Every flashcard from the interactive tool above, listed here in full by topic with the correct answer and explanation — searchable, bookmarkable, and readable without needing to click through the quiz interface.
Switching (25 cards)
1. What device connects multiple devices in a LAN and forwards frames based on MAC addresses?
Answer: Switch
A switch forwards frames based on MAC addresses, unlike a hub which broadcasts to all ports.
2. Which layer does a switch primarily operate on?
Answer: Data Link
Switches operate at Layer 2 (Data Link) using MAC addresses to forward frames.
3. What is the purpose of VLANs?
Answer: Separate networks logically
VLANs allow segmentation of networks logically, even if devices are on the same switch.
4. What is the main difference between a Hub and a Switch?
Answer: Switch forwards frames intelligently
Switches forward frames to the correct port based on MAC addresses; hubs broadcast to all ports.
5. Which protocol prevents loops in a Layer 2 network?
Answer: STP
STP (Spanning Tree Protocol) prevents loops by blocking redundant paths in Layer 2 networks.
6. What does STP stand for?
Answer: Spanning Tree Protocol
STP stands for Spanning Tree Protocol, used to prevent network loops.
7. What is a trunk port used for?
Answer: Carry multiple VLANs
Trunk ports carry traffic for multiple VLANs between switches.
8. Which type of VLAN allows untagged traffic?
Answer: Native VLAN
Native VLAN carries untagged traffic across a trunk link.
9. Which VLAN type is used for network management?
Answer: Management VLAN
Management VLAN is used to access and manage the switch itself.
10. What is the purpose of a MAC address table in a switch?
Answer: Forward frames to correct port
The MAC address table maps MAC addresses to specific ports for proper frame forwarding.
11. What is the default priority of a switch for DR election in STP?
Answer: 32768
The default bridge priority in STP is 32768, used for root bridge election.
12. Which command shows the MAC address table in Cisco IOS?
Answer: show mac address-table
The 'show mac address-table' command displays learned MAC addresses and ports.
13. Which spanning-tree port state allows forwarding?
Answer: Forwarding
Only the Forwarding state allows frames to pass through the port.
14. What happens if two switches have the same STP priority?
Answer: Lower MAC becomes root
If priorities are equal, the switch with the lower MAC address becomes the root bridge.
15. Which switch feature helps reduce broadcast traffic?
Answer: VLANs
VLANs reduce broadcast domains by segmenting traffic.
16. Which protocol allows dynamic VLAN assignment?
Answer: VTP
VTP (VLAN Trunking Protocol) propagates VLAN information dynamically.
17. What is the purpose of EtherChannel?
Answer: Aggregate multiple links
EtherChannel combines multiple physical links into one logical link for higher bandwidth.
18. Which switch port type connects end devices?
Answer: Access port
Access ports connect to end devices and carry traffic for a single VLAN.
19. What does a BPDU do?
Answer: Exchange information for STP
BPDUs are used by switches to share STP information and detect loops.
20. Which STP version supports rapid convergence?
Answer: RSTP
RSTP (Rapid Spanning Tree Protocol) converges faster than original STP.
21. What does PVST stand for?
Answer: Per VLAN Spanning Tree
PVST allows a separate spanning tree for each VLAN.
22. Which VLAN type carries voice traffic?
Answer: Voice VLAN
Voice VLANs are optimized for IP phones.
23. Which protocol helps switches learn MAC addresses dynamically?
Answer: MAC learning
Switches dynamically learn MAC addresses to populate their MAC tables.
24. Which feature prevents loops when multiple links exist?
Answer: STP
STP blocks redundant paths to prevent Layer 2 loops.
25. What command shows active VLANs on a Cisco switch?
Answer: show vlan brief
'show vlan brief' displays all active VLANs on the switch.
Routing (26 cards)
1. What is the primary function of a router?
Answer: Routes packets between networks
Routers forward packets between different networks, making decisions based on IP addresses.
2. What is the primary function of a router?
Answer: Routes packets between networks
Routers forward packets between different networks, making decisions based on IP addresses.
3. Which OSI layer does a router primarily operate on?
Answer: Layer 3 (Network)
Routers work at Layer 3 (Network Layer) to forward packets based on IP addresses.
4. What table does a router use to make forwarding decisions?
Answer: Routing Table
Routers rely on their routing table to determine the best path for packet forwarding.
5. Which of these is a dynamic routing protocol?
Answer: RIP
RIP (Routing Information Protocol) is one of the dynamic routing protocols.
6. What is the default administrative distance of OSPF?
Answer: 110
OSPF has an administrative distance of 110 by default.
7. What does NAT stand for?
Answer: Network Address Translation
NAT translates private IP addresses into public IPs for internet communication.
8. What is the main advantage of dynamic routing over static routing?
Answer: Automatic route updates
Dynamic routing automatically updates routes when the topology changes.
9. Which protocol is link-state?
Answer: OSPF
OSPF is a link-state routing protocol, unlike RIP which is distance-vector.
10. Which routing protocol is used between ISPs on the Internet?
Answer: BGP
BGP (Border Gateway Protocol) is the standard protocol for ISP-level routing.
11. What is the default administrative distance of static routes?
Answer: 1
Static routes have an administrative distance of 1, making them very reliable.
12. What is the main difference between IPv4 and IPv6 routing?
Answer: IPv6 uses 128-bit addresses
IPv6 uses 128-bit addressing, requiring different routing handling compared to IPv4's 32-bit.
13. Which Cisco command shows the routing table?
Answer: show ip route
The 'show ip route' command displays the router's routing table.
14. What does default route 0.0.0.0/0 represent?
Answer: Unknown destination
A default route forwards packets with unknown destinations to the next-hop.
15. Which of these is a distance-vector routing protocol?
Answer: RIP
RIP is a distance-vector protocol using hop count as its metric.
16. What metric does OSPF use?
Answer: Cost (Bandwidth)
OSPF uses Cost (based on bandwidth) as its metric.
17. Which protocol is considered a hybrid routing protocol?
Answer: EIGRP
EIGRP is a hybrid protocol, combining features of distance-vector and link-state.
18. Which interface is used for loopback testing?
Answer: Loopback
Loopback interfaces are virtual and often used for testing and router ID assignment.
19. What is the maximum hop count allowed by RIP?
Answer: 15
RIP supports a maximum hop count of 15; anything beyond is considered unreachable.
20. Which routing protocol supports VLSM?
Answer: RIP v2
RIP v2 supports Variable Length Subnet Masking (VLSM).
21. What is ECMP in routing?
Answer: Equal-Cost Multi-Path
ECMP allows load-balancing across multiple equal-cost paths.
22. Which type of routing requires manual configuration?
Answer: Static Routing
Static routing requires manual configuration by administrators.
23. Which Cisco command configures a static route?
Answer: ip route
Cisco routers use 'ip route' command to configure static routes.
24. Which protocol advertises only best path information?
Answer: BGP
BGP advertises only the best path to its neighbors.
25. What is the default administrative distance of eBGP?
Answer: 20
eBGP has an administrative distance of 20, higher priority than many protocols.
26. Which feature helps prevent routing loops?
Answer: Split Horizon
Split Horizon prevents a router from advertising a route back on the interface it was learned from.
Firewalls (25 cards)
1. What is the primary function of a firewall?
Answer: To filter and control network traffic
A firewall filters and controls traffic between trusted and untrusted networks.
2. At which OSI layers can a firewall operate?
Answer: Layer 3, 4, and 7
Firewalls can operate at the Network, Transport, and Application layers.
3. What type of firewall inspects traffic based on IP and port?
Answer: Packet Filtering Firewall
Packet filtering firewalls check packets using IP addresses and port numbers.
4. Which firewall type maintains the state of connections?
Answer: Stateful Firewall
Stateful firewalls track the state of connections to allow or block traffic intelligently.
5. What is a proxy firewall also called?
Answer: Circuit-Level Gateway
Proxy firewalls, or circuit-level gateways, filter traffic by acting as intermediaries.
6. What is a major advantage of a Next-Generation Firewall (NGFW)?
Answer: Deep packet inspection and threat detection
NGFWs provide deep packet inspection and advanced security features.
7. Which of these is a hardware firewall example?
Answer: Cisco ASA
Cisco ASA is a hardware firewall device widely used in enterprises.
8. Which protocol is commonly blocked by firewalls for security?
Answer: ICMP
ICMP is often restricted to prevent network discovery and ping floods.
9. What does DPI stand for in firewalls?
Answer: Deep Packet Inspection
Deep Packet Inspection (DPI) examines packet payloads for threats.
10. What is a common firewall rule format?
Answer: Allow/Deny with conditions
Firewall rules are typically defined as Allow or Deny with conditions.
11. Which command manages firewall rules in Linux?
Answer: iptables
iptables is a common tool in Linux for managing firewall rules.
12. Which Windows tool configures firewall rules?
Answer: netsh advfirewall
'netsh advfirewall' manages firewall rules in Windows.
13. What is the default firewall behavior if no rules are matched?
Answer: Deny traffic
By default, most firewalls deny traffic if no explicit rule matches.
14. Which firewall feature hides internal IP addresses?
Answer: NAT
Network Address Translation (NAT) hides private IPs from external networks.
15. What type of firewall inspects traffic up to Layer 7?
Answer: Application Firewall
Application firewalls filter traffic based on application-layer data.
16. Which firewall deployment protects a network's perimeter?
Answer: Perimeter Firewall
Perimeter firewalls sit between an internal and external network to block threats.
17. What is the difference between host-based and network-based firewalls?
Answer: One runs on each device
Host-based firewalls run on individual devices, while network-based firewalls protect whole networks.
18. Which firewall type combines multiple security functions?
Answer: UTM Firewall
Unified Threat Management (UTM) firewalls combine multiple features in one device.
19. Which of the following is an open-source firewall?
Answer: pfSense
pfSense is a popular open-source firewall solution.
20. What is the main disadvantage of packet filtering firewalls?
Answer: Cannot inspect packet payloads
Packet filters only check headers, not payloads, so they miss deeper threats.
21. What kind of firewall prevents SQL injection and XSS attacks?
Answer: WAF
Web Application Firewalls (WAF) protect web servers from application-layer attacks.
22. Which protocol does a firewall use to block unwanted websites?
Answer: DNS filtering
DNS filtering can be used by firewalls to block access to certain domains.
23. Which firewall feature allows specific applications while blocking others?
Answer: Application Control
Application control lets administrators allow or block specific apps.
24. What is the main function of IDS/IPS in firewalls?
Answer: Detect and block threats
IDS/IPS detects intrusions and can prevent them in real time.
25. Which firewall log entry indicates dropped packets?
Answer: DENY
A firewall log entry with 'DENY' means the packet was dropped.
OSI Model (25 cards)
1. How many layers are in the OSI model?
Answer: 7
The OSI model has 7 layers, from Physical to Application.
2. Which OSI layer is responsible for logical addressing?
Answer: Network
The Network layer handles logical addressing using IP addresses.
3. Which OSI layer ensures reliable data delivery?
Answer: Transport
The Transport layer ensures reliable communication using protocols like TCP.
4. Which OSI layer deals with encryption and compression?
Answer: Presentation
The Presentation layer handles encryption, compression, and translation.
5. Which OSI layer establishes, manages, and terminates sessions?
Answer: Session
The Session layer manages sessions between applications.
6. Which OSI layer converts bits into signals?
Answer: Physical
The Physical layer deals with raw bits and physical transmission.
7. Which OSI layer is responsible for framing?
Answer: Data Link
The Data Link layer encapsulates data into frames.
8. At which OSI layer does routing occur?
Answer: Network
The Network layer determines the best path for packets.
9. Which OSI layer ensures data is in a usable format?
Answer: Presentation
The Presentation layer translates and formats data for the Application layer.
10. Which OSI layer provides services like HTTP, SMTP, and FTP?
Answer: Application
The Application layer provides network services directly to the user.
11. Which OSI layer uses switches for data forwarding?
Answer: Data Link
Switches operate at the Data Link layer using MAC addresses.
12. Which OSI layer uses IP addresses?
Answer: Network
The Network layer uses IP addresses to deliver packets.
13. Which OSI layer is responsible for segmentation?
Answer: Transport
The Transport layer segments data into smaller units.
14. Which OSI layer detects and may correct errors in frames?
Answer: Data Link
The Data Link layer provides error detection and correction for frames.
15. Which OSI layer defines cables, connectors, and voltage levels?
Answer: Physical
The Physical layer defines the hardware specifications.
16. Which OSI layer ensures complete data transfer?
Answer: Transport
The Transport layer ensures complete and error-free delivery.
17. Which OSI layer provides end-to-end communication?
Answer: Transport
The Transport layer provides end-to-end connectivity.
18. Which OSI layer adds MAC addresses?
Answer: Data Link
The Data Link layer adds source and destination MAC addresses.
19. At which OSI layer does a router operate?
Answer: Network
Routers work at the Network layer to forward packets using IP addresses.
20. Which OSI layer is closest to the end user?
Answer: Application
The Application layer is the top layer, closest to the user.
21. Which OSI layer deals with acknowledgments?
Answer: Transport
The Transport layer uses acknowledgments in reliable protocols like TCP.
22. Which OSI layer organizes data into packets?
Answer: Network
The Network layer encapsulates data into packets.
23. Which OSI layer is responsible for flow control?
Answer: Transport
The Transport layer manages flow control to prevent congestion.
24. Which OSI layer is associated with bit rates and modulation?
Answer: Physical
The Physical layer defines bit rate, modulation, and signal transmission.
25. Which OSI layer handles dialog control?
Answer: Session
The Session layer manages dialog control between two systems.
Access Points (25 cards)
1. What is the main function of an Access Point (AP)?
Answer: To extend wireless connectivity
An Access Point extends wireless connectivity to allow devices to join a wired network.
2. Which IEEE standard defines Wi-Fi used by Access Points?
Answer: IEEE 802.11
Wi-Fi is defined under the IEEE 802.11 standard.
3. What does SSID stand for in wireless networking?
Answer: Service Set Identifier
SSID stands for Service Set Identifier, the name of a wireless network.
4. Which security protocol is most recommended for modern APs?
Answer: WPA3
WPA3 is the most secure wireless encryption standard currently available.
5. What frequency bands do most APs operate on?
Answer: 2.4GHz and 5GHz
Most APs operate on the 2.4GHz and 5GHz frequency bands.
6. What is the main advantage of a dual-band Access Point?
Answer: Provides two frequency options for devices
Dual-band APs provide both 2.4GHz and 5GHz frequencies, reducing congestion.
7. Which protocol is used by APs for secure management?
Answer: HTTPS
HTTPS is recommended for securely managing APs.
8. What does roaming mean in wireless networks?
Answer: Switching between APs seamlessly
Roaming allows clients to move between APs without losing connection.
9. What is MU-MIMO in Access Points?
Answer: Multiple User - Multiple Input Multiple Output
MU-MIMO allows APs to communicate with multiple clients simultaneously.
10. What is the main drawback of using WEP security on APs?
Answer: It is insecure and easily hacked
WEP is outdated and vulnerable, making it insecure for modern networks.
11. Which type of antenna provides coverage in all directions for an AP?
Answer: Omnidirectional
Omnidirectional antennas provide 360-degree coverage.
12. Which type of antenna is best for long-distance point-to-point AP connections?
Answer: Directional
Directional antennas focus signals in one direction for long-distance communication.
13. What does PoE stand for in relation to APs?
Answer: Power over Ethernet
PoE (Power over Ethernet) powers APs using the same Ethernet cable that carries data.
14. What is the maximum theoretical speed of Wi-Fi 6 (802.11ax)?
Answer: 9.6 Gbps
Wi-Fi 6 can theoretically reach speeds up to 9.6 Gbps.
15. What is the role of a Wireless Controller with APs?
Answer: Centrally manages multiple APs
A Wireless Controller manages configurations, policies, and monitoring of multiple APs.
16. Which wireless mode allows APs to connect directly without a controller?
Answer: Autonomous Mode
Autonomous Mode allows APs to operate independently without a controller.
17. What does WPA2-Enterprise use for authentication?
Answer: RADIUS Server
WPA2-Enterprise uses a RADIUS server for authentication.
18. What is the purpose of channel selection in APs?
Answer: To avoid interference with other APs
Selecting the correct channel helps avoid interference and improves performance.
19. What does the term 'Hidden SSID' mean?
Answer: The SSID is not broadcasted
Hidden SSID means the AP does not broadcast its network name publicly.
20. Which AP feature helps extend wireless coverage?
Answer: Repeater Mode
Repeater Mode allows an AP to extend the coverage of another AP.
21. What is the role of 802.1X in wireless networking?
Answer: Provides port-based authentication
802.1X provides port-based network access control in wireless networks.
22. What does Band Steering in APs do?
Answer: Encourages devices to use the 5GHz band
Band Steering directs capable devices to the less congested 5GHz band.
23. Which frequency band has better range but lower speed?
Answer: 2.4GHz
2.4GHz provides longer range but lower speed compared to 5GHz.
24. What is the primary purpose of a Guest Wi-Fi network on APs?
Answer: To allow visitors secure internet access without exposing internal network
Guest Wi-Fi isolates visitors from internal resources while still providing internet.
25. What is Wi-Fi 6E's key improvement over Wi-Fi 6?
Answer: Adds 6GHz frequency band
Wi-Fi 6E introduces the 6GHz frequency band for higher performance and less interference.
IPv4 Addressing (25 cards)
1. What does IPv4 stand for?
Answer: Internet Protocol version 4
IPv4 stands for Internet Protocol version 4, the fourth version of the Internet Protocol.
2. How many bits are used in an IPv4 address?
Answer: 32 bits
An IPv4 address uses 32 bits, usually shown as four decimal numbers separated by dots.
3. How many total IPv4 addresses are possible?
Answer: 2^32
IPv4 allows approximately 4.3 billion (2^32) unique addresses.
4. Which notation is used to write IPv4 addresses?
Answer: Dotted decimal
IPv4 addresses are usually written in dotted decimal notation (e.g., 192.168.1.1).
5. What is the default subnet mask for a Class A IPv4 address?
Answer: 255.0.0.0
Class A addresses use a default subnet mask of 255.0.0.0.
6. Which class does the IP 172.16.0.1 belong to?
Answer: Class B
172.16.0.1 falls within Class B address range (128.0.0.0 to 191.255.255.255).
7. What is the loopback IPv4 address?
Answer: 127.0.0.1
127.0.0.1 is the loopback address used for testing on the local machine.
8. Which IP address class supports the most hosts?
Answer: Class A
Class A networks support the most hosts because they allocate 24 bits for host addresses.
9. What is the range of Class C IPv4 addresses?
Answer: 192.0.0.0 - 223.255.255.255
Class C addresses range from 192.0.0.0 to 223.255.255.255.
10. What does the address 0.0.0.0 represent?
Answer: Unspecified address
0.0.0.0 represents an unspecified address or default in routing tables.
11. What is the broadcast address for 192.168.1.0/24?
Answer: 192.168.1.255
192.168.1.255 is the broadcast address for the 192.168.1.0/24 network.
12. Which protocol translates domain names to IP addresses?
Answer: DNS
DNS translates domain names into IP addresses.
13. Which protocol assigns IP addresses automatically?
Answer: DHCP
DHCP automatically assigns IP addresses to devices.
14. Which command shows your computer's IPv4 configuration?
Answer: ipconfig
The 'ipconfig' command (Windows) shows IP configuration.
15. Which special IPv4 range is reserved for private networks?
Answer: 10.0.0.0/8
Private ranges are 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16.
16. What is the APIPA IPv4 range?
Answer: 169.254.0.0/16
169.254.0.0/16 is the Automatic Private IP Addressing (APIPA) range.
17. What is the purpose of a subnet mask?
Answer: To divide networks into subnets
A subnet mask divides an IP address into network and host portions.
18. Which address is used to communicate with all devices on a subnet?
Answer: Broadcast address
Broadcast addresses send packets to all hosts on the same subnet.
