NCoE Selection Test flashcards
NCoE Selection Test · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- TCP three-way handshake
- Connection setup uses SYN, then SYN-ACK, then ACK. Sequence numbers synchronize both directions before data flows, enabling reliable ordered delivery and retransmission.
- MSS versus MTU
- MTU is the largest IP packet a link carries, typically 1500 bytes. MSS is the payload after IP and TCP headers, so 1500 minus 40 equals 1460 bytes.
- Private IPv4 ranges
- RFC 1918 defines 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 as non-routable private space. Link-local 169.254.0.0/16 appears when DHCP fails.
- ARP versus NDP
- ARP resolves IPv4 addresses to MAC addresses using broadcast. IPv6 uses Neighbor Discovery with solicitation and advertisement messages sent to solicited-node multicast groups.
- Administrative distance order
- Lower distance is preferred: connected 0, static 1, eBGP 20, EIGRP 90, OSPF 110, IS-IS 115, RIP 120, iBGP 200. It only applies to identical prefixes.
- Longest prefix match
- A router always selects the most specific matching route regardless of administrative distance. Distance and metric break ties only among routes with the same prefix length.
- OSPF neighbor states
- Progression is Down, Init, 2-Way, ExStart, Exchange, Loading, Full. Neighbors stuck in ExStart commonly indicate an MTU mismatch between interfaces.
- Spanning Tree root election
- The root bridge is the switch with the lowest bridge ID, composed of priority then MAC address. All its ports become designated; other switches elect one root port each.
- 802.1Q native VLAN
- Trunk frames carry a four-byte tag except native VLAN traffic, which is untagged. Mismatched native VLANs on two trunk ends cause VLAN hopping and connectivity faults.
- EIGRP feasible successor
- A backup route qualifies as feasible successor when its reported distance is lower than the current feasible distance, guaranteeing it is loop-free.
- Extended ACL placement
- Extended ACLs filter source, destination, protocol, and port, so they belong close to the source to stop unwanted traffic early. Standard ACLs go near the destination.
- Implicit deny rule
- Every access control list ends with an invisible deny-any entry. Any traffic not explicitly permitted by an earlier line is dropped.
- IPsec AH versus ESP
- AH provides integrity and authentication but no encryption. ESP encrypts payload and also provides integrity, so confidentiality requires ESP, usually in tunnel mode.
- TACACS+ versus RADIUS
- TACACS+ encrypts the entire payload over TCP 49 and separates AAA functions. RADIUS encrypts only the password, uses UDP 1812 and 1813, and combines authentication with authorization.
- DHCP snooping trust
- Only ports facing legitimate DHCP servers are trusted. Untrusted ports drop server offers and acknowledgements, blocking rogue DHCP servers on access ports.
- 802.1X roles
- The supplicant is the client, the authenticator is the switch port, and the authentication server is RADIUS. EAPoL carries credentials between supplicant and authenticator.
- DNS CNAME restriction
- A CNAME aliases one name to another and cannot coexist with any other record at the same owner name. Zone apexes therefore use A or AAAA records instead.
- DHCP DORA process
- Clients broadcast Discover, servers reply Offer, clients broadcast Request, servers send Acknowledge. Renewal at fifty percent of lease time is unicast.
- DHCP relay agent
- A router forwards client broadcasts to a DHCP server on another subnet and fills the giaddr field, which selects the correct address pool.
- Layer 4 versus Layer 7 balancing
- Layer 4 distributes connections by IP and port without inspecting payload. Layer 7 parses HTTP host, path, or headers and can terminate TLS and rewrite requests.
- PAT port multiplexing
- Port address translation maps many private hosts to one public address, distinguishing sessions by translated source port. Each flow consumes one port mapping.
- CRC and late collision counters
- CRC errors indicate physical layer faults such as bad cabling. Late collisions beyond the first 512 bits usually signal duplex mismatch or an over-length cable run.
- Bandwidth-delay product
- Multiply path bandwidth by round-trip time to get the bytes in flight needed to fill the link. TCP throughput ceiling equals window size divided by RTT.
- SNMP ports and versions
- Agents listen on UDP 161 for manager polls; traps and informs go to UDP 162. Version 3 adds authentication and encryption through authPriv security levels.
- Syslog severity levels
- Severity runs 0 emergency to 7 debug, where lower numbers are more severe. A configured logging level includes that level and all more severe ones.
- Traceroute mechanism
- Traceroute sends probes with incrementing TTL values. Each router that expires a packet returns ICMP time-exceeded, revealing the hop and its latency.
- Idempotent configuration
- Applying the same declarative configuration repeatedly produces the same end state without duplicate side effects. Ansible, Puppet, and Chef rely on this property.
- NETCONF transport and port
- NETCONF runs over SSH on TCP 830 and exchanges XML messages. Core operations include get-config, edit-config, lock, unlock, commit, and discard-changes.
- Terraform state file
- Terraform records managed resources in a state file, compares it with desired configuration to produce a plan, then applies the diff.
- Configuration drift
- Drift is divergence between intended and actual device state. Detecting it requires periodic comparison against a versioned source of truth such as Git or a template.
- Change record contents
- A change record documents justification, risk and impact, test plan, rollback plan, implementation window, approver, and post-change verification steps.
- Verified configuration backup
- A backup is trustworthy only after a restore has been tested. Store copies off-device, version them, and record the date and device state captured.