CCNA flashcards

Network Infrastructure and Connectivity

• Administratively down means shutdown in the config; down/down notconnect is a physical or link-establishment problem; err-disabled needs its cause removed before the port is bounced.
• A duplex mismatch links up and errors: late collisions on the half-duplex end, CRC errors and runts on the full-duplex end.
• A speed mismatch between two hard-set ends never brings the link up.
• An autonegotiating port facing a hard-set peer senses the speed but falls back to half duplex at 10/100 Mb/s; the a- prefix in show interfaces status marks negotiated values.
• Collisions are normal only on half-duplex shared media; late collisions mean a duplex mismatch, over-length cabling or faulty hardware.
• Giants point to an MTU mismatch, and overruns, ignored frames and output drops point to capacity, not the cable.
• Twisted pair is limited to 100 m; Cat6 carries 10GBASE-T only on short runs, while Cat6a carries it to 100 m.
• Like devices need a crossover cable unless Auto-MDIX is active, and hard-coding speed and duplex can disable Auto-MDIX; consoles use a rollover cable.
• SX/SR optics are multimode short reach, LX/LR single-mode long reach; check Rx against the far end's Tx, clean connectors first, and attenuate an overloaded receiver.
• Use grounded shielded cable or fiber against EMI, and fiber between buildings with different ground potentials.

• A hypervisor abstracts the host's CPU, memory, storage and NICs, gives each VM a share and keeps VMs isolated.
• Type 1 runs on the hardware (ESXi, Hyper-V, KVM, Xen); Type 2 runs as an app on a host OS (Workstation, Fusion, VirtualBox), and its VMs stop when that OS restarts.
• Every VM needs its own guest OS, which need not match the host, plus drivers for the virtual devices it is given.
• A snapshot is a rollback point with a growing delta disk on the same datastore, not a backup; revert discards changes, delete keeps them.
• Overcommitted vCPUs wait for free physical cores, so a VM's performance can depend on how busy the rest of the host is; CPU ready time on the hypervisor shows it.
• A virtual switch keeps same-host, same-VLAN traffic inside the host; different VLANs are routed outside and hairpin back over the uplink.
• A host with VMs in several VLANs needs an 802.1Q trunk uplink, and the switch learns one MAC per vNIC on that port.
• Live migration keeps the VM's MAC and IP, so the destination needs the VM's storage and its VLAN.
• Containers share the host kernel: namespaces isolate what they see, cgroups limit what they use, and a host kernel flaw affects them all.
• On Docker's default bridge, outbound traffic is NATed to the host IP and inbound needs -p host-port:container-port; Kubernetes recreates managed containers when a node fails.

• Block size = 256 minus the mask value in the interesting octet; subnets start at its multiples, and the broadcast is the next multiple minus 1.
• Usable hosts = 2^h − 2; count the gateway as a device, and pick the smallest prefix that fits when the design says so.
• Borrowing s bits gives 2^s subnets; from a fixed starting prefix, subnet bits and host bits trade one for one, so check every requirement.
• A VLSM subnet must start on a multiple of its own block size; expand every allocation to its full range before looking for gaps.
• An address ending in .0 or .255 can be a valid host when the mask is shorter than /24; judge it only under its own mask.
• RFC 1918 is exactly 10/8, 172.16–172.31 and 192.168/16; 100.64.0.0/10 is CGN shared space, 169.254/16 is link-local, 127/8 is loopback.
• /30 leaves two hosts, /31 (RFC 3021) uses both addresses on a point-to-point link, /32 suits loopbacks.
• On IOS, re-entering ip address replaces the primary, the secondary keyword adds a subnet, ip address dhcp leases one, and an overlapping subnet is refused with a message naming the colliding interface.
• Only show ip interface (or the running config) lists secondary addresses; show ip interface brief and show interfaces show the primary alone.
• Check the on-link decision from both the host's and the router's side: a fix that only makes one side agree leaves the return path broken.

