Prepare for the 2027 AP Networking pilot with 32 original scenario questions, instant feedback, evidence-based explanations, and a four-unit study guide.
Independent student resource • Published and updated October 11, 2026 • 32 original questions
What is confirmed about the 2027 pilot?
The May 2027 AP Networking pilot is a digital, multiple-choice-only exam for participating pilot schools. College Board lists Networking in Session 2 on Friday, May 7, 2027. Confirm your reporting time and location with your AP coordinator. The public pilot page does not give a question count, duration, or unit weighting. This 32-question practice set is an independent diagnostic, not a full-length official simulation.
College Board says no practice exam is available for pilot courses. These questions are newly written educational exercises, not released or recalled exam items. They do not predict an AP score or guarantee which scenarios you will receive.
What should a pilot student study?
The 2026–27 pilot course framework names four units and four skill categories: Connect and Configure, Secure, Troubleshoot, and Collaborate. The following study map is our organization of the practice on this page, not an official exam distribution. Eight questions per unit makes the diagnostic balanced; it does not establish equal exam weighting.
On a narrow screen, swipe the table horizontally. Read the questions in mixed order for a second attempt once you understand their mechanisms; memorizing answer letters will not measure that understanding.
For a course overview, use the four-unit guide. For a specific weakness, the topic practice library lets you isolate a mechanism before returning to mixed scenarios.
Take the 32-question pilot practice test
Choose one answer to get immediate feedback and a question-specific explanation. Your first choice counts; answers lock after selection. Use Show My Score to review progress at any point. This is an untimed diagnostic, not an official exam replica. Questions and choices are present in readable HTML.
Before choosing: Identify what the evidence proves, what remains uncertain, and which option meets the stated requirement. A correct answer that you cannot explain is worth revisiting.
Showing all 32 questions.
0 of 32 answered · 0 correct
Unit 1 · Endpoint performance
Question 1 of 32
A student’s video call freezes while Task Manager shows CPU usage at 99%. Another laptop on the same access point completes a call normally. On the affected laptop, closing a runaway background process drops CPU usage to 35% and the call becomes smooth.
Answer and evidence — Question 1
Correct answer: B. Local processor contention on the affected laptop
The symptom changes when local CPU contention is removed, while a peer on the same network works. That supports an endpoint resource problem. A shared WAN failure would not explain the healthy peer and immediate local improvement. DHCP exhaustion concerns obtaining configuration; the laptop already has an active call. An incorrect DNS record does not explain this process-dependent recovery.
Unit 1 · Client configuration
Question 2 of 32
A Windows laptop joins the school SSID but receives 169.254.73.8/16 with no default gateway. Its adapter is set to obtain an address automatically. Other laptops have 10.42.6.x/24 leases.
Answer and evidence — Question 2
Correct answer: D. Observe whether the laptop’s DHCP exchange receives an offer and completes
The automatic client has an IPv4 link-local address instead of a school lease. Check the DHCP exchange and its path before naming the exact fault. A missing offer could result from several causes, including client, VLAN, relay, or server problems. Changing DNS does not supply a usable school address and gateway. A website certificate is unrelated to address allocation. Disabling loop prevention creates risk without testing the indicated dependency.
Unit 1 · Name resolution
Question 3 of 32
A workstation reaches an internal test server using a TCP connection to 10.18.4.20:8080. A lookup of lab.example.test using its configured resolver returns NXDOMAIN. The administrator confirms that this exact name should exist.
Answer and evidence — Question 3
Correct answer: A. Compare the requested name and its record in the intended DNS zone
NXDOMAIN reports that the queried name does not exist according to that DNS response. Compare the spelling, resolver context, and intended zone record. The working address-based connection shows that this particular TCP service is reachable; it does not validate the name. A cable replacement and TCP tuning do not address the negative DNS answer. A port change cannot create a missing DNS record.
Unit 1 · Local delivery
Question 4 of 32
A host is 192.168.77.34/24. Its default gateway is 192.168.77.1, and a printer is 192.168.77.90/24 on the same Ethernet LAN. No policy routes or isolation rules apply. The host has no neighbor entry for the printer.
