liveBookmanning.com

What you will learn in Acing the CCNA Exam: Volume 2 Advanced Networking and Security

by Jeremy McDowell

Read it on liveBook Get the book at manning.com

Chapter by chapter

Concepts explained in this book

• wireless LAN controllerA wireless LAN controller is a network platform that centrally controls and manages wireless access points and their client connections.
• service set identifierA service set identifier is a human-readable label that identifies an 802.11 service set.
• IEEE 802.11Wi-Fi is a trademarked industry designation for wireless LAN equipment and products that conform to interoperability certification requirements for IEEE 802.11.
• quality of serviceQuality of service is the classification, marking, queuing, and scheduling of network traffic to manage performance characteristics such as delay, jitter, bandwidth, and loss.
• domain name systemThe Domain Name System is a distributed naming system that translates domain names into network addresses and related resource records.
• DNS serverA DNS server is a service that answers domain-name queries by returning corresponding network records or consulting other DNS servers.
• lightweight access pointA lightweight access point is a centrally managed wireless access point whose control and management functions are provided by a wireless LAN controller.
• FlexConnectFlexConnect local switching is a mode in which a lightweight access point forwards client traffic between wired and wireless networks without tunneling that traffic to the controller.
• centralized DHCP serverA DHCP server is a service that assigns clients network configuration, including IP addresses and other DHCP options.
• port securityswitchport port-security is a Cisco IOS interface command that enables port security on a switch port.
• global addressAn outside global address is the address of an outside host from the perspective of the outside network.
• inside local addressA local address is a host address as represented before a NAT router translates it or from the perspective of the inside network.
• authenticationAn authentication message is a message exchanged to prove or verify the identity of a communicating entity.
• NTP clientAn NTP client is a device or service that obtains time information from one or more NTP servers to synchronize its clock.
• NTP serverAn NTP server is a device or service that provides time synchronization to network clients or obtains time from another time source.
• dynamic mac addressA dynamic MAC address is a MAC address that a switch learns automatically from received frames and can remove through aging.
• static secure mac addressA static secure MAC address is a port-security MAC address manually configured and stored in both the MAC address table and the running configuration.
• denial-of-service attackA denial-of-service attack is an attack that makes a system or service unavailable to legitimate users by exhausting or disrupting resources.
• virtual machineA virtual machine is a software-emulated computer that runs an operating system and applications in an isolated environment on physical hardware.
• untrusted portAn untrusted port is a switch port whose received ARP messages are inspected by Dynamic ARP Inspection before forwarding or discard.
• electromagnetic interferenceSignal interference is unwanted electromagnetic energy or overlapping channel use that disrupts or degrades a wireless communication signal.
• split-MAC architectureSplit-MAC architecture is a wireless LAN design that divides real-time media access control operations between access points and non-real-time management functions in a controller.
• Syslog protocolSyslog is a standardized protocol and message format for conveying event and diagnostic messages from devices and applications to local or remote logging systems.
• CIA triadThe CIA triad is an information-security framework consisting of confidentiality, integrity, and availability.
• DHCP leaseA DHCP lease is a time-limited assignment of an IP address and related configuration parameters to a DHCP client.
• network management stationA network management system is software that monitors and manages network devices through management protocols such as SNMP.
• link aggregation groupLink aggregation is the combination of multiple physical network links into one logical link to increase bandwidth and provide link redundancy.
• mac flooding attackA MAC flooding attack is a Layer 2 attack that fills a switch's MAC address table with spoofed addresses so frames are flooded instead of selectively forwarded.
• secure mac addressA secure MAC address is a MAC address authorized by port security to send traffic through a particular switch port.
• ARP poisoningAn ARP-based attack exploits weaknesses in Address Resolution Protocol to redirect, intercept, or disrupt local-network traffic.
• acknowledgmentAn acknowledgment is an 802.11 control message confirming receipt of a frame.
• SNMP TrapAn SNMP trap is an unsolicited, unacknowledged notification message sent by a managed device to report an event to a network management system.
• CAPWAPCAPWAP is a protocol for encapsulating and transporting wireless access-point control and data traffic between access points and controllers.
• DHCP snooping binding tableA DHCP snooping binding table is a switch-maintained table mapping leased IP addresses to client MAC addresses, VLANs, interfaces, and lease information.
• IOS fileAn IOS image is a software image containing Cisco IOS that can be loaded and run by a compatible Cisco device.
• WPA-EnterpriseWPA-Enterprise is a wireless LAN security mode that authenticates users or devices through an enterprise authentication infrastructure rather than a single shared key.
• reference clockA reference clock is a highly accurate timekeeping source that provides the basis for synchronization in an NTP hierarchy.
• stratumStratum is the numerical level indicating an NTP server's distance from a reference clock in the NTP synchronization hierarchy.
• site-to-site VPNA site-to-site VPN is a VPN that connects two geographically separate sites through a non-private network using persistent tunnels between gateway devices.
• SNMPSNMP is an application-layer network management protocol for monitoring and configuring networked devices through a centralized management system.
• DHCP snoopingDHCP snooping is a network security feature that filters DHCP messages and builds trusted bindings between clients and assigned addresses.
• infrastructure as codeInfrastructure as code is the practice of defining and managing infrastructure through machine-readable configuration rather than manual operations.
• differentiated services code pointDSCP is the six-bit Differentiated Services Code Point field in an IP header that identifies a packet's desired forwarding treatment.
• cloud WLC deploymentA cloud WLC is a wireless LAN controller deployed as a virtual machine on a cloud-hosted server.
• machine learningMachine learning is a computational technique in which systems learn patterns from data to make predictions or decisions without being explicitly programmed for each case.
• Trivial File Transfer ProtocolTrivial File Transfer Protocol is a lightweight application-layer protocol for transferring files, typically without authentication or encryption.
