Network Troubleshooting Flashcards

Question 1

What is the first step in a structured network troubleshooting process?

Accepted Answer

The first step is to identify the problem by gathering information from the user and the environment. Ask what changed, who is affected, what symptoms appear, and whether the issue is constant or intermittent. Reproducing the problem and defining its scope prevents wasted effort on the wrong component.

Question 2

Why should a technician establish a theory of probable cause before testing?

Accepted Answer

A theory of probable cause is a reasoned guess about the most likely source of the fault, based on the symptoms gathered. Testing against a theory keeps work focused and efficient. Starting with the most likely causes, then moving to less likely ones, usually resolves issues faster than random changes.

Question 3

What does it mean to change only one variable at a time when testing?

Accepted Answer

Changing one variable at a time means altering a single setting or component, then observing whether the symptom changes before making another change. This isolates the cause, because any improvement can be attributed to that specific change. Making several changes together can hide the real fix and may introduce new problems.

Question 4

Why is it important to document changes and results during troubleshooting?

Accepted Answer

Documentation records every action taken, the result observed, and the time it occurred. This history lets you roll back changes that made things worse, avoids repeating failed steps, and gives others a clear account if the issue returns or is escalated. Good notes also support future troubleshooting of similar faults.

Question 5

What is the difference between a hard failure and an intermittent failure?

Accepted Answer

A hard failure is a consistent fault that occurs every time the affected function is used, so it is usually easier to reproduce. An intermittent failure appears and disappears unpredictably, which makes it harder to diagnose. Intermittent faults often point to marginal hardware, loose connections, duplicate addresses, or load-related problems.

Question 6

What should you verify after applying a fix to confirm the problem is resolved?

Accepted Answer

After a fix, verify that the original symptom is gone and that the affected user can complete the task that failed. Also confirm that the change did not break anything else, such as other users, services, or connections. Finally, record the outcome and inform the user so the ticket can be closed with confidence.

Question 7

Why should you ask whether anything changed recently when a network problem begins?

Accepted Answer

Recent changes are the most common source of new network faults, so they are a strong first lead. A software update, configuration edit, new device, cable move, or power event may explain why a previously working connection suddenly stopped. Identifying the change often narrows the search dramatically.

Question 8

What is an escalation, and when should a technician escalate a network problem?

Accepted Answer

Escalation means passing a problem to a more senior or specialized team when it exceeds your authority, skills, or available tools. Technicians should escalate when the cause is outside their control, when service is affected, when a fix risks major disruption, or when repeated attempts fail. Complete notes help the next team.

Question 9

What is the OSI model and why do troubleshooters use it?

Accepted Answer

The OSI model is a conceptual framework that divides network communication into seven layers, from physical signaling up to application services. Troubleshooters use it to organize their thinking, so each symptom can be matched to the layer where faults most likely occur. This keeps testing systematic instead of random.

Question 10

What are the seven layers of the OSI model, listed from bottom to top?

Accepted Answer

From bottom to top, the seven OSI layers are physical, data link, network, transport, session, presentation, and application. A common memory aid for the order from top to bottom is All People Seem To Need Data Processing, though any mnemonic works if it preserves the sequence.

Question 11

What is a bottom-up troubleshooting approach, and when is it useful?

Accepted Answer

A bottom-up approach starts at the physical layer and moves upward, confirming each layer works before testing the next. It is effective for basic connectivity failures, such as a dead link, because lower-layer faults can make higher-layer symptoms misleading. Its drawback is that it can take time to reach the actual problem.

Question 12

How does a top-down troubleshooting approach differ from bottom-up?

Accepted Answer

A top-down approach starts with the application the user is trying to use and works downward toward the physical network. It suits cases where the network is known healthy and the fault seems tied to one application. It can overlook a failing cable when symptoms seem to point at software.

Question 13

What is divide and conquer in network troubleshooting?

Accepted Answer

Divide and conquer means splitting the path between the user and the destination into segments, then testing the midpoint to determine which half contains the fault. Repeating this narrows the problem quickly, much like a binary search. It is especially useful on long paths with many devices.

Question 14

Which OSI layer is responsible for logical addressing and routing between networks?

Accepted Answer

The network layer, layer 3, is responsible for logical addressing and routing packets between networks. IP addresses, subnet masks, and routers operate here. When a host can reach devices on its own subnet but not beyond it, a network layer fault such as a wrong default gateway is a likely suspect.

Question 15

Which OSI layer handles reliable end-to-end delivery and port numbers?

