Definitions and pro-tips for the 200-301 certification.
An IEEE standard for port-based Network Access Control (PNAC) that provides an authentication mechanism to devices wishing to attach to a LAN or WLAN.
A sequential list of permit or deny statements (ACEs) that apply to IP addresses or upper-layer protocols to control traffic entering or exiting a router interface.
A switch port configured to carry traffic for only one specific VLAN. End devices like PCs and printers are typically connected to access ports.
A network layer protocol used to map an IPv4 address to a physical MAC address on a local network segment.
A value used by Cisco routers to select the best path when there are two or more different routes to the same destination from different routing protocols.
An open-source automation tool used for IT tasks such as configuration management, application deployment, and provisioning. It is agentless and uses SSH/NETCONF to communicate.
A standby router on a multi-access network that listens to all OSPF routing updates and is ready to immediately take over if the DR fails.
A security feature that error-disables a switch port if a BPDU is received on it, preventing unauthorized switches from affecting the STP topology.
The frames exchanged by switches in a LAN to share information about the spanning tree topology, allowing them to elect a Root Bridge and identify redundant links.
A logical division of a computer network in which all nodes can reach each other by broadcast at the data link layer.
A network multiple access method used in wireless networks where nodes attempt to avoid collisions by transmitting only when the channel is sensed to be idle.
A configuration management tool that transforms infrastructure into code. It uses a master-agent architecture and relies on a Ruby-based domain-specific language.
A standard protocol that enables a Wireless LAN Controller (WLC) to manage a collection of lightweight access points (LAPs).
A static route with the destination network 0.0.0.0/0 (IPv4) or ::/0 (IPv6), used when no other specific route matches the destination IP address.
The out-of-the-box VLAN that all ports on a Cisco switch are assigned to. It is also the default Native VLAN and the VLAN used for control plane traffic like CDP and STP.
A type of attack aimed at overwhelming a system, network, or service with traffic, rendering it unavailable to legitimate users.
In STP, the port that forwards traffic away from the root bridge onto a network segment. There is exactly one designated port per network segment.
A router elected on an OSPF multi-access network (like Ethernet) to act as a central point for collecting and distributing routing information.
A router or host that listens for client DHCP broadcast messages and forwards them as unicast messages to a remote DHCP server.
A security feature that mitigates DHCP spoofing by filtering untrusted DHCP messages and building a binding database of valid client IP-to-MAC assignments.
A static route configured specifying only the outgoing exit interface instead of a next-hop IP address.
A hierarchical and decentralized naming system for computers, services, or other resources connected to the Internet or a private network. It translates easily memorized domain names to numerical IP addresses.
An OSPF router on a multi-access network that has not been elected as either the DR or the BDR.
A Cisco-proprietary protocol used to automatically negotiate trunking between two switches.
A security feature that validates ARP packets in a network by checking them against the DHCP snooping binding database and dropping packets with invalid IP-to-MAC bindings.
A network management protocol used on IPv4 networks where a DHCP server dynamically assigns an IP address and other network configuration parameters to each device.
A port link aggregation technology that groups multiple physical Ethernet links into a single logical link to provide fault tolerance and high-speed connections.
A piece of software, data, or sequence of commands that takes advantage of a vulnerability to cause unintended behavior or gain unauthorized access.
An ACL that filters traffic based on multiple criteria including source IP, destination IP, protocol (TCP, UDP, ICMP), and port numbers. Numbered 100-199 and 2000-2699.
A static route configured with a higher Administrative Distance (AD) than a primary route (static or dynamic), acting as a backup route.
A static route that includes both the exit interface and the next-hop IP address.
The industry-standard trunking protocol that inserts a 4-byte tag into the Ethernet frame header to identify the VLAN to which the frame belongs.
In NAT terminology, this is the legitimate IP address assigned by the NIC or service provider that represents one or more inside local IP addresses to the outside world.
In NAT terminology, this is the IP address assigned to a host on the inside network. It is usually a private IP address as defined by RFC 1918.
A 32-bit numerical label assigned to each device connected to a computer network that uses the Internet Protocol for communication.
A 128-bit alphanumeric address used to identify a device on a network, designed to replace IPv4 due to address exhaustion.
A manually configured route for forwarding IPv6 packets, configured using the 'ipv6 route' command.
A lightweight, text-based, language-independent data interchange format that is easy for humans to read and write and easy for machines to parse and generate.
An IEEE standard (802.3ad) protocol used to automatically negotiate and bundle multiple physical ports into a single logical EtherChannel.
An IPv6 static route that uses an IPv6 link-local address as the next hop.
Data structures used by OSPF routers to advertise their links, states, and costs to other routers in the OSPF area.
A table in an OSPF router that contains all the LSAs received from other routers, representing the complete topology of the network.
A Layer 2 attack where an attacker changes their device's MAC address to impersonate a legitimate device, often to bypass access controls or hijack traffic.
A table maintained by a Layer 2 switch that maps MAC addresses to specific physical ports to make accurate frame forwarding decisions.
A type of optical fiber with a larger core diameter (typically 50 or 62.5 microns) that allows multiple modes of light to propagate, suitable for short-distance, high-bandwidth applications.
A specific VLAN on an 802.1Q trunk that carries untagged traffic. Both ends of a trunk link must be configured with the same Native VLAN.
A process that translates private, non-routable IP addresses to public, routable IP addresses, allowing devices on a local network to access the Internet.
A networking protocol for clock synchronization between computer systems over packet-switched, variable-latency data networks.
The IP address of the adjacent router interface to which a packet is forwarded.
An interface that allows the SDN controller to communicate with higher-level applications and management systems, typically using RESTful APIs.
