Routing Technologies — N10-009 Study Guide

How a router chooses a path: the three-step selection

A packet arrives with a destination IP, and the router answers one question: which entry in my routing table do I forward this out of? It resolves that in three steps, always in the same order, and most N10-009 routing questions are really testing whether you know which step fires first.

Step 1, longest-prefix match. The router compares the destination against every route's network/mask and keeps the most specific one, meaning the one with the longest matching prefix. If the table holds 10.1.1.0/24, 10.1.0.0/16, and 0.0.0.0/0 (the default route), a packet to 10.1.1.5 matches all three but takes the /24, because /24 is longer (more specific) than /16 or the /0 default. This rule wins outright; it is decided before administrative distance or metric is ever consulted.

Step 2, administrative distance. Longest-prefix match settles which prefix, but the same prefix can be learned from more than one source (a static route and OSPF both advertising 10.1.1.0/24). Administrative distance (AD) is a 0 to 255 trust rank the router uses to pick the more believable source, lower being more trusted. A directly connected interface is 0, a static route is 1, and dynamic protocols are higher, so a static route beats an OSPF-learned route for the same prefix. AD is local to one router and never travels in an advertisement.

Step 3, metric. Only when the prefix length and the AD both tie does the protocol's own metric break the tie, and each protocol measures differently: RIP counts hops, OSPF sums an inverse-bandwidth cost, and EIGRP computes a composite of bandwidth and delay. A lower metric is the better path within that one protocol. Comparing metrics across protocols is meaningless, which is exactly why AD exists to arbitrate between them first.

Keep the order straight and the trap answers fall away: a /32 host route always beats a /24 no matter what AD or metric the /24 carries, because length is decided first.

Route selection runs in fixed order: longest-prefix match, then administrative distance, then metric; each step only runs on a tie from the one before.

Static vs dynamic routing, and when each fits

Pick static when the path will not change and you want zero protocol overhead; pick dynamic when the network must heal itself. That single trade decides most design questions.

Static routing

A static route is one administrator-typed entry pairing a destination prefix with a next-hop address or exit interface. It costs no CPU and no bandwidth (nothing is advertised), is fully predictable, and is invisible to attackers scanning for routing protocols. Its weakness is that it is blind: if the next hop goes down, the route stays in the table and blackholes traffic unless you add a backup (a floating static route with a higher AD that activates only when the primary is gone). The most common static route is the default route, 0.0.0.0/0, the gateway of last resort that a stub site uses to send everything it does not have a specific route for toward its ISP.

Dynamic routing

Dynamic protocols (RIP, OSPF, EIGRP, BGP) discover neighbors, exchange reachability, and recompute paths automatically when a link changes. Convergence is the time for every router to agree on the new best paths after a change, and it is the headline metric: link-state and EIGRP converge in seconds, classic RIP can take minutes. Dynamic routing scales to topologies no human could hand-maintain and reroutes around failures without intervention, at the cost of CPU, memory, and bandwidth for the protocol's own traffic, plus a larger attack surface (route injection, neighbor spoofing) that you mitigate with authentication.

Choosing

Use static for a small or stub network, a single Internet exit (one default route), or a deliberately pinned path. Use dynamic the moment the network has redundant paths that must fail over, more subnets than you want to track by hand, or multiple sites that change. Real networks routinely mix the two: a default static route to the ISP plus an IGP inside.

Static fits small or stub networks and a single default route; dynamic fits networks that must reroute on failure; production often runs both.

Protocol families: RIP, OSPF, EIGRP, BGP

The four protocols on N10-009 split by what they advertise to neighbors. Get the family right and the rest (metric, scope, behavior) follows.

RIP, distance-vector

Routing Information Protocol advertises only a destination plus a hop count and the next-hop direction, and it trusts what neighbors say like rumor. Its metric is hop count with a hard maximum of 15; a route at 16 hops is treated as unreachable (infinity), which caps RIP's usable network diameter at 15 hops. RIPv2 added subnet masks (classless, VLSM-capable) and multicast updates over the original RIPv1. It is simple to run but slow to converge and unsuitable for large networks.

