Overview
Network Fundamentals is 20% of the CCNA and the vocabulary and math that everything else depends on. It has thirteen objectives. Network components covers routers, Layer 2 and Layer 3 switches, next-generation firewalls and IPS, access points, controllers, endpoints, servers and power over Ethernet. Topology architectures covers two-tier, three-tier, spine-leaf, WAN, SOHO and cloud. Cabling covers fiber and copper and interface issues such as duplex and speed mismatches. TCP versus UDP compares the transport protocols. Addressing covers IPv4 addressing and subnetting, private addressing, IPv6 addressing and prefixes, and IPv6 address types. Verifying IP parameters covers client operating systems. Wireless principles, virtualization fundamentals, and switching concepts round it out.
The exam rewards understanding what each device does and, above all, fast, accurate IPv4 subnetting, which hides inside routing, ACL and OSPF questions throughout the exam. This domain is where candidates build momentum or lose easy points.
How it's tested
CCNA questions are scenario-based, and many are hands-on simulations requiring real Cisco IOS commands and show-output interpretation. In this domain they describe a device, protocol, cable or addressing need, or require a subnetting calculation. Read the scenario for the component, protocol or address it points to, and compute carefully.
-
Device or topology
A function or design is described, and you identify the network component or topology architecture.
-
Protocol or cabling
A transport or connection need is described, and you choose TCP or UDP, or the cable or interface.
-
Addressing and subnetting
An addressing need is described, and you calculate the subnet, prefix, host range or IPv6 type.
A design needs the subnet that contains a given host, with a /28 mask. A /28 leaves 4 host bits, so subnets increment by 16 in the last octet, giving 16 addresses each with 14 usable hosts. Finding which /28 block the host falls into, and its network and broadcast addresses, is the subnetting skill the exam expects, applied directly from the prefix length.
Domains 13
Official domains from the Cisco outline, in outline order.
1.1 Explain the role and function of network componentsRouters, switches, firewalls, IPS, APs, controllers, endpoints, servers, PoE.
- What it means
- This covers the role of core network components: routers, Layer 2 and Layer 3 switches, next-generation firewalls and intrusion prevention systems, access points, wireless LAN controllers, endpoints, servers, and power over Ethernet for powering devices over the network cable.
- What to understand
- Each component has a distinct role: routers connect networks at Layer 3, switches connect devices at Layer 2 (with Layer 3 switches adding routing), firewalls and IPS enforce security, and access points and controllers provide and manage wireless. PoE delivers power and data over one cable. Knowing each role is foundational.
- How it shows up
- A function is described, and you must identify the component.
- Common confusion
- Confusing a Layer 2 switch with a Layer 3 switch or router, or a next-generation firewall with a traditional one.
1.2 Describe characteristics of network topology architecturesTwo-tier, three-tier, spine-leaf, WAN, SOHO and cloud.
- What it means
- This covers topology architectures: the two-tier collapsed core and three-tier hierarchical designs, spine-leaf data center fabrics, WAN, small office/home office, and on-premises versus cloud architectures, and their characteristics and use cases.
- What to understand
- Architectures structure networks for scale and resilience: three-tier separates core, distribution and access, two-tier collapses core and distribution, and spine-leaf provides consistent low-latency paths in data centers. SOHO is small-scale, and cloud shifts resources off-premises. Matching the architecture to the need is the skill.
- How it shows up
- A design or scale need is described, and you must identify the topology architecture.
- Common confusion
- Confusing two-tier with three-tier, or spine-leaf with a traditional hierarchical design.
1.3 Compare physical interface and cabling typesSingle-mode and multimode fiber, copper, and connection types.
- What it means
- This covers comparing interface and cabling types: single-mode and multimode fiber, copper cabling, and connection characteristics such as shared media versus point-to-point, matching media to distance and speed needs.
- What to understand
- Single-mode fiber carries signals over long distances, multimode over shorter runs, and copper over limited distances at lower cost. Point-to-point links connect two devices directly. Choosing the right media for the distance, speed and cost requirement is the practical skill.
