Cisco Certified Support Technician Networking (100-150) Study Guide¶
Independent AI-assisted resource — SOURCES + OBJECTIVES CHECKED; HUMAN REVIEW PENDING. Public objectives, citations, links, volatility labels, and exam-integrity compliance were checked September 29, 2026. See the coverage record. Cisco's exam page and exam-topics page are authoritative.
Study guide at a glance
Start here
Prerequisites: No formal prerequisite. Build packet-delivery reasoning across models, performance, applications/protocols, IPv4/IPv6 addressing and subnet formats, endpoint/media selection, switching/routing/services, safe Cisco and operating-system inspection, evidence-led troubleshooting/ticketing, and foundational network/wireless security using Packet Tracer or equipment you are authorized to operate.
Official objective domains
- See the objective map in this guide
The active-reading range uses 90–130 words per minute for technical material. Labs, troubleshooting, note-taking, spaced review, and prerequisite gaps add time; it is not a total preparation promise.
Current baseline: CURRENT BLUEPRINT: Active 100-150 CCST Networking; 25 numbered objectives and their supporting bullets across six domains, read from the actual three-page objective PDF on September 29, 2026
Scheduled change: None announced on the checked official pages
Official source: 100-150 exam page · exam topics · training overview
Current guide watch — October 28, 2026¶
Cisco’s current 100-150 page still lists a 50-minute CCST Networking exam and the same six areas: standards/concepts, addressing, endpoints/media, infrastructure, diagnosis, and security. The current free Cisco Networking Academy career path remains a direct preparation route; no new exam version was announced in the reviewed source set. Cisco CCST Networking exam page
How to use this guide¶
Treat networking as a packet-delivery story: application need → name and address → local medium → switch → default gateway/router → remote path → destination service → return path. At each step, identify the device, protocol, addressing information, observable evidence, likely failure, and safest next diagnostic action. Memorizing labels without being able to trace a packet is not enough.
Cisco currently lists a 50-minute exam costing USD 125 and offered in English, Arabic, Chinese, Spanish, French, Japanese, and Portuguese. VERIFY CURRENT: The exam policies state that CCST certifications earned on or after July 15, 2025 are valid for five years; earlier awards do not expire. The CCST recertification section lists qualifying current exams, including any current CCST exam, and excludes Continuing Education credits. Complete renewal requirements before expiry. Some older answers in the CCST FAQ still say lifetime without a date; use its dated renewal answer together with the dedicated policy. Recheck logistics and your own certification record before booking.
The FAQ estimates about 70 hours for the free self-paced Network Technician Career Path. Separately, the objective PDF describes the target candidate as having at least 150 hours of instruction and hands-on experience. These describe different things; finishing the path is not proof of readiness, and the candidate description is not an independently verified registration prerequisite. Cisco's training overview states that its course has no prerequisite.
The canonical exam-page objective digest is unchanged. The detailed PDF was retrieved and reviewed separately because the exam-topics web interface returned a loading shell. A previously missing lifecycle-monitor baseline was explicitly initialized and then rechecked unchanged; that initialization is not a newly announced exam change.
About related items: A
Related item:callout adds prerequisite, operational, architectural, or adjacent context. It is supporting knowledge, not a claim that the item appears verbatim in the published objectives.
Objective map¶
The actual objective-domain PDF contains 25 numbered objectives: 5 / 3 / 4 / 5 / 5 / 3 across the six groups below. All supporting bullets were read and mapped. It prints no domain weights or dated revision identifier; none are invented here. The separate four-page training overview is corroborating course material, not a substitute exam blueprint. Allocate practice time from demonstrated gaps, then repeat the full map before booking.
| Topic group | Proof that you understand it |
|---|---|
| Standards and concepts | Trace encapsulation and distinguish network types, performance terms, applications, transports, and services |
| Addressing and subnet formats | Classify IPv4/IPv6 addresses and determine whether two endpoints are local or require a gateway |
| Endpoints and media types | Select and inspect endpoint, copper, fiber, wireless, connector, and interface choices |
| Infrastructure | Explain what switches, routers, access points, firewalls, services, and cloud/on-premises components do |
| Diagnosing problems | Follow a documented method, gather command/capture evidence, isolate a layer, test, and record the result |
| Security | Apply foundational confidentiality, integrity, availability, access, firewall, update, and WPA protections |
1. Standards and concepts¶
Models are troubleshooting maps¶
The OSI model separates physical, data-link, network, transport, session, presentation, and application responsibilities. The TCP/IP model commonly groups these into link/network-access, internet, transport, and application layers. Use either model to ask a practical question:
- Physical: Is the interface powered, enabled, correctly cabled, and receiving a usable signal?
- Data link: Are Ethernet frames, MAC addresses, VLAN membership, and local switching correct?
- Network: Do IP address, prefix, gateway, and routing decisions place packets on a viable path?
- Transport: Is the application using TCP or UDP and the expected port? Is a firewall permitting it?
- Application: Does DNS resolve, and does the actual service respond correctly?
Encapsulation adds information as data moves down the stack: application data becomes a TCP segment or UDP datagram, an IP packet, then a frame and bits/signals. The receiver removes those wrappers. A switch normally forwards using MAC-address information inside a local Layer 2 domain; a router forwards IP packets between networks.
Related item: A protocol data unit's name helps locate evidence. Wireshark may show frame, packet, TCP/UDP, and application fields in one capture; those are nested views of the same communication, not four unrelated transmissions.
Performance terms¶
- Bandwidth is a path's theoretical or provisioned capacity.
- Throughput is the measured transfer rate at a specified layer and measurement point; state what bytes and interval were counted.
- Goodput counts useful application payload delivered per unit time, excluding protocol overhead and duplicate retransmissions.
- Latency is delay; round-trip time includes travel out and back.
- Jitter is variation in delay and matters to voice/video.
- Packet loss forces recovery or reduces real-time quality.
A 1-Gbps access link does not guarantee 1-Gbps application throughput. A slower upstream link, contention, wireless interference, server limits, TCP behavior, encryption, loss, or latency can constrain the end-to-end result. Always measure at the appropriate point and time. An Internet speed test includes the chosen remote server and intervening path; an authorized Iperf test between controlled endpoints can isolate a narrower path. Record endpoints, direction, transport, duration and load before comparing results; a throughput result is not a universal circuit guarantee.