Answer and evidence — Question 4
Correct answer: C. 192.168.77.90, the printer’s on-link address
The /24 places .34 and .90 in the same connected subnet, so ordinary delivery resolves the printer’s local MAC address. The gateway would be the next hop for an off-subnet destination under the stated routing conditions. ARP maps a local IPv4 next-hop address to a link-layer address; it does not resolve names. The limited broadcast address is not this printer’s unicast identity.
Unit 1 · Phishing response
Question 5 of 32
A message claims to be school IT and asks a student to sign in through a shortened link immediately. The school’s normal help portal has no matching notice. The student has not opened the link or entered credentials.
Answer and evidence — Question 5
Correct answer: C. Contact IT through a known school channel and report the suspicious message
A known channel separates verification from the untrusted message and lets IT investigate. A familiar-looking sign-in page can still collect credentials. Passwords should not be sent in replies, and classmates should not be exposed to a suspected phishing link. Because no credentials have been entered in this scenario, there is no evidence yet of a completed account compromise; report the attempt and follow school guidance.
Unit 1 · Patch verification
Question 6 of 32
A managed laptop has a known operating-system vulnerability. Its update tool reports a downloaded patch and says a restart is required. The security dashboard still reports the vulnerable version.
Answer and evidence — Question 6
Correct answer: A. The required restart is completed and the installed version or follow-up check confirms the patched state
Downloaded is not the same as installed and active. Complete the required maintenance step and verify the resulting version or vulnerability status. A filename is not proof of an applied patch. Throughput does not test the vulnerability. Careful browsing may reduce some exposure, but it does not replace the specified software remediation.
Unit 1 · Authentication factors
Question 7 of 32
A school account already uses a password. The school wants a second authentication factor to reduce the risk from a stolen password.
Answer and evidence — Question 7
Correct answer: D. Approval using an enrolled hardware security key
A hardware security key provides a possession factor in addition to the password’s knowledge factor. A second password and a memorized security answer remain knowledge factors. A username identifies an account and is not normally a secret authentication factor. Multiple steps do not automatically make authentication multifactor; the factor types matter.
Unit 1 · Tool-assisted judgment
Question 8 of 32
An assistant tool recommends turning off the endpoint firewall after a browser reports a connection error. The student has not checked the requested hostname, destination port, or firewall logs.
Answer and evidence — Question 8
Correct answer: B. Treat it as a hypothesis, inspect relevant evidence, and test an authorized narrow change only if justified
The recommendation is not a verified diagnosis. Check which connection failed and whether a relevant rule actually blocked it, then test a limited authorized remedy if supported. A blanket firewall shutdown increases exposure and changes many conditions at once. Credentials must not be shared to validate a suggestion. A router replacement is another unsupported conclusion. Human review and a fresh test remain necessary.
Unit 2 · Physical evidence
Question 9 of 32
A SOHO desktop repeatedly drops its wired connection. Switch port counters show new frame-check errors during file transfers. A known-good patch cable on the same ports stops both the new errors and the drops.
Answer and evidence — Question 9
Correct answer: A. Replace the suspect patch cable and verify stable transfers
The controlled cable substitution removes the observed link errors and drops, supporting a cable or connector problem on that replaced segment. Verify sustained operation before closing the case. DNS settings and DHCP pool size do not repair physical corruption. Changing VLAN membership is unsupported when the same-port cable substitution restores operation.
Unit 2 · Subnet boundaries
Question 10 of 32
A small office uses 192.168.14.64/27. The router interface is .65. A technician must assign one unused ordinary host address to a printer. No addresses in this subnet are currently allocated except .65.
Answer and evidence — Question 10
Correct answer: C. 192.168.14.82
A /27 contains 32 addresses. This block spans .64–.95, with .64 as network and .95 as broadcast. Ordinary host addresses are .65–.94, making unused .82 valid. Address .96 starts the next block. The router already uses .65, so the printer must receive a different available host address.
Unit 2 · Guest isolation
Question 11 of 32
A tutoring center must give guests Internet access while preventing access to staff files and router administration. Guests and staff currently share one flat LAN.