19. Which address is used by one device to talk to another device?
Answer: Unicast
Unicast addresses are used for one-to-one communication.
20. Which protocol is used to resolve IP addresses to MAC addresses?
Answer: ARP
ARP resolves IP addresses to MAC addresses on a LAN.
21. What is CIDR in IPv4?
Answer: Classless Inter-Domain Routing
CIDR (Classless Inter-Domain Routing) replaces classful addressing with prefix notation like /24.
22. What does 192.168.1.1 usually represent?
Answer: Default gateway
192.168.1.1 is often used as the default gateway in home networks.
23. What is the maximum number of hosts in a /24 subnet?
Answer: 254
A /24 subnet allows 256 addresses, 2 reserved (network + broadcast), leaving 254 usable hosts.
24. Which IP address range is reserved for multicast?
Answer: 224.0.0.0 - 239.255.255.255
224.0.0.0 to 239.255.255.255 is reserved for multicast traffic.
25. Which IPv4 address is reserved for experimental use?
Answer: 240.0.0.0/4
240.0.0.0/4 is reserved for experimental purposes.
IPv6 Addressing (25 cards)
1. What does IPv6 stand for?
Answer: Internet Protocol version 6
IPv6 stands for Internet Protocol version 6, the successor to IPv4.
2. How many bits are used in an IPv6 address?
Answer: 128 bits
An IPv6 address uses 128 bits, allowing a vastly larger address space.
3. How many possible IPv6 addresses exist?
Answer: 2^128
IPv6 provides 2^128 possible addresses, approximately 340 undecillion.
4. Which notation is used for IPv6 addresses?
Answer: Hexadecimal with colons
IPv6 addresses are written in hexadecimal and separated by colons (e.g., 2001:db8::1).
5. What is the IPv6 loopback address?
Answer: ::1
::1 is the IPv6 loopback address, equivalent to 127.0.0.1 in IPv4.
6. What does a double colon (::) represent in IPv6?
Answer: Compression of consecutive zeros
:: is used to compress consecutive groups of zeros in an IPv6 address.
7. What is the unspecified IPv6 address?
Answer: ::
:: represents the unspecified address, used before an interface is assigned an address.
8. Which IPv6 address type is equivalent to IPv4 private addresses?
Answer: Unique Local
Unique Local Addresses (fc00::/7) are similar to IPv4 private addresses.
9. Which prefix is reserved for IPv6 link-local addresses?
Answer: fe80::/10
fe80::/10 is reserved for link-local addresses, automatically assigned to interfaces.
10. Which prefix is reserved for IPv6 multicast addresses?
Answer: ff00::/8
ff00::/8 is reserved for multicast addresses in IPv6.
11. Which IPv6 address type identifies the nearest node among many?
Answer: Anycast
Anycast addresses deliver packets to the nearest node in a group.
12. What is the global unicast IPv6 address range?
Answer: 2000::/3
2000::/3 is used for global unicast addresses (equivalent to public IPv4 addresses).
13. Does IPv6 support broadcast addresses?
Answer: No
IPv6 does not support broadcast. It uses multicast and anycast instead.
14. Which IPv6 address is reserved for documentation and examples?
Answer: 2001:db8::/32
2001:db8::/32 is reserved for documentation and examples.
15. Which protocol is used by IPv6 instead of ARP?
Answer: NDP
Neighbor Discovery Protocol (NDP) replaces ARP in IPv6.
16. Which protocol assigns IPv6 addresses automatically?
Answer: DHCPv6
DHCPv6 automatically assigns IPv6 addresses, similar to DHCP for IPv4.
17. What is SLAAC in IPv6?
Answer: Stateless Address Autoconfiguration
SLAAC (Stateless Address Autoconfiguration) allows devices to configure their IPv6 addresses automatically without DHCP.
18. Which protocol does IPv6 rely on for error reporting and diagnostics?
Answer: ICMPv6
ICMPv6 is used in IPv6 for error messages and diagnostic functions like ping.
19. Which IPv6 address corresponds to an IPv4-mapped address?
Answer: ::ffff:IPv4
IPv4-mapped addresses use the ::ffff: prefix (e.g., ::ffff:192.168.1.1).
20. Which is the prefix for IPv6 multicast addresses?
Answer: ff00::/8
IPv6 multicast addresses always begin with ff00::/8.
21. What is the maximum number of hex blocks in an IPv6 address?
Answer: 8
An IPv6 address consists of 8 groups of 16-bit hexadecimal numbers.
22. How many characters are there in a full IPv6 address (without compression)?
Answer: 39
A full IPv6 address has 39 characters (8 groups of 4 hex digits plus 7 colons).
23. Which IPv6 range is equivalent to IPv4 APIPA (169.254.0.0/16)?
Answer: fe80::/10
Link-local addresses (fe80::/10) are automatically assigned like APIPA in IPv4.
24. Which type of IPv6 address starts with 'fc00' or 'fd00'?
Answer: Unique Local Address
fc00::/7 defines Unique Local Addresses (ULAs) for private use.
25. What is the IPv6 address compression rule?
Answer: Remove leading zeros and use :: for consecutive zeros
IPv6 allows compression by removing leading zeros and replacing consecutive zeros with :: (once per address).
Subnetting (25 cards)
1. What is subnetting?
Answer: Dividing a network into smaller networks
Subnetting is the process of dividing a large network into smaller, more manageable sub-networks.
2. What is the main purpose of subnetting?
Answer: Reduce broadcast traffic and improve management
Subnetting reduces broadcast domains, improves performance, and enhances network management.
3. How many bits are in an IPv4 address?
Answer: 32
IPv4 addresses are 32 bits long.
4. What is the subnet mask for a /24 network?
Answer: 255.255.255.0
A /24 subnet mask is 255.255.255.0, giving 256 IP addresses.
5. How many host addresses are available in a /30 network?
Answer: 2
A /30 provides 4 total addresses, but 2 usable (network & broadcast excluded).
6. What does CIDR stand for?
Answer: Classless Inter-Domain Routing
CIDR (Classless Inter-Domain Routing) allows flexible allocation of IP addresses using prefix length.
7. What is the usable host formula in subnetting?
Answer: 2^n - 2
Usable hosts per subnet = 2^n - 2, where n = number of host bits.
8. How many usable hosts are in a /29 network?
Answer: 6
A /29 provides 8 addresses, 6 usable for hosts.
9. Which subnet mask corresponds to /26?
Answer: 255.255.255.192
A /26 prefix equals 255.255.255.192.
10. What is the number of usable hosts in a /28 subnet?
Answer: 14
A /28 provides 16 addresses, with 14 usable hosts.
11. How many subnets can be created with a /27 mask?
Answer: 8
A /27 uses 3 extra subnet bits, so 2^3 = 8 subnets.
12. Which classful network has a default mask of 255.255.0.0?
Answer: Class B
Class B networks use a default mask of 255.255.0.0 (/16).
13. How many host bits are there in a /20 network?
Answer: 12
/20 means 32-20 = 12 host bits.
14. What is the broadcast address of subnet 192.168.10.0/26?
Answer: 192.168.10.63
A /26 has 64 addresses. Broadcast = 192.168.10.63.
15. What is the first usable host in 10.0.0.0/30?
Answer: 10.0.0.1
In a /30, network is .0, broadcast is .3, so first usable is .1.
16. How many usable hosts in a /23 network?
Answer: 510
A /23 provides 512 addresses, 510 usable.
17. Which subnet mask allows exactly 2 usable hosts?
Answer: /30
/30 provides 4 addresses, 2 usable hosts.
18. What is the usable host count of a /32 address?
Answer: 0
/32 represents a single host, so no usable host addresses.
19. Which subnet mask corresponds to 62 usable hosts?
Answer: /26
A /26 provides 64 addresses, 62 usable hosts.
20. Which IPv4 private range is defined in RFC 1918?
Answer: All of these
All three ranges are defined as private in RFC 1918.
21. How many usable hosts are in a /21 network?
Answer: 1022
A /21 has 2048 addresses, 1022 usable hosts.
22. Which subnet mask gives exactly 14 usable hosts?
Answer: /28
/28 provides 16 addresses, 14 usable hosts.
23. What is the network address of 192.168.5.77/27?
Answer: 192.168.5.64
/27 blocks = 32. Closest lower multiple to 77 is 64, so network is 192.168.5.64.
24. How many subnets can you create with a /24 broken into /28?
Answer: 16
/24 to /28 means 4 more subnet bits (2^4=16 subnets).
25. What is VLSM?
Answer: Variable Length Subnet Masking
VLSM (Variable Length Subnet Masking) allows using different subnet masks within the same network.
DHCP (25 cards)
1. What does DORA stand for in the DHCP process?
Answer: Discover, Offer, Request, Acknowledge
DORA is the four-step DHCP process: Discover (client broadcast), Offer (server responds), Request (client asks for IP), Acknowledge (server confirms).
2. Which port does a DHCP server listen on?
Answer: 67
DHCP servers listen on UDP port 67. Clients use UDP port 68 to send and receive messages.
3. What address does a DHCP Discover packet use as the destination?
Answer: 255.255.255.255
DHCP Discover is sent to the limited broadcast address 255.255.255.255 because the client has no IP yet.
4. Which Cisco IOS command configures a DHCP relay agent?
Answer: ip helper-address
'ip helper-address [server-IP]' is configured on the router interface facing clients to forward DHCP broadcasts to a remote server.
5. What is the purpose of a DHCP lease?
Answer: Defines how long an IP address is assigned
A DHCP lease specifies the duration for which a client may use an assigned IP address before it must renew.
6. Which command excludes addresses from a DHCP pool on Cisco IOS?
Answer: ip dhcp excluded-address
'ip dhcp excluded-address [start] [end]' prevents the router from assigning those IPs to clients.
7. What does a DHCP server send when it has no available addresses?
Answer: DHCP NAK
A DHCP NAK (Negative Acknowledgement) is sent when the server cannot fulfill a request, such as when the pool is exhausted.
8. Which DHCP message does a client send when it no longer needs its IP?
Answer: DHCP Release
DHCP Release is sent by a client to notify the server that it is giving back the leased IP address.
9. What is APIPA and when is it assigned?
Answer: 169.254.x.x — assigned when DHCP fails
APIPA (Automatic Private IP Addressing) assigns a 169.254.0.0/16 address when a DHCP server is unreachable, allowing limited local communication.
10. What is the default DHCP lease time on Cisco IOS?
Answer: 1 day
The default DHCP lease time on Cisco IOS is 1 day (86400 seconds).
11. Which command verifies active DHCP leases on a Cisco router?
Answer: show ip dhcp binding
'show ip dhcp binding' displays all active IP-to-MAC address bindings currently leased from the DHCP server.
12. What is DHCP snooping?
Answer: A security feature that filters rogue DHCP servers
DHCP snooping is a Layer 2 security feature on switches that only allows DHCP offers from trusted ports, blocking rogue DHCP servers.
13. Which DHCP option carries the default gateway IP to clients?
Answer: Option 3
DHCP Option 3 (Router) provides the default gateway IP address to clients.
14. Which DHCP option carries the DNS server IP?
Answer: Option 6
DHCP Option 6 (Domain Name Server) provides the IP address(es) of DNS servers to clients.
15. What happens during a DHCP renewal?
Answer: Client contacts server at 50% of lease to renew
At 50% of the lease time (T1), the client sends a unicast DHCP Request to the original server to renew the lease without going through the full DORA process.
16. What is the source IP of a DHCP Discover packet?
Answer: 0.0.0.0
A DHCP Discover is sourced from 0.0.0.0 because the client does not yet have an IP address.
17. What is a DHCP conflict and how is it detected?
Answer: A duplicate IP detected by ping probe before assignment
A DHCP conflict occurs when an IP about to be assigned is already in use. Cisco routers send a ping before assignment — if it gets a reply, the address is marked as conflicted and skipped.
18. Which command shows DHCP conflicts on a Cisco router?
Answer: show ip dhcp conflict
'show ip dhcp conflict' lists all IP addresses that were detected as already in use during conflict detection.
19. What is DHCPv6 used for?
Answer: Assign IPv6 addresses dynamically
DHCPv6 provides dynamic IPv6 address assignment and configuration, similar to DHCP for IPv4.
20. What is SLAAC in IPv6?
Answer: Stateless Address Autoconfiguration
SLAAC allows IPv6 hosts to auto-configure their own address using the network prefix from Router Advertisements without a DHCPv6 server.
21. Which port does a DHCP client use?
Answer: 68
DHCP clients send and receive messages on UDP port 68.
22. What is a DHCP scope?
Answer: A range of IP addresses a server can assign
A DHCP scope (pool) defines the range of IP addresses available for dynamic assignment, along with options like gateway and DNS.
23. Which protocol is used for DHCP failover between two servers?
Answer: DHCPv4 failover protocol
The DHCPv4 failover protocol allows two DHCP servers to share lease information and provide redundancy.
24. What Cisco command creates a DHCP pool named VLAN10?
Answer: ip dhcp pool VLAN10
'ip dhcp pool VLAN10' enters the DHCP pool configuration mode for a pool named VLAN10.
25. What does 'network 192.168.10.0 255.255.255.0' do in a DHCP pool?
Answer: Defines the subnet from which addresses are assigned
The 'network' command in a DHCP pool defines the subnet and mask from which the server will assign IP addresses.
DNS (25 cards)
1. What does DNS stand for?
Answer: Domain Name System
DNS (Domain Name System) translates human-readable domain names into IP addresses that computers use.
2. Which DNS record maps a hostname to an IPv4 address?
Answer: A record
An A record (Address record) maps a domain name to its IPv4 address.
3. Which DNS record maps a hostname to an IPv6 address?
Answer: AAAA record
A AAAA record maps a domain name to its IPv6 address (128 bits).
4. What is the default port number for DNS?
Answer: 53
DNS uses port 53 for both UDP (standard queries) and TCP (zone transfers and large responses).
5. Which DNS record type is used for mail servers?
Answer: MX
MX (Mail Exchange) records specify the mail servers responsible for receiving email for a domain.
6. What is a CNAME record?
Answer: An alias that points one name to another
A CNAME (Canonical Name) record creates an alias pointing one domain name to another, allowing multiple names to resolve to the same IP.
7. What is a PTR record used for?
Answer: Reverse DNS lookup — IP to hostname
A PTR (Pointer) record maps an IP address back to a hostname, used for reverse DNS lookups.
8. What is an NS record?
Answer: Identifies the authoritative name server for a domain
NS (Name Server) records identify which DNS servers are authoritative for a domain.
9. What is a DNS resolver?
Answer: A client-side service that queries DNS servers
A DNS resolver is a client-side component (often in the OS) that queries DNS servers to resolve domain names on behalf of applications.
10. What is a recursive DNS query?
Answer: Resolver does all the work and returns a final answer
In a recursive query, the DNS resolver contacts other servers as needed and returns the final answer to the client rather than giving referrals.
11. What is DNS TTL?
Answer: Time To Live — how long a record is cached
TTL (Time To Live) specifies how long a DNS response can be cached by resolvers before they must query the authoritative server again.
12. What is a DNS zone transfer?
Answer: Replication of DNS zone data between servers
A zone transfer copies DNS zone data from a primary server to a secondary server for redundancy, using TCP port 53.
13. Which command tests DNS resolution on Windows and Linux?
Answer: nslookup
'nslookup' queries DNS servers to resolve names or IPs and is available on both Windows and Linux.
14. What is a root DNS server?
Answer: Top-level server that knows TLD name server locations
Root DNS servers are the top of the DNS hierarchy. There are 13 root server addresses (A–M) that know where the TLD (.com, .net, .org) name servers are.
15. What is a TLD in DNS?
Answer: Top-Level Domain — like .com or .org
A TLD (Top-Level Domain) is the last part of a domain name (.com, .net, .org, .gov). TLD servers know which authoritative servers hold records for second-level domains.
16. What is DNS caching poisoning (cache poisoning)?
Answer: Injecting false DNS records into a resolver cache
DNS cache poisoning injects false DNS records into a resolver's cache, causing clients to be redirected to malicious IP addresses when they look up legitimate domains.
17. Which Cisco IOS command sets the DNS server for the router?
Answer: ip name-server
'ip name-server [IP]' configures the DNS server that the Cisco router uses for hostname resolution.
18. Which Cisco IOS command enables DNS lookups?
Answer: ip domain-lookup
'ip domain-lookup' enables the router to resolve hostnames using DNS. It is enabled by default but can be disabled with 'no ip domain-lookup'.
19. What is a forward lookup zone?
Answer: Maps hostnames to IP addresses
A forward lookup zone contains records that resolve hostnames to IP addresses — the most common DNS lookup direction.
20. What is a reverse lookup zone?
Answer: Maps IP addresses to hostnames
A reverse lookup zone contains PTR records that map IP addresses back to hostnames.
21. What does DNSSEC provide?
Answer: Digital signatures to verify DNS responses
DNSSEC (DNS Security Extensions) adds cryptographic signatures to DNS records, allowing resolvers to verify that responses haven't been tampered with.
22. What is DoH (DNS over HTTPS)?
Answer: DNS queries sent over HTTPS to prevent eavesdropping
DNS over HTTPS (DoH) sends DNS queries encrypted inside HTTPS connections (port 443), preventing eavesdropping and manipulation of DNS traffic.
23. What is a secondary DNS server?
Answer: A read-only copy of a DNS zone for redundancy
A secondary DNS server holds a read-only copy of the zone data received via zone transfer from the primary server, providing redundancy.
24. What is DNS round robin?
Answer: Multiple A records for load balancing across servers
DNS round robin returns multiple A records for the same hostname in rotating order, distributing client connections across multiple servers.
25. Which dig command shows the full DNS query and response?
Answer: dig example.com ANY
'dig example.com ANY' requests all available DNS record types for a domain and shows the full query/response details including TTL and authoritative info.
OSPF (25 cards)
1. What does OSPF stand for?
Answer: Open Shortest Path First
OSPF (Open Shortest Path First) is a link-state routing protocol that uses Dijkstra's algorithm to calculate the shortest path.
2. What metric does OSPF use to select the best route?
Answer: Cost (based on bandwidth)
OSPF uses cost as its metric, calculated as 100 Mbps / interface bandwidth. Lower cost = preferred path.
3. What is the OSPF hello interval on broadcast networks?
Answer: 10 seconds
The default OSPF hello interval on broadcast and point-to-point networks is 10 seconds.
4. What is the OSPF dead interval on broadcast networks?
Answer: 40 seconds
The default OSPF dead interval is 4x the hello interval = 40 seconds. If no hello is received within 40 seconds, the neighbour is declared dead.
5. Which OSPF neighbour state indicates full adjacency?
Answer: FULL
The FULL state means two OSPF routers have exchanged their complete LSDBs and are fully adjacent.
6. What is a Designated Router (DR) in OSPF?
Answer: The router elected to represent the broadcast segment
On multi-access networks, the DR reduces LSA flooding by acting as the central point for LSDB synchronisation. All routers form full adjacency with the DR.
7. What determines the OSPF router ID?
Answer: Highest loopback IP, then highest active interface IP
OSPF router ID is selected in order: manually configured > highest loopback IP > highest active interface IP.
8. Which command verifies OSPF neighbour adjacency on Cisco IOS?
Answer: show ip ospf neighbor
'show ip ospf neighbor' displays all OSPF neighbours, their states, dead time, and interfaces.
9. What is OSPF Area 0?
Answer: The backbone area — all other areas must connect to it
Area 0 is the OSPF backbone. All non-backbone areas must connect to Area 0 either directly or through a virtual link.
10. What is an ABR in OSPF?
Answer: Area Border Router — connects two OSPF areas
An ABR (Area Border Router) connects two or more OSPF areas and maintains a separate LSDB for each area.
11. Which LSA type describes routes within an area?
Answer: Type 1 (Router LSA)
Type 1 Router LSAs are generated by every router and describe the router's links within an OSPF area.