OSPF, link-state

Open Shortest Path First is the dominant open-standard IGP, defined in RFC 2328 (OSPF Version 2)^[1]. Every router floods Link State Advertisements (LSAs) describing its own links, so all routers build an identical link-state database and independently run Dijkstra's shortest-path algorithm to compute routes. Its metric is cost, derived from interface bandwidth (lower cost preferred). OSPF scales through areas: a hierarchy where all non-backbone areas attach to the backbone, Area 0, which keeps each router's database and recomputation bounded. It converges fast but uses more memory and CPU than RIP.

EIGRP, advanced distance-vector

Enhanced Interior Gateway Routing Protocol is Cisco's protocol, frequently called hybrid because it blends distance-vector advertising with link-state-like fast reaction. Its DUAL algorithm precomputes a loop-free backup (the feasible successor), so on a failure it can switch instantly without full recomputation. Its metric is a composite weighted on bandwidth and delay by default. It converges quickly but historically ran only on Cisco gear.

BGP, path-vector

Border Gateway Protocol, RFC 4271 (A Border Gateway Protocol 4)^[2], is the routing protocol of the Internet. It advertises the full AS-path, the ordered list of autonomous systems a route crosses, and uses that path plus policy attributes to choose loop-free routes between organizations. BGP rides TCP port 179 for reliable, ordered session delivery, which is unusual; the other three carry their own transport. Because its job is policy between networks, it converges deliberately, not quickly.

The four N10-009 routing protocols by family: RIP and EIGRP distance-vector, OSPF link-state, BGP path-vector; only BGP is an EGP.

NAT, PAT, FHRP, and subinterfaces

Beyond choosing a routing protocol, objective 2.1 bundles four router functions that show up constantly: address translation, gateway redundancy, and inter-VLAN routing.

NAT and PAT

Network Address Translation (NAT) rewrites the private source address of a packet to a routable public one as it leaves the network, because RFC 1918^[3] private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) are not globally unique and cannot be routed across the Internet. The flavors differ by mapping:

Type	Mapping	Typical use
Static NAT	one private to one public, fixed	publish an inside server to the outside
Dynamic NAT	private to public from a pool, first-come	many inside hosts, a pool of public IPs
PAT (NAT overload)	many private to ONE public, by port	home/office: whole LAN shares one ISP IP

Port Address Translation (PAT) is the everyday case: the router tracks a unique source port per inside conversation and multiplexes thousands of hosts behind a single public address, which is why one residential IP serves an entire household. Remember the boundary: NAT hides and conserves addresses but does not inspect or filter, so it is not a substitute for a firewall.

FHRP and the virtual IP

A first hop redundancy protocol (FHRP) removes the default gateway as a single point of failure. Two or more routers share one virtual IP (VIP) and virtual MAC that hosts use as their gateway; an active router owns the VIP, and if it fails a standby takes over within seconds, with no change on any host. HSRP and GLBP are Cisco proprietary (GLBP additionally load-balances across the group), while VRRP is the open IETF standard, RFC 5798^[4], for a multi-vendor environment. Any question asking how to make the default gateway redundant without reconfiguring clients is answered by an FHRP.

Subinterfaces (router-on-a-stick)

To route between VLANs over a single physical link, a router uses subinterfaces: logical divisions of one port, each tagged for a different VLAN with 802.1Q and assigned that VLAN's gateway IP. This pattern, router-on-a-stick, carries all VLANs to the router over one trunk so a single port routes between many VLANs; a Layer 3 switch with switched virtual interfaces does the same job at higher scale.

Router-on-a-stick: one 802.1Q trunk carries multiple tagged VLANs to subinterfaces on a single router port, each holding that VLAN's gateway IP.

Exam-pattern recognition: how routing questions are framed

N10-009 routing items reward pattern recognition over memorized config. The stems repeat, and so do the right answers.

"Which route does the router use?"

The stem lists several table entries for overlapping prefixes and asks which one forwards a given destination. Apply the order: longest-prefix match first. The most specific prefix wins outright, before AD or metric. The classic trap offers the route with the lowest administrative distance or best metric as the answer, but a less specific prefix never beats a more specific one. Only when two entries share the same prefix do you fall to AD, then metric.

"Two protocols advertise the same network"

The stem says OSPF and a static route (or EIGRP and RIP) both know 10.1.1.0/24, and asks which the router installs. Lowest administrative distance wins: connected 0, static 1, eBGP 20, EIGRP internal 90, OSPF 110, RIP 120, iBGP 200. Static beating OSPF is the most-tested instance. Do not compare their metrics; metrics are only compared within one protocol.