Answer and evidence — Question 11
Correct answer: B. Put guests in a separate network and enforce rules that allow required Internet access but deny staff and management access
A separate guest segment plus enforced traffic policy provides an actual access boundary. A different SSID name alone does not prove different forwarding or firewall treatment. Hiding an SSID is not an access-control boundary. Stronger link encryption does not itself separate guest permissions from staff permissions on the shared LAN. After configuration, test both allowed Internet traffic and denied internal access.
Unit 2 · Switch learning
Question 12 of 32
A small Ethernet switch receives a frame on port 3 with source MAC address AA:AA:AA:AA:AA:03 and destination BB:BB:BB:BB:BB:07. Both addresses are absent from the switch’s table, and all relevant ports are in the same VLAN.
Answer and evidence — Question 12
Correct answer: D. AA:AA:AA:AA:AA:03 is reachable through port 3 in this VLAN
The arriving frame establishes where its source is reachable. It does not establish which port leads to the destination. With an unknown unicast destination, ordinary switching may flood within the VLAN, excluding the ingress port, subject to controls. A later frame from the destination can teach its location. The source entry belongs to the observed VLAN context; an initially unknown address does not make it a member of every VLAN.
Unit 2 · Wireless coverage
Question 13 of 32
A family’s video calls work near the access point but drop in a back room. The same laptop works reliably on Ethernet. A survey finds a weak Wi-Fi signal in that room, while the wired uplink has spare capacity.
Answer and evidence — Question 13
Correct answer: D. Improve access-point placement or add a properly connected access point to cover the room
The location-dependent symptom and weak signal point to the local wireless coverage path. Better placement or an appropriately connected access point can improve it; verify coverage and calls afterward. A faster WAN subscription does not strengthen the room’s radio link. A band change needs coverage evidence rather than an assumption that it will improve the room’s link. Reliable wired operation does not justify replacing the gateway configuration.
Unit 2 · Network documentation
Question 14 of 32
A technician traces a printer’s cable to switch port 8. Port 8 is configured in VLAN 12. The printer currently uses 10.12.0.46/24 with gateway 10.12.0.1, but an old diagram labels it as 10.10.0.46 on port 2.
Answer and evidence — Question 14
Correct answer: B. Record the verified port, VLAN, current addressing, and verification date in the network inventory
The verified current connection and configuration are actionable evidence for later troubleshooting. A date helps distinguish observed state from an old assumption. Keeping disproven values makes future work harder. Endpoints such as printers belong in inventories because their network dependencies matter. A DHCP pool alone does not record a manually observed connection or identify the actual switch port.
Unit 2 · Management security
Question 15 of 32
A home router’s administration interface is reachable from the Internet, uses its original default administrator password, and is not needed for remote management.
Answer and evidence — Question 15
Correct answer: C. Disable unnecessary Internet-facing administration and set a unique administrator credential
Removing an unnecessary public management path reduces exposure, and replacing the default credential addresses a known authentication weakness. These controls target different parts of the stated risk. Renaming Wi-Fi, increasing switch speed, or changing lease duration leaves the exposed interface and credential problem intact. Verify that legitimate local administration remains available.
Unit 2 · Address conflicts
Question 16 of 32
A printer uses manually configured 192.168.8.40. The office DHCP pool also includes .40. A laptop receives a lease for .40, and connectivity becomes intermittent when both devices are active.
Answer and evidence — Question 16
Correct answer: A. Coordinate the printer’s assignment with the DHCP scope, using an appropriate exclusion or reservation and clearing the duplicate assignment
The same active address is assigned to two devices. Coordinate static and dynamic allocations, then renew or reconfigure the affected endpoint as appropriate and verify unique ownership. DNS suffixes do not change the duplicate IP. A shorter lease can still allocate the same conflicting address. Clearing caches may temporarily change symptoms, but the duplicate assignments remain.
Unit 3 · Access VLAN
Question 17 of 32
A classroom workstation should join VLAN 30. Its switch port is configured as an access port in VLAN 20. A DHCP capture shows a valid lease from VLAN 20’s scope, and the workstation cannot reach VLAN 30-only resources.
