Your FREE CCNA Flashcards 2026 – 250+ Cards

A seven-layer framework for network communication: Physical, Data Link, Network, Transport, Session, Presentation, Application (L1→L7).

A Layer 3 device that forwards packets between different IP networks using a routing table.

A Layer 2 device that forwards frames within a network using a MAC address table.

Marks which bits of an IPv4 address are the network portion (1s) and which are the host portion (0s).

TCP is connection-oriented and reliable (3-way handshake, ACKs); UDP is connectionless, best-effort, and faster.

The router IP a host sends traffic to when the destination is on a different subnet.

Transmits raw bits over the medium — cables, connectors, radio, voltage. PDU: bits.

Local delivery using MAC addresses; switches operate here. PDU: frame.

Logical addressing and routing between networks using IP; routers operate here. PDU: packet.

End-to-end delivery and ports; TCP and UDP. PDU: segment.

Wrapping data with each layer's header going down the stack: data → segment → packet → frame → bits.

A 48-bit hardware address burned into a NIC, written in hex; used for Layer 2 delivery on the local link.

Address Resolution Protocol — maps a known IPv4 address to its MAC address on the local network.

The set of devices that receive a Layer 2 broadcast frame; a router or a VLAN boundary separates them.

A network segment where frames can collide; each switch port is its own collision domain (full duplex avoids collisions).

TCP connection setup: SYN, then SYN-ACK, then ACK. The connection is open after the ACK.

A 32-bit logical address written as four dotted-decimal octets (e.g., 192.168.1.10).

Slash notation (e.g., /24) showing how many leading bits of an IP are the network portion.

Usable hosts = 2ⁿ − 2, where n = host bits (subtract the network and broadcast addresses).

Block size = 256 − the mask's interesting octet; subnets increment by the block size.

Non-routable ranges 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 — translated by NAT to reach the internet.

169.254.0.0/16 address a host self-assigns when no DHCP server answers — a DHCP-failure clue.

127.0.0.0/8 (usually 127.0.0.1) — tests the local TCP/IP stack.

A 128-bit address written as eight groups of four hex digits, separated by colons.

A publicly routable IPv6 address, typically in the 2000::/3 range.

An automatically configured FE80::/10 address used only on the local link (e.g., for neighbor discovery).

FC00::/7 (commonly FD00::/8) — private IPv6, like RFC 1918 for IPv4; not internet-routable.

A method to build the 64-bit IPv6 interface ID from a 48-bit MAC by inserting FFFE and flipping the 7th bit.

An address assigned to multiple interfaces; traffic goes to the nearest one (by routing metric).

FF00::/8 addresses that deliver to a group; IPv6 has no broadcast — it uses multicast instead.

Fiber with a thin core for long distances using a laser; lower attenuation than multimode.

Fiber with a wider core for shorter, high-speed runs; typically uses LED/VCSEL light sources.

Cat 5e/6/6a/8 UTP cabling; cheap and common but limited to about 100 meters per run.

One end half-duplex and the other full-duplex — causes collisions, late collisions, and poor throughput.

A two-tier data-center fabric where every leaf switch connects to every spine — predictable, low latency.

Combines core and distribution into one layer plus an access layer; common in smaller networks.

Core (backbone), distribution (policy/routing), and access (endpoints) layers in enterprise networks.

802.3af/at/bt — delivers electrical power and data over one Ethernet cable to APs, phones, and cameras.

A firewall adding deep packet inspection, application awareness, and IPS beyond stateful filtering.

Running multiple virtual machines on one physical server via a hypervisor, each with its own OS.

Lightweight, isolated app environments that share the host OS kernel (e.g., Docker) — faster and smaller than VMs.

Virtual Routing and Forwarding — multiple independent routing tables on one router for traffic separation.

A switch records the source MAC and ingress port of each frame to build its MAC address table.

A switch floods a frame out all ports (except the source) when the destination MAC is unknown (unknown unicast).

Channels 1, 6, and 11 — the only non-overlapping channels in the 2.4 GHz band.

Service Set Identifier — the human-readable name of a wireless network.

Establishes, manages, and terminates sessions between applications. PDU: data.

