← Cisco CCNA Practice
Test yourself →

Network fundamentals

What network fundamentals covers

This is the base layer of CCNA - how devices are physically and logically connected, the models we use to describe networking, and the core terminology examiners lean on hardest.

OSI vs TCP/IP models

The OSI model has 7 layers: Physical, Data Link, Network, Transport, Session, Presentation, Application. Remember it as 'Please Do Not Throw Sausage Pizza Away'.

The TCP/IP model condenses this into 4 layers: Network Access, Internet, Transport, Application.

Key mappings: switches operate at Layer 2 (Data Link, using MAC addresses), routers operate at Layer 3 (Network, using IP addresses), and firewalls/load balancers often work at Layer 4 (Transport, using ports).

Common mistake: mixing up which layer does what - PDUs matter too. Layer 4 = segments, Layer 3 = packets, Layer 2 = frames, Layer 1 = bits.

Cabling and connectors

  • Copper Ethernet: Cat5e supports up to 1 Gbps at 100m; Cat6 supports 10 Gbps up to 55m (100m at 1 Gbps); Cat6a supports 10 Gbps up to 100m.
  • Maximum UTP cable segment length is 100 metres for all standard Ethernet copper runs.
  • Straight-through cables connect unlike devices (PC to switch); crossover cables connect like devices (switch to switch) - though modern NICs use Auto-MDIX so this matters less in practice.
  • Fibre types: single-mode (long distance, uses laser, yellow jacket) vs multi-mode (shorter distance, uses LED, orange/aqua jacket).

Network topologies

  • Star: all devices connect to a central switch - the standard for modern LANs.
  • Mesh: every device connects to every other device - high redundancy, used in WANs/data centres.
  • Hybrid: combination, common in real enterprise designs.

Bandwidth vs throughput vs latency

Bandwidth is the theoretical maximum capacity of a link (e.g. 1 Gbps). Throughput is what is actually achieved. Latency is delay in milliseconds - critical for VoIP and video. Jitter is the variation in latency.

Common mistakes to avoid

  • Confusing a hub (Layer 1, no intelligence, single collision domain) with a switch (Layer 2, separate collision domains per port, uses a MAC address table).
  • Forgetting that a switch does NOT break up broadcast domains - only a router or VLAN boundary does that.
  • Mixing up simplex, half-duplex, and full-duplex - full-duplex means simultaneous send and receive, standard on modern switched networks.
  • OSI model has exactly 7 layers: Physical, Data Link, Network, Transport, Session, Presentation, Application.
  • TCP/IP model has 4 layers: Network Access, Internet, Transport, Application.
  • Maximum standard UTP copper cable segment length is 100 metres.
  • Cat6a supports 10 Gbps over the full 100m; Cat6 only hits 10 Gbps up to 55m.
  • Switches operate at Layer 2 using MAC addresses; routers operate at Layer 3 using IP addresses.
  • A switch creates a separate collision domain per port but does NOT separate broadcast domains.
  • Only a router or a VLAN boundary separates broadcast domains.
  • PDU names by layer: bits (L1), frames (L2), packets (L3), segments (L4).
  • Full-duplex allows simultaneous send and receive; standard on all modern switched Ethernet links.
  • Single-mode fibre uses a laser and supports much longer distances than multi-mode fibre, which uses an LED.
  • Auto-MDIX on modern NICs means straight-through and crossover cables often both work automatically.
What are the 7 layers of the OSI model, top to bottom?
Application, Presentation, Session, Transport, Network, Data Link, Physical.
tap to reveal
What mnemonic helps remember the OSI layers bottom to top?
Please Do Not Throw Sausage Pizza Away (Physical, Data Link, Network, Transport, Session, Presentation, Application).
tap to reveal
How many layers does the TCP/IP model have and what are they?
4 layers: Network Access, Internet, Transport, Application.
tap to reveal
At what OSI layer does a switch operate, and what address does it use?
Layer 2 (Data Link), using MAC addresses.
tap to reveal
At what OSI layer does a router operate, and what address does it use?
Layer 3 (Network), using IP addresses.
tap to reveal
What is the maximum cable length for a standard UTP Ethernet segment?
100 metres.
tap to reveal
Does a switch separate broadcast domains?
No - a switch only separates collision domains per port; only a router or VLAN boundary separates broadcast domains.
tap to reveal
What is the PDU called at Layer 4, Layer 3, and Layer 2?
Layer 4 = segment, Layer 3 = packet, Layer 2 = frame (Layer 1 = bit).
tap to reveal
What is the difference between bandwidth and throughput?
Bandwidth is the theoretical maximum capacity; throughput is the actual data rate achieved.
tap to reveal
What is jitter?
The variation in latency over time - important for VoIP and video quality.
tap to reveal
What is the difference between single-mode and multi-mode fibre?
Single-mode uses a laser and supports much longer distances; multi-mode uses an LED and is used for shorter runs.
tap to reveal
What speed does Cat6a support over the full 100m run?
10 Gbps.
tap to reveal
What does full-duplex mean?
A device can send and receive data simultaneously - standard on modern switched Ethernet.
tap to reveal
When would you use a mesh topology?
When high redundancy is needed - every device connects to every other device, common in WANs and data centres.
tap to reveal
What is the key difference between a hub and a switch?
A hub is Layer 1 with no intelligence and a single collision domain; a switch is Layer 2, uses a MAC address table, and gives each port its own collision domain.
tap to reveal