Network types, layouts, and delivery models¶
LAN and WLAN serve a local area; PAN connects a person's nearby devices; CAN commonly spans a campus; MAN spans a metropolitan area; WAN joins geographically separated sites. A physical topology describes cables/radios and devices; a logical topology describes traffic relationships. Star layouts centralize access, while mesh adds alternate paths at greater cost and complexity.
On-premises hosting gives an organization direct responsibility for facilities and equipment. Cloud services shift defined responsibilities to a provider but do not remove customer responsibility for identities, data, configuration, endpoints, and service use. Hybrid designs join both. The correct choice follows latency, connectivity, control, scale, security, recovery, and cost requirements. Public cloud serves customers on provider infrastructure; private cloud is dedicated to one organization; hybrid joins environments. IaaS exposes infrastructure you configure, PaaS manages more of the application platform, and SaaS supplies an application. A remote worker still depends on local Wi-Fi, an ISP, identity and an approved access path to either cloud or on-premises services.
Applications, transports, and ports¶
TCP is connection-oriented and provides ordered, acknowledged delivery; UDP has lower transport overhead and no built-in delivery/order guarantee. Applications choose according to their behavior—do not call UDP inherently unreliable at the application level, because an application can add its own recovery.
Know the purpose and usual transport/port for foundational services:
| Service | Common port(s) | Purpose and evidence |
|---|---|---|
| DNS | UDP/TCP 53 | Translate names and addresses; inspect query, answer, and chosen server |
| DHCPv4 | UDP 67/68 | Lease address, mask, gateway, and DNS information |
| HTTP / HTTPS | Commonly TCP 80 / 443; HTTP/3 uses QUIC over UDP, commonly 443 | Identify the actual transport; HTTPS protects the connection, not the truth of its content |
| SSH / Telnet | TCP 22 / 23 | Secure versus clear-text remote terminal access |
| FTP / SFTP / TFTP | FTP control TCP 21; active-mode data commonly TCP 20; SFTP TCP 22; TFTP initial request UDP 69 | FTP passive data uses a negotiated server port; SFTP uses SSH and is distinct from FTPS; TFTP transfers use selected UDP transfer IDs |
| SMTP / POP3 / IMAP | TCP 25 / 110 / 143 | Mail transfer and mailbox access; secure variants may use other ports |
| NTP | UDP 123 | Time synchronization, essential to trustworthy logs |
| SNMP | UDP 161/162 | Polling/management and traps/informs |
Related item: HTTP/3 uses QUIC over UDP; blocking UDP can cause connection failure or fallback to a TCP HTTP version. Servers can advertise a different UDP port. Do not infer application success from TCP 443 alone. ICMP carries IP control/error information and echo messages; it has no TCP/UDP port.
Port numbers identify application endpoints, not physical switch ports. A socket is commonly described by protocol plus IP address plus transport port.
2. Addressing and subnet formats¶
IPv4 decisions¶
An IPv4 address is 32 bits shown as four decimal octets. A prefix length such as /24 says how many leading bits identify the network. A subnet mask is another representation: /24 equals 255.255.255.0; /25 equals 255.255.255.128; /26 equals 255.255.255.192; /27 equals 255.255.255.224; /28 equals 255.255.255.240.
For an ordinary subnet, the network address has all host bits zero and the broadcast address has all host bits one. To decide whether a destination is local, apply the mask to both addresses. If the resulting network IDs match, use local Layer 2 delivery; otherwise use the selected route, often the default gateway. More specific configured routes can override that default.
Private IPv4 ranges are 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. They are not publicly routed on the Internet; NAT/PAT commonly translates between inside private addressing and public connectivity. 127.0.0.0/8 is loopback. An IPv4 link-local address in 169.254.0.0/16 can indicate fallback when normal DHCP configuration was unavailable. It does not establish the root cause, prove that a DHCP server is down, or imply that all other interfaces are disconnected. Check the address method, intended design, lease state and VLAN before changing anything.
Example: 192.168.10.70/26 uses blocks of 64. It belongs to network 192.168.10.64; the broadcast is .127, and the ordinary usable range is .65–.126. A host 192.168.10.120/26 is local; 192.168.10.130/26 is in the next subnet and requires routing.
Related item: Class A/B/C language still appears in foundational material, but modern routing and allocation use classless prefixes. Prefer CIDR reasoning over assuming a mask from the first octet. For ordinary IPv4 LAN subnets, usable addresses are usually 2^(32-prefix)-2; supported point-to-point /31 links use both addresses, and /32 identifies one address. Do not subtract two indiscriminately. If host A uses /24 but B uses /25, A can see B as local while B needs a route back; evaluate each endpoint's actual mask.
IPv6 recognition¶
IPv6 addresses are 128 bits, written as eight hexadecimal groups. Leading zeros in a group may be omitted, and one run of all-zero groups may be compressed with ::. Expand before comparing if compression makes the prefix unclear.
Recognize these anchors:
::1is loopback;::is unspecified.fe80::/10is link-local and does not cross routers.2000::/3covers global unicast space.ff00::/8is multicast; IPv6 does not use broadcast.- A
/64is the normal LAN prefix size for many IPv6 designs.
The prefix identifies the network portion. The default gateway is still a routing decision, and an IPv6 host can have multiple addresses. Do not diagnose solely from the presence of a link-local address.
Address assignment and supporting resolution¶
Static configuration is deliberate and persistent; DHCP provides leases dynamically. A usable host configuration normally needs address, prefix/mask, default gateway for remote networks, and DNS resolver information. ARP maps a local IPv4 next-hop address to a MAC address. IPv6 Neighbor Discovery performs related discovery and reachability work using ICMPv6. Router Advertisements establish default-router and on-link-prefix information; address assignment via DHCPv6 is a separate concern. A working link-local address or assigned global address alone does not prove a default route exists. Check route and neighbor evidence instead of broadly blocking ICMPv6.
When a user says “the Internet is down,” separate:
- Does the interface have an expected address and prefix?
- Can it reach its own gateway by IP?
- Can it reach a remote IP?
- Can DNS resolve the desired name?
- Can the application reach its service and port?
That order distinguishes local, routed, naming, and application failures.
3. Endpoints and media types¶
Endpoints include workstations, phones, printers, servers, cameras, sensors, and mobile devices. They differ in interface type, power, operating system, address method, mobility, and security capability. Document the expected network and policy before connecting one.
Copper, fiber, and radio¶
Twisted-pair copper Ethernet commonly uses an eight-position modular connector often called RJ-45. Category, negotiated speed, maximum supported distance, termination, electromagnetic interference, and damage matter. Fiber uses light, supports longer distance and electrical isolation, and may be single-mode or multimode; transceiver type, wavelength, connector, polarity, and cleanliness must match.
