AP Networking • Artifact-based free-response practice
AP Networking FRQ Scoring Guide
Twelve before-and-after responses, a practical evidence-writing method, and an interactive revision lab that shows exactly how to turn network output into a defensible answer.
Independent classroom scoring framework • Updated September 23, 2026 • Original practice, not an official scoring rubric
Read this before practicing
What does a strong networking free response actually do?
It tells a technician what the evidence shows, why that evidence supports a particular explanation, what action follows, and how to confirm the result. Naming DHCP, DNS, or a VLAN is not enough when the question asks you to interpret a configuration, log, packet path, or command output.
Important exam distinction: The May 2027 pilot exam is multiple choice only. The planned May 2028 national digital exam includes artifact-based free-response questions. The five-part method and classroom point system on this page are original teaching tools—not College Board scoring guidelines, released questions, official point allocations, or a prediction of exam weighting. Use the method to practice clear technical reasoning; follow the actual question's directions on exam day.
Start with evidence: If you have not practiced reading real-looking network output, begin with our eight worked artifact-analysis cases. Each case pairs a diagnostic artifact with a justified response and a verification step. Then return here to improve how you explain the same reasoning in writing.
Jump to the section you need
A repeatable reasoning process
The E–I–D–A–V response method
Use these five checkpoints to make sure you have answered the specific question. You do not need five paragraphs or five headings in every response. A two- or three-sentence answer can contain everything the prompt requires.
E · EvidenceQuote or identify the exact field, value, command result, or log entry.
I · InterpretationExplain what that observation establishes—and what it does not.
D · DiagnosisConnect the evidence to the likely failure boundary or mechanism.
A · ActionRecommend the smallest justified change or next discriminating test.
V · VerificationName the result that would demonstrate the requirement now works.
One 38-word example
Prompt: A client shows 169.254.17.9/16 and no default gateway. A neighboring client on the same switch has 192.168.20.44/24. Explain the likely problem and next step.
“The affected client has a link-local 169.254 address and no gateway, unlike its working neighbor. Its normal DHCP lease likely failed. Check DHCP reachability or the local VLAN, renew the lease, and verify it receives the expected subnet and gateway.”
This answer avoids claiming the DHCP server is definitely down. A wrong VLAN, exhausted scope, blocked DHCP relay, or host-specific fault could also explain the evidence. A good response is precise about its uncertainty.
Teacher-designed assessment
Original 10-point classroom scoring rubric
Use this formative rubric for a prompt that asks students to analyze an artifact, diagnose a fault, propose a correction, and verify success. It is not an official AP Networking rubric. Adjust the categories when a prompt asks for fewer tasks; never penalize a student for omitting something the prompt did not request.
Criterion
Points
Full-credit evidence
Typical partial response
Artifact selection
0–2
Cites the relevant address, status, rule, metric, route, or log line accurately.
Mentions the artifact but omits or misreads the decisive field.
Technical interpretation
0–2
Explains what the cited evidence proves and identifies a meaningful limitation.
States a correct observation without connecting it to behavior.
Diagnosis
0–2
Identifies a defensible failure boundary and links it to the mechanism.
Names a plausible cause but does not connect it to evidence.
Action or next test
0–2
Proposes a targeted repair or discriminating test consistent with the diagnosis.
Suggests a generic restart or broad change without a rationale.
Verification
0–2
Names an observable post-change result tied to the original user requirement.
Says “test again” without specifying what must succeed.
How to score: Award 2 when a criterion is complete and accurate, 1 when partly supported, and 0 when absent or contradicted. For a prompt that only asks students to interpret a routing table, assess interpretation and diagnosis rather than forcing a repair recommendation. Do not convert a practice score into an AP 1–5 prediction.
Calibration example: “DNS is broken. Change the DNS server and test it” identifies a plausible diagnosis and action but provides no artifact evidence, no reason to prefer DNS over a path failure, and no measurable success condition. Students improve faster when feedback names the missing reasoning step rather than merely saying “add detail.”
Twelve worked revisions
From plausible-sounding to evidence-supported
Each fictional artifact is simplified for instruction. The “weak” response illustrates a common reasoning gap; the revision answers the stated task without claiming more than the evidence supports. Read the artifact before expanding the explanation.
Example 01 / 12
DHCP and APIPA
Task: Identify the most defensible explanation, recommend a next action, and describe a meaningful verification check.
Client A has a link-local 169.254 address and no gateway while Client B has a valid lease. Client A did not obtain a usable DHCP configuration; check its VLAN, DHCP reachability, and lease exchange before restarting any server. Renew the lease and verify an address in 192.168.20.0/24 with gateway 192.168.20.1.
