Network Specialist ExaminationStudy guide

Covers the correspondence between the OSI reference model, which divides communication into seven roles, and the four-layer TCP/IP model used in practice; encapsulation, which wraps upper-layer data in lower-layer headers, and the PDU (frame/packet/segment) at each layer; and the judgment skill of isolating which layer—L2/L3/L4/L7—a given communication failure belongs to.

Covers Ethernet standards and CSMA/CD, full-duplex communication, the 48-bit MAC address, an L2 switch's MAC address learning and flooding, choosing devices that separate collision domains and broadcast domains, and the judgment skill of deciding whether to use a hub, an L2 switch, or an L3 switch.

Covers the structure of IPv4 addresses and the classful concept, CIDR notation and the subnet mask, VLSM, which splits address space into variable-length blocks sized to the required host count, private addresses that must not leak externally, and the judgment skill of designing network segments while manually verifying subnet calculations.

Covers 128-bit IPv6 address notation and global unicast addresses/link-local addresses, ARP, which resolves MAC addresses for IPv4, and its IPv6 counterpart NDP, dual stack, which runs IPv4 and IPv6 side by side, and the judgment skill of deciding how to respond to IPv4 address exhaustion.

Covers transmission coding, which puts digital signals onto an analog transmission medium, multiplexing (TDM/FDM/WDM), which consolidates multiple communications onto a single line, error control for handling transmission errors, the difference between full duplex and half duplex, and the relationship between bandwidth and effective transmission speed.

Covers how a routing table is consulted, when to choose static routing versus dynamic routing, the longest-match rule for resolving multiple matching routes, the default route as the catch-all exit, metric as a route's cost measure, and administrative distance (AD) for comparing routes learned from different sources.

Covers the distance-vector approach that evaluates routes by hop count (RIP), the link-state approach that floods link information and computes a shortest-path tree (OSPF, areas, LSAs, cost), the path-vector approach that governs inter-AS routing (BGP, AS, eBGP/iBGP, path attributes), and the distinction between IGP (used within an organization) and EGP (used between organizations), along with the speed of convergence.

Covers VLANs for logically partitioning a single physical switch, tagged VLANs (IEEE 802.1Q) for carrying frames from multiple VLANs over one link, the division of roles between trunk ports and access ports, inter-VLAN routing and Layer 3 switches for communication across VLANs, and link aggregation (LACP) for bundling multiple physical links.

Covers the Layer 2 loop and its harmful consequence, a broadcast storm, that arise when switches are connected redundantly with multiple links; the Spanning Tree Protocol (STP/RSTP) that prevents this; root bridge election, determined by priority and MAC address; and the port states a port transitions through, along with the difference in convergence speed between STP and RSTP.

Covers the division of roles between authoritative servers and caching (resolving) servers, how zones and delegation partition the domain namespace, resource records such as A/AAAA/MX/CNAME/NS/PTR, the difference between recursive queries and iterative queries, and how to triage DNS failures using forward and reverse lookups.

Covers the DHCP four-message exchange (DISCOVER/OFFER/REQUEST/ACK), temporary address assignment via lease, the DHCP relay agent used across multiple segments, static (reserved) allocation for servers and similar devices, and DHCP scope design decisions in a multi-segment environment.

Covers the fundamentals of HTTP/HTTPS, the performance improvements of HTTP/2 and HTTP/3 (QUIC), cookie/session management, mail transfer via SMTP/POP3/IMAP, sender domain authentication via SPF/DKIM/DMARC, and mail attachments via MIME, together with design decisions for web/mail performance and anti-spoofing measures.

Covers the difference between L4 and L7 load balancers, distribution methods such as round robin, least connections, and weighted algorithms, automatic removal of failed servers via health checks, session persistence (sticky sessions), content delivery optimization via reverse proxies and CDNs, and time synchronization via NTP, together with the judgment of choosing L4 vs. L7 for a given requirement.

Compares the characteristics of closed-network services connecting sites over a leased line, wide-area Ethernet, and MPLS (label switching)-based IP-VPN, versus an Internet VPN, and builds the judgment to choose the optimal circuit and access method from the tradeoffs among cost, quality (bandwidth guarantee, latency), and security.

Covers the evolution of the IEEE 802.11 standards (a/b/g/n/ac/ax (Wi-Fi 6)), frequency bands and channels, SSID, encryption via WPA2/WPA3, roaming, the hidden node problem, and 5G/LTE mobile communication, building the judgment needed to design a wireless environment given interference and security requirements.

Covers SDN, which separates the control and data-forwarding functions (via OpenFlow), SD-WAN, which centrally controls a multi-site WAN in software, NFV, which turns dedicated appliance functions into software, and VXLAN (VNI), which builds an L2 network as an overlay on top of L3, building the judgment needed to decide when to migrate from a traditional network.

Covers the IaaS/PaaS/SaaS service models and cloud connectivity methods (dedicated connection/VPN), the VPC (virtual network), edge computing, which performs latency-sensitive processing near the device, the CDN, which accelerates content delivery, and IoT/M2M, building the judgment needed to design network connectivity between on-premises and the cloud.

Covers device monitoring via SNMP (manager/agent/MIB/OID), the trade-off between polling and traps, the security hardening of SNMPv3, flow monitoring with NetFlow/sFlow, event collection via syslog, and the design thinking behind monitoring design for early fault detection.

Covers performance metrics such as throughput, bandwidth, latency, jitter, and packet loss; queueing theory (M/M/1) (utilization ρ, average waiting time) for mathematically modeling congestion; traffic-volume estimation and capacity management; and diagnosing the root cause of performance degradation (bottleneck diagnosis).

Covers why QoS is needed to protect the quality of voice and video traffic, priority control (priority queueing), which separates queues by priority, shaping and policing, which control transmission rate, the standardized priority-marking schemes DiffServ (DSCP) and IntServ, and congestion control, which prevents network-wide collapse.

Covers VRRP/HSRP for default-gateway redundancy, link aggregation for bundling physical links, route redundancy for securing multiple paths, active/standby device redundancy, calculating availability, MTBF, and MTTR, and eliminating a single point of failure (SPOF) that threatens an entire system.

Covers IPsec (ESP, AH, IKE) with its transport/tunnel modes for encrypting and authenticating IP packets, TLS underlying secure web communication, SSL-VPN usable from a browser alone, site-to-site VPN connecting locations and remote-access VPN for remote workers, and NAT-T for passing IPsec through NAT.

Covers firewalls (packet filtering, stateful inspection, application gateway) that block unauthorized traffic at the network perimeter, IDS/IPS (signature-based and anomaly-based) that detect and block attacks, WAF protecting against attacks targeting web applications, UTM that integrates multiple functions, DMZ that isolates externally published servers, and proxies that mediate communication.

Covers RADIUS for centralized network access authentication, EAP (EAP-TLS, PEAP) extending authentication methods, IEEE 802.1X and authentication VLAN for port-based access control, symmetric-key and public-key cryptography with their differing key handling, and digital certificates, PKI, and CAs that guarantee a peer's identity, plus hashing and digital signatures for tamper detection and authenticity proof.

Covers DoS/DDoS (SYN Flood, reflection attacks, amplification attacks) that overwhelm a service with traffic, DNS cache poisoning that forges DNS responses, ARP spoofing that forges MAC addresses within a LAN and the resulting man-in-the-middle attack, port scanning used for reconnaissance, and the countermeasures DNSSEC, DHCP snooping, and sender domain authentication (SPF/DKIM/DMARC), plus zero trust and SASE, which assume no trusted perimeter.