- How it shows up
- A distance or connection need is described, and you must choose the cabling or interface type.
- Common confusion
- Confusing single-mode and multimode fiber, or their distance capabilities.
1.4 Identify interface and cable issues (collisions, errors, duplex, speed)Collisions, errors, duplex and speed mismatches.
- What it means
- This covers identifying interface and cable problems: collisions, interface errors and error counters, and duplex and speed mismatches, which cause connectivity and performance problems visible in show interface output.
- What to understand
- Interface counters reveal problems: increasing errors suggest a physical or duplex issue, and a duplex mismatch causes collisions and poor performance. Speed must also match between ends. Reading the interface counters to diagnose these issues is a practical, tested skill.
- How it shows up
- Interface symptoms are described or shown, and you must identify the cable or configuration issue.
- Common confusion
- Overlooking a duplex or speed mismatch as the cause of errors and poor performance.
1.5 Compare TCP to UDPConnection-oriented versus connectionless transport.
- What it means
- This covers comparing TCP and UDP: TCP is connection-oriented with reliability, sequencing and flow control, while UDP is connectionless, lightweight and faster without assured delivery, and the use cases for each.
- What to understand
- TCP establishes a connection and ensures ordered, reliable delivery, suiting applications like web and file transfer, while UDP sends without a connection or guarantees, suiting latency-sensitive applications like voice, video and DNS queries. Knowing which protocol fits a use case is the skill.
- How it shows up
- An application or reliability need is described, and you must choose TCP or UDP.
- Common confusion
- Confusing the characteristics of TCP and UDP, or which applications use each.
1.6 Configure and verify IPv4 addressing and subnettingIPv4 addresses, masks, subnetting and VLSM.
- What it means
- This covers configuring and verifying IPv4 addressing and subnetting: calculating subnets, hosts, ranges and network and broadcast addresses from a mask, variable-length subnet masking, and applying addresses to interfaces.
- What to understand
- Subnetting is the most important skill in this domain and the whole exam. Given an address and prefix, you compute the number of subnets and hosts, the usable range, and the network and broadcast addresses, and apply VLSM to size subnets to need. Fluency without a calculator is essential because subnetting recurs everywhere.
- How it shows up
- An addressing scenario is described, and you must subnet or calculate the correct values.
- Common confusion
- Miscalculating subnets, hosts or ranges from a prefix, or misapplying VLSM.
1.7 Describe private IPv4 addressingRFC 1918 private address ranges.
- What it means
- This covers private IPv4 addressing: the RFC 1918 private address ranges, their purpose for internal networks, and how they relate to public addressing and network address translation.
- What to understand
- Private address ranges are reserved for internal use and are not routable on the internet, so they are translated to public addresses by NAT at the edge. Knowing the three private ranges and that they require NAT to reach the internet is expected.
- How it shows up
- An addressing situation is described, and you must identify a private range or its implications.
- Common confusion
- Confusing the private address ranges or thinking private addresses are internet-routable without NAT.
1.8 Configure and verify IPv6 addressing and prefixIPv6 addresses, prefixes and configuration.
- What it means
- This covers configuring and verifying IPv6 addressing: the 128-bit address format and abbreviation rules, prefixes, and assigning IPv6 addresses to interfaces.
- What to understand
- IPv6 uses 128-bit hexadecimal addresses with rules for compressing zeros, and prefixes expressed in CIDR notation. Configuring and verifying IPv6 on interfaces, and reading abbreviated addresses correctly, is the practical skill, reflecting the move beyond IPv4's limited space.
- How it shows up
- An IPv6 addressing need is described, and you must configure or interpret the address and prefix.
- Common confusion
- Mishandling IPv6 abbreviation rules when compressing or expanding an address.
1.9 Describe IPv6 address typesGlobal unicast, unique local, link-local, anycast, multicast, EUI-64.
- What it means
- This covers IPv6 address types: global unicast, unique local, link-local, anycast and multicast addresses, and the modified EUI-64 process for forming an interface identifier.