• DHCP poolA DHCP pool is a configured set of IP addresses and options that a DHCP server can lease to clients.
• CAPWAP control tunnelA CAPWAP control tunnel is an encrypted-by-default tunnel that carries configuration and management communications between a lightweight access point and a wireless LAN controller.
• CAPWAP data tunnelA CAPWAP data tunnel is a tunnel that carries traffic to and from wireless clients associated with a lightweight access point.
• Local modeLocal mode is a lightweight access point operational mode that provides basic service sets for clients and tunnels their traffic to the controller.
• declarative programmingA declarative approach specifies the desired end state while leaving the sequence of operations needed to reach it to the automation system.
• agentless designAgentless architecture manages systems without requiring dedicated management software to be installed on each managed device.
• push modelA push model is an automation pattern in which a management system initiates connections and sends configuration to managed systems.
• managed deviceA managed device is a network device that exposes operational or configuration information to a network management system through a management protocol.
• trusted portA trusted port is a switch port on which DHCP messages are permitted without DHCP snooping inspection and whose ARP messages are allowed by Dynamic ARP Inspection.
• management interfaceA management interface is a logical or physical interface through which a network device is accessed for administration.
• basic service setA basic service set is an 802.11 wireless network consisting of an access point and the wireless clients associated with it.
• extended service setAn extended service set is a wireless LAN formed by multiple basic service sets connected through a distribution system and presenting a common SSID.
• WPA-PersonalWPA-Personal is a wireless security mode that authenticates clients with a shared passphrase or pre-shared key.
• IPsecIPsec is a suite of network-layer protocols that authenticates and protects IP communications through mechanisms such as encryption and encapsulation.
• radio waveRadio frequency is the portion of the electromagnetic spectrum generally used for radio-based wireless communication, approximately from 20 kHz to 300 GHz.
• 2.4 ghz bandThe 2.4 GHz band is the portion of the radio spectrum centered around 2.4 gigahertz that is used by wireless networking technologies.
• errdisable recoveryErrDisable Recovery is a Cisco switch feature that automatically re-enables error-disabled ports after a configured interval for selected causes.
• port security violationA port security violation is an event in which a frame arrives from a MAC address that exceeds or is not permitted by a port's security limit.
• Cisco Discovery ProtocolCisco Discovery Protocol is a Cisco proprietary Layer 2 discovery protocol that advertises device and network information to directly connected Cisco devices.
• ntp peeringAn NTP peer is a device configured to exchange time information symmetrically with another NTP device.
• SNMP Set requestAn SNMP Set request asks an SNMP agent to change specified management-object values on a managed device.
• DHCP clientA DHCP client is a network interface or device that requests configuration parameters such as an IP address from a DHCP server.
• BSSIDA BSSID, or basic service set identifier, uniquely identifies an 802.11 basic service set and is usually represented by the access point radio's MAC address.
• RADIUSRADIUS is an AAA protocol that provides centralized authentication, authorization, and accounting for network access.
• Multiprotocol Label SwitchingMultiprotocol Label Switching is a networking technology that forwards packets using labels carried in an additional header rather than relying solely on IP addresses.
• SNMP ResponseAn SNMP Response is a message from an agent that returns the result or requested values for a manager request or confirms receipt of an Inform message.
• vulnerabilityA vulnerability is a weakness in a system, process, or control that can be exploited to cause harm or gain unauthorized access.
• management information baseA Management Information Base is a structured collection of managed objects and variables that a network-management protocol can query or modify.
• data integrityIntegrity is the property that systems and data remain trustworthy and are not altered except by authorized entities.
• procedural programmingA procedural approach specifies an ordered sequence of operations to achieve a configuration or infrastructure result.
• NTPNetwork Time Protocol is an Internet protocol that synchronizes computer clocks across a network using authoritative time sources.
• multifactor authenticationMultifactor authentication is an identity-verification process that requires authentication factors from multiple categories before granting access.
• artificial intelligenceArtificial intelligence is the field of computational methods that perform tasks requiring capabilities associated with human intelligence, such as learning, prediction, and reasoning.
• dhcpDHCP is a network protocol that automatically provides devices with configuration such as IP addresses and DNS server information.
• mac address tableA MAC address table is a switch data structure that maps learned MAC addresses to the ports through which their devices are reachable.
• software-defined networkSoftware-defined networking is a network architecture that centralizes control-plane intelligence in a controller and programmatically manages forwarding devices.
• DMVPNDMVPN is a Cisco technology that dynamically establishes multipoint VPN tunnels between routers, commonly forming a full mesh from a hub-and-spoke configuration.
• GREGRE is a tunneling protocol that encapsulates network packets with additional headers but does not encrypt their contents.
• GRE over IPsecGRE over IPsec is a tunneling configuration that encapsulates packets with GRE and then encrypts and encapsulates the resulting packet with IPsec.
• tunnelingTunneling is the technique of encapsulating one packet or protocol unit inside another for transport across an intermediate network.
• login commandlogin local is a Cisco IOS line configuration command that requires authentication against locally configured user accounts.
• amplification attackAn amplification attack is a reflection attack in which a small request causes a disproportionately large response toward the target.
• malicious codeMalware is software designed to perform malicious actions or compromise the confidentiality, integrity, or availability of systems or data.
• man-in-the-middle attackA man-in-the-middle attack is an attack in which an attacker secretly intercepts and relays communications between two parties, potentially altering the exchanged data.
• reconnaissance attackA reconnaissance attack gathers information about a target for use in a future attack.
• reflection attackA reflection attack is an attack in which spoofed requests cause third-party servers to send responses to the target.
• spoofing attackA spoofing attack is an attack in which an attacker falsifies a device or sender identity, such as with a forged IP or MAC address.
• port numberA port number is a transport-layer identifier that distinguishes application endpoints and concurrent communication sessions on a host.
