Cheat sheet
CCST Networking Cheat Sheet
Standards and Concepts
- 16-17% of exam
- Models Network Types Protocols Bandwidth vs Throughput
Addressing and Subnets
- 16-17% of exam
- IPv4 IPv6 Private IPv4 Subnet Picker
Endpoints and Media
- 16-17% of exam
- Media Connectors Endpoint Checks Wi-Fi vs Cellular
Infrastructure
- 16-17% of exam
- Device Roles Switching Routing Infrastructure Picker
Diagnosing Problems
- 16-17% of exam
- Troubleshooting Commands Wireshark Diagnostic Picker
Security
- 16-17% of exam
- Firewalls Wireless Security Security Basics Security Picker
Quick Facts
- Exam 100-150
- Credential CCST Networking
- Time 50 min
- Price US$125
- Level Entry-level
- Prereqs None
- Result Pass/fail
- Weights Not public
OSI Order ST
- Please Do Not Throw Sausage Pizza Away
- Physical Data Link Network Transport Session Presentation Application
Bandwidth vs Throughput ST
Bandwidth
- Maximum capacity
- Theoretical ceiling
- Link capability
Throughput
- Actual rate
- Measured performance
- Real conditions
- Capacity vs actual
Models ST
- OSI L1 Bits and media
- OSI L2 Frames and MACs
- OSI L3 Packets and IP
- OSI L4 TCP/UDP ports
- Frame Layer 2 unit
- Packet Layer 3 unit
- Segment TCP data unit
- Encapsulation Headers added
TCP vs UDP ST
TCP
- Connection-oriented
- Reliable
- Sequenced
UDP
- Connectionless
- Low overhead
- Best effort
- Reliability vs speed
Network Types ST
- PAN Personal range
- LAN Local site
- WLAN Wireless LAN
- CAN Campus network
- MAN Metro area
- WAN Wide area
- Cloud Provider-hosted services
- On-prem Locally hosted services
Protocols ST
- FTP 20/21 Plain file transfer
- SFTP 22 SSH file transfer
- TFTP 69 Simple UDP transfer
- HTTP 80 Plain web
- HTTPS 443 Encrypted web
- DHCP 67/68 Address leasing
- DNS 53 Name resolution
- ICMP Reachability messages
- NTP 123 Time sync
- TCP Reliable transport
- UDP Low-overhead transport
Private Ranges AD
- Ten, seventeen, one-ninety-two stay private
- 10/8 172.16/12 192.168/16 NAT outward
Public vs Private AD
Public
- Internet routable
- Globally unique
- ISP assigned
Private
- Internal use
- Needs NAT
- RFC1918 ranges
- Global vs local
Subnet Picker AD
- Need local delivery → Same subnet
- Need remote delivery → Default gateway
- Need public reach → NAT
- DHCP fails → Check APIPA
- Name fails → Check DNS
- IPv6 local only → FE80 address
IPv4 AD
- IPv4 32-bit address
- /24 255.255.255.0
- /25 128 addresses
- /26 64 addresses
- /27 32 addresses
- /30 Two usable hosts
- Gateway Off-subnet exit
- Broadcast Subnet-wide delivery
MAC vs IP AD
MAC
- Layer 2
- Hardware address
- Local delivery
IP
- Layer 3
- Logical address
- Routed delivery
- Local vs routed
Private IPv4 AD
- 10.0.0.0/8 Private range
- 172.16.0.0/12 Private range
- 192.168.0.0/16 Private range
- 169.254.0.0/16 APIPA range
- 127.0.0.1 Loopback
- Public IP Internet-routable
- Private IP Needs NAT
- NAT Address translation
IPv6 AD
- IPv6 128-bit address
- ::1 Loopback
- FE80::/10 Link-local
- FF00::/8 Multicast
- 2000::/3 Global unicast
- /64 Common LAN prefix
- :: Zero compression
- SLAAC Auto addressing
Wi-Fi vs Cellular EN
Wi-Fi
- Local AP
- SSID based
- Private admin
Cellular
- Carrier network
- SIM/eSIM
- Wide coverage
- AP vs carrier
Media EN
- Copper Electrical signaling
- Fiber Light signaling
- Coax Broadband cable
- UTP Twisted pair
- Cat 5e Gigabit copper
- Cat 6 Higher-speed copper
- SMF Long-distance fiber
- MMF Shorter fiber
Connectors EN
- RJ45 Ethernet copper
- RJ11 Phone cable
- LC Fiber connector
- SC Fiber connector
- SFP Modular transceiver
- USB-C Endpoint adapter
- Console Device management
- PoE Power over Ethernet
Endpoint Checks EN
- Windows ipconfig
- Linux ip addr
- macOS Network settings
- Android Wi-Fi details
- iOS Wi-Fi info
- NIC Network adapter
- SSID Wi-Fi name
