Educational model — not real hardware, traffic or official certification.
57 / 57 · 0 Completed
OSI separates responsibilities: application services, presentation encoding, session coordination, transport delivery, network addressing, data-link framing and physical signals. Troubleshoot from observed evidence, not by assuming every failure is a cable fault. TCP/IP combines some OSI responsibilities.
StartA star centralizes links at a switch; a ring connects neighbors; a mesh adds redundant paths. Physical topology describes cabling, while logical topology describes how frames flow. Redundancy can create Ethernet loops unless a loop-prevention design exists.
StartCSMA/CD belongs to shared, half-duplex Ethernet. A station senses carrier, transmits when idle, detects a collision and retries after binary exponential backoff. Modern switched full-duplex Ethernet has separate transmit/receive paths and does not use collision detection.
StartCopper Ethernet, optical fiber and AV media have different electrical and protocol roles. Twisted-pair copper can supply PoE within its specified limits; optical fiber does not deliver PoE power. HDMI carries video/audio and optional control, not ordinary simulated Ethernet. Cable compatibility and interface state matter before addressing.
StartARP maps an IPv4 next-hop address to a link-layer address on the local segment. For a remote destination, a host resolves the default gateway MAC, not the remote host MAC. Requests are normally broadcast; responses update local neighbor state. ARP does not authenticate the sender.
StartDHCP leases addressing parameters; DNS resolves names to records. DHCP discovery, offer, request and acknowledgement establish a lease. A valid IP address does not prove the DNS server or record is correct. Validate scope subnet, exclusions, gateway and DNS options separately.
StartA stub resolver checks local state and asks a recursive resolver. On a cache miss, the resolver may follow root, top-level domain and authoritative referrals. Cached answers respect TTL. NXDOMAIN means the queried name does not exist; timeout means an answer was not obtained. The existing topology resolver is deliberately simpler.
StartAn IP packet identifies source/destination across routed networks. An Ethernet frame delivers that packet over one local link. Routers remove incoming link headers, update forwarding-relevant IP fields and create a new outgoing frame. Switches usually forward frames within a VLAN without routing the packet.
StartEncapsulation adds headers as application data descends through transport, internet and link layers. TCP data is called a segment, UDP a datagram, IP a packet and Ethernet a frame. These names describe different wrapping levels, not interchangeable physical objects.
StartPing sends ICMP Echo Requests and observes Echo Replies or errors. A successful test demonstrates a specific path at that moment, not that every application works. Policy can block ICMP while allowing HTTPS. A complete exchange needs a usable return path as well as an outbound route.
StartTCP creates state through SYN, SYN-ACK and ACK. Sequence numbers track byte streams; acknowledgements report the next expected byte. Retransmission handles loss, and flow control protects the receiver. FIN closes a direction gracefully; RST aborts state.
StartA Wi-Fi station associates with an AP and passes authentication before data reaches a wired distribution network. The AP bridges between 802.11 and Ethernet framing; VLAN assignment must match the intended wired segment. Wireless association is not proof of DHCP or routed connectivity.
StartCIDR indicates the number of network bits. Remaining bits determine block size. For ordinary broadcast subnets the first and last addresses are network and broadcast; /31 point-to-point links and /32 host routes use different semantics. Always normalize an input host to its network before allocating.
StartVariable-Length Subnet Masking allocates different sized blocks from a parent network. Sort host requirements largest first, include reserved addresses, round up to a power of two and align each block. Never overlap allocations or exceed the parent. This planner allocates ordinary LAN subnets, not /31 links.
StartIPv6 uses 128-bit addresses expressed as eight hexadecimal hextets. Leading zeros may be omitted; one consecutive run of zero hextets may be compressed with ::. Link-local addresses use fe80::/10; documentation examples use 2001:db8::/32. IPv6 has multicast rather than broadcast.
StartNDP uses ICMPv6 for neighbor and router discovery. Router Advertisements communicate default-router information and prefixes. An autonomous /64 prefix can enable SLAAC; DHCPv6 can provide addresses or other configuration depending on deployment. DHCPv6 does not replace RA default-route discovery. Duplicate Address Detection checks uniqueness.
StartThe IPv4 prefix table relates CIDR to mask, total addresses and usable hosts. Each additional prefix bit halves a block. Wildcard masks are the inverse of subnet masks. Remember special /31 and /32 behavior and that a mask must be contiguous.
StartA switch forwards frames within a broadcast domain using destination MAC information. Each port is a separate collision domain in switched Ethernet. VLANs split broadcast domains. A layer-3 switch can also route when configured, but L2 forwarding alone does not connect different IP networks.