- What to understand
- Each IPv6 type has a role: global unicast is internet-routable, unique local is for internal use, link-local is automatically configured for local communication, and multicast and anycast serve group and nearest-node delivery. EUI-64 derives an interface ID from the MAC address. Recognizing each type by its prefix is the skill.
- How it shows up
- An IPv6 address or need is described, and you must identify its type or the EUI-64 result.
- Common confusion
- Confusing the IPv6 address types, especially link-local and unique local, by their prefixes.
1.10 Verify IP parameters for client OS (Windows, macOS, Linux)Checking IP settings on Windows, macOS and Linux.
- What it means
- This covers verifying IP parameters on client operating systems, Windows, macOS and Linux, using the appropriate commands to check address, mask, gateway and DNS settings.
- What to understand
- Each operating system has commands to display IP configuration, and verifying a client's address, mask, default gateway and DNS is a basic troubleshooting step. Knowing how to check these settings across the common operating systems is expected.
- How it shows up
- A client connectivity situation is described, and you must verify or interpret the IP parameters.
- Common confusion
- Confusing the commands or output used to check IP settings across different operating systems.
1.11 Describe wireless principlesNonoverlapping channels, SSID, RF and encryption.
- What it means
- This covers wireless principles: nonoverlapping channels and why they matter, service set identifiers, radio frequency concepts and bands, and wireless encryption, at a foundational level.
- What to understand
- Wireless design uses nonoverlapping channels to avoid interference, SSIDs to identify networks, and encryption to secure traffic. Understanding the frequency bands and basic RF behavior and why channel planning matters is the foundational knowledge expected, with deeper wireless in later domains.
- How it shows up
- A wireless concept need is described, and you must identify the principle such as nonoverlapping channels.
- Common confusion
- Choosing overlapping channels, or confusing the frequency bands and their characteristics.
1.12 Explain virtualization fundamentals (VMs, containers, VRFs)Server virtualization, containers and VRFs.
- What it means
- This covers virtualization fundamentals: server virtualization with virtual machines, containers, and virtual routing and forwarding instances that create separate routing tables on one device.
- What to understand
- Virtual machines run full guest operating systems on a hypervisor, containers package applications more lightly sharing the host OS, and VRFs partition a router into multiple independent routing tables. Understanding these virtualization concepts and how they apply to networking is the expectation.
- How it shows up
- A virtualization need is described, and you must identify VMs, containers or VRFs.
- Common confusion
- Confusing virtual machines with containers, or misunderstanding what a VRF provides.
1.13 Describe switching conceptsMAC learning and aging, frame switching, flooding, the MAC table.
- What it means
- This covers switching concepts: how a switch learns MAC addresses and ages them out, how it makes frame-forwarding decisions, flooding of unknown unicast and broadcast frames, and the MAC address table.
- What to understand
- A switch builds its MAC address table by learning source addresses, forwards frames toward the known port for a destination, floods frames when the destination is unknown or is broadcast, and ages out stale entries. Understanding this learning and forwarding behavior underpins all of switching.
- How it shows up
- A switching behavior is described, and you must identify the MAC learning, forwarding or flooding concept.
- Common confusion
- Confusing flooding of unknown unicast with normal forwarding, or misunderstanding MAC aging.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Layer 2 vs. Layer 3 switch
Switching only versus switching plus routing.
- Remember
- Layer 3 switches route between VLANs.
- Tested as
- Component questions.
- Trap
- Confusing with a router or Layer 2 switch.
-
Power over Ethernet
Power and data over one cable.
- Remember
- Powers APs and phones over the network.
- Tested as
- Component questions.
- Trap
- Overlooking PoE wattage limits.
-
Topology architectures
Two-tier, three-tier, spine-leaf.
- Remember
- Spine-leaf suits data centers.
- Tested as
- Design questions.