Why the revision works: A link-local address supports lease failure, not proof of a server-wide outage. For a deeper explanation, see Investigate the DHCP failure boundary, which connects this specific failure to additional diagnostic evidence.
Example 02 / 12
DNS versus connectivity
Task: Identify the most defensible explanation, recommend a next action, and describe a meaningful verification check.
ping 203.0.113.20: replies received
nslookup intranet.school.test: NXDOMAIN
DNS server: 192.168.20.10
Incomplete answer
The internet is down. Reboot the router.
Evidence-supported revision
The client can reach the test IP, so at least that IP path works. NXDOMAIN for intranet.school.test points to a missing or incorrect DNS record or name query, not a proven internet outage. Inspect the expected DNS zone and record, then repeat the lookup and open the intended service by name.
Why the revision works: An IP ping proves reachability to one destination; it does not establish that every service works. For a deeper explanation, see Trace the DNS dependency, which connects this specific failure to additional diagnostic evidence.
Example 03 / 12
Wrong VLAN
Task: Identify the most defensible explanation, recommend a next action, and describe a meaningful verification check.
Gi0/12 is configured as an access port in VLAN 20, but the Finance endpoint requires VLAN 30. Confirm the device is connected to Gi0/12, move that port to the authorized VLAN, and verify its DHCP lease and access to the Finance service.
Why the revision works: Configuration evidence supports a port-membership mismatch, not a hardware failure. For a deeper explanation, see Verify VLAN membership, which connects this specific failure to additional diagnostic evidence.
Example 04 / 12
Routing: longest prefix
Task: Identify the most defensible explanation, recommend a next action, and describe a meaningful verification check.
S 10.40.0.0/16 via 192.0.2.1
S 10.40.8.0/24 via 192.0.2.9
Destination: 10.40.8.25
192.0.2.9 is unreachable
Incomplete answer
The /16 route will be used because it covers the destination.
Evidence-supported revision
The destination matches both routes, but the /24 is more specific, so traffic follows next hop 192.0.2.9. Because that next hop is unreachable, inspect or correct the /24 route and confirm the selected path with the routing table and a destination test.
Why the revision works: The correct route is selected by prefix specificity before route preference becomes relevant. For a deeper explanation, see Practice route-table evidence, which connects this specific failure to additional diagnostic evidence.
Example 05 / 12
ACL first-match ordering
Task: Identify the most defensible explanation, recommend a next action, and describe a meaningful verification check.
10 deny ip 192.168.30.0/24 any
20 permit tcp 192.168.30.0/24 host 198.51.100.20 eq 443
Incomplete answer
Move the permit to the bottom.
Evidence-supported revision
The broad deny at sequence 10 matches Finance traffic before the HTTPS permit at sequence 20 can be evaluated. After checking the intended policy, place the narrow authorized permit before the broader deny and verify HTTPS succeeds while other prohibited traffic remains blocked.
Why the revision works: ACL ordering matters, and a security repair must preserve the intended restrictions. For a deeper explanation, see Analyze firewall rule order, which connects this specific failure to additional diagnostic evidence.
Example 06 / 12
Wi-Fi congestion
Task: Identify the most defensible explanation, recommend a next action, and describe a meaningful verification check.
The strong RSSI does not support a weak-signal diagnosis. High channel utilization and retry rate suggest contention or interference; inspect channel occupancy and nearby APs, adjust channel planning if justified, then compare retries and throughput under a similar load.
Why the revision works: Signal strength and usable capacity measure different things. For a deeper explanation, see Separate signal from congestion, which connects this specific failure to additional diagnostic evidence.
Example 07 / 12
Gateway boundary
Task: Identify the most defensible explanation, recommend a next action, and describe a meaningful verification check.
Successful gateway ping shows the client can reach its local gateway. The failure occurs beyond that checkpoint or at the remote test target; inspect gateway routes, upstream connectivity, filtering, and a second external destination before changing the laptop.
Why the revision works: A failed external ping alone cannot isolate a particular upstream device. For a deeper explanation, see Diagnose beyond the gateway, which connects this specific failure to additional diagnostic evidence.
Example 08 / 12
Duplicate addressing
Task: Identify the most defensible explanation, recommend a next action, and describe a meaningful verification check.
Host A ARP: 192.168.10.50 → aa:aa:aa:aa:aa:01
Later ARP: 192.168.10.50 → bb:bb:bb:bb:bb:02
Incomplete answer
Someone is hacking the network.
Evidence-supported revision
The same IP is resolving to two different MAC addresses over time, consistent with an address conflict or an authorized failover arrangement. Check DHCP leases, static assignments, and device ownership before changing either endpoint; verify stable ARP resolution and service access afterward.