StartA learning bridge records source MAC, ingress port and VLAN. Known unicast forwards to the learned destination port. Unknown unicast floods eligible ports in the same VLAN except ingress. A move updates the source location; aging removes stale entries. This exercise describes a learning table separate from the topology engine.
StartAccess ports normally carry one endpoint VLAN. Trunks carry multiple VLANs with 802.1Q tags except configured native behavior. Both ends need compatible allowed VLANs. Changing an endpoint IP cannot repair a VLAN mismatch. Inter-VLAN routing requires a layer-3 interface for each segment.
StartSTP prevents L2 loops by electing a root bridge and selecting forwarding paths while blocking redundant ones. Lowest bridge ID wins root election; path cost guides root-port selection with tie-breakers. RSTP improves convergence. STP is not part of the legacy topology forwarding engine; this is a separate decision exercise.
StartA logical bundle combines compatible physical links, often negotiated with LACP. Flow hashing keeps a flow on a member to avoid reordering; one flow usually cannot exceed one member link. A failed member reduces aggregate capacity without necessarily breaking all traffic.
Start802.1X separates a supplicant, an authenticator and an authentication server such as RADIUS. The controlled port restricts normal data until authorization succeeds. EAP identity alone is not access approval. Failure policies and exceptions need deliberate least-privilege design.
StartA router selects an outgoing path for an IP destination and decrements TTL or hop limit. It connects distinct broadcast domains rather than forwarding every L2 broadcast. Forwarding needs a suitable route and reachable next hop; successful bidirectional traffic also requires return routing.
StartA default route is the least-specific match. More specific prefixes win before administrative distance; distance selects among candidates for the same prefix. A floating static backup uses a less-preferred distance so it becomes active when the primary route is unavailable.
StartRouting compares destination membership against route prefixes and chooses the matching route with the most network bits. A /24 match outranks /16 and /0 regardless of the default route being shorter to configure. Preference only resolves appropriate equal-prefix candidates.
StartNAT rewrites address tuples; PAT additionally maps ports so multiple inside sessions share one outside address. Return packets must match active mappings. NAT does not inherently authenticate a user or replace firewall policy. Logging inside/outside tuples aids troubleshooting.
StartStatic routes are manually defined. OSPF uses link-state shortest paths within an autonomous system; BGP exchanges reachability with policy between peers; RIP is a distance-vector protocol with hop-count limits. Select a protocol for scale, policy, failure behavior and administrative boundaries.
StartBGP exchanges network prefixes and attributes over established TCP sessions. Policy can prefer higher local preference before comparing AS-path length. Actual implementations have additional tie-breakers. This lesson uses a stated simplified ordering and does not claim a full vendor decision process.
StartOSPF neighbors exchange link-state information and each router runs shortest-path first over its link-state database. Path cost is the sum of link costs, not physical hop count alone. Area boundaries and neighbor parameters affect operation; this lesson focuses on cost comparison.
StartQoS classifies and marks traffic, then applies queuing, shaping or policing during contention. Low-latency queues can protect real-time media but need limits so other traffic is not starved. Markings must be trusted only at controlled boundaries; QoS cannot create missing bandwidth.
StartVPN tunnels authenticate peers and protect traffic between defined endpoints. IPsec policies select traffic and negotiate security associations; WireGuard uses keys and allowed IPs for peer mapping. Routes, policy and key trust all matter. Encryption is not a substitute for endpoint authorization.
StartEncapsulation reduces space for an inner packet. If the underlay MTU is 1500 and modeled tunnel overhead is 80 bytes, inner MTU is 1420. Path MTU discovery and ICMP messages prevent black holes; filtering those messages can break large transfers while small pings work.
StartWi-Fi uses a shared radio medium. Stations contend for airtime, and physical-layer rates differ from usable throughput. Signal, noise, channel occupancy and authentication all affect service. An SSID identifies a network but does not itself prove isolation or security.
StartChannel planning considers occupied bandwidth and neighboring transmitters. In many 2.4 GHz deployments with 20 MHz channels, 1, 6 and 11 provide a common non-overlapping plan. Wider channels consume more spectrum. Regulatory channels and DFS rules vary by region.
StartRoaming is usually a client decision influenced by RSSI, retries, policy and capabilities. Overlap supports transition, but excessive co-channel overlap wastes airtime. Matching security and network design are needed to preserve sessions; strongest signal is not the only quality metric.
StartBeamforming adjusts antenna phase/amplitude to improve received signal in useful directions. It needs channel information and compatible capability; it does not eliminate obstacles, interference or airtime contention. Distinguish multiple spatial streams from a claim that every client gets dedicated bandwidth.
