CompTIA Network+ (N10-009) flashcards

Logical diagrams show IP addressing, VLANs, and data flow; physical diagrams show actual cabling, device locations, and hardware layout.

• Logical = 'how data moves'
• Physical = 'where hardware sits'
• Both are essential parts of network documentation

Memory trick: Logical = Layout of Logic; Physical = Placement of Ports.

A VPN configuration that allows an individual remote device to establish an encrypted tunnel into a private network, granting secure access to internal resources.

• Also called remote-access VPN
• Commonly uses IPsec or SSL/TLS
• Differs from site-to-site VPN, which connects entire networks

Memory trick: One laptop, one tunnel — client-to-site is a private lane home to the office.

A network appliance that distributes client requests across multiple servers to improve performance, availability, and fault tolerance.

• Uses algorithms like round robin or least connections
• Can perform health checks on backend servers
• Improves scalability and redundancy

Memory trick: Balance the load like a scale across servers

A Windows fallback mechanism that assigns an address in the 169.254.0.0/16 range when a DHCP server cannot be reached.

• APIPA addresses cannot route beyond the local subnet
• Common causes: DHCP server down, scope exhausted, or network cable/link issue
• Devices with existing valid leases are unaffected until they need renewal

Memory trick: 169 means 'I couldn't reach the DHCP guy'

A data center network architecture where leaf switches (connected to servers) each connect to every spine switch, providing predictable, low-latency east-west traffic paths.

• Two-tier design: spine and leaf switches
• Every leaf connects to every spine
• Optimized for east-west (server-to-server) traffic in data centers

Memory trick: Spine-leaf: 'leaves reach every branch of the spine, never each other'.

A break in a cable's conductor that prevents electrical continuity, often caused by poor termination or physical damage.

• Cable testers detect opens by checking continuity per pin
• Common causes: bad crimp, cut wire, corrosion
• Results in no link light or intermittent connection

Memory trick: Open means broken, Short means touching, Split means swapped

Network Time Protocol synchronizes clocks across devices and uses UDP port 123 for its communication.

• UDP port 123 is the standard NTP port
• NTP uses a hierarchical stratum system for time source accuracy
• Blocking UDP 123 on firewalls prevents time sync, causing certificate and log timestamp issues

Memory trick: NTP ticks on UDP 123 — one-two-three, sync with me.

Switches operate at the Data Link layer, using MAC address tables to forward frames only out the port where the destination device resides.

• Switches build a MAC address table by learning source addresses
• Unknown destination MACs are flooded out all ports except the source
• Layer 2 devices do not read IP addresses

Memory trick: Please Do Not Throw Sausage Pizza Away

A DNS resource record that specifies the hostname, port number, priority, and weight for a specific service, enabling automatic service discovery.

• Format includes service, protocol, priority, weight, port, target
• Commonly used for SIP, LDAP, and Active Directory service discovery
• Differs from MX, which only handles mail routing

Memory trick: SRV = Service Reveals Vitals (host, port, priority).

A switch security feature that validates ARP packets against a trusted DHCP snooping database to prevent ARP spoofing/poisoning attacks.

• Relies on DHCP snooping binding table for validation
• Drops ARP packets with mismatched IP-to-MAC bindings
• Configured per VLAN on Layer 2/3 switches

Memory trick: DAI checks the ARP ID card before letting it in.

TIA/EIA standards limit UTP horizontal cabling to 100 meters total (90m permanent link + 10m patch cords) regardless of category rating, due to attenuation.

• 100m max total for copper Ethernet runs
• Beyond this, attenuation causes signal loss
• Solutions: fiber, repeaters, or switches placed closer

Memory trick: 100 meters is the copper ceiling — go further, lose the signal.

A system or tool used to plan, track, and manage IP address allocation, DHCP scopes, and DNS records across an organization's network.

• Prevents IP conflicts and scope exhaustion
• Often integrates with DHCP and DNS servers
• Provides audit trail of address assignments

Memory trick: IPAM keeps your IPs in an organized AM (address map).

Effective Isotropic Radiated Power is the total power radiated in the direction of maximum antenna gain, calculated as transmitter power plus antenna gain minus cable/connector losses (in dB/dBm).

