Domain 1: Standards and Concepts
- The OSI model has 7 layers: Physical (1), Data Link (2), Network (3), Transport (4), Session (5), Presentation (6), Application (7). The TCP/IP model collapses these into 4: Link, Internet, Transport, and Application.
- Layer 3 (Network) handles logical addressing and routing; IP lives here and routers forward packets by examining destination IP and consulting a routing table.
- Layer 2 (Data Link) uses MAC addresses and switches; Layer 4 (Transport) uses TCP and UDP with port numbers to identify applications.
- TCP is connection-oriented and reliable: it uses a three-way handshake (SYN, SYN-ACK, ACK), sequence numbers for ordering, acknowledgments, and retransmission of lost segments.
- UDP is connectionless and low-overhead with no handshake, ordering, or retransmission; it favors timeliness over reliability and suits VoIP, video, DNS queries, and gaming.
- Well-known ports to memorize: SSH 22, Telnet 23, DNS 53, HTTP 80, HTTPS 443, FTP 20/21, SMTP 25, SNMP 161/162, NTP 123, DHCP 67/68.
- SSH (TCP 22) provides an encrypted CLI session and replaced Telnet (TCP 23) because Telnet sends credentials and data in plaintext.
- HTTPS (TCP 443) is HTTP wrapped in TLS/SSL; the browser opens a TCP connection to 443 and negotiates a TLS session before exchanging HTTP data.
- IPv4 addresses are 32 bits; IPv6 addresses are 128 bits written as eight hex groups (e.g., 2001:0db8::1), providing roughly 3.4 x 10^38 addresses.
- NTP (UDP 123) synchronizes device clocks, which is essential for accurate logging, certificate validation, and correlating events across devices.
- NAT/PAT lets many private hosts share one public IPv4 address, conserving the limited public address space.
- Goodput (useful throughput) is limited by protocol overhead, latency, retransmissions, congestion control, and the lowest-capacity component along the path.
- Jitter is the variation in packet delay; high jitter degrades real-time traffic like voice and video even when average bandwidth is adequate.
- Jumbo frames carry larger payloads (typically up to 9000-byte MTU) to reduce per-packet overhead on high-volume transfers within a controlled network.
Domain 2: Addressing and Subnet Formats
- RFC 1918 private IPv4 ranges are 10.0.0.0/8, 172.16.0.0/12 (172.16.0.0-172.31.255.255), and 192.168.0.0/16; these are not routable on the public internet.
- CIDR prefix length equals the number of network bits; usable hosts per subnet equal 2^(host bits) minus 2 for the network and broadcast addresses.
- A /24 (255.255.255.0) has 256 total addresses and 254 usable hosts; a /26 (255.255.255.192) has 64 total and 62 usable hosts per subnet.
- For a /26, subnets begin at .0, .64, .128, .192; the second subnet's usable host range is 192.168.1.65 through 192.168.1.126 with .127 as the broadcast.
- The network address has all host bits set to 0 and the broadcast address has all host bits set to 1; neither is assignable to a host.
- DHCP automatically assigns IP address, subnet mask, default gateway, and DNS server, eliminating manual configuration and reducing errors.
- An APIPA address in 169.254.0.0/16 means the host failed to obtain an address from DHCP and self-assigned a link-local address.
- DNS resolves human-readable hostnames to IP addresses; local caching reduces repeated lookups and lowers name-resolution latency.
- The default route 0.0.0.0/0 matches all destinations and is configured in IOS as 'ip route 0.0.0.0 0.0.0.0 <next-hop>'.
- IPv6 link-local addresses begin with fe80::/10 and are automatically configured on every IPv6 interface for same-link communication.
- SLAAC (Stateless Address Autoconfiguration) lets IPv6 hosts self-configure addresses, and the vast address space removes the need for NAT.
- IPv6 shorthand rules: a single double-colon (::) replaces one run of consecutive all-zero groups; the fully expanded form of 2001:db8::1 is 2001:0db8:0000:0000:0000:0000:0000:0001.
- Route summarization (supernetting) aggregates contiguous subnets into one prefix at aggregation points, shrinking routing tables; design subnets from a contiguous summarizable block per site.
- In Cisco IOS, 'ip address 192.168.10.1 255.255.255.0' sets a static interface address and 'ip address dhcp' configures the interface to obtain its address from DHCP.
Domain 3: Endpoints and Media Types
- A MAC address is a 48-bit (6-octet) Layer 2 hardware address written in hexadecimal that uniquely identifies a network interface within a broadcast domain.
- Wi-Fi is defined by the IEEE 802.11 standard family; amendments a/b/g/n/ac/ax add speed and features such as MIMO and OFDMA.