Wi-Fi uses radio and a shared medium. Signal strength alone is not quality: interference, channel use, client density, band, distance, obstacles, authentication, and backhaul capacity all matter. Cellular access depends on carrier radio coverage and service. Wired access usually offers stable dedicated link characteristics but limits mobility.
Patch panels organize permanent cabling; patch cables join panels, switches, and endpoints. A console connection is for device management, not user data forwarding. Ethernet switch ports, router interfaces, SFP/SFP+ transceiver cages, USB, serial/console, and power connectors serve different purposes. Read the diagram and labels before inserting a cable. Distinguish smaller RJ-11 telephone connectors, coaxial connections and fiber connectors such as LC/SC from copper Ethernet. PoE supplies supported devices through Ethernet cabling, but connector fit does not establish compatible power, available budget or negotiated link speed. Trace the intended rack, patch-panel and switch-port labels before moving a connection.
VERIFY CURRENT: The blueprint includes Wi-Fi in 2.4, 5 and 6 GHz bands and licensed cellular service. Actual band/channel availability depends on regional rules and both client and access-point support. Choose compatible SSID, authentication method and WPA mode; signal strength does not prove successful authentication or usable IP configuration.
Endpoint evidence¶
Useful read-only commands include:
| Platform | Address/interface | Reachability/path | Name and connection evidence |
|---|---|---|---|
| Windows | ipconfig /all |
ping, tracert |
nslookup, netstat -ano |
| Linux | ip address, ip route |
ping, tracepath or traceroute |
dig/nslookup, ss -tupn |
| macOS | Network settings, ifconfig, route -n get default |
ping, traceroute |
dig, netstat/lsof |
Android and iOS settings show SSID, IP details, privacy address behavior, and cellular/Wi-Fi state. Exact labels vary by release. Record outputs and timestamps; do not paste secrets or personal data into tickets.
Interface LEDs are model-specific evidence. A dark LED might mean no power, disabled interface, bad cable, inactive peer, or model-specific behavior. Color and blink rate can represent link, speed, activity, PoE, faults, or boot state—use the device documentation rather than guessing.
4. Infrastructure¶
A hub repeats signals and shares a collision domain. A Layer 2 switch learns source MAC addresses and forwards frames by destination MAC within VLANs. A router/Layer 3 switch selects paths between IP networks. An access point bridges wireless clients into a network. A firewall permits or denies traffic using policy and state; it does not automatically make every permitted application safe. A modem/ONT converts provider access signaling, while a home gateway may combine routing, switching, wireless, NAT, DHCP, DNS forwarding, and firewall functions.
Switching and routing basics¶
When a switch receives a frame, it learns the source MAC on the incoming port. If the destination is known, it forwards toward that port; an unknown unicast or broadcast is flooded within the relevant broadcast domain, not across a router by default. VLANs create separate logical Layer 2 domains on shared switching hardware. MAC filtering permits or denies selected link addresses; those addresses can be changed or impersonated, so a MAC allowlist does not establish a person's identity. A VLAN usually pairs with an IP subnet in a design, but VLAN membership and IP configuration are separate facts to verify.
A host sends remote traffic to its default gateway's local MAC address while retaining the remote destination IP. The router removes the incoming frame, consults its routing table, decrements the IPv4 TTL or IPv6 hop limit, and builds a new frame for the next link. Each hop changes link-layer addressing; end-to-end IP addressing normally remains unless translation occurs.
Related item: A routing table chooses the most specific matching prefix, then uses route preference/metric rules. CCST requires basic routing reasoning; detailed dynamic-routing configuration belongs later in CCNA-level study.
Safe Cisco device inspection¶
Console provides local out-of-band-style access; SSH provides encrypted remote CLI access; Telnet is clear text and should not be selected when SSH is available. Web interfaces, controllers, APIs, and network-management platforms are other access/data methods. Use authorized credentials and start with observation. RDP supplies a remote desktop; SSH supplies an encrypted terminal or other SSH service; a VPN protects an access path and does not automatically authorize every resource. A terminal emulator can use a local console connection. A management system or cloud-managed platform such as Meraki centralizes selected inventory and telemetry; verify device identity and observation time. Scripts collect repeatable evidence but retain the permissions and failure risks of their account.
Common read-only Cisco IOS-style commands include:
show interfaces statusandshow interfacesfor link, state, counters, errors, speed, and duplex;show ip interface brieffor interface/address/status summary;show mac address-tablefor learned MAC locations;show arpfor IPv4 neighbor mappings;show ip routefor known IPv4 routes;show cdp neighborsfor directly discovered Cisco neighbors, with visibility depending on CDP and platform configuration;show version,show inventoryand supportedshow switchoutput for software, hardware identity and stack membership;show running-config(show run) only when authorized, because output can expose sensitive configuration.
VERIFY CURRENT: Commands and output vary by device family, image, role and privilege. Use command help (?) and completion in the chosen lab image; a missing command or denied privilege is not proof that a device feature is broken. The objective PDF names these command families; no live Cisco CLI execution is claimed here.
Interpret evidence together. “Administratively down” differs from a physical down state. Increasing CRC/input errors suggests a different path than a valid link with no route. A learned MAC on the wrong port may indicate topology/documentation or cabling issues.
5. Diagnosing problems¶
Use a repeatable method:
- Define impact, scope, expected state, start time, recent change, and reproduction steps.
- Gather endpoint, link, address, gateway, DNS, path, service, device, and log evidence.
- Form the narrowest testable hypothesis.
- Plan a safe test and rollback; obtain authorization for changes.
- Change one controlled variable or run a non-mutating test.
- Observe whether the result supports the hypothesis.
- Escalate with evidence when ownership, privilege, risk, or complexity exceeds your role.
- Restore service, validate with the user/monitoring, and document cause, action, evidence, and prevention.
Do not reboot or replace components before collecting volatile evidence unless safety or an approved restoration procedure requires it. Correlation is not cause: a recent change is a lead to test.
Diagnostic tools¶
pingtests ICMP reachability and timing when ICMP is allowed; a failed ping does not prove the target is down.tracert/traceroutereveals responding hops and where responses cease; filtering and asymmetric paths affect interpretation.ipconfig,ip,ifconfig, and route tools reveal local configuration.nslookup/digtests DNS independently of the application.netstat/ssshows listeners and connections.- Wireshark captures frames visible at the selected interface and observation point. Use the distinct capture/display filters described below, reproduce once, record time, and protect credentials/content.
