AP Networking Exam PrepBuild • Secure • Troubleshoot • Verify
Secure Services • Phase 5

HTTPS, TLS & Certificate Troubleshooting Practice Test

Practice 75 HTTPS and TLS troubleshooting questions: certificate names, trust chains, SNI, proxies, renewals, client differences, and verified repairs. Three difficulty levels with instant explanations.

Published and updated October 17, 2026 · Free student and teacher resource · 25 Easy + 25 Medium + 25 Hard
Start the testFind the failing stage

Diagnose the secure connection, not just the page

A working IP path does not prove that a web service can authenticate its name. An unexpired certificate does not prove that every client trusts it. Use these 75 original scenarios to identify the failed stage, choose a narrow repair, and verify the actual student or business task.

Easy questions check one mechanism. Medium questions combine client and server observations. Hard questions test partial deployments, proxy connections, pinning, failover, and conflicting evidence. These are independent instructional questions, not official Cisco or College Board exam items.

Start the interactive test · Read the troubleshooting guide · Choose another topic

If TLS validation passes but a large upload stalls, investigate the data path with the MTU, MSS, and path MTU troubleshooting test. Compare packet sizes and feedback before changing a certificate that already validates.

Take the HTTPS and TLS practice test

Choose one answer to receive immediate feedback. Your first selection is scored; read the explanation before moving on. Use keyboard Tab to reach controls and arrow keys within the answer group. You can use these as untimed diagnostic practice, pausing to write your reasoning.

Changing difficulty or restarting clears the current attempt. Download your log first if you want to keep it.

Back to Top of Practice Test

Read all 75 question prompts and choices

Open a prompt to inspect its choices. The correct answer and explanation for that item become available here after you submit a choice in the interactive test. Reference IDs stay fixed for classroom discussion and correction reports. Switching levels or restarting clears the current attempt and its revealed reference answers.

