CCNA Devnet Network Fundamentals Questions

The southbound API connects the SDN controller downward to forwarding devices, programming flow tables and installing forwarding rules. This satisfies the requirement to communicate with network devices, whereas northbound APIs face applications and management planes.

The record maps the domain to mail.example.com with preference 10, the standard MX syntax of priority followed by mail exchanger. This satisfies the requirement to name the mail server handling email for the corporate domain, since MX records exist solely to direct SMTP delivery.

UDP has a fixed 8-byte header, which is much smaller than TCP's minimum 20-byte header. This reduces overhead and processing time, making it ideal for real-time applications where speed is critical and small delays are unacceptable. The minimal header contributes to lower latency and higher throughput.

TCP satisfies the ordered, error-checked delivery requirement through sequence numbers, acknowledgements and retransmission of lost segments. The three-way handshake (SYN, SYN-ACK, ACK) establishes that reliable connection before data flows, directly meeting the stem's demand for dependable, in-order transport rather than best-effort delivery.

The client begins the three-way handshake by transmitting a single TCP segment with the SYN flag set, carrying its initial sequence number. This synchronises sequence numbers and requests a connection before the server replies with SYN-ACK. Only after the client's final ACK does the connection become established, satisfying the initiation requirement.

ARP broadcasts a request containing the target IPv4 address, and the owning device replies with its MAC address. This resolves layer-3 to layer-2 addressing within the same broadcast domain, which is exactly what the application needs.

Layer 3 provides logical addressing through IP addresses and determines packet forwarding between networks via routing protocols and routing tables. This satisfies the question's requirement, distinguishing it from Layer 2, which handles physical MAC addressing and local frame delivery.

DNS queries use UDP on port 53 for standard resolution, avoiding TCP's handshake overhead for small request-response exchanges. This connectionless transport matches the protocol's need for fast, lightweight lookups, though it falls back to TCP for large responses.

The SYN, SYN-ACK, ACK exchange establishes a TCP connection by synchronising sequence numbers in both directions. The client sends SYN, the server replies SYN-ACK acknowledging it while sending its own SYN, then the client returns ACK. This satisfies the stem's requirement for the exact flag sequence of the three-way handshake.

TCP establishes a session via a three-way handshake before data transfer, then uses sequence numbers, acknowledgments and retransmission of lost segments to guarantee ordered, reliable delivery. This connection-oriented design directly satisfies the stem's requirement for acknowledged, retransmitted transport, unlike connectionless UDP.

OpenFlow is a southbound protocol where the controller pushes match-action flow entries directly into switch flow tables, governing forwarding behaviour. This programmatic control of forwarding matches the automation scenario, distinguishing it from NETCONF's configuration-focused role.

The client hangs on port 80 and times out, which is the classic signature of silently dropped TCP SYN segments on an ACL or firewall policy. Because the same hostname and application reach the service over 443, routing and name resolution are already proven correct, so the only variable left is the destination port being filtered between client and server.

A 401 Unauthorized response indicates that the request lacks valid authentication credentials for the target resource. The developer must supply a proper token, such as a Bearer token, in the Authorization header. Adding the header allows the server to authenticate the client and return a successful response, assuming the token has the required permissions.

NETCONF is a southbound protocol: the SDN controller uses it to configure and retrieve state from managed network devices. It runs over SSH and exchanges XML-encoded configuration data, sitting below the controller in the architecture, which satisfies the stem's southbound requirement.

Forwarding frames by MAC address is the defining function of a Layer 2 switch, satisfying the stem's requirement for the primary role. It builds a MAC address table from source addresses and forwards each frame only out the port leading to the destination, rather than flooding every port as a hub does.

TXT records hold arbitrary text strings, which is exactly how SPF policies are published: a domain owner adds a TXT record containing the authorised sending hosts. This satisfies the stem's requirement for verifying domain ownership for email security while being stored as text.

The UDP header is 8 bytes, while the TCP header is at least 20 bytes. This smaller header reduces per-packet overhead, which can improve efficiency for high-throughput applications. In scenarios where many small packets are sent, the reduced overhead can lead to better bandwidth utilization and lower latency.

A /25 prefix leaves 7 host bits (32 − 25), giving 2⁷ = 128 total addresses. Subtracting the network and broadcast addresses yields 126 usable host addresses, satisfying the subnet's requirement. This matches the standard formula 2^h − 2, where h is the number of host bits available.

HPACK compresses request and response header fields using static and dynamic tables plus Huffman coding, cutting the repeated header overhead that plagued HTTP/1.1. This satisfies HTTP/2's requirement for reduced latency over many concurrent streams, since headers previously dominated each request's bytes.

