Read the artifact as evidence, not as decoration
A network artifact can be a route table, ARP cache, switch MAC table, firewall log, DNS result, traceroute, interface counter set, wireless statistic, or endpoint configuration. A strong response does not merely name the command. It explains what the artifact directly proves, what remains unresolved, and which next test would reduce uncertainty the most.
Use this four-part structure on every artifact
Routing table: longest-prefix match
The /24 route is selected because it is the most specific matching prefix. That proves route selection, not reachability of 10.1.1.4.
ARP + MAC table: duplicate address ownership
The same IPv4 address alternates between two Layer 2 identities on different ports. That is much stronger evidence for duplicate IP ownership than for DNS failure.
Firewall log: denied application flow
If the requirement explicitly permits StudentNet to this application on TCP/443, the firewall decision conflicts with the requirement.
Wireless counters: strong signal does not rule out contention
Coverage is not the strongest explanation because signal is strong. High retries and channel utilization support contention, interference, or airtime saturation.
Interface counters: CRC errors separate corruption from congestion
High CRC growth at modest utilization does not fit ordinary queue saturation. The evidence points toward cabling, transceiver, interface, duplex/negotiation, or physical-layer quality.
WAN performance: correlated congestion evidence
The shared upstream path is the strongest congestion candidate. Stable gateway latency helps preserve the local access path as a known-good checkpoint.
DNS result + no listener: do not keep opening the firewall
Name resolution and routed reachability are substantially proven. A firewall permit cannot create a missing application listener.
SSID label + wrong DHCP subnet: placement beats branding
The SSID name alone does not create segmentation. Inspect SSID-to-VLAN mapping, dynamic role assignment, and DHCP scope selection before rewriting firewall rules.
APIPA on one host: DHCP failure without overclaiming
The affected endpoint failed to obtain expected IPv4 configuration, but healthy peers make a total DHCP-server outage weaker.
Subnet calculation as elimination evidence
The gateway is local and valid. Any answer claiming “gateway is outside the subnet” contradicts the calculation.
Gateway + remote IP + DNS all work, but TCP/443 fails
Local connectivity, routed reachability, and DNS are known-good checkpoints. Move to policy, service listener, return path, TLS, or application behavior.
One VLAN fails while others cross the same uplink
The physical trunk is alive. Inspect VLAN 30 membership, existence, allowed lists, tagging, and the path to its gateway.
The best explanation must fit all the evidence at once
| Artifact A | Artifact B | Stronger conclusion |
|---|---|---|
| High CRC | Low utilization | Physical/link corruption over congestion |
| Remote IP works | DNS fails | Resolver branch over general routing |
| Firewall ALLOW | No server listener | Service state over firewall deny |
| Two VLANs cross trunk | One VLAN fails | VLAN-specific trunk issue over dead link |
| Server received request | Client times out | Return path or response-side issue |
Swipe horizontally to see the contradiction matrix.
Stop your conclusion exactly where the artifact stops
| Artifact | What it proves | What it does not prove |
|---|---|---|
| Route table entry | Route selection exists | Next-hop reachability |
| Firewall DENY | Firewall blocked that observed flow | Whether policy should permit it |
| nslookup succeeds | DNS returned an answer | Application port is open |
| High retries | Wireless retransmission pressure | Exact interference source |
| APIPA | No expected DHCP lease acquired | DHCP server is definitely down |
Swipe horizontally to see the evidence-boundary table.
Name the mechanism, not just the device
“The firewall is the problem” is weaker than “the observed StudentNet-to-AppServer TCP/443 flow matches rule 18 and receives DENY even though the requirement permits HTTPS.” The second answer connects the artifact to the mechanism and leaves less ambiguity.
A repair is not complete until you prove what should work and what should stay blocked
If you change a firewall rule, test the required HTTPS flow and a prohibited management flow. If you add VLAN 30 to a trunk, test VLAN 30 and confirm VLANs 10 and 20 still work. If you correct a DHCP mapping, verify the new lease comes from the right subnet and that unauthorized access is still denied.
Reject answers that contradict a successful checkpoint
If a client reaches a remote numeric IP, a total local Layer 1 outage is incompatible with the evidence. If a server log shows the request arrived, a source-side routing failure is weaker. If two VLANs use the same trunk successfully, “dead cable” is a poor explanation for one failed VLAN.
Six original multi-artifact prompts
A /24 route exists through 10.1.1.4, but ping to 10.1.1.4 fails while the interface is up. State what the route table proves, what the ping changes, and the next artifact you want.
A guest client receives a Staff subnet, and its MAC appears in the Staff VLAN on the access switch. Identify the first failed boundary and the safest correction.
The firewall logs ALLOW for TCP/443, but the server shows no listener on 443. Identify which hypothesis is weakened and what should be fixed.
Wi-Fi has 30% retries and high channel utilization; wired control is clean. Explain why WAN congestion is not the strongest branch.
CRC errors climb while throughput is low. Explain why link quality is stronger than capacity exhaustion.
Server logs show the request, but the client times out and the server's return route is missing. State the first directly demonstrated failed dependency.
Score each response on evidence discipline
1 point
Correctly identifies the supported boundary or conclusion.
1 point
Cites the decisive artifact field or output.
1 point
Chooses a high-information next action.
1 point
Provides meaningful verification.
Bonus discipline
Rejects a plausible distractor using existing evidence.
Bonus discipline
Stops the conclusion where the evidence stops.
24 Network Artifact FRQ digital flashcards
Practice routes, ARP/MAC evidence, firewall logs, DNS, service listeners, wireless counters, CRC errors, DHCP, VLAN controls, evidence boundaries, distractors, and verification.