Easy question library · 25 questions

Easy 1. The class opens https://portal.example. DNS returns the expected address, but the TCP connection to port 443 times out. Which is the earliest stage not yet demonstrated for this attempt?
  1. Transport reachability to the HTTPS listener
  2. Certificate hostname matching
  3. Rendering of the portal's HTML
  4. The portal's HTTP authorization decision
Easy 2. A browser reports that portal.example presented a certificate for printer.example. Which comparison failed?
  1. The DNS record's TTL against the certificate lifetime
  2. The destination port against the TCP source port
  3. The requested hostname against the certificate identity
  4. The server's MAC address against its public key
Easy 3. A certificate's notAfter time was yesterday; the client clock is accurate. What repair addresses this evidence?
  1. Change the site's HTTPS port to 8443
  2. Extend the DNS record TTL for the portal
  3. Clear the client's default route and renew DHCP
  4. Deploy a valid replacement certificate at the serving endpoint
Easy 4. Only one laptop says a valid campus certificate is not yet valid. Its clock is two years behind. What should be checked first?
  1. The laptop's time and time-synchronization configuration
  2. The access switch's allowed VLAN list
  3. The web application's session timeout
  4. The campus certificate's DNS wildcard coverage
Easy 5. What does a successful TLS handshake with a validated server certificate establish most directly?
  1. A protected connection authenticated for the intended server identity
  2. Permission for this user to open every application resource
  3. Confirmation that the DNS response was cryptographically signed
  4. Proof that all scripts on the page are harmless
Easy 6. A student enters an HTTPS URL. What is the usual purpose of its TLS protection?
  1. Replace the need for an IP routing decision
  2. Protect traffic confidentiality and integrity between the TLS endpoints
  3. Guarantee that the application stores passwords safely
  4. Hide the destination IP from every router on the path
Easy 7. A server sends a leaf certificate and an intermediate CA certificate. Why send the intermediate?
  1. Give the client the server's private key for decryption
  2. Help the client build a certification path to a trusted anchor
  3. Make the client's DNS resolver authoritative for the domain
  4. Convert the leaf certificate into a self-signed root
Easy 8. Which certificate field should a modern HTTPS client examine for the DNS service name?
  1. The certificate's serial number
  2. The signature algorithm's identifier
  3. A dNSName entry in subjectAltName
  4. The issuer's organization name
Easy 9. A certificate contains only *.school.example. Which hostname fits that wildcard?
  1. library.school.example.attacker.test
  2. school.example
  3. library.school.example
  4. east.library.school.example
Easy 10. What does Server Name Indication normally help a shared TLS listener choose?
  1. The client's default gateway for the next packet
  2. The authoritative DNS server for the destination zone
  3. The HTTP user's permissions in the application database
  4. The virtual host and certificate for the requested service name
Easy 11. What is Application-Layer Protocol Negotiation used to agree on?
  1. The user's role after an application login
  2. The certificate authority that must issue the next certificate
  3. The Ethernet frame size allowed on the access port
  4. An application protocol such as HTTP/2 on the TLS connection
Easy 12. After successful TLS validation, a server returns HTTP 403. Which layer should the next investigation emphasize?
  1. Application or HTTP access policy for this request
  2. An unanswered DNS query for this connection
  3. A certificate not yet presented by the server
  4. Failure to complete the initial TCP handshake
Easy 13. Port 443 accepts a TCP connection, but no TLS reply follows a ClientHello. What is justified?
  1. The browser has received an HTTP success response
  2. The TCP listener was reachable; TLS negotiation remains unproven
  3. The server certificate has already passed identity validation
  4. The requested hostname must be absent from DNS
Easy 14. Why should clicking through a certificate warning not count as a successful repair?
  1. It automatically changes the server's certificate expiration date
  2. It proves that the private key has been stolen
  3. It forces the client to use a different IP subnet
  4. It bypasses a failed identity or trust check rather than resolving it
Easy 15. In an ordinary server certificate deployment, which item must not be distributed to every student browser?
  1. The server's public certificate
  2. The hostname students are expected to visit
  3. The public intermediate CA certificate
  4. The server's private key
Easy 16. A private school CA signs an internal portal certificate. Unmanaged laptops do not trust that CA. What does this best explain?
  1. An expired password in the portal's student database
  2. A requirement that all internal sites use plain HTTP
  3. A trust-anchor difference between managed and unmanaged devices
  4. A DNS record that must point to a private MAC address
Easy 17. A load balancer terminates browser TLS, then forwards plain HTTP to a backend. Which traffic is protected by that TLS session?
  1. Traffic from every backend to its database
  2. Traffic between the DNS resolver and root servers
  3. Traffic between the browser and load balancer
  4. Traffic across the backend HTTP connection
Easy 18. A browser connects to https://192.0.2.40, but the certificate contains only portal.example as a DNS identity. What can fail even if both reach the same server?
  1. Identity validation for the IP-literal URL
  2. Validity of the portal.example DNS zone's SOA record
  3. The server's ability to receive any TCP segment
  4. Selection of an Ethernet destination on every routed hop
Easy 19. What is the narrowest interpretation of a TCP reset immediately after a SYN to a web service?
  1. The requested certificate has the wrong subject alternative name
  2. The attempted connection was actively rejected somewhere on the path
  3. The server has finished processing an HTTP GET
  4. The browser rejected the certificate's issuing CA
Easy 20. The portal certificate is valid, but its page loads a script using http://. What should be investigated?
  1. A certificate serial number duplicated in the HTML
  2. The browser's inability to negotiate any TLS session
  3. Mixed content caused by an insecure subresource URL
  4. A failure of the portal's initial DNS lookup
Easy 21. A TLS listener receives a certificate-only update but still serves the old certificate to new clients. What evidence matters most next?
  1. The certificate actually presented by the live listener
  2. The color of the browser's page loading indicator
  3. The length of the DNS resolver's search suffix list
  4. The replacement certificate's filename on an administrator's laptop
Easy 22. Two devices use different browsers and receive the same chain. One reports an unknown issuer. What is a useful comparison?
  1. Their Ethernet cable jacket colors
  2. Their trust stores and certificate-validation environments
  3. Their browser homepage bookmark order
  4. Their keyboard layout and display resolution
Easy 23. A page returns HTTP 404 over verified HTTPS. What does the response most directly indicate?
  1. The HTTP service did not find that requested resource
  2. The destination rejected all TCP connections
  3. The server's TLS certificate could not be parsed
  4. The client failed to resolve the server name
Easy 24. What is the purpose of requiring a client certificate in mutual TLS?
  1. Make the server's certificate optional in every deployment
  2. Authenticate the connecting client at the TLS layer
  3. Give the client permission for every application action
  4. Assign the client a new DHCP address during the handshake
Easy 25. A student proposes replacing HTTPS with HTTP to remove a certificate error. Which requirement would that abandon?
  1. The server's need to identify an HTTP resource path
  2. The client's need to reach an IP destination
  3. The use of a browser to request a document
  4. Authenticated encrypted transport for the web connection

