3.3 Static routing

IPv4 default route

ip route 0.0.0.0 0.0.0.0 203.0.113.1

IPv4 network route

ip route 10.50.0.0 255.255.0.0 192.0.2.2

IPv4 host route

ip route 203.0.113.25 255.255.255.255 192.0.2.2

A host route uses /32.

IPv6 static route

ipv6 route 2001:DB8:50::/64 2001:DB8:FF::2

Floating static route

A floating static route is a backup route with a higher AD than the primary route source.

ip route 10.50.0.0 255.255.0.0 198.51.100.2 200

If OSPF is primary with AD 110, a static route with AD 200 remains less preferred until OSPF disappears.

Trap: A static route with default AD 1 normally beats OSPF. Increase the AD when the static route must float behind OSPF.

3.4 Single-area OSPFv2

Neighbor adjacency checklist

When two OSPF routers fail to become neighbors, investigate:

• OSPF enabled on the correct interfaces
• Matching area IDs
• Compatible hello and dead timers
• Compatible network type
• Correct connected IP addressing and subnet relationship
• Unique router IDs
• Authentication compatibility if configured
• MTU issues where relevant to adjacency progress

Router ID selection

General selection order:

1. Explicitly configured router ID
2. Highest loopback IPv4 address
3. Highest active physical-interface IPv4 address

For deterministic operation, configure the router ID explicitly.

Broadcast and point-to-point links

DR/BDR election

On a broadcast network:

1. Higher OSPF interface priority is preferred.
2. Router ID is used as a tie-breaker among eligible routers.
3. Election timing matters; do not assume preemption behavior that was not stated.

3.5 First-hop redundancy

Hosts often use a default gateway. If that gateway is one physical router with no redundancy, its failure breaks off-subnet connectivity.

A first-hop redundancy protocol provides:

• A virtual IP address used by hosts as the default gateway
• An active forwarding router
• A standby or alternate router able to assume responsibility

Trap: Hosts normally point to the virtual gateway, not the physical router’s individual address.

Domain 4 — 4.0 IP Services

4.1 NAT

Static inside-source NAT

Use when one inside local address should consistently map to one public address.

Conceptual form:

ip nat inside source static 10.10.10.10 198.51.100.10

Pool-based NAT

Use when a defined group of inside local addresses should translate using addresses from a public pool.

Reasoning sequence:

1. Identify inside and outside interfaces.
2. Define the inside source addresses, commonly with an ACL.
3. Define the public NAT pool.
4. Apply the inside-source translation rule.
5. Verify translations.

Trap: NAT solves address translation. It does not solve DNS, NTP, switching loops, or DHCP trust.

4.2 NTP

NTP synchronizes device clocks.

Why it matters:

• Comparable log timestamps
• Easier event correlation
• Consistent troubleshooting records

4.3 DHCP and DNS

Common relay command on the client-facing Layer 3 interface:

ip helper-address 192.0.2.50

Trap: DHCP can provide the DNS-server address, but DHCP does not resolve names.

4.4 SNMP and syslog

Syslog severity levels

Memory aid: Every Awesome Cisco Engineer Will Need Icecream Daily.

4.5 QoS per-hop behavior

Major trap: Policing drops or remarks excess traffic. Shaping buffers and delays it.

4.6 Secure remote access with SSH

Typical preparation steps:

hostname R1
ip domain-name example.local
username admin secret StrongSecret
crypto key generate rsa
line vty 0 4
 login local
 transport input ssh

Trap: Telnet is remote CLI but does not encrypt the session.

4.7 TFTP vs FTP

Domain 5 — 5.0 Security Fundamentals

5.1 Security concepts

Trap: A vulnerability is the weakness. An exploit is the method used against the weakness.

5.2 Security program elements

Security is not only configuration:

• User-awareness training
• Phishing recognition and reporting
• Physical access control for equipment rooms
• Operational procedures
• Credential-handling policy

5.3 Local device access control

Common IOS ideas:

enable secret StrongEnableSecret
username admin secret StrongUserSecret
line console 0
 login local
line vty 0 4
 login local
 transport input ssh

enable secret is preferred over relying on weakly protected password storage.

Trap: service password-encryption provides limited obfuscation. Do not treat it as a strong modern cryptographic control.

5.4 Password alternatives and stronger authentication

5.5 VPN types

Trap: A branch-to-branch requirement is not a remote-user-only use case.