"Pick the protocol for this scenario"

Map the scenario to the family: a stub site with one exit wants a static default route (0.0.0.0/0); a large multi-area enterprise wants OSPF; an all-Cisco shop wanting fast convergence may use EIGRP; connecting to another company or the Internet for policy routing needs BGP (eBGP). A frequent distractor is choosing BGP for an internal campus; BGP is for between autonomous systems, not internal convergence.

"Many hosts, one public IP" and "redundant gateway"

When the stem describes a LAN sharing a single ISP address, the answer is PAT (NAT overload), not static or dynamic NAT (those need a public IP per host or a pool). When it asks how to keep the default gateway available after a router failure without touching clients, the answer is an FHRP (VRRP for multi-vendor, HSRP/GLBP for Cisco); routing protocols reroute transit paths but do not give end hosts a redundant gateway IP. And when the stem wants inter-VLAN routing over a single physical link, the answer is router-on-a-stick with 802.1Q subinterfaces.

The repeating routing-question shapes: overlapping prefixes resolve by longest match, same prefix by lowest admin distance, and scenario stems map to a protocol family.

N10-009 routing protocols: family, scope, metric, and trust

Protocol	Family	Scope (IGP / EGP)	Metric	Admin distance
RIP (v2)	Distance-vector	IGP	Hop count (max 15)	120
OSPF	Link-state	IGP	Cost (bandwidth-based)	110
EIGRP	Advanced distance-vector (Cisco)	IGP	Composite (bandwidth + delay)	90 internal / 170 external
BGP	Path-vector	EGP (between AS)	AS-path + path attributes	20 eBGP / 200 iBGP
Static route	Manually configured	Either	None (admin-set)	1
Connected	Directly attached	n/a	None	0

Decision tree

Cheat sheet

Sharp facts the exam loves — give these one last read before exam day.

Cheat sheet

Sharp facts the exam loves — scan these before test day.

Longest-prefix match decides the route before anything else

When more than one route in the table covers a destination, the router forwards out of the most specific one, the route with the longest matching prefix, and this is settled before administrative distance or metric is even looked at. A packet to 10.1.1.5 takes a 10.1.1.0/24 entry over a 10.1.0.0/16 entry over a 0.0.0.0/0 default, because /24 is more specific than /16 which is more specific than /0. A /32 host route therefore beats every shorter prefix no matter how attractive the shorter route's AD or metric looks.

Trap Picking the entry with the lowest administrative distance or best metric when a different entry has a longer prefix; specificity is decided first, so the more specific prefix wins regardless of AD or metric.

Administrative distance ranks how much a router trusts a route's source

Administrative distance (AD) is a 0 to 255 trust value a router uses to choose between two sources advertising the same prefix, where lower is more trusted. It only arbitrates between sources; it never measures path quality and never travels in an advertisement, so it is local to one router. Once a source wins on AD, that protocol's own metric picks the best path within it.

Trap Treating administrative distance as a path metric; AD only chooses which source to believe for a prefix, while the metric (cost, hops) compares paths inside one protocol.

Memorize the default administrative distances in order

For the same prefix learned from multiple sources, the router installs the one with the lowest AD: directly connected is 0, static route is 1, external BGP (eBGP) is 20, EIGRP internal is 90, OSPF is 110, RIP is 120, EIGRP external is 170, and internal BGP (iBGP) is 200. The most-tested instance is a static route (1) beating an OSPF-learned route (110) for the same network. These compare only across sources of one prefix, never as path metrics.

Trap Assuming OSPF (AD 110) wins over a static route (AD 1) because OSPF is dynamic and seems smarter; the lower AD wins, so the static route is installed.

The metric breaks ties only within a single protocol

The protocol metric chooses the best path only after prefix length and administrative distance have already tied, and a lower metric is better. Each protocol measures differently: RIP counts hops, OSPF sums an inverse-bandwidth cost, and EIGRP computes a composite of bandwidth and delay. Comparing metrics across two different protocols is meaningless, which is exactly why AD exists to arbitrate between protocols first.

Static routing is hand-set, predictable, and silent

A static route is one administrator-entered line mapping a prefix to a next hop, so it uses no CPU or bandwidth advertising itself and is invisible to routing-protocol scans. Its weakness is that it does not react to failure: if the next hop dies the route blackholes traffic unless you add a floating static backup (a higher-AD static that activates only when the primary is gone). It fits small or stub networks and a single Internet exit.