• Drop only leading zeros in a hextet and use :: once; RFC 5952 compresses the longest zero run, the first one on a tie, and never a single zero hextet.
• First hextet 2000–3FFF is global unicast, FC/FD unique local (internal only), FE80 link-local, FF multicast; :: is unspecified and ::1 loopback. Site-local FEC0::/10 is deprecated.
• Modified EUI-64: split the MAC, insert FFFE, flip the 0x02 bit of the first byte (00→02, A8→AA); reverse it by removing FFFE and flipping the bit back.
• Each ipv6 address command adds an address (no secondary keyword); ipv6 enable gives link-local only; autoconfig makes the router a SLAAC client, and autoconfig default also installs a default route.
• A Cisco router sends RAs only with ipv6 unicast-routing; by default it advertises the prefixes of the global addresses on the interface, so a LAN interface with only a link-local address sends RAs with no prefix.
• SLAAC needs a /64; any other prefix length in an RA is ignored for addressing, even though hosts may still learn the gateway.
• Hosts always learn their default gateway from RAs (the router's link-local source address); DHCPv6 has no gateway option, so never stop RAs to force DHCPv6.
• O flag = stateless DHCPv6 (SLAAC address + DHCPv6 options); M flag plus a no-autoconfig prefix = addresses from stateful DHCPv6 only.
• Expand addresses before comparing subnets: 7C is 007C, not 07C0; /48 to /56 uses the high byte of the fourth hextet, and block numbers must be converted to hex.
• [TEN] means DAD is running, [DUP] means the address is in use elsewhere; a duplicate link-local disables IPv6 on the interface, a duplicate global is just not used.

• 2.4 GHz gives the most range and penetration; 5 and 6 GHz give more channels and capacity with shorter range; 6 GHz serves only Wi-Fi 6E and newer clients.
• In 2.4 GHz only channels 1, 6 and 11 do not overlap; in 5 GHz, UNII-2 and UNII-2e (52-144) are DFS channels that an AP must leave when it detects radar.
• Wider channels raise per-client peak rates but halve the channel count per doubling; dense areas use 20 or 40 MHz.
• SNR = RSSI minus noise; Cisco's voice guidance is at least -67 dBm and 25 dB SNR, and both must be met.
• WEP = RC4, WPA = TKIP, WPA2 = AES-CCMP, WPA3 = SAE with PMF required (GCMP-256 in 192-bit Enterprise mode).
• Personal shares one passphrase, Enterprise uses 802.1X and RADIUS per user, and Enhanced Open (OWE) encrypts each client without authenticating anyone.
• 6 GHz allows only WPA3-Personal (SAE), WPA3-Enterprise or OWE, all with PMF required; WPA2 and transition modes are not offered there.
• Co-channel interference shows high utilization with normal retries; adjacent-channel and non-802.11 interference raise retries and lower SNR.
• A 169.254.x.x address means no DHCP offer; a gateway outside the subnet or a lower-metric competing default route breaks only off-subnet traffic.
• Compare the client's saved profile with what the SSID offers: netsh wlan (Windows), nmcli key-mgmt (Linux), wdutil info or system_profiler (macOS).

• The client broadcasts DISCOVER and REQUEST; the broadcast REQUEST names the chosen server so the other servers release their offers.
• T1 at 50% is a unicast REQUEST to the original server; T2 at 87.5% is a broadcast REQUEST; DISCOVER only after the lease expires.
• A pool needs network (mask, not wildcard) and default-router; lease reads days hours minutes; excluded-address is global and inclusive.
• Recurring Ping conflicts mean statics inside the pool: exclude them. Clearing conflicts only returns the addresses to the pool.
• ip helper-address goes on the client-facing interface, one line per server; DHCP is already in its default forwarded list.
• The server picks a pool by giaddr, the receiving interface's primary address; the pool's mask must contain it. Smart relay can fall back to a secondary.
• The server replies to giaddr on UDP 67 and needs a route back to that subnet.
• no service dhcp disables both the IOS server and the relay; remove a pool to stop serving one VLAN.
• An IOS DHCP client installs its default route at distance 254; tune it with ip dhcp client default-router distance.

