Cisco Certified Support Technician: Networking (CCST Networking)Study guide

Covers the correspondence between the layered TCP/IP model and the OSI reference model, encapsulation that wraps upper-layer data in lower-layer headers, the difference between a frame (L2) and a packet (L3), and the two kinds of addressing—MAC address and IP address—as the foundation for telling which layer a symptom belongs to.

Covers the difference between bandwidth (a link's theoretical maximum capacity) and throughput (the actual effective amount that flows), latency as a measure of delay, and the difference between a speed test (against a server) and iperf (between two points)—framed as the judgment of using numbers to isolate a "it is slow" complaint.

Covers "network types" classified by scale—LAN/WAN/MAN/CAN/PAN/WLAN—and the difference between physical topology (how devices are actually cabled) and logical topology (how data flows), as the foundation for telling "what scale a situation is about" and "whether a diagram shows wiring or flow."

Covers the difference between on-premises (devices in your own facility) and cloud (using a provider's infrastructure), the cloud service models SaaS/PaaS/IaaS, the deployment models public/private/hybrid cloud, and the spread of remote work and hybrid work, as basic judgment about "which model fits a requirement."

Covers choosing between reliable connection-oriented TCP and low-latency connectionless UDP, plus common protocols and port numbers—HTTP/HTTPS, DNS, DHCP, FTP/SFTP/TFTP, NTP, and ICMP—as the foundation for identifying "which port, and TCP or UDP" a given communication uses.

Covers the difference between a globally unique, internet-routable public address and a private address reused inside an organization (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), the makeup of address classes A/B/C, the APIPA block (169.254.0.0/16) that appears when DHCP fails, and NAT that translates private to public—as the foundation for telling whether an address can reach the outside.

Covers the idea of a subnet that divides a network into smaller pieces, the subnet mask that decides "how much of an address is the network portion," its correspondence with slash (CIDR) notation counting the mask's one bits, the fact that each subnet reserves its first address as the network address and its last as the broadcast address, and the router's role of separating broadcast domains—learned with gentle /24 and /25 examples (no complex calculation).

Covers the main address types in 128-bit IPv6—the globally unique global unicast (GUA, 2000::/3), the link-only link-local (fe80::/10), the internal unique local (ULA, fc00::/7), and the self-referring loopback (::1)—the meaning of the common /64 prefix, and the fact that IPv6 has no broadcast and replaces it with multicast (ff00::/8), as the foundation for telling address types apart.

Covers the difference between copper twisted pair (Cat5e/6/6a, up to about 100 m, subject to EMI) and optical fiber (single-mode (SMF) for long distance with a laser vs. multimode (MMF) for medium distance with an LED), plus the common connectors coax, RJ-45, RJ-11, and fiber connectors, framed as the judgment of "which cable for this distance and environment."

Organizes the license-free 2.4/5/6 GHz bands used by Wi-Fi (802.11), the non-overlapping channels 1/6/11 on the congestion-prone 2.4 GHz, interference sources like microwave ovens and Bluetooth, and the difference from licensed cellular—framed as the judgment of choosing "wireless or wired" and "which band" by situation.

Covers the roles and identification of endpoints at the edge of the network—PCs, mobile devices, IP phones, network printers, servers, and IoT devices—through the lens of "what does this device provide, and what to check when it will not connect."

Covers the network utilities on Windows/Linux/macOS/Android/iOS, how to run troubleshooting commands like ping and ipconfig (Windows) / ifconfig and ip (Linux), and the wireless-client settings (SSID, authentication, WPA mode), framed as the procedure of "how to verify and connect on each OS."

Covers what the color and solid/blinking state of a switch or router link light (LED) mean, and the roles of each port—console port, serial port, Ethernet port, fiber/SFP, USB port, and PoE—as the foundation for "reading a device's state from its lights alone" and "telling which socket to plug into."

Covers wiring patch cables correctly per an engineer's network diagram, a small topology including a switch and router, and the layout of the rack that houses the gear (rack units (U), cable management, power via a PDU, and a UPS), as the introductory task of "cabling exactly as the diagram shows, in order, down to the power."

Covers the default gateway as the exit when leaving your own network (to another network), the difference between an L2 switch (forwarding within one segment by MAC) and an L3 switch (which can also route between networks), and how forwarding changes by whether the destination is on the local network or a remote network—as the foundation for telling "does this destination go via the gateway or arrive directly."

Covers the MAC address table by which a switch learns a source MAC and its receive port, flooding for unknown/broadcast frames, the default 300-second aging, MAC address filtering for permit control, and the VLAN that divides an L2 broadcast domain—learned while glancing at show mac address-table as the basics of "how a switch learns and delivers to a destination."

Covers working along a troubleshooting methodology (confirm the symptom -> gather information -> isolate the cause -> act -> verify) instead of poking devices on a hunch, recording work as a ticket with accurate and complete documentation, and prioritizing multiple cases by impact, as the discipline of support work.

Covers the purpose of a packet analyzer (notably Wireshark) that records communication packet by packet so you can see its contents, and how captured traffic is saved as a .pcap file and reopened later for analysis, as a tool for "confirming with your own eyes what is actually flowing."

Covers when to use the staple commands—ping for reachability, ipconfig (Windows) / ifconfig and ip (Linux) for local IP settings, tracert/traceroute to trace the path, and nslookup for name resolution—plus correctly interpreting results, such as how a firewall blocking ICMP can make ping fail even though the host is actually reachable.

Covers means of accessing devices and collecting data by situation: RDP/SSH/Telnet for remote operation (Telnet is unencrypted and discouraged; SSH is secure), VPN to safely connect into the office from outside, a console connection and terminal emulator for direct attachment, NMS and cloud management (Meraki) to monitor many devices at once, and scripts to automate repetitive work.

Covers the basic show commands for reading a Cisco device's state (show ip interface brief for the interface list and up/up, show cdp neighbors for adjacent Cisco devices, show ip route for the routing table, show mac address-table for MAC learning, show version for IOS/model), the privilege levels of user EXEC mode (>, view-oriented) vs. privileged EXEC mode (#, full), and the ? help and Tab completion aids.

Covers the role of a firewall that screens traffic at a network boundary, the permit and deny rules that decide what passes or is stopped, the default-deny posture of blocking by default and opening only what is needed, and the stateful mechanism that remembers a connection to let the return traffic back automatically—as the basis for telling "is this traffic failing because of the filter."

Covers the three security pillars CIA (confidentiality/integrity/availability), AAA (authentication/authorization/accounting) that verifies, controls, and records users, MFA that strengthens identity checks with multiple factors, the identity foundations of encryption, certificates, password complexity, and Active Directory, plus threats such as phishing, malware, and DoS—as the basis for telling "what a control is meant to protect."

Covers the generational differences of the wireless encryption standards WPA/WPA2/WPA3 that protect home and SOHO Wi-Fi, how to choose between Personal (PSK) using a pre-shared key and Enterprise (802.1X/RADIUS) using per-user authentication, and why the still-seen WEP and WPA (TKIP) are deprecated—as the basic judgment of "which method to choose for this environment."