CNPLE cheat sheet

Three-tier design: core (fast, resilient forwarding), distribution (policy, aggregation, routing boundaries), access (endpoint attachment, PoE, port security).

Collapsed core merges core and distribution when the site has limited scale; spine-leaf replaces three-tier in data centers to give uniform, predictable any-to-any latency.

Campus hierarchy rule: keep 2 hops or fewer from access to core; oversubscription ratios of 20:1 at access and 4:1 at aggregation are common design targets.

Availability math: serial availability multiplies (0.999 x 0.999 = 0.998), parallel/redundant paths add (1 - (1-A)^n); five nines equals about 5.26 minutes downtime per year.

Subnet sizing: usable hosts = 2^h - 2; pick the smallest block that fits current hosts plus roughly 30-50 percent growth headroom per segment.

PoE budget: total draw of all powered devices must not exceed switch PoE budget; 802.3af gives 15.4 W at PSE, 802.3at (PoE+) 30 W, 802.3bt up to 90 W.

Cabling limits: 100 m channel for twisted pair (90 m permanent link plus 10 m patch cords); multimode fiber for building backbone, single-mode for campus and WAN spans.

Design documents: high-level design covers requirements and topology, low-level design covers IP addressing, VLANs, device configs, and cutover steps.

OSPF: neighbors must match area, hello/dead timers, MTU (unless ignored), authentication, and stub flags; default hello/dead is 10/40 s on broadcast, 30/120 s on NBMA.

OSPF cost = reference bandwidth / interface bandwidth; reference bandwidth default 100 Mbps, so raise it (e.g., 10000) on links faster than 100 Mbps.

EIGRP uses composite metric from bandwidth and delay by default; feasible successor requires reported distance < feasible distance of current successor to satisfy feasibility condition.

BGP best-path order: highest weight, highest local preference, locally originated, shortest AS path, lowest origin type, lowest MED, eBGP over iBGP, lowest IGP metric to next hop, lowest router ID.

STP: root bridge is lowest bridge ID (priority then MAC); port states blocking, listening, learning, forwarding; RSTP converges in seconds with alternate and backup port roles.

VLAN trunking 802.1Q inserts a 4-byte tag; native VLAN frames are untagged, so native VLANs must match on both ends of a trunk.

First-hop redundancy: VRRP uses priority with preempt, HSRP uses active/standby with priority and preempt, GLBP adds load balancing across up to four gateways.

EtherChannel rules: member interfaces must match speed, duplex, VLAN mode, and allowed VLAN list; LACP is standards-based (802.3ad), PAgP is Cisco-proprietary.

AAA separates authentication (who), authorization (what allowed), and accounting (what was done); RADIUS is common for network device access, TACACS+ encrypts the full payload.

802.1X roles: supplicant (endpoint), authenticator (switch), authentication server (RADIUS); EAP methods like EAP-TLS use certificates on both sides.

IPsec: IKE phase 1 builds ISAKMP SA (policy, pre-shared key or certificates), phase 2 builds IPsec SA; ESP provides confidentiality and integrity, AH integrity only.

Firewall placement: stateful inspection between security zones; DMZ hosts public-facing services; default deny inbound with explicit allow rules ordered by specificity.

DHCP snooping binds client MAC, IP, VLAN, and port; combine with dynamic ARP inspection and IP Source Guard to block spoofing and rogue DHCP servers.

Port security: sticky MAC learning, violation modes protect (drop), restrict (drop and log), shutdown (err-disable); err-disable recovery requires manual or configured auto-recovery.

Crypto hygiene: disable Telnet and SNMPv1/v2c, use SSHv2 and SNMPv3 authPriv; rotate keys and use certificate-based VPN authentication where possible.

Control plane protection: CoPP and control-plane policing rate-limit traffic destined to the device CPU; uRPF drops packets with spoofed source addresses.

Troubleshooting method: define the problem, gather facts, consider likely causes, build an action plan, implement, observe results, document; work bottom-up (physical to application) or top-down as appropriate.

Layer 1 checks first: interface status (up/up, up/down, down/down), errors and CRC counters, duplex mismatch, cable and optics, PoE status.

Layer 2 checks: MAC address table, VLAN membership, trunk allowed lists, spanning-tree topology and root location, ARP table.

Layer 3 checks: routing table for the destination, adjacency state, ping with source interface, traceroute to locate the failing hop, ACL counters.

Syslog severity 0 emerg to 7 debug; SNMP poll for trends, traps for events; NetFlow or IPFIX for traffic accounting and anomaly detection.

Latency, jitter, and loss are the three key transport metrics; voice requires roughly under 150 ms one-way latency, under 30 ms jitter, and under 1 percent loss.