• distribution systemA DS, or distribution system, is the interconnection that links basic service sets within an extended service set.
• customer edge routerA customer edge router is an MPLS router at a customer's premises that connects the customer's network to a service provider network.
• MPLS L2VPNAn MPLS L2VPN is a Layer 2 virtual private network in which the provider network transparently forwards customer frames between customer edge routers.
• MPLS L3VPNAn MPLS L3VPN is a Layer 3 virtual private network in which provider edge routers participate in customer routing and maintain separated routing information.
• provider edge routerA provider edge router is an MPLS router at the edge of a service provider network that connects to customer networks and manages MPLS labels for customer traffic.
• dynamic arp inspectionDynamic ARP Inspection is a Cisco switch security feature that validates ARP messages against trusted IP-to-MAC address bindings and filters invalid messages.
• network automationNetwork automation is the use of software and programmable processes to configure, operate, monitor, and troubleshoot network infrastructure with reduced manual intervention.
• access control listAn access control list is an ordered set of permit and deny rules that controls whether specified network traffic or access is allowed.
• dynamic interfaceA dynamic interface is a logical wireless LAN controller interface associated with a WLAN and VLAN and configured with network parameters and a DHCP forwarding destination.
• Virtual Routing and ForwardingVirtual Routing and Forwarding is a networking feature that maintains multiple logically separate routing tables on the same device.
• classifierClassification is the process of identifying network packets or traffic and assigning them to classes based on attributes, contents, markings, or required treatment.
• dynamic port address translationDynamic Port Address Translation is a Network Address Translation technique that dynamically maps many internal hosts to one public IP address by distinguishing connections with transport-layer ports.
• nat translation tableA NAT translation table is a router-maintained collection of mappings between translated and original network addresses, with associated communication sessions.
• cpu aclA CPU ACL is an access control list applied to traffic destined for or originating from a network device's control-plane CPU.
• 5 ghz bandThe 5 GHz band is the portion of the radio spectrum centered around 5 gigahertz that is used by wireless networking technologies.
• 6 ghz bandThe 6 GHz band is an RF band used by newer wireless LANs that spans approximately 5.925 to 7.125 GHz.
• WPA2WPA2 is a Wi-Fi security certification program that specifies security requirements for wireless LAN devices and communications.
• IP addressAn IP address is a numerical network-layer identifier assigned to an interface or host for communication across an IP network.
• embedded WLCAn embedded WLC is a wireless LAN controller integrated into a network switch or wireless access point.
• Mobility ExpressA Mobility Express wireless LAN controller is a controller integrated into a wireless access point for managing a wireless deployment.
• unified WLCA unified WLC is a dedicated hardware wireless LAN controller appliance.
• VTY lineline vty 0 15 is a Cisco IOS configuration command that selects VTY lines 0 through 15 for configuration.
• cloud-managed access point architectureCloud-based AP architecture is a wireless LAN design in which access points are managed through a cloud-hosted platform.
• stateful firewallStateful packet filtering is a traffic-filtering technique that permits or denies packets according to connection state and packet relationships.
• WPA3WPA3 is the current generation of Wi-Fi security certification that improves wireless authentication and protection over earlier WPA versions.
• hypervisorA hypervisor is software or firmware that creates and manages virtual machines while allocating physical hardware resources to them.
• type 1 hypervisorA type 1 hypervisor is a hypervisor installed directly on physical hardware rather than on a host operating system.
• type 2 hypervisorA type 2 hypervisor is a hypervisor that runs as an application on an operating system installed on physical hardware.
• virtual network interfaceA virtual network interface card is a software-defined network interface through which a virtual machine communicates with other hosts and networks.
• virtual switchA virtual switch is software that forwards network frames between virtual machines and physical network interfaces.
• AnsibleAnsible is an open-source automation tool for configuring systems and deploying applications, typically without requiring agents on managed nodes.
• TerraformTerraform is an open-source infrastructure-as-code tool for defining and provisioning infrastructure through declarative configuration files.
• DNS cacheDNS caching is the temporary storage of DNS answers so subsequent name-resolution requests can be answered without repeating all queries.
• pull modelA pull model is an automation pattern in which managed systems periodically connect to a management system and retrieve configuration.
• CSMA/CACSMA/CA is a wireless media-access method in which devices sense a shared channel and defer transmission to reduce the likelihood of collisions.
• free-space path lossFree-space path loss is the reduction in received signal power caused by geometric spreading as a radio signal propagates through unobstructed space.
• pre-shared keyA pre-shared key is a secret value configured in advance on wireless clients and access points for shared-key authentication.
• aaa frameworkAAA is a framework that separates network user access control into authentication, authorization, and accounting.
• JSONJSON is a text-based data-interchange format that represents structured data using objects, arrays, values, and name-value pairs.
• markingMarking is the process of setting packet or traffic header fields to encode classification information for network policy enforcement.
• provisioningInfrastructure provisioning is the process of deploying and preparing computing, network, or cloud infrastructure resources.
• dynamic natDynamic NAT is a network address translation technique that dynamically assigns one-to-one mappings from inside local addresses to available inside global addresses from a configured pool.
• intrusion detection and prevention systemAn intrusion prevention system is a security system that inspects network traffic, detects malicious or suspicious activity, and can take actions such as blocking traffic.
• next-generation firewallA next-generation firewall is a firewall that combines traditional traffic filtering with capabilities such as application awareness, integrated intrusion prevention, and advanced threat inspection.
• confidentialityConfidentiality is the property that systems and data are accessible only to authorized entities.
• distribution layerA distribution layer is the campus-network layer that aggregates access switches and provides policy, connectivity, and path control between access and core layers.
• FTPFile Transfer Protocol is an application-layer protocol for transferring files between networked systems, traditionally using separate control and data connections.
• remote access VPNA remote access VPN is an on-demand virtual private connection that securely connects an individual end-user device to an organization's internal network.