HTTPS secures HTTP by layering Transport Layer Security beneath it, so all request and response data is encrypted in transit. This satisfies the stem's requirement to describe the protocol accurately: TLS provides confidentiality and integrity, preventing eavesdropping or tampering between client and server.

HTTP/2 introduces binary framing with streams, letting many concurrent requests and responses share one TCP connection. HTTP/1.1 requires separate connections or serialised pipelining, so head-of-line blocking delays later requests. Multiplexing removes that per-connection queueing, which is the primary performance gain.

The candidate datastore capability allows a device to support a candidate configuration that can be edited and then committed to the running datastore. This matches the workflow described, where changes are made to a candidate and only applied after a commit. Without this capability, the device would not support the candidate datastore, and the <edit-config> targeting candidate would fail.

HTTP/2 compresses request and response header fields with HPACK, which uses static and dynamic tables plus Huffman coding. HTTP/1.1 sends headers as uncompressed plaintext on every request, so repetitive headers waste bandwidth that HPACK eliminates.

A TCP segment with the SYN flag set and the ACK flag not set is the first step of the three-way handshake, used to initiate a connection. The destination port 443 indicates the host is attempting to connect to an HTTPS service. This is the standard behavior for a client opening a TCP connection to a web server.

The southbound API connects the SDN controller to underlying switches, letting it push flow rules and forwarding instructions directly to the data plane. This satisfies the stem's requirement for controller-to-device communication, whereas northbound interfaces serve applications and management layers instead.

UDP's eight-byte header, versus TCP's minimum twenty bytes, cuts per-packet overhead, satisfying the stem's comparison of protocol characteristics. Omitting handshakes, acknowledgements and congestion control further reduces processing and bandwidth cost, which suits latency-sensitive traffic that tolerates loss.

The Authorization header is the standard HTTP header used to carry credentials for authenticating a client with a server. When using an API key, it is common to include it in the Authorization header, often with a scheme like Bearer or Basic. This header is designed specifically for authentication and is the correct choice for passing an API key.

A /27 mask leaves five host bits, yielding 32 addresses minus network and broadcast, so exactly 30 usable hosts. It is the smallest subnet satisfying the stated requirement without waste, whereas /28 would provide only 14 usable addresses.

A /26 mask yields 64 addresses, giving 62 usable hosts, which satisfies the 50-host requirement with minimal waste. Smaller masks like /25 waste over 70 addresses; larger masks like /27 provide only 30 usable hosts, falling short.

VLANs (Virtual LANs) logically segment a switch into multiple broadcast domains. Each VLAN is a separate broadcast domain. To allow communication between VLANs, a Layer 3 device (like a router or a Layer 3 switch) is required. The scenario asks for segmentation into broadcast domains, which VLANs provide.

The sequence of SYN, SYN-ACK, and ACK is the standard TCP three-way handshake used to establish a connection. The first host sends a SYN to initiate, the second host responds with SYN-ACK to acknowledge and synchronize, and the first host completes with an ACK. This ensures both sides are ready to communicate and agree on initial sequence numbers. The capture clearly shows this exact exchange.

Enabling IP routing on a Layer 3 switch allows it to route packets between VLANs. Each VLAN interface (SVI) acts as a default gateway for hosts in that VLAN, and the switch uses its routing table to forward traffic between subnets. This is the standard method for inter-VLAN routing on modern switches.

Switches forward frames using MAC addresses contained in Ethernet headers, which reside at Layer 2, the Data Link layer. This satisfies the scenario's forwarding basis, distinguishing switches from Layer 3 routers that forward on IP addresses.

The second handshake step has the server responding to the client's initial SYN with its own sequence number while acknowledging the client's, so both SYN and ACK flags are set. This synchronises sequence numbers in both directions.

A CNAME record maps one DNS name to another canonical name, so querying example.com returns www.example.com's records. This satisfies the stem's requirement for an alias rather than a duplicate A record, letting both hostnames resolve to the same web server without maintaining separate IP entries.

SSL/TLS operates between HTTP and TCP, encrypting the request and response payloads and authenticating the server via its certificate. Plain HTTP provides neither confidentiality nor identity verification, so layering TLS satisfies the encryption and authentication requirement.

TCP is reliable and connection-oriented, suitable for reliable data transfer.

A VLAN interface (SVI) remains in a down state until the VLAN is active, which requires at least one physical port to be up and assigned to that VLAN, or the VLAN to be manually activated. Without an active port in VLAN 10, the SVI cannot come up. The engineer must assign an access port to VLAN 10 and ensure it is connected and up.