Medium question library · 25 questions

Medium 1. The campus portal loads on managed laptops but not phones. Both receive the same unexpired certificate with the correct SAN. Phones report an unknown issuer; managed laptops trust the school CA. What is the best next action?
  1. Disable hostname verification on all managed laptops
  2. Remove the portal's SAN because its issuer is private
  3. Increase the portal's DHCP lease duration for mobile clients
  4. Decide whether to use public trust or authorized private-CA enrollment for the phones
Medium 2. Certificate renewal succeeded on disk. New connections to frontend A show the new serial; frontend B shows the expired serial. Which repair is supported?
  1. Update or reload the credential on frontend B and retest both nodes
  2. Replace the site's public DNS zone with a single hosts-file entry
  3. Delete the application cookies on every affected browser
  4. Renew the already-valid certificate on frontend A again
Medium 3. curl reaches portal.example successfully on a teacher laptop but reports an issuer error inside a container using the same endpoint. What should be compared first?
  1. The browser's saved password for the teacher account
  2. The container's CA bundle and the laptop's trust configuration
  3. The number of CPU cores assigned to the web server
  4. The portal's HTML language attribute on successful responses
Medium 4. You want to test a replacement server at 192.0.2.80 while preserving portal.example as the URL hostname. Which curl command fits?
  1. curl https://192.0.2.80/ -H 'Host: portal.example'
  2. curl http://portal.example:443/
  3. curl -k https://192.0.2.80/
  4. curl --resolve portal.example:443:192.0.2.80 https://portal.example/
Medium 5. A shared address serves portal.example and library.example. A test omitting SNI gets a default certificate; a test specifying portal.example gets the correct one. What does this show?
  1. The client must remove all DNS search domains
  2. The default certificate must be accepted for every hosted site
  3. The test's service-name context affects virtual-host selection
  4. The server cannot host more than one HTTPS name
Medium 6. A browser trusts an intermediate it cached earlier. A clean client reports a missing issuer. The server sends only the leaf. Which repair removes that dependency?
  1. Send the server private key alongside the leaf certificate
  2. Ask all users to visit a different site first to populate caches
  3. Configure the serving endpoint to send the necessary intermediate chain
  4. Extend the leaf's validity period without changing the chain
Medium 7. A DNS alias learn.example points to app.vendor.example. Students open https://learn.example, but the certificate covers only app.vendor.example. What is needed?
  1. An ARP entry mapping both hostnames to one public key
  2. A rule requiring every student to disable certificate checks
  3. A certificate and virtual-host configuration supporting learn.example
  4. A longer CNAME TTL to make the vendor name trusted
Medium 8. Only clients preferring IPv6 see an expired certificate. The A endpoint has the new certificate; the AAAA endpoint has the old one. What should be corrected?
  1. The certificate deployment on the IPv6-serving endpoint
  2. The browser's HTTP request method for IPv4 sessions
  3. The lifetime of all IPv4 ARP cache entries
  4. The certificate's issuer name on the working A endpoint
Medium 9. A reverse proxy returns HTTP 502. Browser-to-proxy TLS validates, but proxy logs show backend certificate-name mismatch. Which leg is failing?
  1. The browser's certificate validation of the public listener
  2. The proxy's separately validated TLS connection to the backend
  3. The access switch's delivery of the browser's TCP SYN
  4. The browser's original DNS resolution to the proxy
Medium 10. A client sends ClientHello, then receives an alert. Server logs for that attempt say no shared protocol version. What is the defensible response?
  1. Establish a mutually supported version within the required security policy
  2. Disable routing between the client and its default gateway
  3. Permit every legacy cipher without checking the cause
  4. Replace the site's certificate because every alert means expiry
Medium 11. A certificate is current and chains to an accepted CA, but the app connects using api.school.example and the SAN lists only portal.school.example. What should change?
  1. Increase the TCP receive window on the application client
  2. Add api.school.example to the resolver's cache forever
  3. Remove the accepted CA from all client trust stores
  4. Provide identity coverage for api.school.example at its serving endpoint
Medium 12. A server requires mutual TLS. Normal browsers work on the public site, but a protected endpoint logs certificate_required when an integration connects without a client credential. What is missing?
  1. An HTTP redirect from the protected endpoint to port 80
  2. The integration's approved client certificate and private-key configuration
  3. A wildcard DNS record covering every browser profile
  4. A new server-side DHCP reservation for each request
Medium 13. A laptop works off campus. On campus it sees a certificate issued by an approved inspection CA; its application rejects that issuer. What should be investigated?
  1. Whether the website changed its Ethernet MAC address overseas
