AP Networking — Cheatsheet
Formulas, exam-day tips, and key terms on one page.
On the exam
- For a scenario about **layered network communication**, identify the decisive evidence before naming a response. A defensible conclusion here is: The application data remains conceptually the same while lower-layer framing changes from link to link.
- For a scenario about **IPv4 addressing and subnet boundaries**, identify the decisive evidence before naming a response. A defensible conclusion here is: A router must move the packet between the two /24 networks.
- For a scenario about **local media, switching, and performance measures**, identify the decisive evidence before naming a response. A defensible conclusion here is: The evidence points to wireless quality, not insufficient advertised internet bandwidth.
- For a scenario about **Layer 2 forwarding and logical segmentation**, identify the decisive evidence before naming a response. A defensible conclusion here is: VLANs provide segmentation, but policy at the routed boundary determines what communication is allowed.
- For a scenario about **routing tables, next hops, and path decisions**, identify the decisive evidence before naming a response. A defensible conclusion here is: The router forwards through gateway B using the /24 route.
- For a scenario about **wireless design, channels, roaming, and capacity**, identify the decisive evidence before naming a response. A defensible conclusion here is: Treat this as a capacity and airtime problem, then validate the redesign under realistic load.
- For a scenario about **core network services**, identify the decisive evidence before naming a response. A defensible conclusion here is: Investigate DHCP and local connectivity before blaming name resolution.
- For a scenario about **TCP, UDP, ports, and application dependencies**, identify the decisive evidence before naming a response. A defensible conclusion here is: Different parts of one application can choose different transports based on their requirements.
- For a scenario about **virtual networks, redundancy, and shared responsibility**, identify the decisive evidence before naming a response. A defensible conclusion here is: Multiple front-end servers do not make the whole service resilient when a critical shared dependency is singular.
- For a scenario about **observable and supportable network operations**, identify the decisive evidence before naming a response. A defensible conclusion here is: Convert the vague symptom into measured scope, then compare evidence across the path.
- For a scenario about **hypothesis-driven fault isolation**, identify the decisive evidence before naming a response. A defensible conclusion here is: The narrow scope makes a building-wide router failure unlikely; test the local path first.
- For a scenario about **safe network change and operational resilience**, identify the decisive evidence before naming a response. A defensible conclusion here is: A technically valid update is still a poor operational change when timing, validation, and recovery are missing.
- For a scenario about **network access policy and containment**, identify the decisive evidence before naming a response. A defensible conclusion here is: Create a distinct guest segment with default-deny access to internal resources.
- For a scenario about **protecting administrative planes and remote connections**, identify the decisive evidence before naming a response. A defensible conclusion here is: Remove Telnet and shared credentials, restrict reachability, and log accountable encrypted administration.
- For a scenario about **network security evidence and response**, identify the decisive evidence before naming a response. A defensible conclusion here is: The correlated timeline supports rapid containment while a broader scope investigation continues.
How to get a 5
- Show the arithmetic on any subnetting question. 2^n − 2 written out earns the point that a bare answer does not.
- When a symptom is "local works, external fails", say what that rules OUT as well as what it rules in — proving the endpoints are fine is half the diagnosis.
- For each diagnostic tool you name, state what a pass and a fail would each tell you. A tool with no stated interpretation earns nothing.
- Do not describe TCP as simply "better" than UDP. Every answer that treats reliability as a universal good misses the point real-time traffic is making.
Key terms
OSI layers (1–7) — Physical, Data Link, Network, Transport, Session, Presentation, Application. Mnemonic: Please Do Not Throw Sausage Pizza Away.
TCP/IP model layers — Link, Internet, Transport, Application. Fewer layers than OSI and maps to what is actually implemented.
Encapsulation — Each layer adds its own header to the payload from the layer above: transport header, then IP header, then link frame. The receiver strips them in reverse.
Which layer uses which address — Layer 2 uses MAC addresses (local segment, changes each hop). Layer 3 uses IP addresses (end to end, unchanged across hops).
Switch vs. router — A switch forward frames by MAC within one broadcast domain (layer 2). A router forward packets by IP between networks (layer 3) and separates broadcast domains.
Hub vs. switch — A hub repeats every bit to every port — one collision domain. A switch learns MACs and forward only to the correct port.
Broadcast domain — The set of devices a broadcast reaches. Bounded by routers, and by VLANs on a switch. Oversized broadcast domains waste bandwidth on every host.
VLAN — Logically splits one physical switch into separate broadcast domains. Inter-VLAN traffic must cross a router, which is where access control can be enforced.
TCP vs. UDP — TCP is connection-oriented, ordered, reliable, with flow and congestion control. UDP is connectionless and best-effort, with lower latency and less overhead.
TCP three-way handshake — SYN → SYN-ACK → ACK. Synchronizes initial sequence numbers in both directions and confirms both hosts are willing before data flows.
How TCP achieves reliability — Sequence numbers (ordering, duplicate detection), acknowledgements with retransmission on timeout, checksums (corruption), sliding window (flow control).
Head-of-line blocking — TCP delivers strictly in order, so a lost segment stalls everything behind it. This is why real-time media prefers UDP — a late frame is useless anyway.
Port numbers — Identify the application endpoint within a host. Well-known: 22 SSH, 25 SMTP, 53 DNS, 80 HTTP, 443 HTTPS, 67/68 DHCP.
DHCP — Automatically assigns addressing to clients: IP address, subnet mask, default gateway and DNS servers. Without it every device is configured by hand.
DORA — Discover, Offer, Request, Acknowledge — the four DHCP messages, in that order. The client broadcasts first because it has no address yet.
DNS resolution on a cache miss — Resolver queries root → TLD server → authoritative server, then caches the answer for its TTL. Root servers delegate; they do not hold the record.
Reaching a site by IP but not by name — Isolates the fault to DNS. Connectivity, routing, and the server are all proven working by the successful IP test.
Default gateway — The router address a host sends traffic to when the destination is not on its own subnet. Wrong or missing gateway is the classic "local works, internet does not" fault.
Subnet mask — Marks which bits of an address are network and which are host. Tells a host whether a destination is local or must go via the gateway.
Usable hosts in a subnet — 2^(host bits) − 2. The all-zeros host address is the network ID and the all-ones is the broadcast address, so neither can be assigned.
/24, /26, /30 host counts — /24 → 254 usable · /25 → 126 · /26 → 62 · /27 → 30 · /28 → 14 · /30 → 2 (the classic point-to-point link).
Longer prefix means what — Fewer host bits, so fewer hosts per subnet but more subnets. The two trade directly against each other.
Private address ranges (RFC 1918) — 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16. Not routable on the public internet; NAT translates them at the boundary.
NAT — Rewrites private addresses to a public one at the boundary, letting many internal hosts share one public address. It also incidentally hides internal structure.