- Airplane mode Radios disabled
Switch vs Router IN
Switch
- Layer 2
- MAC table
- Same LAN
Router
- Layer 3
- Routing table
- Between networks
- Frames vs packets
Infrastructure Picker IN
- Same LAN devices → Switch
- Different networks → Router
- Wireless clients → Access point
- Traffic filtering → Firewall
- Many VLANs → Trunk
- One endpoint VLAN → Access port
Device Roles IN
- Switch Connects LAN devices
- Router Connects networks
- AP Wireless access
- Firewall Filters traffic
- Modem Provider handoff
- Server Provides services
- Client Consumes services
- Printer Network endpoint
Switching IN
- MAC table Switch lookup
- Flooding Unknown destination
- VLAN Broadcast segment
- Access port One VLAN
- Trunk Many VLANs
- STP Loop prevention
- Link light Physical status
- Duplex Send/receive mode
Routing IN
- Route Network path
- Default route Unknown destinations
- Static route Manual path
- Dynamic route Learned path
- Metric Path cost
- Hop Next router
- ARP IP-to-MAC mapping
- TTL Loop limiter
Ticket Flow DI
- Scope, test, fix, verify, document, escalate
- Scope Test Fix Verify Document Escalate
DNS vs DHCP DI
DNS
- Names to addresses
- Resolver setting
- Website names
DHCP
- Leases addresses
- Scope setting
- Client IP config
- Names vs leases
Diagnostic Picker DI
- No link light → Check cable
- No IP address → Check DHCP
- IP works only → Check DNS
- Path stops → traceroute
- Need packet proof → Wireshark
- Cisco status needed → show commands
Commands DI
- ping Tests reachability
- traceroute Shows path hops
- tracert Windows path hops
- nslookup Queries DNS
- ipconfig Windows IP settings
- ifconfig Legacy interface info
- arp -a Shows ARP cache
- netstat Shows connections
Troubleshooting DI
- Identify Gather symptoms
- Scope Who is affected
- Theory Likely cause
- Test Prove theory
- Fix Apply change
- Verify Confirm service
- Document Record outcome
- Escalate Transfer cleanly
Security AAA SE
- Authenticate, authorize, account for access
- Identity Permission Logging
AuthN vs AuthZ SE
AuthN
- Who are you
- Login proof
- Identity
AuthZ
- What allowed
- Permission check
- Access
- Identity vs permission
Security Picker SE
- Need identity proof → Authentication
- Need allowed actions → Authorization
- Need traffic control → Firewall
- Home Wi-Fi setup → WPA2/WPA3
- Guest devices → Guest network
- Unknown threat → Escalate
Security Basics SE
- CIA Security triad
- Authentication Proves identity
- Authorization Grants access
- Accounting Tracks actions
- MFA Multiple factors
- Encryption Protects data
- Patch Fixes flaws
- Least privilege Minimum access
Wireless Security SE
- WPA2 Common Wi-Fi security
- WPA3 Modern Wi-Fi security
- PSK Shared passphrase
- SSID Network name
- Guest Wi-Fi Isolated access
- WPS Disable if risky
- Evil twin Rogue AP
- Firewall rule Permit or deny
Common Traps
Official Weights
- Cisco lists topics ≠ Weights not public
Ping Passing
- ICMP works ≠ App may fail
DNS Failure
- IP may work ≠ Names may fail
APIPA Meaning
- DHCP likely failed ≠ Cable not proven
Switch Role
- MAC forwarding ≠ Not IP routing
Router Role
- IP routing ≠ Not MAC switching
SSID Hiding
- Name still discoverable ≠ Not real security
Fix Process
- Verify before closing ≠ Document after fix
Last Minute
- 1. Cisco publishes no weights
- 2. Exam: 100-150, 50 minutes
- 3. Switches forward by MAC
- 4. Routers forward by IP
- 5. DNS resolves names
- 6. DHCP leases IP settings
- 7. APIPA suggests DHCP failure
- 8. Gateway exits local subnet
- 9. WPA2/WPA3 for Wi-Fi
- 10. Document before closing ticket
- 11. Wireshark proves packet facts
- 12. Escalate with clean evidence
Cisco CCST Networking
- Practice Questions 100 questions Study Guide 72 topics Cheat Sheet 131 facts Flashcards 50 cards Shorts 3 short s Videos 2 videos Blogs 2 blogs Free CE Podcast