Network access & switching

Switching fundamentals

A switch builds a MAC address table by reading the source MAC of every incoming frame and mapping it to the port it arrived on. If the destination MAC isn't in the table, the frame is flooded out every port except the one it came in on (unicast flooding). Broadcasts and multicasts are always flooded within the VLAN.

VLANs and trunking

A VLAN creates a separate broadcast domain on shared switch hardware. Access ports carry traffic for one VLAN only; trunk ports carry multiple VLANs tagged with 802.1Q, which inserts a 4-byte tag holding a 12-bit VLAN ID (range 1-4094, with 1002-1005 reserved for legacy VLANs). VLAN 1 is the default VLAN and carries untagged traffic plus control-plane traffic on many switches - best practice is to move management off VLAN 1. The native VLAN on a trunk is sent untagged; both ends must agree on it or you get a native VLAN mismatch (a common exam trap and a real security issue, since it can allow VLAN hopping).

EtherChannel

EtherChannel bundles up to 8 active physical links into one logical link for bandwidth and redundancy. It negotiates using PAgP (Cisco proprietary, modes desirable/auto) or LACP (open standard, modes active/passive). Both ends need matching speed, duplex, VLAN, and trunk settings or the bundle won't form.

Spanning Tree Protocol (STP)

STP (IEEE 802.1D) prevents Layer 2 loops by electing a root bridge (lowest bridge ID: priority + MAC, default priority 32768) and blocking redundant paths. Port states are blocking, listening, learning, forwarding (and disabled) - convergence can take up to 50 seconds with classic STP. Rapid PVST+ (802.1w) converges in seconds using alternate/backup roles. PortFast should only be enabled on ports connecting to end devices, never to another switch, since it skips listening/learning and can create a loop if misused - always pair it with BPDU Guard.

Common mistakes to avoid

  • Confusing access and trunk port roles, or forgetting `switchport trunk allowed vlan` limits which VLANs actually cross a trunk
  • Mixing up PAgP (Cisco-only) with LACP (standards-based)
  • Enabling PortFast on an inter-switch link
  • Forgetting that STP cost is based on link bandwidth (lower cost wins) and that a lower bridge priority wins root election
  • Assuming VLAN 1 is safe to leave for management traffic