Answer and evidence — Question 17
Correct answer: C. Assign the workstation’s access port to the intended VLAN 30 and obtain the corresponding client configuration
The port membership and lease identify the workstation’s current segment as VLAN 20. Correct the access VLAN and refresh addressing as needed, then verify intended access. A gateway used as DNS does not move a port into another VLAN. A forced VLAN 30 address remains on the wrong Layer 2 segment if port membership is unchanged. Configuring an unrelated spare port does not alter this workstation’s attachment.
Unit 3 · Trunk membership
Question 18 of 32
Two switches share an 802.1Q trunk. VLANs 10 and 20 work across it, but VLAN 40 clients fail only when the destination is on the other switch. Both switches have VLAN 40 defined. The trunk’s allowed list is 10,20.
Answer and evidence — Question 18
Correct answer: D. Allow VLAN 40 on the trunk at the relevant ends and verify cross-switch traffic
The allowed list excludes VLAN 40, matching the selective cross-switch failure. Add the required VLAN consistently and verify forwarding plus intended separation. DNS cannot carry an excluded VLAN across a trunk. The working VLANs show the link is not simply unavailable for all traffic. Converting the trunk into one access VLAN would disrupt the other VLANs that the shared connection must carry.
Unit 3 · Route selection
Question 19 of 32
A router has usable installed routes 10.0.0.0/8 via A with metric 5, 10.66.0.0/16 via B with metric 80, and 0.0.0.0/0 via C with metric 1. There is no policy-based routing.
Answer and evidence — Question 19
Correct answer: B. B, because the /16 is the longest matching installed prefix
The destination matches all three prefixes, but /16 is the most specific. Longest-prefix selection occurs before comparing metrics of equivalent candidates under ordinary forwarding. The lower default-route metric does not override a more specific installed match. A /8 covers more addresses and is less specific. Multiple matching prefixes do not automatically cause duplication across all next hops.
Unit 3 · Ordered policy
Question 20 of 32
A stateless ACL processes rules from top to bottom and stops at the first match. Rule 10 denies all traffic from 10.30.0.0/24 to 10.50.0.0/24. Rule 20 permits that same source network to 10.50.0.8 TCP destination port 443. The requirement is to allow only that HTTPS service and keep other access denied.
Answer and evidence — Question 20
Correct answer: A. Place the narrow HTTPS permit before the broad deny, retaining the deny for other traffic
Rule 10 currently matches and denies the desired connection before Rule 20 is considered. The specific permit must precede that broader deny in this stated first-match model. Appending another permit below the deny cannot help. Permitting all traffic violates the restriction. UDP 53 describes a different service and would not authorize this TCP 443 connection. Return traffic must also satisfy the network’s separate policy.
Unit 3 · Transport evidence
Question 21 of 32
A capture near a client shows a TCP SYN to 10.51.3.8:8443, a matching SYN-ACK, and the client’s ACK. A later application response contains an authorization error.
Answer and evidence — Question 21
Correct answer: B. The TCP handshake completed, but the requested application action was not authorized
The matched SYN, SYN-ACK, and ACK show connection establishment for this flow. The later application response supplies a separate authorization outcome. That response cannot be explained by the server being wholly unreachable for this exchange. Transport success does not grant permissions. The evidence does not establish a DNS failure; the application reached a point where it could return an authorization error.
Unit 3 · Changed DNS data
Question 22 of 32
An internal service moves from 10.70.2.10 to 10.70.2.25. The authoritative zone now returns .25. One client’s resolver cache still holds the old A record, and a name-based connection goes to .10.
Answer and evidence — Question 22
Correct answer: C. Refresh the stale resolver state through an appropriate cache clear or expiry, then verify a fresh lookup
The authoritative answer and the client’s cached answer differ. Refresh or allow expiry of the relevant stale cache, then confirm what a new lookup returns. A port-VLAN change is not justified by the named cache evidence. Restoring the old address would undo the intended migration rather than correct this client’s state. A new TTL on the authoritative record does not instantly replace the expiry of every previously cached answer. Other caching layers may also need investigation if the stale result persists.
Unit 3 · Capacity planning
Question 23 of 32
A lab’s desktops each negotiate 1 Gb/s to their access switch, but they share a 100 Mb/s uplink to the file server network. During concurrent transfers, uplink utilization stays near 100% and queues grow; the server’s CPU and disks have spare capacity.