  2. Whether the private inspection key should be copied into the application
  3. Whether the application's trust policy supports the authorized inspection path
  4. Whether an HTTP 404 can invalidate the school's DNS server
Medium 14. An openssl s_client probe prints a certificate but also reports a verification error. Why is that not a passing acceptance test?
  1. The probe always substitutes a self-signed certificate for the real one
  2. The diagnostic can continue despite validation errors unless configured to fail
  3. The printed certificate proves every browser would accept the chain
  4. The verification error describes only the remote server's DNS cache
Medium 15. TLS validates for portal.example, but requests alternate between a normal page and a login redirect loop. Which evidence best advances the investigation?
  1. The number of trusted roots stored on the working client
  2. HTTP redirect locations, cookies, and proxy scheme handling for affected requests
  3. The DNSSEC status of an unrelated classroom printer
  4. The leaf certificate's signature repeated on each Ethernet frame
Medium 16. Two teams test a move. One verifies only https://192.0.2.90; the other verifies https://portal.example at that address with checks enabled. Which test matches student use?
  1. The named URL test that preserves the intended service identity
  2. Neither test can establish a TCP connection without public DNS
  3. The IP-literal test because it avoids all naming requirements
  4. Both tests necessarily validate the same certificate identity
Medium 17. The certificate file was replaced, but existing long-lived sessions stay open. Why must renewal verification use a fresh full handshake?
  1. Certificate renewal changes the MAC address of all current sessions
  2. Existing sessions do not prove the new credential is being presented
  3. Each existing TLS session must switch to plaintext immediately
  4. A browser cannot establish any new session until DNS TTL expires
Medium 18. A valid HTTPS page calls an API whose certificate is expired. The page appears, but data panels fail. Which acceptance test was incomplete?
  1. Validation of the separate API origin used by the page
  2. Confirmation that the top-level DNS lookup returned an address
  3. Testing whether the browser could open an initial TCP connection
  4. Verification of the page's own HTML heading text
Medium 19. A certificate contains *.example but not example. The bare domain fails validation before its redirect to www.example can run. What is required?
  1. A lower routing metric for the client's default gateway
  2. A longer HTML cache lifetime for the www homepage
  3. A faster HTTP redirect after the same failed TLS exchange
  4. A valid certificate for example on the listener receiving that first connection
Medium 20. A client offers h2 and http/1.1. A server configured only for a different required ALPN protocol rejects negotiation. What should be compared?
  1. The serial number's decimal length on the server certificate
  2. The offered and accepted application-protocol sets and endpoint configuration
  3. The number of application users already in the database
  4. The browser's DNS search suffix against the Ethernet VLAN tag
Medium 21. A firewall change allows TCP 443. A capture now shows complete TCP setup followed by the server's certificate and a client validation alert. What changed diagnostically?
  1. The portal's DNS resolver has become authoritative for the domain
  2. The certificate alert proves the TCP allow rule was never matched
  3. Every client must now be authorized for every HTTPS resource
  4. The attempt progressed beyond connection establishment to certificate validation
Medium 22. A certificate renewal job reports success, but it renewed dev.portal.example rather than portal.example. What proves the production task is unfinished?
  1. The development certificate must use the same private key as production
  2. The DNS A record must contain a certificate serial number
  3. A certificate job can succeed only if every site was renewed
  4. The renewed credential does not cover the production reference name
Medium 23. One application rejects a server certificate whose extended key usage permits only client authentication. The chain and hostname are otherwise acceptable. Which check matters?
  1. Whether the certificate is suitable for TLS server authentication
  2. Whether the client's source port is lower than 1024
  3. Whether the server's DNS TTL equals its certificate serial number
  4. Whether a browser bookmark uses the expected page title
Medium 24. A teacher says the padlock proves an external website is safe for students. Which response is accurate?
  1. It means every link on the page uses the same certificate
  2. It proves the server has no software vulnerabilities
  3. It protects and authenticates the connection, not the site's educational suitability
  4. It proves the site's content was reviewed by the issuing CA
Medium 25. An administrator's check uses a custom CA file, while student browsers use their standard trust stores. The administrator passes; students fail. What comparison is essential?
  1. Whether the administrator's shell supports colored certificate output
  2. Whether all clients use the same source TCP port for HTTPS
  3. Whether the student validation environment has the intended trust path
  4. Whether the portal has at least two DNS MX records