Switching and Network Access

• no switchport makes a routed port: it takes an IP address, belongs to no VLAN and runs no spanning tree; show interfaces switchport reports Switchport: Disabled.
• A DTP trunk needs at least one end that asks (trunk or dynamic desirable); auto-auto never trunks, routers never send DTP, and nonegotiate needs a static trunk on the other end.
• switchport trunk allowed vlan with a bare list replaces the list; add, remove and except edit it, and except also covers VLANs created later.
• In show interfaces trunk, allowed-but-not-active means the VLAN is not created locally; active-but-not-forwarding means spanning tree blocks it (or it is pruned).
• The native VLAN is untagged, must match on both ends, and is still subject to the allowed list; a router receives it on a dot1Q native subinterface or the physical interface.
• An enabled SVI is up only while its VLAN exists and at least one port carrying it is up and forwarding; administratively down means shutdown.
• A multilayer switch routes IPv4 only with ip routing and IPv6 only with ipv6 unicast-routing; ip default-gateway is used only when routing is off.
• LACP active/passive (at least one active), PAgP desirable/auto, and on only with on; member ports must match locally, and LACP does not compare VLAN lists between switches.
• A Layer 3 port-channel needs routed members and the IP address on the Port-channel interface.
• EtherChannel hashes each flow onto one link; LACP allows eight active links, the lower system priority picks them, max-bundle caps and min-links sets a floor.

• A host port is switchport mode access plus switchport access vlan; the hard-coded mode stops DTP trunking, and switchport nonegotiate (static ports only) also stops it sending DTP.
• On a trunk the access VLAN is ignored and untagged frames go to the native VLAN; on an access port the trunk settings are ignored.
• Assigning a missing VLAN creates it (VLAN00xx); deleting a VLAN leaves its ports assigned but Inactive and forwarding nothing until the VLAN is recreated.
• Real segmentation is a separate VLAN, subnet and gateway; secondary subnets, port ACLs and port security in a shared VLAN are not. Broadcast and link-local multicast discovery stops at the VLAN boundary.
• With a voice VLAN, untagged frames join the access VLAN and frames tagged with the voice VLAN join it, from any device; Cisco phones learn it via CDP, third-party phones via LLDP-MED (needs lldp run).
• PoE allocates the class maximum at the switch: 15.4 W (af, Class 0 and 3), 30 W (at, Class 4), 60/90 W (bt Type 3/4); a port is powered only if the allocation fits the remaining budget and any auto max cap.
• power inline static guarantees power, never disables it, auto max caps it, and police err-disables on overdraw unless action log is set; no command makes PoE+ hardware deliver 802.3bt power.
• Local-mode and centrally switched FlexConnect APs need an access port in the management VLAN; standalone and locally switched FlexConnect APs need a trunk whose native VLAN is the management VLAN.
• Hypervisor uplinks are trunks; switch-independent teaming (default vSphere, Hyper-V SET) needs no channel-group, standard-vSwitch IP hash needs mode on, and LACP needs a distributed switch LAG.
• LACP needs at least one active end; mismatched members are suspended (s); one flow always uses one member, and each end hashes only its own transmitted traffic.

• In CDP and LLDP tables, Local Intrfce is your port and Port ID is the neighbor's port; a link is confirmed when both ends agree.
• CDP is Cisco proprietary and on by default; LLDP (IEEE 802.1AB) is vendor-neutral and off by default on Catalyst IOS XE until lldp run, and it must run on both ends.
• The brief tables never show addresses or versions: use show cdp neighbors detail or show cdp entry <name>.
• Capability letters differ: CDP S is Switch, LLDP S is Station and an LLDP switch shows B; CDP T is Trans Bridge, LLDP T is Telephone; R S I from a Catalyst means it routes.
• CDP 60 s / 180 s, LLDP 30 s / 120 s; entries age by the sender's advertised holdtime, and clear cdp table removes stale ones without a config change.
• no cdp run is device-wide, no cdp enable is one port in both directions; LLDP transmit and receive are separate, and CDP and LLDP settings never affect each other.
• Ping: ! reply, . timeout, U unreachable, M could not fragment, & TTL expired (loop); alternating U. or M. is ICMP rate limiting.
• Extended ping with a LAN source tests the return route; repeat catches intermittent loss; DF plus size or a sweep finds the path MTU.
• Traceroute stars in the middle of a completed trace mean a silent hop; two addresses alternating mean a routing loop.
• The log buffer is lost on reload; show version's uptime and last reload reason explain the outage, and a new image runs only after a reload.

