Cisco ENNA 300-445 key terms

A Layer 2 broadcast domain created logically on a switch, letting one physical switch carry several separate networks. Frames are tagged so ports and trunks know which domain they belong to.

An IEEE standard that inserts a 4-byte tag into Ethernet frames so a single link can carry traffic for multiple VLANs between switches or to a router or hypervisor.

The single VLAN on an 802.1Q trunk whose frames are sent untagged. Both ends of the trunk must agree on it, otherwise frames can leak between VLANs or be dropped.

A switch port assigned to exactly one VLAN that sends and receives untagged frames, typically connecting to an end device such as a PC, printer, or access point.

A Layer 2 loop-prevention protocol in which switches elect a root bridge and block redundant ports, producing a loop-free topology that can heal automatically when a link fails.

The reference switch in a spanning-tree topology, chosen by lowest bridge ID (priority plus MAC address). All other switches compute least-cost paths toward it and block redundant links.

A spanning-tree feature applied to edge ports so they skip listening and learning states and forward immediately, avoiding DHCP timeouts on client devices. It must not be used toward switches.

A switch safety feature that error-disables a PortFast edge port if it receives a bridge protocol data unit, blocking an unauthorized or misconfigured switch from altering the topology.

The bundling of several physical links into one logical link to add bandwidth and redundancy. Member interfaces must match in speed, duplex, VLAN configuration, and allowed VLANs.

IEEE 802.3ad Link Aggregation Control Protocol, a standards-based negotiation method for forming EtherChannels. Its modes are active, which initiates negotiation, and passive, which only responds.

A Layer 2 security feature that classifies switch ports as trusted or untrusted and drops DHCP server messages arriving on untrusted ports, preventing rogue DHCP servers from handing out addresses.

A feature that validates ARP packets against the DHCP snooping binding table and discards suspicious replies on untrusted ports, mitigating ARP spoofing and man-in-the-middle attacks.

A switch feature that limits how many MAC addresses a port may learn and can restrict or shut down the port on violation, blocking unauthorized devices from attaching to the network.

An open standards link-state interior gateway protocol that floods link-state advertisements within an area, builds a shared topology database, and runs Dijkstra's algorithm to compute lowest-cost routes.

The relationship two OSPF routers form after matching hello parameters such as area, timers, authentication, and MTU. It progresses through states including Init, 2-Way, ExStart, Exchange, and Full.

A 32-bit identifier unique to each OSPF router. It is chosen as the highest loopback address, then the highest physical interface address, or set manually with the router-id command.

A Cisco value ranking the trustworthiness of a route source, where lower is preferred. Connected routes are 0, static routes 1, EIGRP 90, OSPF 110, and RIP 120.

A static route configured with an administrative distance higher than the primary routing protocol, so it stays out of the table until the preferred route disappears, providing backup connectivity.

A family of protocols, including HSRP, VRRP, and GLBP, that lets multiple routers share a virtual IP and MAC so hosts keep a working default gateway when one router fails.

Cisco's proprietary First Hop Redundancy Protocol. One router is active and another standby; they exchange hellos and share a virtual IP and MAC address presented to hosts as their gateway.

An address shared by routers in a first-hop redundancy group and configured on hosts as their default gateway. Ownership moves between routers without hosts changing configuration.

Dividing a network prefix into smaller prefixes by borrowing host bits, which raises the prefix length and reduces usable addresses per subnet while creating more broadcast domains.

A compact way to write an IP address and its prefix length, such as 192.168.10.0/24, where the number after the slash counts network bits and defines the subnet mask.

Address ranges reserved by RFC 1918 for internal use and not routed on the public internet: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. They require NAT for internet access.

Network Address Translation rewrites source or destination IP addresses, and often ports, as packets cross a router, letting many private hosts share public addresses and hiding internal addressing.

Port Address Translation, also called NAT overload, maps many inside private addresses to one public address by tracking unique source port numbers, which is how home and office internet sharing works.

A router function that forwards broadcast DHCP requests from a client subnet to a DHCP server on another subnet as unicast, using the configured helper address.

The four-message exchange that leases an address: Discover from client, Offer from server, Request from client, and Acknowledgment from server. Renewals later use unicast messages.

Network Time Protocol synchronizes device clocks to a reference source over UDP port 123, keeping log timestamps, certificates, and time-based access rules consistent across the network.

A standard for sending event messages to a central collector over UDP port 514. Cisco severity levels run 0 (emergencies) through 7 (debugging), with lower numbers more severe.

Simple Network Management Protocol polls and configures devices through structured variables called OIDs. Agents send unsolicited traps on UDP 162, while polling and requests use UDP 161.

Quality of Service classifies and marks traffic, then queues and schedules it so latency-sensitive flows such as voice get priority during congestion. Common tools are classification, marking, policing, and shaping.

An ordered set of permit and deny rules applied to an interface or line that filters traffic by addresses, protocols, and ports. The first matching entry decides and an implicit deny follows.

A numbered ACL from 1 to 99 or 1300 to 1999 that matches only source IP addresses. It is normally placed close to the destination to avoid blocking unintended traffic.

A numbered ACL from 100 to 199 or 2000 to 2699 that can match source and destination addresses, protocol, and port numbers. It is typically placed close to the source.

Authentication, Authorization, and Accounting. It verifies who a user is, what they may do, and records what they did, often using a central server such as RADIUS or TACACS+.

A Cisco-developed AAA protocol using TCP port 49 that encrypts the entire packet body and separates authentication, authorization, and accounting, making it well suited to device administration.

An AAA protocol using UDP that encrypts only the password, combines authentication and authorization in one step, and is widely used for network access control such as 802.1X.

A suite of protocols that encrypts and authenticates IP traffic. It uses IKE for key exchange, AH or ESP for integrity and confidentiality, and tunnel or transport mode for encapsulation.

A tunnel between two gateways, often built with IPsec, that connects remote networks so hosts communicate as if directly attached, without per-user client software.

A secure remote-shell protocol on TCP port 22 that encrypts management sessions, replacing Telnet. Cisco devices require a domain name, RSA key pair, and local user before SSH can be enabled.

An HTTP-based interface where clients send GET, POST, PUT, and DELETE requests to resource URLs and receive JSON or XML replies, commonly used to configure controllers and network devices.

A lightweight text data format built from objects, arrays, strings, numbers, and booleans. It is the usual payload for REST APIs and is easy for scripts to parse.

A data modeling language that describes the configuration and state of network devices, used with NETCONF and RESTCONF so automation tools can work with vendor-neutral models.

A network management protocol that runs over SSH and uses XML-encoded YANG data with operations such as get-config and edit-config to read and change device configuration programmatically.

An agentless automation tool that connects over SSH or API calls and runs playbooks written in YAML, applying tasks to inventory groups in order without installing software on managed devices.

Managing networks and systems through version-controlled definition files rather than manual commands, so changes are repeatable, reviewable, and can be re-applied to restore a known state.