Study Hub / Cisco CCNA (200-301) / Domain 4.0
Cisco CCNA (200-301) Domain 4.0: IP Services — Explained
Domain 4.0 is the "services on the network" domain: the infrastructure services every network depends on — addressing (DHCP), naming (DNS), translation (NAT), time (NTP) — plus how devices are managed (SSH) and monitored (SNMP, syslog).
Managing devices: access and files
- Console, Telnet, SSH — console is physical direct access (the "I'm standing in front of it" method); Telnet is remote but plaintext; SSH is remote and encrypted. Production = SSH only.
- Configuration files — running-config (active, in RAM, lost on reboot) vs. startup-config (saved, in NVRAM, loaded at boot). "Copy run start" is the most consequential command habit in networking.
- IOS images and licensing — devices boot an IOS image from flash; upgrades mean copying a new image and verifying it before reloading. Licensing determines which features are legally enabled.
- Password recovery vs. password reset — recovery (via ROMmon/confreg) regains access without wiping config on most platforms; the exam distinguishes it from a factory reset.
Monitoring: SNMP, syslog, and NetFlow
- SNMP — the manager polls agents for data (GET) and agents send traps/informs when events happen. v2c uses community strings (plaintext); v3 adds authentication and encryption. MIBs define what can be asked; OIDs address each data point.
- Syslog — devices forward log messages to a central server, severity 0 (Emergency) through 7 (Debug). Centralized logs are the difference between "the network broke" and "here's the minute it broke."
- NetFlow — exports flow records: who talked to whom, on which ports, how many bytes. The tool for capacity planning and "what's eating the bandwidth" questions.
- Mirroring/SPAN — copies traffic from ports to an analyzer port for packet capture without interrupting the original flow.
Core IP services: DHCP, DNS, NAT, NTP
- DHCP — hands out IP addresses automatically: DORA (Discover, Offer, Request, Acknowledge). A DHCP relay forwards client requests to a server on another subnet — without it, broadcasts never leave the LAN.
- DNS — resolves names to IPs. Clients query; servers recurse or forward. If DNS fails, "the internet is down" (it isn't — names just don't resolve). Always check name resolution before declaring a routing problem.
- NAT — translates addresses at the boundary: static NAT (one-to-one, fixed mapping), dynamic NAT (pool of public addresses), PAT/overload (many private to one public, distinguished by port — the home/SOHO default). NAT hides internal addressing but breaks end-to-end connectivity.
- NTP — synchronizes clocks across devices. Logs, certificates, and authentication all assume sane time — a device with a 2019 clock breaks TLS and makes log correlation fiction. One stratum hierarchy, everything synced.
- QoS concepts — when links congest, some traffic matters more: voice gets priority queuing, bulk transfers wait. Marking (DSCP), queuing, and policing — the vocabulary of "the network is slow for everyone except the phones."
The must-memorize table: monitoring tools and what each answers
Match the question to the tool.
| Tool | Answers | Key detail |
|---|---|---|
| SNMP | "Is the device healthy?" — CPU, memory, interface stats | Manager polls; agent sends traps; v3 is secure |
| Syslog | "What happened and when?" — event timeline | Severity 0 (Emergency) → 7 (Debug) |
| NetFlow | "Who used the bandwidth?" — traffic patterns | Flow records: src/dst, ports, bytes |
| SPAN / port mirroring | "What exactly crossed the wire?" — full packets | Copy to analyzer without disrupting traffic |
| REST API | "How do I automate this device?" — programmatic control | JSON over HTTPS; CRUD verbs |
Try it: 4 sample questions
Sample questions to check your understanding of this domain. Answers and full reasoning are tucked under each one.
1. An engineer configures a router, tests it, and reboots. The changes are gone. What happened?
- A. A. The IOS image was corrupted during reload
- B. B. Changes were in running-config (RAM) but never saved to startup-config
- C. C. The router loaded a different VLAN database
- D. D. SNMP overwrote the configuration
Show answer & reasoning
B. The classic CCNA rite of passage: running-config lives in RAM and evaporates on reboot; only startup-config (NVRAM) survives. The fix is one command — copy running-config startup-config — before the reload. Nothing was corrupted; the config was simply never saved.
2. A monitoring system needs encrypted, authenticated polling of switch health data. Which SNMP version and why?
- A. A. SNMPv1 — simplest and fastest
- B. B. SNMPv2c — community strings are encrypted by default
- C. C. SNMPv3 — adds authentication and encryption (authPriv)
- D. D. SNMPv4 — the current secure standard
Show answer & reasoning
C. Only SNMPv3 provides real security: authentication (prove who you are) plus privacy/encryption (authPriv mode). v1 and v2c send community strings in plaintext — "security" by obscurity. (There is no SNMPv4 — D is a distractor.)
3. A REST API call uses the HTTP GET method against a switch's interface inventory endpoint. What does it do?
- A. A. Creates a new interface
- B. B. Reads/retrieves the interface data
- C. C. Deletes an interface
- D. D. Reboots the switch
Show answer & reasoning
B. CRUD maps to HTTP verbs: GET = read, POST = create, PUT/PATCH = update, DELETE = delete. A GET never changes anything — it retrieves. At CCNA level, reading the verb tells you the intent of the call.
4. A company wants identical NTP and DNS settings pushed to 300 switches without logging into each one. Which approach fits?
- A. A. Console into each switch during a maintenance window
- B. B. A configuration management tool (e.g., Ansible) applying a declared desired state
- C. C. SNMP traps from each switch
- D. D. A longer syslog retention policy
Show answer & reasoning
B. This is the declarative automation use case: describe the desired state once, let the tool enforce it everywhere identically — no typos, no drift, no 300 console sessions. SNMP (C) and syslog (D) are monitoring, not configuration. Manual logins (A) are exactly what automation replaces.
This was one domain. The simulator drills all 6.
This free preview covered IP Services (Domain 4.0, 10%). Not covered here: IP Connectivity (Domain 3.0, 25%); Automation & Programmability (Domain 6.0, 10%). Routing configuration and automation — the heaviest hands-on CCNA material — stay in the paid guide and practice bank. The ByteBar Practice Exam Simulator drills every domain with 1,000 exam-style questions — $9.99 one-time unlocks all 28 exams. Prefer to read? The full CCNA Study Guide is in the ByteBar shop on Etsy.
Practice Exam Simulator — $9.99 one-time, all 28 exams Full Study Guides on Etsy