• nat poolA NAT pool is a configured range of inside global addresses available for dynamic network address translation.
• RESTRepresentational state transfer is an architectural style for distributed systems that models interactions around resources and their representations.
• dns queryA DNS query is a request for DNS information, such as the network address associated with a domain name.
• severityA Syslog severity level is an ordinal classification of event importance that controls which Syslog events are logged or transmitted.
• arpARP is a network protocol that resolves an IPv4 address to a MAC address on a local network.
• bridging modeDHCP bridging mode is a wireless LAN controller mode that forwards client DHCP messages without acting as a DHCP proxy.
• proxy modeProxy mode is a wireless controller mode in which the controller represents wireless clients when forwarding their DHCP messages.
• virtual private networkA virtual private network is a technology that creates an encapsulated and typically encrypted logical connection across an underlying network.
• outside local addressAn outside local address is the address of an outside host from the perspective of the inside network.
• 802.1xPort-based network access control is a technique that restricts network connectivity at a physical or logical switch port until the connecting device is authorized.
• extensible authentication protocolEAP is an authentication framework that supports multiple methods for exchanging identity and authentication information.
• password managerA password manager is software that securely stores, generates, and manages passwords and can automate their entry.
• layer 2 discovery protocolLink Layer Discovery Protocol is a vendor-neutral Layer 2 discovery protocol for advertising device information to directly connected network neighbors.
• community stringA community string is a shared password-like value used by SNMPv1 and SNMPv2c to authenticate management operations.
• packet lossPacket loss is the failure of a packet to reach its intended receiver because it is discarded or otherwise lost during transmission.
• virtualizationVirtualization is the abstraction of computing, networking, or storage resources from their underlying physical hardware so that multiple logical instances can share it.
• Bridge modeBridge mode is a lightweight access point operational mode that forms wireless mesh links or bridges wired LANs across wireless connections.
• Datagram Transport Layer SecurityDatagram Transport Layer Security is a TLS-based protocol that provides cryptographic protection for datagram-oriented communications such as UDP traffic.
• iterative dns queryAn iterative DNS query permits a DNS server to return either an answer or a referral to another DNS server that may know the answer.
• recursive dns queryA recursive DNS query requests that a DNS server return a definite answer or an error for the client rather than referring the client elsewhere.
• low latency queuingLow Latency Queuing is a QoS scheduling technique that gives selected traffic strict priority treatment while providing bandwidth allocation for other classes.
• SNMP agentAn SNMP agent is the SNMP component on a managed device that receives manager requests, accesses device information, and sends responses or notifications.
• SNMP managerAn SNMP manager is the SNMP component on a management system that sends requests to agents and receives their responses and notifications.
• wireless channelA wireless channel is a designated portion of radio spectrum used to carry wireless network transmissions.
• social engineeringSocial engineering is the manipulation of people into disclosing confidential information or performing actions that compromise security.
• object IDAn object identifier is a hierarchical identifier for a managed object in a management information model such as SNMP.
• primary serverA primary NTP server obtains time directly from a reference clock rather than from an upstream NTP server.
• 802.11 frameThe 802.11 frame format is the layout of a wireless LAN frame, including its control, addressing, sequencing, payload, and integrity fields.
• DHCP address conflictA DHCP address conflict occurs when an IP address available for lease is already configured or used by another host.
• client/server modeClient/server mode is an NTP operating mode in which a device acts both as a client of an upstream server and as a server for downstream clients.
• electromagnetic waveAn electromagnetic wave is a propagating oscillation of electric and magnetic fields oriented perpendicular to each other and to the direction of propagation.
• class-based weighted fair queuingClass-Based Weighted Fair Queuing is a packet-scheduling technique that assigns traffic classes to queues and guarantees each queue a configured minimum share of bandwidth during congestion.
• authentication and authorizationAuthorization is the process of determining and granting the actions or resources an authenticated subject is permitted to access.
• generative modelingGenerative AI is artificial intelligence that produces new content such as text, code, configurations, or designs from learned patterns and supplied requirements.
• control planeThe control plane is the set of network-device functions that determines the rules and state used by the data plane to forward traffic.
• data planeThe data plane is the part of a network system that forwards packets or frames according to programmed forwarding decisions.
• authorization serverAn authorization server is a service that authenticates clients or resource owners and issues authorization credentials such as access tokens.
• basic authenticationBasic authentication is an HTTP authentication method that transmits a username and password in an HTTP header, typically encoded but not inherently encrypted.
• OAuthOAuth 2.0 is an industry-standard authorization framework that delegates controlled access to protected resources without sharing the resource owner's credentials with a third-party application.
• Cisco MerakiCisco Meraki is a cloud-managed networking platform for centrally configuring, monitoring, and troubleshooting network devices.
• priority queuingPQ is a quality-of-service queuing technique that gives one queue strict priority over other queues.
• clockA software clock is the operating-system-maintained clock in a network device that tracks the current date and time.
• assured forwardingAssured Forwarding is a standardized DSCP marking scheme with four traffic classes and three drop-precedence levels per class.
• class selectorClass Selector is a standardized set of DSCP markings that preserves compatibility with the older three-bit IP Precedence values.
• expedited forwardingExpedited Forwarding is a standardized DSCP per-hop behavior for traffic sensitive to delay, jitter, and loss, represented by DSCP value 46.
• IP precedenceIP Precedence is the legacy three-bit IP packet-priority field represented by the three most significant bits of the former Type of Service byte.
• security threatA threat is a potential cause or actor that could exploit a vulnerability and harm a system or its data.
• logging bufferedlogging buffered is a Cisco IOS command that enables storage of log messages in the device's memory buffer and optionally sets the minimum severity threshold.
• logging traplogging trap is a Cisco IOS command that enables sending log messages to a Syslog server and optionally sets the minimum severity threshold.