Answer and evidence — Question 23
Correct answer: A. The shared uplink and its offered load
The saturated shared link and growing queues identify a bottleneck under the measured workload. Compare aggregate demand with uplink capacity and consider scheduling or an appropriate upgrade. Faster desktop links alone do not enlarge the shared uplink. Changing MTU without checking the path can introduce another problem, and the stated server measurements do not identify disk capacity as the bottleneck. A component carrying the traffic can be constrained even when other components have spare resources.
Unit 3 · Change handoff
Question 24 of 32
A team changes a VLAN policy during an approved maintenance window. The original configuration has been saved. One member performs the change while another checks results.
Answer and evidence — Question 24
Correct answer: D. Record the exact change, time, expected allowed and denied behavior, observed tests, and rollback condition
A useful handoff identifies the intended state and the observations needed to accept or roll back the change. It lets another person reproduce the verification and understand its limits. A vague completion note cannot show which policy was tested. One ping does not validate all required restrictions. Deleting rollback material and making unrelated simultaneous changes both weaken control of the investigation.
Unit 4 · Performance interpretation
Question 25 of 32
A school’s cloud upload stalls during lunch. Measurements show its WAN upload link at 98% utilization and sharply higher round-trip delay under load. Quiet-period tests are normal. Local file transfers remain fast.
Answer and evidence — Question 25
Correct answer: D. WAN upload congestion with queueing during the busy period
High upload utilization with load-dependent delay supports congestion and queueing on the shared WAN path. Healthy local transfers and quiet-period recovery help locate the affected dependency. Permanent cable failures or universally missing gateways would not normally recover with offered load. A high advertised download rate does not establish available upload capacity under the measured workload. Confirm the traffic source and compare an appropriate controlled reduction in demand.
Unit 4 · Failure domains
Question 26 of 32
A campus has two Internet links, but both fibers run through the same conduit. A construction cut in that conduit takes both links down.
Answer and evidence — Question 26
Correct answer: A. Use physically diverse routes where feasible and verify how they are separated
Two logical connections can still share one physical failure domain. Diverse physical routes address the stated common cut, though other shared dependencies must also be evaluated. Labels and faster optics do not separate the path. DNS configuration cannot preserve transport through severed fibers. Redundancy should be judged by which single failures it survives, not simply by counting links.
Unit 4 · Traceroute limits
Question 27 of 32
A traceroute shows no reply at an intermediate hop, then replies from later hops and reaches the destination. A fresh connection to the destination service also succeeds.
Answer and evidence — Question 27
Correct answer: C. The silent hop did not answer that probe, but it was not a complete forwarding barrier for the later successful traffic
Later-hop replies and destination success show that the missing response is not proof of a complete path break. A router may forward traffic while limiting or declining diagnostic replies. The observation does not prove loss-free service either; compare repeated tests if performance is the issue. Universal unreachability contradicts the successful connection. A missing diagnostic reply is not equivalent to measured application loss. Rebooting a router without further evidence or authorization can disrupt working service.
Unit 4 · Routed DHCP
Question 28 of 32
A new branch subnet is 10.91.4.0/24. Its DHCP server is on another routed subnet. A capture sees client DHCP Discover broadcasts on the branch LAN, but no relay is configured at the branch gateway and the server receives none of these requests.
Answer and evidence — Question 28
Correct answer: B. A DHCP relay that forwards the branch clients’ requests to the configured remote server
Ordinary routers do not forward these local client broadcasts to the remote server as normal routed unicast traffic. An appropriate DHCP relay carries the exchange across the routed boundary; its server scope and return path must also be correct. A DNS alias does not relay discovery. Serving as an IP gateway does not automatically enable a DHCP server or relay. Public NAT per client is not a prerequisite for private branch address allocation.
Unit 4 · TLS identity
Question 29 of 32
A browser reaches a school’s HTTPS server, but reports that the certificate’s names do not include portal.example.test, the hostname the student requested. The intended hostname and DNS address have been verified.
Answer and evidence — Question 29
Correct answer: A. Deploy a valid certificate covering the intended hostname through the school’s approved process
The certificate must authenticate the intended hostname as well as satisfy other validation requirements. Replace or correctly configure it through the approved process and retest. A warning bypass hides the mismatch rather than repairing identity assurance. Clearing a cache does not correct the names in the certificate returned by the verified server. Moving credential entry to unprotected HTTP sacrifices transport protection instead of fixing the named HTTPS problem.