Accepted Answer

The transport layer, layer 4, manages end-to-end delivery between applications using port numbers. TCP provides reliable, ordered delivery with acknowledgments, while UDP offers faster, connectionless transmission. When a network reaches a host but a specific service fails, checking ports and transport behavior often reveals the cause.

Question 16

Why is it useful to map each symptom to a specific OSI layer?

Accepted Answer

Mapping a symptom to a layer narrows the set of possible causes and tells you which tools to use next. For example, a link light that is off suggests a physical fault, while a valid address with a failed name lookup points upward toward application services. This habit turns vague complaints into testable hypotheses.

Question 17

What are common signs of a physical layer fault on a wired network?

Accepted Answer

Common signs include no link light on the port, intermittent connectivity that changes when a cable is moved, excessive errors on an interface, and slow transfers despite a connected status. Physical faults often stem from damaged cables, loose connectors, faulty ports, or interference. Swapping in a known good cable is a fast check.

Question 18

Why does a duplex mismatch cause performance problems on Ethernet links?

Accepted Answer

A duplex mismatch occurs when one end of a link runs full duplex while the other runs half duplex. The result is collisions, late collisions, and CRC errors on the half-duplex side, producing slow throughput even though the link appears up. Matching speed and duplex settings on both ends usually resolves it.

Question 19

What does a CRC error indicate, and what commonly causes it?

Accepted Answer

A CRC error means a received frame failed its cyclic redundancy check, so its data was corrupted in transit. Common causes include damaged or excessively long cables, electromagnetic interference, faulty network interface cards, and duplex mismatches. Counters should be checked over time to see if they keep rising.

Question 20

What is a broadcast storm, and how can it disrupt a switched network?

Accepted Answer

A broadcast storm occurs when broadcast frames circulate endlessly, usually because of a switching loop, consuming bandwidth and processing resources. Devices become slow or unresponsive as legitimate traffic is crowded out. Spanning Tree Protocol is designed to block redundant paths and prevent such loops. Many ports flashing activity lights together and rising broadcast counters help confirm it.

Question 21

How can a VLAN misconfiguration cause a device to lose connectivity?

Accepted Answer

A VLAN misconfiguration can place a device's switch port in the wrong VLAN, so it cannot reach hosts in its intended segment. Mismatched trunk settings, where one side tags frames and the other does not, can also isolate traffic. Verifying the port's VLAN membership and trunk configuration on both sides usually reveals the problem.

Question 22

What is the purpose of a loopback test on a network interface or cable?

Accepted Answer

A loopback test sends traffic from an interface back to itself, verifying that the device's hardware and driver can transmit and receive without involving the wider network. Hardware loopback plugs can test a port, while software loopback addresses test the local stack. Passing results make local hardware a less likely cause.

Question 23

Why might a device show a link light but still fail to communicate?

Accepted Answer

A link light only confirms that a physical signal is detected between two ports, not that the link is usable. Problems such as a VLAN mismatch, a duplex mismatch, a bad driver, or a fault above layer 2 can still prevent communication. Checking higher layers is necessary after confirming the link is up.

Question 24

How do you check for a faulty or damaged cable using a cable tester?

Accepted Answer

A cable tester checks continuity and wiring of each conductor, revealing opens, shorts, crossed pairs, and split pairs. Testing both ends and comparing results helps distinguish a cable fault from a port fault. For longer runs, a time-domain reflectometer can estimate the distance to a break.

Question 25

What information does a host need to communicate beyond its local subnet?

Accepted Answer

A host needs a valid IP address, a correct subnet mask, a default gateway, and usually one or more DNS server addresses. Without the correct gateway, traffic destined for other networks cannot leave the local segment. Each item must be consistent with the others to work properly.

Question 26

What does the ping command test, and what does a failed ping not necessarily prove?

Accepted Answer

Ping sends ICMP echo requests to a target and reports whether echo replies return, along with round-trip times. A successful ping shows basic reachability at the network layer. A failed ping does not prove the host is down, because firewalls may block ICMP while the service still works.

Question 27

What does traceroute reveal, and how is it useful for locating a fault?

Accepted Answer

Traceroute displays the sequence of routers a packet passes through on its way to a destination, along with response times at each hop. It is useful for locating a fault because the last responding hop shows how far traffic travels before failing. Silent hops alone are not conclusive, since some routers ignore probes.

Question 28

How can you identify an IP address conflict on a local network?

