N10-009 quick review

Memory hook: Name the layer, then name the job.

Must remember

The TCP/IP model groups functions differently; real protocols do not always fit neatly into one textbook box. Encapsulation adds headers as data descends the stack. On a routed path, link-layer addresses change at each link; the IP destination normally remains the end host unless translation/tunneling changes it.

TCP establishes a connection, sequences bytes, acknowledges delivery and handles retransmission/flow control. UDP sends datagrams without those built-in guarantees; an application protocol can add its own reliability. TCP reliability does not mean a business transaction executed exactly once.

A switch learns source MAC addresses and forwards frames within its Layer 2 domain. A router selects next hops between IP networks. A multilayer switch can do both. Firewalls enforce traffic policy; proxies terminate/mediate connections; load balancers distribute service traffic. NAS provides file access, while a SAN commonly presents block storage over a storage network.

Unicast addresses one recipient; broadcast a local IPv4 broadcast domain; multicast a group; anycast the routing-selected instance of a shared address. IPv6 uses multicast rather than broadcast. Routers normally separate broadcast domains.

Star, mesh, hub-and-spoke, spine-leaf, three-tier and collapsed-core designs trade cost, fault paths and scale. A logical topology and a physical cabling diagram describe different views.

Choose under exam pressure

Traps

• A switch can implement several layers; identify the function being tested.
• UDP is not automatically inappropriate for reliable applications.

Practise this topic

Memory hook: Prefix is the boundary; longest match wins.

Must remember

IPv4 has 32 bits. CIDR /n reserves n network bits, leaving 32-n host bits. A conventional IPv4 subnet has 2^(32-n) addresses and usually two reserved endpoints. /31 point-to-point and /32 host routes are exceptions to the usual minus-two rule.

Worked example: 192.168.10.77/26 has blocks of 64: network .64, broadcast .127, ordinary hosts .65–.126, 62 usable. Four /26 networks fit within a /24. For VLSM, allocate the largest required blocks first and check overlap.

IPv6 uses 128 bits in hexadecimal groups. Remove leading zeros and compress one consecutive run of zero groups with ::; using it twice would make the address ambiguous. Many LAN subnets use /64, but do not assume every IPv6 prefix is /64.

ARP discovers IPv4 next-hop MAC addresses on a local link. IPv6 Neighbor Discovery uses ICMPv6; blocking all ICMPv6 can break normal operation. Router advertisements supply on-link/default-router information and can support SLAAC. DHCPv6 does not replace every router-advertisement function.

Historical class A/B/C boundaries are vocabulary; current route decisions use actual prefixes. Two hosts with mismatched masks can disagree about whether traffic is local. Verify address, prefix, gateway and duplicate-address evidence together.

Choose under exam pressure

Traps

• 172.16/12 covers 172.16 through 172.31, not all 172 addresses.
• A default gateway must be reachable through the host’s local routing configuration.

Practise this topic

Memory hook: Resolve the name, obtain the lease, trust the clock.

Must remember

Ports are conventions, not proof of application identity. Secure FTP (SFTP over SSH) differs from FTP with TLS (FTPS).

DNS A/AAAA map names to IPv4/IPv6; CNAME aliases another name; MX specifies mail exchangers; NS delegates authoritative service; PTR supports reverse lookup; TXT carries text used by policies and verification. A resolver asks authoritative servers and caches answers according to TTL. DNSSEC authenticates signed DNS data; it does not encrypt ordinary DNS queries. Encrypted DNS protects the resolver connection through its selected protocol.

DHCPv4 commonly follows Discover, Offer, Request, Acknowledge. Scopes define pools, options, exclusions and reservations. A relay forwards requests across routed boundaries. Exhausted pools, rogue servers, wrong options and blocked relay paths produce different symptoms. Reservations provide predictable leases, not static manual configuration on the host.

NTP synchronizes time broadly; PTP supports more precise timing in suitable networks; NTS adds authenticated security to NTP. Time matters for logs, certificates and ticket-based authentication.

Choose under exam pressure

Traps

• DNS can use TCP, not only UDP.
• A DHCP reservation does not prevent every rogue device from using an address.

Practise this topic

Memory hook: VLAN separates; trunk carries; spanning tree prevents loops.

Must remember

An access port normally places untagged client traffic into one data VLAN. An 802.1Q trunk carries multiple VLANs using tags, with native/untagged behavior defined by configuration. A voice VLAN can separate phone traffic from an attached workstation. VLAN membership does not by itself authorize routing between VLANs.

Switches learn source MAC addresses, forward known unicasts to the learned port and flood unknown unicasts/broadcasts within the VLAN as appropriate. MAC-table instability, duplicate paths and loops can create storms. Spanning Tree elects a root bridge and blocks redundant forwarding paths while preserving connectivity. Rapid variants converge more quickly; root selection and path cost remain important.

