Don't memorise the line. Explain the concept.

A network is a group of connected devices that can exchange data and use shared resources or services.

A hub repeats traffic to all ports. A switch forwards Ethernet frames inside a LAN using MAC addresses. A router forwards IP packets between different networks.

A LAN is a network that connects devices within a limited area such as an office, floor, home or campus building.

A WAN connects networks across larger geographic distances, for example connecting branch offices to a headquarters or cloud network.

A default gateway is the Layer-3 next hop a host uses when the destination is outside its local subnet.

A broadcast domain is the set of Layer-2 devices that can receive the same broadcast. Routers and VLAN boundaries separate broadcast domains.

A collision domain is a network segment where simultaneous transmissions can collide. On a modern switched Ethernet network, each switch port is its own collision domain.

Network topology describes how network devices and links are arranged, physically or logically.

The OSI model divides network communication into seven conceptual layers. I use it mainly to understand where a protocol works and to troubleshoot from physical connectivity up to the application.

OSI is a seven-layer reference model. TCP/IP is the practical protocol model used by real IP networks and is commonly shown with four or five layers.

Encapsulation is the process of adding protocol information as data moves down the stack—for example TCP information, then IP information, then an Ethernet header/trailer.

A frame is the Layer-2 data unit used on technologies such as Ethernet. It includes source and destination MAC information.

A packet is commonly the Layer-3 data unit. An IP packet contains source and destination IP addresses used for routing.

A TCP segment is the transport-layer unit carrying TCP header information such as source/destination ports, sequence numbers and flags.

Routing is primarily a Layer-3 function because routers make forwarding decisions using network-layer addresses such as IP.

I use OSI to isolate the fault. I first prove physical/link state, then VLAN/MAC behaviour, then IP/gateway/routes, and only after that move to transport and application checks.

An IPv4 address is a 32-bit logical address used to identify an interface in an IPv4 network and support Layer-3 forwarding.

A subnet mask tells a device which bits of an IPv4 address represent the network and which represent hosts. It also helps the host decide whether a destination is local or remote.

A /24 means 24 network bits and 8 host bits. Its subnet mask is 255.255.255.0.

The three private IPv4 ranges are 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. They are used inside private networks and are not globally routed on the public internet.

Private IPv4 ranges are intended for internal networks and are not globally routed on the public internet. Common ranges include 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16.

The network address identifies the subnet itself. It is the first address in an IPv4 subnet and is not assigned to a normal host interface.

The broadcast address is the last address in a traditional IPv4 subnet. Traffic sent to it is delivered to all hosts in that broadcast domain.

Subnetting divides an IP network into smaller networks by using a longer prefix. It helps address planning, segmentation and routing design.

A switch learns from the source MAC address of incoming Ethernet frames. It records that MAC against the port where the frame arrived and uses the table for future forwarding decisions.

A MAC address is a Layer-2 identifier used by Ethernet interfaces and switches for local frame delivery.

A VLAN is a logical Layer-2 broadcast domain. It lets one physical switching infrastructure separate groups such as Sales and Finance.

An access port normally carries one VLAN and is commonly used for endpoint connections.

802.1Q is the Ethernet VLAN tagging standard commonly used on trunk links.

Inter-VLAN routing is Layer-3 routing between different VLANs, using a router or Layer-3 switch as the gateway.

Router-on-a-Stick uses one physical router interface with 802.1Q subinterfaces to provide gateways and routing for multiple VLANs.

A trunk carries traffic for multiple VLANs between network devices, commonly using IEEE 802.1Q tagging.

STP prevents Layer-2 loops when redundant switch links exist. It keeps a loop-free active path by placing selected redundant ports into a blocking or discarding state.

The STP root bridge is the reference switch for the spanning tree. The switch with the best bridge ID wins, with priority considered before MAC address.

A root port is the best port on a non-root switch toward the STP root bridge.

A designated port is the STP forwarding port selected for a network segment. It provides that segment with the best path toward the root bridge.

RSTP is the faster-converging evolution of classic STP, defined by IEEE 802.1w.

EtherChannel combines compatible physical links into one logical port-channel for more aggregate bandwidth and redundancy.

