Start here
What does an AP Networking artifact-based FRQ ask you to do?
College Board confirms that the first national AP Networking exam in May 2028 will be fully digital in Bluebook and will include free-response questions that ask students to analyze realistic networking artifacts and evidence. An artifact might be a configuration, diagram, table or troubleshooting record. The eight cases below are independently written instructional examples, not released College Board questions or predictions of the exam's exact wording, point values or time limits. Check the official exam overview for confirmed information.
The response method: name the symptom; cite an exact artifact value; explain the network mechanism; propose the smallest defensible next test or correction; state what result would verify it. Do not claim certainty when the evidence only narrows the possibilities.
| Case | Evidence | Skill | Course connection |
|---|---|---|---|
| 1. DHCP address failure | Lease and interface data | Separate a DHCP problem from a general outage | Units 1–2 |
| 2. DNS resolution failure | nslookup and ping | Isolate name resolution from connectivity | Units 1–3 |
| 3. VLAN mismatch | Switch port and VLAN tables | Find an access-port configuration error | Units 2–3 |
| 4. Wrong route | Routing table and traceroute | Explain longest-prefix route selection | Units 3–4 |
| 5. Firewall rule order | Ordered ACL and traffic log | Apply least privilege without blocking needed access | Units 3–4 |
| 6. Slow wireless | RSSI, channel and latency readings | Differentiate signal from congestion | Units 1–2 |
| 7. CLI evidence chain | ipconfig, ping and gateway tests | Build a defensible troubleshooting sequence | Units 1–3 |
| 8. Security incident | DHCP log and access events | Distinguish evidence from unproven security claims | Units 3–4 |
On a phone, swipe horizontally to see the complete table.
Case 1: A laptop has a self-assigned address
Original worked example 1 of 8 • DHCP / APIPA
Incident: A student laptop joins the classroom Wi-Fi but cannot reach the learning platform. Two nearby laptops on the same SSID work.
Artifact: inspect the evidence
DEVICE A — failing laptop IPv4 address 169.254.38.27 Subnet mask 255.255.0.0 Default gateway (blank) DHCP enabled Yes Wi-Fi status Connected DEVICE B — working laptop, same SSID IPv4 address 192.168.40.112 Subnet mask 255.255.255.0 Default gateway 192.168.40.1 DHCP server 192.168.40.10
Your task
Identify the most likely failure category. Cite two pieces of evidence. Recommend two tests in order, and state what would confirm recovery.
Reveal the worked response and verification plan
The failing laptop has an automatically assigned 169.254.38.27 address and no default gateway, while another client on the same SSID obtained a valid 192.168.40.x lease. This supports a DHCP lease-acquisition problem on Device A, not proof that the entire wireless network or DHCP server is down. First verify that Device A is on the intended SSID and that its adapter is set to obtain an address automatically. Then renew its lease and inspect the DHCP client event or server lease log. Recovery is a valid address in the expected subnet, gateway 192.168.40.1, and successful connectivity tests.
Common mistake: An APIPA address is a symptom, not proof that the DHCP server itself has failed; the working laptop weakens that explanation.
Study further: DHCP troubleshooting · Unit 1.
Case 2: The website fails by name, not by IP
Original worked example 2 of 8 • DNS
Incident: A library desktop can reach an internal web server by IP address, but its hostname returns a resolution error.
Artifact: inspect the evidence
C:> ping 10.24.8.20
Reply from 10.24.8.20: bytes=32 time=2ms
C:> nslookup catalog.school.example
Server: 10.24.0.53
*** 10.24.0.53 can't find catalog.school.example:
Non-existent domain
DNS change ticket: catalog moved yesterday
Expected new record: catalog.school.example → 10.24.8.20Your task
Explain which network function is failing and why the ping result matters. Name the next authoritative check.
Reveal the worked response and verification plan
IP connectivity to 10.24.8.20 works, so a blanket claim that the web server is unreachable is not supported. The configured resolver 10.24.0.53 returns NXDOMAIN for the hostname. Check whether the authoritative DNS zone contains the expected A record and whether the configured resolver is querying the correct zone or holding an outdated negative cache. After correcting the record or resolver path, repeat nslookup and then test the website by name.
Common mistake: NXDOMAIN is not the same as a timeout; it points toward a missing or incorrectly resolved name rather than proving a broken physical link.