• The root bridge has the lowest bridge ID: priority first, MAC address only as a tie-breaker; with all defaults the lowest MAC wins.
• Priority is configured in multiples of 4096 (0–61440); show output displays it plus the VLAN number (the extended system ID).
• root primary writes 24576, or 4096 below a lower existing root; root secondary writes 28672; both are one-time macros saved as plain priority lines.
• The root port has the lowest cumulative root path cost; ties go to the lowest sender bridge ID, then sender port priority, then sender port number.
• Port cost steers the local switch's own root port; port priority is sent to neighbours and steers their choice between parallel links.
• Alternate = better BPDU from another switch (standby path to the root); backup = better BPDU from the same switch on a shared segment. Both discard.
• Rapid PVST+ states are discarding, learning and forwarding; IOS still shows a discarding port as BLK.
• Rapid transitions need an edge port or a full-duplex point-to-point link to an RSTP neighbour; Shr and Peer(STP) ports fall back to timers.
• PortFast makes an edge port that forwards at once; a received BPDU removes edge status; trunks need portfast trunk; edge ports never cause topology changes.
• BPDU guard err-disables on any BPDU (manual or errdisable recovery); root guard blocks on superior BPDUs and loop guard on missing BPDUs, both recovering automatically.

IP Routing

• Route entries read code, prefix/mask, [administrative distance/metric], via next hop, age, exit interface; the first bracket number is always the AD.
• The longest matching prefix wins for every packet, whatever its source, distance or metric; different prefix lengths coexist in the table.
• Administrative distance compares only routes for the identical prefix from different sources: connected 0, static 1, eBGP 20, EIGRP 90, OSPF 110, RIP 120, external EIGRP 170, iBGP 200.
• Metrics compare paths within one protocol only; the best path is installed and worse ones stay in the protocol's database.
• Equal-best metrics are installed together and load-shared; OSPF on IOS installs up to four by default.
• C and L routes come from an addressed, up interface; L is the router's own /32 (IPv4) or /128 receive (IPv6) address.
• Heading lines such as "is variably subnetted" are not routes and match no traffic.
• The default route (0.0.0.0/0, ::/0) matches everything but loses to every other match; with no match and no gateway of last resort, the packet is dropped.
• A next-hop-only route needs a recursive lookup; it is withdrawn when its next hop no longer resolves and re-resolves through any covering route.
• OSPFv3 next hops are link-local addresses, always shown with their exit interface.

• IPv4: ip route <network> <dotted mask> {next-hop | interface [next-hop]} [distance]; IPv6: ipv6 route <prefix/length> with the same options.
• The default route is 0.0.0.0 0.0.0.0 or ::/0. A routing device ignores ip default-gateway; an all-zeros address with a full-length mask matches one address only.
• A network route must use the network address and the mask that covers exactly the intended range; IOS rejects host bits with %Inconsistent address and mask.
• Host routes (/32, /128) always win by longest match, so a stale one silently breaks a single destination.
• A static route is installed only while its next hop resolves and no lower-distance route to the same prefix exists; it reinstalls itself automatically.
• A floating static needs the identical prefix and a distance above the primary's and below 255; equal distances load-share.
• When a static's next hop is on a connected Ethernet subnet, the route stays while the interface is up, so remote failures do not trigger the floating backup without tracking.
• Interface-only statics on Ethernet ARP for every destination and rely on proxy ARP; give them a next hop.
• IPv6 needs ipv6 unicast-routing to forward and send RAs, and a link-local next hop must be paired with its exit interface.
• Static routes are one-way: every hop needs a return route, including to the subnet a router's own ping is sourced from.