A three-way TCP handshake is SYN → SYN/ACK → ACK. Repeated SYNs without SYN/ACK point toward path, policy, service, or return-path trouble; a reset is different evidence. DNS query with no response differs from a valid “name does not exist” response.
Tickets should record asset/user, time zone, impact/scope, symptoms, expected versus actual state, topology/context, sanitized outputs, tests, changes/approvals, result, next owner, and closure validation. A concise timeline is more useful than “network fixed.” Prioritize by business impact, affected users and urgency; preserve an escalation owner and next update time.
Capture evidence without confusing filters¶
A capture filter decides what is collected, using libpcap syntax. In an authorized lab with client 192.0.2.10, host 192.0.2.10 and port 53 selects conventional DNS TCP/UDP traffic for that address. It excludes unrelated traffic, ARP and encrypted DNS on other ports; a missing packet may be outside the filter or observation point.
A display filter, such as ip.addr == 192.0.2.10 and dns, changes the visible subset of an existing capture. Clearing it can reveal collected packets, but cannot recover packets excluded at capture time. For SYN-bearing packets, use tcp.flags.syn == 1; the field's mere presence is not a test that its bit is set. Verify the selected export subset instead of assuming a display filter sanitizes the saved file.
Stop the capture, save the required .pcap format when supported by the chosen link type, reopen it and check timestamps, packet count and a known exchange. Retain the original and a separately sanitized sharing copy. Wireshark's default file format and menu labels can vary; verify the file type rather than renaming an extension.
Checksum offloading can make locally captured outgoing packets appear to have incomplete or invalid checksums before the NIC finishes them. Compare capture location, protocol preferences and receiving-side evidence before declaring corruption or changing offload settings. A checksum detects some accidental damage; it does not authenticate a sender. The local byte exercise below creates complete synthetic checksums and does not reproduce offloading.
6. Security¶
Confidentiality limits disclosure, integrity protects correctness, and availability keeps authorized services usable. Authentication establishes identity; authorization controls allowed action; accounting/auditing records activity. Least privilege, unique identities, multifactor authentication, secure defaults, updates, backups, segmentation, and logging reduce risk in different ways.
Firewalls filter by properties such as addresses, protocols, ports, direction, zone, application, and connection state. A rule permitting TCP 443 allows that protocol/port under its other conditions; it does not cover every HTTPS transport or validate the site's legitimacy and content. Check source, destination, direction, protocol, port and return-state behavior, then test both intended and denied access. Default-deny boundaries require explicit justified access.
Prefer WPA3 where supported or WPA2 with AES when compatibility requires it; avoid deprecated WEP and weak shared secrets. Change vendor-default administrator credentials, use a long unique passphrase, update firmware, separate guest/untrusted devices, disable unnecessary remote administration and insecure convenience features, and document recovery access. Enterprise wireless may use individual identities and centralized AAA instead of one shared key. Explain Personal versus Enterprise by credential ownership and authentication infrastructure, not by signal strength. Encryption protects data under its key and endpoint assumptions. Certificate validation checks the expected identity and trust chain; do not train users to bypass warnings. An identity store such as Active Directory holds identity information and supports access processes; authentication still differs from authorization.
Social engineering, phishing, malware, password attacks, unpatched vulnerabilities, misconfiguration, rogue access, eavesdropping, and denial of service can affect a network. A support technician should preserve evidence, follow incident procedures, and escalate—not investigate beyond authorization or upload captures/configurations to unapproved services.
Integrated scenarios¶
Scenario 1: One user cannot reach an internal site¶
Confirm whether other users and sites work. Inspect link and IP configuration, then test loopback, own address, gateway, internal server IP, DNS resolution, and TCP service in that order. If IP works but name fails, capture resolver/server/error evidence. If the gateway fails, inspect local VLAN, Wi-Fi association, cabling, DHCP, and neighbor evidence. Document every comparison before escalation.
Scenario 2: A meeting room has intermittent video¶
Separate reachability from quality. Record time, clients, SSID, band/channel, signal, loss, latency, jitter, link rate, utilization, and whether wired comparison improves the call. Check interference/client density and upstream constraints; do not conclude “low bandwidth” from one speed test. Propose the least disruptive authorized correction and validate under similar load.
Scenario 3: A new printer works locally but not from another subnet¶
Confirm its address, mask, gateway, VLAN, DHCP reservation/static plan, and local reachability. Compare a working printer. If same-subnet clients succeed but remote clients fail, inspect gateway/routing/firewall policy rather than repeatedly changing cabling. Confirm the print service port and return path, then document the final configuration and access boundary.
Hands-on evidence labs¶
PRACTICAL DEPTH: These eight Packet Tracer/device/OS/Wireshark labs are proposed, not executed in this review. Use an isolated topology and authorized traffic. Keep a before/after worksheet, expected failure, observations and restoration evidence for each lab. Do not change a working household or business network to manufacture faults.
- Packet journey. Build client–switch–router–server networks in a simulator. Predict both directions before sending traffic. Record IP and MAC addresses before/after the router, TTL/hop limit and the ARP/ND next hop. Remove only a disposable return route: show why an outbound packet alone does not prove success. Restore the route and retain the diagram plus comparison.
- Subnet proof. Calculate mask, network, broadcast and host range for
/24through/28; include10.20.30.141/27. Verify ten cases using a calculator or the local workbook. Introduce/24versus/25masks in a disposable pair and predict the asymmetric local/remote decisions. Treat/31point-to-point and/32host routes separately. Restore both masks and explain each discrepancy. - Dual-stack inventory. Collect sanitized address, prefix, route, DNS and interface state on an available Windows/Linux/macOS endpoint; separately inspect Android/iOS Wi-Fi settings where available. Label unavailable platforms as untested. Compare an authorized isolated static configuration with DHCP, including DNS and gateway; capture before/after and restore the original method. Explain why IPv6 link-local presence alone does not prove routed access.
- Service ladder. In the disposable network, compare local IP, gateway, remote IP, explicit DNS query and the actual application. Break only the lab resolver setting and record DNS failure alongside working IP access; restore it. Separately block ICMP in the lab while allowing the application to show why failed ping alone is inconclusive. Restore the rule and keep timestamps and return-path evidence.