12. What is OSPF route redistribution?
Answer: Injecting routes from another protocol into OSPF
Redistribution imports routes from other protocols (static, EIGRP, BGP) into OSPF so they can be advertised throughout the OSPF domain.
13. What OSPF state comes just before FULL?
Answer: LOADING
In the LOADING state, the router is requesting missing LSAs from its neighbour. After receiving all LSAs, it moves to FULL.
14. What is the OSPF cost of a FastEthernet interface (100 Mbps)?
Answer: 1
OSPF cost = 100,000,000 / bandwidth in bps. For FastEthernet (100 Mbps): 100,000,000 / 100,000,000 = 1.
15. Which command enables OSPF and assigns a process ID?
Answer: router ospf 1
'router ospf [process-id]' enables OSPF on the router. The process ID is locally significant and does not need to match neighbours.
16. What does the 'network' command do in OSPF?
Answer: Specifies which interfaces participate in OSPF
The OSPF 'network [address] [wildcard] area [id]' command activates OSPF on interfaces whose IP addresses fall within the specified range.
17. What is a passive interface in OSPF?
Answer: An interface that does not send OSPF hellos but advertises the network
A passive interface suppresses OSPF hello packets on that interface while still advertising its connected network into OSPF. Used on LAN interfaces facing end users.
18. What command makes Gi0/1 passive in OSPF?
Answer: passive-interface GigabitEthernet0/1
Under 'router ospf', the command 'passive-interface GigabitEthernet0/1' stops hello packets on that interface while keeping it in OSPF.
19. What causes OSPF neighbours to be stuck in EXSTART?
Answer: MTU mismatch between the two interfaces
OSPF stalls in EXSTART/EXCHANGE when there is an MTU mismatch. One router sends DBD packets that exceed the neighbour's MTU, causing them to be dropped.
20. What is an OSPF virtual link?
Answer: A tunnel connecting a non-backbone area to Area 0 through a transit area
A virtual link is used when an area cannot connect directly to Area 0. It creates a logical connection through a transit area to maintain Area 0 connectivity.
21. What is route summarisation in OSPF?
Answer: Combining multiple routes into one advertisement at an ABR
Route summarisation at an ABR condenses multiple specific routes into one summary advertisement sent to other areas, reducing LSDB size.
22. Which show command lists all OSPF-learned routes?
Answer: show ip route ospf
'show ip route ospf' filters the routing table to show only routes learned via OSPF, identified by the letter O.
23. What is the OSPF network type on a serial point-to-point link?
Answer: Point-to-point
Serial links default to point-to-point OSPF network type. No DR/BDR election occurs and adjacency forms directly between the two routers.
24. What is the Administrative Distance of OSPF?
Answer: 110
OSPF has an Administrative Distance of 110, making it less preferred than EIGRP (90) but more preferred than RIP (120).
25. Which OSPFv3 feature differs from OSPFv2?
Answer: OSPFv3 supports IPv6 and uses link-local addresses for hellos
OSPFv3 is OSPFv2 adapted for IPv6. Key differences: uses link-local addresses for hello/updates, IPv6 addresses in LSAs, and per-link rather than per-subnet operation.
NAT / PAT (25 cards)
1. What does NAT stand for?
Answer: Network Address Translation
NAT (Network Address Translation) translates private IP addresses to public IPs, enabling internet communication from private networks.
2. What is the difference between NAT and PAT?
Answer: PAT maps many private IPs to one public IP using port numbers
PAT (Port Address Translation) is a type of NAT that maps multiple private IP addresses to a single public IP using unique source port numbers to track sessions.
3. What is Static NAT?
Answer: One-to-one permanent mapping of private to public IP
Static NAT creates a permanent one-to-one mapping between a private IP and a public IP, commonly used for servers that need a fixed public address.
4. What is Dynamic NAT?
Answer: Maps private IPs to a pool of public IPs as needed
Dynamic NAT assigns public IP addresses from a pool on a first-come, first-served basis. The mapping exists only while the session is active.
5. What is PAT also called?
Answer: NAT overload
PAT is also called NAT overload because it allows hundreds of private IP addresses to share a single public IP by overloading port numbers.
6. Which interface is the 'ip nat inside' interface?
Answer: The interface facing internal private hosts
'ip nat inside' is applied to the interface connected to the private network. 'ip nat outside' is applied to the interface facing the internet.
7. How many public IP addresses does PAT require at minimum?
Answer: 1
PAT requires only one public IP address to support thousands of simultaneous private sessions by using unique source port numbers.
8. Which command verifies NAT translations on Cisco IOS?
Answer: show ip nat translations
'show ip nat translations' displays the current NAT/PAT translation table showing inside local, inside global, outside local, and outside global addresses.
9. What is Inside Local in NAT terminology?
Answer: Private IP of the internal host
Inside Local is the private IP address of the internal host as it appears before translation.
10. What is Inside Global in NAT terminology?
Answer: Public IP representing the internal host after translation
Inside Global is the public (translated) IP address that represents the internal host to the outside world after NAT.
11. Which command clears all NAT translation entries?
Answer: clear ip nat translation *
'clear ip nat translation *' removes all dynamic NAT/PAT entries from the translation table. Static entries must be removed by reconfiguring.
12. What Cisco command enables PAT using the outside interface IP?
Answer: ip nat inside source list 1 interface Gi0/0 overload
The 'overload' keyword at the end of the 'ip nat inside source' command enables PAT, using the outside interface's IP for all translations.
13. What ACL is used in a NAT configuration?
Answer: Defines which inside hosts are translated
A standard ACL used in NAT defines which source IP addresses on the inside network should be translated.
14. What is a NAT pool?
Answer: A range of public IP addresses for dynamic NAT
A NAT pool defines a range of public IP addresses that the router can use for dynamic NAT assignments.
15. What problem does NAT create for IPsec VPNs?
Answer: NAT changes IP headers, breaking IPsec authentication
IPsec uses AH/ESP which authenticate the entire IP packet. NAT modifies the source IP, breaking the authentication hash. NAT-Traversal (NAT-T) encapsulates IPsec in UDP 4500 to solve this.
16. What does NAT-T (NAT Traversal) do?
Answer: Encapsulates IPsec in UDP to pass through NAT
NAT-T wraps IPsec ESP packets inside UDP port 4500 packets, allowing them to traverse NAT devices without breaking the IPsec authentication.
17. Which protocol translation allows IPv6 hosts to communicate with IPv4?
Answer: NAT64
NAT64 translates between IPv6 and IPv4 addresses, allowing IPv6-only hosts to communicate with IPv4-only servers.
18. What is Twice NAT?
Answer: Both source and destination addresses are translated
Twice NAT (bidirectional NAT) translates both the source and destination addresses in a packet, used when both inside and outside address spaces overlap.
19. What is a hairpin NAT issue?
Answer: Internal hosts cannot reach internal servers using the public IP
Hairpin NAT (or NAT loopback) issues occur when an internal host tries to reach an internal server using its public IP. Some NAT implementations don't support this without specific configuration.
20. What is Port Forwarding?
Answer: Maps an external port to an internal host's port
Port forwarding (a form of static NAT) maps an external IP:port to an internal host's private IP:port, allowing external access to internal services.
21. Which command shows NAT statistics on Cisco IOS?
Answer: show ip nat statistics
'show ip nat statistics' shows NAT hit/miss counters, number of translations, and interface designations for inside/outside.
22. What is the NAT timeout for TCP sessions by default on Cisco IOS?
Answer: 24 hours
The default NAT TCP translation timeout on Cisco IOS is 24 hours (86400 seconds). UDP timeout is 5 minutes.
23. Why would a NAT translation show 'outside local = outside global'?
Answer: The outside (public) address is not being translated
When outside local = outside global, the destination address is not being translated — only the source (inside) address is being NATted, which is the normal case.
24. What does 'ip nat inside source static' configure?
Answer: A permanent one-to-one static NAT mapping
'ip nat inside source static [inside-local] [inside-global]' creates a permanent static NAT mapping from a private IP to a public IP.
25. What is the purpose of NAT in private networks?
Answer: Conserve public IPv4 addresses and provide security
NAT conserves the limited pool of public IPv4 addresses by allowing many private hosts to share one or more public IPs, and also hides internal IP structure.
Security & ACLs (25 cards)
1. What does ACL stand for?
Answer: Access Control List
An ACL (Access Control List) is a set of rules that permit or deny traffic based on matching criteria like source/destination IP, port, or protocol.
2. What is the difference between standard and extended ACLs?
Answer: Standard filters by source IP only; extended filters by source, destination, port, and protocol
Standard ACLs match only on source IP address. Extended ACLs can match source IP, destination IP, protocol, and port numbers — much more granular.
3. Where should a standard ACL be applied?
Answer: Close to the destination
Standard ACLs should be placed close to the destination because they filter only on source IP and applying them near the source could block traffic unnecessarily.
4. Where should an extended ACL be applied?
Answer: Close to the source
Extended ACLs should be applied close to the source to block unwanted traffic as early as possible, saving bandwidth on the path to the destination.
5. What does a wildcard mask of 0.0.0.255 match?
Answer: Any host in a /24 subnet
A wildcard mask of 0.0.0.255 matches any value in the last octet — effectively matching all 256 hosts in a /24 subnet.
6. What wildcard mask matches exactly one host?
Answer: 0.0.0.0
A wildcard mask of 0.0.0.0 means every bit must match exactly — it matches only one specific IP address (a single host).
7. What is the implicit rule at the end of every Cisco ACL?
Answer: deny any any
Every Cisco ACL ends with an implicit 'deny any any' rule. Any traffic not explicitly permitted by a rule is dropped by default.
8. Which command applies an ACL to an interface in the inbound direction?
Answer: ip access-group [name] in
'ip access-group [ACL-name/number] in' applies the ACL to inbound traffic on the interface. 'out' applies it to outbound traffic.
9. What is port security on a Cisco switch?
Answer: Limits the number of MAC addresses per port
Port security restricts which MAC addresses can communicate on a switch port. It can limit the number of MACs and take action (shutdown/restrict/protect) when violated.
10. What does 'sticky MAC' do in port security?
Answer: Dynamically learns and saves MAC addresses to running-config
Sticky MAC learning dynamically learns MAC addresses and stores them as secure static entries in the running config, persisting across reboots if saved.
11. What are the three port security violation modes?
Answer: Shutdown, Restrict, Protect
Shutdown: err-disables the port. Restrict: drops frames and increments violation counter. Protect: drops frames silently with no logging or counter increment.
12. What is 802.1X?
Answer: Port-based network access control using authentication
802.1X is an IEEE standard for port-based Network Access Control. Devices must authenticate via RADIUS/TACACS+ before being granted network access.
13. What is AAA in network security?
Answer: Authentication, Authorisation, Accounting
AAA is a security framework: Authentication (verify who you are), Authorisation (what you can do), Accounting (what you did).
14. What is the difference between RADIUS and TACACS+?
Answer: RADIUS encrypts only password; TACACS+ encrypts entire packet
RADIUS uses UDP, encrypts only the password, and combines authentication/authorisation. TACACS+ uses TCP, encrypts the entire payload, and separates authentication/authorisation/accounting.
15. What is DHCP snooping?
Answer: Blocks DHCP offers from untrusted switch ports
DHCP snooping is a Layer 2 security feature that marks switch ports as trusted or untrusted. Only trusted ports can forward DHCP Offer/Ack messages, blocking rogue DHCP servers.
16. What is Dynamic ARP Inspection (DAI)?
Answer: Validates ARP packets against the DHCP snooping binding table
DAI intercepts ARP packets on untrusted ports and verifies the IP-to-MAC mapping against the DHCP snooping binding table, blocking ARP spoofing attacks.
17. What command verifies an ACL on Cisco IOS?
Answer: show ip access-lists
'show ip access-lists' displays all IP ACLs configured on the router and shows match counters for each ACE (Access Control Entry).
18. What is a Zone-Based Firewall (ZBF) on Cisco IOS?
Answer: A stateful firewall that assigns interfaces to security zones
ZBF groups router interfaces into zones (e.g., inside, outside, DMZ). Traffic between zones is inspected by zone-pair policies, providing stateful firewall capabilities.
19. What is the purpose of a DMZ in network security?
Answer: A buffer network hosting public-facing servers
A DMZ (Demilitarised Zone) is a separate network segment that hosts public-facing servers. It is less trusted than the internal network but more trusted than the internet.
20. Which ACL number range is used for standard IP ACLs?
Answer: 1–99 and 1300–1999
Standard IP ACLs use numbers 1–99 and 1300–1999. Extended IP ACLs use 100–199 and 2000–2699.
21. Which ACL number range is used for extended IP ACLs?
Answer: 100–199 and 2000–2699
Extended IP ACLs use numbers 100–199 and 2000–2699. Named ACLs can also be used for extended ACLs without number limits.
22. What command shows port security status on a Cisco switch?
Answer: show port-security
'show port-security' displays port security configuration including the max MAC count, current count, violation mode, and violation count per interface.
23. What is SSH and why is it preferred over Telnet?
Answer: SSH encrypts all traffic; Telnet sends data in plaintext
SSH (Secure Shell) encrypts all management session traffic including passwords. Telnet sends all data including passwords in cleartext, making it insecure on shared networks.
24. What Cisco command generates RSA keys for SSH?
Answer: crypto key generate rsa
'crypto key generate rsa modulus 2048' generates the RSA key pair required for SSHv2 on Cisco IOS.
25. What is Control Plane Policing (CoPP)?
Answer: Rate-limits traffic destined for the router CPU
CoPP protects the router's CPU by rate-limiting or dropping control plane traffic (e.g., routing protocol packets, SNMP, SSH) to prevent DoS attacks on the management plane.
Troubleshooting (25 cards)
1. What does a dot (.) in Cisco ping output indicate?
Answer: Timeout — no reply received
A dot in ping output means the probe timed out — no reply was received within the timeout period. Could indicate the destination is unreachable or filtered.
2. What does 'U' in Cisco ping output indicate?
Answer: Destination unreachable — ICMP unreachable received
'U' in ping output means an ICMP Destination Unreachable message was received. This indicates a router knows the destination is unreachable and actively responded.
3. What does '!' in Cisco ping output indicate?
Answer: Successful reply received
'!' indicates a successful ICMP echo reply was received from the destination within the timeout period.
4. What is the OSI troubleshooting methodology?
Answer: Start at Layer 1 and work upward
The OSI methodology starts at Layer 1 (physical) and works up: fix lower layers before diagnosing upper layers, since faults at lower layers generate misleading symptoms at higher layers.
5. Which command shows interface error counters on Cisco IOS?
Answer: show interfaces
'show interfaces' displays input/output error counters including CRC errors, collisions, late collisions, interface resets, and runts/giants per interface.
6. What do incrementing CRC errors on an interface indicate?
Answer: Layer 1 problems — duplex mismatch, bad cable, or EMI
CRC errors indicate frames arriving with corrupted data. Common causes: duplex mismatch, faulty cable, bad NIC, or electromagnetic interference.
7. What do late collisions indicate on an Ethernet interface?
Answer: Duplex mismatch — one end is half-duplex
Late collisions (occurring after the first 64 bytes) are a strong indicator of a duplex mismatch. The half-duplex side uses CSMA/CD and detects collisions; the full-duplex side doesn't.
8. A switch port shows VLAN (Inactive). What is the cause?
Answer: The VLAN does not exist in the switch's VLAN database
A port assigned to a VLAN that doesn't exist in the VLAN database shows as Inactive. Fix: create the VLAN with 'vlan [id]' command.
9. What does an empty 'show interfaces trunk' output indicate?
Answer: No trunk links are active on the switch
An empty 'show interfaces trunk' means no trunk ports are currently in trunking mode. Check DTP mode: two dynamic-auto ports facing each other will never trunk.
10. Which OSPF neighbour state indicates a hello-level problem?
Answer: Init or missing from neighbor table
If a neighbour never appears or stays in Init, hello packets are not being received bilaterally. Common causes: area mismatch, authentication mismatch, passive-interface, or wrong 'network' statement.
11. Which OSPF state indicates an MTU mismatch?
Answer: EXSTART or EXCHANGE
OSPF stalls in EXSTART or EXCHANGE when there is an MTU mismatch. The DBD packets exceed the peer's MTU and are silently dropped.
12. What does 'show ip dhcp binding' help troubleshoot?
Answer: Whether DHCP clients are receiving addresses
'show ip dhcp binding' shows all active IP-to-MAC lease assignments. An empty table or missing client indicates the DHCP process isn't completing — check relay, pool, or server.
13. What is asymmetric routing and how does it appear in ping/traceroute?
Answer: Forward path works, return path broken — dots in both-direction ping
Asymmetric routing: packets reach the destination (forward path OK) but replies have no return route. Both-direction pings show dots. Traceroute shows clean hops then stops — the destination receives the probe but can't reply.
14. What does a routing loop look like in traceroute?
Answer: Same two or three IPs repeat for all 30 hops
A routing loop shows as alternating IPs in traceroute output (e.g., 10.0.0.1, 10.0.0.2, 10.0.0.1, 10.0.0.2...) repeating for all 30 TTL increments.
15. Which command is the fastest triage for interface health across an entire device?
Answer: show ip interface brief
'show ip interface brief' shows all interfaces and their up/down/admin-down status on one screen. It's the fastest way to identify which interfaces are down across the whole device.
16. What does 'administratively down' on an interface indicate?
Answer: The interface has been manually shut down
Administratively down means the interface has been manually disabled with the 'shutdown' command. Fix: 'no shutdown' in interface configuration mode.
17. What does 'up/down' (line protocol down) on an interface indicate?
Answer: Layer 1 is OK but Layer 2 keepalives are failing
Up/down means the physical layer is connected but Layer 2 cannot establish — common causes: wrong encapsulation, keepalive mismatch, or the other end is down.
18. Which command helps trace the exact path a packet takes?
Answer: traceroute
'traceroute' sends probes with incrementing TTL values. Each router that discards a packet due to TTL=0 sends back an ICMP Time Exceeded, revealing that hop's IP address.
19. What does 'debug ip dhcp server events' show?
Answer: DHCP Discover/Offer/Request/Ack messages being processed
'debug ip dhcp server events' shows real-time DHCP server processing — received Discovers, offers sent, requests received, and Acks sent. Essential for diagnosing why a client can't get an address.
20. What is the first thing to check when a client shows 169.254.x.x?
Answer: DHCP connectivity — Layer 2 path to DHCP server or relay
A 169.254.x.x (APIPA) address means the client failed to get a DHCP address. First check: is the Layer 2 path to the DHCP server or relay functioning? Check trunk, VLAN, and ip helper-address.
21. What does 'show ip nat translations' help troubleshoot?
Answer: Whether NAT is actively translating traffic
'show ip nat translations' shows active translation entries. An empty table means NAT isn't matching traffic — check the ACL, inside/outside interface designation, and ip nat inside source statement.
22. What command shows which ACL is applied to an interface?
Answer: show ip interface [interface]
'show ip interface [interface]' shows the ACL applied inbound and outbound on that interface, along with IP address and other Layer 3 information.
23. What does incrementing 'input errors' but no CRC errors indicate?
Answer: Runt frames or giants (frame size violations)
Input errors without CRC errors often indicate runt frames (less than 64 bytes) or giants (more than 1518 bytes). Runts can be caused by collisions; giants by MTU mismatches.
24. What is the structured troubleshooting document an engineer should maintain?
Answer: A change log recording every command run and result
Maintaining a change log during troubleshooting records each action taken and its result. This prevents circular troubleshooting, provides an audit trail, and documents the root cause for future reference.
25. Which command shows all CDP neighbours on a Cisco device?
Answer: show cdp neighbors detail
'show cdp neighbors detail' shows all directly connected Cisco devices including their platform, IP address, IOS version, and interface connections — invaluable for topology mapping.
Network Services (25 cards)
1. What does SNMP stand for?
Answer: Simple Network Management Protocol
SNMP (Simple Network Management Protocol) is used for monitoring and managing network devices by collecting performance data and sending alerts.
