP Services: Essential Network Functions
Data Channel
FTP's connection (port 20 or dynamic) for actual file transfer.
IP Services: Essential Network Functions
IOS Image
The operating system software for Cisco routers and switches.
IP Services: Essential Network Functions
TFTP/FTP for Device Management & File Transfer
To 'T'ransfer 'F'iles 'T'rivially, use 'TFTP' on 'U'DP '69'. For 'F'ull 'T'ransfer 'P'ower, use 'FTP' on 'T'CP '20' and '21'.
IP Services: Essential Network Functions
TFTP/FTP for Device Management & File Transfer
Memorize the port numbers: TFTP uses UDP 69, FTP uses TCP 20 (data) and 21 (control). The exam often tests these specific details.
IP Services: Essential Network Functions
TFTP/FTP for Device Management & File Transfer
Using TFTP for sensitive files over an untrusted network, exposing data.
IP Services: Essential Network Functions
TFTP/FTP for Device Management & File Transfer
Forgetting that FTP sends credentials in plaintext, making it vulnerable to sniffing.
IP Services: Essential Network Functions
TFTP/FTP for Device Management & File Transfer
Confusing TCP and UDP port numbers for these protocols.
IP Services: Essential Network Functions
ACL (Access Control List)
A sequential list of permit/deny statements for traffic filtering.
Security Fundamentals: Protecting the Network
ACE (Access Control Entry)
An individual permit or deny statement within an ACL.
Security Fundamentals: Protecting the Network
Standard ACL
Filters traffic based only on source IP address (1-99, 1300-1999).
Security Fundamentals: Protecting the Network
Extended ACL
Filters based on source/destination IP, protocol, and port (100-199, 2000-2699).
Security Fundamentals: Protecting the Network
Implicit Deny
An invisible 'deny any any' at the end of every ACL.
Security Fundamentals: Protecting the Network
Named ACL
ACL identified by a descriptive name instead of a number.
Security Fundamentals: Protecting the Network
Access Control Lists (ACLs) for Traffic Filtering
SOURce (Standard) is near the DESTination. EXTended is near the SOURce. 'S-D, E-S' – like saying 'SD card, ESports'.
Security Fundamentals: Protecting the Network
Access Control Lists (ACLs) for Traffic Filtering
The exam expects you to know the difference between standard and extended ACLs, including their numbering ranges and placement recommendations. You must also understand the 'implicit deny' rule and how ACLs are processed sequentially. Be ready to interpret simple ACL configurations.
Security Fundamentals: Protecting the Network
Access Control Lists (ACLs) for Traffic Filtering
Forgetting the implicit deny: If you don't explicitly permit desired traffic, it will be blocked.
Security Fundamentals: Protecting the Network
Access Control Lists (ACLs) for Traffic Filtering
Incorrect ACE order: The first match wins, so specific rules must come before general rules.
Security Fundamentals: Protecting the Network
Access Control Lists (ACLs) for Traffic Filtering
Applying an ACL to the wrong interface or direction (inbound/outbound), leading to unexpected blocking.
Security Fundamentals: Protecting the Network
Port Security
Limits MAC addresses on a switch port to prevent unauthorized access.
Security Fundamentals: Protecting the Network
Violation Mode
Action taken by Port Security when an unauthorized MAC is detected.
Security Fundamentals: Protecting the Network
Sticky MAC
Learned MAC addresses saved in configuration, persistent across reboots.
Security Fundamentals: Protecting the Network
DHCP Snooping
Prevents rogue DHCP servers and DHCP starvation attacks.
Security Fundamentals: Protecting the Network
Trusted Port
Allows all DHCP messages; connects to legitimate DHCP servers/switches.
Security Fundamentals: Protecting the Network
Untrusted Port
Filters DHCP messages; connects to end-user devices.
Security Fundamentals: Protecting the Network
DHCP Snooping Binding Database
Table of valid IP-to-MAC mappings built by DHCP Snooping.
Security Fundamentals: Protecting the Network
Dynamic ARP Inspection (DAI)
Prevents ARP spoofing by validating ARP packets against the binding database.
Security Fundamentals: Protecting the Network
Port Security, DHCP Snooping & Dynamic ARP Inspection
Think of 'P-D-D' for 'Protect Devices Daily': Port Security, DHCP Snooping, Dynamic ARP Inspection – your daily network protection trio!
Security Fundamentals: Protecting the Network
Port Security, DHCP Snooping & Dynamic ARP Inspection
The CCNA exam frequently tests your understanding of the interaction between DHCP Snooping and DAI. Remember that DAI relies on the DHCP snooping binding database to function correctly, so DHCP Snooping must be enabled first.
Security Fundamentals: Protecting the Network
Port Security, DHCP Snooping & Dynamic ARP Inspection
Forgetting to enable DHCP Snooping globally and on specific VLANs before configuring DAI, leading to DAI not functioning correctly.