The default route 0.0.0.0/0 is the gateway of last resort

A default route, written 0.0.0.0/0, matches any destination not covered by a more specific entry and sends it toward the configured next hop, typically the ISP. Because it is the shortest possible prefix (/0), longest-prefix match uses it only when nothing more specific matches. A stub site with one exit usually needs just this single static default plus its connected routes.

Dynamic routing trades overhead for automatic failover

Dynamic protocols discover neighbors, exchange reachability, and recompute paths on their own when a link changes, so they scale to networks too large to hand-edit and reroute around failures with no human. The cost is CPU, memory, and bandwidth for the protocol's own traffic, plus a larger attack surface (route injection, neighbor spoofing) you mitigate with protocol authentication. Reach for it the moment the network has redundant paths that must fail over or more subnets than you want to track by hand.

Convergence time is the headline difference between protocols

Convergence is the time for every router to agree on new best paths after a topology change, and it separates the protocols sharply: OSPF and EIGRP converge in seconds, while classic RIP can take minutes because it ages routes out slowly. A scenario that stresses fast recovery after a link failure is pointing at a link-state (OSPF) or advanced distance-vector (EIGRP) protocol, not RIP.

RIP is distance-vector and caps the network at 15 hops

Routing Information Protocol advertises only a destination, a hop count, and a direction, trusting neighbors like rumor, which makes it simple but slow. Its metric is hop count with 16 meaning unreachable (infinity), so the usable network diameter is 15 hops. RIPv2 added subnet masks (classless/VLSM) and multicast updates over RIPv1, but any topology wider than 15 hops needs OSPF or EIGRP instead.

Trap Picking RIP for a large network because it is simple; a route at 16 hops is unreachable, so RIP cannot span more than 15 hops.

OSPF is link-state, uses cost, and scales with areas

Open Shortest Path First (RFC 2328) has every router flood Link State Advertisements (LSAs) describing its own links, so all routers build an identical map and run Dijkstra to compute shortest paths by cost (lower is better, derived from bandwidth). It scales through areas, a hierarchy where every non-backbone area attaches to the backbone, Area 0, keeping each router's database bounded. It converges fast at the cost of more memory and CPU than RIP.

Trap Assuming OSPF uses hop count like RIP; OSPF's metric is bandwidth-based cost, and an area design must connect every area to Area 0.

2 questions test this

EIGRP is Cisco's advanced distance-vector protocol

Enhanced Interior Gateway Routing Protocol blends distance-vector advertising with link-state-style fast reaction, which is why it is often called hybrid. Its DUAL algorithm precomputes a loop-free backup (the feasible successor) so it can switch on a failure without full recomputation, and its metric is a composite weighted on bandwidth and delay. It converges quickly but historically ran only on Cisco equipment.

BGP is the path-vector protocol that runs the Internet

Border Gateway Protocol (RFC 4271) advertises the full AS-path, the ordered list of autonomous systems a route crosses, and uses that path plus policy attributes to pick loop-free routes between organizations. It is the only exterior gateway protocol (EGP) in use and rides TCP port 179 for reliable, ordered delivery, unlike the IGPs which carry their own transport. Because its job is policy between networks, it converges deliberately rather than fast.

Trap Running BGP inside a single campus for fast convergence; BGP is for policy between autonomous systems, and an IGP (OSPF or EIGRP) is the right tool inside one AS.

IGPs route inside one AS; BGP routes between them

An interior gateway protocol (IGP), namely OSPF, RIP, or EIGRP, finds best paths inside a single autonomous system, while an exterior gateway protocol (EGP), in practice only BGP, connects separate autonomous systems. The same BGP runs two ways the exam contrasts: external BGP (eBGP) peers between two different AS numbers, and internal BGP (iBGP) carries those learned routes across routers within one AS. Their trust differs accordingly, eBGP at AD 20 and iBGP at AD 200.

NAT translates non-routable private addresses to public ones

Network Address Translation rewrites a packet's private RFC 1918 source address (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) to a routable public address on the way out, because private addresses are not globally unique and cannot be routed on the Internet. Static NAT maps one private address to one public address permanently to publish an inside server, while dynamic NAT hands out public addresses from a pool to inside hosts on a first-come basis.