Study further: DNS guide · Artifact analysis.
Case 3: One workstation is in the wrong VLAN
Original worked example 3 of 8 • Switching and VLANs
Incident: A replacement desktop on switch port Gi1/0/18 cannot reach the accounting gateway; another accounting desktop works.
Artifact: inspect the evidence
PORT MODE ACCESS VLAN STATUS Gi1/0/17 access 30 up Gi1/0/18 access 20 up Gi1/0/19 access 30 up ACCOUNTING VLAN: 30 | Gateway: 10.30.0.1 GUEST VLAN: 20 | Gateway: 10.20.0.1 Gi1/0/18 MAC table: learned in VLAN 20
Your task
Identify the mismatch, cite the configuration evidence and explain why the link can be up while access still fails.
Reveal the worked response and verification plan
Gi1/0/18 is operational but configured for access VLAN 20, while the accounting workstations use VLAN 30. The MAC table also places the replacement desktop in VLAN 20. Verify the desktop belongs to accounting and change the access VLAN to 30 under the approved change procedure; then verify its DHCP lease or addressing, gateway reachability and intended access.
Common mistake: A green link light proves physical link, not membership in the correct broadcast domain. Do not change a trunk or gateway without first verifying the endpoint port.
Study further: VLAN mismatch symptoms · Unit 3.
Case 4: A more-specific route sends traffic to the wrong next hop
Original worked example 4 of 8 • Routing and path selection
Incident: An office can reach most internal subnets, but the inventory subnet fails after a router change.
Artifact: inspect the evidence
Destination Prefix Next hop Interface 10.60.0.0 /16 10.0.0.2 WAN-A 10.60.24.0 /24 10.0.0.6 WAN-B 0.0.0.0 /0 10.0.0.1 WAN-A Target inventory server: 10.60.24.15 Change record: inventory subnet moved to WAN-A Traceroute first routed hop toward target: 10.0.0.6
Your task
Which route is selected and why? Identify the discrepancy and a safe verification step before changing configuration.
Reveal the worked response and verification plan
For 10.60.24.15, the 10.60.24.0/24 route is more specific than the 10.60.0.0/16 route and is therefore selected, forwarding to 10.0.0.6 on WAN-B. That conflicts with the change record stating that the inventory subnet moved to WAN-A. Verify the approved current topology and route ownership before updating or removing the stale /24 route. Then inspect the selected route and test the target.
Common mistake: The default route does not win when a matching /24 exists. A traceroute showing the wrong next hop supports, but does not by itself prove, the remote failure cause.
Study further: Routing guide · Unit 4.
Case 5: A broad deny rule shadows a needed exception
Original worked example 5 of 8 • Firewalls and ACLs
Incident: A payroll app must accept HTTPS only from the finance subnet. A new firewall policy blocks finance users.
Artifact: inspect the evidence
RULE SOURCE DESTINATION SERVICE ACTION 10 10.10.0.0/16 172.20.5.10 ANY DENY 20 10.10.30.0/24 172.20.5.10 TCP 443 ALLOW 30 ANY 172.20.5.10 ANY DENY Finance client: 10.10.30.45 Observed log: matched rule 10, denied TCP 443
Your task
Explain the failure using rule order. Propose a least-privilege correction and describe one allowed and one denied verification test.
Reveal the worked response and verification plan
The finance source 10.10.30.45 belongs to both 10.10.30.0/24 and 10.10.0.0/16. With first-match processing, rule 10 denies it before the narrower HTTPS allow rule 20 can apply. After validating the intended policy, place the specific finance-to-payroll TCP 443 allow before the broad deny. Verify that finance HTTPS succeeds and that a nonfinance source or a disallowed port remains blocked.
Common mistake: Never solve this by allowing all finance traffic to every destination. Check whether the device actually uses first-match semantics before applying the proposed order.
Study further: Least privilege · Artifact analysis.
Case 6: Strong signal but poor performance
Original worked example 6 of 8 • Wireless performance
Incident: Students report slow video calls in a classroom, despite a strong Wi-Fi signal.