• Formula: EIRP = TX Power (dBm) + Antenna Gain (dBi) − Cable Loss (dB)
• dB values are additive/subtractive, not multiplicative
• Regulatory bodies often cap maximum allowed EIRP

Memory trick: Power in, gain adds, loss subtracts — EIRP is the final signal strength.

A routing table entry (0.0.0.0/0 for IPv4) that matches any destination not covered by a more specific route, typically pointing to an upstream gateway.

• Written as 0.0.0.0/0 in IPv4 and ::/0 in IPv6
• Used when a router has no specific route to a destination
• Common on edge routers connecting to an ISP

Memory trick: 'Default' = the road you take when no other road is signposted.

An nmap scan option that fingerprints a target's operating system by analyzing characteristic TCP/IP stack responses.

• -O relies on TTL, window size, and TCP option ordering.
• Requires at least one open and one closed port for best accuracy.
• Different from -sV, which detects application/service versions.

Memory trick: 'O is for Operating system.'

The point where a telecommunications provider's network ends and the customer's internal wiring begins, marking a change in ownership and troubleshooting responsibility.

• Often located in a utility closet or basement
• May include a smartjack (NIU) for testing
• Customer is responsible for cabling beyond this point

Memory trick: Demarc = the doorway between 'their' network and 'yours'.

East-west traffic is data communication that flows laterally between servers or devices within the same data center, distinct from north-south traffic entering/exiting the data center.

• Common in spine-leaf architectures optimized for east-west flow
• Contrasts with north-south (client-to-server) traffic
• High east-west volume drives designs like spine-leaf fabrics

Memory trick: East-west stays inside the map; north-south crosses the border.

The number of subnets created when subdividing a larger IPv6 prefix into smaller fixed-size prefixes equals 2 raised to the power of the bit difference between the two prefix lengths.

• Formula: 2^(new prefix - original prefix)
• /64 is the standard subnet size for IPv6 LANs
• No need to subtract network/broadcast addresses like IPv4

Memory trick: Borrow 4 bits, get 16 slots — 2^4 always equals 16.

PaaS provides a managed platform including OS, runtime, and middleware so developers can build and deploy applications without managing infrastructure.

• Examples: Heroku, Google App Engine, Azure App Service
• Customer manages code and data only
• Vendor manages OS, runtime, and middleware

Memory trick: IaaS = bricks, PaaS = the built house, SaaS = furnished apartment.

An IPS is an inline device that actively blocks malicious traffic, while an IDS is a passive device that only detects and alerts on suspicious activity.

• IPS = inline, active blocking
• IDS = out-of-band, passive alerting
• Both use signature/anomaly detection

Memory trick: IDS = 'I Detect and Signal', IPS = 'I Prevent and Stop'.

Availability measures the proportion of time a system is operational, calculated as MTBF divided by the sum of MTBF and MTTR.

• Formula: Availability = MTBF / (MTBF + MTTR)
• MTBF = average time between failures; MTTR = average repair time
• Higher MTBF and lower MTTR both increase availability

Memory trick: Availability = Uptime over Uptime-plus-fix-time.

DNS resolvers cache records for a duration defined by Time To Live (TTL) to reduce lookups; stale caches cause outdated resolution after changes.

• TTL determines how long a resolver caches a DNS record before requerying
• Lowering TTL before a planned change speeds up propagation
• dig or nslookup can be used to verify current authoritative record values

Memory trick: Old TTL means old IP sticks around

A pre-deployment assessment of a physical space to measure RF signal strength, interference, and coverage, used to determine optimal access point placement.

• Produces a heat map of coverage
• Identifies interference sources and dead zones
• Should be repeated after major layout changes

Memory trick: Survey the site before you site the survey equipment... err, before installing APs!

A switch feature that limits the number of MAC addresses allowed on a port and can dynamically learn and store them as 'sticky' entries.

• Max MAC count can be set (e.g., 1)
• Violation modes: protect, restrict, shutdown
• Shutdown mode err-disables the port on violation

Memory trick: One port, one MAC—break the rule and the port goes dark.

A cloud model where a provider delivers a complete application to end users over the internet, handling all underlying infrastructure and maintenance.