Translation, encryption/decryption, and compression of data (TLS, ASCII, JPEG). PDU: data.

User-facing network services and protocols: HTTP, FTP, DNS, SMTP. PDU: data.

The 4-layer model the internet runs on: Link, Internet, Transport, Application; maps onto OSI.

Protocol Data Unit — the name of data at each layer: bits (L1), frame (L2), packet (L3), segment (L4).

An obsolete Layer 1 device that repeats incoming bits out every port, creating one collision domain.

A host such as a PC, phone, or server that consumes or provides network services.

Network Interface Card — the hardware (with a MAC address) that connects a host to the network.

One of the four 8-bit segments of an IPv4 address (range 0–255).

Dividing a network into smaller subnetworks by borrowing host bits for the network portion.

Variable Length Subnet Masking — using different mask lengths within a network to size subnets efficiently.

255.255.255.0 — 254 usable hosts, block size 256 (last octet).

255.255.255.192 — 62 usable hosts, block size 64.

255.255.255.252 — 2 usable hosts; used for point-to-point links.

Drop leading zeros in each group; replace one run of all-zero groups with :: (only once).

Running IPv4 and IPv6 simultaneously on the same device during migration.

Bandwidth is the link's capacity; throughput is the actual data rate achieved in practice.

The delay for data to travel from source to destination, often measured as round-trip time.

Variation in packet delay — disruptive to real-time traffic such as voice and video.

Maximum Transmission Unit — the largest frame payload that can be sent without fragmentation (Ethernet default 1500 bytes).

A logical Layer 2 segment that splits one switch into multiple broadcast domains; devices in different VLANs need a router to talk.

A switch port that belongs to a single VLAN and carries untagged traffic to one end device.

A switch link that carries traffic for multiple VLANs, tagging frames with 802.1Q.

The IEEE standard that inserts a 4-byte VLAN tag into Ethernet frames so VLANs span trunk links.

The one VLAN whose traffic is sent untagged across an 802.1Q trunk (default VLAN 1; change it for security).

A separate VLAN on an access port for an IP phone, while a daisy-chained PC uses the data VLAN.

VLAN 1 — all switch ports belong to it by default; best practice is not to use it for user data.

Routing between VLANs using a router-on-a-stick (subinterfaces) or a Layer 3 switch (SVIs).

Cisco Discovery Protocol — a Cisco proprietary Layer 2 protocol that discovers directly connected Cisco neighbors.

Link Layer Discovery Protocol — the vendor-neutral (IEEE 802.1AB) equivalent of CDP.

Bundling multiple physical links into one logical link for more bandwidth and redundancy.

Link Aggregation Control Protocol (802.3ad) — the standard protocol that negotiates an EtherChannel.

Port Aggregation Protocol — Cisco's proprietary EtherChannel negotiation protocol.

Prevents Layer 2 loops by electing a root bridge and blocking redundant paths until needed.

Cisco's per-VLAN Rapid Spanning Tree (based on 802.1w) — runs a separate, fast-converging STP instance per VLAN.

The switch with the lowest bridge ID (priority + MAC); it becomes the reference point of the spanning tree.

A switch's STP identity = bridge priority (default 32768 + VLAN) plus its MAC address.

The single port on a non-root switch with the lowest cost path to the root bridge.

The forwarding port on each segment with the lowest cost to the root; non-designated ports block.

Puts an access port directly into forwarding, skipping STP listening/learning — for end-device ports only.

Disables a PortFast port if it receives a BPDU, protecting the topology from rogue switches.

Discarding, Learning, and Forwarding (RSTP simplifies the older STP blocking/listening/learning/forwarding).

An access point that relies on a Wireless LAN Controller for configuration and management (split-MAC).

A standalone access point that is configured and managed individually (no controller).

Wireless LAN Controller — centrally manages lightweight APs, pushing config, security, and RF settings.

Control And Provisioning of Wireless Access Points — the tunnel protocol between a lightweight AP and a WLC.

Link Aggregation on a WLC — bundles its physical ports into one logical interface to the switch.

Console, Telnet, SSH, HTTP/HTTPS, plus AAA via RADIUS/TACACS+ for admin authentication.

On a WLC you define the SSID, map it to an interface/VLAN, and set security, QoS, and advanced settings.