Hard question library · 25 questions

Hard 1. A CDN certificate was renewed. Public clients pass, but a monitoring probe pinned to the origin address fails with an expired origin certificate. The CDN terminates TLS and validates backend TLS separately. What is the correct conclusion?
  1. The origin failure establishes that public clients received the expired origin certificate.
  2. A successful cached edge response is enough to validate the origin connection.
  3. Edge success does not establish the origin leg; verify and repair the origin credential
  4. Public validation should be disabled until both endpoint certificates have equal expiry dates.
Hard 2. Fresh connections fail on 1 of 4 load-balancer nodes after renewal; reused sessions pass everywhere. A node-by-node full-handshake test finds the old serial on node C. What acceptance condition is missing?
  1. The old serial on C can be corrected by changing only the client resolver cache.
  2. Successful resumed sessions establish that node C loaded the replacement leaf.
  3. Fresh validated handshakes present the intended credential on every serving node
  4. Retesting through the shared address once is sufficient after any node reports the new serial.
Hard 3. The new backend certificate covers origin.school.example. A proxy connects by IP but verifies it against portal.school.example; both names are controlled by the school. What is the narrow repair?
  1. Replace the backend CA root while retaining a certificate that lacks the name being verified.
  2. Align the proxy's intended backend identity, SNI, and certificate coverage
  3. Keep verification against portal.school.example because the public browser URL determines every backend identity.
  4. Send SNI origin.school.example but retain verification against the unrelated public name.
Hard 4. After a private CA rotation, new clients pass but an old service agent fails. Its bundled CA file lacks the new root; the host operating system trusts that root. What is the next repair target?
  1. Change the agent URL to an IP literal and keep its DNS-name-only certificate.
  2. The service agent's effective CA configuration and approved trust bundle
  3. Reinstall the same new root only in the host browser, which already accepts it.
  4. Renew the server leaf while retaining the agent bundle that cannot trust its issuer.
Hard 5. A reverse proxy renews its public certificate correctly. The backend uses a private CA whose intermediate expired. Only origin-dependent requests return 502. Which verification best locates the defect?
  1. Validate the backend chain from the proxy's runtime and inspect its path result
  2. Reissue only the public leaf because the browser is the final user of every TLS connection.
  3. Repair the API route without checking the expired intermediate reported by the proxy.
  4. Use the cached homepage as proof that every origin server passed certificate validation.
Hard 6. Two hosts share a public address. A scanner omits SNI and flags an old default certificate, but all named tests pass. What should the report say?
  1. Classify all named services as expired because an IP address can have only one certificate.
  2. Remove SNI from the working named probes so their results agree with the scanner.
  3. The default listener is stale; the evidence does not establish failure for the named sites
  4. Ignore the default listener without checking whether monitoring or legacy clients use it.
Hard 7. The URL is portal.example, but a tester changes only HTTP Host to library.example. TLS still presents the portal credential; the response comes from the library application. What must be distinguished?
  1. Correct HTTP routing makes certificate identity checks unnecessary on a shared listener.
  2. TLS service-name selection and HTTP request routing are separate contexts
  3. The library response proves the server authenticated library.example during the portal handshake.
  4. The Host header retroactively selected the earlier handshake certificate for library.example.
Hard 8. A pinned mobile app rejects a replacement certificate that browsers accept. The hostname, dates, and public trust path pass. The app's pin no longer matches. What is appropriate?
  1. Repeat the browser test as sufficient evidence that the installed app now accepts the rollover.
  2. Replace the issuing root on the server even though the rejected condition is an application pin.
  3. Follow the app's authorized pin-rotation process and verify its expected key policy
  4. Reuse a matching hostname while ignoring the app versions that still expect the previous key.
Hard 9. Mutual TLS succeeds, but a client receives HTTP 403 after its certificate identity is mapped to a read-only role. It attempted a write. What is the supported repair discussion?
  1. Issue another client certificate while retaining the same read-only application role.
  2. Review the intended application authorization for that identity and action
  3. Permit write access to every authenticated identity to avoid changing a specific role mapping.
  4. Treat the 403 as proof the client never completed TLS authentication.
Hard 10. Normal browsing passes, but an automated acceptance test uses -k and an IP URL. The next day real clients see a hostname mismatch after cutover. What did the test fail to preserve?
  1. An HTTP Host header alone would have restored the checks removed by the IP URL and insecure option.
  2. Only the destination address mattered; keeping it fixed made the IP URL fully representative.
  3. The real URL identity and enforced certificate verification
  4. Disabling checks was acceptable because a response proves which hostname the server authenticated.
Hard 11. A wildcard *.school.example works for lab.school.example but not lab.east.school.example. The team proposes adding a DNS CNAME from the deeper name to the working name. Is that enough?
  1. No; the deeper URL still needs appropriate certificate identity coverage
  2. A CNAME makes the deeper hostname inherit all validation properties of its target.
  3. A redirect from the deeper HTTPS name avoids needing a valid certificate on that first connection.
  4. The single wildcard necessarily covers every number of labels beneath school.example.
Hard 12. A new chain works on current browsers but not a required older managed client. Both receive identical bytes and accurate time; the old client cannot build an accepted path. What should guide the repair?
  1. Remove the intermediate chain because any client with a root must validate the leaf directly.
  2. Consider current-browser acceptance sufficient despite an explicitly supported failing client.
  3. Choose the chain containing the largest number of certificates without inspecting validation paths.
  4. The supported client matrix and the actual chain-building failure
Hard 13. An enterprise app sees a public certificate off campus and an inspection-issued certificate on campus. Browser access passes both, but app pinning rejects the inspected path. What is the key decision?
  1. Add another public root even though inspection substitutes a credential rejected by the app pin.