A hierarchical level in the NTP architecture that represents the distance from the reference clock. Stratum 0 devices are atomic clocks, Stratum 1 servers are directly connected to Stratum 0, and so on.
An interior gateway protocol (IGP) for IPv4 networks that uses a link-state routing algorithm to calculate the shortest path to all known destinations.
A conceptual framework used to describe the functions of a networking system across seven layers: Physical, Data Link, Network, Transport, Session, Presentation, and Application.
The amount of time an OSPF router will wait to receive a Hello packet from a neighbor before declaring that neighbor down.
A type of OSPF packet used to discover OSPF neighbors, establish adjacencies, and maintain keepalive status.
A value between 0 and 255 assigned to an OSPF interface that determines its eligibility to become a DR or BDR.
A 32-bit number formatted like an IPv4 address that uniquely identifies a router within an OSPF domain.
A virtual logical network created on top of an existing physical underlay network using tunneling protocols like VXLAN, GRE, or IPsec.
A form of NAT, also known as NAT Overload, that maps multiple private IP addresses to a single public IP address or a few public IP addresses by using unique source port numbers.
A Cisco-proprietary protocol for EtherChannel creation that automatically groups links with similar characteristics.
A Layer 2 security feature on switches that restricts interface access by limiting the number of valid MAC addresses allowed to send traffic into the port.
A Cisco proprietary STP feature that causes a switch port to immediately transition to the forwarding state, bypassing the listening and learning states.
A configuration management tool that uses a declarative language to manage infrastructure lifecycle. It typically relies on an agent installed on target nodes.
An enhancement of STP (802.1w) that provides significantly faster spanning tree convergence after a topology change, usually within milliseconds.
An architectural style for designing networked applications that relies on a stateless, client-server, cacheable communications protocol, usually HTTP.
The potential for loss, damage, or destruction of an asset as a result of a threat exploiting a vulnerability.
The central switch in a spanning tree topology. All other switches calculate the shortest path to this switch, and all its ports are placed in the Forwarding state.
The centralized 'brain' of a Software-Defined Network that manages flow control and defines how the underlying network devices (switches/routers) handle traffic.
A cryptographic network protocol operating at layer 7 to securely connect to and manage network devices over an unsecured network.
A unique, 32-character string used to identify a wireless local area network (WLAN).
An application-layer protocol used to manage and monitor network devices. SNMPv3 provides significant security enhancements over versions 1 and 2c, including authentication and encryption.
A type of optical fiber with a very small core diameter (typically 9 microns) that allows only one mode of light to propagate, used for long-distance, high-bandwidth applications.
A psychological manipulation technique used by attackers to trick individuals into divulging confidential information or performing actions that compromise security.
An interface that allows an SDN controller to communicate with and program the data plane forwarding on the physical network devices below it.
A Layer 2 network protocol that ensures a loop-free topology for any bridged Ethernet local area network. It dynamically blocks redundant paths to prevent broadcast storms.
An ACL that filters traffic based solely on the source IP address. They are numbered 1-99 and 1300-1999.
A type of NAT that maps a single private IP address to a single public IP address on a one-to-one basis.
A route manually configured by a network administrator to dictate the exact path a packet should take to reach a specific destination network.
A 32-bit number that masks an IP address, dividing the IP address into network address and host address portions.
A single static route that encompasses multiple contiguous network addresses, reducing the size of the routing table.
The DTP mode where the port passively waits to receive DTP negotiation frames. It will become a trunk only if the neighboring port is set to Trunk or Dynamic Desirable.
The DTP mode where the port actively sends DTP frames and attempts to negotiate a trunk link with the neighboring port.
A standard protocol used to send system log or event messages to a specific server. It operates on UDP port 514 by default.
Any potential danger to an information system. It is an event or action that could cause a loss of data or negatively impact operations.
A connection-oriented transport layer protocol that provides reliable, ordered, and error-checked delivery of a stream of bytes between applications running on hosts communicating via an IP network.
A switch port configured to carry traffic for multiple VLANs over a single link, typically used for connections between switches or between a switch and a router.
A virtualization layer that runs directly on the host's physical hardware, also known as a bare-metal hypervisor, to manage virtual machines.
The physical network infrastructure (switches, routers, and cables) that provides basic IP connectivity and routes traffic between devices.
A common type of copper cabling used in telephone wiring and local area networks (LANs), consisting of color-coded pairs of wires twisted together to minimize electromagnetic interference (EMI).
A connectionless transport layer protocol that provides a simple, unreliable message service without guarantees for delivery, ordering, or duplicate protection.
A software emulation of a physical computer system that runs an operating system and applications, utilizing virtualized hardware resources.
A technology that allows multiple instances of a routing table to co-exist within the same router at the same time.
A logical subset of a switch's ports that form a single broadcast domain. Devices in different VLANs cannot communicate directly without a Layer 3 device.
A feature that allows a switch port to carry both untagged data traffic for a PC and tagged voice traffic for an IP phone connected to the same port.
A weakness in a system, network, or application that could be exploited by a threat to cause a security breach.
A centralized device used to configure, manage, and monitor lightweight access points across a network.
A wireless security protocol that uses the Advanced Encryption Standard (AES) block cipher and Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (CCMP) for robust encryption.
The latest wireless security standard that replaces PSK with Simultaneous Authentication of Equals (SAE) to protect against offline dictionary attacks and improve forward secrecy.
We're adding new exams every week. Let us know what you're studying for, and we'll bump it up our priority list! (Typical turnaround: 2-3 days)
Your feedback has been submitted successfully. We appreciate your help in making Cert Sensei better!