• Examples: webmail, Office 365, Salesforce
• Customer manages only user-level configuration
• Contrasts with IaaS (infrastructure) and PaaS (platform)

Memory trick: IaaS=bricks, PaaS=kitchen, SaaS=finished meal

A Cisco-developed AAA protocol that fully encrypts authentication traffic and separates authentication, authorization, and accounting, commonly used for granular administrative control of network devices.

• Uses TCP port 49
• Encrypts the entire packet, not just the password
• Allows per-command authorization for device administration

Memory trick: TACACS+ Tackles All Commands Carefully, Separately.

NTP synchronizes device clocks across a network to ensure consistent timestamps for logging and troubleshooting.

• Uses UDP port 123
• Critical for accurate log correlation
• Hierarchical stratum levels define time source accuracy

Memory trick: NTP keeps every clock ticking in tune.

sFlow is an open, vendor-neutral standard that captures statistically sampled packets at the interface level, while NetFlow (Cisco-originated) exports complete flow records from the control plane.

• sFlow = packet sampling, lightweight, vendor-neutral
• NetFlow = full flow export, Cisco proprietary origin
• sFlow commonly found on lower-cost/multi-vendor switches

Memory trick: sFlow samples a slice; NetFlow captures the full flow.

An attack where forged ARP replies associate the attacker's MAC address with a legitimate IP (often the gateway), redirecting traffic through the attacker for interception.

• Exploits ARP's lack of authentication
• Enables on-path/man-in-the-middle attacks
• Mitigated by Dynamic ARP Inspection and static ARP entries

Memory trick: Lie about who owns the gateway's IP.

OSPF assigns a cost to each interface based on reference bandwidth divided by interface bandwidth; the total path cost is the sum of all outgoing interface costs along the route.

• Default reference bandwidth is 100Mbps (10^8)
• Formula: cost = reference bandwidth / interface bandwidth
• Minimum cost value is 1, even for very fast links

Memory trick: Slower links cost more—OSPF favors the fast lane.

Remote Desktop Protocol provides graphical remote access to Windows systems and uses TCP port 3389 by default.

• RDP is Microsoft's proprietary remote access protocol
• Default port is TCP 3389
• VNC (port 5900) is a cross-platform alternative

Memory trick: RDP = '33-89'... remember the 'Remote Desk-Port'.

The Network layer is responsible for logical addressing and routing packets between different networks using IP addresses.

• Routers operate at Layer 3
• Uses IP addresses for logical addressing
• Handles path determination and forwarding decisions

Memory trick: 'Please Do Not Throw Sausage Pizza Away' - Layer 3 is Network, home of routing.

A BGP path attribute used within an AS to indicate the preferred exit point for outbound traffic; higher values are preferred and it is exchanged only via iBGP.

• Higher LOCAL_PREF wins
• Evaluated early in BGP best path algorithm (after Weight)
• Only propagated within the AS via iBGP, not to eBGP peers

Memory trick: Higher LOCAL_PREF, higher priority for the exit door.

Spanning Tree Protocol elects the root bridge by comparing Bridge IDs, which consist of a priority value and the switch's MAC address; the lowest Bridge ID wins.

• Default priority is 32768 on most switches
• Tie-breaker is lowest MAC address
• Root bridge becomes the reference point for the loop-free tree

Memory trick: Lowest Bridge ID wins—like golf, low score takes the crown.

A router feature that forwards DHCP broadcast messages from clients on one subnet to a DHCP server on a different subnet by converting them to unicast.

• Needed because DHCP discovery is a Layer 2 broadcast
• Configured on the router interface facing the client subnet
• Also called 'ip helper-address' in Cisco IOS

Memory trick: Broadcasts can't cross bridges — relay 'helps' them over.

A hardened server that serves as the single controlled entry point for administrators to access an isolated or sensitive network segment, enabling centralized authentication and logging.

• Reduces attack surface by limiting direct access to internal devices
• All administrative sessions pass through and are logged at the jump box
• Commonly used to access management VLANs or DMZs securely

Memory trick: Jump box = the drawbridge into the castle's inner keep.