Artifact: inspect the evidence
MEASUREMENT 09:00 10:30 (incident) Client RSSI -48 dBm -49 dBm Channel utilization 24% 92% Retry rate 5% 31% Gateway ping median 4 ms 85 ms Wired gateway ping 2 ms 2 ms Associated clients 18 57
Your task
Use at least three measurements to explain the likely bottleneck. Propose a low-risk diagnostic and a measurable success condition.
Reveal the worked response and verification plan
Signal remains strong at roughly -49 dBm, but channel utilization rises to 92%, retries to 31% and wireless gateway latency to 85 ms, while wired gateway latency stays at 2 ms. Together these readings point to contention or airtime congestion on the wireless segment rather than a general WAN failure or weak signal. Check neighboring-channel use and client distribution, then test an approved channel or client-balancing adjustment. Success would include lower utilization/retries and reduced wireless latency under comparable load.
Common mistake: RSSI alone cannot establish wireless performance. Also avoid promising that changing channels will fix interference without surveying nearby access points.
Study further: Troubleshooting guide · Unit 2.
Case 7: A sequence of command results narrows the fault
Original worked example 7 of 8 • Command-line evidence
Incident: A student can open the router management page but cannot load an external site by name.
Artifact: inspect the evidence
ipconfig: 192.168.12.44/24
Gateway: 192.168.12.1
DNS: 192.168.12.1
ping 192.168.12.1 → 4 replies, 1 ms
ping 1.1.1.1 → 4 replies, 17 ms
nslookup www.example.com 192.168.12.1
→ request timed out
nslookup www.example.com 1.1.1.1
→ returns an addressYour task
Identify what is working, isolate the most likely failing service and name a verification test after remediation.
Reveal the worked response and verification plan
The valid local configuration and successful gateway ping show local IP connectivity. The successful external IP ping shows at least some routed Internet connectivity. The local resolver at 192.168.12.1 times out, while a query to 1.1.1.1 succeeds. Investigate the router’s DNS forwarding or upstream resolver settings, subject to the school’s approved DNS policy. Verify by repeating the query through the configured resolver and then loading the site by name.
Common mistake: A successful ping to one public IP does not prove that all Internet services work. A DNS timeout is different from a negative DNS answer.
Study further: Practice questions · Troubleshooting simulator.
Case 8: A rogue DHCP clue is not a complete incident finding
Original worked example 8 of 8 • Security and incident evidence
Incident: Several classroom devices unexpectedly receive an unfamiliar default gateway after a guest connects a personal router.
Artifact: inspect the evidence
10:04 DHCP OFFER to client A
server-id 192.168.50.254
gateway 192.168.50.254
10:05 DHCP OFFER to client B
server-id 192.168.50.10
gateway 192.168.50.1
10:06 Switch port Gi1/0/22 learned new MAC
port description: classroom wall jack
10:08 Helpdesk: three clients redirected to
gateway 192.168.50.254Your task
State a supported hypothesis, identify two missing facts and propose containment that protects authorized users.
Reveal the worked response and verification plan
The competing DHCP offers and unexpected gateway 192.168.50.254 support the hypothesis that an unauthorized or misconfigured DHCP service is present. The data do not prove malicious intent or show that sensitive data was stolen. Confirm which switch port and MAC address originate the unexpected offers, verify whether the device is authorized, and preserve relevant logs. Under the school’s incident procedure, isolate the unauthorized service or apply approved DHCP snooping controls, then renew affected clients and confirm that leases come only from 192.168.50.10 with gateway 192.168.50.1.
Common mistake: A suspicious DHCP offer is evidence of a network integrity/availability risk, not proof of exfiltration. Containment should follow school policy and avoid disconnecting critical authorized systems.
Study further: Unit 4 · Artifact analysis.
Student method
How to write a response that uses the evidence
Start with the observation, not a memorized definition. A good answer should be short enough to audit: another technician ought to be able to point to the same value and reproduce your conclusion.
| Move | Question to answer | Example from Case 5 |
|---|---|---|
| Identify | What is failing? | Finance users cannot reach payroll HTTPS. |
| Cite | Which exact value proves the observation? | 10.10.30.45 matches the 10.10.0.0/16 deny at rule 10. |
| Explain | What mechanism connects the evidence to the symptom? | The first matching rule blocks traffic before rule 20. |
| Act | What is the least risky corrective action? | Move the specific finance HTTPS exception above the broad deny, after approval. |
| Verify | What results would show success without weakening security? | Finance TCP 443 succeeds; unrelated traffic remains denied. |
Swipe horizontally on smaller screens.
