CPDN flashcards

33 cards. Read the term and the definition here. The deck at the top of this page is optional.

OSI model layers

Seven layers from the bottom: Physical, Data Link, Network, Transport, Session, Presentation, and Application. Each layer provides services to the layer above it and consumes services from the layer below.

TCP three-way handshake

Connection setup using SYN, then SYN-ACK, then ACK. It synchronizes sequence numbers so both endpoints confirm reachability and agree on initial sequence values before data flows.

Private IPv4 address ranges

RFC 1918 blocks are 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. They are not routable on the public internet and require network address translation to reach external hosts.

IPv6 address length

An IPv6 address is 128 bits, written as eight hexadecimal groups. It uses a fixed 40-byte header and has no broadcast address, relying on multicast and anycast instead.

Usable hosts in a subnet

For a classic IPv4 subnet, usable host addresses equal two raised to the number of host bits, minus two, because the network and broadcast addresses cannot be assigned to hosts.

MTU versus MSS

Maximum transmission unit is the largest payload a link carries, typically 1500 bytes on Ethernet. TCP maximum segment size equals MTU minus 40 bytes for IPv4 with TCP.

Three-tier network design

A hierarchical model with core for fast transport, distribution for policy and routing boundaries, and access for endpoint connectivity. Each layer has a distinct role and limits fault propagation.

Availability expressed in nines

Availability stated as downtime: 99.9 percent is about 8.8 hours per year, 99.99 percent about 53 minutes per year, and 99.999 percent about 5.3 minutes per year.

MTBF and MTTR

Mean time between failures measures how long a component runs before failing; mean time to repair measures recovery speed. Availability equals MTBF divided by MTBF plus MTTR.

VLSM allocation rule

Variable length subnet masking assigns the largest required subnet first and works downward, keeping every block on a bit boundary so the address plan never overlaps.

PoE standards

IEEE 802.3af delivers roughly 15.4 watts per port, 802.3at roughly 30 watts, and 802.3bt up to 90 watts at the power sourcing equipment, subject to the switch power budget.

DHCP DORA process

Four-step address assignment: Discover broadcast from client, Offer from server, Request from client, and Acknowledge from server. It uses UDP port 67 on the server and 68 on the client.

802.1Q VLAN tag

A four-byte tag inserted into the Ethernet frame carrying the VLAN identifier and priority bits. Trunk links tag frames, while access ports forward untagged traffic on one VLAN.

Administrative distance

A ranking of how trustworthy a route source is. Lower values win, so connected and static routes are preferred over routes learned through dynamic routing protocols.

NAT overload

Also called port address translation, it maps many private addresses to one public address by tracking source ports, letting thousands of internal hosts share a single routable address.

NTP stratum levels

Stratum 1 servers synchronize directly to a reference clock, each level down adds one, and stratum 16 indicates an unsynchronized clock that should not be trusted.

802.1X components

Port-based access control with a supplicant on the endpoint, an authenticator such as a switch or access point, and an authentication server, usually RADIUS, that validates the credentials.

FCAPS management model

Five network management functional areas: Fault, Configuration, Accounting, Performance, and Security. It is used to organize tooling, processes, and operational responsibilities.

RPO versus RTO

Recovery point objective is the maximum acceptable data loss measured in time. Recovery time objective is the maximum acceptable outage duration before service restoration must be complete.

SNMPv3 security features

Version 3 adds authentication and encryption of management messages plus a user-based security model, unlike versions 1 and 2c, which send community strings in clear text.

Syslog severity levels

Numbered 0 through 7, where 0 is emergency and 7 is debug. Lower numbers are more severe, and collectors usually record facility and severity with each message.

3-2-1 backup rule

Keep three copies of data on two different media types with one copy stored off site, so a single device failure or site event cannot destroy every copy.

CIA triad

Confidentiality, integrity, and availability: the three core security objectives used to evaluate whether a control is justified and to classify incident impact.

Risk calculation

Risk is commonly expressed as likelihood multiplied by impact. Treatments are mitigate, transfer, avoid, or accept, chosen by comparing control cost against expected loss.

Symmetric versus asymmetric encryption

Symmetric ciphers such as AES use one shared key and are fast. Asymmetric algorithms such as RSA use a key pair and are slower, so TLS uses them to establish a session key.

Stateful firewall behavior

It tracks connection state so return traffic for an allowed session passes automatically. Stateless ACLs must permit both directions explicitly and end with an implicit deny.

CVSS score range

The Common Vulnerability Scoring System rates severity from 0.0 to 10.0, where 9.0 and above is critical, 7.0 to 8.9 is high, and 4.0 to 6.9 is medium.

Duplex mismatch symptoms

One side set to full duplex and the other to half causes late collisions, runts, and frame check errors on the full-duplex side, with poor throughput despite link up.

CRC and input errors

Counters showing frame check sequence failures or input errors point to physical-layer faults such as bad cabling, faulty transceivers, or interference rather than routing or addressing problems.

PMTUD black hole

When ICMP fragmentation-needed messages are blocked, large packets silently drop while small ones succeed. Testing with a don't-fragment ping of decreasing size isolates the failing MTU.

APIPA address meaning

A Windows host self-assigns a 169.254.x.x address when no DHCP server responds, indicating a layer 1 or layer 2 path problem to the DHCP service or an exhausted scope.

Traceroute mechanism

It sends packets with incrementing time-to-live values; each router that discards an expired packet returns ICMP time exceeded, revealing the path hop by hop.

Duplex autonegotiation failure

When autonegotiation fails on one end, speed may match while duplex does not, producing a hidden half-duplex link that is best fixed by hard-setting speed and duplex on both sides.