Workbook method
For every artifact, use four columns: observation, supported inference, unresolved question, and next evidence. This prevents students from turning one clue into an unsupported diagnosis.
Write the observation separately from the inference. Then name one alternative explanation the artifact does not yet eliminate and choose the next evidence that best separates the possibilities.
Artifact 1: endpoint configuration
Inspect IP address, prefix/mask, gateway, DNS, interface state, and DHCP-related information. Calculate whether the gateway is local. Compare with a working peer before changing configuration.
Write the observation separately from the inference. Then name one alternative explanation the artifact does not yet eliminate and choose the next evidence that best separates the possibilities.
Artifact 2: topology diagram
Identify endpoints, switches, routers, access points, firewalls, segments, uplinks, and service dependencies. Mark the path relevant to the symptom rather than analyzing every device equally.
Write the observation separately from the inference. Then name one alternative explanation the artifact does not yet eliminate and choose the next evidence that best separates the possibilities.
Artifact 3: MAC address table
Use learned MAC-to-port/VLAN entries to reason about Layer 2 location and forwarding. Missing entries can have several causes; do not interpret an empty table as proof the endpoint is powered off without additional evidence.
Write the observation separately from the inference. Then name one alternative explanation the artifact does not yet eliminate and choose the next evidence that best separates the possibilities.
Artifact 4: ARP or neighbor table
Map local IP neighbors to link-layer addresses. Alternating MAC ownership for one IPv4 address can support a duplicate-address investigation, while an incomplete neighbor entry can indicate unresolved local reachability.
Write the observation separately from the inference. Then name one alternative explanation the artifact does not yet eliminate and choose the next evidence that best separates the possibilities.
Artifact 5: routing table
Identify matching prefixes, select the most specific route, read next hop/interface, and then ask whether that next hop is reachable. Route selection and end-to-end success are separate questions.
Write the observation separately from the inference. Then name one alternative explanation the artifact does not yet eliminate and choose the next evidence that best separates the possibilities.
Artifact 6: DNS output
Distinguish timeout/no response, NXDOMAIN, unexpected record, and expected record. An expected answer moves troubleshooting toward later dependencies; it does not prove the application is listening.
Write the observation separately from the inference. Then name one alternative explanation the artifact does not yet eliminate and choose the next evidence that best separates the possibilities.
Artifact 7: ping output
Use target choice carefully. Gateway ping, remote-IP ping, and hostname ping test overlapping but different dependencies. ICMP may also be filtered, so a failed ping is evidence—not automatic proof that a host is down.
Write the observation separately from the inference. Then name one alternative explanation the artifact does not yet eliminate and choose the next evidence that best separates the possibilities.
Artifact 8: traceroute
Interpret where hop visibility changes and remember that routers can deprioritize or suppress responses. Use traceroute with routing, reachability, and service evidence rather than declaring the first missing hop the failed device.
Write the observation separately from the inference. Then name one alternative explanation the artifact does not yet eliminate and choose the next evidence that best separates the possibilities.
Artifact 9: firewall rules and logs
Read source, destination, protocol/port, action, order, and matched rule. A log entry showing a deny for the required flow can be decisive, but first determine whether the deny is intended policy or misconfiguration.
Write the observation separately from the inference. Then name one alternative explanation the artifact does not yet eliminate and choose the next evidence that best separates the possibilities.
Artifact 10: listener/connection output
A server with no listener on the required TCP port presents a different boundary than a firewall timeout. A listener proves a local service socket exists; it still does not prove every client path or application function works.
Write the observation separately from the inference. Then name one alternative explanation the artifact does not yet eliminate and choose the next evidence that best separates the possibilities.
Artifact 11: interface counters
Compare utilization, errors, discards, queue drops, speed/duplex, and time. CRC errors at modest load point in a different direction from output drops under saturation.
Write the observation separately from the inference. Then name one alternative explanation the artifact does not yet eliminate and choose the next evidence that best separates the possibilities.