An IPv6 address automatically assigned to an interface, beginning with the prefix FE80::/10, used only for communication within the same local network segment and never routed.

• Automatically generated via SLAAC even without a router
• Required on every IPv6-enabled interface
• Never forwarded by routers to other networks

Memory trick: FE80 stays at home, never leaves the local link

A DNS resource record that maps a fully qualified domain name to an IPv6 address.

• Analogous to the A record but for IPv6
• 'Quad-A' name comes from IPv6's 128-bit length vs IPv4's 32-bit
• Required for native IPv6 forward name resolution

Memory trick: Quad-A for the quadrupled address length of IPv6.

Kerberos authentication fails if the client and server system clocks differ by more than the configured tolerance (default 5 minutes), since timestamps are used to prevent replay attacks.

• Default max clock skew tolerance is 5 minutes.
• NTP synchronization keeps domain member clocks aligned.
• Symptoms include login failures with explicit clock-skew error messages.

Memory trick: 'No ticket if your watch is off by too much.'

The Transport layer manages end-to-end communication, segmentation, flow control, and reliability using protocols like TCP and UDP.

• TCP provides reliable, connection-oriented delivery
• UDP provides connectionless, best-effort delivery
• Port numbers operate at this layer to identify applications

Memory trick: 'TCP takes care of packets' — Transport ensures reliable delivery.

A wildcard mask is the inverse of a subnet mask, used in ACLs and routing protocols to specify which bits must match and which are ignored.

• Wildcard mask = 255.255.255.255 minus subnet mask
• 0 bits mean 'must match', 1 bits mean 'don't care'
• Number of covered addresses = 2^(number of 1-bits) in the wildcard octet

Memory trick: Wildcard is the subnet mask's evil twin — flip the bits to find the range.

A misconfigured IP address that tells a device where to send traffic destined for networks outside its local subnet.

• Prevents communication with any external networks.
• Symptoms: 'Destination Host Unreachable' for external IPs, `traceroute` failing at first hop.
• Verify by checking IP configuration on the client device.

Memory trick: Can't leave the block? Check the 'exit ramp' (gateway).

Occurs when two connected network devices fail to agree on the highest common supported speed and duplex mode, often defaulting to a lower speed or half-duplex.

• Can be caused by faulty cables, incompatible hardware, or misconfigured ports.
• Results in reduced throughput and performance issues.
• Troubleshoot by checking cables, port settings, and device compatibility.

Memory trick: Speed mismatch? Check the 'chain' for a weak link.

A standardized 0–7 numeric scale used by syslog to indicate the severity of a logged event, with 0 being most severe.

• 0=Emergency,1=Alert,2=Critical,3=Error
• 4=Warning,5=Notice,6=Informational,7=Debug
• Lower numbers indicate greater severity

Memory trick: 'Every Awesome Cat Eats Warm Noodles In Dark' = Emergency,Alert,Critical,Error,Warning,Notice,Info,Debug.

The variation in delay between packets arriving at their destination, which is especially disruptive to real-time traffic like voice and video.

• Measured in milliseconds; VoIP typically tolerates jitter under 30ms
• Caused by network congestion, route changes, or queuing delays
• Mitigated with QoS, jitter buffers, and traffic prioritization

Memory trick: Jitter is packets arriving 'jittery' — uneven spacing scrambles smooth audio.

Facility codes in syslog classify the source or category of a log message (e.g., kernel, mail, security), separate from the severity level.

• Facility 0 = kernel, 2 = mail, 4 = security/authorization
• Local facilities range 16-23 (local0-local7)
• Facility and severity together form the syslog message header

Memory trick: Facility tells WHO sent it; severity tells HOW BAD it is.

A point in the network where the data flow is restricted, typically due to limited bandwidth, high utilization, or slow device processing.

• Identified by high utilization on a specific network component (e.g., NIC, switch port).
• Causes slow performance and increased latency.
• Resolution often involves upgrading hardware, increasing bandwidth, or optimizing traffic.

Memory trick: Slow performance? Look for the 'choke point' in the system.

Anycast is an addressing method where multiple servers share the same IP address, and routing directs traffic to the nearest or best-performing instance.