2. What are the three SNMP versions and their key difference?
Answer: v1/v2c use community strings; v3 adds encryption and authentication
SNMPv1 and v2c use community strings (essentially passwords in cleartext). SNMPv3 adds three security features: authentication (MD5/SHA), encryption (DES/AES), and access control.
3. What is an SNMP community string?
Answer: A password-like string that controls access to SNMP data
A community string is used in SNMPv1/v2c for authentication. 'public' (read-only) and 'private' (read-write) are common defaults — change these for security.
4. What is an SNMP trap?
Answer: An unsolicited alert from a device to the NMS
An SNMP trap is an unsolicited message sent by a network device to the NMS when a significant event occurs (e.g., link down, threshold exceeded).
5. On which port does SNMP operate?
Answer: UDP 161 for queries, UDP 162 for traps
SNMP uses UDP port 161 for management queries (get/set) and UDP port 162 for traps sent from devices to the SNMP manager.
6. What is syslog used for?
Answer: Centralised logging of device events and messages
Syslog collects and forwards log messages from network devices to a central syslog server for monitoring, troubleshooting, and compliance.
7. What is syslog severity level 0?
Answer: Emergency — system unusable
Severity 0 (Emergency) is the highest severity — the system is unusable. Levels go from 0 (Emergency) to 7 (Debug), with lower numbers being more severe.
8. What is syslog severity level 7?
Answer: Debug — detailed diagnostic information
Severity 7 (Debug) provides detailed diagnostic messages. In production, logging is usually set to level 6 (Informational) or lower to avoid excessive log volume.
9. What syslog severity level indicates an interface going down?
Answer: 5 — Notice
Interface state changes (up/down) are typically logged at severity 5 (Notice), indicating a normal but significant event.
10. Which Cisco command sends syslog messages to a remote server?
Answer: logging host [IP]
'logging host [server-IP]' configures the Cisco device to send syslog messages to the specified remote syslog server.
11. What does NTP stand for?
Answer: Network Time Protocol
NTP (Network Time Protocol) synchronises clocks across network devices, ensuring accurate timestamps for logs, certificates, and time-sensitive protocols.
12. On which port does NTP operate?
Answer: UDP 123
NTP uses UDP port 123 for time synchronisation between clients and servers.
13. What is an NTP stratum?
Answer: A measure of distance from the reference clock
NTP stratum indicates distance from the reference clock. Stratum 1 is directly connected to an atomic clock. Stratum 2 syncs from stratum 1, and so on. Lower = more accurate.
14. Which Cisco command sets NTP server on a device?
Answer: ntp server [IP]
'ntp server [server-IP]' configures the device to synchronise its clock from the specified NTP server.
15. What is NetFlow?
Answer: Collects IP traffic statistics for analysis
NetFlow records metadata about IP flows (source/dest IP, ports, protocol, bytes, packets) and exports it to a collector for traffic analysis, capacity planning, and security.
16. What is CDP (Cisco Discovery Protocol)?
Answer: A Cisco-proprietary Layer 2 protocol for device discovery
CDP is a Cisco-proprietary Layer 2 protocol that shares device information (hostname, model, IP, IOS version, interface) with directly connected Cisco devices.
17. What is LLDP?
Answer: Link Layer Discovery Protocol — open standard equivalent to CDP
LLDP (Link Layer Discovery Protocol) is the IEEE 802.1AB open standard equivalent of CDP. It works with non-Cisco devices and provides similar neighbour discovery capabilities.
18. Which command shows the NTP synchronisation status?
Answer: show ntp status
'show ntp status' displays whether the device is synchronised, the current stratum, reference clock, and polling interval.
19. What is SNMP MIB?
Answer: Management Information Base — database of managed objects
The MIB (Management Information Base) is a hierarchical database of all objects (interfaces, CPU, memory, routes) that can be queried or set via SNMP.
20. What is SNMP OID?
Answer: Object Identifier — unique number identifying a MIB object
An OID (Object Identifier) is a dotted-number string uniquely identifying each managed object in the MIB hierarchy (e.g., .1.3.6.1.2.1.1.1 = sysDescr).
21. What is IP SLA on Cisco IOS?
Answer: Measures network performance by sending test probes
IP SLA (Service Level Agreement) sends synthetic test probes (ping, jitter, HTTP, DNS) to measure real-time network performance and trigger events when thresholds are exceeded.
22. What Cisco command shows logging severity level currently set?
Answer: show logging
'show logging' displays the current logging configuration including the console, buffer, and remote syslog severity levels, as well as the recent log buffer contents.
23. What is the purpose of 'logging synchronous' on a VTY line?
Answer: Prevents log messages from interrupting typed commands
'logging synchronous' on a console or VTY line prevents syslog messages from interrupting the user's typed command, reprinting the current command after each log message.
24. What is EEM (Embedded Event Manager) on Cisco IOS?
Answer: An automation tool that responds to IOS events with CLI actions
EEM is a Cisco IOS automation framework that detects events (syslog messages, interface state changes, thresholds) and triggers CLI commands or scripts in response.
25. Which protocol provides out-of-band management access to network devices?
Answer: Console port / OOB management network
Out-of-band (OOB) management uses the console port or a dedicated management network separate from the data plane, ensuring access even when the production network is down.
WAN & VPN (25 cards)
1. What does WAN stand for?
Answer: Wide Area Network
A WAN (Wide Area Network) connects networks across large geographic distances, such as between cities or countries.
2. What is MPLS?
Answer: Multi-Protocol Label Switching — forwards packets using labels
MPLS (Multi-Protocol Label Switching) forwards packets using short labels instead of IP routing table lookups, providing fast, deterministic path switching across service provider networks.
3. What is the difference between a leased line and broadband WAN?
Answer: Leased line is dedicated bandwidth; broadband is shared
A leased line provides dedicated, guaranteed bandwidth between two points. Broadband (DSL, cable, fibre) is shared infrastructure — bandwidth varies based on network load.
4. What is SD-WAN?
Answer: Software-Defined WAN — manages WAN links via a central controller
SD-WAN uses software-defined networking principles to manage multiple WAN connections (MPLS, broadband, LTE) from a central controller, applying intelligent path selection and QoS.
5. What is a GRE tunnel?
Answer: A protocol that encapsulates packets inside IP packets to create a virtual point-to-point link
GRE (Generic Routing Encapsulation) creates a virtual point-to-point link by encapsulating one protocol inside another. GRE itself does not encrypt traffic — IPsec is added for encryption.
6. What is IPsec?
Answer: A suite of protocols for encrypting and authenticating IP packets
IPsec is a framework of protocols (AH, ESP, IKE) that provides confidentiality, integrity, and authentication for IP traffic, widely used in VPNs.
7. What are the two IPsec modes?
Answer: Transport mode (encrypts payload only) and Tunnel mode (encrypts entire packet)
Transport mode encrypts only the IP payload (used between hosts). Tunnel mode encrypts the entire original packet and adds a new IP header (used in site-to-site VPNs).
8. What is IKE in IPsec?
Answer: Internet Key Exchange — negotiates IPsec security associations
IKE (Internet Key Exchange) is the protocol used to authenticate peers and negotiate the Security Associations (SAs) that define IPsec encryption and authentication parameters.
9. What is a site-to-site VPN?
Answer: Permanent encrypted tunnel between two network sites
A site-to-site VPN creates a permanent encrypted tunnel between two fixed locations (offices), allowing their internal networks to communicate securely over the internet.
10. What is a remote access VPN?
Answer: Allows individual users to connect to the corporate network over the internet
A remote access VPN allows individual users to connect to the corporate network from any location using VPN client software (SSL VPN or IPsec client).
11. What is PPPoE?
Answer: Point-to-Point Protocol over Ethernet — used for DSL internet connections
PPPoE encapsulates PPP frames inside Ethernet frames, used by ISPs to authenticate DSL subscribers. The router acts as a PPPoE client using a dialer interface.
12. What is DMVPN?
Answer: Dynamic Multipoint VPN — allows scalable hub-and-spoke and spoke-to-spoke tunnels
DMVPN uses mGRE and NHRP to allow a hub router to support many spoke routers with a single tunnel interface, and enables direct spoke-to-spoke communication on demand.
13. What is NHRP in DMVPN?
Answer: Next Hop Resolution Protocol — maps tunnel IPs to physical IPs
NHRP (Next Hop Resolution Protocol) in DMVPN resolves spoke tunnel IP addresses to their physical (NBMA) IP addresses, enabling spoke-to-spoke tunnel establishment.
14. What is BGP used for in WAN?
Answer: Routing between autonomous systems — used between ISPs and enterprises
BGP (Border Gateway Protocol) routes traffic between autonomous systems. Enterprises use eBGP to advertise their public IP prefixes to ISPs and to receive full internet routing tables.
15. What is the difference between IKEv1 and IKEv2?
Answer: IKEv2 is simpler, faster, and supports EAP and MOBIKE
IKEv2 reduces SA negotiation to two exchanges (vs four in IKEv1), supports EAP authentication, MOBIKE for mobility, and is more resilient to DoS attacks.
16. What is SSL VPN?
Answer: VPN using HTTPS/TLS — works through web browsers without a client
SSL/TLS VPN uses HTTPS to create a VPN session, often through a web browser (clientless) or a lightweight client. Works through firewalls that allow HTTPS, unlike IPsec which may be blocked.
17. What is Metro Ethernet?
Answer: Ethernet-based WAN service within a metropolitan area
Metro Ethernet provides carrier Ethernet services within a city, connecting enterprise sites using standard Ethernet interfaces at WAN speeds (10Mbps to 100Gbps).
18. What is the purpose of a dialer interface in PPPoE?
Answer: Represents the PPPoE session — carries the IP address and settings
A dialer interface on a Cisco router is a logical interface that represents the PPPoE session. It carries the IP address (assigned by ISP), default route, and NAT configuration.
19. What is split tunnelling in remote access VPN?
Answer: VPN traffic goes through tunnel; internet traffic bypasses it
Split tunnelling allows VPN users to access corporate resources through the VPN while internet traffic goes directly through their local connection, reducing VPN server load.
20. What is the Cisco SD-WAN architecture controller called?
Answer: vManage
vManage is the central management controller for Cisco SD-WAN, providing a GUI for configuration, monitoring, and policy management across all vEdge routers.
21. What is a PE router in MPLS?
Answer: Provider Edge — connects customer CE routers to the MPLS network
A PE (Provider Edge) router is the service provider's router that connects directly to customer CE routers. It performs label imposition (attaches MPLS labels to incoming packets).
22. Which protocol distributes MPLS labels between routers?
Answer: LDP (Label Distribution Protocol)
LDP (Label Distribution Protocol) is the standard protocol for distributing labels between MPLS routers. RSVP-TE is used for traffic engineering label distribution.
23. What is a VRF in WAN contexts?
Answer: Virtual Routing and Forwarding — creates isolated routing tables per customer
VRF (Virtual Routing and Forwarding) creates multiple isolated routing tables on a single router. MPLS uses VRFs to keep customer traffic separate on shared provider infrastructure.
24. What does 'show pppoe session' display on a Cisco router?
Answer: Active PPPoE sessions including session ID and interface
'show pppoe session' displays active PPPoE sessions including the unique session ID, associated dialer/virtual access interface, and remote MAC address of the BRAS.
25. What is an SLA in WAN context?
Answer: Service Level Agreement — guaranteed bandwidth and uptime from the ISP
An SLA (Service Level Agreement) is a contract between the ISP and customer guaranteeing specific metrics like minimum bandwidth, maximum latency, jitter, and uptime percentage.
Wireless (24 cards)
1. What does SSID stand for?
Answer: Service Set Identifier — the name of a Wi-Fi network
SSID (Service Set Identifier) is the human-readable name of a wireless network that clients see when scanning for available Wi-Fi connections.
2. Which 802.11 standard introduced MIMO and operates on 2.4 GHz and 5 GHz?
Answer: 802.11n (Wi-Fi 4)
802.11n (Wi-Fi 4) introduced MIMO (Multiple Input Multiple Output) and can operate on both 2.4 GHz and 5 GHz, providing up to 600 Mbps.
3. Which 802.11 standard is also known as Wi-Fi 6?
Answer: 802.11ax
802.11ax (Wi-Fi 6) is the latest standard, operating on 2.4 GHz and 5 GHz with MU-MIMO, OFDMA, and improved efficiency in dense environments.
4. What are the three non-overlapping channels in 2.4 GHz Wi-Fi?
Answer: 1, 6, and 11
In 2.4 GHz, channels 1, 6, and 11 are the only non-overlapping channels (in North America). Adjacent channel interference occurs when nearby APs use overlapping channels.
5. What is CSMA/CA used in wireless networks?
Answer: Carrier Sense Multiple Access with Collision Avoidance
CSMA/CA is the access method used in 802.11 wireless. Unlike wired CSMA/CD, wireless cannot detect collisions, so it tries to avoid them by listening before transmitting and using random backoff.
6. What is the difference between 2.4 GHz and 5 GHz Wi-Fi?
Answer: 2.4 GHz has longer range but more interference; 5 GHz is faster but shorter range
2.4 GHz penetrates walls better (longer range) but has only 3 non-overlapping channels and is congested by microwaves/Bluetooth. 5 GHz offers more channels and higher speeds but shorter range.
7. What is a BSS in wireless networking?
Answer: Basic Service Set — one AP and its associated clients
A BSS (Basic Service Set) is the fundamental wireless topology: one AP providing service to a group of associated client devices. Each BSS is identified by a BSSID (the AP's MAC address).
8. What is an ESS in wireless networking?
Answer: Extended Service Set — multiple APs sharing the same SSID
An ESS (Extended Service Set) consists of multiple APs using the same SSID connected by a wired distribution system, creating one logical wireless network that clients can roam between.
9. What is roaming in wireless networking?
Answer: A client moving between APs while maintaining connectivity
Wireless roaming occurs when a client moves from one AP to another within the same ESS. The client reassociates with a new AP while keeping its IP address and session.
10. What is CAPWAP?
Answer: Control and Provisioning of Wireless Access Points — tunnels between WLC and APs
CAPWAP is the protocol used between lightweight APs and a Wireless LAN Controller (WLC). It tunnels both management and data traffic between the AP and WLC.
11. What is the difference between autonomous and lightweight APs?
Answer: Autonomous APs are self-contained; lightweight APs require a WLC
Autonomous APs operate independently with all configuration locally. Lightweight APs offload processing to a Wireless LAN Controller (WLC) via CAPWAP and cannot function without it.
12. What is WPA2?
Answer: Wi-Fi Protected Access 2 — uses AES encryption
WPA2 (Wi-Fi Protected Access 2) uses AES-CCMP encryption and is the current enterprise wireless security standard. It replaced WEP and WPA which had significant vulnerabilities.
13. What is WPA3?
Answer: The latest Wi-Fi security standard with SAE and 192-bit encryption
WPA3 introduced SAE (Simultaneous Authentication of Equals) replacing PSK, providing forward secrecy and protection against offline dictionary attacks. Enterprise mode uses 192-bit encryption.
14. What is the maximum theoretical speed of 802.11ac (Wi-Fi 5)?
Answer: 3.5 Gbps (with multiple streams)
802.11ac (Wi-Fi 5) operates only on 5 GHz and achieves up to 3.5 Gbps with MU-MIMO and 160 MHz channels with multiple spatial streams.
15. What is RRM (Radio Resource Management)?
Answer: WLC feature that automatically assigns channels and power to APs
RRM is a Cisco WLC feature that dynamically adjusts AP transmit power and channel assignments based on RF conditions, client density, and interference, optimising the wireless environment.
16. What is a hidden SSID?
Answer: An SSID not broadcast in beacon frames — clients must know it to connect
Hiding the SSID (disabling SSID broadcast in beacon frames) is a minor security measure. Clients must manually enter the SSID name. Note: hidden SSIDs are still discoverable by tools like Wireshark.
17. What is a rogue AP?
Answer: An unauthorised AP connected to the network
A rogue AP is an unauthorised wireless access point connected to the network, potentially creating a security backdoor. WLCs use rogue detection to identify and alert on such APs.
18. What is FlexConnect mode on Cisco APs?
Answer: AP switches traffic locally even when WLC connection is lost
FlexConnect (formerly H-REAP) allows APs at branch offices to switch traffic locally rather than tunnelling everything to the central WLC, maintaining connectivity if the WAN link fails.
19. What is OFDMA in 802.11ax (Wi-Fi 6)?
Answer: Allows multiple clients to share a channel simultaneously using subcarriers
OFDMA (Orthogonal Frequency Division Multiple Access) in Wi-Fi 6 divides a channel into smaller resource units, allowing multiple clients to transmit simultaneously — greatly improving efficiency in dense environments.
20. What is band steering on a WLC?
Answer: Moves capable clients from 2.4 GHz to 5 GHz
Band steering is a WLC feature that encourages dual-band capable clients to connect on 5 GHz instead of 2.4 GHz, reducing congestion on the 2.4 GHz band.
21. What is the WLC management interface used for?
Answer: In-band management of the WLC itself
The management interface on a Cisco WLC is used for device management (GUI/SSH/SNMP access), AP CAPWAP control traffic, and as the source for RADIUS/syslog communications.
22. What is a dynamic interface on a Cisco WLC?
Answer: A VLAN interface mapped to a specific WLAN
A dynamic interface on a Cisco WLC is a logical VLAN interface mapped to a WLAN. Client traffic for that WLAN is tagged with the corresponding VLAN and forwarded onto the wired network.
23. What 802.11 amendment added 6 GHz band support?
Answer: 802.11ax (Wi-Fi 6E)
802.11ax with the 'E' extension (Wi-Fi 6E) added the 6 GHz band, providing additional spectrum with up to 1200 MHz of bandwidth and no legacy device interference.
24. Which command shows wireless clients associated to a Cisco WLC via CLI?
Answer: show wireless client summary
'show wireless client summary' on a Cisco WLC displays all currently associated wireless clients including their MAC, IP, AP, WLAN, RSSI, and association state.
Automation (24 cards)
1. What HTTP method retrieves data in a REST API?
Answer: GET
GET is used to retrieve data from a REST API without modifying it. It is idempotent — multiple identical GET requests return the same result.
2. What HTTP method creates a new resource in a REST API?
Answer: POST
POST creates a new resource on the server. Each POST request typically creates a new entry, unlike PUT which replaces an existing resource.
3. What HTTP method replaces an entire resource in a REST API?
Answer: PUT
PUT replaces the entire resource at the specified URI with the new data provided. PATCH modifies only the specified fields of an existing resource.
4. What HTTP method deletes a resource in a REST API?
Answer: DELETE
DELETE removes the specified resource from the server. Like GET, it is idempotent — deleting an already-deleted resource returns the same result (404 Not Found).
5. What is the default data format used by RESTCONF?
Answer: JSON or XML
RESTCONF uses JSON or XML as its data format. JSON is commonly preferred for its simplicity, though XML is also supported for compatibility.
6. What is NETCONF?
Answer: A protocol for managing network devices using XML over SSH
NETCONF (Network Configuration Protocol) uses XML-encoded RPCs over SSH (port 830) to configure and retrieve state from network devices, using YANG data models.
7. What is YANG?
Answer: A data modelling language for NETCONF/RESTCONF
YANG (Yet Another Next Generation) is a data modelling language used to define the structure and constraints of network configuration and state data consumed by NETCONF and RESTCONF.
8. What is Ansible used for in network automation?
Answer: Agentless automation using YAML playbooks and SSH
Ansible automates network configuration using YAML playbooks executed over SSH. It is agentless (no software needed on network devices) and idempotent by design.
9. What is a Jinja2 template used for in network automation?
Answer: Generating device configurations from variables
Jinja2 is a Python templating engine that generates text from templates and variable data. In networking, it creates device configurations dynamically from a CSV or YAML variable file.