- The 2.4 GHz band has longer range and better obstacle penetration but only 3 non-overlapping channels (1, 6, 11), so it congests easily in dense areas.
- The 5 GHz band offers more non-overlapping channels and higher throughput at the cost of shorter range and weaker wall penetration.
- To increase per-client throughput in a crowded WLAN, deploy more APs with smaller cells, lower transmit power, and non-overlapping channels.
- Twisted-pair copper (Cat5e/Cat6/Cat6a) is the standard LAN medium; the maximum run for 1000BASE-T and 10GBASE-T is 100 meters.
- Fiber optic cable transmits data as light, is immune to electromagnetic interference (EMI), and supports the longest distances, making it ideal for inter-building backbones and noisy industrial sites.
- Single-mode fiber with long-range (LR) optics uses a laser and small core for runs up to about 10 km; multimode fiber suits shorter in-building runs.
- Direct Attach Copper (DAC) cables with SFP+ are cost-effective for short in-rack 10 GbE links between adjacent equipment.
- RJ45 is the connector for terminating twisted-pair Ethernet, wired to the T568A or T568B pinout standard.
- Power over Ethernet (PoE) delivers DC power and data over a single Ethernet cable, commonly powering APs, IP phones, and cameras from a PoE-capable switch.
- A duplex mismatch (one side full-duplex, the other half-duplex) causes late collisions, FCS errors, and slow throughput on a switch port.
- Auto-negotiation lets two interfaces agree on the highest common speed and duplex; both ends should be set the same way (both auto or both fixed).
- When a port shows down, first check for an administrative shutdown ('no shutdown'), then verify the cable and that the far-end device is powered.
Domain 4: Infrastructure
- A switch is a Layer 2 device that forwards frames by destination MAC address, learns MACs into a CAM table, and creates a separate collision domain per port.
- A router is a Layer 3 device that forwards packets by destination IP, connects different IP networks, serves as the default gateway, and can perform NAT and filtering.
- A VLAN logically segments one physical switch into multiple independent Layer 2 broadcast domains; inter-VLAN traffic must be routed at Layer 3.
- An access port belongs to a single VLAN; configure it with 'switchport mode access' and 'switchport access vlan <id>'.
- A trunk port carries multiple VLANs over one link using IEEE 802.1Q tagging, which inserts a 4-byte VLAN tag into each frame.
- A wireless access point broadcasts an SSID for clients to join and bridges wireless traffic onto the wired network.
- NAT translates private source addresses to a public address so internal hosts can reach the internet while hiding the internal addressing.
- Link aggregation (EtherChannel, negotiated with LACP) bundles multiple physical links into one logical link for added bandwidth and redundancy.
- Network reliability comes from redundant links/devices and backup power such as a UPS so a single failure does not cause an outage.
- An ACL permits or denies traffic based on rules matching source/destination address, protocol, and port.
- SNMP monitors devices over UDP 161 (polling) and 162 (traps), reading metrics from agent MIBs into an SNMP manager.
- Port mirroring (SPAN) copies traffic from monitored ports to an analyzer port without disrupting the monitored link.
- Caching/proxy servers and a CDN reduce WAN bandwidth and latency by serving content locally or from a geographically closer location.
- In IOS, 'ip route 0.0.0.0 0.0.0.0 203.0.113.1' creates a default static route and 'no shutdown' brings an administratively down interface back up.
Domain 5: Diagnosing Problems
- ping sends ICMP Echo Requests and reports round-trip time and packet loss; it is the first tool for verifying basic Layer 3 reachability.
- traceroute (Linux/macOS) and tracert (Windows) reveal each router hop by incrementing TTL and reading the ICMP Time Exceeded replies, exposing where a path breaks.
- If a host can ping IP addresses but not hostnames, the IP path works and the fault is DNS: missing, wrong, or unreachable DNS server.
- ipconfig (Windows) and ifconfig / 'ip addr show' (Linux) display IP address, mask, gateway, and DNS; nslookup and dig test DNS resolution.
- ARP maps a known IPv4 address to a MAC address on the local segment; 'arp -a' (Windows) or 'ip neigh show' (Linux) displays the neighbor cache.
- A structured troubleshooting process starts with identifying the problem and gathering information (link LEDs, IP config, scope) before changing anything.
- To release and renew a Windows DHCP lease, run 'ipconfig /release' followed by 'ipconfig /renew'.
- 'copy running-config startup-config' saves the running configuration to NVRAM so it survives a reboot.
- A duplex mismatch and rising interface error/discard counters point to a Layer 1/2 problem; check both ends and review utilization on the uplink.
- A saturated link is a common bottleneck; a bandwidth/traffic monitor (NetFlow or SNMP analyzer) measures latency, throughput, and utilization to find it.