Unit 4 · Cloud dependency
Question 30 of 32
Students can open the school’s cloud learning platform and sign in. The platform displays other pages normally, but one assignment’s upload returns HTTP 413 and the server’s documented upload limit is smaller than that file.
Answer and evidence — Question 30
Correct answer: B. Check the file size against the service limit and use an approved smaller file or supported submission method
The service returned a specific application-level rejection consistent with the stated size limit. Compare size and supported methods before changing network infrastructure. A service-imposed size rejection is different from insufficient link capacity or a connection timeout. Increasing bandwidth or waiting longer leaves the stated upload limit intact. Successful sign-in and the size-specific response do not support treating this as a password failure.
Unit 4 · Least privilege
Question 31 of 32
An IT intern needs to read network monitoring dashboards but must not change firewall rules or user permissions. A full administrator role would include all three abilities.
Answer and evidence — Question 31
Correct answer: D. A named read-only monitoring role limited to the necessary resources
A named limited role grants the needed read access without unnecessary administrative power and supports accountability. A shared administrator account still permits prohibited changes and obscures who acted. Sharing a personal password compromises control of credentials. Anonymous editing rights contradict the requirement. Verify that the intern can read the intended dashboards and cannot perform restricted operations.
Unit 4 · Recovery verification
Question 32 of 32
A network device’s configuration is exported nightly. After a device replacement, the team wants evidence that its recovery plan works, not just that a file exists.
Answer and evidence — Question 32
Correct answer: C. Restore an appropriate backup in an authorized test, then verify required connectivity, security policy, and documented recovery steps
A controlled restore tests whether the backup is usable and whether the recovered state meets operational requirements. Document what was restored, dependencies, and measured results. A date, copy count, or successful export does not prove restoration or correct behavior. Test required access and restrictions together, using an authorized environment or maintenance plan rather than disrupting live service without approval.
Filters change which questions are shown, not the scoring rule. Download your log before restarting. Responses are held in this page’s memory and clear when it reloads. To study a missed question again, restart after saving your notes.
Read the host’s configuration before naming the fault
Begin with the interface carrying the traffic. A computer can have Wi-Fi, Ethernet, a VPN, and virtual adapters at the same time. An address on an inactive interface does not tell you which path the failing request used. Read the address, prefix, gateway, resolver, and active route together. If a question supplies a particular interface and excludes policy routing, use those conditions rather than inventing a hidden VPN.
An automatic IPv4 client with a 169.254.x.x address and no usable gateway has not demonstrated a successful ordinary DHCP configuration for that network. That is a clue about missing configuration, not proof that the server itself is down. The client might be on the wrong VLAN, its request might not reach the server, or a reply might not return. A useful next test asks where the exchange stops. Review DNS and DHCP protocol practice when you confuse lease allocation with name lookup.
Now make the local-versus-remote decision. With 192.168.25.70/26, the containing block is .64–.127; ordinary host addresses are .65–.126. A destination at .100 is on-link, while .150 belongs to another block. Under ordinary connected-subnet routing, the host resolves a local neighbor directly and uses a selected router next hop for the remote destination. The Ethernet destination identifies that immediate step; the IP destination still identifies the intended remote host.
Write the range before looking at answer choices. A /26 leaves six host bits, giving 64 total addresses in a conventional IPv4 LAN subnet and 62 ordinary host addresses after excluding network and broadcast. A /27 leaves five host bits, giving 32 total and 30 ordinary hosts. These rules describe the ordinary LAN examples on this page; do not generalize the subtraction rule blindly to special-purpose /31 point-to-point links. Use addressing and subnetting practice for more boundary decisions.
Short Classroom Warm-Ups
Ask for the next hop before opening the options
Use a brief subnet or local-delivery prompt to check the reasoning behind a student’s answer. The 300 Bell Ringers pack offers regular classroom starters; follow a response with a request to explain which address or boundary mattered.