10.0.0.0/8 falls within the RFC 1918 private address space, alongside 172.16.0.0/12 and 192.168.0.0/16. These ranges are non-routable on the public internet, satisfying the stem's requirement for a private IPv4 range. The /8 prefix covers 10.0.0.0 through 10.255.255.255.

MAC addressing and frame delivery occur at the Data Link layer, which encapsulates packets into frames and uses hardware addresses to forward them between nodes on the same segment. Layer 2 therefore satisfies the stem's requirement for intra-segment delivery, unlike Layer 3's logical IP routing.

192.168.1.128 falls within the 192.168.1.0/24 subnet range, satisfying the network constraint. Unlike the network address (192.168.1.0) or broadcast address (192.168.1.255), it is assignable to a host device. The /24 mask leaves 254 usable host addresses, and .128 sits comfortably inside that pool.

When the TCP handshake completes but the TLS handshake never begins, an inline device such as a firewall, proxy, or intrusion prevention system may be accepting the TCP connection on behalf of the server and then dropping or resetting it before TLS negotiation. This behavior is typical of a device performing TCP proxy or deep packet inspection without proper TLS passthrough.

A /26 mask leaves six host bits, giving 62 usable addresses, which satisfies the minimum of 50 hosts per subnet. A /27 would provide only 30 usable addresses, so 255.255.255.192 is the smallest mask that meets the requirement.

Port 80 is the default port for HTTP (Hypertext Transfer Protocol) used for unencrypted web traffic. Web servers listen on port 80 for standard HTTP requests. Opening this port on the firewall allows clients to access web content over HTTP, matching the requirement.

The southbound API connects the SDN controller downward to the physical and virtual network devices, carrying forwarding instructions such as OpenFlow flow-table entries. This directly satisfies the stem's separation of control and data planes, since the controller programmes devices through this interface.

Layer 5 (Session) governs dialogue control between applications, establishing, maintaining and terminating sessions — exactly the session management the stem requires. It sits above Transport (Layer 4), which handles end-to-end delivery, and below Presentation (Layer 6), which handles formatting, so connection lifecycle management belongs here.

Layer 3 handles logical addressing and routing, with routers forwarding packets hop-by-hop using IP addresses and routing tables. This satisfies the engineer's need to verify the packet path, since traceroute relies on Layer 3 forwarding decisions rather than Layer 2 switching.

UDP is connectionless, requiring no handshake before transmission, and its header carries only source port, destination port, length and checksum — eight bytes versus TCP's larger header. This satisfies both constraints: no connection setup and minimal header overhead.

Multiplexing allows multiple request/response streams to be interleaved concurrently over one TCP connection, each identified by a stream ID. This removes HTTP/1.1's head-of-line blocking at the connection level and is the specific HTTP/2 feature enabling concurrent streams.

NETCONF carries configuration and state data between the SDN controller and managed network devices, sitting below the controller. This places it in the southbound interface layer, distinct from northbound APIs that expose controller capabilities to applications.

Layer 3 handles logical addressing and path selection between distinct networks, so routers forward packets hop by hop using IP addresses. Layer 2 switches only forward within one broadcast domain, which is why routing across different networks is a Network layer function.

A 401 Unauthorized response means the request lacks valid authentication credentials. The vManage API requires a session token or basic authentication. The developer should obtain a token by authenticating to the /j_security_check endpoint or using basic auth, then include it in the request header, typically as a cookie (JSESSIONID) or an Authorization header. This will allow the request to succeed.

TLS performs an asymmetric handshake (for example, ECDHE with RSA or ECDSA signatures) to authenticate the server and negotiate a shared symmetric session key, which then encrypts bulk traffic. This hybrid approach satisfies HTTPS's need for both secure key exchange and efficient confidentiality.

WPA3 mandates SAE (Simultaneous Authentication of Equals), replacing WPA2's PSK handshake and providing forward secrecy plus 192-bit Enterprise mode. That stronger encryption and resistance to offline dictionary attacks make it the recommended enterprise standard, satisfying the 2023 requirement.

AAAA records map a hostname to an IPv6 address, satisfying the requirement to resolve names to IP addresses. Where A records handle IPv4, AAAA provides the 128-bit equivalent, making it one of the standard hostname-to-address mappings alongside A and CNAME.

HTTP/2 multiplexing lets many request/response streams share one TCP connection, interleaving frames so no stream blocks another. This removes HTTP/1.1's head-of-line queuing per connection, directly satisfying the stem's requirement for concurrent, interleaved exchanges on a single connection.

TCP guarantees reliable, ordered delivery through sequence numbers, acknowledgements and retransmission, and establishes connections via the three-way SYN, SYN-ACK, ACK handshake. This satisfies the stem's explicit requirements for both ordered reliable delivery and handshake-based connection establishment, which connectionless UDP cannot provide.