- Trap
- Confusing the architectures.
-
TCP vs. UDP
Reliable connection versus lightweight connectionless.
- Remember
- UDP suits latency-sensitive traffic.
- Tested as
- Transport questions.
- Trap
- Confusing their use cases.
-
IPv4 subnetting
Calculating subnets, hosts and ranges from a mask.
- Remember
- The single most important CCNA skill.
- Tested as
- Pervasive across the exam.
- Trap
- Slow or inaccurate calculation.
-
VLSM
Sizing subnets to their host needs.
- Remember
- Avoids wasting addresses.
- Tested as
- Addressing questions.
- Trap
- Overlapping or mis-sized subnets.
-
Private IPv4 ranges
RFC 1918 reserved internal ranges.
- Remember
- Not internet-routable; need NAT.
- Tested as
- Addressing questions.
- Trap
- Confusing the ranges.
-
IPv6 address types
Global unicast, unique local, link-local, multicast, anycast.
- Remember
- Identify by prefix.
- Tested as
- IPv6 questions.
- Trap
- Confusing link-local and unique local.
-
Modified EUI-64
Derives an interface ID from the MAC.
- Remember
- Inserts FFFE and flips a bit.
- Tested as
- IPv6 questions.
- Trap
- Misapplying the process.
-
MAC learning and flooding
Switches learn sources and flood unknown destinations.
- Remember
- Unknown unicast is flooded.
- Tested as
- Switching questions.
- Trap
- Confusing flooding with forwarding.
-
VMs vs. containers vs. VRFs
Full guests, lightweight apps, and separate routing tables.
- Remember
- VRFs partition routing on one device.
- Tested as
- Virtualization questions.
- Trap
- Confusing the three.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Router vs. Layer 2 switch vs. Layer 3 switch
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Router | Connects networks at Layer 3 | Routes between networks | Confusing with a Layer 3 switch |
| Layer 2 switch | Connects devices in a LAN | Switches by MAC | Expecting it to route |
| Layer 3 switch | Switches and routes between VLANs | Adds routing to switching | Confusing with a Layer 2 switch |
TCP vs. UDP
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| TCP | Connection-oriented, reliable | Ordered, assured delivery | Using for latency-sensitive traffic |
| UDP | Connectionless, lightweight | Fast, no delivery assurance | Expecting reliability |
Single-mode vs. multimode fiber
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Single-mode | Narrow core, laser | Long distances | Confusing with multimode |
| Multimode | Wider core, LED | Shorter distances, cheaper | Using for long runs |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Subnet miscalculation
- What candidates pick
- Pick the wrong subnet or host range for a given prefix.
- Why it looks right
- The math is easy to rush.
- Why it's wrong
- Each prefix has a fixed block size and host count; the host's subnet, network and broadcast must be computed precisely.
Clue to watch for The question gives an address and a mask or prefix.
-
TCP for voice
- What candidates pick
- Choose TCP for real-time voice or video traffic.
- Why it looks right
- TCP is reliable.
- Why it's wrong
- Real-time traffic prefers UDP's low latency; TCP's retransmission and ordering add delay.
Clue to watch for The application is latency-sensitive, such as voice or video.
-
Layer 2 switch routes VLANs
- What candidates pick
- Expect a Layer 2 switch to route between VLANs.
- Why it looks right
- Switches connect devices.
- Why it's wrong
- Routing between VLANs requires a router or a Layer 3 switch; a Layer 2 switch cannot route.
Clue to watch for Traffic must move between different VLANs or subnets.
-
Private address is routable
- What candidates pick
- Assume a private IPv4 address can reach the internet directly.
- Why it looks right
- It is a valid address.
- Why it's wrong
- Private addresses are not internet-routable and must be translated by NAT to a public address.
Clue to watch for An internal host must reach the public internet.
-
Link-local is unique local
- What candidates pick
- Confuse an IPv6 link-local address with a unique local address.
- Why it looks right
- Both are non-global.