• TelnetThe telnet command is a command-line client that initiates a Telnet remote terminal connection.
• configuration managementConfiguration management is the systematic process of defining, applying, tracking, and enforcing the configurations of devices or other infrastructure.
• WEPWEP is an obsolete IEEE 802.11 wireless security protocol that provides authentication, confidentiality, and integrity through a shared static key and RC4 encryption.
• DHCPDISCOVERDHCPDISCOVER is a DHCP client message that broadcasts a request to locate available DHCP servers.
• DHCPOFFERDHCPOFFER is a DHCP server message that proposes an IP address and other configuration to a client.
• DHCPREQUESTDHCPREQUEST is a DHCP client message that requests an offered address or renews an existing lease.
• DORADORA is the four-message DHCP address-allocation process consisting of discovery, offer, request, and acknowledgment.
• client-server architectureClient-server architecture is a distributed-system pattern that separates clients requesting services from servers providing them.
• mitigationA mitigation technique is a measure that reduces the likelihood or impact of a security threat or vulnerability.
• configuration management toolA configuration management tool is software that automates the application, enforcement, and monitoring of system or network configuration standards.
• network address translationNetwork Address Translation is a technique that rewrites network-layer addresses and often transport-layer ports as traffic crosses a gateway.
• network jitterNetwork jitter is variation in the delay of successive data packets or flows.
• brute-force attackA brute-force attack systematically tries possible character combinations until a password is found or the search is exhausted.
• DHCP exhaustion attackA DHCP exhaustion attack is a denial-of-service technique that consumes a DHCP server's address pool so legitimate clients cannot obtain addresses.
• dictionary attackA dictionary attack tries passwords drawn from a list of common or likely words and passwords.
• open-source intelligenceOpen-source intelligence is the collection and analysis of information that is publicly available.
• policingPolicing is a traffic-control technique that enforces a configured rate or traffic contract by identifying excess traffic and applying a policy action.
• SYN flood attackA SYN flood attack is a denial-of-service technique that overwhelms a target with TCP connection-opening requests and leaves connections half open.
• traffic-shaping algorithmShaping is a quality-of-service technique that enforces a traffic rate limit by buffering excess traffic and transmitting it later at the permitted rate.
• static natStatic NAT is a network address translation technique that permanently configures one-to-one mappings between inside local and inside global addresses.
• show ip nat translationsshow ip nat translations is a Cisco IOS operational command that displays the router's NAT translation table.
• management planeThe management plane is the part of a network system that provides administrative monitoring, configuration, and operational control.
• priority code pointPCP is the three-bit priority field in an IEEE 802.1Q Ethernet tag that encodes a frame's Layer 2 traffic class.
• exploitAn exploit is a method or code that takes advantage of a vulnerability to produce an unintended effect.
• leased lineA leased line is a dedicated physical connection between two sites with bandwidth reserved for that connection, traditionally delivered as a serial circuit.
• RC4RC4 is a stream-cipher algorithm that generates a pseudorandom keystream for encrypting data.
• private ipv4 addressA private IPv4 address is an IPv4 address from a designated range intended for internal networks and not required to be globally unique or routable over the public internet.
• public ip addressA public IPv4 address is an IPv4 address that is globally unique and intended for communication across the public internet.
• WPAWPA, or Wi-Fi Protected Access, is a Wi-Fi security certification program that defines requirements for protecting wireless LAN communications.
• SSH version 2SSH version 2 is the later major version of the Secure Shell protocol with security and performance improvements over version 1.
• random early detectionRandom Early Detection is a queue-management technique that probabilistically drops packets before a queue becomes full to reduce congestion and avoid synchronized TCP rate reductions.
• SSHSSH is a protocol that provides authenticated and encrypted remote shell access and other secure network services.
• weighted random early detectionWeighted Random Early Detection is a queue-management technique that applies differentiated early packet dropping based on packet classification or drop precedence.
• authoritative dns serverAn authoritative DNS server holds the definitive DNS records for a specific domain and can provide definitive answers about that domain.
• JSON arrayA JSON array is an ordered collection of JSON values enclosed in square brackets.
• JSON objectA JSON object is an unordered collection of string-keyed key-value pairs enclosed in curly braces.
• community cloudA community cloud is a cloud deployment model in which infrastructure is shared by consumers from multiple organizations with common requirements.
• private cloudA private cloud is a cloud deployment model in which cloud infrastructure is reserved for use by a single organization and its authorized consumers.
• access layerAn access layer is the campus-LAN tier that connects end hosts and other endpoint devices to the network.
• frequencyFrequency is the number of complete oscillations a periodic wave makes per unit of time.
• checksumA checksum is a small value derived mathematically from data to allow detection of changes to that data.
• name-value pairA JSON key-value pair associates a quoted property name with a JSON value using a colon separator.
• RF jamming attackAn RF jamming attack floods wireless radio frequency bands with interfering signals to prevent legitimate communication.
• wide area networkA wide area network is a network that connects devices or sites across a broad geographic area.
• MPLS labelAn MPLS label is a fixed-length header value inserted into a packet to identify a predetermined forwarding path through an MPLS network.
• provider routerA provider router is an internal MPLS service-provider router that forwards labeled packets without directly connecting to customer networks.
• switch virtual interfaceA switch virtual interface, or SVI, is a virtual Layer 3 interface on a switch that provides an IP interface for a VLAN, management, or routing.
• tail dropTail drop is a queue-management technique that discards incoming packets only after a queue has reached its capacity.
• TCP global synchronizationTCP global synchronization is the simultaneous reduction and subsequent increase of many TCP senders' congestion windows in response to packet loss, causing cyclic network utilization.
• autonomous access pointAn autonomous access point is a wireless access point that independently performs wireless operations and does not rely on an external controller.
• AP-manager interfaceAn AP-manager interface is a wireless LAN controller interface that communicates with lightweight wireless access points through CAPWAP tunnels.