• A network statement selects interfaces by address and wildcard; the advertised prefix always comes from the interface's own address and mask, and an interface-level ip ospf <pid> area <area> overrides a matching network statement.
• A passive interface keeps its subnet advertised but sends no hellos and forms no adjacency; passive-interface default also silences uplinks until you add no passive-interface for each.
• Router ID order: router-id command, highest up loopback IPv4 address, highest up interface IPv4 address. A new value takes effect only after clear ip ospf process or a reload; duplicate router IDs block adjacencies.
• Hello/dead timers, area ID and (OSPFv2 on broadcast links) subnet and mask must match; process ID, cost and priority are local. Setting only the hello interval makes the dead interval four times the hello.
• INIT means hellos are getting through in one direction only (often an ACL that does not permit OSPF, IP protocol 89); EXSTART/EXCHANGE usually means an MTU mismatch, fixed by matching the MTU or ip ospf mtu-ignore on the smaller-MTU side.
• DROTHERs stay 2WAY with each other and FULL with the DR and BDR; that is normal.
• DR/BDR: highest priority, then highest router ID; priority 0 never wins. The election is not preemptive: the BDR takes over a failed DR, a new BDR is elected, and a returning DR becomes a DROTHER.
• Hellos go to 224.0.0.5 (FF02::5); DROTHER updates go to 224.0.0.6 (FF02::6) and the DR re-floods to 224.0.0.5.
• Point-to-point on Ethernet: no DR/BDR, FULL/ - with Pri 0, still 10/40 timers and 224.0.0.5 hellos. A point-to-point/broadcast mismatch reaches FULL but its routes are not installed.
• OSPFv3 needs ipv6 unicast-routing, ipv6 ospf <pid> area <area> per interface and a 32-bit router ID (configure it on IPv6-only routers); it uses link-local next hops, has no prefix check and advertises every global prefix on the interface.

• Hosts point at the FHRP virtual IP, never a router's interface address; the forwarding router answers ARP for it with the virtual MAC, so failover needs no change on the hosts.
• HSRP roles are Active, Standby and Listen (states Init, Learn, Listen, Speak, Standby, Active); VRRP roles are Master and Backup (states Initialize, Backup, Master).
• Both elect by highest priority (default 100), then highest interface IP; a VRRP address owner runs at priority 255 and is always Master while up.
• HSRP preemption is off by default and must be configured on the router that should take over; VRRP preemption is on by default and needs a strictly higher priority.
• Tracking decrements lower the current priority (shown as Priority X (configured Y)) and add up; the peer takes over only if the new priority is below it and the peer can preempt.
• HSRPv1 uses 0000.0c07.acXX and 224.0.0.2, HSRPv2 0000.0c9f.fXXX and 224.0.0.102 (both UDP 1985), VRRP 0000.5e00.01XX and 224.0.0.18 (IP protocol 112).
• Default failover: HSRP up to the 10-second hold time; VRRP about 3 advertisements plus skew (about 3.6 s at priority 100); the new forwarder sends gratuitous ARP from the virtual MAC.
• Both routers Active or Master means hellos are not being processed: group, version, protocol or authentication mismatch, filtered hellos, or a Layer 2 split.
• Load sharing needs multiple groups with a different forwarding router in each; IPv6 HSRP requires version 2 and the Active router advertises the virtual link-local in RAs.

Network Services and Security

• username NAME privilege 15 secret stores a one-way hash; password 0 is clear text and password 7 (including service password-encryption) is reversible.
• Without AAA, login local checks local accounts and transport input ssh refuses Telnet; apply both to every VTY range.
• aaa new-model must come before every aaa command, server groups included; after it, lines use the default list, VTY lines fall back to the local database if no default list exists, and the console is not authenticated at all until a list covers it.
• The default list applies automatically; a named list works only where login authentication NAME is applied.
• Fallback happens on silence (error), never on a reject (fail): group SERVERS local uses local accounts only when no server answers.
• group tacacs+ means every TACACS+ server; group NAME means only that group's members.
• TACACS+ is TCP 49, encrypts the whole body and separates authorization (per-command); RADIUS is UDP 1812/1813, encrypts only the password and combines authentication with authorization.
• Privilege levels from local accounts or the server are applied only with aaa authorization exec; accounting exec logs sessions, accounting commands logs commands.
• ip tacacs, ip radius and ip ssh source-interface are separate commands; the source must match what the server or firewall expects.
• SCP and SFTP use SSH on TCP 22; IOS as an SCP server needs ip scp server enable, exec authorization and a privilege 15 user; copy to running-config merges, configure replace replaces.