10. What Python library is used to SSH into Cisco devices?
Answer: Netmiko
Netmiko is a Python library that simplifies SSH connections to network devices from multiple vendors. It handles connection setup, command sending, and output parsing.
11. What is NAPALM in network automation?
Answer: A multi-vendor Python library for configuration and state retrieval
NAPALM (Network Automation and Programmability Abstraction Layer with Multivendor support) provides a unified Python API to interact with multiple network operating systems (IOS, NX-OS, EOS, JunOS).
12. What is a northbound API in SDN?
Answer: Interface between applications and the SDN controller
A northbound API allows applications and orchestration systems to communicate with the SDN controller, abstracting network complexity into programmable interfaces.
13. What is a southbound API in SDN?
Answer: Interface between the SDN controller and network devices
A southbound API (like OpenFlow or NETCONF) is used by the SDN controller to programme forwarding rules and retrieve state from the underlying network devices.
14. What is OpenFlow?
Answer: A southbound protocol for SDN controllers to programme switch forwarding tables
OpenFlow is a standardised southbound API that allows an SDN controller to directly manage the flow tables in network switches and routers.
15. What is the purpose of Cisco DNA Center?
Answer: Intent-based networking controller for enterprise automation
Cisco DNA Center is Cisco's intent-based networking controller providing centralised automation, analytics, and policy management for enterprise campus and branch networks.
16. What does idempotent mean in REST APIs?
Answer: Same request produces the same result regardless of repetition
An idempotent operation produces the same result no matter how many times it is performed. GET, PUT, and DELETE are idempotent. POST is not — each POST typically creates a new resource.
17. What HTTP status code means success in REST APIs?
Answer: 200 OK
HTTP 200 OK indicates the request was successful and the response body contains the requested data. 201 Created is returned after a successful POST that creates a new resource.
18. What HTTP status code means the resource was not found?
Answer: 404 Not Found
HTTP 404 Not Found means the requested resource doesn't exist on the server. In network automation, this commonly means the device or interface name in the URI is incorrect.
19. What is infrastructure as code (IaC)?
Answer: Managing infrastructure using configuration files and code
Infrastructure as Code means managing and provisioning network infrastructure through machine-readable configuration files (Ansible playbooks, Terraform configs) rather than manual CLI processes.
20. What is the Cisco IOS-XE RESTCONF base URI?
Answer: https://[device-IP]/restconf/data/
Cisco IOS-XE RESTCONF uses the base URI https://[device-IP]/restconf/data/ followed by the YANG model path to access configuration and operational data.
21. What Python library is used to make REST API calls?
Answer: requests
The Python 'requests' library is the standard for making HTTP/REST API calls. It supports GET, POST, PUT, DELETE and handles authentication, headers, and JSON parsing.
22. What is a playbook in Ansible?
Answer: A YAML file defining automation tasks to run on managed devices
An Ansible playbook is a YAML file that defines one or more plays, each specifying a set of tasks to run on a group of hosts defined in the inventory.
23. What is an Ansible inventory file?
Answer: A file listing managed devices and their connection details
The Ansible inventory file lists all managed devices (routers, switches, servers) along with their IP addresses, credentials, and group membership used to target automation tasks.
24. What is the ncclient Python library used for?
Answer: Connecting to NETCONF-enabled devices
ncclient is a Python library that implements the NETCONF protocol client, allowing Python scripts to connect to NETCONF-enabled devices and send XML-formatted configuration and query operations.
QoS (24 cards)
1. What does QoS stand for?
Answer: Quality of Service
QoS (Quality of Service) refers to mechanisms that manage network traffic to ensure critical applications receive the bandwidth, low latency, and low jitter they require.
2. What is DSCP?
Answer: Differentiated Services Code Point — a 6-bit field in the IP header for traffic marking
DSCP uses the 6 high-order bits of the TOS byte in the IP header to mark traffic into up to 64 classes. Routers use these markings for QoS treatment.
3. What DSCP value is assigned to voice (VoIP) traffic using Expedited Forwarding?
Answer: EF (DSCP 46)
EF (Expedited Forwarding, DSCP 46) is the marking used for VoIP bearer traffic. It receives strict priority treatment — low latency, low jitter, and low loss.
4. What is the MQC framework?
Answer: Modular QoS CLI — class-map, policy-map, service-policy
MQC (Modular QoS CLI) is the Cisco QoS configuration framework: define traffic classes with class-map, define actions with policy-map, and apply to an interface with service-policy.
5. What does a class-map do in MQC?
Answer: Identifies traffic classes based on match criteria
A class-map identifies traffic using match criteria (DSCP value, ACL, protocol, port). Traffic matching the class-map is then subject to the actions defined in the policy-map.
6. What does a policy-map do in MQC?
Answer: Defines QoS actions for each class
A policy-map defines what action to take on each class of traffic: bandwidth allocation, priority queuing, policing, shaping, or marking.
7. What does service-policy do in MQC?
Answer: Applies a policy-map to an interface in a specific direction
'service-policy [in|out] [policy-name]' applies the policy-map to an interface. 'in' processes inbound traffic; 'out' processes outbound traffic.
8. What is the difference between policing and shaping?
Answer: Policing drops/remarks excess; shaping buffers and delays excess
Policing drops or re-marks packets that exceed the configured rate. Shaping buffers excess packets in a queue and releases them at the configured rate — resulting in smoother traffic flow.
9. What is LLQ (Low Latency Queuing)?
Answer: A strict priority queue for delay-sensitive traffic like VoIP
LLQ provides a strict priority queue (PQ) within CBWFQ. Traffic in the priority queue (typically VoIP) is always serviced first, guaranteeing low latency and jitter.
10. What is CBWFQ?
Answer: Class-Based Weighted Fair Queuing — assigns bandwidth to each class
CBWFQ extends WFQ by allowing administrators to define custom traffic classes and allocate minimum guaranteed bandwidth percentages or bit rates to each class.
11. What is CoS (Class of Service)?
Answer: A 3-bit field in the 802.1Q VLAN tag for Layer 2 QoS marking
CoS (also called PCP — Priority Code Point) is a 3-bit field in the 802.1Q header. It provides 8 classes of service for QoS marking at Layer 2. DSCP is the Layer 3 equivalent.
12. What is traffic shaping used for on a WAN interface?
Answer: Limits outbound traffic to match the ISP's contracted bandwidth
Traffic shaping on a WAN interface controls the outbound rate to match the ISP's Committed Information Rate (CIR), preventing traffic from exceeding the contracted rate and avoiding ISP policing drops.
13. What is the QoS trust boundary?
Answer: The point where QoS markings are trusted and not re-marked
The trust boundary is where the network decides to trust existing QoS markings from connected devices. Typically placed at the access switch port where IP phones connect — the phone's DSCP markings are trusted; PC markings behind the phone are re-marked.
14. What is the default DSCP marking of unclassified traffic?
Answer: BE (Best Effort, DSCP 0)
Unclassified or best-effort traffic defaults to DSCP 0 (Best Effort). It receives no QoS treatment and is the lowest priority class.
15. What command verifies QoS policy statistics on Cisco IOS?
Answer: show policy-map interface
'show policy-map interface [interface]' displays per-class QoS statistics including matched packets, dropped packets, queued packets, and bandwidth utilisation for each class.
16. What is NBAR in Cisco QoS?
Answer: Network Based Application Recognition — identifies applications beyond port numbers
NBAR (Network Based Application Recognition) performs deep packet inspection to identify applications by payload patterns, not just port numbers — allowing accurate classification of applications like Skype or Netflix.
17. What is the Committed Information Rate (CIR) in QoS?
Answer: The guaranteed minimum bandwidth the ISP will deliver
CIR is the minimum bandwidth the service provider guarantees to deliver under normal conditions. Traffic up to the CIR is forwarded; excess may be shaped, policed, or marked as discard eligible.
18. Which DSCP class is recommended for call signalling (e.g., SIP)?
Answer: CS3 (DSCP 24)
CS3 (DSCP 24) is the Cisco recommended marking for call signalling protocols like SIP and H.323. Voice bearer (actual audio) uses EF (DSCP 46).
19. What is WRED (Weighted Random Early Detection)?
Answer: Drops packets probabilistically based on DSCP before queues fill
WRED drops packets probabilistically as queues fill, preferentially dropping lower-priority traffic (lower DSCP). This prevents tail-drop and signals TCP senders to slow down before congestion becomes severe.
20. What is tail-drop in queue management?
Answer: Dropping all new packets when the queue is full
Tail-drop is the default queue management behaviour: when a queue is full, all new incoming packets are dropped until space is available. WRED is preferred as it provides more graceful congestion signals.
21. What QoS mechanism marks voice traffic at the access layer?
Answer: DSCP EF marking at the trust boundary (access switch)
IP phones mark their own voice traffic with DSCP EF. The access switch trust boundary is configured to trust DSCP markings from the phone port, carrying the marking throughout the network.
22. What percentage of link bandwidth should VoIP traffic not exceed?
Answer: 33% of available bandwidth
Cisco recommends voice traffic should not exceed 33% of available link bandwidth. Exceeding this degrades call quality even with priority queuing because the queue itself introduces delay.
23. What is traffic classification in QoS?
Answer: Identifying and categorising traffic into classes
Classification is the first step of QoS — identifying traffic and assigning it to a class based on DSCP, ACL match, port numbers, protocol, or NBAR application recognition.
24. What is traffic marking in QoS?
Answer: Writing DSCP or CoS values into packet headers
Marking writes QoS values (DSCP in IP header, CoS in 802.1Q tag) into packets at the trust boundary so that all subsequent network devices apply consistent treatment without re-classification.
IOS Commands (25 cards)
1. Which command saves the running configuration to NVRAM?
Answer: copy running-config startup-config
'copy running-config startup-config' (or 'write memory') saves the current running configuration to NVRAM so it persists after a reload. Shortcut: 'wr'.
2. Which command enters privileged EXEC mode from user EXEC?
Answer: enable
'enable' (or 'en') moves from user EXEC mode (Router>) to privileged EXEC mode (Router#) where all show commands and configuration access are available.
3. Which command enters global configuration mode?
Answer: configure terminal
'configure terminal' (shortcut 'conf t') moves from privileged EXEC to global configuration mode (Router(config)#) where all system-wide settings are configured.
4. What does 'show running-config' display?
Answer: The current active configuration in RAM
'show running-config' displays the entire current configuration in RAM. Use '| include [keyword]' or '| section [section]' to filter output.
5. What does 'show startup-config' display?
Answer: The configuration saved in NVRAM
'show startup-config' displays the configuration stored in NVRAM that will be loaded on the next reload. If it matches running-config, no unsaved changes exist.
6. Which command shows all interfaces and their IP/status briefly?
Answer: show ip interface brief
'show ip interface brief' provides a one-line summary per interface showing IP address, method, status, and protocol — the fastest way to check overall interface health.
7. Which command shows detailed error counters for an interface?
Answer: show interfaces [interface]
'show interfaces [interface-name]' shows detailed statistics including input/output errors, CRC, collisions, late collisions, queue drops, and 5-minute traffic rates.
8. Which command shows the routing table?
Answer: show ip route
'show ip route' displays the routing table with codes indicating the source of each route (C=connected, S=static, O=OSPF, etc.), AD, metric, and next-hop.
9. Which command enters interface configuration mode for GigabitEthernet0/0?
Answer: interface GigabitEthernet0/0
'interface GigabitEthernet0/0' (shortcut 'int gi0/0') enters interface configuration mode for that specific interface.
10. Which command brings up a shutdown interface?
Answer: no shutdown
'no shutdown' (shortcut 'no shut') removes the administrative shutdown from an interface, bringing it to an operationally up state (assuming cable and speed are correct).
11. Which command shows all OSPF neighbours?
Answer: show ip ospf neighbor
'show ip ospf neighbor' lists all OSPF neighbours with their router IDs, priority, state (should be FULL), dead timer countdown, address, and interface.
12. Which command shows all VLANs on a switch?
Answer: show vlan brief
'show vlan brief' displays all VLANs in the database, their names, status (active/act/unsup), and which access ports are assigned to each VLAN.
13. Which command shows trunk interfaces and their allowed VLANs?
Answer: show interfaces trunk
'show interfaces trunk' displays all ports currently trunking, their encapsulation, native VLAN, and the four trunk VLAN sections (allowed, active, forwarding, pruned).
14. Which command assigns IP address 192.168.1.1/24 to an interface?
Answer: ip address 192.168.1.1 255.255.255.0
'ip address [IP] [subnet-mask]' assigns an IP address to a router or SVI interface. The mask must be in dotted decimal, not CIDR notation.
15. Which command sets hostname to 'NetsTuts_R1'?
Answer: hostname NetsTuts_R1
'hostname [name]' in global configuration mode sets the device hostname, which is displayed in the CLI prompt and used as the OSPF router ID source.
16. Which command enables password encryption for all plaintext passwords?
Answer: service password-encryption
'service password-encryption' applies weak (Type 7) encryption to all plaintext passwords in the config. Note: this is reversible — use 'enable secret' for stronger MD5/SHA hashing.
17. Which command sets an encrypted enable password?
Answer: enable secret [password]
'enable secret [password]' sets the privileged EXEC password using MD5 hash (Type 5). It always overrides 'enable password' if both are configured.
18. Which command shows the IOS version and hardware details?
Answer: show version
'show version' displays IOS version, feature set, uptime, configuration register, RAM/flash, number of interfaces, and the licence level — essential for support calls.
19. Which command shows the CDP neighbours of a device?
Answer: show cdp neighbors
'show cdp neighbors' lists all directly connected Cisco devices with their device ID, local interface, hold time, capability, platform, and remote port.
20. Which command filters 'show running-config' to show only lines containing 'ospf'?
Answer: show running-config | include ospf
'show running-config | include [keyword]' filters output to lines containing the keyword. '| section [keyword]' shows the section header and all sub-commands.
21. Which command reloads a Cisco device?
Answer: reload
'reload' restarts the Cisco IOS device. It prompts to save unsaved changes. Configuration loaded on restart comes from NVRAM (startup-config).
22. Which command shows current active VTY sessions?
Answer: show users
'show users' displays currently active terminal sessions on the device, including console and VTY lines, showing the username, line number, and source IP.
23. Which command copies running config to a TFTP server?
Answer: copy running-config tftp
'copy running-config tftp' initiates a TFTP transfer of the current running configuration to a specified TFTP server — the standard method for configuration backup.
24. Which command erases the startup configuration?
Answer: erase startup-config
'erase startup-config' removes the startup configuration from NVRAM. After a reload, the device boots with factory defaults and enters setup mode.
25. Which command creates a local user 'admin' with privilege level 15?
Answer: username admin privilege 15 secret [password]
'username [name] privilege 15 secret [password]' creates a local user with the highest privilege level (15 = full access) using a hashed password.
Ports & Protocols (25 cards)
1. Which port does HTTP use?
Answer: 80
HTTP (Hypertext Transfer Protocol) uses TCP port 80. It is the unencrypted web traffic protocol.
2. Which port does HTTPS use?
Answer: 443
HTTPS (HTTP Secure) uses TCP port 443. It encrypts web traffic using TLS/SSL.
3. Which port does SSH use?
Answer: 22
SSH (Secure Shell) uses TCP port 22. It provides encrypted remote management, replacing Telnet.
4. Which port does Telnet use?
Answer: 23
Telnet uses TCP port 23. It sends all data including passwords in cleartext — replaced by SSH for secure environments.
5. Which ports does FTP use?
Answer: 21 (control) and 20 (data)
FTP uses TCP port 21 for control (commands) and TCP port 20 for active data transfer. Passive FTP uses port 21 for control and a dynamic port for data.
6. Which port does DNS use?
Answer: 53 (UDP and TCP)
DNS uses UDP port 53 for standard queries (fast, low overhead) and TCP port 53 for zone transfers and responses larger than 512 bytes.
7. Which port does DHCP server use?
Answer: 67
DHCP servers listen on UDP port 67. DHCP clients use UDP port 68 to send discovery and request messages.
8. Which port does TFTP use?
Answer: 69
TFTP (Trivial File Transfer Protocol) uses UDP port 69. It is a simplified, unauthenticated file transfer protocol commonly used for IOS images and config backups.
9. Which port does SMTP use?
Answer: 25
SMTP (Simple Mail Transfer Protocol) uses TCP port 25 for server-to-server email transfer. Port 587 is used for authenticated client submission.
10. Which port does POP3 use?
Answer: 110
POP3 (Post Office Protocol v3) uses TCP port 110 for email retrieval. It downloads emails to the client and typically deletes them from the server.
11. Which port does IMAP use?
Answer: 143
IMAP (Internet Message Access Protocol) uses TCP port 143. Unlike POP3, IMAP keeps emails on the server and syncs them across multiple devices.
12. Which port does SNMP use for queries?
Answer: 161 UDP
SNMP uses UDP port 161 for management queries (GET, SET operations from the NMS to devices). UDP port 162 is used for SNMP traps (device to NMS).
13. Which port does Syslog use?
Answer: 514 UDP
Syslog traditionally uses UDP port 514. RFC 5425 defines TCP port 6514 for secure (TLS) syslog.
14. Which port does NTP use?
Answer: 123 UDP
NTP (Network Time Protocol) uses UDP port 123 for all time synchronisation messages between clients and servers.
15. Which port does RDP use?
Answer: 3389
RDP (Remote Desktop Protocol) uses TCP port 3389. It provides graphical remote access to Windows systems.
16. Which port does BGP use?
Answer: 179 TCP
BGP (Border Gateway Protocol) uses TCP port 179 for establishing and maintaining neighbour sessions between routers.
17. Does OSPF use TCP or UDP?
Answer: Neither — OSPF uses IP protocol 89 directly
OSPF does not use TCP or UDP. It sends packets directly over IP using protocol number 89. OSPF hello and LSA packets are encapsulated directly in IP datagrams.
18. Does EIGRP use TCP or UDP?
Answer: Neither — EIGRP uses IP protocol 88 directly
EIGRP uses IP protocol number 88 directly, not TCP or UDP. It includes its own reliable transport mechanism (RTP — Reliable Transport Protocol) for guaranteed delivery.
19. Which port does LDAP use?
Answer: 389 TCP
LDAP (Lightweight Directory Access Protocol) uses TCP port 389 for directory queries. LDAPS (LDAP over SSL/TLS) uses TCP port 636.
20. Which port does NetFlow export use?
Answer: 2055 UDP
NetFlow exports flow records to a collector on UDP port 2055 by default, although this is configurable. The collector port must match the exporter configuration.
21. Which port does NETCONF use?
Answer: 830 TCP
NETCONF uses TCP port 830, running over an SSH session. It uses XML-encoded RPCs to manage network device configurations.
22. What is the port range for registered (well-known) ports?
Answer: 0–1023
Well-known ports (0–1023) are assigned by IANA to common services. Registered ports (1024–49151) are used by applications. Dynamic/ephemeral ports (49152–65535) are used for client-side connections.
23. What transport protocol does HTTP use?
Answer: TCP
HTTP and HTTPS use TCP to ensure reliable, ordered delivery of web content. UDP is used by HTTP/3 (over QUIC) but classic HTTP uses TCP.
24. Which port does RADIUS authentication use?
Answer: 1812 UDP
RADIUS authentication uses UDP port 1812 (newer standard) or UDP port 1645 (legacy). RADIUS accounting uses UDP port 1813 or 1646.
25. Which port does TACACS+ use?
Answer: 49 TCP
TACACS+ uses TCP port 49 for all authentication, authorisation, and accounting communications, providing reliable delivery unlike RADIUS which uses UDP.
EIGRP (25 cards)
1. What does EIGRP stand for?
Answer: Enhanced Interior Gateway Routing Protocol
EIGRP (Enhanced Interior Gateway Routing Protocol) is a Cisco-developed advanced distance-vector routing protocol that uses the DUAL algorithm to guarantee loop-free paths.