• distribution system portA distribution system port is a wireless LAN controller network port that connects the controller to the wired distribution system.
• virtual interfaceA virtual interface is a logical wireless LAN controller interface associated with a virtual gateway IP address for controller functions such as relaying client DHCP messages.
• SNMP softwareAn SNMP entity is the complete SNMP implementation running on an SNMP-capable device or management system.
• SNMPv1SNMPv1 is the first widely implemented version of SNMP, using community strings for basic authentication and supporting a limited set of message types.
• SNMPv2cSNMPv1/SNMPv2c is the family of earlier SNMP versions whose access control is based on shared community strings.
• syslog serverA Syslog server is a service that receives and stores Syslog messages from networked devices for centralized review and correlation.
• power over ethernetPower over Ethernet is a networking standard and technology for delivering electrical power over Ethernet cabling along with data.
• electromagnetic spectrumThe electromagnetic spectrum is the complete range of electromagnetic radiation organized by frequency or wavelength.
• domainA domain is a subtree of the DNS hierarchy under the administrative control of an organization or individual.
• fully qualified domain nameA fully qualified domain name is a complete DNS name that specifies a host's location through the entire domain hierarchy.
• top-level domainA top-level domain is a domain directly beneath the DNS root, such as com, net, or org.
• queuingQueuing is the technique of holding packets in ordered buffers for scheduled transmission.
• option 82 insertionDHCP option 82 is the relay-agent information option that carries additional client or circuit context in DHCP messages.
• TACACS+TACACS+ is an AAA protocol that separates authentication, authorization, and accounting and supports centralized control of administrative access.
• Simultaneous Authentication of EqualsSimultaneous Authentication of Equals is a password-authenticated key-exchange protocol used by WPA3 to establish authenticated wireless connections without directly transmitting the password.
• WLC discovery processThe WLC discovery process is the procedure by which a lightweight access point locates available wireless LAN controllers after booting and obtaining an IP address.
• overlay networkAn overlay network is a logically constructed network implemented through tunnels or other virtual connections over an underlying physical network.
• underlay networkAn underlay network is the foundational physical or logical network that provides connectivity for an overlay network.
• mesh basic service setA mesh basic service set is a wireless LAN architecture in which multiple access points communicate wirelessly and relay traffic toward a distribution system.
• iaasInfrastructure as a service is a cloud service model that provides on-demand computing, storage, and networking resources for customer-managed operating systems and applications.
• platform as a servicePlatform as a service is a cloud service model that provides an application development and execution platform while the customer manages the applications.
• multi-homed designA multi-homed design connects a network to multiple internet service providers, typically with one connection to each provider.
• TFTP serverA TFTP server is a network service that sends and receives files using the Trivial File Transfer Protocol.
• user awarenessA user awareness program educates employees about potential security threats without constituting formal training.
• DHCP option 43DHCP option 43 is a vendor-specific DHCP option that can supply lightweight access points with a wireless LAN controller address.
• encryptionEncryption is the transformation of readable data into ciphertext that can be recovered only with the appropriate decryption capability.
• ip nat pool commandThe Cisco IOS ip nat pool command creates a named range of inside global IPv4 addresses for dynamic NAT.
• southbound apiA southbound interface is the interface through which an SDN controller communicates actionable instructions to network devices.
• SNMP informAn SNMP inform is a notification message that requires acknowledgment from the receiving network management system.
• syslog messageA Syslog message is a structured event record generated by a device or one of its services to report an occurrence or status change.
• security zoneA security zone is a logical network segment whose traffic to and from other zones is governed by distinct security policies.
• stateless firewallA stateless firewall evaluates each packet independently without retaining or using connection state from other packets.
• VRF-liteVRF-lite is a form of Virtual Routing and Forwarding that provides separate routing instances without MPLS.
• default gatewayA default gateway is the router to which a host sends packets destined for networks absent from its routing table.
• power policingPower policing is a PoE protection technique that places a port into an error-disabled state when its powered device draws more than the configured cutoff power.
• four-way handshakeA four-way handshake is a WPA key-establishment exchange between a wireless client and authenticator that generates encryption keys for data communication.
• independent basic service setAn independent basic service set is a wireless network in which client devices communicate directly with one another without a wireless access point.
• core layerA core layer is the campus-network layer that aggregates connections between distribution layers in large LANs.
• inherence factorAn inherence factor is an authentication factor based on something the user is, such as a biometric characteristic.
• knowledge factorA knowledge factor is an authentication factor based on information that the claimant knows.
• possession factorA possession factor is an authentication factor based on an item or device that the user possesses.
• SNMP GetBulk requestAn SNMP GetBulk request asks an agent to return multiple management-information values or successive portions of the management information tree efficiently.
• diffractionDiffraction is the bending and spreading of a propagating wave around obstacles or through openings.
• reflectionReflection is the redirection of a propagating electromagnetic wave when it encounters a surface or boundary.
• scatteringScattering is the redirection of a propagating electromagnetic wave by irregularities or small objects in its medium.
• agent orchestrationA container orchestrator is software that automates the deployment, management, and scaling of containers.
• logging bufferA logging buffer is the RAM-resident storage area on a Cisco IOS device that holds Syslog messages.
• logging hostlogging host is a Cisco IOS command that specifies an external host to receive Syslog messages.
• unbounded mediumAn unbounded medium is a wireless transmission medium in which signals propagate through open space rather than being confined to a cable.
• Application-Centric InfrastructureCisco ACI is Cisco's data-center software-defined networking solution that translates application and network policies into configurations for the infrastructure.
• Cisco SD-AccessCisco SD-Access is Cisco's software-defined networking solution for automating and securing wired and wireless campus LANs.
• Cisco SD-WANCisco SD-WAN is Cisco's software-defined networking solution for managing wide area networks through centralized control and overlay tunnels.