- Baselining normal traffic lets you detect deviations and right-size capacity before performance problems or overspending occur.
- Schedule heavy jobs like backups for off-peak hours or rate-limit them so they do not saturate links during business hours.
- Basic show commands are the read-only half of IOS troubleshooting: "show ip interface brief" for a one-line status of every interface, "show interfaces" for error and discard counters, "show mac address-table" to prove which port a host is on, and "show version" for the platform and image. None of them change the configuration, so they are safe first steps.
- Wireshark captures packets off an interface so you can see what actually crossed the wire rather than what a device reports. Use a display filter such as "dns" or "ip.addr == 192.0.2.10" to cut a busy capture down, and remember the capture only sees traffic that reaches the port, which is why a SPAN session is often needed on a switched network.
- You reach a device to diagnose it in one of several ways, and the exam expects you to pick the right one for the situation: the console port when the network itself is down, SSH for an encrypted CLI over the network, RDP for a Windows desktop, a VPN when the device is on the far side of the internet, and a management dashboard such as Cisco Meraki for cloud-managed gear.
- Helpdesk practice matters as much as the commands. Open a ticket that records the reported symptom, its scope and the time it started; note each change you make and its effect; and close with the resolution, so the next person sees what was already tried instead of repeating it.
Domain 6: Security
- Secure a wireless network with WPA2 or WPA3 encryption and a strong, unique passphrase; avoid open networks and deprecated WEP.
- Secure console access in IOS with 'line console 0', 'password <pw>', and 'login'; secure remote access with SSH instead of Telnet.
- A firewall permits or denies traffic against an ordered rule set matching source and destination address, protocol and port, and the last rule is an implicit deny. Because the list is evaluated top down and stops at the first match, a broad permit placed above a specific deny silently defeats it.
- Blocking by port and protocol is the everyday form of that filtering: deny inbound TCP 23 to stop Telnet reaching a device, permit TCP 443 so staff can browse, deny a protocol outright where it has no business on the segment. Knowing the well-known port numbers is what makes the rules readable.
- The CIA triad names the three properties security controls protect: confidentiality (only authorised people can read the data), integrity (the data has not been altered), and availability (the data and service are reachable when needed). A denial-of-service attack targets availability without touching the other two.
- AAA separates three questions that are easy to conflate: authentication proves who you are, authorisation decides what you may do once proven, and accounting records what you did. RADIUS is the protocol that centralises all three for network access, and it is what 802.1X consults.
- Multifactor authentication requires two or more factors of different kinds - something you know (a password), something you have (a token or phone), something you are (a fingerprint). Two passwords are not multifactor, because both come from the same category.
- Encryption protects data in transit and at rest. Symmetric encryption uses one shared key and is fast, which is why it carries the bulk data; asymmetric encryption uses a public and private key pair and is what safely exchanges the symmetric key. TLS uses both together.
- A digital certificate binds a public key to an identity and is signed by a certificate authority the client already trusts. That is how a browser knows the server it reached is really the site named in the address bar, and why an expired or self-signed certificate raises a warning even though the traffic is still encrypted.
- Password policy is about resisting guessing: length matters more than symbol substitution, reuse across systems turns one breach into many, and default credentials on a router or switch are the first thing an attacker tries. Changing the default administrator account is step one on any new device.
- An identity store holds the accounts a network authenticates against, so credentials live in one place instead of on every device. Active Directory is the common example in Windows environments, queried over LDAP, and joining devices and services to it is what makes a single sign-on and a central password policy possible.
- Learn the common threats by their mechanism, not just their name: phishing tricks a person into giving up credentials, spam is unsolicited bulk mail and often the delivery vehicle, malware covers viruses, worms and ransomware that run code on the endpoint, and a denial-of-service attack exhausts a resource so legitimate users cannot reach it.
- On a home or small-office router, wireless security means choosing the strongest scheme both ends support. WPA is obsolete and WEP is broken; WPA2 with AES-CCMP is the practical minimum, and WPA3 is current, replacing the pre-shared-key handshake with SAE so a captured handshake cannot be attacked offline.
- Personal and Enterprise describe how the wireless network authenticates, not how strongly it encrypts. Personal uses one pre-shared passphrase everyone types, so removing one person means changing it for all; Enterprise authenticates each user individually through 802.1X against a RADIUS server, which is why business networks use it.
- Also harden the router itself, not only the radio: change the default administrator password, disable remote administration from the internet unless it is genuinely needed, turn off WPS, and keep the firmware updated. A strong Wi-Fi passphrase does not help if the admin page is reachable with the factory login.