StartWPA2/WPA3 protect link access and traffic with different authentication methods. Enterprise designs use individual credentials and EAP-based authentication, often certificate trust. WPA3-Personal uses SAE rather than the old PSK handshake model. A secure SSID still needs safe segmentation and endpoint controls.
Start802.11 generations add modulation, channel widths and efficiency capabilities. 802.11n uses 2.4/5 GHz; ac focuses on 5 GHz; ax supports efficient multi-user operation and Wi-Fi 6E extends into 6 GHz. Marketing link rates are not application throughput; region and client support limit use.
StartEnterprise design starts with coverage and capacity requirements, then surveys RF, channel reuse, power and client behavior. 802.11k/v/r can assist discovery/transition where supported. Voice and AV require attention to roaming delay, multicast policy, QoS and wired uplink capacity.
StartDHCP snooping distinguishes trusted server ports and builds bindings; Dynamic ARP Inspection validates ARP where configured; port security limits accepted MAC behavior. Incorrect trust settings can block legitimate traffic. These controls supplement segmentation and monitoring rather than replace them.
StartOrdered ACLs evaluate source, destination, protocol and ports. First matching rule controls the result; an implicit deny commonly applies at the end. Broad early rules can shadow specific later ones. Test allowed and forbidden flows, not only one success case.
StartTLS negotiates parameters and establishes protected communication with authenticated endpoints. TLS 1.3 combines key agreement with certificate-based server authentication in common deployments. Trust checks include name, chain, validity and appropriate use. It protects data in transit, not an already compromised endpoint.
StartZone policies group interfaces/resources and define which traffic can cross boundaries. Default deny with explicit service allowances supports least privilege. Return state may be handled by a stateful engine. This lesson separates zone authorization from the legacy topology basic rule model.
StartA leaf certificate chains through intermediates to a trusted root. Signature checks, validity, hostname and intended use all matter; revocation handling depends on policy and mechanism. Private keys must remain protected. Importing an arbitrary root can authorize untrusted issuers.
StartCorrelate timestamps, flow tuples, DNS, authentication and endpoint evidence. Preserve originals and track how evidence was acquired. A single unusual connection is a lead, not proof of compromise. Distinguish observations from hypotheses and explain confidence and missing data.
StartPhishing manipulates trust, urgency and identity to induce unsafe actions. Check sender domain, actual link destination and unexpected requests. Report through an established channel; do not reply with credentials or open suspect attachments to investigate. Exercises here use synthetic examples only.
StartAn attacker can advertise a forged IP-to-MAC mapping because basic ARP lacks authentication. Traffic may be redirected through the attacker. DAI with accurate bindings can reject inconsistent advertisements; encryption and endpoint verification reduce interception risk but do not restore a poisoned L2 mapping by themselves.
StartAuthentication proves an identity, authorization decides permitted actions and accounting records activity. MFA strengthens authentication but does not grant every privilege. Service accounts and human accounts need different lifecycle and monitoring controls.
StartA stateful firewall tracks permitted conversations and may allow matching return traffic. NAT rewrites tuples, so state/policy inspection must identify whether addresses are viewed before or after translation. Asymmetric paths, stale state or mismatched zones can break replies. The old topology firewall remains a simpler ordered rule model.
StartDocument collection time, collector, source and transformations. Hashes detect later changes, while chain of custody documents handling. Work on copies and protect original evidence. Isolation and collection order depend on risk and volatility; never claim a hash proves who created a file.
StartZero trust evaluates identity, device posture, resource and context rather than trusting network location alone. Decisions should be least privilege and reassessed as risk changes. Being on the internal VLAN does not automatically authorize a protected application.
StartCloud virtual networks provide addressing, subnets, routing and security controls on provider infrastructure. Public and private access depend on route tables and policy, not a subnet name. Security groups, network ACLs and service endpoints have provider-specific semantics.
StartSeparate web, application and database tiers. Permit only required flows, such as load balancer to application and application to database. Management access and outbound dependencies need explicit controls. Do not expose a database publicly merely because it uses authentication.
StartDiagnostic commands answer different questions: Get-NetIPConfiguration inspects addressing, Resolve-DnsName inspects resolution, Test-NetConnection can test reachability/TCP and Get-NetRoute inspects routes. These examples are reference PowerShell, not commands executed by this website.
StartDefine the symptom and scope, gather evidence, form a falsifiable hypothesis, make one controlled change, retest and document. Separate link, VLAN, address, route, DNS and policy evidence. A diagnostic workflow should avoid random changes that hide the original fault.
StartPractice should connect answers to mechanisms and evidence. Review why distractors are wrong, then perform a relevant exercise. A mock score is a local learning signal, not an official exam result or guarantee. Network+ and Security+ preparation have overlapping but distinct scopes.
Start