• mobility groupA mobility group is a configuration grouping that allows wireless LAN controllers to coordinate client roaming across access points they control.
• RF groupAn RF group is a configuration grouping that coordinates radio-frequency settings such as power and channel selection across wireless LAN controllers.
• trust boundaryA trust boundary is a logical network boundary separating packet markings that a device accepts from markings it reclassifies.
• full mesh topologyA full mesh topology is a network arrangement in which every device has a direct connection to every other device.
• partial mesh topologyA partial mesh topology is a network arrangement in which some, but not all, devices have direct connections to one another.
• active scanningActive scanning is a wireless discovery technique in which a client sends probe requests and listens for probe responses from nearby access points.
• ChefChef is an infrastructure-automation and configuration-management tool that defines system configuration through code-based policies.
• passive scanningPassive scanning is a wireless discovery technique in which a client listens for beacon messages transmitted by nearby access points.
• PuppetPuppet is an infrastructure automation and configuration management tool that commonly uses declarative resource descriptions and managed-node agents.
• server modeServer mode is an NTP operating mode in which a device serves time from its local clock without acting as a client of an external NTP server.
• resource ownerA resource owner is the entity that can grant an application permission to access a protected resource.
• resource serverA resource server is a service that hosts protected resources and validates access tokens before providing them to authorized clients.
• DNS recordA DNS record is a structured entry that associates a domain name with an address, service, server, or administrative value.
• SNMPv3SNMPv3 is the third major version of the Simple Network Management Protocol with enhanced security and administration features.
• community-based security modelA community-based security model authenticates SNMP managers and agents with shared community strings.
• centralized control planeA centralized control plane is a control-plane design in which a controller centrally performs control functions and distributes forwarding instructions to network devices.
• control layerThe control layer of an SDN architecture translates high-level network requirements into actionable instructions for network devices.
• control messageA control frame is an 802.11 frame that facilitates the delivery of other frames over the wireless medium.
• controllerAn SDN controller is a software platform that centrally manages and programs network behavior through software-defined networking interfaces.
• data frameA data frame is an 802.11 frame that carries a data payload between wireless clients.
• infrastructure layerThe infrastructure layer of an SDN architecture contains network devices that execute instructions from the control layer.
• northbound interfaceA northbound interface is the interface through which SDN applications communicate requirements and desired behavior to an SDN controller.
• DHCP client identifierA DHCP client identifier is a value that uniquely identifies a DHCP client to the server.
• CDP neighbor tableA CDP neighbor table is a tabular representation of directly connected devices and the local and remote interfaces discovered by Cisco Discovery Protocol.
• authenticatorAn authenticator is a network-access device that controls a protected connection between a supplicant and a network.
• supplicantA supplicant is a client device that requests access to a network protected by an authentication system.
• wireless access pointA wireless access point is a network device that coordinates wireless client communication and provides access to other network resources.
• service setA service set is a logical grouping of wireless LAN devices that communicate as part of the same wireless network.
• fiber-optic ethernetFiber-optic Ethernet is Ethernet communication carried over fiber-optic cabling using optical signals.
• vpn clientA VPN client is software that establishes and manages a virtual private network connection from an end-user device.
• NTP authenticationNTP authentication is a technique that verifies the identity of an NTP server or peer before accepting its time data.
• star topologyA hub-and-spoke topology is a network arrangement in which peripheral sites connect to a central site or device.
• integrity check valueA message integrity check is a cryptographic checksum that enables a recipient to detect alteration of transmitted data.
• violation modeswitchport port-security violation mode is a Cisco IOS switch-port command that configures the response to a port-security violation.
• HTTP methodAn HTTP method is a request-message field that specifies the action a client asks a server to perform on a resource.
• DHCP relayA DHCP relay agent is an intermediary network device that forwards DHCP messages between clients and remote DHCP servers.
• small office/home office networkA SOHO network is a network designed for the limited scale and connectivity needs of a small office or home office.
• digital subscriber lineDSL is a family of broadband access technologies that transmits digital data over copper telephone lines.
• netmaskA netmask is a bit mask that separates the network portion of an IP address from its host portion.
• spine-leaf architectureA spine-leaf network is a data-center topology in which every leaf switch connects to multiple spine switches for predictable, high-bandwidth paths.
• crypto key generate rsacrypto key generate rsa is a Cisco IOS global configuration command that creates an RSA key pair for SSH.
• key sizeAn RSA modulus size is the bit length of the RSA modulus and a principal determinant of the key's cryptographic strength.
• ftp control connectionAn FTP control connection is the TCP connection through which an FTP client authenticates and sends commands to an FTP server.
• ftp data connectionAn FTP data connection is the separate TCP connection used to transfer file data between an FTP client and server.
• Ansible playbookAn Ansible playbook is a YAML file that defines tasks and procedures for managing configuration on target devices.
• request messageA POST request is an HTTP request that submits data to a server for processing or resource creation.
• show ip dhcp snooping bindingshow ip dhcp snooping binding is a Cisco IOS show command that displays the DHCP snooping binding table.
• HashiCorp Configuration LanguageHashiCorp Configuration Language is a declarative configuration language for describing infrastructure and services.
• secondary serverA secondary NTP server obtains its time from another NTP server rather than directly from a reference clock.
• phishingPhishing is a social engineering technique that uses deceptive messages or sites to trick targets into revealing information, clicking malicious links, or downloading malware.
• pretextingPretexting is a social engineering technique in which an attacker invents a plausible scenario to manipulate a target.
• tailgatingTailgating is gaining physical entry to a restricted area by following an authorized person through an access point.
• user trainingA user training program is a formal educational program covering security policies and threat avoidance.
• domain-specific languageA domain-specific language is a computer language specialized for a particular application domain or purpose.
• network virtualizationNetwork virtualization is the abstraction of network functions and segments so they can be created and operated independently of the underlying physical network.