  2. Reconcile approved inspection policy with the app's pinning requirement
  3. Replace only the origin leaf while assuming the gateway will stop reissuing certificates.
  4. Disable pinning silently so application policy cannot conflict with inspection policy.
Hard 14. A deployment changes DNS and TLS certificates at once. Some clients reach the old site with a valid old certificate; others reach the new site with a mismatched certificate. What evidence should be recorded per attempt?
  1. Treat every mismatch as stale DNS without recording which certificate each endpoint serves.
  2. Treat the valid old endpoint as proof that the new frontend’s certificate has the same names.
  3. Renew both leaves before distinguishing resolver propagation from the misconfigured new endpoint.
  4. Resolved address, reached endpoint, requested name, and presented credential
Hard 15. Certificate checks pass, then an upload stalls after small requests succeed. A tunnel was added recently; larger packets disappear and PMTU feedback is blocked. Which next investigation fits?
  1. Path MTU and packet-size handling for the failing transfer
  2. Add another trusted root because larger uploads always require a longer certification path.
  3. Reissue the leaf because an authenticated session guarantees delivery of all application packet sizes.
  4. Disable SNI because the successful small requests prove the endpoint name was never needed.
Hard 16. A security gateway logs a blocked TLS connection, but the application logs a successful handshake at the same second. They cover different source ports. What is needed before reconciling them?
  1. Correlate the exact connection tuple and timestamp context for each record
  2. Match logs by timestamp alone because one source cannot have multiple HTTPS connections.
  3. Use the successful application session to declare all gateway drops false positives.
  4. Conclude the server completed the blocked connection without comparing the endpoint tuples.
Hard 17. A service accepts a new TCP session but repeatedly closes it when a client offers TLS. Local configuration shows the port expects cleartext HTTP. What correction is supported?
  1. Serve TLS on that listener or point the client to the intended TLS endpoint
  2. Retest with plain HTTP and report the original authenticated HTTPS requirement as restored.
  3. Install a certificate on another port and leave the tested cleartext listener unchanged.
  4. Alter only the HTTP Host header so the cleartext listener will accept a TLS ClientHello.
Hard 18. An HTTP-only health check marks every backend healthy. User HTTPS connections fail because the TLS listener has no usable certificate/key pair. Which health check would catch this?
  1. Keep the HTTP-only check because a healthy application process guarantees a usable TLS credential.
  2. Check only the certificate file on disk without exercising the listener serving clients.
  3. A named validated HTTPS check against the actual TLS listener
  4. Use an HTTPS check with validation disabled and no hostname as equivalent acceptance evidence.
Hard 19. The server presents the intended renewed certificate, yet one client reports it revoked. Other clients do not check revocation in the same way. What is the sound next step?
  1. Accept the certificate solely because its notAfter time is still in the future.
  2. Replace the server hostname before checking which certificate the revocation warning identifies.
  3. Use the least strict client result as proof that all stricter status checks are incorrect.
  4. Investigate certificate status evidence and the client's effective revocation policy
Hard 20. A failover test switches to the standby proxy. TCP and DNS succeed, but the standby presents a valid certificate for a maintenance hostname. What failed the acceptance test?
  1. Count failover as successful because the maintenance certificate is valid for some hostname.
  2. Remove validation from the failover test while keeping it enabled for real clients.
  3. Extend DNS TTL without changing the standby credential that lacks the production name.
  4. The standby's ability to authenticate the production service name
Hard 21. A portal redirect sends clients to https://login.school.example:8443. The portal certificate validates, but a firewall blocks that destination port. What must recovery verification include?
  1. Add the login name to the portal SAN while leaving the redirected port blocked.
  2. Validate only the original hostname because its certificate must authenticate every redirect target.
  3. Treat a 302 from the portal as proof that the subsequent login request completed.
  4. The redirected authentication path and its own transport and TLS stages
Hard 22. A TLS 1.3 packet capture shows ClientHello and ServerHello, then encrypted records. A student says the absent visible certificate proves none was sent. What is the evidence limit?
  1. The encrypted records prove the client accepted the server identity without any endpoint result.
  2. Later handshake messages can be encrypted, so this view cannot prove absence
  3. The missing readable certificate proves a certificate-authenticated handshake was impossible.
  4. A ServerHello proves the browser received a successful HTTP response from the requested resource.
Hard 23. A probe negotiates TLS and matches the hostname, but it was configured with an unapproved root supplied by the same untrusted endpoint. Why is that not ordinary public-trust verification?
  1. A passing custom-root probe proves ordinary clients already trust that same root.
  2. A matching service name makes an unapproved issuing root equivalent to an approved trust anchor.
  3. A root supplied by the tested endpoint becomes trustworthy once its signature is self-consistent.
  4. The tester changed the trust assumption instead of establishing an approved path
Hard 24. After moving to a new HTTPS frontend, the page loads but an essential API still targets an old hostname. That old certificate expires next week. What should a complete cutover inventory include?
  1. All browser-requested origins, redirects, and backend dependencies with their owners
  2. Track only the new frontend because API origins inherit its certificate renewal automatically.
  3. Remove monitoring from the old API as soon as the landing page’s cutover passes.
  4. List only domains in the homepage certificate rather than observing actual browser dependencies.
Hard 25. A proposed fix restores access only with hostname checks disabled. A second proposal corrects SNI, installs the matching chain, and passes named tests on both frontends. Which meets the stated secure-service goal?
  1. The first proposal can be accepted if only managed browsers are asked to ignore the warning.
  2. The first proposal is sufficient because encryption without identity checks meets the whole goal.
  3. The second proposal, followed by representative client and workflow checks
  4. The second proposal needs only one frontend test because the installed chain is identical in storage.
Find the failing stage

