MSCE flashcards
MSCE · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Usable hosts in /26
- A /26 has 6 host bits, so 2^6 = 64 addresses; subtract the network and broadcast addresses for 62 usable host addresses.
- VLSM allocation order
- Variable-length subnet masking assigns the largest required subnet block first and subdivides remaining space, minimizing wasted address space across mixed-size segments.
- APIPA address meaning
- An address in 169.254.0.0/16 is self-assigned when no DHCP server answers, indicating DHCP failure rather than a physical link problem.
- Route summarization purpose
- Supernetting combines contiguous networks sharing high-order bits into one route, shrinking routing tables and reducing advertisement overhead across the infrastructure.
- Duplex mismatch symptoms
- A duplex mismatch produces late collisions, FCS errors, and asymmetric throughput loss, since one side transmits while the other believes the link is idle.
- Default gateway rule
- A host's default gateway must reside on the same subnet as its interface; an off-subnet gateway causes all off-net traffic to be silently dropped.
- Trunk versus access port
- Trunk ports carry multiple VLANs using 802.1Q tags, while access ports are untagged and belong to exactly one VLAN for end-device connection.
- Spanning Tree loop symptom
- An unblocked Layer 2 loop causes broadcast storms and MAC address table flapping, driving CPU and link utilization to saturation rapidly.
- DHCP scope option precedence
- Scope-level options override server-level options; option 003 supplies the router and option 006 supplies DNS servers to clients.
- DHCP renewal timers
- Clients attempt renewal at 50 percent of the lease (T1) and rebind to any server at 87.5 percent (T2) if renewal fails.
- Forward versus reverse lookup
- Forward lookup resolves a name to an address using A or AAAA records; reverse lookup resolves an address to a name using PTR records.
- Recursive versus iterative query
- A recursive query asks the resolver for a final answer; iterative queries ask successive authoritative servers until the resolver obtains that answer itself.
- CNAME record constraint
- A CNAME aliases one name to another name and must never point directly to an IP address; only A or AAAA records map names to addresses.
- Zone transfer transport
- DNS zone transfers use TCP port 53, while ordinary queries use UDP port 53; blocking TCP 53 breaks secondary zone replication.
- DHCP reservation behavior
- A reservation binds a specific MAC address to a fixed IP while still delivering scope options, unlike a static assignment that bypasses DHCP entirely.
- SOA record fields
- The SOA record holds the serial number, refresh, retry, expire, and minimum TTL values that govern secondary zone synchronization and negative caching.
- DHCP authorization purpose
- In an Active Directory environment, DHCP authorization prevents unauthorized rogue servers from leasing addresses to clients on the domain network.
- Forest versus domain boundary
- The forest is the security boundary containing shared schema and configuration; a domain is the replication and administrative boundary within it.
- Global catalog function
- The global catalog stores a partial attribute set for every forest object and answers cross-domain queries on TCP port 3268.
- FSMO role split
- Schema Master and Domain Naming Master are forest-wide roles; RID Master, PDC Emulator, and Infrastructure Master are per-domain roles.
- Site link attributes
- Site links define replication between sites using cost, replication interval, and schedule, forming the topology Active Directory uses for intersite transfer.
- Read-only domain controller
- An RODC holds a read-only directory copy and caches only permitted credentials, suiting branch offices where physical security is weak.
- AH versus ESP
- IPsec AH provides integrity and authentication without confidentiality; ESP encrypts payloads to provide confidentiality in addition to integrity.
- Kerberos time skew limit
- Kerberos authentication fails when client and domain controller clocks differ by more than five minutes, a common cause of cross-trust logon failures.
- 802.1X components
- Port-based access control requires a supplicant on the client, an authenticator switch or access point, and a RADIUS authentication server.
- Symmetric versus asymmetric encryption
- Symmetric encryption is fast and used for bulk data; asymmetric encryption solves key distribution but is far more computationally expensive per operation.
- Sysprep generalization role
- Sysprep removes machine-specific identifiers such as the security ID and hardware configuration so a captured image can be deployed to multiple computers.
- PXE boot requirements
- Network boot requires DHCP or proxyDHCP to supply boot options plus a TFTP server to deliver the boot image to the client.
- Group Policy application order
- Policy applies local, then site, then domain, then organizational unit; the last applied setting wins unless a higher level is marked enforced.
- Assigned versus published software
- Assigned policy software installs automatically at logon or on demand; published software appears for optional user installation from Add or Remove Programs.
- Baseline before tuning
- Performance counters are only interpretable against a recorded normal range for the same workload, so capture a baseline before diagnosing a bottleneck.
- SNMP trap versus poll
- SNMP traps are unsolicited alerts sent from agent to manager, while polling is manager-initiated at fixed intervals to collect counter values.