NCoE Selection Test study plan

Explain the OSI and TCP/IP models layer by layer and map at least 15 common protocols to their correct layer and transport port.

Compare TCP and UDP behavior in terms of handshake, ordering, retransmission, and head-of-line effects, and predict which one a given application would use.

Describe IPv4 addressing, subnet masks, CIDR notation, and private address ranges, and identify the network and broadcast address for five given prefixes.

Summarize the purpose and header fields of ARP, ICMP, and the Ethernet frame format, including how a host resolves a next-hop MAC address.

Differentiate distance-vector, link-state, and path-vector routing protocols and state which convergence and loop-prevention mechanisms each relies on.

Explain OSPF neighbor states, area design, and the role of LSAs, and describe how a router moves from Down to Full adjacency.

Describe Ethernet switching behavior: MAC learning, flooding, forwarding, aging, and the purpose of VLANs and 802.1Q tagging.

Explain how the Spanning Tree Protocol prevents Layer 2 loops and how root bridge election and port states work.

Configure static routes and a default route in a lab and verify the resulting routing table entries.

Compare interior and exterior gateway behavior, including BGP path attributes and why BGP uses TCP port 179.

Explain NAT and PAT operation, including how translation tables are built and what breaks when inbound connections are needed.

Read a routing table and longest-prefix-match decision for five competing destination entries.

Describe the function of stateful firewalls, stateless ACLs, and security groups, and state where each is typically enforced.

Explain 802.1X authentication flow with supplicant, authenticator, and authentication server, and list the EAP methods commonly used.

Identify common attack classes such as spoofing, ARP poisoning, VLAN hopping, and DDoS, and name one mitigation for each.

Describe IPsec components (AH, ESP, IKE) and where TLS fits in protecting application traffic.

Trace a DNS resolution from stub resolver through recursive resolver to authoritative server, and distinguish A, AAAA, CNAME, MX, TXT, and NS records.

Explain DHCP DORA exchange, lease renewal, relay agents, and common failure modes such as rogue servers and scope exhaustion.

Compare load-balancing algorithms (round robin, least connections, weighted, hash) and explain health checks and session persistence.

Differentiate WAN technologies and topologies, including MPLS, SD-WAN, and site-to-site VPN, by cost, resilience, and management model.

Interpret interface counters, latency, jitter, and packet loss, and describe a structured troubleshooting method from symptom to root cause.

Use ping, traceroute, dig, and packet capture to isolate whether a fault is DNS, routing, or application layer.

Explain syslog severity levels, SNMP polling versus traps, and how flow data such as NetFlow supports capacity analysis.

Distinguish baseline, threshold, and anomaly alerting and state why each matters for performance monitoring.

Write a Python or shell script that parses device configuration or command output and reports a specific compliance check.

Explain idempotency and declarative versus imperative configuration, and describe how a tool such as Ansible or Terraform applies each model.

Describe how a REST API call is structured and how authentication tokens are used to retrieve device or inventory data.

Explain the role of version control, branching, and peer review in managing network configuration as code.

Write a change record containing impact, rollback plan, verification steps, and approval path for a sample routing change.

Produce network documentation including topology diagram conventions, IP address plan, and device inventory fields.

Complete a timed mixed-domain practice set and categorize every miss by domain and root cause.

Build a personal weak-area list with a review action for each item and schedule the final review.