Quick numbers to memorise

  • 802.1Q VLAN ID range: 1-4094 (1002-1005 reserved)
  • EtherChannel: up to 8 active links (plus up to 8 standby with PAgP)
  • Default switch priority for STP: 32768
  • Classic STP convergence: up to 50 seconds; Rapid PVST+: a few seconds
  • 802.1Q VLAN IDs run from 1 to 4094, with 1002-1005 reserved for legacy VLANs.
  • The native VLAN on a trunk is sent untagged - mismatched native VLANs on either end is a classic misconfiguration.
  • EtherChannel bundles up to 8 active physical links into a single logical link.
  • PAgP is Cisco proprietary (modes desirable/auto); LACP is the open IEEE standard (modes active/passive).
  • STP (802.1D) elects a root bridge using the lowest bridge ID (priority, default 32768, plus MAC address).
  • Classic STP can take up to 50 seconds to converge; Rapid PVST+ (802.1w) converges in a few seconds.
  • STP port states are blocking, listening, learning, and forwarding.
  • PortFast should only be used on ports facing end devices, and must be paired with BPDU Guard.
  • Access ports carry one VLAN; trunk ports carry multiple VLANs tagged with 802.1Q.
  • A switch floods a frame out all ports (except the source) when the destination MAC is not in its MAC address table.
  • Broadcasts and multicasts are flooded to every port within the same VLAN.
  • STP path cost favours lower values, calculated from link bandwidth - higher bandwidth links get lower cost.
What is the VLAN ID range defined by 802.1Q, and which IDs are reserved?
1 to 4094, with 1002-1005 reserved for legacy VLANs.
tap to reveal
What traffic does an access port carry versus a trunk port?
Access port: a single VLAN, untagged. Trunk port: multiple VLANs, tagged with 802.1Q.
tap to reveal
What is the native VLAN on a trunk, and why does a mismatch matter?
The VLAN sent untagged across the trunk; a mismatch between switches can leak traffic between VLANs (a security risk) and is a classic exam trap.
tap to reveal
How many active physical links can EtherChannel bundle into one logical link?
Up to 8 active links.
tap to reveal
Name the two EtherChannel negotiation protocols and who owns each.
PAgP (Cisco proprietary) and LACP (open IEEE standard).
tap to reveal
What are the PAgP and LACP port modes that will form a bundle when paired?
PAgP: desirable-desirable or desirable-auto. LACP: active-active or active-passive.
tap to reveal
What does STP stand for and what problem does it solve?
Spanning Tree Protocol - it prevents Layer 2 loops by blocking redundant paths between switches.
tap to reveal
How is the STP root bridge elected?
The switch with the lowest bridge ID wins, calculated from priority (default 32768) plus MAC address.
tap to reveal
List the STP port states in order.
Blocking, listening, learning, forwarding (plus disabled).
tap to reveal
How long can classic STP (802.1D) take to converge, and what's faster?
Up to 50 seconds; Rapid PVST+ (802.1w) converges in a few seconds.
tap to reveal
What is PortFast and where should it be enabled?
A feature that skips STP listening/learning states for faster access-port startup - only on ports connecting to end devices, never to other switches.
tap to reveal
What should always accompany PortFast, and why?
BPDU Guard - it shuts the port down if a BPDU is received, protecting against an accidental loop if PortFast is misapplied to a switch link.
tap to reveal
What happens when a switch receives a frame for a destination MAC not in its MAC address table?
It floods the frame out every port except the one it arrived on (unicast flooding).
tap to reveal
How does a switch build its MAC address table?
By reading the source MAC address of each incoming frame and recording which port it arrived on.
tap to reveal
What determines STP path cost, and which value wins?
Link bandwidth determines cost - lower cost is preferred, so higher-bandwidth links get lower cost values.
tap to reveal

IP connectivity & routing

How routers forward packets

Every router builds a routing table from three sources: directly connected routes, static routes you configure by hand, and dynamic routes learned via a routing protocol. When a packet arrives, the router does a longest prefix match - it picks the route with the most specific (longest) matching subnet mask, not just the first match it finds. If there is no match at all and no default route (0.0.0.0/0), the packet is dropped and the router should send back an ICMP destination unreachable message.

Administrative distance - who do you trust

When two different sources offer a route to the same destination, the router picks the one with the lowest administrative distance (AD). Learn these: connected = 0, static = 1, EIGRP internal = 90, OSPF = 110, RIP = 120, and anything unreachable/unknown = 255 (never installed). A common exam trap: metric only breaks ties WITHIN the same protocol - AD decides between protocols first.

Static vs dynamic routing

Static routes are simple, predictable and use zero CPU/bandwidth for calculation, but do not adapt if the network changes - you must edit them manually. Dynamic routing protocols (OSPF, EIGRP, RIP) automatically discover and adapt to topology changes but add complexity and overhead. A default static route (ip route 0.0.0.0 0.0.0.0 <next-hop>) is the classic 'gateway of last resort' used on stub networks like a small branch office.

