Cisco Certified Network Associate (CCNA)Study guide

Covers the roles of components such as the router, L2/L3 switches, next-generation firewall (NGFW), IPS, AP and WLC, endpoints, servers, and PoE; topologies such as 2-tier, 3-tier, and spine-leaf; SOHO and WAN; and on-premises vs. cloud—all as the design judgment of "which device or topology fits this requirement."

Covers the correspondence between the layered OSI reference model and the practical TCP/IP model, encapsulation that wraps upper-layer data in lower-layer headers along with each layer's PDU, and TCP (reliable, three-way handshake) versus UDP (low-latency, connectionless) framed as the judgment of "which fits this application."

Covers choosing between copper (UTP) and optical fiber (SMF/MMF), straight-through/crossover and Auto-MDIX, and an L2 switch's core behavior—MAC address learning, aging, flooding, and the MAC address table—framed as the judgment/diagnosis of "which cable for a distance/speed" and "why frames leak to every port."

Covers the structure of IPv4 addresses, the private/public distinction, the subnet mask and CIDR, and VLSM, which splits space into variable-length blocks sized to the required host count—learned as the design judgment of "allocating a limited address space without waste," with manual verification.

Covers 128-bit IPv6 address notation and types (GUA/ULA/link-local/multicast/anycast) and EUI-64, wireless fundamentals (2.4/5 GHz, non-overlapping channels 1/6/11, SSID, encryption), and virtualization (VM/container/VRF), framed as design and troubleshooting judgment.

Covers VLANs that split one physical switch into multiple broadcast domains, access ports that place an end host into a single VLAN, trunk ports that extend the same VLAN across multiple switches by tagging frames per VLAN with 802.1Q, the native VLAN (the one VLAN sent untagged), and the default VLAN (VLAN 1) that every port belongs to out of the box, all alongside the Cisco IOS configuration and verification commands.

Covers CDP (Cisco-proprietary) and LLDP (industry-standard) for automatically discovering directly connected neighbors, and EtherChannel for bundling multiple physical links into one logical link to gain both bandwidth and redundancy (dynamic negotiation via LACP, L2/L3 configuration, verification with show etherchannel summary), all with the Cisco IOS configuration and verification commands.

Covers spanning tree that prevents the broadcast storm of a redundant L2, Cisco's default Rapid PVST+ (per-VLAN RSTP), root bridge election decided by the bridge ID, port roles (root/designated/alternate) and states (discarding/learning/forwarding), and PortFast for end-host ports plus BPDU Guard to defend against rogue BPDUs, all with the Cisco IOS configuration and verification commands.

Covers the autonomous architecture that manages each AP individually, the cloud-based architecture that manages them centrally from the cloud, and the split-MAC (WLC) architecture that divides work between a WLC and its APs; the AP modes of a lightweight AP that joins a WLC over CAPWAP; the management-access options for APs/WLCs; and WLAN creation in the WLC GUI (SSID, WPA2 PSK, QoS profile, advanced settings).

Covers the paths for managing network devices—the physically attached, out-of-band console; unencrypted Telnet versus encrypted SSH; and the web GUI over HTTP/HTTPS—together with the AAA protocols that centralize their login authentication on an external server: TACACS+ (Cisco-proprietary, TCP 49, separates AAA, encrypts the entire payload) and RADIUS (industry standard, UDP, combines authentication and authorization), all with the Cisco IOS configuration.

Covers reading each line of show ip route—the routing protocol code, prefix/network mask, next hop, administrative distance (AD), metric, and gateway of last resort—and the router logic that picks a forwarding path in the order longest match -> AD -> metric, all through diagnosing real device output.

Understands static routing—routes an administrator enters by hand—through its four forms: a network route to a destination network, a host route to a single host, a default route catching all non-matches, and a floating static with a raised AD for backup; and learns to configure and verify ip route / ipv6 route from an operator's viewpoint.

Covers single-area OSPFv2 (a link-state IGP; AD 110, bandwidth-based cost) through the conditions for forming neighbor adjacencies via Hello (matching area, timers, subnet, MTU), the difference between the point-to-point and broadcast network types, and configuration with router ospf / network / ip ospf verified by show ip ospf neighbor.

Covers the roles of the DR (Designated Router) and BDR (Backup DR) that curb the explosion of adjacencies on a broadcast network, the election decided by priority (default 1; 0 means ineligible) then router ID, the fact that the election is non-preemptive, and how the router ID is chosen in the order manual -> highest loopback IP -> highest physical IP, all through diagnosing the DR/BDR/DROTHER output of show ip ospf neighbor.

