MSCE cheat sheet

Subnet hosts formula: usable hosts = 2^(host bits) - 2; a /26 leaves 6 host bits and yields 62 usable addresses.

VLSM allocates the largest required subnet block first, then subdivides remaining space, to avoid fragmentation.

Private ranges: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 are non-routable on the public Internet and require NAT for egress.

APIPA 169.254.0.0/16 is self-assigned when no DHCP server responds; presence of an APIPA address indicates DHCP failure, not a cabling fault.

Supernetting reduces routing table size by summarizing contiguous networks that share high-order bits (e.g., four /24s into one /22).

Classful defaults: A=/8, B=/16, C=/24; CIDR removes class boundaries and requires explicit prefix length on every route.

IPv6 global unicast is 2000::/3; link-local fe80::/10 is auto-configured per interface and is never routed.

Link-local (169.254.x.x) plus working switch port points to DHCP scope exhaustion or an unreachable DHCP relay.

Duplex mismatch symptoms: late collisions, FCS errors, and severe throughput loss on one direction of a link.

ipconfig /all shows DHCP server, lease timestamps, and DNS suffix; use it before assuming a DNS fault.

A default gateway must be on the same subnet as the host interface; an off-subnet gateway silently drops all off-net traffic.

VLAN trunk ports carry 802.1Q tags; access ports are untagged and belong to exactly one VLAN.

Spanning Tree blocks redundant links to prevent loops; a loop produces broadcast storms and MAC table flapping.

Traceroute identifies the last responding hop before failure; timeouts beyond that hop indicate filtering or a down link.

DHCP scope options: 003 router, 006 DNS servers, 015 DNS domain name; scope options override server options.

DHCP lease renewal follows the 50% (renew) and 87.5% (rebind) T1/T2 timers of the lease duration.

A DHCP relay agent (or ip helper-address) is required when the DHCP server is on a different subnet than clients.

DNS forward lookup resolves name to address (A/AAAA); reverse lookup resolves address to name (PTR) under in-addr.arpa or ip6.arpa.

Recursive queries go from client to resolver; iterative queries go from resolver to authoritative servers.

A CNAME must point to another name, never directly to an IP address; an A record maps a name to an IPv4 address.

WINS-style NetBIOS name resolution order: local cache, WINS server, broadcast, then LMHOSTS.

DNS zone transfer uses TCP 53; standard queries use UDP 53. Blocking TCP 53 breaks secondary zone replication.

Stale DNS records persist until scavenging runs; verify with nslookup against the authoritative server, not a cached resolver.

DHCP authorization in Active Directory prevents rogue servers from leasing addresses on the domain network.

A reservation binds a MAC address to a fixed IP and still delivers scope options; a static assignment bypasses DHCP entirely.

SOA record fields: serial (increments on change), refresh, retry, expire, and minimum TTL govern secondary zone behavior.

If clients get an address but cannot resolve names, check option 006 before inspecting the DNS server itself.

Split-horizon DNS serves different answers to internal and external clients; internal zones must contain all published records.

Forest is the security boundary; domain is the replication and administrative boundary.

A domain controller must host DNS (or point to a DNS server holding the AD-integrated zone) to register SRV records.

Global catalog holds a partial attribute set for every object in the forest and answers cross-domain queries on TCP 3268.

Sites map to well-connected IP subnets; site links carry cost, interval, and schedule and drive replication topology.

Operations master (FSMO) roles: Schema Master and Domain Naming Master are forest-wide; RID, PDC Emulator, and Infrastructure Master are per-domain.

Read-only domain controllers hold no writable copy and are suited to branch offices with weak physical security.

Trust types: transitive two-way within a forest by default; external and shortcut trusts are non-transitive unless configured otherwise.

IPsec AH provides integrity and authentication but no confidentiality; ESP provides confidentiality through encryption.

Kerberos uses port 88; failure to authenticate across a trust commonly traces to time skew beyond 5 minutes.

Least privilege: assign permissions to groups, not users, and use role separation to limit administrative exposure.

802.1X port-based access control requires a supplicant, an authenticator (switch), and an authentication server (RADIUS).

Certificate revocation is published via CRL or OCSP; an expired CRL causes silent validation failures.

Symmetric encryption is fast and used for bulk data; asymmetric encryption solves key distribution but is computationally expensive.

A DMZ segments Internet-facing hosts from the internal network; traffic between them is filtered by firewall rules.

Unattended installation answer files supply computer name, product key, and partitioning so no prompts interrupt setup.

Imaging captures a reference computer; sysprep generalizes the image by removing SID and machine-specific drivers.

PXE boot requires DHCP (or proxyDHCP) plus a TFTP server to deliver the boot image.

Group Policy applies in order: local, site, domain, then organizational unit; the last applied wins unless enforced.

Software deployment via Group Policy supports assigned (installed on demand or at logon) and published (user-installed) modes.

Driver injection into a boot image must match the target hardware architecture; wrong-architecture drivers are ignored silently.

Roaming profiles store user settings on a server share; folder redirection moves data without copying at logon.

Baseline first: performance counters are only meaningful against a recorded normal range for the same workload.

Bottleneck isolation order: processor, memory, disk, then network - fix the saturated resource before tuning others.

SNMP traps are unsolicited alerts from agent to manager; polling is manager-initiated and interval-driven.

Packet capture requires a mirrored port or tap; a standard access port sees only its own unicast plus broadcast traffic.

High retransmits with low latency indicate packet loss; high latency with few retransmits indicates path or queueing delay.

Event log correlation: match timestamps across services before attributing a failure to a single component.

Disk queue length sustained above 2 per spindle indicates an I/O bottleneck rather than a CPU or memory limit.