OSPF essentials

OSPF is a link-state protocol using Dijkstra's SPF algorithm, AD 110, and cost as its metric (cost = reference bandwidth ÷ interface bandwidth, default reference 100 Mbps on older IOS). Routers become neighbours by exchanging Hello packets (default 10s on broadcast links, 30s on NBMA) and must agree on: area ID, subnet mask, hello/dead timers, and authentication type. Area 0 is always the backbone - every other area must connect back to it, directly or via a virtual link.

Inter-VLAN routing and gateways

Devices in different VLANs cannot talk without a router or Layer 3 switch. Router-on-a-stick uses one physical interface split into sub-interfaces (each tagged with dot1Q encapsulation for its VLAN) - cheap but limited by the single link's bandwidth. A Layer 3 switch with SVIs (switched virtual interfaces) is the enterprise standard - faster and scales better.

Common mistakes to avoid

  • Confusing administrative distance (trust between protocols) with metric (best path within a protocol).
  • Forgetting that longest prefix match always wins over a shorter, less specific route - even a static route.
  • Mixing up classful summarisation with proper subnetting - CCNA expects VLSM, not old classful thinking.
  • Forgetting the default route needs a valid, reachable next-hop or exit interface, or it will not install.
  • Assuming a routing protocol is enabled just by turning it on - networks/interfaces must be explicitly advertised (e.g. network statements in OSPF).
  • Longest prefix match always wins - the most specific matching subnet beats any shorter match, including over a default route.
  • Administrative distance ranking to memorise: connected 0, static 1, EIGRP 90, OSPF 110, RIP 120, unusable 255.
  • A default route is written as ip route 0.0.0.0 0.0.0.0 <next-hop-or-exit-interface>.
  • OSPF default Hello interval is 10 seconds on broadcast/point-to-point links and 30 seconds on NBMA links; dead interval is 4x hello.
  • OSPF neighbours must match area ID, subnet mask, hello/dead timers and authentication before they can form an adjacency.
  • Area 0 is mandatory as the OSPF backbone area - all other areas must connect to it directly or via a virtual link.
  • Router-on-a-stick needs one sub-interface per VLAN, each configured with encapsulation dot1Q <vlan-id>.
  • A Layer 3 switch uses SVIs (interface vlan X) to route between VLANs without needing an external router.
  • If there is no matching route and no default route, the router drops the packet and should reply with ICMP destination unreachable.
  • Metric only decides the best path between routes learned by the SAME protocol - AD decides which protocol's route wins first.
  • Static routes have zero routing overhead but do not adapt automatically to topology or link failures.
  • OSPF cost is calculated as reference bandwidth divided by interface bandwidth - lower cost is preferred.
What does a router do when two routes to the same destination come from different protocols?
It compares administrative distance and installs the route from the source with the lowest AD.
tap to reveal
What is the administrative distance of a directly connected route?
0 - the most trusted source, always preferred.
tap to reveal
What is the administrative distance of a static route?
1.
tap to reveal
What is OSPF's administrative distance?
110.
tap to reveal
What is RIP's administrative distance?
120.
tap to reveal
What happens when a router has two routes with different prefix lengths that both match the destination?
It always chooses the route with the longest (most specific) prefix match, regardless of AD or metric.
tap to reveal
How do you configure a default static route on a Cisco router?
ip route 0.0.0.0 0.0.0.0 <next-hop-ip-or-exit-interface>
tap to reveal
What algorithm does OSPF use to calculate best paths?
Dijkstra's Shortest Path First (SPF) algorithm.
tap to reveal
What four things must OSPF neighbours agree on to form an adjacency?
Area ID, subnet mask, hello/dead timers, and authentication type.
tap to reveal
What is the default OSPF Hello interval on a broadcast link?
10 seconds (dead interval is 40 seconds, 4x hello).
tap to reveal
Why is OSPF Area 0 special?
It is the mandatory backbone area - every other area must connect to it directly or via a virtual link.
tap to reveal
What is router-on-a-stick and what must each sub-interface have?
Using one physical interface with multiple VLAN sub-interfaces for inter-VLAN routing; each sub-interface needs encapsulation dot1Q <vlan-id>.
tap to reveal
What is an SVI and why is it preferred over router-on-a-stick?
A Switched Virtual Interface on a Layer 3 switch (interface vlan X) - preferred because it is not bandwidth-limited by a single trunk link.
tap to reveal
What happens if a packet has no matching route and no default route exists?
The router drops the packet and should send back an ICMP destination unreachable message.
tap to reveal
How is OSPF cost calculated?
Reference bandwidth divided by interface bandwidth - lower cost is more preferred.
tap to reveal