A WLC setting (Platinum/Gold/Silver/Bronze) that prioritizes wireless traffic such as voice and video.

A trunk carries many tagged VLANs between switches; an access port carries one untagged VLAN to a host.

Dynamic Trunking Protocol — Cisco protocol that auto-negotiates trunking; disable it for security.

VLANs 1–1005; the CCNA focuses on the normal range for access/trunk configuration.

IOS command that lists VLANs and the access ports assigned to each.

Sets a port to access mode (single VLAN, untagged).

Sets a port to trunk mode to carry multiple tagged VLANs.

Assigns an access port to a specific VLAN (e.g., switchport access vlan 10).

Inter-VLAN routing using one router interface with 802.1Q subinterfaces, one per VLAN.

Switched Virtual Interface — a Layer 3 VLAN interface on a multilayer switch for inter-VLAN routing.

The time STP takes to reach a stable, loop-free topology after a change; RSTP converges far faster.

Bridge Protocol Data Unit — the STP message switches exchange to elect the root and build the tree.

Prevents a port from becoming a root port, protecting the chosen root bridge's position.

Prevents a blocking port from wrongly transitioning to forwarding if BPDUs stop arriving.

Distributes frames across the bundle by hashing source/destination MAC, IP, or port.

Configures an interface for LACP active mode in an EtherChannel.

Wireless LAN — an 802.11 network identified by an SSID and served by APs.

The wireless spectrum used by Wi-Fi — 2.4 GHz, 5 GHz, and 6 GHz bands.

Faster with many non-overlapping channels but shorter range than 2.4 GHz.

Clean spectrum used by Wi-Fi 6E/7 for high throughput and low interference.

An access point configured and monitored through a cloud dashboard (e.g., Cisco Meraki).

The list of known networks a router uses to forward packets: prefix, mask, next hop, AD, and metric.

A router selects the most specific matching route (the longest matching network mask) to forward a packet.

A router's trust ranking of routing sources; lower is preferred when multiple sources offer a route.

Directly connected route — administrative distance 0 (most trusted).

Static route — administrative distance 1.

OSPF — administrative distance 110.

EIGRP internal — administrative distance 90.

RIP — administrative distance 120.

A value a routing protocol uses to pick the best path among routes it learned (e.g., OSPF cost).

A manually configured route; predictable but does not adapt automatically to topology changes.

A 'route of last resort' (0.0.0.0/0 in IPv4, ::/0 in IPv6) used when no more specific route matches.

A static route to a specific destination subnet via a next hop or exit interface.

A static route to a single host — a /32 (IPv4) or /128 (IPv6) prefix.

A backup static route with a higher administrative distance that activates only if the primary route fails.

ip route <network> <mask> <next-hop|exit-interface> — e.g., ip route 10.0.0.0 255.0.0.0 192.168.1.2

ipv6 route <prefix/length> <next-hop|exit-interface> — e.g., ipv6 route 2001:db8::/32 2001:db8:1::1

Open Shortest Path First — a fast, link-state interior gateway protocol that uses cost as its metric.

The OSPF version for IPv4; the CCNA tests single-area OSPFv2 configuration and verification.

Default OSPF metric = reference bandwidth (100 Mbps) ÷ interface bandwidth; lower cost is preferred.

A 32-bit ID for an OSPF router — chosen by manual config, then highest loopback IP, then highest active interface IP.

Two OSPF routers form an adjacency by exchanging Hello packets and agreeing on parameters before sharing routes.

Routers must agree on Hello (default 10s on broadcast) and Dead (default 40s) timers to become neighbors.

On broadcast/multiaccess networks OSPF elects a Designated Router and Backup DR to reduce adjacencies.

Highest OSPF interface priority wins; ties break to the highest router ID. Priority 0 means never DR/BDR.

On a point-to-point link OSPF forms an adjacency directly with no DR/BDR election.

The backbone area; single-area OSPF places all routers and links in area 0.

First Hop Redundancy Protocol — provides a redundant default gateway so hosts keep connectivity if a router fails.

Hot Standby Router Protocol — Cisco FHRP; active and standby routers share a virtual IP/MAC for the gateway.