• Inside or outside says whose address it is; local or global says where it is seen from. With only inside source NAT, outside local equals outside global.
• NAT translates only traffic crossing between an ip nat inside and an ip nat outside interface; swapped roles or a DMZ marked outside mean nothing is translated.
• ip nat inside source static lists the local address first, works in both directions, keeps ports, overrides dynamic rules for that host and survives clear ip nat translation *.
• Static PAT maps protocol, local IP and port to a global IP (or interface) and port; the local port is where the server listens, the global port is what clients use.
• Only static NAT and static PAT let outside hosts start connections; dynamic NAT and PAT entries exist only after inside traffic.
• A pool takes a subnet mask or prefix length, usable host addresses only, and must not include statically mapped addresses; without overload, a full pool drops new hosts and counts misses.
• overload turns a pool or interface rule into PAT, which separates sessions by source port; the interface form follows a DHCP-learned address.
• Inside to outside, NAT runs after routing and before the outbound ACL; outside to inside, the inbound ACL runs before NAT. The upstream router must route the whole global block back to the NAT router.

• A = IPv4, AAAA = IPv6, CNAME = alias to another name, MX = mail hosts, NS = delegation, PTR = address to name.
• Dual-stack clients try IPv6 first, so a missing or wrong AAAA record breaks only clients that use IPv6.
• A CNAME must be the only record at its name and can never sit at the zone apex; chains are legal, and a deleted target gives NXDOMAIN with the CNAME in the answer.
• MX: the lowest preference is primary and equal preferences share load; the target must be a host name with an A/AAAA record, never an IP or a CNAME. With no MX, senders use the domain's own A/AAAA.
• Delegating a subdomain needs NS records in the parent, plus glue A/AAAA records when the name server is inside the delegated zone; lame delegation causes SERVFAIL for the whole subdomain.
• PTR names reverse the octets under in-addr.arpa (nibbles under ip6.arpa) and are controlled by the address owner; mail receivers want PTR and A to agree (FCrDNS).
• Lower TTLs one old-TTL period before a change; NXDOMAIN answers are cached for the SOA-derived negative TTL; clear a stale entry at the resolver that holds it.
• NXDOMAIN = the name has nothing, NODATA = the name exists without that type, SERVFAIL = tried and failed, REFUSED = would not try.
• nslookup takes the name first and the server last, and bypasses the hosts file; Non-authoritative means a cached or recursive answer.
• On IOS XE: ip name-server sets the server, ip domain name expands short names, ip host adds a static entry (perm in show hosts) that beats DNS.

• IPsec is an open-standard Layer 3 framework: confidentiality (AES), integrity and origin authentication (HMAC such as SHA-256), anti-replay (sequence numbers); Diffie-Hellman makes the keys.
• Site-to-site: gateways encrypt for whole subnets and hosts need no software. Remote access: a client on each device, per-user authentication, an inner address from the headend's pool.
• ESP is IP protocol 50 and encrypts plus authenticates; AH is IP protocol 51, authenticates only, and its check covers the outer IP addresses, so it breaks through NAT.
• Tunnel mode adds a new outer header and encrypts the whole original packet (ESP); transport mode keeps the original header, so host addresses stay visible. ESP's ICV never covers the outer IP header.
• IKE runs on UDP 500. IKEv1: phase 1 ISAKMP SA (main mode, six messages), phase 2 quick mode builds the IPsec SAs. IKEv2: IKE_SA_INIT + IKE_AUTH, four messages for the IKE SA and first IPsec SA.
• ISAKMP policy = encryption, hash, authentication, DH group, lifetime. Transform set = ESP or AH, its algorithms, mode. Crypto map = peer, ACL, transform set, PFS.
• MM_NO_STATE = no reply or no matching policy; MM_KEY_EXCH stuck = authentication (pre-shared key) failing; QM_IDLE = phase 1 done, so a missing IPsec SA is a phase 2 problem.
• IPsec SAs are one-way, one per direction with its own SPI. Encaps rising with decaps at zero means the return direction is broken.
• Firewall: no NAT = UDP 500 + IP protocol 50; with NAT-T = UDP 500 + UDP 4500. PFS = a new DH exchange per IPsec SA; certificates scale and revoke per device but need enrollment and NTP.
• GRE over IPsec carries routing-protocol multicast (use transport mode when the GRE and IPsec endpoints match). TLS remote access uses TCP 443 with DTLS on UDP 443; split tunneling sends only listed networks through the VPN.