Link aggregation combines compatible links into one logical bundle for capacity/resilience. LACP negotiates the bundle. Traffic is usually distributed by a hash, so one flow may not use the sum of all link bandwidth. Member speed, VLAN and trunk settings must agree.

MTU determines maximum packet/frame payload behavior at a layer. Jumbo frames need consistent path support; an MTU mismatch can allow small pings while breaking larger transfers. Duplex mismatch, CRC errors, discards and speed negotiation faults require different fixes.

Use switch port status/counters, MAC tables, VLAN/trunk information, spanning-tree state and neighbor discovery to trace a client path. Document intended native/allowed VLANs and avoid unnecessary trunks to untrusted devices.

For a new segment, verify the access port, VLAN existence, trunk allowance, routed interface/gateway and policy. A single missing VLAN on an intermediate trunk can mimic a routing problem.

Choose under exam pressure

Traps

• A trunk does not mean all VLANs are necessarily allowed.
• PortFast/edge behavior belongs on suitable endpoint links, not arbitrary switch loops.

Practise this topic

Memory hook: Specific route first; preference next; metric within the protocol.

Must remember

Routers select the longest matching prefix for a destination. For competing routes to the same prefix, route-source preference/administrative distance and the protocol's metric determine which route is installed/used. A lower metric in one protocol cannot be compared directly to another protocol's metric as though they were the same units.

Static routes are explicit; a default route (0.0.0.0/0 or ::/0) handles destinations lacking a more specific match. A floating static route has a less-preferred administrative distance so another route wins while available. Dynamic protocols exchange reachability: OSPF is link-state, BGP policy-driven path-vector between routing domains, and EIGRP an advanced distance-vector protocol.

NAT rewrites addresses; PAT/NAT overload also distinguishes flows by ports so many internal clients share an external address. Static NAT fixes a mapping; dynamic pools allocate mappings. Translation is not a substitute for firewall policy or end-to-end authorization. Return traffic must traverse a path with the needed translation/session state.

First-hop redundancy provides a virtual gateway shared by routers. It protects gateway availability, not every upstream link or application. Route convergence, asymmetric paths, health tracking and failover capacity affect actual resilience.

Subinterfaces can route tagged VLANs over a trunk (router-on-a-stick). Switch virtual interfaces on a multilayer switch provide another inter-VLAN routing design. Both require the right VLAN/trunk and routing configuration.

Worked choice: routes 10.0.0.0/8, 10.4.0.0/16 and 10.4.8.0/24 all match 10.4.8.9; /24 wins even if its metric is numerically larger than another protocol's broader route.

Choose under exam pressure

Traps

• Default routes do not beat a more specific route.
• NAT does not automatically permit unsolicited inbound access.

Practise this topic

Memory hook: Signal quality, channel plan and identity all matter.

Must remember

Wi-Fi shares airtime. Signal strength alone does not measure usable performance: interference, signal-to-noise ratio, channel contention, client capability and retries matter. In 2.4 GHz, 1/6/11 are the familiar nonoverlapping 20 MHz plan where permitted; 5/6 GHz offer more spectrum with region/device restrictions. Wider channels trade peak capacity for fewer independent channels and more overlap.

An SSID identifies a wireless network name; a BSSID identifies a basic service set/radio identity. Roaming requires compatible configuration and suitable coverage, not simply giving every AP the same name. Directional/omnidirectional antennas shape coverage; survey placement, walls, power and channel use.

WPA2/WPA3 protect Wi-Fi; enterprise modes use 802.1X/EAP with an authentication service such as RADIUS. Validate the server certificate and choose suitable EAP methods. Guest networks should have appropriate isolation and a controlled route to required services. A captive portal is not equivalent to strong link encryption or enterprise identity.

NAC can assess and authorize endpoints. Hardening includes management restrictions, secure firmware, disabled unused services, changed defaults, centralized logging and protected secrets. ACLs, firewall zones and URL/content filtering enforce different boundaries. TACACS+ is often chosen for network-device administrative AAA; RADIUS is common for network admission.

Threat cues: an evil twin imitates a trusted AP; ARP/DNS poisoning redirects traffic; MAC flooding pressures switch tables; VLAN hopping abuses weak trunk/native configurations; a rogue DHCP server supplies malicious addressing/gateway options. Segmentation, DHCP snooping, appropriate ARP inspection, port controls and user training address different paths.

Encryption, MFA and PKI complement physical locks/cameras. Treat IoT, BYOD and industrial systems according to their capabilities and risk, with controlled access rather than unconditional internal trust.

Choose under exam pressure

Traps

• Hidden SSIDs do not provide meaningful authentication.
• Increasing transmit power can worsen interference or create asymmetric links.

Practise this topic

Memory hook: Match medium, distance, power and failure domain.

Must remember

Copper twisted pair commonly uses RJ45 connectors; telephone cabling uses smaller RJ11. Fiber connectors include LC, SC, ST and multifiber MPO. Coaxial systems may use F-type or BNC. Connector fit alone does not prove the correct medium, wavelength, speed or polarity.