- Capture and reopen. Capture a lab DNS query and a deliberately selected TCP HTTPS connection. Record interface, capture filter and time, then identify nested Ethernet/IP/UDP or TCP fields. Separately observe HTTP/3 if supported and label it UDP/QUIC; absence is not a failed TCP handshake. Compare a DNS negative response with no response. Stop, save, reopen and verify
.pcapevidence; show what clearing a display filter reveals. Keep credentials and real user traffic out of the exercise. - Switch evidence. Use an available simulated IOS image or authorized equipment. Save interface state/counters, MAC/ARP tables, route, neighbor, software and inventory evidence. Explain command availability and privilege errors. Move one lab endpoint to the wrong VLAN, compare evidence, then restore it. Do not reset counters before preserving the baseline; no missing CDP neighbor alone proves a failed cable.
- Wi-Fi security and recovery. On a disposable AP/router, inventory firmware, administrator access, Personal/Enterprise mode, guest isolation, remote management and recovery access. Test one authorized compatible client and one wrong-credential attempt; verify intended guest restrictions separately from Internet access. Preserve a configuration backup and recovery method before changes, then restore the agreed baseline. A MAC filter is not a replacement for secure authentication.
- Trouble ticket. Have a learner introduce one documented fault in an isolated topology: mask, VLAN, gateway, DNS or a service rule. Another learner records impact/priority, expected state, evidence, hypothesis, safe test, result and escalation threshold. Compare with the hidden fault, restore it and obtain closure verification. Grade the explanation and retained evidence as well as the fix.
Executed local packet and subnet workbook¶
Save this original Python program and run it with Python 3. It needs only the standard library. The exact public code was executed during this review and passed 40 checks, including subnet boundaries, longest-prefix selection, an asymmetric mask pair, byte-encoded ARP, routed frame addresses, TTL and checksums, truncated/corrupted data, and DNS negative response versus no observation. Output includes subnet 10.20.30.128/27, 30 ordinary hosts, ARP target 192.0.2.1, remote IP 203.0.113.53, TTL 64 → 63, and a 75-byte synthetic frame without Ethernet FCS.
The IPv4 header specification, ARP format, UDP checksum definition and DNS header fields provide the field semantics. This code is a small teaching implementation: untagged Ethernet, IPv4 without options or fragmentation, UDP and a fixed DNS question. It is not a general packet parser, DNS resolver, router or capture tool. The negative DNS fixture has no SOA or validated denial and is not a DNSSEC/cache implementation. None means no response was observed by the fixture, not proof of a live timeout.
No sockets, network traffic, interface capture, device configuration, service changes or file writes occur. The program builds and inspects bytes in memory; it does not create a .pcap, execute Wireshark filters, authenticate endpoints, measure performance, test wireless, or generate ICMP for expired TTL. IPv4 permits an omitted UDP checksum, which the parser reports as absent; do not extend that rule to ordinary IPv6 UDP. All 40 checks include structural as well as behavioral assertions and do not establish production robustness.
"""Synthetic bytes only: no sockets, captures, device commands, or file writes."""
import ipaddress as ip
import json
import struct
checks = 0
def check(condition):
global checks
assert condition
checks += 1
def rejects(function, *args):
try:
function(*args)
except ValueError:
check(True)
else:
raise AssertionError('Expected rejection')
def checksum(data):
padded = data + (b'\x00' if len(data) % 2 else b'')
total = sum(struct.unpack('!' + 'H' * (len(padded) // 2), padded))
while total >> 16:
total = (total & 0xffff) + (total >> 16)
return (~total) & 0xffff
def ipv4(payload, source, destination, ttl=64):
header = struct.pack('!BBHHHBBH4s4s', 0x45, 0, 20 + len(payload),
7, 0x4000, ttl, 17, 0, source, destination)
return header[:10] + struct.pack('!H', checksum(header)) + header[12:] + payload
def parse_ipv4(packet):
# Deliberately limited to this unfragmented, option-free UDP exercise.
if len(packet) < 20 or packet[0] != 0x45:
raise ValueError('Unsupported or truncated IPv4 header')
length, = struct.unpack('!H', packet[2:4])
flags, = struct.unpack('!H', packet[6:8])
if flags & 0xbfff or packet[9] != 17:
raise ValueError('Unsupported flags, fragmentation, or protocol')
if length < 28 or length > len(packet) or checksum(packet[:20]):
raise ValueError('Length or IPv4 header checksum failed')
return dict(ttl=packet[8], source=packet[12:16], destination=packet[16:20],
udp=packet[20:length], packet=packet[:length])
def udp(payload, source, destination):
length = 8 + len(payload)
header = struct.pack('!HHHH', 53000, 53, length, 0)
pseudo = source + destination + struct.pack('!BBH', 0, 17, length)
value = checksum(pseudo + header + payload) or 0xffff
return header[:6] + struct.pack('!H', value) + payload
def parse_udp(fields):
data = fields['udp']
if len(data) < 8:
raise ValueError('Short UDP header')
source_port, destination_port, length, value = struct.unpack('!HHHH', data[:8])
pseudo = fields['source'] + fields['destination'] + struct.pack('!BBH', 0, 17, length)
if length != len(data) or length < 8 or (value and checksum(pseudo + data)):
raise ValueError('UDP length or checksum failed')
return source_port, destination_port, data[8:], bool(value)
def ethernet(payload, source_mac, destination_mac, kind=0x0800):
frame = destination_mac + source_mac + struct.pack('!H', kind) + payload
return frame.ljust(60, b'\x00') # Minimum frame bytes excluding Ethernet FCS.
def forward(frame, router_mac, next_mac):
if len(frame) < 14 or frame[12:14] != b'\x08\x00':
raise ValueError('Expected untagged Ethernet IPv4')
fields = parse_ipv4(frame[14:])
if fields['ttl'] <= 1:
return None # Teaching boundary: no actual ICMP reply is generated.
