CNPE flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Three-tier hierarchy

Access attaches users, distribution enforces policy and summarizes routes, core forwards at high speed. Collapsing core and distribution suits smaller sites where policy needs are limited.

Oversubscription ratio

Downlink bandwidth divided by uplink bandwidth in a spine-leaf fabric. A 3:1 ratio means servers can collectively demand three times the uplink capacity at line rate.

Route summarization

Advertising one aggregate prefix that covers many more specific subnets. Requires contiguous, hierarchically assigned addressing so no unrelated networks fall inside the summary.

Availability formula

Availability equals MTBF divided by MTBF plus MTTR. Five nines permits about 5.26 minutes of unplanned downtime per year across the measured service.

QoS trust boundary

The point where device markings are first accepted. It sits at the access edge on IP phones and access points; untrusted PC ports are re-marked or set to zero.

OSPF hello and dead timers

Broadcast and point-to-point links use 10-second hellos and 40-second dead intervals. NBMA and point-to-multipoint use 30 and 120 seconds. Timers must match to form an adjacency.

EIGRP feasible successor

A backup route whose reported distance is lower than the current feasible distance of the successor. This condition guarantees the path is loop-free.

BGP local preference

An iBGP-wide attribute, higher is better, evaluated after weight. It is the standard control for choosing an exit point for outbound traffic across the whole AS.

Native VLAN mismatch

Occurs when the untagged VLAN differs on each end of a trunk. Frames from two separate VLANs merge into one broadcast domain, causing connectivity and security problems.

VRRP virtual MAC

VRRP routers share virtual MAC addresses in the form 00:00:5E:00:01:xx. The master is elected by highest priority, then highest interface IP address.

IPsec ESP tunnel mode

The entire original IP packet is encrypted and a new outer IP header is added. Used for site-to-site VPNs where gateway addresses differ from host addresses.

DHCP snooping

Switch feature that drops DHCP server messages arriving on untrusted ports. Trusted ports face legitimate servers. It builds the binding table used by Dynamic ARP Inspection.

TACACS+ versus RADIUS

TACACS+ runs over TCP 49 and encrypts the whole payload, supporting command authorization. RADIUS uses UDP 1812 and 1813 and encrypts only the password attribute.

802.1X authenticator

The switch or wireless access point that relays EAPoL frames between the supplicant and the RADIUS server. It enforces the authorization decision on the port.

Zero Trust model

No implicit trust based on network location. Every session is authenticated and authorized, and segmentation limits lateral movement after a compromise.

CRC and input errors

Counters that increment when received frames fail the checksum. They point to Layer 1 faults such as bad cable, faulty connector, duplex mismatch, or interference.

Syslog severity levels

Numbered 0 to 7: emerg, alert, crit, err, warning, notice, info, debug. A lower number is more severe, so level 3 logs errors and above.

SNMPv3 privacy

Adds encryption of the message payload using DES or AES on top of authentication. Without it, credentials and data travel in a form readable on the wire.

Divide-and-conquer troubleshooting

Start testing at the layer most likely to have failed based on symptoms, then move up or down. Faster than strict bottom-up when evidence already points to a layer.

Bandwidth-delay product

Bandwidth multiplied by round-trip time, giving the amount of data in flight. TCP throughput is limited by window size divided by RTT without window scaling.

DMVPN phase 3

Uses NHRP shortcut switching with a summarized tunnel network so spokes reach each other directly while the hub still advertises a single summary route.

GRE tunnel characteristics

Encapsulates many protocols including multicast and routing protocols, but provides no encryption. It is commonly paired with IPsec for confidentiality.

Dedicated cloud interconnect

A private circuit from an enterprise site or colocation to a cloud provider, bypassing the public internet. Examples include AWS Direct Connect and Azure ExpressRoute.

NETCONF transport and encoding

Runs over SSH on port 830 and encodes data in XML. Operations include get-config, edit-config, lock, and commit, all defined against YANG models.

RESTCONF HTTP verbs

GET retrieves data, POST creates, PUT replaces, PATCH modifies, and DELETE removes. It maps YANG-modeled data to resources addressed over HTTPS.

Idempotent automation

An operation that produces the same end state no matter how many times it runs. Declarative tools depend on this to converge devices safely.

JSON object versus array

An object is an unordered set of quoted key-value pairs in braces. An array is an ordered list in brackets that may hold mixed types.

WPA3 SAE

Simultaneous Authentication of Equals replaces the WPA2 pre-shared key handshake. It resists offline dictionary attacks and provides forward secrecy per session.

CAPWAP data and control

Control messages use UDP 5246 and data uses UDP 5247 between access point and wireless controller. Firewalls must permit both for AP registration and client traffic.

EIRP calculation

Effective isotropic radiated power equals transmit power in dBm plus antenna gain in dBi minus cable loss in dB. Regulatory limits cap it per band.

RTO and RPO

Recovery time objective is the maximum acceptable downtime after an outage. Recovery point objective is the maximum acceptable data loss measured in time.

Standard versus normal change

A standard change is pre-approved and low risk, executed without CAB review. A normal change requires assessment and approval by the change advisory board.