6 questions test this

PAT (NAT overload) lets one public IP serve a whole network

Port Address Translation maps many private hosts to a single public IP by tracking a unique source port per conversation, which is why one residential or office ISP address can serve thousands of devices. It is the everyday default and the answer whenever a stem describes a LAN sharing one public address. Static NAT (one-to-one) and dynamic NAT (a pool) both still need a public IP per simultaneous host, so they do not solve the one-address case.

Trap Choosing static or dynamic NAT when many hosts must share a single public IP; only PAT multiplexes them behind one address by port.

23 questions test this

NAT hides and conserves addresses but is not a firewall

NAT and PAT rewrite addresses to conserve public IPs and obscure the inside topology, but they do not inspect or filter traffic and outbound-initiated sessions still pass freely. Treating NAT as a security control leaves the network unprotected; an actual stateful firewall or ACL is still required alongside the translation.

Trap Relying on NAT or PAT as the network's security boundary; address translation provides no traffic inspection, so a real firewall or ACL is still needed.

An FHRP gives hosts a redundant virtual gateway IP

A first hop redundancy protocol (FHRP) lets two or more routers share one virtual IP (VIP) and virtual MAC that hosts use as their default gateway, so when the active router fails a standby takes over the VIP within seconds and no host setting changes. This is the answer when a stem asks how to remove the default gateway as a single point of failure without reconfiguring clients. Routing protocols reroute transit paths but do not provide end hosts a redundant gateway address.

Trap Reaching for a dynamic routing protocol to make the default gateway redundant; routing protocols reroute transit paths, but only an FHRP hands hosts a failover virtual gateway IP.

4 questions test this

VRRP is the open FHRP; HSRP and GLBP are Cisco

VRRP (RFC 5798) is the vendor-neutral IETF first hop redundancy protocol for a mixed-vendor environment, while HSRP and GLBP are Cisco proprietary. GLBP additionally load-balances traffic across all routers in the group rather than leaving the standbys idle. Pick VRRP when the question specifies multi-vendor or an open standard; pick HSRP or GLBP when it specifies an all-Cisco network.

4 questions test this

Router-on-a-stick uses 802.1Q subinterfaces for inter-VLAN routing

To route between VLANs over a single physical link, a router divides one port into subinterfaces, each tagged for a different VLAN with 802.1Q and assigned that VLAN's gateway IP, so one trunk carries all VLANs to the router and one port routes among them. This pattern is called router-on-a-stick. A Layer 3 switch with switched virtual interfaces does the same job at higher scale and is preferred when port density or throughput matters.

5 questions test this

A floating static route is a backup that activates on failure

A floating static route is a static route configured with a deliberately higher administrative distance than the primary path, so it stays out of the table until the preferred route disappears. It gives static routing a manual failover: when the primary next hop or dynamic route is lost, the higher-AD static floats into the table and keeps traffic moving. It is the simple way to add redundancy without running a full dynamic protocol.

An exhausted dynamic-NAT pool or PAT port range drops new sessions while existing ones survive

Dynamic NAT hands each inside host a public address from a finite pool; once every pool address is in use, further connection attempts fail until a mapping times out or is released. PAT (NAT overload) instead multiplexes many hosts behind one public IP using unique source ports, but each IP offers only about 65,000 ports, so heavy session counts can exhaust the ports and block new outbound sessions even though the WAN link is up. NAT and PAT entries are stateful and are reclaimed automatically after an idle timeout.

Trap Blaming a dead WAN link when an operational interface plus a full translation table points to pool or port exhaustion.

8 questions test this

FHRP elects the highest priority; preemption (default on in VRRP, off in HSRP) lets it take back over

First-hop redundancy protocols elect the gateway with the highest configured priority as master/active. Preemption governs whether a higher-priority router that comes online later seizes the role from a current lower-priority master: VRRP enables preemption by default, while HSRP requires it to be turned on explicitly. In VRRP, the priority value 255 is reserved for the router that actually owns the virtual IP address, and that owner always becomes master.

Trap Assuming a higher-priority router always takes over immediately, which only happens when preemption is enabled (it is off by default in HSRP).

4 questions test this

Also tested in

AZ-104 Microsoft Azure Administrator

References

RFC 2328 — OSPF Version 2 Whitepaper
RFC 4271 — A Border Gateway Protocol 4 (BGP-4) Whitepaper
RFC 1918 — Address Allocation for Private Internets Whitepaper
RFC 5798 — Virtual Router Redundancy Protocol (VRRP) Version 3 Whitepaper