• sticky secure mac addressswitchport port-security mac-address sticky is a Cisco IOS interface command that enables sticky learning of secure MAC addresses on a switch port.
• bandA radio-frequency band is a defined contiguous range of frequencies used for wireless communication.
• lock-step communicationLock-step communication is a sequential exchange in which each message is followed by a wait for the corresponding reply before the next message is sent.
• ip name-serverip name-server is a Cisco IOS configuration command that specifies DNS servers a router can query for name resolution.
• dynamic switch portA dynamic switch port is a port whose access or trunk status is negotiated by DTP rather than explicitly configured.
• show port-security interfaceshow port-security interface is a Cisco IOS command that displays port-security settings and status for a specified interface.
• physical access controlPhysical access control is the restriction of who can physically reach and handle a device or facility.
• TKIPTKIP is a wireless security protocol that improves WEP-compatible hardware security through per-packet key mixing and stronger integrity checks.
• Meraki dashboardThe Meraki dashboard is a web-based management interface for centrally administering Meraki network devices.
• absorptionAbsorption is the conversion of electromagnetic-wave energy into heat as a wave passes through a medium.
• cacheabilityCacheability is the property that determines whether a resource representation may be temporarily stored and reused.
• stateless systemStatelessness is a communication property in which each request contains all information needed for the server to process it without retaining prior client-request context.
• campus LANA campus LAN is a local area network spanning the buildings and facilities of an organization or institution in a shared campus area.
• logging consolelogging console is a Cisco IOS command that enables console logging and optionally sets its minimum event severity threshold.
• logging monitorlogging monitor is a Cisco IOS command that enables logging of messages to monitored terminal lines and optionally sets their minimum severity threshold.
• basic service areaA basic service area is the geographic coverage area in which clients can successfully communicate with an access point.
• ip helper-addressip helper-address is a Cisco IOS interface command that forwards selected UDP broadcasts, including DHCP messages, to a specified server.
• CRUDA CRUD operation is one of the four fundamental actions on a resource: create, read, update, or delete.
• data center networkA data center is a facility or dedicated space that centralizes an organization's servers, storage systems, and network infrastructure.
• CCMPCCMP is an IEEE 802.11 wireless security protocol that combines AES counter-mode encryption with CBC-MAC-based message authentication.
• partially qualified domain nameA partially qualified domain name is a DNS name that omits enough hierarchy information to prevent global identification of a host.
• root domainThe root domain is the unnamed top of the DNS hierarchy, conventionally represented by a single dot.
• subdomainA subdomain is a domain located beneath another domain in the DNS hierarchy.
• application visibility and controlApplication Visibility and Control is a traffic-inspection capability that identifies applications by examining packet attributes and contents.
• attack signatureAn attack signature is a pattern used by an intrusion-prevention system to identify malicious or suspicious network activity.
• SNMP applicationAn SNMP application is software that provides a human-facing interface for monitoring and managing devices through SNMP.
• wpa2-pskPSK authentication verifies wireless clients using a pre-shared secret key.
• hardware calendarA hardware calendar is a persistent hardware-maintained clock that retains calendar time independently of the operating system's software clock.
• open system authenticationOpen System Authentication is an 802.11 authentication exchange that permits a client to proceed to association without validating a shared secret.
• shared key authenticationShared key authentication is a WEP authentication method that verifies possession of a configured shared key by encrypting and returning a challenge phrase.
• scryptscrypt is a memory-hard password-based key derivation and hashing algorithm designed to resist hardware-accelerated password guessing.
• GCMPGCMP is a wireless data-protection protocol that combines AES counter-mode encryption with GMAC integrity protection.
• terminal monitorterminal monitor is a Cisco IOS privileged EXEC command that enables real-time monitoring of Syslog messages for the current VTY session.
• wireless routerA wireless router is an integrated network device that typically provides routing, wired switching, firewalling, and wireless access-point functions.
• eap over lansEAP over LANs is a protocol encapsulation that transports EAP messages across Ethernet or IEEE 802.11 LANs.
• password attackA password attack is an attempt to discover, obtain, or exploit a password to gain unauthorized access.
• differentiated servicesDifferentiated Services is an IP packet-marking architecture that uses the DSCP field to classify traffic for differentiated forwarding treatment.
• drop precedenceDrop precedence is a relative congestion-discard level indicating how likely a packet is to be dropped within an assured-forwarding class.
• wireless signalA wireless signal is an electromagnetic signal transmitted through air or another unbounded medium for communication.
• two-tier architectureA two-tier campus LAN architecture is a campus network design with access and distribution layers and no separate core layer.
• absolute secure mac agingAbsolute aging is a secure-MAC aging mode in which the aging timer starts when the address is learned and does not reset when frames are received.
• inactivity aging typeInactivity aging is a secure-MAC aging mode in which receiving a frame from the address resets its aging timer.
• leaf switchA leaf switch is a switch in the endpoint-facing layer of a spine-leaf data-center topology that connects to hosts and spine switches.
• spine switchA spine switch is a switch in the upper layer of a spine-leaf data-center topology that connects to leaf switches.
• backdoor attackA backdoor is malware or functionality that provides unauthorized access to an infected computer.
• botnetA botnet is a group of internet-connected devices infected with malware and controlled or coordinated for malicious activity.
• computer virusA computer virus is malware that attaches to a legitimate program or file and replicates or executes when the host is executed.
• computer wormA computer worm is self-replicating malware that spreads across systems or networks without requiring attachment to a host file or human intervention.
• radio-frequency managementRadio resource management is the optimization of wireless radio parameters and resources to maintain network performance and user experience.
• ransomwareRansomware is malware that encrypts files or otherwise restricts access and demands payment for restoration.
• Trojan horseA Trojan horse is malware that disguises itself as legitimate software or content.

These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.