IP services (DHCP, NAT, NTP)

DHCP

DHCP (Dynamic Host Configuration Protocol) automatically hands out IP addresses, subnet masks, default gateways and DNS servers to hosts, saving manual configuration.

The process is DORA:

  • Discover - client broadcasts DHCPDISCOVER (destination 255.255.255.255)
  • Offer - server replies DHCPOFFER with a proposed lease
  • Request - client broadcasts DHCPREQUEST asking to accept that offer
  • Acknowledge - server confirms with DHCPACK

If a client roams back onto a subnet where it already has a valid lease, it can skip straight to Request/Acknowledge (a shortened exchange).

When the DHCP server sits on a different subnet from the client, a router does not forward broadcasts by default, so you configure the ip helper-address command on the client-side interface. This turns the broadcast into a unicast and forwards it to the DHCP server, also relaying DNS, TFTP and other UDP broadcast services.

On IOS routers you can build a small DHCP server with ip dhcp pool NAME, then network, default-router and dns-server sub-commands. Use ip dhcp excluded-address to stop the pool handing out addresses reserved for statics like gateways and servers - do this before defining the pool or the router will hand those addresses out first.

Common mistake: forgetting the excluded-address statement, causing an IP conflict with the gateway.

NAT

NAT (Network Address Translation) maps private IP addresses (RFC 1918: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) to a public address so multiple internal hosts can share limited public IPs and reach the internet.

  • Static NAT - one-to-one, permanent mapping, good for servers that need a fixed public address
  • Dynamic NAT - pool of public addresses matched to a pool of private addresses, first-come first-served
  • PAT (NAT overload) - many private addresses share one public address, differentiated by source port number; this is what most home and small business routers use

Key terms: inside local (private address as seen inside), inside global (public address as seen outside). Interfaces must be marked ip nat inside or ip nat outside or translation will not happen.

Common mistake: configuring the NAT pool/ACL correctly but forgetting the inside/outside interface commands.

NTP

NTP (Network Time Protocol) synchronises device clocks across a network, which matters for accurate logging, certificate validation and troubleshooting timelines.

NTP uses a stratum hierarchy: stratum 0 devices are reference clocks (atomic/GPS), stratum 1 servers are directly connected to them, and each hop away adds one to the stratum number, up to a maximum of stratum 15 (stratum 16 means unsynchronised).

Devices can operate in client mode (ntp server IP) or peer mode (ntp peer IP) for mutual synchronisation between equals. Check sync state with show ntp status and show ntp associations - look for the sys.peer indicated by an asterisk.

Common mistake: assuming NTP works instantly - convergence can take several minutes as the client gradually steps or slews its clock.