Configuration management: back up configs before changes, use archive and rollback features, log changes with timestamps, and validate with show commands and test traffic.

Common failure signatures: interface flapping suggests cabling or duplex; asymmetric routing suggests policy or dual-homed design issues; broadcast storms suggest loop or STP failure.

DHCP DORA: Discover, Offer, Request, Acknowledge; relay agents forward requests across subnets using giaddr so a single server can serve many VLANs.

DNS record types: A (IPv4), AAAA (IPv6), CNAME (alias), MX (mail), PTR (reverse), TXT (verification and policy), SRV (service location); TTL controls caching.

NAT: static one-to-one, dynamic pool, and PAT/overload many-to-one; inside local/global and outside local/global terminology distinguishes pre- and post-translation addresses.

QoS: classify and mark at edge (DSCP), trust boundary at access or distribution, queue with priority for voice, shape/police to enforce rate; congestion management vs congestion avoidance (WRED).

NTP uses stratum levels from reference clocks; stratum 0 is the reference, stratum 1 servers sync to it; authentication prevents time spoofing.

Multicast: IGMP for host-to-router group membership, PIM-SM with rendezvous point for sparse mode, PIM-DM for dense; SSM (232/8) removes the RP for one-to-many sources.

Load balancing and proxies: reverse proxy terminates client connections, forward proxy serves outbound clients; health checks remove failed members from pools.

IPv6 services: SLAAC uses RA with prefix and flags, DHCPv6 supplies stateful addressing, and dual-stack or translation (NAT64/DNS64) supports coexistence.

Data models: YANG defines schema for configuration and state; YANG models are encoded in XML or JSON and transported over NETCONF (SSH) or RESTCONF (HTTPS).

NETCONF operations include get, get-config, edit-config, copy-config, delete-config, lock, unlock, and commit; candidate datastore allows validate-then-commit.

REST principles: stateless requests, resource URIs, standard methods GET (read), POST (create), PUT/PATCH (replace/update), DELETE; idempotent methods are safe to retry.

Ansible is agentless over SSH, push-based, uses YAML playbooks and idempotent modules; Puppet and Chef are typically agent-based pull models.

Python essentials for network work: requests for HTTP APIs, netmiko/napalm for device CLI abstraction, json for parsing, and jinja2 for templated configs.

Infrastructure as code: version control configs and templates, peer review changes, run CI checks (lint, dry-run), then deploy with rollback capability.

Telemetry streaming (gNMI, model-driven telemetry) pushes data continuously, replacing polling for high-resolution monitoring and faster anomaly detection.

API security: use tokens or certificates, scope accounts to least privilege, log API calls, and rate-limit to prevent abuse or runaway automation loops.

Change management: request, risk assessment, approval, scheduled window, implementation, validation, and backout plan; emergency changes get retrospective review.

Frameworks: ITIL for service management processes, ISO/IEC 27001 for information security management systems, NIST CSF for identify-protect-detect-respond-recover functions.

Regulations map to controls: PCI DSS for cardholder data, HIPAA for health information, GDPR for EU personal data; network controls include segmentation, logging, and encryption.

Documentation set: network diagrams (physical and logical), IP address management records, asset inventory, configuration baselines, and disaster recovery runbooks.

Incident response phases: preparation, detection and analysis, containment, eradication, recovery, and lessons learned; preserve evidence with chain of custody.

Risk treatment options: avoid, mitigate, transfer (insurance), accept; residual risk must be documented and approved by an accountable owner.

Professional ethics: protect confidentiality of client data, disclose conflicts of interest, report accurate findings, and stay within scope of authorization during testing.

Service levels: SLA defines commitments, SLO is an internal objective, SLI is the measured indicator; MTTR and MTBF quantify reliability and recovery performance.

Map each exam objective to a domain and tag weak areas by practice-question error rate rather than by topic familiarity.

Use spaced repetition: review missed items after 1 day, 3 days, 7 days, and 21 days to move facts into long-term recall.

Practice subnetting until you can compute usable hosts, network and broadcast addresses, and mask conversions in under 30 seconds per item.

For scenario questions, eliminate options that violate a hard constraint (cabling distance, PoE budget, STP rules) before comparing the remaining choices.

Build a one-page mental model per domain: design (hierarchy and availability), routing (protocol selection), security (zones and AAA), operations (troubleshooting order).

Time management: answer known items first, flag uncertain ones, and reserve the final portion of the exam to revisit flagged questions.

Read the entire stem for qualifiers such as first, best, most cost-effective, and least disruptive; these change the correct answer.