CCDE flashcards
CCDE · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Availability of serial components
- Total availability of components in series equals the product of individual availabilities. Adding a device in the path always lowers end-to-end availability, so insert inline services deliberately.
- Availability of parallel paths
- Redundant paths combine as one minus the product of individual failure probabilities. Two independent 99.9 percent paths yield 99.9999 percent, roughly 32 seconds of downtime per year.
- MTBF and MTTR
- Availability equals MTBF divided by MTBF plus MTTR. Reducing mean time to repair through faster convergence and better operations usually costs less than raising hardware reliability.
- Modular design boundaries
- Module boundaries are where policy, summarization, and failure domains should change. Core, distribution, access, WAN edge, and services blocks each get defined responsibilities and interfaces.
- L2 failure domain rule
- One VLAN equals one spanning-tree domain equals one broadcast domain. Keep access VLANs local to a switch pair and route between VLANs at the distribution block.
- First-hop redundancy design
- HSRP, VRRP, or GLBP provide a virtual IP and MAC. Sub-second failover needs BFD or tuned timers, and the gateway owner should match the spanning-tree root.
- Port-channel hashing behavior
- Hashing is per flow, not per packet, so a single conversation never exceeds one member link. Size bundles for flow diversity and understand that aggregate bandwidth is not per-flow bandwidth.
- PoE power classes
- 802.3af delivers 15.4 watts at the PSE, 802.3at delivers 30 watts, and 802.3bt delivers 60 or 90 watts. Size switch power supplies and UPS capacity against worst-case simultaneous draw.
- Underlay versus overlay
- The underlay provides reachability across Internet, MPLS, or cellular transports. The overlay supplies encryption, policy, and topology such as hub-spoke or partial mesh over that transport.
- SD-WAN path selection
- Per-path probes measure loss, latency, and jitter, and application-aware policy steers flows to the path meeting SLA. Local Internet breakout serves SaaS while policy stays centrally managed.
- Provider diversity limits
- Dual-homing to two PEs inside one provider protects against link and PE failure but not provider failure. True diversity requires two providers and physically separate last-mile access.
- Overlay MTU discipline
- Encapsulation such as IPsec, GRE, or VXLAN consumes header bytes. Set underlay MTU to carry the largest encapsulated packet and verify with don't-fragment probes.
- VXLAN encapsulation facts
- VXLAN uses a 24-bit VNI supporting about 16 million segments, adds 50 bytes of overhead, and uses UDP destination port 4789. Underlay MTU must be at least 1600 bytes.
- EVPN route types
- Type 2 carries MAC and IP advertisements, type 3 builds the inclusive multicast tree, and type 5 carries IP prefixes. ESI multihoming and anycast VTEPs remove flood-and-learn behavior.
- Spine-leaf topology rule
- Every leaf connects to every spine and no leaf connects to another leaf. Equal-cost multipath across spines provides predictable any-to-any latency and horizontal bandwidth scaling.
- Cloud interconnect trade-offs
- Internet VPN is fast to deploy and cheap but variable. Dedicated interconnect is private and predictable at higher cost. Choose per workload sensitivity to latency, loss, and egress charges.
- BGP best-path order
- Weight, then local preference, then locally originated, then shortest AS path, then lowest origin, then lowest MED, then eBGP over iBGP, then lowest IGP metric, then oldest route.
- OSPF area rules
- All non-backbone areas must connect to area zero or use virtual links. Inter-area routes summarize at ABRs, while external routes summarize only at ASBRs.
- Summarization trade-off
- Aggregation shrinks routing tables and hides topology flaps, but it blackholes traffic when a component prefix fails unless a more specific route or discard route exists.
- Redistribution design rule
- Keep redistribution points few, documented, and filtered with tags or route maps. Mutual redistribution between two domains without filtering creates loops and suboptimal paths.
- Zone-and-conduit security model
- Define zones such as user, server, DMZ, management, guest, and IoT. Permit only explicit conduits between them and default deny in both directions.
- Asymmetric routing and stateful firewalls
- Stateful inspection requires both directions of a flow to traverse the same device. Where asymmetry is unavoidable, use stateless ACLs or redesign the path.
- Control-plane policing purpose
- CoPP rate-limits traffic destined to the route processor, protecting routing protocols and management access from CPU exhaustion during attacks or misconfiguration.
- Zero-trust design principle
- Authenticate and authorize every request, apply least privilege, microsegment workloads, and verify continuously. Identity replaces the network perimeter as the primary trust boundary.
- DiffServ versus IntServ
- DiffServ classifies and marks at the edge and applies per-hop behavior in the core, scaling well. IntServ with RSVP reserves per-flow state and scales poorly in large networks.
- Standard DSCP values
- EF is 46 for voice, AF41 is 34 for interactive video, AF31 is 26 for streaming, AF21 is 18 for transactional data, AF11 is 10 for bulk, and CS1 is 8 for scavenger traffic.
- PIM-SM versus PIM-SSM
- PIM-SM builds a shared tree through a rendezvous point and then switches to the shortest-path tree. PIM-SSM uses direct source-specific channels and needs no rendezvous point.
- Multicast address scopes
- IPv4 multicast is 224.0.0.0/4, SSM is 232.0.0.0/8, and administratively scoped ranges sit in 239.0.0.0/8. Link-local 224.0.0.0/24 is never forwarded by routers.
- YANG and NETCONF roles
- YANG defines the configuration and state schema, NETCONF and RESTCONF transport it, and OpenConfig supplies vendor-neutral models. gNMI adds streaming telemetry over the same data model.
- Idempotent automation
- Automation must converge devices to a declared state regardless of starting condition. The inventory, IPAM, and Git repository are authoritative sources of truth, not running configurations.
- Streaming telemetry advantage
- Model-driven telemetry pushes structured state at sub-minute intervals with low CPU cost. SNMP polling is coarse and expensive, making it unsuitable for intent verification and SLA monitoring.
- Network CI/CD pipeline
- Version control, peer review, lint and lab tests, staged canary rollout by device or region, then automated verification and rollback gates before full production deployment.