Virtual Router Redundancy Protocol — the open-standard FHRP (master/backup) sharing a virtual gateway IP.

Gateway Load Balancing Protocol — Cisco FHRP that also load-balances across multiple gateways.

The next hop used for the default route, shown in the routing table when a default route exists.

A connected route is learned automatically from an up/up interface; a static route is manually configured.

Displays the IPv4 routing table — codes, prefixes, next hops, AD, and metrics.

The letter in the routing table showing how a route was learned (C connected, S static, O OSPF, D EIGRP).

Distance vector shares its whole table with neighbors (RIP); link state shares topology to compute paths (OSPF).

Cisco's advanced distance-vector IGP; fast convergence using a composite metric (bandwidth + delay).

A simple distance-vector IGP using hop count (max 15) as its metric; rarely used today.

A collection of networks under one administrative control; OSPF runs inside one, BGP between them.

Interior Gateway Protocols (OSPF, EIGRP) route within an AS; Exterior (BGP) route between ASes.

Reduces the number of full adjacencies on a multiaccess segment so updates flow through the DR.

Stops OSPF from sending Hellos out an interface while still advertising its subnet.

'router ospf <id>' starts the process; 'network <addr> <wildcard> area <n>' enables OSPF on matching interfaces.

Verifies OSPF adjacencies, neighbor router IDs, and DR/BDR roles.

A router can install multiple equal-metric routes to the same destination and balance traffic across them.

ip route 0.0.0.0 0.0.0.0 <next-hop> — sends all unmatched traffic to the next hop.

A next-hop static route requires a recursive lookup; an exit-interface static route forwards directly.

The shared gateway IP that hosts use; the active HSRP router answers for it.

HSRP elects one active router (highest priority) to forward; the standby takes over on failure.

Network Address Translation — maps private (RFC 1918) addresses to public ones so internal hosts reach the internet.

A one-to-one fixed mapping between a private (inside local) and a public (inside global) address.

Maps inside addresses to a pool of public addresses on a first-come, first-served basis.

Port Address Translation — many private hosts share one public IP, distinguished by source port numbers.

Inside local = the private host address inside the network; inside global = its translated public address.

Network Time Protocol — synchronizes device clocks; runs client/server mode and uses a stratum hierarchy. UDP 123.

A measure of distance from an authoritative clock; stratum 0 is the reference, stratum 1 is directly attached.

Dynamic Host Configuration Protocol — auto-assigns IP, mask, gateway, and DNS via DORA. UDP 67 (server) / 68 (client).

The DHCP exchange: Discover, Offer, Request, Acknowledge.

Forwards DHCP broadcasts across subnets to a central server, configured with 'ip helper-address'.

Domain Name System — resolves names to IP addresses using a hierarchy of resolvers. Mainly UDP 53 (TCP 53 for large/zone).

A (IPv4), AAAA (IPv6), CNAME (alias), MX (mail), NS (name server), PTR (reverse), TXT (text).

Simple Network Management Protocol — a manager polls agents on UDP 161; agents send traps on UDP 162. Use v3 for security.

v1/v2c use clear-text community strings; SNMPv3 adds authentication and encryption.

A protocol for sending log messages to a central server (UDP 514) with facility and severity levels.

0 Emergency, 1 Alert, 2 Critical, 3 Error, 4 Warning, 5 Notice, 6 Informational, 7 Debugging (mnemonic: 'Every Awesome Cisco Engineer Will Need Ice cream Daily').

Quality of Service — prioritizes traffic so latency-sensitive flows (voice, video) get preferential treatment.

Identifying and grouping traffic (by port, protocol, or DSCP) so policies can be applied to each class.

Setting a value (e.g., DSCP or CoS) on a packet so downstream devices honor its priority.

Buffering and scheduling packets so high-priority traffic is sent first when a link is congested.

Policing drops or remarks traffic that exceeds a rate; shaping buffers and delays it to smooth the rate.

How each device independently treats a marked packet (e.g., expedited forwarding for voice).

Secure Shell — encrypted remote CLI access (TCP 22); replaces clear-text Telnet for device management.

A hostname, an IP domain name, and an RSA key pair (crypto key generate rsa) plus a local user and 'transport input ssh'.

