CCST Networking common mistakes
CCST Networking · Understand the traps and how to avoid them.
When asked which OSI layer a device or protocol operates at, candidates answer from the device name (for example, calling a switch 'Layer 1' because it has ports, or a router 'Layer 3' only when the question mentions IP) instead of naming the layer by the unit of data and the function described in the question.
Cisco's CCST items frequently describe behaviour rather than naming the device, and candidates memorise a device-to-layer table without learning what each layer actually does (framing, logical addressing, end-to-end delivery). The question often gives away the layer through words like 'frame', 'segment', or 'best path'.
What to do instead
Build a one-page layer sheet keyed on function and PDU, not device: Layer 2 = framing and MAC addressing, Layer 3 = logical addressing and path selection, Layer 4 = port numbers and reliability. For every practice item, write the PDU named in the stem before choosing the layer, and drill the encapsulation order (data, segment, packet, frame, bits) until it is automatic.
Candidates confuse the roles of TCP and UDP, choosing TCP for latency-sensitive voice or DNS queries because 'TCP is more reliable', or choosing UDP for file transfer because 'UDP is faster'.
Reliability is taught as an unconditional good, so candidates default to TCP whenever the stem mentions importance or criticality. They also miss the cues that decide the answer: whether a handshake, retransmission, or ordering matters versus whether a small request/response needs speed.
What to do instead
Learn the decision rule: TCP when loss must be recovered or order matters (web, email, file transfer, SSH); UDP when a retransmission would arrive too late or the payload is a single small exchange (voice and video, DNS, DHCP, TFTP, SNMP). Memorise the well-known port list alongside the protocol so the transport is recalled as a pair, and practise classifying ten protocols by transport in under a minute.
When converting between binary, decimal, and prefix length, candidates miscount host bits or use the wrong power of two, producing a subnet mask or host count that is off by a factor of two, and they misread a /30 as supporting more than two usable hosts.
The maths is done mentally under time pressure, and the 2^n formula is applied to the whole address rather than to the host bits. Candidates also forget to subtract the network and broadcast addresses when the question asks for usable hosts.
What to do instead
Use a fixed written procedure: prefix length gives network bits, host bits = 32 minus prefix, usable hosts = 2^hostbits minus 2. Memorise the mask-to-prefix table (/24 = 255.255.255.0, /25 = .128, /26 = .192, /27 = .224, /28 = .240, /29 = .248, /30 = .252) and the host counts 254, 126, 62, 30, 14, 6, 2. Write the binary octet out for any question involving a non-octet boundary instead of estimating.
Candidates misidentify the network address, first usable address, last usable address, and broadcast address of a subnet, especially when the subnet boundary falls inside an octet, and they treat the all-zeros or all-ones host as assignable.
The block size is computed from the wrong octet, or the candidate subtracts one from the wrong end of the range. The 'first usable' and 'network' addresses are often assumed to be the same value.
What to do instead
Compute the block size (256 minus the interesting mask octet), find the multiples of the block size that bracket the given address, and label the boundaries explicitly: the lower multiple is the network address, the next multiple minus one is the broadcast, and the two addresses in between are the usable range. Verify with a quick sanity check that the host count matches 2^hostbits minus 2.
Candidates treat private and public IPv4 ranges and special addresses loosely, labelling 172.16.0.0/16 as the whole of the 172 private space, calling 169.254.x.x a private address, or assuming 127.0.0.1 is a valid host address on a LAN.
The RFC 1918 list is memorised as '10, 172, 192.168' without the exact boundaries, and link-local, loopback, and APIPA addresses are lumped together as 'special' without distinguishing their purposes.
What to do instead
Memorise the exact ranges: 10.0.0.0/8, 172.16.0.0/12 (that is 172.16.0.0 through 172.31.255.255), and 192.168.0.0/16. Separately learn 169.254.0.0/16 as link-local self-assignment when DHCP fails, 127.0.0.0/8 as loopback, and 0.0.0.0 and 255.255.255.255 as unspecified and limited broadcast. Test yourself by classifying random addresses into private, link-local, loopback, and public.