  • DHCP DORA order is Discover, Offer, Request, Acknowledge - all client-originated messages start as broadcasts
  • ip helper-address on the client-facing router interface relays DHCP broadcasts to a remote DHCP server as unicast
  • ip dhcp excluded-address must be configured before ip dhcp pool to stop the router leasing out reserved addresses like the gateway
  • RFC 1918 private ranges are 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16
  • PAT (NAT overload) lets many private hosts share one public IP by tracking unique source port numbers
  • Static NAT is a permanent one-to-one mapping, commonly used for servers needing a fixed public address
  • Interfaces must be explicitly marked ip nat inside or ip nat outside for NAT to function
  • Inside local = private address seen inside the network; inside global = translated public address seen outside
  • NTP stratum 0 is a reference clock, stratum 1 servers connect directly to it, and stratum increases by 1 per hop away
  • NTP stratum 16 signals the device is unsynchronised
  • ntp server configures client mode; ntp peer configures mutual peer synchronisation
  • show ntp associations shows the current synchronisation peer, marked with an asterisk (sys.peer)
What does DORA stand for in the DHCP process?
Discover, Offer, Request, Acknowledge
tap to reveal
What command relays DHCP broadcasts across a router to a remote DHCP server?
ip helper-address, configured on the client-side interface
tap to reveal
Why must ip dhcp excluded-address be set before creating the DHCP pool?
So the router does not lease out reserved addresses (like the default gateway) to clients
tap to reveal
Name the three RFC 1918 private address ranges.
10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16
tap to reveal
What is PAT and what does it use to distinguish hosts?
NAT overload; it uses unique source port numbers to let many private hosts share one public IP
tap to reveal
What is the difference between static and dynamic NAT?
Static NAT is a fixed one-to-one mapping; dynamic NAT assigns addresses from a pool on a first-come first-served basis
tap to reveal
What two interface commands are required for NAT to actually translate traffic?
ip nat inside and ip nat outside
tap to reveal
Define inside local and inside global addresses.
Inside local is the private address as seen inside the network; inside global is the translated public address as seen outside
tap to reveal
What is an NTP stratum 0 device?
A reference clock source such as an atomic clock or GPS receiver
tap to reveal
What does NTP stratum 16 mean?
The device is unsynchronised
tap to reveal
What is the difference between ntp server and ntp peer commands?
ntp server configures client mode (one-way sync from a server); ntp peer configures mutual peer synchronisation between equals
tap to reveal
How do you check which NTP source a router is currently synchronised to?
show ntp associations - the sys.peer is marked with an asterisk
tap to reveal
What is the maximum useful NTP stratum number before a device is considered unsynchronised?
15 (stratum 16 means unsynchronised)
tap to reveal

Security fundamentals

Security fundamentals — the big picture

CCNA security fundamentals cover the core concepts you need before touching a firewall CLI: threats, key security principles, and the basic controls Cisco expects you to recognise.

CIA triad

  • Confidentiality: only authorised people can read the data (encryption, ACLs).
  • Integrity: data has not been altered in transit or storage (hashing, checksums).
  • Availability: systems and data are accessible when needed (redundancy, DoS defence).
  • Every security control maps back to one or more of these three goals — a common exam trick is naming a control and asking which leg it protects.

AAA framework

  • Authentication: proving who you are (username/password, certificates, MFA).
  • Authorisation: what you are allowed to do once authenticated.
  • Accounting: logging what you actually did (audit trail).
  • Cisco devices commonly use TACACS+ (Cisco-proprietary, encrypts the whole packet, separates authentication/authorisation, uses TCP port 49) or RADIUS (open standard, only encrypts the password, combines authentication and authorisation, uses UDP ports 1812/1813 — older ports 1645/1646 still seen).
  • Common mistake: mixing up TACACS+ (TCP 49, full encryption) with RADIUS (UDP 1812/1813, partial encryption) — the exam loves this contrast.

Common threats and mitigations

  • Malware: viruses, worms, trojans, ransomware — mitigate with endpoint AV/AMP and patching.
  • Social engineering: phishing, pretexting, tailgating — mitigate with user training, not just tech.
  • Reconnaissance, access, and DoS attacks are the three classic attack categories.
  • Spoofing attacks (MAC, IP, DHCP) are countered on switches with Port Security, DHCP Snooping, Dynamic ARP Inspection (DAI), and IP Source Guard.
  • Password attacks: brute force and dictionary attacks — mitigate with complexity rules, lockout thresholds, and MFA.

Key device/network hardening

  • Disable unused ports and services; use SSH (TCP 22) not Telnet (TCP 23) for management — Telnet sends everything in clear text.
  • Use enable secret (MD5/scrypt-hashed) rather than the plaintext enable password.
  • Port Security limits the number of MAC addresses per switchport (default violation action is shutdown) to stop MAC flooding.
  • VPNs (IPsec, site-to-site or remote-access) protect data confidentiality and integrity over untrusted networks like the internet.