Use Wrong Answer Detective to diagnose unsupported leaps and network artifact response practice to extend these exercises.
Teacher-ready implementation
Teacher use: one 45-minute artifact lab and a formative checklist
Before class: project one artifact without its answer, give students a copy of the task and ask them to underline exact values they plan to cite. Students work individually first, then compare diagnoses in pairs. Avoid revealing the worked response until students have committed to a hypothesis.
45-minute lesson sequence
- 5 min: Quick diagnosis from Case 1.
- 10 min: Pairs analyze Cases 3 and 5; each pair writes an evidence-based response.
- 10 min: Swap responses; partners challenge any claim without a cited artifact value.
- 12 min: Work through Case 8, separating observed facts from hypotheses.
- 8 min: Exit ticket: choose a next test and specify a success condition.
Five-point classroom checklist
A teacher-created formative tool, not College Board scoring guidance. Award one classroom point each for: accurate symptom; relevant quoted value; technically sound mechanism; justified next action; measurable verification. Require students to mark unsupported assumptions separately.
Extension: change one artifact value—such as DNS timeout to NXDOMAIN—and have students revise the diagnosis rather than reuse the first answer.
Use the eight free editable teacher PowerPoints for a visual launch, the teacher resource hub for additional lessons and the performance tasks for longer assessments.
What to study next: build the skill across all four units
Units 1–2: local devices and shared connections
Start with Managing My Connections and Managing My Shared Connections. Practice interpreting an address, lease, gateway, wireless reading and resolver response.
Units 3–4: larger networks and global connections
Move to Managing Many Connections and Managing Our Global Connections. Interpret switching, route selection, firewall order and incident evidence.
For broad review, use the study guide, free-response practice hub, practice questions and exam format guide. For teachers planning the national launch, see the curriculum map and pacing guide.
Frequently asked questions about AP Networking FRQs
Are these official AP Networking FRQs?
No. All eight cases and worked answers on this page are original, unofficial instructional examples. College Board has confirmed artifact-based free response for May 2028, but these examples are not released exam questions or official scoring guidelines.
Will the May 2027 pilot have free-response questions?
No. College Board describes the May 2027 final pilot exam as multiple-choice only. The first nationwide exam in May 2028 includes multiple choice and free response.
What is a networking artifact?
A networking artifact is a record or representation that helps you diagnose or explain a network: for example, a DHCP lease, routing table, switch configuration, packet summary, security log or topology diagram.
How long should my written answer be?
Write enough to name the problem, cite the relevant evidence, explain the mechanism and answer every part of the prompt. No official AP Networking FRQ response-length requirement is asserted here.
Can a single artifact prove the root cause?
Sometimes it can show a direct misconfiguration, but often it only narrows the possibilities. For example, an APIPA address supports a DHCP acquisition failure but does not establish that the entire DHCP server is offline.
Do these examples match the official 2028 scoring rubric?
No. The five-point checklist is a classroom feedback method, not a prediction of College Board point allocations or scoring criteria.
Can teachers reuse these examples?
Teachers may use the page for free classroom instruction and direct students to it. The original scenarios are designed for discussion, formative assessment and revising evidence-based explanations.
Where can I verify the current exam format?
Use the College Board AP Networking Exam Overview and the published course framework. Official specifications may be updated before the May 2028 national exam.
Official sources and editorial boundaries
These original examples are informed by College Board’s published description of career-connected networking scenarios, the four-unit course structure and the confirmed artifact-based free-response section for May 2028. No exact 2028 question count, FRQ time allocation or official scoring points are assumed here.
- College Board: AP Networking Exam Overview — confirmed digital exam and artifact-based free response.
- College Board: About AP Networking — course units and skills.
- College Board: AP Networking Course Framework (PDF) — course content and authentic scenarios.
- Our 2027 vs. 2028 exam comparison — pilot and national exam differences.
- Complete AP Networking directory — browse all guides and practice resources.
Editorial note: The technical evidence in each case is fictional and intentionally simplified for teaching. Configuration changes should follow your school or organization's approval and security procedures. This independent website is not affiliated with or endorsed by College Board.