A website can fail in five different places

Start with the student's task: open the named portal, sign in, and retrieve an assignment without a security warning. “The site is down” is too broad to test. Record the exact URL, client, time, network, and visible error. Keep the hostname in the URL because a direct-IP test changes the identity the client expects. If the browser redirects to another service, record that destination too.

Separate address resolution, connection establishment, TLS negotiation, certificate validation, and HTTP behavior. A resolver returning an address establishes only a lookup result. A completed TCP handshake establishes a transport exchange for that attempt. A validated TLS connection adds authentication and protection between its endpoints. An HTTP response adds application evidence, which may still be a denial, missing resource, or server error. For HTTP/3, the transport is QUIC over UDP; do not assume every HTTPS attempt uses TCP. The connection-stage questions here explicitly describe TCP when that distinction matters.

For a name-resolution failure, use the DNS resolution test. For a SYN timeout, use the transport troubleshooting test. Once a client reports a specific certificate error, keep the working lower stages intact while investigating that error.

Swipe to see every column.

Match an observation to a bounded conclusion
Observed resultWhat it supportsWhat to inspect next
Name lookup failsNo usable address from this lookupResolver, query, response, and client context
TCP 443 times outNo completed TCP exchange in this attemptPath, policy, listener, and return traffic
Client receives the wrong certificateA TLS endpoint presented an unexpected identityReached frontend, requested name, SNI, and deployment
HTTPS returns 403The request reached an HTTP decisionUser, resource, method, and access policy
Landing page works; API failsOnly part of the workflow has passedThe API's own origin, connection, and credential

Check identity, trust, time, and purpose separately

Consider a certificate that is unexpired and signed by a trusted authority but names printer.example. It is still wrong for portal.example. Conversely, a certificate naming portal.example can be rejected because the client does not trust its issuer. A third certificate might match the name and trust policy but be outside its validity interval. These failures need different repairs; renewing everything is a poor substitute for reading the actual validation result.

For DNS service names, inspect the leaf certificate's subject alternative names. A wildcard such as *.school.example covers library.school.example, but not school.example or lab.east.school.example. A DNS alias does not change the name the user intended to authenticate. If learn.school.example points to a vendor, the service still needs to support learn.school.example as the requested identity.

Compare the client's clock with a reliable time source before diagnosing “not yet valid.” Inspect certificate purpose restrictions when a valid-looking credential is unsuitable for a server or client role. Record which check failed instead of grouping everything under “SSL error.” The HTTP versus HTTPS guide provides the broader transport-security context.

Apply the Evidence • 120 Missions

Find the failed dependency before changing the server

If a TLS question reveals that you changed DNS before checking the error, practice choosing your next test deliberately. The Browser Troubleshooting Simulator gives students broken-network missions for collecting evidence, selecting a repair, and verifying the required result.

AP Networking Browser Troubleshooting Simulator
$29.99
120 Missions • 60 Failure Patterns • Offline Copy
BUY NOW — INSTANT ACCESS → See all 120 missions & features

Inspect the certificate that clients actually receive

A renewal receipt proves issuance, not deployment. The replacement might be sitting on an administrator's laptop, saved under an unused filename, installed on a staging listener, or loaded on only one frontend. Ask a more concrete question: which certificate does a new connection to each active endpoint receive? Compare serial number, validity, names, and chain with the intended rollout.

The server normally supplies the leaf and necessary intermediate certificates. Trust comes from the client's accepted anchors and policy, not from a server declaring its own chain trustworthy. A previously used browser can have an intermediate cached; a clean client may expose an incomplete served chain. This is why “it works on my laptop” is useful comparison evidence but weak deployment sign-off.

Test fresh full handshakes as well as normal browser use. A persistent connection or resumed session can hide a credential problem that affects new clients. Check both A and AAAA destinations when both are offered. Include standby nodes before failover: an alternate route that delivers a certificate for a maintenance hostname does not provide a usable production service.

Mixed Review • Exams and Artifact Labs

Put certificate failures beside their network lookalikes

After distinguishing trust errors from transport failures here, return to broader evidence. The Complete Exam Prep Vault includes practice exams, multiple-choice questions, and artifact labs for combining service, addressing, routing, and policy decisions.

AP Networking Complete Exam Prep Vault
$39.99
BUY NOW — INSTANT ACCESS → See the Exam Prep Vault contents →
4 Practice Exams • 320 MCQs • 60 Artifact Labs

Change the destination without changing the service identity

A useful migration experiment sends a real named request to a chosen candidate address. These examples use reserved documentation names and addresses; substitute an endpoint you administer or are authorized to test. They illustrate connection and validation checks, not a requirement to install tools before taking this browser test.

curl --resolve portal.example:443:192.0.2.80 https://portal.example/
openssl s_client -connect 192.0.2.80:443 -servername portal.example \
  -verify_hostname portal.example -verify_return_error

The curl override retains portal.example in the URL while choosing the connection address. Changing only an HTTP Host header on an IP-literal HTTPS request is not equivalent: TLS negotiation happens before that HTTP header is processed. SNI helps select the virtual TLS service, and hostname verification checks the presented identity. Supplying one does not automatically establish the other in every diagnostic tool.