2. What algorithm does EIGRP use to calculate loop-free paths?
Answer: DUAL (Diffusing Update Algorithm)
EIGRP uses DUAL (Diffusing Update Algorithm) which guarantees loop-free paths at every instant and allows fast convergence by pre-calculating backup paths (feasible successors).
3. What is the EIGRP administrative distance for internal routes?
Answer: 90
Internal EIGRP routes have an AD of 90. External EIGRP routes (redistributed into EIGRP) have an AD of 170.
4. What is a successor in EIGRP?
Answer: The best-cost next-hop router to a destination
The successor is the primary route to a destination — the neighbour with the lowest feasible distance (FD) to the destination that is stored in the routing table.
5. What is a feasible successor in EIGRP?
Answer: A backup route that meets the feasibility condition
A feasible successor is a pre-calculated backup path whose reported distance (RD) is less than the current successor's feasible distance (FD), guaranteeing it is loop-free.
6. What is the feasibility condition in EIGRP?
Answer: Neighbour's reported distance < current feasible distance
The feasibility condition is met when a neighbour's reported distance (RD) to a destination is less than the local router's current feasible distance (FD). This guarantees the neighbour is not routing through the local router, preventing loops.
7. What metrics does EIGRP use in its composite metric?
Answer: Bandwidth and delay (by default)
EIGRP's composite metric uses bandwidth (slowest link) and delay (cumulative) by default. Load, reliability, and MTU can also be included but are disabled by default as they cause instability.
8. What is the default EIGRP hello interval on LAN interfaces?
Answer: 5 seconds
EIGRP sends hello packets every 5 seconds on high-bandwidth LAN interfaces. The hold time (dead interval) is 3x the hello interval = 15 seconds.
9. What command enables EIGRP with AS number 100?
Answer: router eigrp 100
'router eigrp [AS-number]' enables EIGRP. The AS number must match on all routers for them to become neighbours.
10. What are the three EIGRP tables?
Answer: Neighbour table, topology table, routing table
EIGRP maintains three tables: neighbour table (adjacent routers), topology table (all learned routes with metrics), and routing table (best routes — successors only).
11. What protocol number does EIGRP use?
Answer: 88
EIGRP uses IP protocol number 88. It does not use TCP or UDP — it has its own reliable transport mechanism called RTP (Reliable Transport Protocol).
12. What is EIGRP RTP?
Answer: Reliable Transport Protocol — guarantees ordered delivery of EIGRP packets
RTP (Reliable Transport Protocol) is EIGRP's own mechanism for reliable and ordered delivery of EIGRP packets (updates, queries, replies). It uses sequence numbers and acknowledgements.
13. What is the EIGRP multicast address for sending updates?
Answer: 224.0.0.10
EIGRP uses multicast address 224.0.0.10 to send hello and update packets to all EIGRP routers on the segment.
14. What command shows the EIGRP topology table?
Answer: show ip eigrp topology
'show ip eigrp topology' displays the EIGRP topology table including successors, feasible successors, feasible distance, and reported distance for all known destinations.
15. What command shows EIGRP neighbours?
Answer: show ip eigrp neighbors
'show ip eigrp neighbors' lists all EIGRP neighbours including uptime, queue count, sequence number, and SRTT (smooth round-trip time).
16. What is EIGRP named mode?
Answer: A newer configuration mode that supports IPv4, IPv6, and address families under one process
EIGRP named mode (introduced in IOS 15.0) consolidates all EIGRP configuration under one named process using address families, supporting both IPv4 and IPv6 and providing more granular control.
17. What is the EIGRP AD for external routes?
Answer: 170
EIGRP external routes (redistributed from other protocols) have an AD of 170, making them less preferred than internal EIGRP routes (AD 90).
18. What is route summarisation in EIGRP?
Answer: Advertising a single summary route instead of multiple specific routes
EIGRP supports manual route summarisation at any interface using 'ip summary-address eigrp [AS] [network] [mask]', reducing routing table size and limiting query scope.
19. What is an EIGRP stuck-in-active (SIA) route?
Answer: A route that does not receive a reply to a query within the active timer
A route goes active when the successor is lost and no feasible successor exists. If query replies are not received within the active timer (default 3 minutes), the route is SIA and the neighbour relationship is reset.
20. How does EIGRP differ from OSPF in terms of updates?
Answer: EIGRP sends partial bounded updates; OSPF floods LSAs throughout an area
EIGRP sends partial, bounded updates — only changed routes, only to affected neighbours. OSPF floods LSAs to all routers in an area. EIGRP's approach is more bandwidth-efficient.
21. What is EIGRP unequal-cost load balancing?
Answer: Distributing traffic across paths with different metrics using the variance command
EIGRP can load-balance across unequal-cost paths using the 'variance' multiplier command. A feasible successor within variance * FD of the successor is included in load balancing.
22. What does the 'network' command do in EIGRP?
Answer: Activates EIGRP on interfaces whose IPs match the network/wildcard
The 'network [address] [wildcard]' command under 'router eigrp' activates EIGRP on all interfaces whose IP addresses fall within the specified range, advertising those networks.
23. What is EIGRPv6?
Answer: EIGRP adapted to support IPv6 routing
EIGRPv6 is EIGRP adapted for IPv6. Key differences: configured directly on interfaces with 'ipv6 eigrp [AS]', uses IPv6 link-local addresses for neighbour relationships.
24. What is the EIGRP bandwidth metric based on?
Answer: The minimum bandwidth along the path to the destination
EIGRP's bandwidth metric uses the minimum (slowest) bandwidth value along the entire path to the destination — the bottleneck link determines the metric.
25. What command redistributes OSPF into EIGRP?
Answer: redistribute ospf 1 metric 10000 100 255 1 1500
'redistribute ospf [process-id] metric [bw] [delay] [reliability] [load] [mtu]' under 'router eigrp' imports OSPF routes into EIGRP. All five metric values are required.
TCP & UDP (25 cards)
1. What are the three steps of the TCP three-way handshake?
Answer: SYN, SYN-ACK, ACK
TCP connection establishment: (1) Client sends SYN; (2) Server responds SYN-ACK; (3) Client sends ACK. After this the connection is established and data transfer begins.
2. What is TCP used for compared to UDP?
Answer: TCP is reliable and connection-oriented; UDP is unreliable and connectionless
TCP provides reliable, ordered, connection-oriented delivery with error recovery. UDP is connectionless, faster, with no guaranteed delivery — used for voice, video, DNS queries.
3. What field in the TCP header prevents out-of-order data problems?
Answer: Sequence number
The sequence number allows the receiver to reorder TCP segments that arrive out of order and identify missing segments that need to be retransmitted.
4. What is the TCP acknowledgement number?
Answer: The next byte the receiver expects
The acknowledgement number tells the sender which byte number the receiver expects next, confirming receipt of all bytes up to that point.
5. What is the TCP window size used for?
Answer: Flow control — limits how much data can be sent before an ACK
The TCP window size controls flow — it tells the sender how many bytes can be sent before an ACK is required. A larger window allows more data in flight, improving throughput on high-latency links.
6. What is TCP sliding window?
Answer: A dynamic mechanism that adjusts how much data can be in transit simultaneously
The sliding window allows continuous data transmission without waiting for each ACK. As ACKs are received, the window slides forward, allowing new segments to be sent.
7. What is TCP connection teardown?
Answer: Four-step FIN-ACK process to gracefully close a connection
TCP teardown uses four steps: (1) FIN from initiator; (2) ACK from receiver; (3) FIN from receiver; (4) ACK from initiator. After TIME_WAIT period, the connection is fully closed.
8. What does a TCP RST packet do?
Answer: Immediately terminates the connection without graceful teardown
A TCP RST (Reset) immediately terminates a connection. It can be sent when a host receives a packet for a connection it doesn't recognise, or as a rejection of a connection attempt.
9. What is TCP congestion control?
Answer: Mechanisms that reduce send rate when network congestion is detected
TCP congestion control (slow start, congestion avoidance, fast retransmit, fast recovery) dynamically adjusts the send rate based on packet loss or delay signals to avoid overwhelming the network.
10. What is the TCP SYN flood attack?
Answer: Sending many SYN packets without completing the handshake to exhaust server resources
A SYN flood sends many SYN packets with spoofed source IPs. The server allocates resources and sends SYN-ACKs but never receives ACKs, exhausting its connection table — a DoS attack.
11. What is the TCP MSS?
Answer: Maximum Segment Size — the largest TCP payload in a single segment
MSS (Maximum Segment Size) is the largest amount of data that can be carried in a single TCP segment. It is negotiated during the handshake and is typically MTU - 40 bytes (20 IP + 20 TCP header).
12. Which protocols use UDP instead of TCP?
Answer: DNS, DHCP, TFTP, SNMP, NTP
UDP is used by: DNS (port 53), DHCP (67/68), TFTP (69), SNMP (161/162), NTP (123), syslog (514), and streaming media. These either tolerate loss or implement their own reliability.
13. What is a TCP port number?
Answer: A 16-bit number identifying the application or service on a host
A TCP/UDP port number (0–65535) identifies a specific application or service. Combined with an IP address it forms a socket. Port numbers below 1024 are well-known (HTTP=80, SSH=22).
14. What is a TCP socket?
Answer: A combination of IP address and port number identifying an endpoint
A TCP socket is the combination of an IP address and port number (e.g., 192.168.1.1:80). A TCP connection is uniquely identified by the four-tuple: source IP, source port, dest IP, dest port.
15. What is UDP's advantage over TCP?
Answer: Lower overhead and lower latency — no connection setup or retransmission
UDP has no connection setup, no acknowledgements, and no retransmission — making it faster and lower-latency. Ideal for voice/video where a dropped packet is better than a delayed one.
16. What is TCP slow start?
Answer: Begins with a small congestion window that grows exponentially until congestion is detected
TCP slow start begins with a congestion window (cwnd) of 1 MSS and doubles it each RTT until it reaches the slow start threshold (ssthresh). After ssthresh, it grows linearly (congestion avoidance).
17. What is the TIME_WAIT state in TCP?
Answer: A period after sending FIN where the socket waits to ensure the remote end received the ACK
After the final ACK in TCP teardown, the closing side enters TIME_WAIT for 2*MSL (Maximum Segment Lifetime, typically 60 seconds) to ensure the remote end received the ACK and any delayed packets expire.
18. What does the TCP URG flag indicate?
Answer: Urgent data that should be processed immediately
The URG (Urgent) flag marks data as urgent, instructing the receiver to process it immediately. The urgent pointer field indicates where the urgent data ends.
19. What is TCP keepalive?
Answer: Periodic probes sent on idle connections to detect if the peer is still alive
TCP keepalive sends periodic probes on idle connections. If no response is received after several probes, the connection is considered dead and closed — useful for detecting broken connections.
20. Which layer of the OSI model do TCP and UDP operate at?
Answer: Layer 4 — Transport
TCP and UDP operate at Layer 4 (Transport layer), providing end-to-end communication services for applications. Layer 4 is responsible for segmentation, flow control, and error recovery (TCP).
21. What is TCP full-duplex communication?
Answer: Data can flow in both directions simultaneously on the same connection
TCP is full-duplex — data can be sent and received simultaneously on the same connection. Each direction has its own sequence numbers and window management.
22. What is a well-known port?
Answer: A port number 0–1023 assigned by IANA to standard services
Well-known ports (0–1023) are assigned by IANA to standard network services (HTTP=80, HTTPS=443, SSH=22, FTP=21). They require root/admin privileges to bind on most operating systems.
23. What is the ephemeral port range?
Answer: 49152–65535 — dynamically assigned to client-side connections
Ephemeral (dynamic) ports 49152–65535 are assigned by the OS to client applications for the source port of outbound connections. They are temporary and released when the connection closes.
24. What does the PSH flag do in TCP?
Answer: Instructs the receiver to push buffered data to the application immediately
The PSH (Push) flag tells the receiver not to buffer this data but to pass it directly to the application layer immediately, reducing latency for interactive applications like SSH.
25. How does UDP handle error detection?
Answer: Optional checksum only — no retransmission or recovery
UDP includes an optional checksum field for error detection but has no mechanism for retransmission or recovery. If an application needs reliability over UDP, it must implement it in the application layer (e.g., QUIC, DTLS).
ARP & MAC (25 cards)
1. What does ARP stand for?
Answer: Address Resolution Protocol
ARP (Address Resolution Protocol) resolves IPv4 addresses to MAC addresses, allowing a host to find the Layer 2 address of another device on the same subnet.
2. What does an ARP request ask?
Answer: Who has IP [x]? Tell me your MAC address
An ARP request broadcasts: 'Who has IP address [target IP]? Tell [sender IP] your MAC address.' Every device on the subnet receives the request; only the target replies.
3. What destination MAC address is used in an ARP request?
Answer: FF:FF:FF:FF:FF:FF (broadcast)
ARP requests are broadcast to FF:FF:FF:FF:FF:FF so every device on the local subnet receives and processes the request.
4. What is the ARP reply?
Answer: A unicast response from the target containing its MAC address
The ARP reply is unicast directly to the requester. It contains the target's MAC address, allowing the requester to update its ARP cache and complete the Layer 2 frame.
5. What is the ARP cache?
Answer: A table mapping IP addresses to MAC addresses stored temporarily
The ARP cache stores recent IP-to-MAC mappings so the host doesn't need to broadcast an ARP request for every packet. Entries expire after a timeout (typically 2–20 minutes).
6. What command shows the ARP cache on a Windows PC?
Answer: arp -a
'arp -a' displays the current ARP cache on Windows and Linux, showing all known IP-to-MAC mappings with their type (dynamic or static) and interface.
7. What command shows the ARP table on a Cisco router?
Answer: show ip arp
'show ip arp' displays the Cisco router's ARP table including IP address, age, MAC address, and interface.
8. What is gratuitous ARP?
Answer: An ARP reply sent without a request — used to update neighbours or detect IP conflicts
Gratuitous ARP is an ARP reply a host sends without receiving a request. Uses: (1) announce presence to update neighbours' caches; (2) detect IP address conflicts (if anyone replies, a duplicate exists).
9. What is proxy ARP?
Answer: A router answers ARP requests on behalf of hosts on another subnet
Proxy ARP allows a router to respond to ARP requests for IP addresses on different subnets, enabling hosts without a default gateway to still reach remote networks (though it is not best practice).
10. What is ARP spoofing?
Answer: Sending fake ARP replies to associate an attacker's MAC with a legitimate IP
ARP spoofing (ARP poisoning) sends unsolicited ARP replies mapping a legitimate IP to the attacker's MAC address, redirecting traffic through the attacker for man-in-the-middle attacks.
11. What protects against ARP spoofing on Cisco switches?
Answer: Dynamic ARP Inspection (DAI)
Dynamic ARP Inspection (DAI) validates ARP packets against the DHCP snooping binding table. If the IP-to-MAC mapping doesn't match, the ARP packet is dropped.
12. What is a MAC address format?
Answer: 48 bits — 24-bit OUI and 24-bit device identifier, written as six hex octets
A MAC address is 48 bits (6 bytes) written as six hexadecimal octets (e.g., 00:1A:2B:3C:4D:5E). The first 24 bits are the OUI (vendor identifier) and the last 24 bits are the device-specific ID.
13. What is an OUI in a MAC address?
Answer: Organizationally Unique Identifier — first 24 bits identifying the manufacturer
The OUI (Organizationally Unique Identifier) is the first 3 bytes (24 bits) of a MAC address. IANA assigns OUIs to manufacturers — you can look up OUIs to identify device vendors.
14. What is a broadcast MAC address?
Answer: FF:FF:FF:FF:FF:FF — received by all devices on the segment
FF:FF:FF:FF:FF:FF is the Layer 2 broadcast address. Any frame sent to this MAC is processed by all devices on the same broadcast domain (same VLAN/subnet).
15. What is a multicast MAC address?
Answer: A MAC starting with 01:00:5E for IPv4 multicast
IPv4 multicast frames use MAC addresses in the range 01:00:5E:00:00:00 to 01:00:5E:7F:FF:FF. The low-order 23 bits of the IP multicast group are mapped into the last three octets.
16. What happens when a switch receives a frame for an unknown MAC?
Answer: Floods the frame out all ports except the receiving port
When a switch doesn't have an entry for the destination MAC in its MAC address table, it floods the frame out all ports in the same VLAN except the port it was received on — this is called unknown unicast flooding.
17. What is MAC address aging on a switch?
Answer: Dynamic MAC entries are removed after an idle period (default 300 seconds)
Dynamic MAC entries in the switch's MAC address table have an aging timer (default 300 seconds on Cisco). If no frame from that MAC is received within the timeout, the entry is removed.
18. What is the Ethernet II frame format?
Answer: Preamble, Destination MAC, Source MAC, EtherType, Data, FCS
Ethernet II (DIX) frame: 7-byte Preamble, 1-byte SFD, 6-byte Destination MAC, 6-byte Source MAC, 2-byte EtherType (identifies Layer 3 protocol), Data (46–1500 bytes), 4-byte FCS.
19. What does the EtherType field 0x0800 indicate?
Answer: IPv4 payload
EtherType 0x0800 indicates the frame carries an IPv4 packet. Other common values: 0x0806 = ARP, 0x86DD = IPv6, 0x8100 = 802.1Q VLAN tag.
20. What is the FCS field in an Ethernet frame?
Answer: Frame Check Sequence — a 4-byte CRC for error detection
The FCS (Frame Check Sequence) is a 4-byte CRC (Cyclic Redundancy Check) at the end of every Ethernet frame. The receiver recalculates the CRC and discards the frame if it doesn't match.
21. What is the minimum Ethernet frame size?
Answer: 64 bytes
The minimum Ethernet frame size is 64 bytes (including headers and FCS). Frames shorter than 64 bytes are called runts and are discarded — they indicate a collision or malformed frame.
22. What is the maximum Ethernet frame size (MTU)?
Answer: 1518 bytes (1500 bytes payload + 18 bytes headers)
The standard Ethernet maximum frame size is 1518 bytes (1500-byte payload + 14-byte Ethernet header + 4-byte FCS). With 802.1Q tag: 1522 bytes. Jumbo frames can be up to 9000 bytes.
23. What is a unicast MAC address?
Answer: A MAC address targeting a single specific device
A unicast MAC address targets a single device. If the least significant bit of the first byte is 0, it is a unicast MAC. If it is 1, it is multicast. FF:FF:FF:FF:FF:FF is a special case — broadcast.
24. What is RARP?
Answer: Reverse ARP — resolves a MAC address to an IP address (legacy)
RARP (Reverse ARP) allowed diskless workstations to discover their IP address from a RARP server using their MAC address. It has been replaced by BOOTP and DHCP.
25. What command clears the ARP cache on a Cisco router?
Answer: clear ip arp
'clear ip arp' removes all dynamic ARP entries from the router's ARP table, forcing fresh ARP requests for all subsequent communications.
FHRP (25 cards)
1. What does FHRP stand for?
Answer: First Hop Redundancy Protocol
FHRP (First Hop Redundancy Protocol) is a category of protocols that provide default gateway redundancy by sharing a virtual IP address between multiple routers.
2. What does HSRP stand for?
Answer: Hot Standby Router Protocol
HSRP (Hot Standby Router Protocol) is a Cisco-proprietary FHRP that allows multiple routers to share a virtual IP address, providing default gateway redundancy.
3. What is the default HSRP priority?
Answer: 100
The default HSRP priority is 100. The router with the highest priority becomes the active router. In a tie, the router with the highest IP address wins.
4. What is the HSRP active router?
Answer: The router currently forwarding traffic for the virtual IP
The HSRP active router is the one currently forwarding traffic for the virtual IP and MAC address. It sends hellos every 3 seconds by default.
5. What is the HSRP standby router?
Answer: The backup router ready to take over if the active fails
The HSRP standby router monitors the active router's hellos and takes over as active if the active fails to send hellos within the hold time (default 10 seconds).