Artifact 12: wireless evidence
Combine signal, retries, channel utilization, authentication state, DHCP state, client count, and a wired comparison. No single Wi-Fi number should become the entire diagnosis.
Write the observation separately from the inference. Then name one alternative explanation the artifact does not yet eliminate and choose the next evidence that best separates the possibilities.
Cross-artifact case
Client reaches gateway and remote numeric IP; DNS returns expected application IP; firewall allows TCP/443; server shows no listener. The artifact sequence pushes the first unsupported dependency to the server/service state.
Write the observation separately from the inference. Then name one alternative explanation the artifact does not yet eliminate and choose the next evidence that best separates the possibilities.
National-exam relevance
College Board says the May 2028 national AP Networking free-response section will use realistic networking artifacts and evidence. This workbook uses original practice artifacts and does not claim unpublished official FRQ counts, timing, or scoring weights.
Write the observation separately from the inference. Then name one alternative explanation the artifact does not yet eliminate and choose the next evidence that best separates the possibilities.
Mastery standard
Students should be able to cite an artifact precisely, avoid conclusions it cannot support, select the next highest-information artifact, and verify the correction against the original requirement.
Write the observation separately from the inference. Then name one alternative explanation the artifact does not yet eliminate and choose the next evidence that best separates the possibilities.
AP Networking Network Artifact Workbook practice laboratory
Artifact case 1
Endpoint has APIPA and no usable gateway; compare with a working peer and identify DHCP/VLAN evidence. Write the observation, supported conclusion, unresolved question, next evidence, and final verification. Then identify one tempting answer that goes beyond the evidence.
Artifact case 2
VLAN 30 fails across a trunk while VLAN 10 works; identify what the working VLAN proves. Write the observation, supported conclusion, unresolved question, next evidence, and final verification. Then identify one tempting answer that goes beyond the evidence.
Artifact case 3
Route matches destination but next hop is unreachable; separate route selection from forwarding. Write the observation, supported conclusion, unresolved question, next evidence, and final verification. Then identify one tempting answer that goes beyond the evidence.
Artifact case 4
Firewall allows 443, DNS/path work, server has no 443 listener; identify the strongest failure boundary. Write the observation, supported conclusion, unresolved question, next evidence, and final verification. Then identify one tempting answer that goes beyond the evidence.
AP Networking Network Artifact Workbook extended mastery set
Artifact drill 1 — Workbook method: Begin with this evidence type: For every artifact, use four columns: observation, supported inference, unresolved question, and next evidence. This prevents students from turning one clue into an unsupported diagnosis. Write one exact observation, one supported inference, one unsupported conclusion to avoid, and the next artifact that would most reduce uncertainty. Finish with a correction and a reproducible verification.
Artifact drill 2 — Artifact 1: endpoint configuration: Begin with this evidence type: Inspect IP address, prefix/mask, gateway, DNS, interface state, and DHCP-related information. Calculate whether the gateway is local. Compare with a working peer before changing configuration. Write one exact observation, one supported inference, one unsupported conclusion to avoid, and the next artifact that would most reduce uncertainty. Finish with a correction and a reproducible verification.
Artifact drill 3 — Artifact 2: topology diagram: Begin with this evidence type: Identify endpoints, switches, routers, access points, firewalls, segments, uplinks, and service dependencies. Mark the path relevant to the symptom rather than analyzing every device equally. Write one exact observation, one supported inference, one unsupported conclusion to avoid, and the next artifact that would most reduce uncertainty. Finish with a correction and a reproducible verification.
Artifact drill 4 — Artifact 3: MAC address table: Begin with this evidence type: Use learned MAC-to-port/VLAN entries to reason about Layer 2 location and forwarding. Missing entries can have several causes; do not interpret an empty table as proof the endpoint is powered off without additional evidence. Write one exact observation, one supported inference, one unsupported conclusion to avoid, and the next artifact that would most reduce uncertainty. Finish with a correction and a reproducible verification.