Accepted Answer

An IP address conflict happens when two devices claim the same address, causing intermittent or failed connections. Operating systems often log duplicate address warnings, and checking the ARP table can reveal two different MAC addresses responding to one IP. Resolving it means reassigning one device or using a static address outside the DHCP pool.

Question 29

What is a subnet mask, and how does it affect whether two hosts can communicate directly?

Accepted Answer

A subnet mask splits an IP address into network and host portions, defining which addresses are local. Two hosts can communicate directly only when their addresses share the same network portion under that mask. Otherwise, traffic must pass through a default gateway. Misconfigured masks often cause hosts to reach some devices but not others.

Question 30

What does a DHCP failure typically look like from a client's perspective?

Accepted Answer

A client experiencing DHCP failure often shows an automatic private address, which is a self-assigned address beginning with 169.254 on IPv4 systems. It may have no default gateway and cannot reach beyond its local segment. Checking the DHCP server, scope exhaustion, and relay configuration are common next steps.

Question 31

Why must a technician verify DNS separately from basic IP connectivity?

Accepted Answer

Basic IP connectivity can work perfectly while name resolution fails, so pinging an address may succeed while pinging a hostname fails. Verifying DNS separately means testing with both names and addresses to isolate whether the fault is in name lookup or in network routing. Tools such as nslookup can query a specific DNS server directly.

Question 32

What does netstat or ss show that helps diagnose a service connection problem?

Accepted Answer

Commands like netstat and ss list active connections, listening ports, and their states on a host. They show whether a service is listening on the expected port and whether connections are established, stuck in SYN_SENT, or closing. Comparing this output with the expected configuration quickly reveals missing listeners or blocked paths.

Question 33

What is the difference between a DNS lookup failure and a DNS server returning a wrong answer?

Accepted Answer

A lookup failure means the resolver receives no usable response, often from an unreachable or overloaded DNS server. A wrong answer means the server responds but with an incorrect or outdated record, such as a stale address after a server move. Tools that query the server directly help separate these cases.

Question 34

Why might a service work from some clients but fail from others?

Accepted Answer

Differences between clients often trace to network location, firewall rules, routing, or configuration. Clients on different subnets may pass through different firewalls or lack a route to the server. Comparing a working client with a failing one, looking at addresses, gateways, DNS settings, and access rules, usually exposes the difference.

Question 35

What is a firewall rule, and how can it block a service while ping still succeeds?

Accepted Answer

A firewall rule is a condition that permits or denies traffic based on attributes such as source, destination, protocol, and port. A rule can block a specific TCP port while allowing ICMP, so ping succeeds even though the service is unreachable. Checking rules for the service's port is an essential step.

Question 36

How can packet captures help confirm where a conversation breaks down?

Accepted Answer

A packet capture records the frames crossing an interface, letting you see each step of a conversation, such as the DNS query, TCP handshake, and application request. Missing replies, resets, or retransmissions show exactly where communication stops. Captures should be taken at both ends when possible to compare what was sent with what arrived.

Question 37

What is a TCP reset, and what might it indicate during troubleshooting?

Accepted Answer

A TCP reset is a packet that abruptly terminates a connection. It may indicate that no service is listening on the destination port, that a firewall or intermediary is actively rejecting the session, or that one endpoint crashed. Looking at which side sent the reset helps narrow the cause.

Question 38

What is a sensible order for checking a user's problem reaching a website?

Accepted Answer

Start by confirming the user's local link and IP configuration, then test the default gateway and an external address by IP. Next, check DNS resolution for the site's name, and finally test the application itself, including its port and any certificate or proxy issues. Recording each result keeps the process clear.

Question 39

Why is it important to test both the server side and the client side of a service?

Accepted Answer

A service problem may originate at either end, so testing only one side can send you down the wrong path. Checking the server confirms that the service runs and listens, while checking the client confirms correct addressing, name resolution, and configuration. Comparing both sides shows whether the fault is server, path, or client.

Question 40

After resolving a network fault, what final steps help prevent the same problem from recurring?

Accepted Answer

Document the root cause, the fix, and the steps used to find it so the knowledge is preserved. Then review whether monitoring, configuration standards, or change control could detect or prevent similar failures. Sharing lessons with the team turns a single repair into lasting improvement.

Network Troubleshooting Flashcards

1Troubleshooting Methodology

2OSI Model and Layered Thinking

3Physical and Link Layer Faults

4IP Addressing and Connectivity Tools

5Name Resolution and Service Diagnosis

Learning Resources