- Why it's wrong
- Link-local addresses (FE80::/10) are for the local link only; unique local addresses (FC00::/7) are for internal routing.
Clue to watch for The address prefix indicates its scope.
-
Ignore duplex mismatch
- What candidates pick
- Investigate higher layers for errors caused by a duplex mismatch.
- Why it looks right
- Errors seem complex.
- Why it's wrong
- A duplex mismatch causes collisions and errors at the interface; the physical settings should be checked first.
Clue to watch for Interface error counters are high on a link.
Answer framework
For any Domain 1 fundamentals scenario, use these steps to find the answer CCNA expects.
- Identify whether the question is about a component, topology, cabling, transport, addressing, wireless, virtualization or switching.
- For components, match the function to the device, keeping Layer 2 switches, Layer 3 switches and routers distinct.
- For transport, choose TCP for reliable ordered delivery and UDP for lightweight latency-sensitive traffic.
- For addressing, subnet IPv4 precisely from the prefix, apply VLSM, and identify IPv6 address types by their prefixes.
- For switching, apply MAC learning, forwarding and flooding behavior, and check interface counters for duplex and speed issues. Where two options seem to fit, pick the one that most precisely matches the scenario's configuration or show output.
Practice question
Want more like this? The CCNA practice test has questions for every domain.
Checklist
0 of 10
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Treat this domain as the base the entire CCNA stands on, and front-load it. The single most important investment is subnetting: drill IPv4 subnetting and VLSM until you can find any subnet's block size, network, broadcast and host range in seconds without a calculator, because subnetting hides inside routing, ACL and OSPF questions across the exam.
Learn the network components and keep Layer 2 switches, Layer 3 switches and routers distinct, and know the topology architectures including spine-leaf. Fix the TCP-versus-UDP distinction and its use cases, and learn the IPv6 address types by their prefixes along with EUI-64. Then master switching concepts, how switches learn, forward, flood and age MAC addresses, since this underpins Domain 2.
Because the exam is hands-on, practice IOS commands and reading show output in a simulator such as Packet Tracer. Afterwards, move to Domain 2, Network Access. Because the CCNA is heavily hands-on, practice every configure-and-verify objective in a simulator such as Packet Tracer or on real gear rather than only reading, and review missed practice questions by domain to find weak spots.
FAQ
How much of the CCNA is Domain 1?
Network Fundamentals is 20% of the exam, and with Network Access and IP Connectivity it forms 65% of the content, so it is the foundation the whole exam builds on.
Why is subnetting so important for the CCNA?
Subnetting is the single most important skill because it is not just its own questions; it hides inside routing, ACL and OSPF questions throughout the exam. You must be able to subnet quickly and accurately without a calculator.
What is the difference between a Layer 2 and a Layer 3 switch?
A Layer 2 switch forwards frames by MAC address within a network. A Layer 3 switch adds routing, so it can route between VLANs, combining switching and routing in one device.
When should I use TCP versus UDP?
Use TCP when reliable, ordered delivery matters, such as web and file transfer. Use UDP for latency-sensitive traffic like voice, video and DNS queries, where speed matters more than assured delivery.
What are the IPv6 address types?
Global unicast (internet-routable), unique local (internal), link-local (automatically configured for the local link), multicast (group delivery) and anycast (nearest node). You identify them by their prefixes, and modified EUI-64 derives an interface ID from the MAC.
Is the CCNA hands-on?
Yes. Many objectives use 'configure and verify', meaning simulation questions where you type real Cisco IOS commands and interpret show output, so hands-on practice in a simulator is essential.
How does Domain 1 connect to the rest of the exam?
Its fundamentals, especially subnetting and switching concepts, underpin Network Access, IP Connectivity and every other domain, which all assume this foundation.
Other Networking certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
Test your Domain 1 knowledge
You have covered components, topologies, TCP/UDP, IPv4 and IPv6 addressing, subnetting and switching. Test whether you can apply these fundamentals, especially subnetting, under exam conditions.