LACP is the standards-based protocol used to negotiate link aggregation. Active initiates negotiation; passive responds.

EtherChannel combines compatible physical links into one logical port-channel for more aggregate bandwidth and redundancy.

A routing table contains destination networks and the next-hop/interface information a router uses to forward packets.

A connected route appears when a router interface is up with an IP network configured. A static route is entered manually. A dynamic route is learned through a routing protocol such as OSPF or EIGRP.

When several routes match a destination IP, the router chooses the route with the most specific prefix. For example, a /24 route is preferred over a matching /16 route.

A static route is manually configured by an administrator to tell a router how to reach a destination network.

A default route is the catch-all route used when no more-specific route matches. In IPv4 it is 0.0.0.0/0.

Communication normally needs a valid path in both directions. The forward packet may reach the destination, but the reply will fail if the destination side has no route back to the source network.

Dynamic routing protocols let routers exchange reachability information and adapt routes when topology changes.

Verify the destination prefix and next hop, interface state, ARP or Layer-2 reachability to the next hop, the return route, ACL or firewall filtering, and then use ping or traceroute to locate where forwarding stops.

OSPF is a link-state interior routing protocol. Routers form neighbours, exchange link-state information and use SPF calculations to select paths.

OSPF is a link-state interior routing protocol. Routers form neighbours, exchange link-state information and use SPF calculations to select paths.

An OSPF neighbour is another OSPF router discovered on a shared link with which the router can form an adjacency and exchange routing information when required.

Check interface IP/subnet, OSPF area, hello/dead timers, authentication, network type, passive-interface settings and basic Layer-3 reachability. Then verify with show ip ospf interface and show ip ospf neighbor.

The Link-State Database is OSPF’s view of the topology for an area. Routers in the same area build a consistent LSDB and run SPF against it to calculate best paths.

EIGRP is an advanced distance-vector routing protocol that uses DUAL and maintains neighbour, topology and routing information.

DUAL, the Diffusing Update Algorithm, is associated with EIGRP. It selects loop-free best paths and can identify feasible backup paths for fast convergence.

If the routing neighbour is up, check whether the destination network is actually being advertised, whether route filtering or summarisation affects it, whether a better route already exists, and inspect the protocol-specific topology or database table.

DORA stands for Discover, Offer, Request and Acknowledge—the common DHCPv4 address-allocation flow.

DHCP relay forwards client DHCP messages between subnets because the client’s initial broadcasts do not normally cross routers.

DNS resolves names into records such as IP addresses, allowing clients to use names instead of remembering addresses.

An A record maps a name to an IPv4 address. An AAAA record maps a name to an IPv6 address.

An ACL is an ordered set of permit/deny rules used to filter traffic based on matching criteria.

A standard IPv4 ACL mainly matches source address. An extended ACL can also match destination, protocol and ports, so it can be more specific.

NAT translates IP addressing between network domains, commonly translating private inside addresses at an internet edge.

PAT translates addresses and transport ports so many inside sessions can share one outside IPv4 address.

SSH encrypts the management session, including credentials and commands. Telnet sends data in clear text.

NTP keeps device clocks consistent; Syslog centralises event messages. Accurate time makes logs from multiple devices much easier to correlate during troubleshooting or security analysis.

CDP and LLDP are neighbour-discovery protocols. CDP is Cisco-specific; LLDP is an IEEE standard used across vendors.

DHCP snooping helps block untrusted DHCP server behaviour and builds a binding database. Dynamic ARP Inspection can use trusted bindings to validate ARP messages and reduce ARP spoofing risk.

Network security is the set of controls, policies and technologies that protect data confidentiality, integrity and availability as it moves across a network.

Confidentiality, Integrity and Availability. Every security control exists to protect one or more of these three properties.

Using multiple independent layers of security controls, so that if one layer fails or is bypassed, another layer can still stop or detect the threat.

A controlled buffer zone between the trusted internal network and the untrusted internet, used to host public-facing servers without exposing the internal LAN directly.

Authentication (who you are), Authorization (what you can do) and Accounting (a log of what you actually did).

