Explanation/Reference:
Section: Addressing and Routing Protocols in an Existing Network Explanation Explanation:
A /20 subnet mask contains 4,094 valid host addresses. A subnet mask specifies how many bits belong to the network portion of a 32bit IP address. The remaining bits in the IP address belong to the host portion of the IP address. To determine how many host addresses are defined by a subnet mask, use the formula
2n2, where n is the number of bits in the host portion of the address. A /20 subnet mask uses 12 bits for host addresses, so 212 -2 equals 4,094 valid host addresses.
Although it is important to learn the formula for calculating valid host addresses, the following list demonstrates the relationship between subnet masks and valid host addresses:

Reference:
CCDA 200-310 Official Cert Guide, Chapter 8, IPv4 Address Subnets, pp. 302-310 Cisco: IP Addressing and Subnetting for New Users