• Multiple servers share one IP address
• Routing protocols select nearest instance
• Used by CDNs and DNS root server infrastructure

Memory trick: Anycast = 'Any nearby server will do' - closest wins.

WPA3's Simultaneous Authentication of Equals replaces WPA2's PSK handshake, using a secure key exchange that resists offline dictionary attacks even if the exchange is captured.

• Also called the 'Dragonfly' handshake
• Provides forward secrecy unlike WPA2-PSK
• Resistant to offline brute-force even with captured traffic

Memory trick: SAE says: even if you catch it, you can't crack it.

The process of forwarding network traffic between different VLANs using a Layer 3 device, typically a router or a Layer 3 switch.

• Each VLAN needs a unique IP subnet and a default gateway.
• Router or Layer 3 switch must have an interface/subinterface in each VLAN.
• Essential for communication between logically segmented networks.

Memory trick: VLANs are like rooms; a 'door' (router) is needed to go between them.

IEEE 802.3ad standard protocol that combines multiple physical network links into a single logical link, increasing bandwidth and providing redundancy.

• Also called EtherChannel (Cisco) or port channel
• Requires matching speed/duplex on all bundled ports
• Provides both increased throughput and failover

Memory trick: 'Many links become one'—LACP bundles the bandwidth.

An isolated decoy system designed to appear vulnerable, used to attract attackers so their techniques can be observed and studied without risking production assets.

• Deployed on its own isolated segment
• Populated with fake data and vulnerable-looking services
• A group of honeypots forms a honeynet

Memory trick: Sweet decoy traps the bee (attacker).

Cabling with a fire-resistant, low-smoke jacket required for installation in plenum spaces (air ducts/return-air spaces) per fire code.

• Plenum spaces circulate breathable air
• PVC cable is prohibited there due to toxic smoke
• Plenum cable costs more but is code-required

Memory trick: Plenum air, plenum cable — no toxic smoke allowed.

A network issue where traffic can flow successfully in one direction between two points, but not in the reverse direction.

• Often caused by firewalls or ACLs with unidirectional rules.
• Can also result from asymmetric routing paths with stateful inspection.
• Troubleshooting involves checking device configurations in both directions.

Memory trick: One-way street for data, often a 'guard' at the gate.

A proxy server acts as an intermediary between clients and external servers, forwarding requests, caching content, and enforcing filtering policies while masking client IP addresses.

• Hides internal client IP addresses from external servers
• Can cache frequently requested content to save bandwidth
• Often used for content filtering and access control policies

Memory trick: A proxy is a 'stand-in actor' making requests on your behalf.

A DNS record type that identifies the mail server(s) responsible for receiving email for a domain, along with a priority preference value.

• Lower priority number = higher preference
• Points to a hostname, which must resolve via an A/AAAA record
• Multiple MX records provide mail server redundancy

Memory trick: MX = Mail eXchange — think 'M' for Mail.

A small form-factor fiber optic connector commonly paired with SFP/SFP+ transceivers for high port density.

• Smaller than SC and ST connectors
• Snap-in latch design
• Standard for modern SFP-based fiber links

Memory trick: 'LC' = Little Connector fits Little SFP slots.

Bandwidth is the theoretical maximum data rate of a link, while throughput is the actual measured rate achieved, which is typically lower due to overhead.

• Formula: Throughput = (file size in bits) / (time in seconds)
• 1 byte = 8 bits, so convert MB to Mb before dividing
• Throughput close to but below rated bandwidth is normal and expected

Memory trick: Multiply by 8 to go from bytes to bits, then divide by time to get real speed.

A type of distributed denial-of-service (DDoS) attack in which an attacker floods a target server with ICMP echo replies.

• Uses ICMP echo requests (ping) to broadcast addresses.
• Victim's IP address is spoofed as the source address.
• Amplifies traffic as all hosts on the network reply to the victim.

Memory trick: Smurfs make a big noise with tiny pings.

A network diagram that illustrates the tangible layout of network devices, including their physical locations, the type and length of cables connecting them, and their arrangement within racks or cabinets.

• Shows real-world device placement.
• Details cable runs and connections.
• Useful for installation, troubleshooting hardware, and asset management.

Memory trick: Diagrams show logic or location, services or numbers.