• ACLs are checked top-down and the first matching entry decides; a broad entry above a specific one shadows it.
• Every ACL ends with an implicit deny, so a list of only deny entries blocks all traffic.
• Standard ACLs (1–99, 1300–1999) match only the source address; extended ACLs (100–199, 2000–2699) match protocol, source, destination and ports.
• A wildcard 0 bit must match and a 1 bit is ignored; host = 0.0.0.0 and any = 255.255.255.255, and IOS zeroes ignored address bits when it stores an entry.
• Standard ACLs go near the destination and extended ACLs near the source, unless the scenario's constraints dictate otherwise.
• One ACL per interface per direction; a second ip access-group in the same direction replaces the first.
• Outbound ACLs do not filter router-originated traffic, but inbound ACLs do filter routing-protocol packets and replies addressed to the router.
• A port operator applies to the address it follows; client requests normally match the destination port.
• ACLs are stateless; established matches TCP segments with ACK or RST set, letting replies in while blocking new inbound connections.
• Use sequence numbers to insert an entry between two others, delete one entry with no <seq> and resequence a crowded list, all without removing the ACL from the interface; apply vty filters with access-class in on every vty line.

• DHCP snooping drops DHCP server messages (OFFER, ACK, NAK) on untrusted ports; every port is untrusted by default, so trust only the path to the real server.
• DHCP snooping needs both ip dhcp snooping (global) and ip dhcp snooping vlan; show ip dhcp snooping separates configured from operational VLANs.
• Starvation with forged chaddr values is stopped by DHCP snooping MAC verification and its rate limit, not by port security; exceeding the rate limit error-disables the port.
• Snooping inserts option 82 with giaddr 0.0.0.0: an IOS DHCP server drops it (fix with no ip dhcp snooping information option), and a downstream snooping switch drops it on untrusted ports (fix with allow-untrusted).
• DAI drops ARP whose sender IP and MAC pair matches no binding; bindings exist only for DHCP exchanges the switch saw, and static hosts need an ARP ACL (the static keyword makes its implicit deny final).
• DAI trust is separate from DHCP snooping trust; trust links between DAI switches. Untrusted ports allow 15 ARP packets per second by default before error-disabling.
• Storm control filters by default and stays up; the first level is rising and the second falling; action shutdown error-disables and action trap only notifies.
• RA guard with device-role host blocks RAs and redirects on host ports; the router-facing port needs a router role; DHCPv6 server messages need DHCPv6 guard.
• Port security needs a static mode; defaults are maximum 1, violation shutdown and no aging. Protect is silent, restrict logs and counts, shutdown error-disables.
• Sticky addresses live in the running config until saved; aging time is in minutes; a secure MAC seen on another secure port in the same VLAN is a violation; shutdown/no shutdown or errdisable recovery cause brings a port back.

AI, and Network Operations and Management

• Generative AI answers a prompt; agentic AI pursues a goal by planning steps and calling tools, and can be triggered by events without a person starting it.
• The agent loop is observe, reason/plan, act through a tool, then observe the result, repeated until the goal is met; the agent chooses each next step.
• An agent's real permissions are its tools and credentials: remove write tools, use read-only (show-only) device accounts and mask secrets in tool output. Prompt rules are not enforcement.
• Human-in-the-loop approval gives a person the decision on each change; read-only data collection is the safe class of action to run without approval.
• Staged rollout to one site limits the blast radius, and a backup with a tested rollback speeds recovery.
• Check AI configuration for implicit deny, replace-versus-add commands, fixes that remove protections, the wrong platform and changes outside the requested scope.
• Reject an AI diagnosis when any evidence contradicts it, such as late collisions on a half-duplex port or a DHCP server that still serves other VLANs.
• Data classification decides which AI service may receive the data and what must be masked: secrets, keys, community strings and customer-identifying data.
• Output format makes replies usable (commands only, JSON with named fields); persona sets role and audience; instructions give the task, platform and release, evidence and scope.