Security Fundamentals: Protecting the Network
Port Security, DHCP Snooping & Dynamic ARP Inspection
Configuring a port connected to a legitimate DHCP server or another switch as 'untrusted' for DHCP Snooping or DAI, causing legitimate traffic to be dropped.
Security Fundamentals: Protecting the Network
Port Security, DHCP Snooping & Dynamic ARP Inspection
Not saving Port Security sticky MAC addresses to the startup configuration, resulting in lost learned addresses after a reboot.
Security Fundamentals: Protecting the Network
Authentication
Verifying the identity of a user or device.
Security Fundamentals: Protecting the Network
Authorization
Determining what resources an authenticated user can access.
Security Fundamentals: Protecting the Network
Accounting
Tracking user activity for auditing or billing purposes.
Security Fundamentals: Protecting the Network
VPN
A secure, encrypted connection over a public network.
Security Fundamentals: Protecting the Network
IPSec
Suite of protocols providing secure IP communication.
Security Fundamentals: Protecting the Network
RADIUS
Centralized AAA protocol, often for network access.
Security Fundamentals: Protecting the Network
TACACS+
Cisco proprietary AAA protocol, often for device administration.
Security Fundamentals: Protecting the Network
AAA Concepts, WPA2/WPA3 & VPN Principles
AAA: 'Always Authenticate, Always Authorize, Always Account' for security!
Security Fundamentals: Protecting the Network
AAA Concepts, WPA2/WPA3 & VPN Principles
The CCNA exam expects you to differentiate between RADIUS and TACACS+ (e.g., RADIUS combines Auth/Auth, TACACS+ separates; TACACS+ is Cisco proprietary). Also, know the key improvements of WPA3 over WPA2, especially SAE and OWE.
Security Fundamentals: Protecting the Network
AAA Concepts, WPA2/WPA3 & VPN Principles
Confusing the roles of Authentication and Authorization; they are distinct steps in the security process.
Security Fundamentals: Protecting the Network
AAA Concepts, WPA2/WPA3 & VPN Principles
Assuming WPA2 is sufficient for all modern wireless security needs; WPA3 offers significant improvements.
Security Fundamentals: Protecting the Network
AAA Concepts, WPA2/WPA3 & VPN Principles
Believing a VPN makes you completely anonymous online; it primarily secures the connection to the VPN endpoint, not necessarily your entire internet activity beyond that point.
Security Fundamentals: Protecting the Network
Enable Secret
A highly secure, MD5-encrypted password for privileged EXEC mode.
Security Fundamentals: Protecting the Network
Console Password
Password required for direct physical access via the console port.
Security Fundamentals: Protecting the Network
VTY Password
Password for remote access (Telnet/SSH) via Virtual Terminal lines.
Security Fundamentals: Protecting the Network
Service Password-Encryption
IOS command to encrypt all plain-text passwords in the configuration.
Security Fundamentals: Protecting the Network
Device Hardening
Process of securing a system by reducing its attack surface.
Security Fundamentals: Protecting the Network
Banner MOTD
Message Of The Day, displayed to users upon login, often for warnings.
Security Fundamentals: Protecting the Network
Password Security & Device Hardening
P.A.S.S.W.O.R.D.S. for Device Hardening: P-Passwords (strong), A-Authentication (local users), S-SSH (prefer over Telnet), S-Services (disable unused), W-Warnings (banners), O-Obfuscate (encrypt passwords), R-Recovery (backups), D-Disable (unused ports), S-Synchronize (NTP).
Security Fundamentals: Protecting the Network
Password Security & Device Hardening
The CCNA exam expects you to know the difference between 'enable password' (weak, plain-text or easily reversible encryption) and 'enable secret' (strong, MD5-encrypted). Always choose 'enable secret' for privileged EXEC access. Also, remember 'service password-encryption' only encrypts plain-text passwords in the running-config, it doesn't strengthen the encryption of 'enable secret'.
Security Fundamentals: Protecting the Network
Password Security & Device Hardening
Using 'enable password' instead of 'enable secret' for privileged EXEC mode, leaving it vulnerable.
Security Fundamentals: Protecting the Network
Password Security & Device Hardening
Forgetting to use 'service password-encryption' to encrypt plain-text passwords in the configuration.
Security Fundamentals: Protecting the Network
Password Security & Device Hardening
Leaving Telnet enabled for remote access when SSH is available, exposing traffic to eavesdropping.
Security Fundamentals: Protecting the Network
Shutdown Mode
Port security action that disables the interface.
Security Fundamentals: Protecting the Network
IOS CLI: ACLs & Port Security Configuration
ACLs: 'S'ource for Standard, 'E'verything for Extended. Standard 'S'hould be 'S'low (close to destination), Extended 'E'arly (close to source).
