MSCE key terms

Dividing one IP address range into smaller logical networks by borrowing bits from the host portion of the address. Each resulting subnet has its own network address, broadcast address, and usable host range.

A shorthand way of writing an address and its prefix length, such as 192.168.10.0/24. The number after the slash states how many leading bits identify the network, replacing traditional class-based masks.

A 32-bit value that marks which bits of an IPv4 address belong to the network and which belong to the host. Devices compare masks to decide whether a destination is local or must be routed.

Combining several contiguous smaller networks into one larger advertised range. It reduces routing table size and is often used for route summarization between routers.

The router address a host sends traffic to when the destination is not on its own subnet. Without a correct gateway, a host can reach local peers but nothing beyond its segment.

The list a router or host keeps of known destinations, next hops, and metrics. The most specific matching entry wins, which determines where each packet is forwarded.

A logically separated broadcast domain configured on switches, letting one physical infrastructure carry several isolated networks. Traffic between VLANs must pass through a router or Layer 3 switch.

A switch link configuration that carries frames for multiple VLANs, tagging each frame so the far end knows which VLAN it belongs to. Trunks typically connect switches to each other or to routers.

A Cisco-proprietary protocol that propagates VLAN definitions across trunk links so switches share a consistent VLAN database. Mismatches or version issues can cause unexpected VLAN changes.

A defined pool of IP addresses and related options, such as mask, gateway, and DNS servers, that a DHCP server can lease to clients on a given subnet.

A fixed mapping of one MAC address to one IP address inside a DHCP scope, so a device always receives the same address while still being configured automatically.

A service or router setting that forwards DHCP broadcasts from a remote subnet to a central DHCP server, because broadcasts do not cross routers on their own.

The length of time a DHCP client may keep an assigned address before it must renew. Short leases suit transient devices; long leases reduce renewal traffic for stable ones.

The set of devices that receive a frame sent to the broadcast address. Routers and VLAN boundaries stop broadcasts, so each segment or VLAN is its own broadcast domain.

A DNS server role that passes queries it cannot answer from cache or local zones to an upstream resolver. Forwarders simplify egress rules and can improve resolution speed.

A DNS configuration that sends queries for one specific namespace to designated servers instead of the general forwarders. It is commonly used to resolve partner or child domains.

A contiguous portion of the DNS namespace for which a server holds authoritative records. Zones can be primary, secondary, or stub, and can be stored in Active Directory.

An individual entry in a DNS zone that maps a name to data, such as an address, mail server, or alias. Record type determines what the value means and how clients use it.

Copying zone data from a primary DNS server to a secondary one so both hold the same records. Transfers can be full or incremental and should be restricted to authorized servers.

A value attached to DNS records or cached data stating how long resolvers may keep it before asking again. Low values speed up changes but increase query load.

A request in which the client asks the resolver to do all the work and return a final answer. Resolvers iterate through authorities on the client's behalf.

A container inside a directory that groups objects for delegation and policy application. It is not a security boundary on its own but is the usual target for group policy links.

A collection of configuration settings linked to sites, domains, or organizational units and applied to users and computers. Settings are refreshed periodically and at startup or logon.

The order in which policy settings from higher containers flow down to lower ones, with closer links generally taking precedence unless a link is enforced or blocked.

A computed view of every policy setting that actually applies to a user or computer after inheritance, filtering, and precedence are resolved. It is used to plan and troubleshoot policy outcomes.

A server that hosts a writable copy of the directory database and handles authentication for its domain. Multiple controllers replicate with each other for redundancy.

A directory server holding a partial, read-only copy of every object in the forest plus full data for its own domain. It answers forest-wide searches and helps logon in multi-domain forests.

Specialized roles assigned to individual domain controllers so certain changes happen in one place at a time, avoiding conflicts. Examples include schema changes and adding domains.

The process by which directory changes on one domain controller are copied to others. Consistency depends on replication topology, site links, and conflict resolution rules.

Directory objects that map well-connected network ranges to physical locations, letting clients find the nearest domain controller and controlling how replication traffic flows between locations.

A configured link that lets users in one security boundary be authenticated by another. Trusts can be one-way or two-way and may be transitive or non-transitive.

The default authentication protocol in many directory environments, issuing time-limited tickets from a central service so credentials are not sent with every request. Clock skew breaks it quickly.

The combination of certificate authorities, templates, and policies that issues and validates digital certificates. It underpins encryption, signing, and smart card or 802.1X authentication.

A published list of certificates that a certificate authority has invalidated before their expiry date. Clients check it to reject credentials that should no longer be trusted.

A service that answers certificate status questions one certificate at a time instead of distributing a whole revocation list. It reduces bandwidth and exposure of revocation data.

A port-based access control standard in which a supplicant proves its identity to an authenticator before network access is granted. It is common on wired switch ports and wireless links.

A policy platform that checks a client's health, such as patch and antivirus state, before or after granting network access, and can restrict non-compliant machines to a remediation network.

A deployment method that supplies answers to setup prompts from a script or file, allowing servers or clients to install without an operator at the console.

A structured file containing configuration values that setup reads during an unattended installation. It can specify partitioning, product keys, and post-install commands.

A server role that boots clients over the network and delivers installation images. It relies on PXE, DHCP, and a configured boot image to start the process.

A firmware capability that lets a machine obtain an address and download a boot image from the network before any local operating system runs.

A clustering feature that spreads incoming traffic across several servers sharing a virtual address, improving capacity and availability for stateless or session-aware services.

Grouping servers so that if one node fails, its resources are restarted on another node. It suits stateful workloads such as databases and file services.

A tool that records and graphs counters for processor, memory, disk, and network activity over time. Baselines from it reveal trends and bottlenecks before users notice.

The practice of comparing resource counters to find the single component limiting overall throughput, then addressing that component rather than adding capacity broadly.

A standard for polling and receiving traps from network devices. Management systems use it to collect interface statistics, availability, and configuration data.

A mechanism that collects selected log entries from many computers into a central collector. It centralizes auditing and speeds correlation during investigations.