Trace the frame, the packet, and the permission separately
Three questions can describe the same failed connection without having the same answer: Which VLAN carries the frame? Which route carries the packet? Which policy permits the connection? A correct route cannot compensate for a VLAN missing from a trunk. A correct VLAN cannot grant an application permission. A successful application login does not establish authorization to upload, modify records, or administer a device.
For switching evidence, distinguish the access port from the shared trunk. An access port places an ordinary untagged endpoint in its configured VLAN. A trunk can carry multiple VLANs, subject to its configuration. If two VLANs cross a link but a third does not, inspect the third VLAN’s allowed membership before assuming the cable has failed for every frame. Separately, a switch learns a MAC location from an arriving frame’s source address. Seeing a destination in that frame is not evidence that the destination sits behind the ingress port.
For ordinary routing, compare the destination with each installed usable prefix. A /24 match is more specific than a /16 match, which is more specific than a default route. A lower default-route metric does not automatically outrank a more specific match. Once you have selected the forward path, ask whether a reply can return. If the scenario gives evidence only at the sender, a missing reply may still involve the return route or return policy. Strengthen this step with routing and gateway practice.
For a stated first-match ACL, read from the top and stop at the first matching rule. A broad deny above a narrow permit can make the permit ineffective. Repair the ordering without opening unrelated access. Then verify both the desired service and the intended restriction. The phrase “allow the network” is too broad when the requirement authorizes one server and one destination port. Firewall and ACL practice develops this distinction with more policy cases.
Troubleshooting Scenarios • 120 Missions
Turn a selected answer into a troubleshooting decision
After working through VLAN, route, and policy questions, practice making decisions in additional broken-network scenarios. The Browser Troubleshooting Simulator provides missions for comparing observations and choosing a repair rather than only recognizing a term.
Choose a test that separates the remaining explanations
A good diagnostic check divides possible causes. If an address-based test to a specific TCP service succeeds while the expected name returns NXDOMAIN, inspect the requested name and DNS context. Do not declare the whole network down. Conversely, a successful lookup gives an address answer; it does not prove that the resulting server is reachable or that its application accepts the user. Follow the dependency rather than treating every success as an all-purpose health certificate.
Use the protocol and stage specified in the evidence. A completed TCP handshake establishes a connection for that flow. A later authorization error is evidence at a different stage. A repeated SYN without a response leaves several explanations, including an absent listener, filtering, path failure, or a missing return path. The trace alone does not necessarily identify which device dropped a packet. A timeout is a missing expected result; it is not a packet carrying a definitive diagnosis.
Performance questions need load and scope. A speed result on an idle connection does not establish the experience of many simultaneous users. Compare quiet and busy periods, local and remote destinations, and wired and wireless operation where the scenario allows it. High utilization plus rising queue delay supports a capacity hypothesis more strongly than the word “slow” alone. A weak wireless signal in one room points toward a different dependency from a saturated WAN upload link affecting many rooms.
For a traceroute, a silent intermediate hop can reflect how that device answers probes. If later hops respond and the destination service works, the silent hop is not proof of a complete forwarding break. That does not prove there is no intermittent loss. Repeated, comparable observations help distinguish probe-response policy from a service problem. Try CLI evidence practice to match the command to the question you are trying to answer.
Broader Revision • Exams and Artifact Labs
Extend review beyond this pilot diagnostic
Use this free set to locate a weak mechanism, then choose further work deliberately. The Complete Exam Prep Vault includes practice exams, questions, and artifact labs for broader course review. These independent materials do not establish the official 2027 pilot blueprint.
Many wrong answers mention a real tool but use it on the wrong dependency. Flushing DNS can be useful for stale name data; it cannot repair damaged Ethernet frames. Replacing a cable can fix a damaged physical segment; it cannot correct a certificate’s missing hostname. Adding capacity can help a measured bottleneck; it cannot authorize a denied application action. Before selecting an option, say what evidence would make that action relevant.
Look for answers that contradict an explicit requirement. A blanket permit may restore a service but violate the instruction to preserve isolation. A permanent warning bypass may let a browser proceed but does not repair server identity validation. A shared administrator account may make a dashboard accessible but violate the instruction to provide read-only access and accountability. The best choice must satisfy the operational goal and the security condition together.