File Transfer Protocol — TCP 20/21; transfers files (e.g., IOS images) but is unencrypted.

Trivial File Transfer Protocol — UDP 69; a simple, lightweight file transfer often used for IOS/config backups.

DHCP hands out IP configuration to clients; DNS resolves names to IP addresses — different jobs.

Displays the current NAT/PAT translation table on a Cisco router.

Marks router interfaces as the NAT inside (private) or outside (public) interface.

One public IP can serve thousands of internal hosts by tracking unique source ports — conserves IPv4.

A device set as an NTP client syncs its clock to a configured NTP server.

Accurate, synchronized time makes logs, certificates, and troubleshooting correlate correctly.

The range of addresses and options (gateway, DNS, lease) a DHCP server hands out for a subnet.

The time a client may use an assigned address before it must renew.

Configures a router interface to relay DHCP (and other) broadcasts to a server on another subnet.

Tools that query DNS to resolve a name and diagnose DNS problems.

The classic symptom of a DNS problem — connectivity is fine but resolution is broken.

A poll is the manager requesting data (UDP 161); a trap is the agent sending an unsolicited alert (UDP 162).

A MIB is the structured database of manageable objects; an OID identifies a specific object within it.

Emergency, Alert, Critical, Error — the most severe messages.

Differentiated Services Code Point — a 6-bit field in the IP header used to mark QoS class.

Voice traffic is typically marked Expedited Forwarding (DSCP EF / 46) for low-latency queuing.

FTP uses TCP 20/21 with authentication; TFTP uses UDP 69 with no authentication — simpler but less capable.

The core security goals: Confidentiality, Integrity, and Availability.

A threat is a potential danger; a vulnerability is a weakness; an exploit is the method that abuses a vulnerability.

A control or technique that reduces the likelihood or impact of a threat (e.g., patching, ACLs, segmentation).

Authentication (who you are), Authorization (what you may do), and Accounting (logging what you did).

An open AAA protocol (UDP) that encrypts only the password and combines authentication and authorization; common for network access.

A Cisco AAA protocol (TCP 49) that encrypts the whole payload and separates AAA; preferred for device administration.

An ordered set of permit/deny rules that filter traffic by address, protocol, or port.

Filters on the source IP address only; placed close to the destination.

Filters on source and destination IP, protocol, and port; placed close to the source.

Every ACL ends with an invisible 'deny any' — traffic matching no entry is dropped.

Top-down, first match wins; order your entries from most specific to least specific.

An inverse mask in ACLs where 0 = must match and 1 = ignore (e.g., 0.0.0.255 matches a /24).

Limits the MAC addresses learned on a switch access port; violation actions are protect, restrict, or shutdown.

Port security option that dynamically learns and saves MAC addresses to the running config.

Marks ports trusted/untrusted and drops rogue DHCP server replies on untrusted ports; builds a binding table.

Validates ARP packets against the DHCP snooping binding table, blocking ARP spoofing / on-path attacks.

Wi-Fi Protected Access — interim Wi-Fi security using TKIP; now deprecated as insecure.

Wi-Fi security using AES/CCMP; strong, but its PSK 4-way handshake is vulnerable to offline guessing.

Current Wi-Fi standard; uses SAE to resist offline password attacks and adds forward secrecy.

On a WLC you secure a WLAN by selecting WPA2, AES, and a Pre-Shared Key (PSK).

Requires two or more factors: something you know, something you have, and/or something you are.

An always-on encrypted tunnel between two networks via gateways (often IPsec).

Connects an individual user's device to the corporate network over an encrypted tunnel (e.g., SSL/AnyConnect).

Rules for password management, complexity, and alternatives (MFA, certificates, biometrics).

Sets a privileged-EXEC password stored as a strong one-way hash (preferred over 'enable password').

Applies weak (type 7) encryption to clear-text passwords in the config so they aren't readable at a glance.

An attacker positioned between two parties to intercept or alter traffic (formerly 'man-in-the-middle').

Flooding a switch with bogus MACs to overflow the address table, forcing it to flood frames; mitigated by port security.

An attack to reach another VLAN via double-tagging or DTP abuse; mitigate by disabling DTP and changing the native VLAN.