packet = ipv4(fields['udp'], fields['source'], fields['destination'], fields['ttl'] - 1)
return ethernet(packet, router_mac, next_mac)
def next_hop(destination, routes):
target = ip.ip_address(destination)
matches = [(ip.ip_network(prefix), hop) for prefix, hop in routes
if target in ip.ip_network(prefix)]
return max(matches, key=lambda item: item[0].prefixlen)[1] if matches else None
def dns_result(message):
if message is None:
return 'no response observed'
if len(message) < 12:
raise ValueError('Short DNS header')
flags, = struct.unpack('!H', message[2:4])
if not flags & 0x8000:
return 'query'
return {0: 'NOERROR', 2: 'SERVFAIL', 3: 'NXDOMAIN', 5: 'REFUSED'}.get(flags & 15, 'other')
net = ip.ip_interface('10.20.30.141/27').network
check(str(net.network_address) == '10.20.30.128')
check(str(net.broadcast_address) == '10.20.30.159')
check(str(net.netmask) == '255.255.255.224')
check((str(next(net.hosts())), str(list(net.hosts())[-1]), len(list(net.hosts())))
== ('10.20.30.129', '10.20.30.158', 30))
check(ip.ip_address('10.20.30.150') in net)
check(ip.ip_address('10.20.30.160') not in net)
check(len(list(ip.ip_network('192.0.2.0/31').hosts())) == 2)
check(len(list(ip.ip_network('192.0.2.4/32').hosts())) == 1)
a, b = ip.ip_interface('10.1.1.10/24'), ip.ip_interface('10.1.1.150/25')
check(b.ip in a.network and a.ip not in b.network)
routes = [('0.0.0.0/0', 'default'), ('203.0.113.0/24', 'specific'),
('203.0.113.53/32', 'host-route')]
check(next_hop('203.0.113.53', routes) == 'host-route')
check(next_hop('203.0.113.54', routes) == 'specific')
check(next_hop('198.51.100.7', routes) == 'default')
check(next_hop('198.51.100.7', routes[1:]) is None)
source, destination = ip.ip_address('192.0.2.10').packed, ip.ip_address('203.0.113.53').packed
gateway = ip.ip_address('192.0.2.1').packed
client_mac = bytes.fromhex('020000000010')
gateway_mac = bytes.fromhex('020000000001')
router_mac = bytes.fromhex('020000000002')
next_mac = bytes.fromhex('020000000003')
arp = struct.pack('!HHBBH6s4s6s4s', 1, 0x0800, 6, 4, 1,
client_mac, source, bytes(6), gateway)
arp_frame = ethernet(arp, client_mac, bytes.fromhex('ffffffffffff'), 0x0806)
check(len(arp_frame) == 60 and arp_frame[:6] == bytes.fromhex('ffffffffffff'))
check(arp_frame[12:14] == b'\x08\x06')
arp_fields = struct.unpack('!HHBBH6s4s6s4s', arp_frame[14:42])
check(arp_fields[:5] == (1, 0x0800, 6, 4, 1))
check(arp_fields[-1] == gateway and arp_fields[-1] != destination)
check(arp_fields[5:7] == (client_mac, source))
question = b'\x07missing\x07example\x00' + struct.pack('!HH', 1, 1)
query = struct.pack('!6H', 1234, 0x0100, 1, 0, 0, 0) + question
datagram = udp(query, source, destination)
packet = ipv4(datagram, source, destination)
frame = ethernet(packet, client_mac, gateway_mac)
fields = parse_ipv4(frame[14:])
check(frame[:6] == gateway_mac and fields['destination'] == destination)
check(checksum(packet[:20]) == 0)
ports = parse_udp(fields)
check(ports[:2] == (53000, 53))
check(ports[2] == query and ports[3])
check(dns_result(query) == 'query')
outgoing = forward(frame, router_mac, next_mac)
after = parse_ipv4(outgoing[14:])
check(outgoing[:12] == next_mac + router_mac)
check(after['source'] == source and after['destination'] == destination)
check(after['ttl'] == 63 and fields['ttl'] == 64)
check(checksum(outgoing[14:34]) == 0 and outgoing[24:26] != frame[24:26])
check(after['udp'] == fields['udp'] and parse_udp(after) == ports)
check(forward(ethernet(ipv4(datagram, source, destination, 1), client_mac, gateway_mac),
router_mac, next_mac) is None)
rejects(parse_ipv4, packet[:19])
rejects(parse_ipv4, packet[:-1])
corrupt_header = bytearray(packet)
corrupt_header[8] ^= 1
rejects(parse_ipv4, bytes(corrupt_header))
corrupt_payload = packet[:-1] + bytes([packet[-1] ^ 1])
check(checksum(corrupt_payload[:20]) == 0) # IPv4 header checksum excludes payload.
rejects(parse_udp, parse_ipv4(corrupt_payload))
without_checksum = datagram[:6] + b'\x00\x00' + datagram[8:]
check(parse_udp(parse_ipv4(ipv4(without_checksum, source, destination)))[3] is False)
negative = struct.pack('!6H', 1234, 0x8583, 1, 0, 0, 0) + question
check(dns_result(negative) == 'NXDOMAIN')
check(dns_result(None) == 'no response observed')
rejects(dns_result, negative[:11])
check(ip.ip_address('fe80::1').is_link_local)
check(ip.ip_address('ff02::1').is_multicast)
print(json.dumps(dict(subnet=str(net), ordinary_hosts=30, arp_target=str(ip.ip_address(gateway)),
remote_destination=str(ip.ip_address(destination)), ttl_before=64, ttl_after=63,
dns_negative=dns_result(negative), frame_bytes=len(frame))))
print(f'{checks} local checks passed')
Readiness checks¶
These are 48 original study prompts with answer guidance, not recalled exam items. Explain the mechanism before checking the answer; complete the proposed evidence tasks separately.
- How does bandwidth differ from throughput, goodput, latency, jitter, and loss?
Answer: Bandwidth is capacity; throughput is measured transfer at a stated layer; goodput is useful delivered application payload. Latency is delay, jitter its variation, and loss the missing fraction. Report endpoints, interval and units.
- Trace encapsulation from an HTTPS application to transmitted bits.
Answer: Application data is carried in transport, IP and link framing, then signals. Traditional HTTPS uses TLS over TCP; HTTP/3 uses secured QUIC over UDP. Identify the actual transport before looking for a TCP handshake.
- What does a switch learn from the source MAC, and how does it handle an unknown destination?
Answer: It learns the source MAC on the ingress port in that VLAN. Unknown unicast is flooded to eligible ports in that VLAN except the ingress; this is not routing across VLANs.
- When does a host use its default gateway?
Answer: It selects a route for the destination. An on-link destination uses local neighbor resolution; a remote destination commonly uses the default gateway unless a more specific route applies.
- Compare LAN, WLAN, PAN, CAN, MAN, and WAN using one real example each.
Answer: LAN: an office floor; WLAN: its wireless LAN; PAN: nearby personal devices; CAN: a campus; MAN: a metropolitan service; WAN: linked distant sites. Geography and access medium are different dimensions.
