CCDE key terms

A written record of what the network must achieve for the organization: services, growth forecasts, budget limits, compliance obligations, and availability targets. Design decisions are traced back to it so trade-offs can be justified to stakeholders.

The practice of comparing design options against cost, complexity, risk, and performance criteria, then documenting why one option was chosen. It converts business priorities into explicit technical decisions instead of leaving them implicit.

A design quality describing how easily a network can be deployed, monitored, changed, and troubleshot by the existing staff. Fewer protocols, consistent configurations, and predictable topologies reduce outages caused by human error.

A contractual commitment on measurable service attributes such as availability, latency, and restoration time. It drives redundancy choices, convergence targets, and monitoring thresholds in the design.

The average time needed to restore service after a failure. Designs lower MTTR through redundancy, fast convergence, clear documentation, and automation; MTTR combined with failure rate determines achievable availability.

A two-tier data center topology in which every leaf switch connects to every spine switch, and spines only connect to leaves. Equal-cost paths between any pair of leaves give predictable latency and simple horizontal scaling.

A Cisco protocol that propagates VLAN definitions between switches in a management domain. Because a misconfigured server can erase or overwrite VLAN databases network-wide, many designs disable it or use transparent mode.

A Layer 2 loop-prevention protocol that elects a root bridge and blocks redundant links. Modern campus designs use Rapid PVST+ or MST with root placement tuned to match the Layer 3 topology.

A family of protocols, including HSRP, VRRP, and GLBP, that presents a shared virtual gateway address so hosts keep a default gateway when one router or switch fails.

A design where every leaf or access switch uses the same virtual MAC and IP gateway address for a subnet, so hosts can move anywhere in the fabric without changing their default gateway. Often paired with VXLAN-EVPN.

A WAN architecture that centrally manages policies and steers traffic across multiple transports such as MPLS, internet, and LTE based on application requirements, path quality, and security policy.

Policy that classifies traffic by application and selects a path based on measured latency, jitter, and loss, rerouting when thresholds are violated. It is a core capability of SD-WAN and modern WAN edge designs.

Public IP address blocks obtained directly from a regional internet registry rather than from a service provider. They let an enterprise change transit providers without readdressing, which simplifies multihoming.

Connecting one enterprise network to two or more upstream providers or links so that service survives a single path or provider failure. Effective multihoming requires careful address planning and routing policy.

The ordered tie-breaking process a router applies to routes for the same prefix, considering weight, local preference, AS path length, origin, MED, and peer type. Designers tune attributes to control inbound and outbound traffic.

A BGP attribute used inside an autonomous system to indicate preferred exit points for outbound traffic. Higher values win, and it is exchanged only among internal BGP peers.

An optional non-transitive BGP attribute that suggests to an external peer which of several entry points is preferred for inbound traffic. It is a hint, so the receiving AS may override it.

Advertising one aggregate prefix that covers many more-specific networks, which shrinks routing tables and limits the scope of instability. It requires contiguous, planned address allocation.

Injecting routes learned by one routing protocol or process into another. Without filtering and metric setting, it can create loops, suboptimal paths, and excessive table size.

Techniques that stop packets from circulating indefinitely, including split horizon, route poisoning, and tagging routes during redistribution. In BGP, loop prevention relies on rejecting its own AS number.

A data center overlay in which VXLAN encapsulates Layer 2 frames over a Layer 3 underlay, and BGP EVPN distributes MAC and IP reachability. It replaces flood-and-learn with a scalable control plane.

Forwarding across multiple equally preferred next hops so traffic is shared and capacity is aggregated. Hashing must be consistent enough to avoid reordering, and it is central to spine-leaf underlays.

A dedicated private circuit between an enterprise data center or colocation and a cloud provider's network edge. It offers predictable latency and bandwidth compared with internet-based connectivity.

The connectivity and routing design that links on-premises networks to one or more cloud environments, covering address planning, encryption, redundancy, and traffic inspection at the boundary.

An encrypted point-to-point connection between gateways using IKE for key negotiation and ESP for confidentiality and integrity. It secures traffic over untrusted transports such as the public internet.

A security model that grants access per request based on identity and device posture rather than trusting a network location. Segmentation, strong authentication, and continuous verification replace perimeter assumptions.

Enforcing security policy between individual workloads or small groups, often in software, so lateral movement is blocked even inside a subnet. It typically uses distributed firewalls or security groups.

Dividing a network into zones with controlled traffic between them, using VLANs, VRFs, or firewalls. Good segmentation limits blast radius and simplifies applying distinct security policy per zone.

A technique that creates multiple independent routing tables on one device, allowing overlapping address space and traffic separation. VRFs are commonly used for segmentation and multi-tenant designs.

Selectively importing routes between VRFs or routing tables so specific prefixes can be reached across otherwise separated domains. It must be tightly filtered to avoid defeating the isolation the VRFs provide.

Classification, marking, queuing, and scheduling of traffic so latency-sensitive or business-critical flows get preferential treatment during congestion. End-to-end behavior depends on consistent marking across domains.

Setting the six-bit Differentiated Services field in the IP header to tag a packet's treatment class. Trust boundaries must be defined so untrusted sources cannot forge high-priority markings.

Traffic-rate controls: policing drops or remarks excess packets immediately, while shaping buffers and delays them to smooth bursts. Policing is simpler; shaping is gentler on TCP performance.

A multicast routing mode that builds shared and shortest-path trees only for groups with active receivers, using a rendezvous point. It scales better than dense mode for sparse, widely distributed audiences.

The router that receivers join to learn about sources in PIM-SM before switching to a source-specific tree. RP placement and redundancy strongly affect multicast convergence and latency.

Configuring the same RP address on multiple routers so receivers and sources reach the nearest one. A multicast source-discovery mechanism keeps the RPs synchronized about active sources.

Managing network and system configuration in version-controlled declarative files that tools apply automatically. It enables review, repeatability, and rollback, and it reduces configuration drift.

A property of an operation that produces the same end state no matter how many times it is applied. It is essential for safe automation, because retries and partial runs do not corrupt configuration.

The divergence between a device's actual configuration and the intended, documented baseline, usually caused by manual changes. Drift breaks assumptions in the design and complicates troubleshooting.

A separate management network, physically or logically isolated from production traffic, used to reach devices when the data plane is down. It is critical for recovery and for secure automation access.

Pushing structured operational data from devices to collectors continuously instead of polling with SNMP. Higher frequency and richer data improve capacity planning and anomaly detection.