Single-mode fiber supports long-distance optical paths with suitable optics; multimode fiber serves shorter links under its own distance/speed limits. DAC cables connect nearby compatible equipment economically. Match transceiver form factor, wavelength, fiber type and supported standard at both ends. Dirty fiber, reversed transmit/receive pairs, excessive bend radius, bad termination and electromagnetic interference have distinct symptoms.

PoE supplies power over compatible Ethernet links. Check per-port standard/class and the switch's total power budget; enough data connectivity does not prove enough power for an AP or phone. Racks need appropriate airflow, grounding, cable management, labeling, temperature and humidity. UPS provides short-term continuity; generators and diverse feeds address longer/different failures.

Cloud networking includes virtual networks/subnets, security groups/policies, gateways, load balancers and virtual appliances. IaaS, PaaS and SaaS shift operational responsibility. NFV implements network functions in software; SDN programs/control-separates networking. SD-WAN steers overlay paths using policy; SASE combines distributed access and security capabilities.

Hybrid connectivity joins cloud and on-premises environments; overlapping CIDRs complicate routing. VPN encryption and private circuits solve different transport requirements. Elasticity changes resources with demand; scalability is the ability to grow. Cloud data-transfer and public-address costs can dominate an apparently cheap design.

Document physical and logical diagrams, rack elevation, cable maps, circuits and IP allocations. Label both ends so future troubleshooting starts with evidence instead of guesswork.

Choose under exam pressure

Traps

• Two fiber connectors mating does not guarantee compatible optics.
• A private circuit is not automatically encrypted.

Practise this topic

Memory hook: Baseline normal; control change; restore what matters.

Must remember

Maintain asset inventory, IPAM, topology, cable/rack diagrams, wireless surveys and current configurations. Know hardware/software end-of-support dates and preserve recoverable configuration backups. Decommissioning includes access revocation, data sanitization, inventory updates and removing obsolete monitoring/DNS entries.

Monitoring sources answer different questions: SNMP polls counters/state, traps notify events, flow records summarize communications, packet captures expose visible protocol detail, syslog centralizes events and APIs support structured telemetry. SNMPv3 can provide authentication and privacy; older community-string modes are weaker. Port mirroring copies selected traffic to an analysis port but may lose packets if oversubscribed.

Establish baselines for utilization, latency, jitter, loss, errors and availability. Thresholds without context create noise. Correlate changes and multiple sources; a high CPU graph is a symptom, not a root cause by itself.

Change management includes authorization, impact, dependency review, testing, maintenance windows, backups, rollback and validation. Store production, baseline and backup configurations distinctly. Emergency changes still need an accountable process and retrospective records.

RPO is tolerable data loss; RTO target restoration time. MTTR measures average repair/recovery time as defined; MTBF estimates time between failures. Do not confuse measured averages with contractual targets. Active-active uses multiple serving systems; active-passive keeps a standby. Recovery sites trade readiness and cost.

Secure remote administration through approved VPN/SSH/API or console access with individual accounts and least privilege. Out-of-band access helps recover from production network failures. Test restoration of configuration, routing, DNS, identity, monitoring and application reachability together.

Choose under exam pressure

Traps

• Monitoring without baselines and response ownership produces dashboards, not reliability.
• A configuration backup must match hardware/software and be restorable.

Practise this topic

Memory hook: Define the symptom; test one layer; verify the whole path.

Must remember

Start by identifying scope, symptoms, recent changes and what still works. Establish a plausible theory, test it, plan a low-impact fix, implement under the change process, verify full functionality and document cause/results. Escalate when the evidence or authority requires it.

ipconfig/ip inspect host configuration; ping checks selected reachability; traceroute/tracert expose responding hops; nslookup/dig query DNS; arp/ip neigh show neighbor bindings; netstat/ss show sockets; tcpdump or Wireshark inspect packets. Command availability differs by OS. A blocked ICMP response or a router deprioritizing probes does not necessarily mean the application path is broken.

Use cable testers for continuity/wiremap, toner/probe tools for cable identification, optical meters/OTDR for suitable fiber diagnosis and Wi-Fi analyzers for channel/radio evidence. Choose the instrument for the suspected fault; a speed test does not identify every wiring defect.

Inspect both directions. A request can leave successfully while the reply lacks a route, session state or policy permission. Duplicate addresses, wrong masks, exhausted DHCP pools, native-VLAN mismatches and stale DNS can appear intermittent.

Finish by testing the actual user service from the intended source, not just the nearest gateway. Record the fixed cause and update diagrams/baselines when the intended design changed.

Choose under exam pressure

Traps

• Traceroute timeouts can reflect filtering rather than a failed forwarding hop.
• Changing several variables at once destroys diagnostic clarity.

Practise this topic