- Compare on-premises, cloud, and hybrid responsibility without saying cloud removes customer responsibility.
Answer: On-premises retains facilities/equipment duties; IaaS/PaaS/SaaS shift different layers to the provider. Customers retain relevant identity, data and configuration duties. Hybrid connectivity adds dependencies rather than removing responsibility.
- When would an application favor TCP, and when might it favor UDP?
Answer: TCP suits ordered byte delivery and recovery; UDP suits applications choosing their own timing/recovery. QUIC is an example of higher-layer reliability over UDP; neither choice guarantees application success.
- Match DNS, DHCP, HTTP(S), SSH, Telnet, NTP, SNMP, and file-transfer protocols to purpose and common port.
Answer: DNS53 UDP/TCP, DHCPv4 UDP67/68, HTTP TCP80, common HTTPS TCP443 or QUIC UDP443, SSH22/Telnet23 TCP, NTP123 UDP, SNMP161/162 UDP. FTP uses control21 and mode-dependent data; SFTP uses SSH22; TFTP starts at UDP69. ICMP has no transport port.
- Convert
/25,/26,/27, and/28to masks.
Answer: They are 255.255.255.128, 255.255.255.192, 255.255.255.224 and 255.255.255.240 respectively; show the contiguous leading one bits.
- For
10.20.30.141/27, determine network, broadcast, and ordinary usable range.
Answer: The /27 block size is32. Network10.20.30.128, broadcast10.20.30.159, ordinary hosts10.20.30.129–158, count30.
- List all RFC 1918 ranges and explain why private does not mean secure.
Answer: 10/8, 172.16/12 and 192.168/16 are private. Routing scope is not authentication, encryption or a firewall policy; private traffic can still be exposed or malicious.
- What evidence does a
169.254.x.xaddress provide, and what does it not prove?
Answer: It can show IPv4 link-local fallback. Inspect the configured method, lease, VLAN and interface; it does not identify the fault or prove every interface lacks service.
- Expand and classify
fe80::21a:2bff:fe3c:4d5e.
Answer: fe80:0000:0000:0000:021a:2bff:fe3c:4d5e is link-local. It serves the local link and requires interface context when ambiguous.
- Why can an IPv6 host have link-local and global addresses simultaneously?
Answer: Addresses serve different scopes and lifetimes. Link-local supports local discovery; a global address can support routed traffic when routes and policy permit. Neither alone proves end-to-end access.
- Distinguish ARP, Neighbor Discovery, DHCP, DNS, and NAT.
Answer: ARP resolves an IPv4 local next hop to link addressing; IPv6 ND includes neighbor/router discovery; DHCP supplies configuration; DNS supplies naming records; NAT translates addressing and sometimes ports.
- Select copper, multimode fiber, single-mode fiber, or Wi-Fi for four justified scenarios.
Answer: For example, supported short desk runs use copper, compatible short optical runs may use multimode, longer optical paths may use single-mode, and mobile clients use Wi-Fi. Verify distance, interface/optics, power, environment and supported performance.
- Why are connector shape, transceiver type, wavelength, polarity, and cleanliness separate checks?
Answer: Mechanical fit does not prove optical/electrical compatibility. A matched connector with the wrong optics, crossed polarity or dirty fiber can still fail.
- What can an interface LED suggest, and why must you consult model documentation?
Answer: A light can indicate link/activity/speed/power/fault states depending on model and mode. Compare the model legend with interface output and peer evidence before assigning a cause.
- Gather address, route, DNS, and active-connection evidence on your operating system.
Answer: Use the platform table to collect actual sanitized outputs with timestamps; identify address method, prefix, default route, resolver and socket state. A written sample answer cannot substitute for this lab evidence.
- Explain a hub, switch, router, access point, firewall, modem/ONT, and multifunction home gateway.
Answer: A hub repeats; a switch forwards within Layer2; a router routes between networks; an AP bridges wireless; a firewall enforces policy; modem/ONT terminates provider signaling; a home gateway combines several roles.
- What happens to MAC and IP addressing as a packet crosses a router?
Answer: The routed link receives a new frame with new link addresses. IP source/destination normally persist without NAT, TTL/hop limit decreases, and IPv4 header checksum changes. Verify the return path too.
- Why are VLAN and IP subnet related but not identical concepts?
Answer: VLAN is a Layer2 forwarding boundary; subnet is an IP prefix boundary. A design often pairs them, but the host mask cannot repair a wrong switch VLAN.
- Interpret
up/up, physical down, and administratively down as different starting points.
Answer: On relevant IOS-style output, up/up indicates interface/protocol operational state; physical down prompts link/peer/cabling checks; administratively down indicates disabled configuration. None alone proves application health.
- Which Cisco
showoutputs would you collect for a suspected local link issue, and why?
Answer: Collect interface status/details and counter changes with time, plus MAC location and the diagram. Add brief address state, ARP, route, CDP and inventory when they narrow the hypothesis; preserve sensitive configuration appropriately.
- Compare console, SSH, Telnet, web, API, and controller access from function and security perspectives.
Answer: Console is local management; SSH encrypts remote access; Telnet does not; web/API/controller access depends on authentication and transport controls. RDP is a remote desktop and a VPN is a protected path, not a blanket permission grant.
- Apply the eight-step troubleshooting method to “the network is slow.”
Answer: Define who/what/when, prioritize impact, preserve baseline, compare wired/wireless and local/remote behavior, form a narrow hypothesis, run a safe test, restore/validate and document or escalate. Do not prescribe a reboot from the symptom alone.
- How do you distinguish a DNS failure from IP-path failure?
Answer: Query the intended resolver and compare IP access to the required application. NXDOMAIN is a response, while no observed response can reflect path/filter/capture loss; neither justifies changing DNS blindly.
- What do repeated SYNs, a reset, and a completed handshake each suggest?
Answer: Repeated SYNs lack a visible successful response; a reset actively rejects or terminates; a completed handshake proves that TCP exchange at that moment. None alone proves application, authentication or payload success.
- Why might traceroute stop even when the final application works?
Answer: Intermediate devices may filter or rate-limit diagnostic replies; paths may differ by direction or protocol. Test the actual application and avoid treating the last responding hop as the proven fault.
- Design a narrow authorized Wireshark capture that minimizes sensitive data.
Answer: Choose an authorized interface, narrow capture filter, short interval and synthetic action; stop and verify saved contents. Display filtering only changes what is shown, and encrypted DNS/QUIC can require different protocol expectations.
- Write a useful ticket timeline for an intermittent wireless incident.