5.6 ACLs

ACL logic is sequential:

1. Process entries from top to bottom.
2. Stop at the first match.
3. Apply the implicit deny when no entry matches.

Standard ACL

Standard ACLs filter mainly on source IPv4 address.

access-list 10 deny host 10.10.10.25
access-list 10 permit any

Wildcard masks

Example:

access-list 10 permit 10.20.30.0 0.0.0.255

Extended ACL context

Extended ACLs can filter using more detail, such as protocol, source, destination, and ports. A useful placement rule of thumb:

• Standard ACL: place closer to the destination when practical
• Extended ACL: place closer to the source when practical

Major trap: A subnet mask and a wildcard mask are inverses. Do not use 255.255.255.0 where IOS expects 0.0.0.255.

5.7 Layer 2 security

Decision sequence: Rogue DHCP server? Think DHCP snooping. ARP spoofing? Think DAI. Too many unexpected MAC addresses on an access port? Think port security.

5.8 AAA

5.9 Wireless security

For a WPA2 PSK WLAN:

1. Create or select the WLAN.
2. Map it to the correct VLAN.
3. Select WPA2 PSK security.
4. Enter the correct preshared key.
5. Verify clients use the same PSK.
6. Check QoS and advanced settings when symptoms persist.

Domain 6 — 6.0 Automation and Programmability

6.1 Why automation matters

Automation can improve:

• Consistency
• Repeatability
• Scale
• Speed
• Version-controlled change processes
• Reduction of manual configuration drift

Automation does not eliminate the need for validation, change control, testing, or human judgment.

6.2 Traditional and controller-based networking

Planes

6.3 Underlay, overlay, and fabric

API direction

Trap: Northbound does not mean “toward the internet.” It means toward applications consuming controller services.

6.4 AI and machine learning in network operations

Decision rule: AI-generated output can assist operations, but validate recommendations before implementation.

6.5 REST APIs

CRUD and HTTP verbs

REST characteristics

Know how to recognize:

• Resources
• URIs
• HTTP methods
• Request and response data
• Status codes at a high level
• Authentication approaches, such as credentials, tokens, or API keys depending on implementation
• JSON encoding

Trap: GET retrieves. POST commonly creates. DELETE removes. Do not choose a verb because it merely “sounds active.”

6.6 Ansible and Terraform

Both support repeatable, reviewable workflows. Neither removes the need for testing.

6.7 JSON

Example:

{
  "hostname": "R1",
  "enabled": true,
  "interfaces": ["GigabitEthernet0/1", "GigabitEthernet0/2"],
  "metric": 20
}

Recognize:

Trap: JSON braces define objects. Brackets define arrays.

5. Service Selection Guide

Core service map

Management-access selection

Security-feature selection

6. Architecture Patterns

Pattern 1: Small campus with collapsed layers

Scenario: A modest campus needs access switching and policy aggregation but does not justify a separate high-speed core.

Recommended solution: Two-tier campus design.

Why alternatives fail:

• Three-tier adds a separate core when the scenario does not require that scale.
• Spine-leaf is a different topology pattern, common for east-west-heavy environments such as data centers.
• SOHO is too small and simple for a campus design.

Pattern 2: Large campus with separate core

Scenario: Multiple distribution blocks require a dedicated high-speed backbone.

Recommended solution: Three-tier campus design.

Why alternatives fail:

• Two-tier collapses core and distribution and may not fit the stated scale.
• Spine-leaf has a different connectivity pattern.

Pattern 3: Predictable east-west connectivity

Scenario: Each leaf switch connects to each spine switch.

Recommended solution: Spine-leaf.

Why alternatives fail: Merely having redundant uplinks does not make a topology spine-leaf.

Pattern 4: Multi-VLAN interswitch connection

Scenario: VLANs 10, 20, and 30 must cross one link between switches.

Recommended solution: 802.1Q trunk.

Why alternatives fail:

• An access port carries an endpoint VLAN, not multiple interswitch VLANs.
• A routed port changes the design and does not extend Layer 2 VLANs.
• PortFast is not a VLAN-transport mechanism.

Pattern 5: Resilient Layer 2 uplink

Scenario: Two compatible parallel links should behave as one logical connection.

Recommended solution: EtherChannel using LACP.