- Defence in depth layers independent controls so no single failure is fatal, and least privilege grants each user and device only the access its role requires. Together they are why a guest network is put on its own VLAN with firewall rules that permit internet access and deny everything internal.
Cisco CCST Networking (100-150) exam tips
- Memorise the OSI layers in order plus which device and protocol live at each layer (switch and MAC at L2, router and IP at L3, TCP/UDP and ports at L4) - many questions hinge on this mapping.
- Drill subnetting until you can find the network address, broadcast address, usable range and host count for /24 through /30 from memory; practise both /26 and /27 boundaries.
- Know the standard port numbers cold (22, 23, 53, 80, 443, 123, 161/162, 67/68) and which use TCP against UDP. They come back in the security domain as firewall rules, not just as trivia.
- For troubleshooting questions, follow the structured order: identify the problem and gather information first, then test from the bottom of the stack up (cable and link, IP configuration, gateway, DNS).
- Read scenario questions for the deciding constraint - distance, EMI immunity, cost or interference - which usually points directly to fibre against copper, or 2.4 GHz against 5 GHz.
- Security is its own sixth domain, not an afterthought inside troubleshooting. Cover firewall permit and deny rules, the CIA triad, AAA and MFA, certificates, identity stores such as Active Directory, the threat vocabulary, and WPA2 against WPA3 with Personal against Enterprise.
- Cisco publishes no percentage weightings for CCST Networking, so budget your study time by how much ground each domain covers rather than by a published figure, and do not gamble on a domain being small.
Study guide FAQ
How long is the CCST Networking exam and what score do I need to pass?
The exam runs 50 minutes and costs US$125. Cisco does not publish a passing score or a score scale for CCST: its own FAQ says the number of questions on each exam varies, and that immediately after finishing you are shown a score report with your Pass or Fail status. Treat every domain as testable and pace yourself so the subnetting and scenario questions, which take longer, do not squeeze the rest.
Do I need hands-on Cisco IOS experience to pass?
You do not need deep configuration experience, but you should recognise basic IOS commands such as "ip address", "switchport access vlan", "ip route 0.0.0.0 0.0.0.0", "no shutdown" and "copy running-config startup-config", along with the read-only show commands used for diagnosis. A free simulator such as Packet Tracer is enough to get comfortable with them.
How much subnetting math is on the exam?
Addressing and Subnet Formats is one of the six domains and a large part of it is subnetting. You should be able to calculate usable hosts, identify network and broadcast addresses, determine subnet ranges, and expand or compress IPv6 addresses quickly without a calculator.
Which domains does the exam actually cover?
Cisco publishes six: Standards and Concepts, Addressing and Subnet Formats, Endpoints and Media Types, Infrastructure, Diagnosing Problems, and Security. No percentage weighting is published for any of them, so plan to cover all six. Security in particular is a full domain, spanning firewall filtering, the CIA triad, AAA and multifactor authentication, encryption and certificates, identity stores, common threats, and wireless security on a home router.
Is CCST Networking the same as CCNA, and what comes next?
No. CCST Networking is an entry-level certification validating foundational concepts and is a stepping stone toward the professional-level CCNA. Passing CCST is a strong way to confirm your fundamentals before tackling CCNA. Note the recertification rule: a CCST earned before 15 July 2025 is valid for life, while one earned on or after that date is renewed by passing any CCST, associate, professional or expert Cisco exam.
Official exam sources
The domain names and weightings on this page follow the published exam blueprint. Each source below records what it confirmed and when it was read, so the split can be checked rather than taken on trust.
- Cisco - CCST Networking (100-150) exam topicslink and content verified 8 September 2026Six objective domains - Standards and Concepts, Addressing and Subnet Formats, Endpoints and Media Types, Infrastructure, Diagnosing Problems, Security - including the domain 6 this guide had once folded away. A 50-minute exam, and "the number of questions on your exam may vary" because some items are performance-based. This REPLACES a recorded-only entry that said no re-fetchable public URL existed: learningnetwork.cisco.com is a JavaScript application, but it renders in a headless browser, so the page is citable after all. Cisco's objective-domain PDF is at https://learningcontent.cisco.com/documents/CCST+Networking+Objective+Domain_Cisco_Final_wCiscoLogo.pdf
- Cisco - certification exam policieslink and content verified 8 September 2026"Cisco does not publish exam passing scores because exam questions and passing scores are subject to change and may vary exam to exam, without notice." Passing scores are "set by using statistical analysis". This is why no Cisco page here prints a cut score as Cisco's: the 825/1000 and 750/1000 figures repeated across study sites are not Cisco's, and CertGrid's own threshold is labelled as a practice figure. Read through a rendered browser - cisco.com answers a plain fetch with HTTP 403.