Cisco Certified Network Associate (CCNA) Device Configuration and Operations Syllabus

What is the difference between the running configuration and the startup configuration?

Running-config is the active config in RAM (volatile, lost on reload); startup-config is saved in NVRAM and loaded at boot.

What command saves the running configuration to NVRAM?

'copy running-config startup-config' (or the shortcut 'write memory' / 'wr').

In which type of memory does the running-config reside, and what happens to it on power loss?

RAM (volatile memory); it is lost on reload or power loss unless saved to startup-config in NVRAM.

What command erases the startup configuration, returning the device to factory defaults after reload?

'erase startup-config' (or 'write erase'), then 'reload'.

What command displays the configuration currently running in RAM?

'show running-config' (privileged EXEC mode).

What command shows the saved configuration that will load at next boot?

'show startup-config'.

In what type of memory is the IOS image typically stored on a Cisco device?

Flash memory (nonvolatile). It is decompressed and loaded into RAM at boot.

What command lists the contents of flash, including the IOS image filename and size?

'show flash:' (or 'dir flash:').

What command displays the IOS version, uptime, image filename, and the configuration register value?

'show version'.

What protocol/command is commonly used to copy a new IOS image onto a router from a network server?

'copy tftp: flash:' (TFTP); FTP/SCP can also be used via 'copy ftp: flash:' or 'copy scp: flash:'.

On modern Cisco IOS, what command installs a permanent right-to-use feature license from the CLI?

'license boot level <level>' to activate a level, plus 'license install <url>' to install a license file (and 'license accept end user agreement' for RTU).

What command shows the licenses currently installed and active on a device?

'show license' (or 'show license udi' for the Unique Device Identifier).

What is the configuration register, and where is the default value normally set?

A 16-bit value (e.g., 0x2102) in NVRAM that controls boot behavior — how the router boots, whether it loads startup-config, and console baud rate.

What configuration-register value causes a router to ignore the startup-config (NVRAM) at boot — used in password recovery?

0x2142.

What is the normal/default configuration register value that loads IOS from flash and uses the startup-config?

0x2102.

During password recovery, why do you set the config register to 0x2142?

It makes the router boot bypassing the startup-config, so you can enter privileged EXEC without the unknown password, then load the config and change passwords.

List the high-level steps of Cisco router password recovery.

1) Reboot and send break to enter ROMMON; 2) set confreg to 0x2142; 3) reset/reboot; 4) skip setup, enter enable; 5) 'copy startup-config running-config'; 6) change the password; 7) reset confreg to 0x2102; 8) save.

What is ROMMON (ROM Monitor) mode and how is it typically accessed?

A low-level bootstrap/diagnostic mode used for recovery and changing the config register; accessed by issuing the break sequence during the first 60 seconds of boot. Prompt is 'rommon>'.

In ROMMON, what command changes the configuration register to ignore NVRAM?

'confreg 0x2142'.

What command tests basic IP connectivity by sending ICMP echo requests, and what does '!' versus '.' mean in its output?

'ping'. '!' = successful reply received; '.' = timeout (no reply / dropped).

What does an extended ping allow that a standard ping does not?

It lets you specify source address, repeat count, datagram size, timeout, DF bit, and other options — entered by typing 'ping' with no target in privileged EXEC.

What command traces the Layer 3 path to a destination, listing each router hop?

'traceroute <destination>'.

In Cisco's traceroute, what mechanism is used to identify each hop?

Successively increasing TTL values; each router that decrements TTL to 0 returns an ICMP Time Exceeded message, revealing its address.

What command tests TCP application-layer connectivity to a specific port (e.g., to verify a service is reachable)?

'telnet <ip> <port>' — a successful TCP session indicates the port/service is reachable.

What 'show' command displays a quick summary of all interfaces, their IP addresses, and status (up/down)?

'show ip interface brief'.

In 'show interfaces' output, what do the two status fields 'line protocol is up/down' and the interface 'up/down' represent?

The first (interface status) is Layer 1 (physical/electrical); 'line protocol' is Layer 2 (keepalives/framing). Both must be up for the link to pass traffic.

What does the interface state 'administratively down' indicate?

The interface has been manually disabled with the 'shutdown' command; it is re-enabled with 'no shutdown'.

What command shows the IP routing table?

'show ip route'.

What command displays directly connected Cisco neighbors and their details using a Cisco-proprietary Layer 2 protocol?

'show cdp neighbors' (CDP = Cisco Discovery Protocol); 'show cdp neighbors detail' adds IP addresses and IOS versions. 'show lldp neighbors' is the standards-based equivalent.

What is the difference between 'show' commands and 'debug' commands?

'show' displays a static snapshot of current state/statistics; 'debug' provides real-time, ongoing output of events as they happen and is CPU-intensive.

Why should debug commands be used cautiously on production devices, and how do you stop all debugging?

Debugging consumes significant CPU and can overwhelm the device or console; stop it with 'no debug all' or 'undebug all' (shortcut 'u all').

What command must be enabled to see real-time debug output on a Telnet/SSH (VTY) session rather than only on the console?

'terminal monitor' (in privileged EXEC on that VTY session).

What are the ordered steps of a structured (bottom-up) troubleshooting approach using the OSI model?

Start at Layer 1 (physical/cabling), then Layer 2 (data link/switching), Layer 3 (IP/routing), and upward through transport and application — verifying each layer before moving up.

Name three common structured troubleshooting methods.

Bottom-up (start at Layer 1), Top-down (start at the application), and Divide-and-conquer (start at a middle layer and move up or down based on findings).

What is the first step in a structured troubleshooting methodology before making any changes?

Define/identify the problem clearly — gather symptoms and information to establish what 'working' looks like and what is actually failing.

What command logs messages with timestamps and shows the device's log buffer history?

'show logging' (the buffered log); enable timestamps with 'service timestamps log datetime'.

What command verifies that ICMP, ARP, and basic reachability work to a directly connected host on the same subnet?

'ping <neighbor-ip>' — success confirms Layer 1–3 connectivity within the subnet; you can also check 'show ip arp' for the learned MAC.

What command displays CPU utilization to help diagnose performance problems (e.g., from heavy debugging)?

'show processes cpu' (e.g., 'show processes cpu sorted' to rank by usage).

What does the 'do' command let you do in IOS, and give an example?

It executes privileged EXEC commands from within configuration mode without leaving it — e.g., 'do show ip interface brief' typed at 'Router(config)#'.