Security Fundamentals: Protecting the Network
IOS CLI: ACLs & Port Security Configuration
Memorize the ACL numbering ranges: Standard (1-99, 1300-1999) and Extended (100-199, 2000-2699). Understand the difference between 'in' and 'out' application on interfaces and the implications of placing standard vs. extended ACLs.
Security Fundamentals: Protecting the Network
IOS CLI: ACLs & Port Security Configuration
Forgetting the implicit 'deny any' at the end of every ACL, leading to unexpected traffic drops.
Security Fundamentals: Protecting the Network
IOS CLI: ACLs & Port Security Configuration
Applying an ACL to the wrong interface or in the wrong direction (in/out), causing connectivity issues.
Security Fundamentals: Protecting the Network
IOS CLI: ACLs & Port Security Configuration
Using 'shutdown' violation mode on a production port without an err-disable recovery timer, requiring manual intervention to restore service.
Security Fundamentals: Protecting the Network
SDN
Software-Defined Networking; separates control from data plane.
Automation & Programmability: Modern Networking
Control Plane
Makes decisions about how traffic should be forwarded.
Automation & Programmability: Modern Networking
Data Plane
Forwards packets based on control plane decisions.
Automation & Programmability: Modern Networking
SDN Controller
Centralized software managing network devices.
Automation & Programmability: Modern Networking
Northbound API
Interface for applications to communicate with the controller.
Automation & Programmability: Modern Networking
Southbound API
Interface for the controller to communicate with devices.
Automation & Programmability: Modern Networking
OpenFlow
A common southbound protocol for SDN.
Automation & Programmability: Modern Networking
Controller-Based Networking & SDN Architectures
Think of an 'SDN' like a 'Smart Driving Network'. The 'Controller' is the GPS, telling all the cars (data plane devices) where to go, while the 'Apps' (Northbound) tell the GPS where you want to go. The 'Roads' (Southbound) are how the GPS talks to the cars.
Automation & Programmability: Modern Networking
Controller-Based Networking & SDN Architectures
The CCNA exam expects you to understand the fundamental concept of separating the control plane from the data plane, and the roles of the SDN controller, northbound, and southbound APIs. Look for questions that describe centralized network management or automated policy enforcement.
Automation & Programmability: Modern Networking
Controller-Based Networking & SDN Architectures
Confusing the data plane (forwarding traffic) with the control plane (making forwarding decisions).
Automation & Programmability: Modern Networking
Controller-Based Networking & SDN Architectures
Thinking SDN replaces all traditional networking devices; it orchestrates them.
Automation & Programmability: Modern Networking
Controller-Based Networking & SDN Architectures
Believing OpenFlow is the ONLY southbound protocol; it's just a common example.
Automation & Programmability: Modern Networking
REST API
Rules for software to communicate over HTTP, enabling programmatic interaction.
Automation & Programmability: Modern Networking
JSON
Lightweight, human-readable data format for exchanging structured data.
Automation & Programmability: Modern Networking
HTTP Methods
Actions (GET, POST, PUT, DELETE) performed on resources via REST API.
Automation & Programmability: Modern Networking
Key-Value Pair
Fundamental JSON data structure, associating a name with a value.
Automation & Programmability: Modern Networking
Network Automation
Using software to manage and configure network devices.
Automation & Programmability: Modern Networking
Orchestration
Automating complex workflows across multiple network domains/devices.
Automation & Programmability: Modern Networking
Resource
An object or data entity managed by a REST API (e.g., interface).
Automation & Programmability: Modern Networking
REST APIs, JSON, and Network Automation Tools
JSON is Just Some Object Notation – it's simple, like a shopping list: 'item': 'milk', 'quantity': 2. REST is like a Restaurant: you GET food, POST orders, PUT changes, DELETE mistakes.
Automation & Programmability: Modern Networking
REST APIs, JSON, and Network Automation Tools
The CCNA exam expects you to recognize the purpose of REST APIs for programmatic interaction and JSON as a data encoding format. Focus on 'GET' for retrieving data and 'POST'/'PUT' for sending configuration, and understand JSON's key-value pair and array structure.
Automation & Programmability: Modern Networking
REST APIs, JSON, and Network Automation Tools
Confusing JSON syntax with Python dictionaries; while similar, they have distinct rules (e.g., JSON requires double quotes for keys and string values).
Automation & Programmability: Modern Networking
REST APIs, JSON, and Network Automation Tools
Assuming all network devices support REST APIs; older or simpler devices may only support CLI or SNMP.
Automation & Programmability: Modern Networking
REST APIs, JSON, and Network Automation Tools
Not understanding HTTP methods: Using a POST request when a GET is appropriate, leading to errors or unintended configuration changes.
Automation & Programmability: Modern Networking
Ansible
Open-source automation engine for configuration management and application deployment.
Automation & Programmability: Modern Networking
Playbook
YAML file in Ansible that defines a set of tasks to be executed.
Automation & Programmability: Modern Networking