Why alternatives fail:

• Passive plus passive will not negotiate.
• HSRP is first-hop gateway redundancy, not link bundling.
• STP alone does not combine bandwidth into one logical channel.

Pattern 6: Redundant default gateway

Scenario: Hosts should retain off-subnet connectivity if one router fails.

Recommended solution: First-hop redundancy with a virtual gateway IP.

Why alternatives fail:

• DNS does not provide gateway redundancy.
• Every endpoint should not need manual reconfiguration during a gateway failure.
• LACP bundles links; it does not provide a virtual default gateway.

Pattern 7: Centralized wireless design

Scenario: Lightweight APs require centralized management.

Recommended solution: Controller-based WLAN architecture using a WLC.

Why alternatives fail:

• Autonomous AP design is more locally managed.
• A Layer 3 route does not replace WLAN control.
• A trunk or access port is part of wired integration, not the controller itself.

Pattern 8: Controller-based programmable network

Scenario: Applications request services from a controller, and the controller programs infrastructure.

Recommended mapping:

• Application to controller: northbound API
• Controller to devices: southbound API
• Physical devices and links: underlay
• Virtualized network relationships: overlay

7. Exam Traps

Misleading wording patterns

Wrong-but-plausible answers

1. Correct technology, wrong layer
   Example: selecting DNS for a duplex mismatch.

2. Correct service, wrong symptom
   Example: selecting DHCP because DNS settings are delivered through DHCP, even though the actual failure is hostname resolution.

3. Correct security feature, wrong attack
   Example: selecting port security for ARP spoofing instead of DAI.

4. Correct routing concept, wrong order
   Example: comparing administrative distance before longest prefix match.

5. Correct STP term, wrong trigger
   Example: selecting root guard when an edge port receives a BPDU; BPDU guard is the direct match.

6. Correct management protocol, insecure variant
   Example: Telnet instead of SSH, or HTTP instead of HTTPS.

7. Correct file-transfer category, wrong capability
   Example: TFTP when authenticated richer transfer behavior is required.

8. Correct API family, wrong verb
   Example: POST for retrieval instead of GET.

Elimination strategy

For a four-option question:

1. Remove answers that operate at the wrong layer.
2. Remove answers that contradict a required security or reliability property.
3. Remove answers with the wrong scope: endpoint-only, link-only, VLAN-only, or network-wide.
4. Compare the two remaining choices against the exact symptom.
5. Prefer the answer that solves the stated issue with the fewest assumptions.

Command-reading strategy

When reading IOS syntax:

• Identify whether the command belongs to interface mode, line mode, or global configuration.
• Check whether the address mask is a subnet mask or a wildcard mask.
• Confirm whether the question asks for a network route, host route, or default route.
• Verify whether the static route must be primary or floating.
• Check whether a switchport should be access or trunk.
• Confirm whether a protocol is secure or legacy.

8. Quick Memory Rules

Rules of thumb

• Switches learn source MAC addresses.
• Unknown unicast Ethernet frames are flooded within the VLAN, except out the ingress port.
• Router forwarding begins with longest prefix match.
• After prefix length, use administrative distance across route sources.
• Compare the routing protocol’s metric within the relevant protocol decision.
• /32 means one IPv4 host route.
• 0.0.0.0/0 is the IPv4 default route.
• ::/0 is the IPv6 default route.
• OSPF broadcast network: think DR/BDR.
• OSPF point-to-point network: no DR/BDR election.
• LACP passive plus passive: no channel.
• Native VLAN traffic is untagged by default on an 802.1Q trunk.
• PortFast is for endpoint-facing edge ports.
• Shaping buffers; policing drops or remarks.
• DNS resolves names; DHCP distributes addressing parameters.
• DAI protects ARP; DHCP snooping protects DHCP trust; port security limits MAC learning.
• Authentication = identity, authorization = permissions, accounting = records.
• Northbound = application to controller; southbound = controller to devices.
• REST read = GET; create = POST; delete = DELETE.
• JSON braces {} are objects; brackets [] are arrays.

“If you see X, think Y”

Subnet arithmetic memory

• Block size = 256 - mask value in the changing octet.
• Find the boundary immediately below the host.
• Network = lower boundary.
• Broadcast = next boundary minus 1.
• First usable = network plus 1.
• Last usable = broadcast minus 1.