Why the revision works: Anomalous ARP evidence does not establish malicious intent. For a deeper explanation, see Investigate duplicate IP symptoms, which connects this specific failure to additional diagnostic evidence.
Example 09 / 12
NAT configuration
Task: Identify the most defensible explanation, recommend a next action, and describe a meaningful verification check.
LAN host: 192.168.10.25
Gateway LAN: 192.168.10.1
NAT inside interface: Gi0/1
Actual LAN interface: Gi0/0
Incomplete answer
Turn off the firewall.
Evidence-supported revision
The LAN is attached to Gi0/0, but the NAT inside designation is applied to Gi0/1. Verify the interface map and NAT policy, correct the inside/outside roles as needed, and confirm an outbound translation appears while an authorized external service is reachable.
Why the revision works: A precise interface mismatch should be checked before changing unrelated security controls. For a deeper explanation, see Follow the NAT packet path, which connects this specific failure to additional diagnostic evidence.
Example 10 / 12
TLS and application reachability
Task: Identify the most defensible explanation, recommend a next action, and describe a meaningful verification check.
DNS resolves portal.school.test → 198.51.100.20
TCP 443 connection: established
Browser: certificate name mismatch
Incomplete answer
DNS is down. Change DNS servers.
Evidence-supported revision
DNS resolution and the TCP connection succeed. The certificate-name mismatch points to a TLS identity or virtual-host configuration problem; check the requested hostname, certificate subject names, and server selection. Verify a trusted certificate matches the intended hostname before declaring the portal fixed.
★ Teacher Extension • FRQ Scoring Guide
A five-minute warm-up for AP Networking FRQ Scoring Guide
Tomorrow’s opening question can pick up where this page leaves off: ask students to explain the idea in their own words and apply it to a real network. The 300 Bell Ringers give you short questions and teacher answers you can use without preparing a new starter each morning.
Why the revision works: A successful transport connection does not guarantee a valid secure application session. For a deeper explanation, see Distinguish transport from HTTPS, which connects this specific failure to additional diagnostic evidence.
Example 11 / 12
Packet loss and baseline
Task: Identify the most defensible explanation, recommend a next action, and describe a meaningful verification check.
Morning: loss 0.2%, RTT 18 ms
Afternoon: loss 11%, RTT 140 ms
Interface errors: 0
WAN utilization: 97%
Incomplete answer
Replace every cable in the building.
Evidence-supported revision
Loss and latency increase when WAN utilization reaches 97%, while the sampled interface reports no errors. Congestion is a plausible bottleneck; compare traffic by class and time, investigate dominant flows, and retest loss and latency under comparable afternoon load after a targeted capacity or traffic-policy change.
Why the revision works: Correlation supports an investigation, not proof of a single cause. For a deeper explanation, see Interpret performance measurements, which connects this specific failure to additional diagnostic evidence.
Example 12 / 12
Security log and uncertainty
Task: Identify the most defensible explanation, recommend a next action, and describe a meaningful verification check.
The log shows the firewall denying repeated HTTPS attempts from 10.2.4.18 to the payroll portal. Check whether this traffic is authorized and which rule matches; if approved, adjust only the required policy and verify the portal opens while unrelated denies remain effective. The log alone does not show hostile intent.
Premium Troubleshooting Lab • 120 Missions
Let students try AP Networking FRQ Scoring Guide for themselves
Reading the explanation is a start. In the browser simulator, students work through a broken network, choose what to test and see whether their fix worked. It gives them another chance to use what they learned about AP Networking FRQ Scoring Guide.
Why the revision works: Describe observable events before attributing motives or changing security policy. For a deeper explanation, see Practice security-log interpretation, which connects this specific failure to additional diagnostic evidence.
Interactive practice • No account required
Answer-improvement lab: one artifact, five decisions
Read the fictional output, write a short technical response, then check which reasoning components you included. The browser checklist is self-assessment, not automated grading; it does not evaluate whether your claims are correct.
Prompt: Explain the likely failure boundary, cite two relevant observations, recommend a policy-safe next step, and state how to verify it.
Model answer:
The client reaches its gateway, and DNS resolves the portal to 198.51.100.20. The firewall log explicitly denies this client’s HTTPS traffic to that address under rule 15, so the firewall policy is the immediate failure boundary. Confirm the portal and client are authorized, inspect rule 15 and the intended allow policy, and make the narrowest approved change. Then verify the portal loads over HTTPS and that unrelated blocked traffic remains blocked.