Artifact drill 5 — Artifact 4: ARP or neighbor table: Begin with this evidence type: Map local IP neighbors to link-layer addresses. Alternating MAC ownership for one IPv4 address can support a duplicate-address investigation, while an incomplete neighbor entry can indicate unresolved local reachability. Write one exact observation, one supported inference, one unsupported conclusion to avoid, and the next artifact that would most reduce uncertainty. Finish with a correction and a reproducible verification.
Artifact drill 6 — Artifact 5: routing table: Begin with this evidence type: Identify matching prefixes, select the most specific route, read next hop/interface, and then ask whether that next hop is reachable. Route selection and end-to-end success are separate questions. Write one exact observation, one supported inference, one unsupported conclusion to avoid, and the next artifact that would most reduce uncertainty. Finish with a correction and a reproducible verification.
Artifact drill 7 — Artifact 6: DNS output: Begin with this evidence type: Distinguish timeout/no response, NXDOMAIN, unexpected record, and expected record. An expected answer moves troubleshooting toward later dependencies; it does not prove the application is listening. Write one exact observation, one supported inference, one unsupported conclusion to avoid, and the next artifact that would most reduce uncertainty. Finish with a correction and a reproducible verification.
Artifact drill 8 — Artifact 7: ping output: Begin with this evidence type: Use target choice carefully. Gateway ping, remote-IP ping, and hostname ping test overlapping but different dependencies. ICMP may also be filtered, so a failed ping is evidence—not automatic proof that a host is down. Write one exact observation, one supported inference, one unsupported conclusion to avoid, and the next artifact that would most reduce uncertainty. Finish with a correction and a reproducible verification.
Artifact drill 9 — Artifact 8: traceroute: Begin with this evidence type: Interpret where hop visibility changes and remember that routers can deprioritize or suppress responses. Use traceroute with routing, reachability, and service evidence rather than declaring the first missing hop the failed device. Write one exact observation, one supported inference, one unsupported conclusion to avoid, and the next artifact that would most reduce uncertainty. Finish with a correction and a reproducible verification.
Artifact drill 10 — Artifact 9: firewall rules and logs: Begin with this evidence type: Read source, destination, protocol/port, action, order, and matched rule. A log entry showing a deny for the required flow can be decisive, but first determine whether the deny is intended policy or misconfiguration. Write one exact observation, one supported inference, one unsupported conclusion to avoid, and the next artifact that would most reduce uncertainty. Finish with a correction and a reproducible verification.
Artifact drill 11 — Artifact 10: listener/connection output: Begin with this evidence type: A server with no listener on the required TCP port presents a different boundary than a firewall timeout. A listener proves a local service socket exists; it still does not prove every client path or application function works. Write one exact observation, one supported inference, one unsupported conclusion to avoid, and the next artifact that would most reduce uncertainty. Finish with a correction and a reproducible verification.
Artifact drill 12 — Artifact 11: interface counters: Begin with this evidence type: Compare utilization, errors, discards, queue drops, speed/duplex, and time. CRC errors at modest load point in a different direction from output drops under saturation. Write one exact observation, one supported inference, one unsupported conclusion to avoid, and the next artifact that would most reduce uncertainty. Finish with a correction and a reproducible verification.
Artifact drill 13 — Artifact 12: wireless evidence: Begin with this evidence type: Combine signal, retries, channel utilization, authentication state, DHCP state, client count, and a wired comparison. No single Wi-Fi number should become the entire diagnosis. Write one exact observation, one supported inference, one unsupported conclusion to avoid, and the next artifact that would most reduce uncertainty. Finish with a correction and a reproducible verification.
Artifact drill 14 — Cross-artifact case: Begin with this evidence type: Client reaches gateway and remote numeric IP; DNS returns expected application IP; firewall allows TCP/443; server shows no listener. The artifact sequence pushes the first unsupported dependency to the server/service state. Write one exact observation, one supported inference, one unsupported conclusion to avoid, and the next artifact that would most reduce uncertainty. Finish with a correction and a reproducible verification.
Continue studying
Study Guide · Practice Questions · Artifact Analysis · Review · Site Directory