Also distinguish “consistent with” from “proves.” A 169.254 address is consistent with missing DHCP configuration; it does not single out the server as the only possible cause. Two Internet links look redundant, but they can fail together if they share a conduit, power supply, or upstream dependency. A backup file is necessary for many recovery plans, but a tested restore provides different evidence from a successful export job. Strong reasoning keeps the claim no broader than the observation.
If a tool suggests a repair, compare it with the actual configuration and the authorized task. A confident recommendation is still a hypothesis. Keep credentials and sensitive school data out of unapproved tools, use limited changes, and check fresh behavior afterward. This is a practical collaboration habit: another student or tool can propose an explanation, while the team remains responsible for deciding what the evidence supports.
Feedback on Evidence and Reasoning
Check whether the explanation supports the answer
Have a student explain why an apparently relevant fix misses the actual dependency. The Artifact Analysis Grading Copilot provides structured feedback on written reasoning, helping teachers examine claims, supporting observations, and the limits of a conclusion.
Turn your practice result into a useful review plan
This set is untimed so you can study the reasoning. If you later choose to time a second attempt, record your own practice duration and treat it as a personal measure. It is not an official pilot time limit. Your teacher or AP coordinator is the appropriate source for current administration instructions.
Make a first-choice attempt. Before selecting, identify the symptom, scope, and decisive observation. Each question scores your first choice. Read the explanation even when you are correct.
Classify a miss. Did you miscalculate a prefix, overlook rule order, confuse services, ignore a stated constraint, or overstate a successful test? Record that reasoning error rather than just the answer letter.
Practice the missing mechanism. Use the linked topic test for the relevant weakness. Draw a frame’s next hop, work another subnet range, or annotate the first matching ACL rule.
Explain a fresh version. Change an address, requirement, or observation and predict whether the diagnosis changes. If you can justify that prediction, you have learned more than the original option wording.
Return to a mixed attempt. Compare your explanations and unit results. Review unresolved misses with your teacher; do not convert this percentage into a predicted AP score.
For example, after missing a VLAN question, write “I treated a valid lease as proof that the workstation was on the intended VLAN.” Then name a discriminating check: inspect the connected access port’s membership and compare the lease scope. That note gives the next study session a specific task. “Study networking more” does not.
Download the attempt log before restarting because responses stay only in this page’s current session. For hands-on evidence, use the beginner home lab; it provides controlled exercises without requiring a rack of equipment. The main study guide connects the mechanisms into a broader review sequence.
Complete 180-Day Teacher Curriculum
Plan instruction around the gaps this review reveals
A mixed diagnostic can reveal whether students need another lesson on addressing, policy order, or verification. The 180-Day Teacher Curriculum supplies a full teaching sequence with daily lessons and simulators for organizing those follow-up activities.
Use this page for a class discussion, not just a percentage
Assign one unit’s eight questions when you need a focused check, or use all 32 for mixed review. Ask students to name the observation that changes their decision. Two students can select the same correct letter while one understands the mechanism and the other recognizes a phrase. A short explanation, diagram, or alternative scenario makes that difference visible.
For pairs, have one student state the working explanation and another challenge it using an option that seems plausible. Resolve the disagreement by identifying what the scenario establishes and what it leaves unknown. On a security question, ask for both an allowed test and a denied test. On a recovery question, ask which condition would trigger rollback. This makes collaboration part of evidence review rather than a way to share answer letters.
Keep pilot exam instructions separate from classroom exercises. The public 2027 format is multiple choice, so these written explanations are study activities rather than a claim that students must submit free-response answers on that pilot. Confirm school-specific exam logistics through your coordinator and use your approved pilot course materials for required coverage.
Sources and update policy
Exam facts on this page were checked against College Board’s pilot page, 2027 schedule, pilot course framework, and national exam overview on . Recheck those links if administration guidance changes. Technical explanations use established networking behavior; the configurations and evidence in the questions are fictional teaching scenarios.
The protocol references behind the DHCP, ARP, DNS, and TCP explanations are RFC 2131, RFC 826, RFC 1035, and RFC 9293. If you find an ambiguous question or outdated fact, send a correction with the question number and the evidence you think changes its answer.