Common mistakes to avoid

  • Confusing authentication with authorisation — authentication is 'who', authorisation is 'what they can do'.
  • Thinking RADIUS encrypts the whole session — it only encrypts the password field.
  • Forgetting accounting is a distinct AAA pillar, not just a log file.
  • Assuming Telnet is 'good enough' for internal management — always default to SSH.
  • The CIA triad is Confidentiality, Integrity, Availability — every control maps to one or more of these.
  • AAA stands for Authentication, Authorisation, and Accounting.
  • TACACS+ is Cisco-proprietary, uses TCP port 49, and encrypts the entire packet.
  • RADIUS is an open standard, uses UDP ports 1812/1813 (legacy 1645/1646), and only encrypts the password.
  • TACACS+ separates authentication and authorisation into distinct steps; RADIUS combines them.
  • SSH uses TCP port 22 and encrypts management traffic; Telnet (TCP port 23) sends everything in clear text.
  • Port Security's default violation mode on a Cisco switch is shutdown, which err-disables the port.
  • DHCP Snooping, Dynamic ARP Inspection (DAI), and IP Source Guard defend against spoofing attacks on Layer 2.
  • Enable secret is hashed (MD5 or scrypt); enable password is stored in plain text and should never be used.
  • IPsec VPNs protect confidentiality and integrity of data crossing untrusted networks such as the internet.
  • The three broad attack categories are reconnaissance, access, and denial-of-service (DoS).
  • Social engineering attacks (phishing, pretexting, tailgating) are best mitigated by user awareness training, not just technology.
What does the CIA triad stand for?
Confidentiality, Integrity, Availability.
tap to reveal
What does AAA stand for in network security?
Authentication, Authorisation, Accounting.
tap to reveal
Which AAA protocol is Cisco-proprietary and uses TCP port 49?
TACACS+.
tap to reveal
Which AAA protocol uses UDP ports 1812/1813 and only encrypts the password?
RADIUS.
tap to reveal
Does TACACS+ or RADIUS separate authentication and authorisation into distinct steps?
TACACS+ separates them; RADIUS combines them.
tap to reveal
What port does SSH use for secure management access?
TCP port 22.
tap to reveal
Why should Telnet be avoided for device management?
It sends all traffic, including passwords, in clear text (TCP port 23).
tap to reveal
What is the default violation action for Port Security on a Cisco switch?
Shutdown — the port goes into err-disabled state.
tap to reveal
Name three Layer 2 features that defend against spoofing attacks.
DHCP Snooping, Dynamic ARP Inspection (DAI), and IP Source Guard.
tap to reveal
What is the difference between enable password and enable secret?
Enable password is stored in plain text; enable secret is hashed (MD5 or scrypt) and is the secure choice.
tap to reveal
What are the three broad categories of network attacks?
Reconnaissance, access, and denial-of-service (DoS) attacks.
tap to reveal
What is the best mitigation against phishing and other social engineering attacks?
User awareness training, alongside technical email/web filtering controls.
tap to reveal
What technology protects data confidentiality and integrity over an untrusted network like the internet?
A VPN, typically using IPsec.
tap to reveal
In AAA, what does the accounting pillar provide?
A log/audit trail of what an authenticated and authorised user actually did on the system.
tap to reveal
Which legacy RADIUS ports might still be seen alongside 1812/1813?
UDP ports 1645 and 1646.
tap to reveal

Automation & programmability

What automation and programmability actually cover

This topic tests whether you understand WHY networks are moving away from box-by-box CLI configuration towards centralised, software-driven control. CCNA does not expect you to write code fluently, but you must know the concepts, the architecture, and the key terms.

Traditional networking vs controller-based networking

Traditional networks are managed device-by-device via CLI (SSH/console), which does not scale and is prone to human error and configuration drift. Controller-based (SDN) networks separate the control plane (decision-making, on a central controller) from the data plane (packet forwarding, on the switches/routers). The controller has a network-wide view and pushes configuration to devices via APIs, giving consistency and speed.

Northbound vs southbound APIs

  • Northbound API: sits between the controller and the applications/orchestration layer above it (usually REST/HTTP, often using JSON).
  • Southbound API: sits between the controller and the physical/virtual devices below it (examples: OpenFlow, NETCONF, OpFlex).

Getting the direction backwards is a very common exam trap - remember 'North looks up to apps, South looks down to devices'.