9. Final Revision Notes

Highest-yield review points

Routing

• Read route codes, prefixes, next hops, AD, metrics, and default routes.
• Use route-selection order correctly.
• Recognize default, network, host, IPv6, and floating static routes.
• Troubleshoot OSPF area, timer, network-type, router-ID, and interface participation issues.
• Know why broadcast links elect DR/BDR and point-to-point links do not.
• Explain the purpose of a virtual gateway in first-hop redundancy.

Switching and network access

• Configure access ports, data VLANs, voice VLANs, trunks, allowed VLANs, and native VLANs.
• Distinguish CDP and LLDP.
• Know LACP active/passive behavior.
• Explain STP root, root port, designated port, alternate port, PortFast, and guard features.
• Connect APs and WLCs using access, trunk, or LAG reasoning that matches the WLAN design.

Addressing

• Calculate /24 through /30 subnet boundaries quickly.
• Recognize private IPv4 ranges.
• Recognize IPv6 global, unique-local, link-local, multicast, anycast, loopback, and unspecified concepts.
• Know client commands for Windows, Linux, and macOS.

Services

• DNS vs DHCP vs DHCP relay
• NAT static vs pool-based translation
• NTP vs SNMP vs syslog
• Classification vs marking vs queuing vs shaping vs policing
• SSH vs Telnet
• FTP vs TFTP

Security

• Threat vs vulnerability vs exploit vs mitigation
• MFA, certificates, biometrics, and password policy
• Site-to-site vs remote-access VPNs
• ACL top-down processing, wildcard masks, and implicit deny
• DHCP snooping, DAI, and port security
• Authentication, authorization, and accounting
• WPA, WPA2, WPA3, and WPA2 PSK GUI settings

Automation

• Traditional vs controller-based networking
• Data plane, control plane, and management plane
• Underlay, overlay, and fabric
• Northbound vs southbound APIs
• Generative AI vs predictive AI vs ML
• CRUD and HTTP verbs
• JSON objects, arrays, keys, strings, numbers, Booleans, and null
• Ansible vs Terraform

Last-day revision list

1. Write the subnet table from memory.
2. Solve five longest-prefix-match questions.
3. Write one default, one host, one IPv6, and one floating static route.
4. Review the OSPF adjacency checklist.
5. Recite the four STP protection features and their triggers.
6. Compare DHCP snooping, DAI, and port security.
7. Compare DNS, DHCP, NTP, SNMP, and syslog.
8. Compare shaping and policing.
9. Recite CRUD-to-HTTP mappings.
10. Read one JSON object and identify every data type.
11. Explain Ansible and Terraform in one sentence each.
12. Revisit the elimination strategy.

10. Exam-Day Checklist

Must-know topics

Network Fundamentals

• I can identify routers, L2 switches, L3 switches, firewalls, IPS, APs, controllers, endpoints, servers, and PoE use cases.
• I can distinguish two-tier, three-tier, spine-leaf, WAN, SOHO, on-premises, and cloud patterns.
• I can select single-mode fiber, multimode fiber, or copper for a scenario.
• I can recognize CRC errors, collisions, duplex mismatches, and speed mismatches.
• I can compare TCP and UDP.
• I can subnet IPv4 quickly and recognize private IPv4 ranges.
• I can classify common IPv6 address types.
• I can verify client IP settings on Windows, Linux, and macOS.
• I understand SSID, RF, nonoverlapping channels, and encryption.
• I understand virtualization, containers, VRFs, and basic switching behavior.

Network Access

• I can configure VLAN access and voice ports.
• I can explain inter-VLAN connectivity.
• I can configure and verify 802.1Q trunks and native VLANs.
• I can compare CDP and LLDP.
• I can reason about LACP active and passive modes.
• I can identify root bridge, root port, designated port, alternate port, and PortFast.
• I can select BPDU guard, root guard, loop guard, or BPDU filter from a scenario.
• I understand controller-based wireless architecture, AP modes, AP/WLC physical connections, and WLAN GUI settings.
• I can choose console, Telnet, SSH, HTTP, HTTPS, TACACS+, RADIUS, or cloud-managed access appropriately.

IP Connectivity

• I can interpret routing-table components.
• I apply longest prefix match before AD and metric.
• I can configure default, network, host, IPv6, and floating static routes.
• I can troubleshoot single-area OSPFv2 adjacencies.
• I know OSPF router-ID selection.
• I know where DR/BDR election occurs.
• I understand first-hop redundancy and virtual gateways.