• Device-based management configures each device on its own through the CLI; it needs no platform but drifts and does not scale.
• Cloud-based management is a vendor-hosted platform: only management data goes to the cloud, user traffic stays local, and devices keep forwarding during a cloud outage.
• Cloud-managed devices are claimed by serial number and call home outbound, so they need only outbound reachability: the platform's changes return over the session the device opened.
• Controller-based management (Catalyst Center) centralises discovery, templates, policy and assurance on a platform you run; switches still forward traffic themselves and keep their CLI (a WLC in local mode is the exception that tunnels client data).
• Northbound = applications to the controller (REST API); southbound = controller to devices (NETCONF, RESTCONF, SSH, SNMP). A call to the controller is northbound even when it returns device data.
• Automation applies changes consistently at scale, so mistakes scale too: test in a lab, pilot, then roll out in stages.
• Infrastructure as code keeps the intended configuration in Git, reviews changes by pull request, deploys by pipeline and rolls back by reverting a commit.
• Declarative definitions say what the end state is; imperative scripts say how. Idempotent desired-state apply changes only what differs.
• Drift comes from out-of-band changes: commit emergency changes back to the repository and compare devices with it continuously.

• The SNMP manager (NMS) polls; the agent on each device answers from its MIB, where every object has an OID. Vendor objects sit under 1.3.6.1.4.1 and need the vendor's MIB loaded into the NMS to be named.
• Get, GetNext, GetBulk and Set go from manager to agent on UDP 161; traps and informs go from agent to manager on UDP 162. GetBulk arrived in SNMPv2 and cuts exchanges when walking tables.
• Traps are sent once with no acknowledgment; informs are acknowledged and resent, and need SNMPv2c or v3.
• SNMPv1/v2c send the community string in clear text. SNMPv3 uses users and three levels: noAuthNoPriv, authNoPriv (HMAC, data readable) and authPriv (authenticated and encrypted).
• An ACL on a community (snmp-server community NAME RO 15) silently drops requests from unlisted addresses, so the NMS times out; snmp-server host only names notification receivers.
• Poll counters to trend utilisation; rely on pushed notifications or syslog to learn quickly that something happened.
• Severity runs 0 emergencies, 1 alerts, 2 critical, 3 errors, 4 warnings, 5 notifications, 6 informational, 7 debugging; lower is worse.
• A threshold sends its own level and every lower-numbered level. logging trap sets the server threshold (default informational); terminal monitor shows logs in an SSH/Telnet session.
• IOS sends server messages with facility local7 by default (change with logging facility); PRI = facility × 8 + severity.
• An asterisk on a timestamp means a non-authoritative clock. Use a common NTP source plus service timestamps log datetime msec to order events across devices.

• Ansible is agentless and push-based: the control node opens SSH to each device, and IOS modules run on the control node, so a switch needs only SSH and an account — and must permit the control node's address on its VTY lines.
• IOS inventories need ansible_connection: ansible.netcommon.network_cli (how to connect) and ansible_network_os: cisco.ios.ios (which platform).
• Enable mode is privilege escalation: ansible_become: true plus ansible_become_method: enable (not sudo) and an enable password from Vault; scope it with group_vars or host_vars.
• host_vars beat group_vars for the same variable; anything the host does not set is inherited. A :children group includes all hosts of its child groups.
• ios_command runs EXEC commands only; register saves the result, and stdout / stdout_lines are indexed by command order from 0. Answer confirmation prompts with command/prompt/answer.
• wait_for re-runs commands up to retries times after the first try, interval seconds apart, and fails the task if the conditions never pass; match: all is the default, match: any passes on one true condition.
• ios_config puts lines under parents and pushes only what is missing; before + match: exact rebuilds a section exactly. Write full keywords — abbreviated lines always look missing.
• save_when defaults to never; changed saves only when the task changed something. backup: true keeps a copy of the running config on the control node.
• Dry-run with --check (ios_config returns the would-be commands; its --diff needs diff_against) and scope with --limit; in the PLAY RECAP, unreachable means no session and failed means a task errored after connecting. Ansible has no automatic undo.

Yes — the whole CCNA deck is free and needs no account, as is every CCNA revision lesson. Create a free account to save progress and drill practice questions; full-length mock exams are a one-time unlock per certification.