Data formats and REST APIs

Automation tools exchange structured data, not screen-scraped CLI text. Know the three formats:

  • JSON: uses key-value pairs in braces {}, most common in networking APIs.
  • XML: uses opening/closing tags like <tag>value</tag>, used heavily by NETCONF.
  • YAML: uses indentation and colons, no braces, human-readable, used by Ansible.

REST APIs use standard HTTP methods: GET (read), POST (create), PUT/PATCH (update), DELETE (remove).

Configuration management tools

Three tools are named on the exam - know their model and language:

  • Ansible: agentless, uses SSH, playbooks written in YAML, push-based.
  • Puppet: agent-based, uses a Ruby-like DSL, pull-based (agent checks in with the master).
  • Chef: agent-based, uses Ruby, pull-based, uses 'recipes' and 'cookbooks'.

Agentless (Ansible) is simpler to deploy since nothing extra is installed on the managed device.

Cisco SDN controllers

  • Cisco DNA Center: enterprise campus/branch automation and assurance, intent-based networking.
  • Cisco SD-WAN (vManage): controller for wide area network overlay/underlay automation.
  • Cisco ACI (APIC controller): data centre SDN, uses a policy/application-centric model.

Common mistakes

Students often mix up northbound/southbound, forget that JSON has no closing tags (unlike XML), and confuse push (Ansible/SSH) versus pull (Puppet/Chef, agent-based) automation models. Also remember APIs are typically consumed over HTTPS with authentication tokens, not plain HTTP.

  • SDN separates the control plane (decisions, on the controller) from the data plane (forwarding, on the devices)
  • Northbound API connects the controller UP to applications, usually REST/HTTP with JSON
  • Southbound API connects the controller DOWN to devices, examples include OpenFlow and NETCONF
  • JSON uses key-value pairs inside curly braces {} and is the most common API data format in networking
  • XML uses matching opening and closing tags, for example <interface>Gi0/1</interface>
  • YAML uses indentation and colons with no braces and is the format used by Ansible playbooks
  • REST API methods: GET reads data, POST creates, PUT or PATCH updates, DELETE removes
  • Ansible is agentless, uses SSH, and is push-based with YAML playbooks
  • Puppet and Chef are agent-based and pull-based, with agents checking in to a central master
  • Puppet uses a Ruby-like DSL; Chef uses Ruby recipes and cookbooks
  • Cisco DNA Center is the SDN controller for enterprise campus and branch networks
  • Cisco ACI uses the APIC controller for data centre automation with an application-centric policy model
What does SDN stand for and what does it separate?
Software-Defined Networking; it separates the control plane (on a central controller) from the data plane (forwarding, on switches/routers)
tap to reveal
Which direction does a northbound API face?
Up towards applications and orchestration systems, typically using REST/HTTP and JSON
tap to reveal
Which direction does a southbound API face, and name an example protocol
Down towards network devices; example: OpenFlow or NETCONF
tap to reveal
What format uses key-value pairs inside curly braces?
JSON
tap to reveal
What format uses matching opening and closing tags like <tag>value</tag>?
XML
tap to reveal
What format uses indentation and colons with no braces, and which tool uses it?
YAML; used by Ansible playbooks
tap to reveal
What HTTP method is used to create a new resource via REST API?
POST
tap to reveal
What HTTP method is used to read/retrieve data via REST API?
GET
tap to reveal
What HTTP method removes a resource via REST API?
DELETE
tap to reveal
Is Ansible agent-based or agentless, and what protocol does it use to connect?
Agentless; it connects over SSH
tap to reveal
Are Puppet and Chef push-based or pull-based?
Pull-based - an agent on the managed device checks in with a central master/server
tap to reveal
What language does Puppet use, and what does Chef use?
Puppet uses a Ruby-like DSL; Chef uses Ruby (recipes and cookbooks)
tap to reveal
What is Cisco DNA Center used for?
SDN controller for enterprise campus and branch network automation and assurance
tap to reveal
What is Cisco ACI's controller called, and what network domain is it for?
The APIC controller; used for data centre SDN with an application/policy-centric model
tap to reveal
What is Cisco SD-WAN's controller called?
vManage
tap to reveal