NCoE Selection Test cheat sheet

OSI layers 1-7: Physical, Data Link, Network, Transport, Session, Presentation, Application; TCP/IP model collapses Session/Presentation into Application.

TCP three-way handshake: SYN, SYN-ACK, ACK; teardown uses FIN/ACK pairs or RST for abort. Sequence numbers advance by payload bytes, not by segment count.

TCP header flags: SYN, ACK, FIN, RST, PSH, URG, ECE, CWR. MSS is negotiated via TCP options and equals MTU minus IP and TCP headers (1500 - 20 - 20 = 1460 typical).

UDP header is 8 bytes (source port, destination port, length, checksum); no handshake, no retransmission, no ordering guarantee.

Private IPv4 ranges: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16; link-local 169.254.0.0/16; loopback 127.0.0.0/8.

IPv6 address types: global unicast 2000::/3, link-local fe80::/10, unique local fc00::/7, multicast ff00::/8; no broadcast exists in IPv6.

Subnet host count formula: 2^(32 - prefix) - 2 for IPv4 (network and broadcast reserved); usable hosts in /26 = 62.

ARP resolves IPv4 to MAC within a broadcast domain; NDP (neighbor solicitation/advertisement) performs the equivalent for IPv6 using multicast.

Administrative distance defaults: connected 0, static 1, eBGP 20, EIGRP 90, OSPF 110, IS-IS 115, RIP 120, iBGP 200.

Longest-prefix match always wins before administrative distance is consulted; AD only breaks ties between identical prefixes from different sources.

OSPF neighbor states in order: Down, Init, 2-Way, ExStart, Exchange, Loading, Full. Stuck in ExStart usually indicates MTU mismatch.

OSPF cost = reference bandwidth (default 100 Mbps) divided by interface bandwidth; a 1 Gbps link yields cost 1 unless reference bandwidth is raised.

EIGRP uses composite metric from bandwidth and delay by default; feasible successor requires reported distance < feasible distance.

STP port roles: root port (one per non-root switch), designated port (one per segment), blocked/alternate. Root bridge election is lowest bridge ID (priority then MAC).

VLAN trunking 802.1Q inserts a 4-byte tag; native VLAN traffic is untagged, so native VLANs must match on both ends of a trunk.

Switch MAC learning builds the CAM table from source MACs; unknown unicast is flooded, while broadcast and multicast are flooded by default.

Standard ACLs (1-99, 1300-1999) filter on source IP only and should be placed near the destination; extended ACLs (100-199, 2000-2699) filter on source, destination, protocol, and port and belong near the source.

ACL evaluation is top-down and stops at first match; every ACL ends with an implicit deny, so an explicit permit is required for wanted traffic.

Stateful firewalls track connection state; stateless ACLs require explicit rules for both directions of a flow.

IPsec: AH provides integrity and authentication only (protocol 51); ESP provides confidentiality plus integrity (protocol 50). IKE negotiates SAs on UDP 500 (and 4500 for NAT-T).

AAA components: authentication (who), authorization (what they may do), accounting (what they did). TACACS+ encrypts the full payload and uses TCP 49; RADIUS encrypts only the password and uses UDP 1812/1813.

802.1X roles: supplicant, authenticator (switch), authentication server (RADIUS). EAPoL runs between supplicant and authenticator.

DHCP snooping trusts only configured uplink ports; untrusted ports drop DHCP offer and ACK messages to prevent rogue servers. Dynamic ARP Inspection relies on the DHCP snooping binding table.

Cipher and hash pairings: AES is symmetric block cipher; RSA and ECDSA are asymmetric; SHA-256 is a hash. TLS 1.3 removed RSA key exchange and static DH in favor of ephemeral (forward-secret) key agreement.

DNS record types: A (IPv4), AAAA (IPv6), CNAME (alias, cannot coexist with other records at same name), MX (mail with preference), NS (delegation), PTR (reverse), TXT (verification/SPF), SOA (zone authority and timers).

