CNPA flashcards

33 cards. Read the term and the definition here. The deck at the top of this page is optional.

OSI Layer 3

The Network layer. It provides logical addressing and routing between networks, and its PDU is the packet. IP operates here.

Three-way handshake

TCP connection setup using SYN, SYN-ACK, and ACK. It confirms both hosts are reachable and synchronizes initial sequence numbers before data transfer.

Encapsulation

The process of adding protocol headers at each layer as data moves down the stack. The receiver strips them in reverse order as data moves up.

Ephemeral port range

Dynamic ports 49152 through 65535, assigned temporarily by a client host as the source port for outbound connections.

MAC address table

A switch table mapping learned source MAC addresses to the ports they arrived on. Unknown destinations are flooded out all other ports.

VLAN trunk

A link carrying multiple VLANs, typically using 802.1Q tags. The native VLAN is sent untagged, so both ends must agree on it.

STP root bridge

The switch with the lowest bridge ID, elected as the spanning tree root. All other switches compute least-cost paths toward it.

Broadcast domain

A set of devices that receive each other's broadcast frames. It ends at a router or VLAN boundary, not at a switch port.

Usable hosts formula

For a subnet with h host bits, usable addresses equal 2^h minus 2. The two subtracted addresses are the network and broadcast addresses.

Private IPv4 ranges

10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. These addresses are not routed on the public internet and require NAT for external access.

APIPA address

A 169.254.x.x link-local address a host self-assigns when DHCP fails. Its presence usually indicates a DHCP reachability problem.

/26 subnet mask

255.255.255.192, giving block size 64 and 62 usable hosts. Subnets start at .0, .64, .128, and .192 in the last octet.

IPv6 link-local address

An address in fe80::/10 automatically configured on every IPv6 interface. It is used for neighbor discovery and is never routed.

Longest prefix match

The rule that a router chooses the most specific matching route, meaning the one with the longest prefix length, before other tiebreakers.

Administrative distance

A ranking of route sources by trustworthiness. Lower values are preferred: connected 0, static 1, EIGRP 90, OSPF 110, RIP 120.

Default route

The route 0.0.0.0/0, which matches any destination not covered by a more specific entry. It typically points toward the internet.

Floating static route

A static route configured with an administrative distance higher than the primary route, so it is installed only if the primary fails.

OSPF metric

Cost, calculated from reference bandwidth divided by interface bandwidth. Lower total path cost is preferred when selecting routes.

DHCP DORA process

The four-step lease sequence: Discover, Offer, Request, Acknowledge. The client broadcasts Discover and confirms the offered address with Request.

DNS A record

A resource record mapping a hostname to an IPv4 address. The AAAA record performs the same function for IPv6 addresses.

DHCP relay

A router feature, configured with ip helper-address, that forwards client DHCP broadcasts to a server on a different subnet.

SNMP trap

An unsolicited alert sent by an agent to the management station on UDP 162 when a defined event occurs, rather than waiting for a poll.

Non-overlapping channels

In 2.4 GHz North America these are 1, 6, and 11. Adjacent channels overlap and cause interference, so only these three can be used together.

CSMA/CA

Wireless medium access that senses the channel and avoids collisions using random backoff and acknowledgments, since collisions cannot be reliably detected over radio.

WPA2 encryption

Uses AES with CCMP for confidentiality and integrity. WPA3 replaces the preshared-key handshake with SAE for better protection.

802.1X authentication

Port-based access control using EAP between client and a RADIUS server. It is the basis of enterprise wireless authentication with individual credentials.

Symmetric vs asymmetric

Symmetric encryption uses one shared key and is fast. Asymmetric uses a public/private pair and is slower, often used to exchange symmetric keys.

Stateful firewall

A firewall that tracks connection state and permits return traffic for established sessions, rather than evaluating every packet in isolation.

Hashing for integrity

A one-way function such as SHA-256 that produces a fixed-length digest. Any change to the data changes the digest, revealing tampering.

Implicit deny

The final rule in an ACL that drops traffic not matched by any earlier entry. Rule order matters because the first match is applied.

Traceroute

A tool that sends packets with increasing TTL values to reveal each hop along a path, showing where forwarding stops or slows.

Duplex mismatch symptom

Late collisions and increasing errors on a link where one side is full duplex and the other half duplex. Both ends should match.

Cat6 distance limit

Cat6 supports 10 Gbps up to 55 meters, while Cat6a reaches 100 meters. Cat5e supports 1 Gbps to 100 meters.