It sends false ARP mappings so a device believes attacker-controlled hardware is a legitimate host, which can misdirect local Layer 2 traffic for interception.

It lets an admin manage and audit access across hundreds of devices from one place, instead of maintaining separate local accounts on every device.

A stateless firewall evaluates every packet independently. A stateful firewall tracks the connection in a state table, so return traffic for an already-permitted session is automatically allowed.

Most firewalls process rules top to bottom and apply the first match. A specific rule placed below a broader rule may never be reached, which is a common real-world misconfiguration.

It is blocked by the implicit deny that sits at the end of every rule base by default.

A defined direction between two security zones (for example Inside to Outside) with a policy attached, controlling what traffic is inspected, allowed or dropped between those zones.

An IDS monitors a copy of traffic and only generates alerts. An IPS sits inline in the actual traffic path and can actively drop malicious traffic in real time.

To limit the blast radius of a compromise — isolating a compromised device's VLAN can prevent it from freely reaching more sensitive parts of the network.

The security policy, separately from NAT. NAT translates addresses; it does not by itself grant permission, so both the NAT rule and the policy must allow the traffic.

To tune signatures and reduce false positives first — a false positive on an inline IPS can drop legitimate traffic and cause an outage, while the same false positive on an IDS only causes noisy alerts.

Site-to-site VPN permanently connects two networks through their gateways with no end-user involvement. Remote access VPN connects an individual user's device to the network on demand.

Phase 1 authenticates the two peers and builds a secure management channel. Phase 2 uses that channel to negotiate the actual IPsec SAs that protect the real data traffic.

Phase 1 has likely succeeded but Phase 2 has failed to negotiate, often due to mismatched interesting traffic (the ACL defining what should go through the tunnel) on each side.

It runs over standard HTTPS on port 443, which passes through most restrictive networks that would otherwise block traditional IPsec ports.

Correlating events across many devices can reveal a pattern, such as a coordinated scan, that no single device's log would show on its own.

Confirm exactly what fails and from where, before changing any configuration. Then trace the traffic path through the relevant zones, rules and state.

Because configuration intent and actual runtime behaviour are not always the same. Logs and state show what really happened, not what was supposed to happen.

Explicit, written authorization from the system owner. The exact same technical actions without that authorization are illegal, regardless of intent.

Reconnaissance, Scanning, Enumeration, Vulnerability Assessment, Exploitation, and Reporting, in that order — each phase builds the context the next phase needs.

Hat describes intent and authorization (white/black/grey). Box describes how much information the tester starts with (black-box/white-box/grey-box). They are independent.

The formal document that legally authorizes a test and defines exact boundaries — in-scope and out-of-scope systems, testing windows, allowed techniques and emergency contacts.

Report the observation without testing it. Testing anything outside the signed scope is unauthorized access, no matter how good the intention is.

A finding that isn't clearly documented with impact, evidence and remediation provides very little real value to the organisation — the report is the actual deliverable.

Passive recon uses only public information without touching the target. Active recon interacts directly, like a ping sweep, and can potentially be detected.

No response was received at all, most likely because a firewall silently dropped the probe — the scanner cannot tell if the port is actually open or closed.

Specific usable detail — exact service versions, share names, usernames — that scanning alone doesn't reveal, and that vulnerability assessment depends on.

No — reachability and context matter too. A vulnerable service isolated with no path to anything sensitive may pose limited real risk.

Banners can be deliberately hidden or altered, so behaviour-based fingerprinting can reveal detail that a misleading banner would hide.

An exploit is the code that triggers a specific known vulnerability. A payload is what runs after the exploit succeeds, such as opening a session.

Untrusted input is directly concatenated into a SQL query string, letting an attacker change the query's actual logic instead of just its data.

Parameterized queries (prepared statements), which always treat user input strictly as data and never as part of the query's structure.

Stored XSS is saved on the server and served to every visitor, like in a comment field. Reflected XSS is echoed back immediately, usually via a crafted link.

It ensures identical passwords don't produce identical hashes, which defeats precomputed lookup table attacks even if the hash database is stolen.

Impact (real business risk), evidence (proof it's real), and remediation (a specific, actionable fix) — not just a vulnerability name.