6. What virtual MAC does HSRP group 1 use?
Answer: 00:00:0C:07:AC:01
HSRP uses virtual MACs in the format 00:00:0C:07:AC:XX where XX is the group number in hex. Group 1 = 00:00:0C:07:AC:01, Group 0 = 00:00:0C:07:AC:00.
7. What is HSRP preemption?
Answer: Allows a higher-priority router to reclaim active role when it recovers
HSRP preempt allows a router with higher priority to take back the active role when it comes online or recovers, even if another router is currently active. Disabled by default — enabled with 'standby [group] preempt'.
8. What command configures HSRP group 1 with virtual IP 192.168.1.254?
Answer: standby 1 ip 192.168.1.254
'standby [group] ip [virtual-IP]' configured under the interface enables HSRP on that interface with the specified group and virtual IP address.
9. What does VRRP stand for?
Answer: Virtual Router Redundancy Protocol
VRRP (Virtual Router Redundancy Protocol) is an open-standard FHRP defined in RFC 5798. It works similarly to HSRP but is vendor-neutral, allowing multi-vendor gateway redundancy.
10. What is the key difference between HSRP and VRRP?
Answer: VRRP is an open standard; HSRP is Cisco-proprietary. VRRP default priority is 100; master is highest priority
HSRP is Cisco-proprietary (uses active/standby terminology). VRRP is IEEE open standard (uses master/backup). VRRP allows the owner router (with the real IP) to always be the master, unlike HSRP.
11. What does GLBP stand for?
Answer: Gateway Load Balancing Protocol
GLBP (Gateway Load Balancing Protocol) is a Cisco-proprietary FHRP that provides both redundancy and load balancing. Unlike HSRP/VRRP, GLBP uses multiple active virtual forwarders.
12. How does GLBP achieve load balancing?
Answer: Multiple routers each use a different virtual MAC while sharing one virtual IP
GLBP uses one virtual IP but multiple virtual MACs (one per AVF — Active Virtual Forwarder). The AVG (Active Virtual Gateway) assigns different virtual MACs to different clients via ARP replies, distributing load.
13. What is an AVG in GLBP?
Answer: Active Virtual Gateway — responds to ARP requests and assigns virtual MACs
The AVG (Active Virtual Gateway) is the elected GLBP router that responds to ARP requests for the virtual IP. It assigns virtual MAC addresses to clients in a round-robin manner across all AVFs.
14. What is HSRP tracking?
Answer: Monitors an interface or IP SLA — reduces priority if the tracked object fails
HSRP object tracking monitors an interface or IP SLA probe. If the tracked object fails (e.g., WAN link goes down), HSRP reduces the router's priority, causing the standby router to take over.
15. What is the HSRP hello timer default?
Answer: 3 seconds
HSRP hello timer defaults to 3 seconds. The hold timer (how long to wait before declaring the active router dead) defaults to 10 seconds (approximately 3x the hello timer).
16. What HSRP state comes just before active?
Answer: Speak
HSRP states: Disabled → Init → Learn → Listen → Speak → Standby → Active. In Speak, the router sends hello packets and participates in election. After winning, it moves to Active.
17. What multicast address does HSRP version 1 use?
Answer: 224.0.0.2
HSRPv1 uses multicast 224.0.0.2 (all routers on the segment). HSRPv2 uses 224.0.0.102. VRRP uses 224.0.0.18.
18. What is the difference between HSRPv1 and HSRPv2?
Answer: v2 supports 4096 groups, IPv6, and uses 224.0.0.102
HSRPv2 increases the group number range from 0-255 (v1) to 0-4095, supports IPv6, uses a different multicast address (224.0.0.102), and uses a different virtual MAC format (00:00:0C:9F:FX:XX).
19. What command shows HSRP status on a Cisco router?
Answer: show standby
'show standby' displays all HSRP groups on all interfaces, showing the state (Active/Standby/Listen), virtual IP, virtual MAC, active/standby router IPs, priority, and preempt status.
20. What is VRRP's equivalent of HSRP active?
Answer: Master
In VRRP, the router currently forwarding traffic is called the Master (equivalent to HSRP Active). All other VRRP routers in the group are Backups (equivalent to HSRP Standby/Listen).
21. Can the VRRP master be the router that owns the virtual IP?
Answer: Yes — the IP owner always becomes master with priority 255
In VRRP, if the virtual IP is the same as one router's real interface IP, that router becomes the IP owner with a fixed priority of 255 and always becomes master as long as it is operational.
22. What problem does FHRP solve?
Answer: Single point of failure on the default gateway
Without FHRP, if the router configured as hosts' default gateway fails, all hosts on that subnet lose connectivity to remote networks. FHRP provides a virtual gateway IP shared by multiple routers.
23. What is the GLBP AVF?
Answer: Active Virtual Forwarder — actually forwards traffic for the virtual IP
An AVF (Active Virtual Forwarder) is a GLBP router that is actively forwarding traffic for one or more virtual MACs. Up to 4 AVFs can exist per GLBP group, each forwarding traffic for different hosts.
24. What is HSRP group 0 virtual MAC?
Answer: 00:00:0C:07:AC:00
HSRP group 0 uses virtual MAC 00:00:0C:07:AC:00. The formula for HSRPv1 is 00:00:0C:07:AC:[group in hex]. For HSRPv2: 00:00:0C:9F:F[group in hex, two digits].
25. What happens to HSRP if both routers have the same priority?
Answer: The router with the highest IP address becomes active
When HSRP priorities are equal, the router with the highest configured IP address on the HSRP interface wins the active election.
Cables & Topology (25 cards)
1. What is a star topology?
Answer: All devices connect to a central switch or hub
In a star topology, all devices connect to a central switch. It is the most common LAN topology. Failure of the central switch takes down the entire network, but individual link failures only affect one device.
2. What is a mesh topology?
Answer: Every device connects directly to every other device
In a full mesh topology, every device has a direct link to every other device. It provides maximum redundancy but requires many links (n*(n-1)/2 for n devices). Partial mesh is more common in WANs.
3. What is a bus topology?
Answer: All devices connect to a single shared cable (backbone)
In a bus topology, all devices connect to a single shared transmission medium. Legacy 10BASE2/10BASE5 Ethernet used bus. Collisions are common, and a break in the bus affects all devices.
4. What is a ring topology?
Answer: Devices connect in a closed loop — data travels in one or both directions
In a ring topology, each device connects to two neighbours forming a circle. Token Ring used this topology. SONET/SDH WAN rings are still common. A break in the ring can disrupt all traffic.
5. What is a hybrid topology?
Answer: A combination of two or more topology types
A hybrid topology combines two or more different topologies. Most enterprise networks are hybrids — star topology at the access layer connected in a partial mesh at the distribution/core layers.
6. What is the maximum cable length for Cat5e at 1 Gbps?
Answer: 100 metres
Cat5e (Category 5 Enhanced) supports 1 Gbps (1000BASE-T) up to 100 metres. It has 4 pairs of twisted copper wires with a minimum of 3 twists per inch.
7. What is the main improvement of Cat6 over Cat5e?
Answer: Higher bandwidth (250 MHz vs 100 MHz) and better crosstalk performance
Cat6 supports 250 MHz bandwidth (vs 100 MHz for Cat5e), better crosstalk reduction, and can support 10 Gbps up to 55 metres. Cat6A extends 10 Gbps to 100 metres.
8. What is the difference between SMF and MMF fibre?
Answer: SMF has a smaller core for longer distances; MMF has a larger core for shorter distances
Single-Mode Fibre (SMF) has a 9-micron core and uses laser light — supports distances up to 80+ km. Multi-Mode Fibre (MMF) has a 50/62.5-micron core — limited to ~2 km. SMF is used for WAN; MMF for campus.
9. What is a straight-through Ethernet cable used for?
Answer: Connecting unlike devices — PC to switch, switch to router
A straight-through cable (T568A on both ends, or T568B on both ends) connects unlike devices: PC to switch, switch to router. Both ends use the same pinout.
10. What is a crossover Ethernet cable used for?
Answer: Connecting like devices — switch to switch, PC to PC directly
A crossover cable (T568A on one end, T568B on the other) connects like devices: switch to switch, router to router, PC to PC. Most modern devices support Auto-MDIX, making crossover cables obsolete.
11. What is Auto-MDIX?
Answer: Automatically detects cable type and adjusts pin assignments accordingly
Auto-MDIX (Automatic Medium-Dependent Interface Crossover) allows a port to automatically detect whether a straight-through or crossover cable is connected and adjust its transmit/receive pins accordingly.
12. What are the T568A and T568B wiring standards?
Answer: Two different pin assignments for RJ45 connectors — T568B is more common in North America
T568A and T568B are EIA/TIA wiring standards for RJ45 connectors. They differ only in the positions of the orange and green wire pairs (pins 1,2 and 3,6). T568B is more common in North America.
13. What is PoE (Power over Ethernet)?
Answer: Delivers electrical power over Ethernet cables to devices like IP phones and APs
PoE delivers DC power over Ethernet cables, eliminating the need for separate power supplies for IP phones, access points, and IP cameras. IEEE 802.3af (15.4W), 802.3at (30W), and 802.3bt (90W) are the standards.
14. What is the maximum power delivery of PoE+ (802.3at)?
Answer: 30 watts per port
PoE+ (IEEE 802.3at) delivers up to 30 watts per port. Standard PoE (802.3af) delivers up to 15.4W. PoE++ (802.3bt Type 3) delivers up to 60W; Type 4 delivers up to 90W.
15. What connector does standard Ethernet use?
Answer: RJ45
Ethernet cables use RJ45 (8-position, 8-contact) connectors. RJ11 (6P4C) is used for telephone lines. LC and SC are fibre optic connectors.
16. What is a fibre LC connector used for?
Answer: High-density fibre connections in switches and SFPs
LC (Lucent Connector) is a small form-factor fibre connector used in SFP/SFP+ modules and data centre equipment. It has a 1.25mm ferrule and uses a latch mechanism.
17. What is an SFP module?
Answer: A hot-swappable transceiver that converts electrical to optical signals
An SFP (Small Form-factor Pluggable) is a compact hot-swappable transceiver that converts between electrical signals and optical (fibre) or copper (RJ45) signals. SFP+ supports up to 10 Gbps.
18. What is the purpose of a loopback plug?
Answer: Tests an interface by connecting TX to RX — verifies the interface hardware
A loopback plug connects the transmit (TX) pins directly to the receive (RX) pins, allowing a port to echo back its own transmissions — used to test whether the interface hardware is working.
19. What is a coaxial cable?
Answer: A cable with a central conductor, insulation, metallic shield, and outer jacket
Coaxial cable has a central copper conductor surrounded by dielectric insulation, a braided metallic shield, and an outer jacket. Used for cable TV, legacy 10BASE2/5 Ethernet, and some WAN connections.
20. What is structured cabling?
Answer: A standardised system of cabling infrastructure with defined subsystems
Structured cabling (TIA-568) is a standardised approach to network cabling infrastructure with defined components: entrance facilities, equipment rooms, backbone cabling, telecoms rooms, horizontal cabling, and work area.
21. What is a patch panel?
Answer: A passive panel providing termination points for horizontal cabling
A patch panel provides fixed termination points where horizontal cabling from wall jacks connects at one end, with RJ45 ports on the front for patch cables connecting to switch ports. It centralises cable management.
22. What does TIA-568 define?
Answer: Commercial building telecommunications cabling standard
TIA-568 (ANSI/TIA-568) is the commercial building telecommunications cabling standard. It defines cable types, distances, connectors, and installation practices for copper and fibre cabling infrastructure.
23. What is the difference between UTP and STP copper cable?
Answer: STP has metallic shielding around pairs for better noise immunity; UTP has no shielding
UTP (Unshielded Twisted Pair) relies on twisting for noise cancellation. STP (Shielded Twisted Pair) adds metallic foil or braid shielding around individual pairs or the whole cable for better EMI protection in industrial environments.
24. What is a toner probe used for?
Answer: Traces cable paths by injecting a tone and using a probe to detect it
A toner probe (toner and probe set) injects an audio tone on a cable and uses a probe to detect where the tone is — used to trace cables through walls, ceilings, or punch-down blocks.
25. What is a TDR (Time Domain Reflectometer) used for?
Answer: Measures cable length and locates faults by analysing reflected signals
A TDR sends a pulse down a cable and measures reflections to determine cable length, locate opens/shorts, and identify impedance mismatches. Cable testers with TDR functionality can pinpoint the exact distance to a fault.
Cloud & Virtualisation (25 cards)
1. What does IaaS stand for?
Answer: Infrastructure as a Service
IaaS provides virtualised computing resources (VMs, storage, networking) over the internet. The customer manages OS and above; the provider manages hardware. Examples: AWS EC2, Azure VMs, GCP Compute Engine.
2. What does PaaS stand for?
Answer: Platform as a Service
PaaS provides a development and deployment platform — the customer manages applications and data; the provider manages OS, middleware, and infrastructure. Examples: AWS Elastic Beanstalk, Azure App Service, Google App Engine.
3. What does SaaS stand for?
Answer: Software as a Service
SaaS delivers complete applications over the internet — the customer only manages their data and user settings; everything else is managed by the provider. Examples: Microsoft 365, Salesforce, Google Workspace.
4. What is the key difference between public and private cloud?
Answer: Public cloud resources are shared among customers; private cloud is dedicated to one organisation
Public cloud (AWS, Azure, GCP) shares infrastructure among multiple tenants. Private cloud is dedicated infrastructure for one organisation — either on-premises or hosted. Hybrid cloud combines both.
5. What is a hypervisor?
Answer: Software that creates and manages virtual machines
A hypervisor (Virtual Machine Monitor) abstracts physical hardware and allocates resources to virtual machines. It enables multiple VMs with different OSes to run on the same physical server.
6. What is the difference between a Type 1 and Type 2 hypervisor?
Answer: Type 1 runs directly on hardware (bare-metal); Type 2 runs on top of a host OS
Type 1 (bare-metal) hypervisors run directly on hardware without an underlying OS (VMware ESXi, Microsoft Hyper-V, KVM). Type 2 hypervisors run as applications on a host OS (VirtualBox, VMware Workstation).
7. What is NFV?
Answer: Network Functions Virtualisation — running network services as software on standard servers
NFV (Network Functions Virtualisation) runs network functions (firewalls, routers, load balancers, WAN optimisers) as software VMs on standard COTS servers instead of dedicated hardware appliances.
8. What is SDN?
Answer: Software-Defined Networking — separates the control plane from the data plane
SDN separates the control plane (routing decisions) from the data plane (packet forwarding) and centralises control in a software controller. This enables programmable, automated network management.
9. What is a container?
Answer: A lightweight isolated application environment sharing the host OS kernel
Containers (Docker, Kubernetes pods) are lightweight isolated environments that share the host OS kernel. They start in seconds (vs minutes for VMs) and consume fewer resources, making them ideal for microservices.
10. What is the difference between a VM and a container?
Answer: VMs include a full OS; containers share the host OS kernel and are lighter
VMs virtualise the entire hardware stack including a full OS per VM — heavy but strongly isolated. Containers share the host OS kernel — lightweight and fast but less isolated than VMs.
11. What is a hybrid cloud?
Answer: A combination of public and private cloud with data portability between them
Hybrid cloud combines private and public cloud resources with orchestration between them. Sensitive data stays on-premises (private); scalable or non-sensitive workloads run on public cloud.
12. What is cloud elasticity?
Answer: The ability to scale resources up or down automatically based on demand
Cloud elasticity allows resources (compute, storage, network) to automatically scale up when demand increases and scale down when demand decreases, matching capacity to actual usage.
13. What is a VPC (Virtual Private Cloud)?
Answer: An isolated virtual network in a public cloud provider
A VPC (Virtual Private Cloud) is an isolated virtual network within a public cloud (AWS, Azure VNet, GCP VPC). It provides IP addressing, subnets, routing tables, and security groups in a logically isolated environment.
14. What is cloud storage in networking context?
Answer: Scalable object, block, or file storage accessed over the internet
Cloud storage types: object (S3-style — flat namespace, accessed via API), block (EBS-style — raw volumes for VMs), and file (NFS/SMB-style — shared file systems). Accessed over internet or private connections.
15. What is a CDN?
Answer: Content Delivery Network — caches content closer to users to reduce latency
A CDN (Content Delivery Network) distributes cached copies of content (web pages, videos, images) to servers closer to end users, reducing latency and origin server load.
16. What is multi-tenancy in cloud computing?
Answer: Multiple customers sharing the same physical infrastructure securely
Multi-tenancy means multiple customers (tenants) share the same physical infrastructure with logical isolation provided by virtualisation and security controls.
17. What is cloud SLA?
Answer: Service Level Agreement defining uptime guarantees and remedies
Cloud SLAs define uptime guarantees (e.g., 99.99% = ~52 minutes downtime/year), performance benchmarks, and service credits if the provider fails to meet commitments.
18. What is serverless computing?
Answer: Running code without managing servers — provider handles infrastructure automatically
Serverless computing (AWS Lambda, Azure Functions) allows developers to run code in response to events without provisioning servers. The provider automatically allocates resources and scales — customers pay per execution.
19. What is Direct Connect (in cloud context)?
Answer: A dedicated private connection from on-premises to a cloud provider
Direct Connect (AWS) / ExpressRoute (Azure) / Cloud Interconnect (GCP) provides a dedicated private circuit from the customer's premises to the cloud provider's network, bypassing the public internet for consistent latency and security.
20. What is cloud bursting?
Answer: Automatically using public cloud capacity when private cloud capacity is exceeded
Cloud bursting allows a hybrid cloud deployment to automatically expand into public cloud resources when the on-premises private cloud reaches capacity, handling demand spikes without permanent public cloud costs.
21. What is a cloud region?
Answer: A geographic area containing multiple data centres (availability zones)
A cloud region is a geographic location (e.g., us-east-1, eu-west-1) containing multiple, physically separate data centres called availability zones. Resources are deployed to regions to reduce latency to users.
22. What is an availability zone in cloud computing?
Answer: One or more physically separate data centres within a region
An availability zone (AZ) is one or more discrete data centres within a region with independent power, cooling, and networking. Deploying resources across multiple AZs provides high availability and fault tolerance.
23. What is cloud-native networking?
Answer: Network services designed for cloud environments — virtual routers, firewalls, load balancers
Cloud-native networking refers to network services designed specifically for cloud environments: virtual routers, software load balancers, virtual firewalls (security groups), and overlay networks like VPCs.
24. What is the shared responsibility model in cloud security?
Answer: Provider secures infrastructure; customer secures data and applications
In the shared responsibility model: the cloud provider secures the underlying infrastructure (hardware, hypervisor, physical security). The customer is responsible for securing their data, applications, OS configuration, and access management.
25. What does CASB stand for?
Answer: Cloud Access Security Broker — enforces security policies between users and cloud services
A CASB (Cloud Access Security Broker) sits between users and cloud services to enforce security policies, provide visibility into cloud usage, prevent data leakage, and ensure compliance.
Cryptography & PKI (25 cards)
1. What is the difference between symmetric and asymmetric encryption?
Answer: Symmetric uses one shared key; asymmetric uses a public/private key pair
Symmetric encryption uses the same key to encrypt and decrypt — fast but requires secure key exchange. Asymmetric uses a mathematically linked key pair: data encrypted with the public key can only be decrypted with the private key.
2. What is AES?
Answer: Advanced Encryption Standard — a symmetric block cipher
AES (Advanced Encryption Standard) is the most widely used symmetric block cipher, operating on 128-bit blocks with key sizes of 128, 192, or 256 bits. AES-256 is used in WPA2, TLS, and IPsec.
3. What is RSA?
Answer: An asymmetric algorithm using large prime numbers for key generation
RSA is an asymmetric encryption algorithm based on the difficulty of factoring the product of two large prime numbers. Used for key exchange, digital signatures, and certificate signing. Common key sizes: 2048 or 4096 bits.
4. What is a hash function?
Answer: A one-way function producing a fixed-size digest from any input
A cryptographic hash function takes any input and produces a fixed-size output (digest). It is one-way (cannot reverse to get the original input) and deterministic (same input always produces the same output). Used for integrity checking.