Answer: Record time zone, room/client count, SSID/band, symptoms and business impact, measurements, wired comparison, changes, outcomes, owner and next update. Remove personal data while preserving the diagnostic timeline.
- Distinguish authentication, authorization, accounting, confidentiality, integrity, and availability.
Answer: Authentication establishes identity; authorization grants actions; accounting records them. Confidentiality limits disclosure, integrity guards against unauthorized alteration, and availability supports timely authorized use.
- Why does permitting TCP 443 not make all resulting traffic trustworthy?
Answer: The rule permits a transport/port under policy conditions. Malicious content can use allowed encrypted connections, and HTTP/3 may use UDP. Certificate validation and endpoint/application controls solve additional problems.
- Build a defensible home Wi-Fi baseline with recovery and rollback.
Answer: Choose compatible WPA3 or WPA2-AES, unique admin credentials and passphrase, current supported firmware, necessary administration only, guest separation and tested recovery. Keep a backup and a restoration path before changing the lab router.
- When should an entry-level technician escalate rather than continue testing?
Answer: Escalate when privilege, ownership, safety, incident handling or scope exceeds the role, or evidence requires another team. Supply observations, attempted tests and impact rather than guessing at a disruptive fix.
- Given an unfamiliar scenario, can you state expected state, evidence, hypothesis, safe test, result, and next action?
Answer: State the expected packet path and measurable outcome, cite observations, choose one falsifiable hypothesis and bounded test, interpret its result, then restore, document and assign the next action. Mark untested assumptions explicitly.
- Does every IPv4 subnet lose two usable addresses?
Answer: No. Ordinary LAN arithmetic has exceptions: supported /31 point-to-point links use two hosts; /32 denotes a single address.
- How can mismatched masks break only one direction?
Answer: Each host classifies destinations using its own prefix. A /24 host may ARP locally for a peer that, with /25, tries to route the response.
- For remote IPv4 traffic, which IP does a host ARP for?
Answer: The selected on-link next hop, commonly its gateway, rather than the remote destination. The original remote IP remains in the IP packet absent translation.
- What wins between a default route and a matching /32?
Answer: The /32 is more specific. Route preference and metric distinguish eligible alternatives after the prefix-selection question; a valid forward route alone does not establish return connectivity.
- Why can damaged payload pass the IPv4 header checksum?
Answer: That checksum covers the header only. The exercise leaves the header intact while altering payload and demonstrates UDP checksum rejection.
- Does a zero UDP checksum have the same meaning for IPv4 and IPv6?
Answer: For IPv4 it can indicate an omitted checksum; ordinary IPv6 UDP requires one. The local parser is IPv4-only and reports checksum absence rather than integrity proof.
- What does clearing a display filter recover?
Answer: It reveals previously collected hidden packets. It cannot recover packets excluded by a capture filter, lost before capture, or outside the observation point.
- Is tcp.flags.syn equivalent to tcp.flags.syn == 1?
Answer: No. The field can be present when the bit is zero; compare its value to identify SYN-bearing packets.
- Why can a local outgoing capture show a bad checksum?
Answer: The NIC may complete an offloaded checksum after the capture point. Compare receiving-side evidence and settings before asserting wire corruption.
- What establishes an IPv6 default router?
Answer: Router Advertisements normally supply discovery information. Address assignment, neighbor reachability and default routing are separate checks.
- Can a MAC allowlist replace wireless identity verification?
Answer: No. A device can change or impersonate its MAC. Use the required wireless authentication, encryption and access policies.
- Does every CCST certification last a lifetime?
Answer: No. Awards before July15,2025 remain non-expiring; awards on or after that date are valid five years under the checked policy. CCST renewal does not use Continuing Education credits.
Places to learn¶
This is not a complete list. Choose resources for your current gaps; the official objectives remain the scope authority. Public listings were compared on September 29, 2026. All ranges marked “editorial” are planning budgets, not provider durations or completion guarantees. No paid lessons, book interiors, provider labs or proprietary practice questions were accessed.
| Resource | Access | Estimated time |
|---|---|---|
| Cisco exam page and full objective PDF | Public; primary scope and logistics | 30–60 min editorial review; no published domain weights |
| Network Technician Career Path | Free self-paced account; first-party preparation | About70 h per Cisco FAQ; current path page exposed only a shell, so the earlier 22+22+14+12 breakdown was not reverified |
| NetAcad public catalog / Packet Tracer introduction | Public catalog; learning/download may require account | Networking Basics22 h and Getting Started With Cisco Packet Tracer2 h listed; add your own practice |
| Cisco course outline and training PDF | Public;25 training objectives/13 outline parts; PDF copyright2024 | 20–40 min editorial mapping; course outline is distinct from exam objectives |
| Russ White's Official Cert Guide, Cisco Press | Paid; public listing Dec2,2023,608 pages, first edition; original-blueprint coverage/update program | No total study duration verified; listing advertises more than5 h mentoring, not the total book workload |
| Networking Essentials Lab Manual v3 | Paid; Cisco Networking Academy, Oct21,2023, second edition224 pages;45 labs advertised | No completion duration published in reviewed metadata; verify required topology/tools before buying |
| MeasureUp CCST Networking practice test | Paid; public catalog150 questions, June2023 release, practice/certification modes | 3–6 h editorial diagnostic/review budget; vendor question distribution is not official exam weighting |
| Official Cert Guide on O'Reilly and Sybex alternative | Paid; both current automated fetches403 | Earlier17 h44 /12 h25 reading estimates could not be reverified; confirm editions and access directly |
| Udemy CCST Networking lab course | Paid; current automated fetch403 | Earlier5 h14 and2026 update claims could not be reverified; check current outline, demonstrations and reviews |
| This guide's original workbook, eight proposed labs and48 answered checks | Public; workbook executed40 checks; live/simulator labs pending | 12–20 h editorial practice budget, adjusted to evidence gaps |
The MeasureUp listing's150-item bank allocates30/18/24/30/30/18 questions across domains; this is the provider's practice distribution, not a Cisco blueprint weighting. Its pass guarantees and readiness claims were not independently validated. The Cisco Press and lab-manual listings provide publication and scope metadata, not evidence that their paid contents or every current objective were reviewed here. Verify current editions, access and fit before purchase.
Use legitimate practice to explain errors and produce lab evidence. Avoid recalled/live exam items, answer-only banks and guaranteed-pass claims. Reconcile disputed explanations with the official objectives and current first-party documentation.