DNS resolution order on a host: local cache, hosts file, then configured resolvers; recursive resolver walks root, TLD, then authoritative servers.

DHCP DORA sequence: Discover, Offer, Request, Acknowledge. Lease renewal uses unicast Request/ACK at T1 (50% of lease); rebinding at T2 (87.5%) uses broadcast.

DHCP relay (helper address) forwards client broadcasts to a server on another subnet; the giaddr field tells the server which pool to use.

Load balancer algorithms: round robin, weighted round robin, least connections, source-IP hash (session persistence), and health-checked active/standby.

Layer 4 load balancing distributes by IP and port; Layer 7 inspects HTTP host, path, or headers and can terminate TLS.

WAN technologies: MPLS (label switching, provider-managed), leased line (dedicated, fixed bandwidth), broadband/DSL, and SD-WAN overlays across encrypted tunnels.

NAT terminology: inside local (private host address), inside global (public translated address), outside global (public destination). PAT multiplexes sessions by source port.

Troubleshooting sequence: define the problem, gather information, analyze, eliminate causes, propose and test a hypothesis, solve, verify, document.

Ping uses ICMP echo request/reply; traceroute varies TTL and reads ICMP time-exceeded replies to map the path.

Interface counters: runts (below minimum frame), giants (above MTU), CRC errors (physical/cabling), late collisions (duplex mismatch or excessive cable length).

Latency, jitter, and packet loss are the three key transport quality metrics; voice typically requires under 150 ms one-way latency and under 30 ms jitter.

Bandwidth-delay product = bandwidth x round-trip time; it sets the window size needed to fill a path (TCP throughput ceiling = window / RTT).

SNMP: agent on device, manager polls UDP 161; traps and informs are sent to UDP 162. SNMPv3 adds authentication and encryption (authPriv).

Syslog severity 0 (emergency) through 7 (debug); lower number is more severe. NetFlow/IPFIX exports flow records with 5-tuple and byte/packet counts.

Baseline first: compare current metrics against a known-good baseline before declaring degradation; correlate time of onset with change records.

Idempotency: applying the same configuration repeatedly yields the same end state without side effects; it is the core property of declarative tools such as Ansible, Puppet, and Chef.

Ansible is agentless over SSH with YAML playbooks and inventory files; Puppet and Chef use agents with a pull model and a central server.

Terraform is declarative and stateful: it tracks resources in a state file and computes a plan/diff before apply. It manages infrastructure, not device CLI state.

NETCONF runs over SSH (port 830) and uses XML with datastore operations get-config, edit-config, and commit. RESTCONF maps the same model to HTTP verbs and JSON/XML.

YANG models define the data schema for NETCONF/RESTCONF; vendor models plus IETF models describe configuration and state.

gNMI/gRPC uses protobuf over HTTP/2 for streaming telemetry and configuration, an alternative to polling with SNMP.

Configuration drift is divergence between intended and actual state; detection requires periodic comparison against a source of truth (Git, template, or state file).

Secrets must not be stored in plaintext in repositories or scripts; use vaults or environment injection, and treat API keys and SNMP communities as credentials.

A change record contains: description, justification, risk and impact, rollback plan, test plan, implementation window, approver, and post-change verification.

Standard vs. normal vs. emergency changes: pre-approved low-risk routine work, CAB-reviewed planned work, and expedited restoration respectively.

Rollback plan must be written and tested before the change window; a change without a viable rollback is not ready for approval.

Network documentation set: physical and logical topology, IP address management (IPAM), device inventory, circuit IDs, rack elevations, and contact/escalation matrix.

Configuration backups should be versioned and stored off-device; a backup is only valid once a restore has been verified.

MTTR is reduced by runbooks, known-error databases, and monitoring alerts tied to ownership; MTBF measures reliability between failures.

Separation of duties: the person who authors a change should not be the sole approver; peer review catches errors before production impact.

Post-implementation review compares actual outcome to expected outcome and updates documentation, baselines, and known-error records.