The Authorization header carries credentials, typically as a Bearer token or Basic scheme, in the HTTP request. It satisfies the stem's requirement for passing credentials in the header, unlike Content-Type or Accept, which describe payload format and response preferences.

An A record maps a hostname to an IPv4 address. Querying for an A record returns the IPv4 address needed to establish the HTTP connection. This is the standard record type for IPv4 resolution and directly answers the scenario's requirement.

TCP establishes a connection, sequences segments, acknowledges receipt and retransmits lost data, guaranteeing ordered, reliable delivery. UDP offers neither ordering nor delivery guarantees. The stem's requirement for reliable, ordered delivery therefore maps directly to TCP's transport-layer mechanisms.

TCP's sequence numbers and acknowledgements guarantee ordered delivery, while windowing provides flow control and unacknowledged segments are retransmitted — exactly the reliability the application demands. The three-way handshake establishes the connection state these mechanisms depend on before any data flows.

The three-way handshake consists of SYN, SYN-ACK, and ACK. The client initiates with SYN, the server responds with SYN-ACK, and the client completes the handshake by sending an ACK. This ACK acknowledges the server's SYN and establishes the connection, allowing data transfer to begin.

The `-L` flag instructs curl to follow HTTP 3xx redirects by reissuing the request to the URL in the Location header. Because the original request used `-I` (HEAD), curl will still issue HEAD requests on the redirect chain, so it will not print a body; to see the final body, the developer should also drop `-I` or use `-o`/`-O` with `-L`. In this scenario, adding `-L` is the correct mechanism to resolve the 301 automatically.

2xx status codes indicate success. The request was successfully received, understood, and accepted. For example, 200 OK means the request succeeded. This range is used when the client's request was valid and the server fulfilled it.

10.0.0.0/8 sits within the RFC 1918 private addressing space, spanning 10.0.0.0 to 10.255.255.255. It satisfies the stem's requirement for a valid private IPv4 range, unlike public or reserved blocks. Organisations use it for internal networks, with NAT handling external traffic.

An AAAA record maps a hostname to a 128-bit IPv6 address, satisfying the stem's requirement for the address family returned by this record type. It mirrors the A record's role for IPv4 but uses four times the bits, which is why the mnemonic quadruples the letter.

HTTP keep-alive, the default in HTTP/1.1, allows a single TCP connection to carry multiple sequential request/response pairs. Reusing the established socket avoids repeating the three-way handshake and TCP slow start for each call, which lowers latency and resource consumption when a client makes several requests to the same server.

The correct endpoint is formed by combining the base URL and the resource path. A GET request to /v1/users retrieves the collection of users. This follows RESTful conventions where GET is used to retrieve data without side effects. The full URL includes the base and the resource, resulting in the correct endpoint.

`socket.getaddrinfo` returns a list of 5-tuples: address family, socket type, protocol, canonical name, and a socket address tuple. With `family=socket.AF_INET` and `type=socket.SOCK_STREAM`, it filters for IPv4 TCP endpoints. Each sockaddr is a (host, port) pair for IPv4. This structure lets a client iterate over candidates and attempt connections without manually parsing DNS responses or constructing sockaddr structures.

SDN separates the control plane from the data plane, letting a controller push configuration programmatically via APIs. This replaces per-device CLI changes, so network configuration changes are automated across the fabric rather than performed manually, satisfying the benefit of reduced manual effort and human error.

Checking the status_code allows the script to handle different HTTP responses explicitly. For example, a 200 indicates success, while 404 means the resource was not found, and 500 indicates a server error. By branching logic, the developer can implement retries for 5xx errors or display user-friendly messages for 4xx errors. This is a fundamental practice for robust API interaction.

HTTP 404 means the server received and understood the request but found no resource matching that URI. The endpoint path is wrong or removed, so the server cannot map it to a handler. This directly satisfies the stem's 404 symptom, unlike authentication or server errors.

Network congestion occurs when the volume of traffic exceeds the capacity of a link or device, causing packets to be buffered and delayed. This results in increased latency without necessarily causing packet loss. Traceroute would show increased round-trip times at the congested hop, while packets still reach the destination.

MAC addresses are burned into network interface hardware and used for frame delivery within a single broadcast domain. The Data Link layer, Layer 2, encapsulates packets into frames and uses these 48-bit addresses for hop-to-hop addressing, unlike Layer 3's logical IP addressing.

In the 2.4 GHz band each channel is 22 MHz wide but spaced only 5 MHz apart, so channels 1, 6 and 11 are the only set separated enough to avoid overlapping spectrum and minimise interference.