OpenSSL's diagnostic client can display verification errors and continue under some settings. Explicit checking and the actual verification result matter more than seeing a certificate printed. Use the appropriate approved CA configuration for your environment. Avoid treating curl's insecure option as a repair or an acceptance test: it removes checks that ordinary clients still need to pass.

300 Bell Ringers • Teacher Answers

Ask what the padlock actually proves

Start class with a short contrast: a trusted certificate for the wrong name, or the right name signed by an unknown issuer. The 300 Bell Ringers pack supplies regular classroom starters and teacher answers for reinforcing the concepts behind longer investigations.

300 AP Networking Bell Ringers
$74.99
BUY NOW — INSTANT ACCESS → See what is included in the 300 Bell Ringers →
Instant Access • Full-Year Teacher Resource

Draw every TLS leg and every required origin

A browser may negotiate TLS with a CDN or reverse proxy, which then makes a separate connection to an origin server. The public certificate can be perfect while the backend certificate is expired, untrusted, or issued for a different name. If the proxy verifies origin.school.example, its backend configuration, SNI, and certificate need to agree on that intended identity. Shared ownership of two hostnames does not make them interchangeable.

Map the complete student workflow: portal, login redirect, API, and essential assets. Each new origin can bring a separate DNS lookup, transport connection, certificate, and policy boundary. A redirect to a login service on port 8443 can fail even when the portal on 443 works. A valid homepage can coexist with a broken API or mixed-content warning.

For a 502, read the proxy's reason and test the failing backend from the proxy's effective runtime. For a 403 after successful authentication, examine the intended authorization for that user and action. Practice that distinction in the secure access and identity test. Neither response code should automatically trigger certificate replacement.

Teacher Feedback • Claims and Evidence

Check the reasoning behind “the certificate is wrong”

Have students name the failed check, cite the observation, and explain why a competing repair would miss it. The Artifact Analysis Grading Copilot helps teachers review written evidence and prepare focused feedback while retaining the final grading decision.

AP Networking Artifact Analysis Grading Copilot
$49.99
8 Criteria • 5 Task Modes • Offline Premium Copy
BUY NOW — INSTANT ACCESS → See the free Copilot preview

Explain why two clients get different results

Build a small comparison matrix rather than randomly clearing caches. Include the requested name, resolved address, presented certificate, client time, trust source, application version, and whether the path crosses an approved inspection gateway. Compare one failing client with one working client while changing as little else as possible.

A container may use a bundled CA file while its host browser uses a different trust store. An application can enforce a certificate or public-key pin beyond ordinary chain and name validation. An inspection gateway can present a replacement credential that a browser trusts but a pinned app rejects. These differences call for an authorized trust, compatibility, or deployment decision; distributing private CA keys or removing validation is not an acceptable shortcut.

Mutual TLS adds a client identity at the connection layer. Successful client-certificate authentication does not authorize every later operation. A read-only service identity can complete TLS and correctly receive 403 on a write request. Decide whether the action should be permitted before changing the role mapping. A secure system sometimes refuses an operation because it is working as designed.

Complete Course • 180 Teaching Days

Connect secure-service work to the rest of the course

Students need transport and naming foundations before a multi-endpoint TLS investigation makes sense. The Complete 180-Day Teacher Curriculum provides daily lessons, activities, and simulators for planning that progression and revisiting gaps exposed by practice.

AP Networking Complete 180-Day Teacher Curriculum
$199.99
180 Lessons • 180 Daily Simulators • 36 Teaching Weeks
BUY NOW — INSTANT ACCESS → See 3 free curriculum examples

Close the incident with a reproducible acceptance test

Write the passing condition before applying the fix. For example: a representative managed laptop and an approved mobile client can open the production hostname, complete normal validation, sign in, and retrieve an uncached assignment through both active frontends. Include IPv6 and standby paths if those are part of the supported service. Keep normal security checks enabled.

Preserve a negative test too. A read-only identity should still be unable to upload; an unrelated hostname should not accidentally route to a private administration site. Recovery must restore the required access without expanding permissions. Record what changed, which endpoint loaded it, the presented credential, the clients tested, and any remaining unsupported case.

Use the test's attempt log to track the reasoning behind a miss. Label it as stage confusion, identity mismatch, trust difference, incomplete deployment, or incomplete workflow verification. Then solve an unfamiliar case with that same missing step. Repeating a familiar answer letter is a weaker check than explaining what new observation would change the diagnosis. Return to the practice-test hub for a related dependency or use the 2027 pilot diagnostic for mixed review.

Technical references and scope

These original instructional questions support networking troubleshooting; they do not reproduce Cisco or College Board exam questions or claim an official exam weighting. The local difficulty levels describe reasoning complexity. They are not certification score predictions. Tools and clients vary, so evaluate the actual validation environment rather than memorizing one browser's wording.