Layering multiple security controls so no single failure exposes the network.

A model that trusts no user or device by default and verifies every access request.

Grant users and devices only the access their role actually requires.

Port-based network access control that authenticates a device (often via RADIUS) before granting access.

Tracks the state of connections and allows return traffic for sessions it initiated.

A segmented network for public-facing servers, isolated from the internal LAN.

A protocol suite that authenticates and encrypts IP traffic — the basis of many VPNs.

ACLs can be identified by number (1–99 standard) or by a descriptive name for easier management.

'ip access-group <acl> in|out' applies an ACL to an interface in a chosen direction.

Protect (drop silently), Restrict (drop + log/counter), Shutdown (err-disable the port) — default is Shutdown.

A port shut down by a security violation; it must be re-enabled (shutdown/no shutdown or errdisable recovery).

Repeatedly guessing credentials; mitigated by strong passwords, lockouts, and MFA.

Manipulating people to reveal information or access; countered by user awareness training.

Authentication using a physical trait (fingerprint, face) — a 'something you are' factor.

Using digital certificates instead of (or with) passwords to prove identity.

Using software and scripts to configure, manage, and monitor devices — reducing manual error and speeding changes.

A central controller manages many devices and pushes policy, versus configuring each device by hand (traditional).

Separates the control plane (decisions) from the data plane (forwarding), managing the network centrally in software.

The 'brain' that decides how traffic should be forwarded (builds routing/switching tables).

The 'muscle' that forwards traffic based on the control plane's decisions.

The underlay is the physical IP transport network; the overlay is a virtual network (tunnels) built on top of it.

The combined underlay plus overlay that a controller manages as a single programmable system.

The interface between the SDN controller and applications/automation tools (often REST).

The interface between the SDN controller and the network devices it manages (e.g., NETCONF, OpenFlow).

Cisco's controller for intent-based campus networking — central management, automation, and assurance.

Traditional management configures each device via CLI; DNA Center centralizes provisioning, policy, and monitoring.

An API style over HTTP using URLs and verbs (GET/POST/PUT/DELETE) to read and change data; usually stateless.

Create, Read, Update, Delete — mapped to HTTP POST, GET, PUT/PATCH, and DELETE.

GET (read), POST (create), PUT/PATCH (update), DELETE (remove) — the actions in REST APIs.

2xx success (200 OK, 201 Created), 4xx client error (401, 404), 5xx server error.

REST APIs exchange structured data, most commonly in JSON (also XML or YAML).

JavaScript Object Notation — human-readable data as key/value pairs in objects {} and arrays [].

Objects use {} with "key": value pairs; arrays use []; strings are double-quoted; values can be string, number, boolean, null, object, or array.

Tools that define device state as code so it's consistent, repeatable, and version-controlled.

An agentless configuration-management tool using YAML 'playbooks' pushed over SSH; uses a push model.

A configuration-management tool using a declarative language and (typically) agents that pull config from a master.

A configuration-management tool using Ruby-based 'recipes' and 'cookbooks'; agent/pull model.

Ansible pushes config to devices; Puppet and Chef agents typically pull config from a central server.

Managing and provisioning infrastructure through machine-readable definition files instead of manual setup.

Faster, consistent deployments, fewer human errors, and easier scaling and rollback of changes.

Expressing what the network should do (policy/intent); the controller translates it into device config.

Application Programming Interface — a defined way for software components to exchange data and commands.

Each API request contains all needed information; the server keeps no client session state (REST is stateless).

REST exposes resources via URLs and HTTP verbs; RPC calls remote procedures/functions directly.

A human-readable data-serialization format using indentation; used by Ansible playbooks.

Extensible Markup Language — a tag-based data format; an alternative to JSON in some APIs.

A southbound protocol that manages device configuration using XML over a secure transport (often SSH).

Applying the same automation repeatedly yields the same end state — a goal of config management.

Tracking changes to configuration-as-code so changes are reviewable and reversible.

Puppet/Chef typically need an agent on each device; Ansible is agentless (uses SSH).

Data in JSON is stored as "key": value pairs inside objects {}.

An ordered list of values in JSON, written in square brackets [ ].