Covers the purpose of FHRP, which makes a host's default gateway redundant, and the operation of Cisco's HSRP—how one Active router forwards for the virtual IP / virtual MAC while a Standby waits, how the role is decided by priority (default 100, higher becomes Active), and the preempt setting needed to fail back after recovery—all from a practical failover-design viewpoint.

Covers the role of NAT in translating internal private addresses into global addresses, choosing among one-to-one static NAT, pool-based dynamic NAT, and PAT (overload) that collapses many hosts to one address using port numbers, the inside local / inside global terminology, and the judgment skill of isolating a fault from a mislabeled ip nat inside / ip nat outside or from the translation table.

Covers the DORA operation of DHCP for automatic IP assignment and the roles of server, client, and relay agent (ip helper-address); the role of DNS in resolving hostnames to IPs; and the stratum hierarchy and client/server configuration of NTP for time synchronization—building the judgment to isolate faults such as "hosts on a remote segment get no IP."

Covers the difference between SNMPv2c (community) and SNMPv3 (authentication and encryption) for monitoring and managing devices, the fire-and-forget trap versus the acknowledged inform, and the severity levels 0-7 (0 emergency to 7 debug) and facility of Syslog—learning to judge, from operational requirements, that a logging trap level captures "that value and everything more severe."

Covers the per-hop behavior of QoS (classification, marking (DSCP), queuing, congestion management, policing that drops excess, and shaping that buffers to smooth), the setup prerequisites of SSH (RSA key, domain name) for encrypted remote management versus Telnet, and choosing among TFTP, FTP, and SCP for transferring IOS images/configs—as practical judgment.

Covers the core vocabulary of threat, vulnerability, exploit, and mitigation and how they relate to risk, countermeasures against common attacks (malware/phishing/DoS/man-in-the-middle/spoofing), and defense in depth that combines user awareness, training, and physical access control—things technology alone cannot cover—so you can judge which mitigation is most effective in a given situation.

Covers local passwords that protect access to routers/switches (enable secret, line passwords, username secret) and SSH, which is safer than Telnet; password policy (complexity, management, MFA, certificates, biometrics); and AAA, which centrally manages authentication, authorization, and accounting, together with the choice between the external-server protocols TACACS+ (TCP 49, Cisco-proprietary, per-command authorization) and RADIUS (UDP, open standard, combined authentication/authorization)—judged from real device config and requirements.

Covers the types of ACL that permit/deny traffic on IOS (numbered/named, standard (1-99/1300-1999, source only) versus extended (100-199, source/destination/protocol/port)), the implicit deny at the end, the wildcard mask, and the placement rule that standard goes near the destination and extended goes near the source—together with configuration/verification commands—so you can judge how to filter exactly as required.

Covers port security that limits which MACs can connect to a switch port (violation modes protect/restrict/shutdown, sticky MAC), DHCP snooping that eliminates rogue DHCP servers (trusted/untrusted ports and the binding table), and Dynamic ARP Inspection (DAI) that uses those bindings to prevent ARP spoofing—so you can judge which L2 controls to combine from an attack scenario.

Covers VPNs that build a secure path over public networks (a remote-access VPN connecting an individual to a site, a site-to-site VPN joining sites, and IPsec providing confidentiality/integrity/authentication), the wireless encryption standards WPA/WPA2/WPA3 (WPA3's SAE and mandatory PMF), the personal/enterprise distinction, and WPA2 PSK GUI configuration—judged as scheme selection to fit requirements.

Covers the consistency, speed, and scale that network automation brings to operations; the split between the control plane (which decides where traffic goes) and the data plane (which actually forwards it); the difference between traditional (distributed) networking, where each device decides on its own, and controller-based networking, where a central controller consolidates those decisions; and using AI/ML to spot anomalies from operational data—all as practical judgment.

Covers the physical underlay and the logical overlay, the fabric that binds the two, Cisco's campus automation SD-Access, the northbound API connecting the controller to applications and the east-west API connecting controllers to one another, and the cloud management dashboard Cisco Catalyst Center (formerly DNA Center) that handles automation and assurance.

Covers, from a practical angle, the nature of REST APIs (stateless, running over HTTP) that underpin operating controllers and devices from automation; the correspondence between CRUD operations and HTTP methods (POST/GET/PUT/DELETE); the HTTP status codes (200/201/4xx/5xx) that indicate success or failure; and reading JSON (the {} object, [] array, keys and values, and data types)—the main vehicle of data exchange.

Covers the idea of Infrastructure as Code (IaC) managing configuration as code; the meaning of idempotency; Ansible, which is agentless, works over SSH, is push-based, and is written in YAML; Terraform, which builds infrastructure declaratively; and the positioning of the agent-resident, pull-based Puppet/Chef—all as tool-selection judgment.