Candidates select the wrong cable or connector for a scenario, for example recommending fibre for a short desktop run, choosing Cat5e for 10GBASE-T at 100 metres, or pairing a straight-through cable between like devices.
Cable categories and distance limits are memorised as a list without the speed-distance table attached, and the crossover versus straight-through rule is remembered as a slogan rather than as a rule about which pin pairs transmit and receive.
What to do instead
Learn the Ethernet media table as speed, medium, and maximum distance: 1000BASE-T over Cat5e at 100 m, 10GBASE-T over Cat6 at 55 m and Cat6a at 100 m, 1000BASE-SX over multimode fibre at roughly 550 m, 1000BASE-LX over single-mode at 5 km and beyond. For copper, use straight-through between unlike devices (PC to switch, switch to router) and crossover between like devices (switch to switch, PC to PC), noting that modern auto-MDIX ports remove the requirement in practice.
Candidates confuse MAC addresses with IP addresses in forwarding questions, saying a router forwards by MAC address across subnets or that a switch rewrites the destination IP when it forwards a frame.
Both are addresses, so the roles blend together. Candidates do not hold a clear mental model of what changes at each hop: the frame's source and destination MAC are rewritten per link, while the source and destination IP stay the same end to end (barring NAT).
What to do instead
Draw a three-device path (PC, router, server) and label what each header contains at each hop. State the rule aloud: IP addresses identify endpoints and survive the trip; MAC addresses identify the next hop on the local link and are rewritten every time the frame crosses a router. Practise questions that ask what the source MAC is when a packet leaves a router toward the destination LAN.
On infrastructure questions, candidates misplace functions among devices, for example expecting a Layer 2 switch to route between VLANs, attributing DHCP to a router only, or assuming a wireless access point performs NAT and firewall duties.
Home all-in-one devices combine routing, switching, wireless, DHCP, NAT, and firewalling in one box, so candidates map those combined behaviours onto each separate enterprise device. The exam tests the separated roles.
What to do instead
Build a function matrix with rows for switching, routing, DHCP, NAT, firewall, and wireless and columns for switch, router, firewall, access point, and controller. Note explicitly that inter-VLAN routing requires a Layer 3 device (router or Layer 3 switch), that a wireless LAN controller centralises AP management, and that a firewall enforces policy between zones. Answer device questions by asking which single function the stem describes.
Candidates stop troubleshooting after the first plausible cause, for example replacing a cable when the real issue is a duplicate IP address, or blaming the ISP when the client simply has an APIPA address because DHCP was unreachable.
The layered troubleshooting method is known in theory but skipped in practice, and the symptoms of different faults overlap (no connectivity looks the same whether the cause is physical, addressing, or DNS). Candidates also skip verifying that the problem is isolated to one host or affects the whole subnet.
What to do instead
Apply a fixed sequence and write it down: define the problem and scope (one host or many), check the physical layer, then addressing (ipconfig or ifconfig output, APIPA, duplicate address), then name resolution (ping by IP versus by name), then routing and default gateway, then the service itself. Use ping, traceroute, and nslookup deliberately, each to test one layer, and only change one variable per test.
Candidates answer diagnostic-tool questions by tool name rather than by what the tool measures, for example expecting ping to report the path taken, using traceroute to test a TCP port, or confusing nslookup with a reachability test.
The tools are learned as a vocabulary list, and several of them (ping, traceroute, nslookup) are used together in practice, so their distinct outputs blur. The exam asks which tool would confirm a specific fact.
What to do instead
Attach each tool to the question it answers: ping tests reachability and round-trip time to a host, traceroute lists the routers along the path and where it stops, nslookup resolves names through DNS, ipconfig or ifconfig shows local addressing and gateway, and arp shows the IP-to-MAC mapping on the local link. For each practice item, restate the question as 'which fact does this tool reveal' before choosing.