IP Services

• I understand static and pool-based inside-source NAT.
• I can choose NTP client and server roles.
• I can distinguish DHCP, DNS, and DHCP relay.
• I can distinguish SNMP and syslog.
• I know syslog severity levels.
• I can compare classification, marking, queuing, congestion, policing, and shaping.
• I can configure SSH access conceptually.
• I can distinguish FTP and TFTP.

Security Fundamentals

• I can distinguish threats, vulnerabilities, exploits, and mitigations.
• I understand security awareness and physical access controls.
• I can configure local passwords and secure remote login conceptually.
• I understand password policy, MFA, certificates, and biometrics.
• I can choose site-to-site or remote-access IPsec VPNs.
• I can process ACLs top-down and calculate wildcard masks.
• I can choose DHCP snooping, DAI, or port security.
• I can distinguish authentication, authorization, and accounting.
• I can compare WPA, WPA2, and WPA3 and recognize WPA2 PSK GUI tasks.

Automation and Programmability

• I understand why automation improves consistency and scale.
• I can compare traditional and controller-based networks.
• I can distinguish underlay, overlay, and fabric.
• I can distinguish control plane, data plane, and management plane.
• I can distinguish northbound and southbound APIs.
• I can distinguish generative AI, predictive AI, and ML.
• I know REST authentication at a high level and can map CRUD to HTTP verbs.
• I can distinguish Ansible and Terraform.
• I can read basic JSON.

Final confidence checklist

• I answer the exact symptom, not a nearby concept.
• I eliminate options from the wrong layer first.
• I do not compare administrative distance before prefix length.
• I check whether IOS expects a subnet mask or wildcard mask.
• I distinguish secure and insecure management protocols.
• I select the narrowest feature that directly solves the scenario.
• I can explain why the strongest wrong answer fails.
• I have completed timed practice and reviewed my error patterns.

Appendix A — Compact IOS Command Patterns

VLAN access and voice port

interface GigabitEthernet1/0/10
 switchport mode access
 switchport access vlan 20
 switchport voice vlan 120

Trunk

interface GigabitEthernet0/24
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30
 switchport trunk native vlan 99

Default route

ip route 0.0.0.0 0.0.0.0 203.0.113.1

Host route

ip route 203.0.113.25 255.255.255.255 192.0.2.2

Floating static route

ip route 10.50.0.0 255.255.0.0 198.51.100.2 200

IPv6 route

ipv6 route 2001:DB8:50::/64 2001:DB8:FF::2

DHCP relay

interface GigabitEthernet0/1
 ip helper-address 192.0.2.50

SSH preparation

hostname R1
ip domain-name example.local
username admin secret StrongSecret
crypto key generate rsa
line vty 0 4
 login local
 transport input ssh

Standard ACL

access-list 10 deny host 10.10.10.25
access-list 10 permit 10.20.30.0 0.0.0.255
access-list 10 permit any

Appendix B — One-Page Mental Model

When a scenario appears, ask:

1. Is it physical?
   Cable, fiber type, CRC, collisions, speed, duplex.

2. Is it Layer 2?
   MAC learning, VLAN, trunk, native VLAN, LACP, STP, BPDU guard, root guard, loop guard, port security, DHCP snooping, DAI.

3. Is it Layer 3?
   IPv4, IPv6, subnet, route table, longest prefix, AD, metric, static route, OSPF, virtual gateway.

4. Is it a network service?
   NAT, DHCP, DNS, NTP, SNMP, syslog, QoS, SSH, FTP, TFTP.

5. Is it security?
   ACL, AAA, VPN, WLAN security, credential policy, physical access.

6. Is it automation?
   Controller, plane separation, underlay, overlay, API direction, REST verb, JSON structure, AI/ML, Ansible, Terraform.

Then choose the smallest answer that directly satisfies the requirement.

Appendix C — Source-Bank Synthesis Notes

The supplied practice bank contained:

• 1,100 questions
• 275 IP Connectivity questions
• 220 Network Fundamentals questions
• 220 Network Access questions
• 165 Security Fundamentals questions
• 110 IP Services questions
• 110 Automation and Programmability questions

This matches the official blueprint weighting. Repeated question patterns were consolidated into the decision rules, comparison tables, architecture patterns, and trap lists in this course rather than repeated question-by-question.