Troubleshooting Exam Practice • the 2028 study plan
Check whether AP Networking FRQ Scoring Guide has really stuck
Once students have worked through this topic, give them questions mixed in with the rest of the course. The Exam Prep Vault includes practice exams, multiple-choice questions and artifact labs so they cannot rely on a chapter heading to tell them what to do.
Evidence: successful gateway test, successful name resolution, explicit deny. Limit: the log identifies the enforcement point but does not tell us whether the rule is mistaken or the request is unauthorized. Verification: authorized HTTPS works and the security requirement remains intact.
Classroom application
A 20-minute response-calibration lesson
Minutes 0–4 · Independent draft
Show students the firewall artifact above without the model. Ask for a response of no more than four sentences. Do not award points for length.
Minutes 4–9 · Evidence exchange
Partners underline each exact value cited, circle the proposed action, and mark any unsupported certainty (“definitely,” “always,” “the server is broken”).
Minutes 9–15 · Rubric calibration
Display two anonymized drafts. Apply the original 10-point rubric criterion by criterion. Discuss where the artifact supports a conclusion and where another test is required.
Minutes 15–20 · Targeted rewrite
Students revise only the weakest criterion. Collect the first and second drafts to see whether they learned to use evidence rather than simply adding words.
Feedback language that leads to better answers
Instead of writing…
Try this actionable comment
“Be more specific.”
“Quote the exact address, rule, route, or result that supports your diagnosis.”
“Wrong cause.”
“Your proposed cause is possible, but which observation distinguishes it from a competing cause?”
“Needs more detail.”
“Name the next test and explain what each possible result would tell you.”
“Incomplete.”
“State the post-change observation that proves the original user requirement is met.”
One uncertainty I should not overclaim: _________________
Build a revision sequence, not a one-time score
Use the wrong-answer diagnosis guide to separate content gaps from evidence-reading and explanation errors. Then assign a fresh case from the artifact-analysis examples and compare whether the student can transfer the same response method to a different networking mechanism.
Premium Evidence-Grading Copilot
Spend less time marking explanations about AP Networking FRQ Scoring Guide
When students explain their answer, it takes more than a right-or-wrong check to see what they understand. The Grading Copilot helps you review how they used the clues, where their explanation falls short and what feedback to give next. You make the final grading decision.
Is this the official AP Networking FRQ scoring rubric?
No. The E–I–D–A–V method and 10-point rubric here are original classroom practice tools. They are not official College Board scoring guidelines or a prediction of how points will be assigned on the May 2028 exam.
Will the 2027 AP Networking pilot exam include FRQs?
No. The announced May 2027 pilot exam is multiple choice only. The national May 2028 digital exam is planned to include artifact-based free response.
How long should an AP Networking free response be?
Write enough to answer each task with the relevant evidence and reasoning. There is no verified universal sentence count or word limit for the new exam in the information used here. A concise, accurate answer can be stronger than a long generic explanation.
Do I need to quote exact command output?
When a prompt asks you to use an artifact, identify the decisive field or result accurately. You can usually explain a value in your own words; preserve the meaning of addresses, ports, routes, and status messages.
NEW • COMPLETE 180-DAY TEACHER CURRICULUM
Teach AP Networking FRQ Scoring Guide as part of a planned school year
This page gives you one topic. The 180-Day Teacher Curriculum puts it into a full course plan, with daily teaching notes, student activities and checks for understanding. Use it when you need to know what comes before this lesson and what to teach next.
Say what is established, identify the remaining plausible causes, and recommend a test that distinguishes them. Avoid presenting a hypothesis as a confirmed root cause.
Does a successful ping prove that the whole network works?
No. A successful ping to one destination establishes a narrower reachability result. DNS, TCP application ports, TLS, authorization, and other destinations may still fail.
Should I always recommend restarting the router?
No. A broad restart may disrupt working services and can destroy useful evidence. Prefer the smallest justified test or correction, then verify the original requirement.
How can teachers score answers consistently?
Use the same visible classroom rubric for the same prompt, calibrate on two sample responses, and award points for observable evidence and reasoning. Do not require a repair or verification step when the prompt asks only for interpretation.
Can I use this rubric to predict my AP score?
No. This formative classroom rubric is not calibrated to the official AP 1–5 scale or an official AP Networking scoring model.
Where should I practice after reading the guide?
Work through the site’s eight FRQ artifact examples, CLI output practice, routing-table analysis, log analysis, and full practice resources. Revisit the exact criterion your previous response missed.
Continue practicing
Choose your next practice by the skill you missed
The point of scoring a response is to decide what to practice next. These resources are grouped by the specific reasoning gap they address.