5. What is MD5?
Answer: A hash function producing a 128-bit digest — considered cryptographically broken
MD5 produces a 128-bit hash. It is widely considered cryptographically broken (collision vulnerabilities) and should not be used for security purposes. SHA-256 or SHA-3 are recommended instead.
6. What is SHA-256?
Answer: A secure hash algorithm producing a 256-bit digest
SHA-256 (part of SHA-2 family) produces a 256-bit hash and is currently secure for most cryptographic applications including TLS certificates, code signing, and IPsec integrity checking.
7. What is a digital signature?
Answer: Data encrypted with the sender's private key to prove authenticity and integrity
A digital signature is created by hashing the data and encrypting the hash with the sender's private key. The receiver decrypts with the sender's public key — if the hashes match, the data is authentic and unmodified.
8. What is a digital certificate?
Answer: A document binding a public key to an identity, signed by a CA
A digital certificate (X.509) contains: the subject's public key, the subject's identity (CN, organisation), the issuing CA's information, validity dates, and the CA's digital signature. Used in TLS/HTTPS, VPNs, and 802.1X.
9. What is a CA (Certificate Authority)?
Answer: A trusted entity that issues and signs digital certificates
A CA (Certificate Authority) is a trusted third party that verifies identities and issues digitally signed certificates. Examples: DigiCert, Let's Encrypt, VeriSign. Enterprise networks often use internal CAs (Microsoft AD CS).
10. What is PKI?
Answer: Public Key Infrastructure — the system of CAs, certificates, and policies for managing public keys
PKI (Public Key Infrastructure) is the full system of hardware, software, policies, and procedures for managing digital certificates and public-key encryption, including CAs, registration authorities, and certificate repositories.
11. What is TLS?
Answer: Transport Layer Security — encrypts communications between clients and servers
TLS (Transport Layer Security) is the cryptographic protocol securing HTTPS, email (SMTPS), VPNs, and other communications. It replaced SSL. TLS 1.3 is the current version — TLS 1.0 and 1.1 are deprecated.
12. What is the TLS handshake?
Answer: Negotiates cipher suite, exchanges keys, and authenticates server before data transfer
TLS handshake: (1) Client Hello (supported ciphers, random); (2) Server Hello (selected cipher, certificate); (3) Key exchange; (4) Client Finished; (5) Server Finished. After this, encrypted data transfer begins.
13. What is a self-signed certificate?
Answer: A certificate signed by its own private key, not by a CA
A self-signed certificate is signed with its own private key rather than a CA. It provides encryption but no third-party trust. Browsers warn users when they encounter self-signed certificates for HTTPS.
14. What is a CRL?
Answer: Certificate Revocation List — a list of certificates revoked before their expiry
A CRL (Certificate Revocation List) is published by a CA and lists certificates that have been revoked before their expiry date (due to compromise, key loss, or organisational changes). Systems check CRLs before trusting a certificate.
15. What is OCSP?
Answer: Online Certificate Status Protocol — real-time certificate revocation checking
OCSP (Online Certificate Status Protocol) provides real-time certificate revocation status by querying a CA's OCSP responder. It is more efficient than downloading full CRLs.
16. What is Diffie-Hellman key exchange?
Answer: A method for two parties to establish a shared secret over an insecure channel
Diffie-Hellman (DH) key exchange allows two parties to establish a shared secret without transmitting the secret itself, even over an insecure channel. Used in TLS, IKE (IPsec), and SSH key exchange.
17. What is Perfect Forward Secrecy (PFS)?
Answer: Each session uses a new key — past sessions cannot be decrypted if a key is compromised
PFS ensures that each session's encryption key is generated fresh and discarded after use. If a long-term key is later compromised, past session recordings remain secure as those session keys are gone.
18. What is the difference between encryption and hashing?
Answer: Encryption is reversible with a key; hashing is one-way and irreversible
Encryption is reversible — given the key, ciphertext can be decrypted back to plaintext. Hashing is one-way — the hash cannot be reversed to recover the original data. Hashing is used for integrity; encryption for confidentiality.
19. What is HMAC?
Answer: Hash-based Message Authentication Code — combines a hash with a shared key for integrity and authentication
HMAC (Hash-based Message Authentication Code) uses a shared secret key combined with a hash function (e.g., HMAC-SHA256). It provides both data integrity and authentication — proving the sender knows the shared key.
20. What is the purpose of salting a password hash?
Answer: Adds random data to the password before hashing to prevent rainbow table attacks
A salt is random data added to a password before hashing. Each password gets a unique salt, so identical passwords produce different hashes. This defeats precomputed rainbow table attacks.
21. What cipher suite is recommended for TLS 1.3?
Answer: TLS_AES_256_GCM_SHA384 or TLS_CHACHA20_POLY1305_SHA256
TLS 1.3 mandates forward secrecy and only allows three cipher suites, all using AEAD (AES-GCM or ChaCha20-Poly1305). RC4, DES, 3DES, and RSA key exchange are all removed in TLS 1.3.
22. What is key stretching?
Answer: Making a weak key stronger by applying a slow hashing function many times
Key stretching (PBKDF2, bcrypt, scrypt) applies a hash function thousands of times to a password, making brute-force attacks computationally expensive even for short passwords.
23. What is the man-in-the-middle attack in PKI context?
Answer: Intercepting traffic by presenting fake certificates to both parties
In a MITM attack, an attacker intercepts communications and presents their own certificate to the client while maintaining a connection to the real server. Certificate pinning and proper CA chain validation help prevent this.
24. What does 'cipher suite' mean in TLS?
Answer: A combination of algorithms for key exchange, authentication, encryption, and MAC
A TLS cipher suite specifies four algorithms: key exchange (ECDHE), authentication (RSA/ECDSA), bulk encryption (AES-256-GCM), and message authentication (SHA-384). Example: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384.
25. What is a rainbow table attack?
Answer: A precomputed table of hash values used to reverse password hashes
A rainbow table is a precomputed lookup table mapping password hashes back to plaintext passwords. Salting passwords defeats rainbow tables because each unique salt means the hash cannot be in a precomputed table.
Network Design (25 cards)
1. What are the three layers of the Cisco hierarchical network model?
Answer: Core, Distribution, Access
The Cisco three-tier hierarchical model: Access (connects end devices, PoE, port security), Distribution (inter-VLAN routing, policy, aggregation), Core (high-speed backbone, minimal policy, maximum availability).
2. What is the role of the access layer?
Answer: Connects end devices — switches providing PoE, VLANs, and port security
The access layer connects end devices (PCs, phones, APs) to the network. Functions: PoE for IP phones/APs, VLAN assignment, port security, STP edge ports (PortFast/BPDU Guard).
3. What is the role of the distribution layer?
Answer: Aggregates access switches and provides inter-VLAN routing and policy enforcement
The distribution layer aggregates access layer switches, performs inter-VLAN routing (L3 switching), enforces QoS and security policies, implements route summarisation, and provides redundancy with dual uplinks.
4. What is the role of the core layer?
Answer: High-speed backbone switching between distribution layers — minimise latency
The core layer is the high-speed backbone. Design principles: never apply policies or filtering (adds latency), use redundant links, optimise for speed and availability. In small networks, core and distribution may be collapsed.
5. What is a collapsed core design?
Answer: Distribution and core layers combined into one layer
A collapsed core (two-tier) design combines the core and distribution into one layer — typically used in smaller networks. The distribution/core switches connect directly to all access switches, reducing complexity and cost.
6. What is a spine-leaf architecture?
Answer: A two-tier data centre design where every leaf connects to every spine
Spine-leaf is a two-tier data centre network: every leaf switch connects to every spine switch (full mesh between tiers). Any server-to-server communication traverses exactly two hops (leaf → spine → leaf), providing consistent, low latency.
7. What is a High Availability (HA) network design?
Answer: Eliminates single points of failure through redundant hardware, links, and protocols
HA design eliminates single points of failure: dual power supplies, redundant supervisors, redundant uplinks with EtherChannel or HSRP/VRRP, diverse routing paths, and out-of-band management.
8. What is a DMZ in network design?
Answer: A separate network zone hosting public-facing servers between the internet and internal network
A DMZ (Demilitarised Zone) is a network segment between two firewalls. Public-facing servers (web, email, DNS) sit in the DMZ — accessible from the internet but isolated from the internal network.
9. What is the purpose of out-of-band management?
Answer: Manage devices via a dedicated network separate from the production data plane
Out-of-band (OOB) management uses a dedicated management network (management VRF, console servers, IPMI) that remains accessible even when the production network is down, enabling recovery during outages.
10. What is network segmentation?
Answer: Dividing a network into smaller zones to limit broadcast domains and contain security breaches
Network segmentation divides the network into zones using VLANs, subnets, and firewalls. Benefits: contains broadcast traffic, limits the blast radius of security incidents, simplifies compliance, and improves performance.
11. What is redundancy in network design?
Answer: Providing duplicate components so failure of one does not cause a service outage
Redundancy eliminates single points of failure by duplicating critical components: redundant power supplies, supervisors, uplinks (EtherChannel), paths (dual switches), WAN connections (dual ISP), and gateway routers (HSRP/VRRP).
12. What is network scalability in design?
Answer: The ability to grow the network without redesign or performance degradation
A scalable network design accommodates growth — adding users, devices, and sites — without requiring fundamental redesign. Hierarchical models, modular design, and route summarisation all contribute to scalability.
13. What is a zero trust security model?
Answer: Trust nothing by default — verify every user, device, and connection before granting access
Zero trust assumes no user or device is inherently trusted, even inside the network perimeter. Every access request must be verified, authorised, and continuously validated. Key principles: verify explicitly, least privilege access, assume breach.
14. What is microsegmentation?
Answer: Applying granular security policies between individual workloads or VMs
Microsegmentation (common in data centres and cloud) applies fine-grained firewall policies between individual VMs or containers — even within the same VLAN or subnet — using software-defined perimeters or firewall rules.
15. What is a network baseline?
Answer: A documented record of normal network performance metrics for comparison
A network baseline documents normal operating metrics (bandwidth utilisation, error rates, CPU, latency) during a representative period. Deviations from the baseline indicate changes or problems.
16. What is east-west traffic in data centre design?
Answer: Server-to-server traffic within the data centre
East-west traffic flows between servers within the same data centre. Modern applications (microservices, virtualisation) generate massive east-west traffic. Spine-leaf architectures optimise for this pattern.
17. What is north-south traffic?
Answer: Traffic between clients outside the data centre and servers inside
North-south traffic flows between external clients (users on the internet or WAN) and servers inside the data centre. Traditional three-tier architectures (core-distribution-access) were optimised for north-south patterns.
18. What is a single pane of glass in network management?
Answer: A unified management interface controlling all network devices from one place
Single pane of glass refers to a unified management platform (e.g., Cisco DNA Center, SolarWinds) that provides visibility and control over the entire network infrastructure from one interface, eliminating the need to manage each device individually.
19. What is IPAM?
Answer: IP Address Management — centralised tracking and management of IP address space
IPAM (IP Address Management) is a system for planning, tracking, and managing the assignment of IP addresses and associated data (DNS, DHCP, subnet allocations). Tools: Infoblox, BlueCat, SolarWinds IPAM.
20. What is a network topology diagram?
Answer: A visual representation of network devices and their interconnections
A network topology diagram documents devices, interfaces, IP addresses, VLANs, and links. Essential for troubleshooting, change management, and onboarding. Should exist in both logical (L3) and physical (L2) versions.
21. What is the purpose of the 80/20 rule in traditional LAN design?
Answer: 80% of traffic should stay local; 20% should cross routers
The traditional 80/20 rule stated that 80% of traffic should stay within the local segment and only 20% should cross routers. Modern applications broke this rule — most traffic is now server-bound (north-south) or inter-DC (east-west).
22. What is link aggregation and why is it used?
Answer: Bundling multiple physical links into one logical link for higher bandwidth and redundancy
Link aggregation (EtherChannel/LAG/LACP) combines 2–8 physical links into one logical interface, providing cumulative bandwidth and automatic failover if one link fails — commonly used for switch uplinks and server connections.
23. What is oversubscription in network design?
Answer: More potential bandwidth demand than physical capacity — expected in access/distribution
Oversubscription is the ratio of potential demand to actual uplink capacity. Access layers are typically oversubscribed (20:1), distribution less so (4:1), and core should be non-blocking (1:1) for critical paths.
24. What is a point of presence (PoP)?
Answer: A location where an ISP or cloud provider has network equipment to connect customers
A PoP (Point of Presence) is a physical location where a network provider (ISP, cloud, CDN) has equipment. Customers connect to the nearest PoP to access the provider's network, minimising latency.
25. What is a network audit?
Answer: A systematic review of network devices, configurations, security, and performance
A network audit reviews device configurations, security policies, firmware versions, access controls, and performance metrics against a baseline or standard. Essential for compliance, security hardening, and change management.
CCNA Mix (25 cards)
1. What is the administrative distance of a directly connected route?
Answer: 0
Directly connected routes have an AD of 0 — the most trusted route source. They cannot be overridden by any dynamic routing protocol.
2. What command shows the serial number and licence of a Cisco device?
Answer: show license
'show version' displays the IOS version, router model, serial number, licence information, RAM/flash, and uptime. 'show inventory' shows hardware component serial numbers.
3. What does 'ip default-gateway' configure on a Layer 2 switch?
Answer: The gateway for out-of-band management traffic from the switch
'ip default-gateway [IP]' on a Layer 2 switch sets the gateway used for management traffic (SSH, SNMP, ping to the switch) when the switch has no routing capability.
4. What is the loopback interface used for?
Answer: A virtual always-up interface used for router ID, management, and testing
A loopback interface is a logical interface that is always up as long as the router is running. Uses: OSPF/EIGRP router ID (most stable source), management access, BGP peering, and testing.
5. What is a floating static route?
Answer: A static route with a higher AD than the dynamic route — acts as a backup
A floating static route has a higher AD than the primary dynamic route. It only enters the routing table if the dynamic route disappears (e.g., OSPF route with AD 110 is primary; floating static with AD 200 is backup).
6. What is the purpose of the 'passive-interface default' OSPF command?
Answer: Makes all interfaces passive by default — only explicitly enabled interfaces participate in OSPF
'passive-interface default' under router ospf makes all interfaces passive (no hellos sent). You then use 'no passive-interface [int]' on specific interfaces where you want OSPF hellos — reverse of the normal approach, useful on routers with many LAN interfaces.
7. What is route redistribution?
Answer: Importing routes from one routing protocol into another
Route redistribution imports routes learned by one routing protocol (or static/connected) into another. Used when two protocols run in the same network — requires careful configuration to avoid routing loops and sub-optimal paths.
8. What is the purpose of the 'ip classless' command?
Answer: Allows the router to forward packets to the best supernet route when no exact match exists
'ip classless' (enabled by default in modern IOS) allows the router to match packets against the longest-prefix match in the routing table, including default routes, even without an exact classful network match.
9. What is the difference between 'access-class' and 'ip access-group'?
Answer: access-class applies ACL to VTY lines; ip access-group applies to interfaces
'access-class [acl] in' on a VTY line filters which source IPs can SSH/Telnet to the device. 'ip access-group [acl] in/out' on an interface filters data plane traffic passing through the interface.
10. What does 'shutdown' do to an interface?
Answer: Administratively disables the interface — it shows as administratively down
'shutdown' administratively disables an interface. The interface shows as 'administratively down' in 'show ip interface brief'. Undo with 'no shutdown'. Used for unused ports as a security best practice.
11. What is the purpose of Cisco IOS privilege levels?
Answer: Controls what commands each user can execute (0=minimal, 15=full access)
IOS privilege levels 0–15 control which commands users can execute. Level 1 = user EXEC (limited show commands). Level 15 = privileged EXEC (all commands). Intermediate levels can be customised with 'privilege exec level'.
12. What is the difference between 'copy run start' and 'write memory'?
Answer: They do exactly the same thing — save running-config to NVRAM
'copy running-config startup-config' and 'write memory' (or 'wr') perform the same action — copying the current running configuration to NVRAM so it persists after reload. 'wr' is the older shorthand.
13. What is the CEF (Cisco Express Forwarding)?
Answer: A high-speed Layer 3 switching mechanism using FIB and adjacency tables
CEF (Cisco Express Forwarding) pre-builds a Forwarding Information Base (FIB) from the routing table and an adjacency table from ARP, enabling line-rate packet forwarding without CPU involvement in each decision.
14. What is a management VLAN?
Answer: A dedicated VLAN for switch management traffic (SSH, SNMP, syslog)
A management VLAN isolates administrative traffic (SSH to switches, SNMP queries, syslog) from user data traffic. The switch's SVI in the management VLAN has the management IP address.
15. What is the purpose of 'no ip domain-lookup'?
Answer: Prevents the router from attempting DNS resolution for mistyped commands
'no ip domain-lookup' prevents the router from broadcasting DNS queries when a mistyped command is interpreted as a hostname, which would cause a long pause. Commonly configured in labs.
16. What is the difference between a routed port and an SVI?
Answer: Routed port is a physical Layer 3 port; SVI is a virtual Layer 3 interface for a VLAN
A routed port (no switchport) is a physical interface configured as Layer 3 on a multilayer switch. An SVI (Switched Virtual Interface) is a logical Layer 3 interface for a VLAN, enabling inter-VLAN routing.
17. What is split horizon?
Answer: A loop-prevention mechanism that stops advertising a route back on the interface it was learned from
Split horizon prevents routing loops by not advertising a route back out the same interface it was received on. It is a fundamental loop-prevention mechanism used by distance-vector protocols like RIP and EIGRP.
18. What is route poisoning?
Answer: Advertising a failed route with an infinite metric to speed up convergence
Route poisoning immediately advertises a failed route with an infinite metric (RIP: 16 hops) so neighbouring routers immediately know the route is unreachable, speeding convergence.
19. What is the purpose of holddown timers in distance-vector routing?
Answer: Prevents accepting new route information for a failed network for a period
Holddown timers prevent accepting new route information about a network that was just reported as down for a period (e.g., 180 seconds in RIP). This prevents a router from immediately accepting a potentially incorrect new route.
20. What does 'show protocols' display on a Cisco router?
Answer: Active routing protocols and whether interfaces are up at Layer 3
'show protocols' shows the routing protocols active on the router and the Layer 3 status of each interface (whether the network layer protocol is up). Quick overview of which interfaces are routing.
21. What is a default route and when is it used?
Answer: 0.0.0.0/0 — used when no more specific route matches, sending to a default gateway
A default route (0.0.0.0/0) is the route of last resort. When no more specific match exists in the routing table, packets are forwarded to the next hop specified in the default route — typically the ISP gateway.
22. What is the purpose of CDP (Cisco Discovery Protocol)?
Answer: Discovers and shares information about directly connected Cisco devices
CDP sends multicast frames every 60 seconds, sharing device ID, IP address, platform, capabilities, IOS version, and interface. Useful for topology mapping and troubleshooting physical connections between Cisco devices.
23. What is a syslog facility?
Answer: A category grouping related log messages (local0–local7 for network devices)
Syslog facility codes (0–23) categorise the source of messages. Cisco devices commonly use local6 or local7 for network device logs. The facility is combined with severity to determine log handling by the syslog server.
24. What is the difference between 'show running-config' and 'show startup-config'?
Answer: Running-config is in RAM (current); startup-config is in NVRAM (saved)
Running-config is the current active configuration stored in volatile RAM — lost on reload if not saved. Startup-config is in non-volatile NVRAM and is loaded on boot. 'copy run start' syncs them.
25. What is the purpose of the Cisco IOS banner motd command?
Answer: Displays a message before login — used for legal warning notices
'banner motd [delimiter] message [delimiter]' configures a Message Of The Day banner shown before the login prompt. Used for legal warning notices (e.g., 'Authorised access only') — important for legal prosecution of unauthorised access.