Unit 2 is easiest when you classify both the shared function and the affected scope
SOHO routers often combine wireless access, DHCP, NAT, firewalling, routing, switching, DNS forwarding, management, VPN, and port forwarding in one physical device. That creates a common exam trap: assuming that because one function works, the whole router is healthy—or because one function fails, the whole router is dead.
Shared connections introduce common capacity and service dependencies. The tests in AP Networking Practice Tests by Topic let students distinguish a power or uplink limit from an address-allocation or resolver failure before applying that diagnosis to this unit.
Who fails is often more useful than the error message
| Affected scope | Stronger first branch | Why |
|---|---|---|
| Everyone loses external IP access | WAN/upstream/router external state | Shared external dependency |
| Only new clients fail | DHCP allocation/scope | Existing leases can continue |
| Only Wi-Fi clients fail | SSID/AP/wireless VLAN path | Ethernet comparison narrows scope |
| Only guests violate policy | Guest segmentation/firewall | Trust-boundary failure |
| Only one endpoint fails | Endpoint-specific config/path | Shared services are less likely |
Swipe horizontally to see the scope matrix.
Know which kind of evidence belongs to each Unit 2 topic
2.1 Troubleshooting
Scope, shared dependencies, known-good comparisons, first failing boundary.
2.2 Documentation
Address plans, port maps, device roles, baselines, backups, change records.
2.3 Upgrading
Bottlenecks, capacity, compatibility, migration, rollback, verification.
2.4 Advanced Features
NAT, port forwarding, DHCP behavior, wireless features, VPN/remote access.
2.5 Security Needs
Assets, threats, exposure, least privilege, segmentation, management risk.
2.6 Securing
Firmware, Wi-Fi protection, guest/IoT isolation, logging, secure admin.
15 high-information-gain Unit 2 questions with reasoning
Each question is built around a real diagnostic distinction: scope, shared dependency, bottleneck, exposure, migration risk, or verification boundary. Read the explanation after answering and identify which evidence made the distractors weak.
All clients lose Internet but can still reach the router
Phones and laptops can open the SOHO router's local management page, but none can reach external IP addresses. What is the best next area to inspect?
A. Each client's keyboard driverB. The router's WAN/upstream connection and external routing stateC. One laptop's DNS cache onlyD. A printer's USB cable
Existing clients work; new clients fail to receive IPv4 configuration
Existing devices with valid leases still communicate. New devices associate to Wi-Fi but do not receive expected IPv4 settings. Which shared service deserves immediate attention?
A. DHCP scope/service and network placementB. Remote HTTPS certificateC. Printer tonerD. Traceroute hop 12
Documentation cannot identify the correct switch port
A switch replacement begins, but no ports are labeled and the network diagram is three years old. Which documentation would most directly reduce this problem next time?
A. Current device/interface map with port labels and uplinksB. Employee birthday listC. Browser bookmarksD. Public DNS root-zone copy
Users report slowness every day at 2 p.m.
Before buying faster Internet service, what evidence is most useful?
A. WAN utilization plus latency/loss during the complaint windowB. Router case colorC. One speed test at 3 a.m.D. Number of desktop icons
Guest network should not expose trusted devices
Which design best matches the requirement?
A. Guests get a separated network with required Internet access but restricted trusted-LAN accessB. Guests receive the router administrator passwordC. Wireless encryption is disabledD. Guests bridge directly to management interfaces
A port forward is proposed for an internal device
What should be established first?
A. Whether inbound access is truly required and how the destination service will be securedB. Whether every client can be made an administratorC. Whether DNS can be disabled globallyD. Whether duplicate IP addresses are acceptable
The router vendor publishes an approved security firmware update
Which action best fits small-network defense?
A. Use the supported update process and verify service/configuration afterwardB. Ignore updates while Wi-Fi still connectsC. Disable WPA protectionD. Publish the management password
2.4 GHz is crowded and Wi-Fi is slow while Ethernet is normal
Which action is most directly related?
A. Review channel use/interference and AP placement/settingsB. Replace the public DNS recordC. Give every client a public IPD. Remove the default route
NAT is not the same as firewall policy
Which statement is most accurate?
A. Address translation and security filtering are distinct functions even when one router performs bothB. NAT guarantees every inbound connection is safeC. NAT replaces endpoint updatesD. NAT makes DNS unnecessary
A functioning SOHO router will be replaced
Which preparation most improves recovery?
A. Export or record supported configuration and document WAN/LAN/WLAN dependenciesB. Delete documentationC. Randomize the subnet without recording itD. Disconnect every cable before identifying it
DHCP pool contains only ten addresses and all are leased
An eleventh device associates to Wi-Fi but receives no lease; all ten existing devices remain online. What is the strongest diagnosis?
A. DHCP pool exhaustionB. Universal WAN outageC. DNS poisoningD. Bad printer driver
ISP service is upgraded to 1 Gbps but router WAN port is 100 Mbps
What should you expect from wired tests behind that router?
A. Results constrained near the router interface limitB. Guaranteed 1 GbpsC. No impact from the router portD. DNS failure only
Ethernet works; Wi-Fi associates but receives no DHCP addresses
The router WAN is healthy. What boundary should be tested next?
A. SSID/VLAN mapping, wireless DHCP reachability, and scope stateB. Provider backbone routing firstC. Printer USB driversD. Public DNS root servers
Remote administration is Internet-facing and uses a reused password
What is the stronger security response?
A. Disable remote admin unless required; otherwise use supported secure access and unique strong authenticationB. Leave it because no compromise is visibleC. Disable local management insteadD. Expose guest devices to the same management page
A router replacement changes the default LAN subnet
What should be checked before accepting the new address plan?
A. Static devices, reservations, printers, cameras, and services that depend on the old subnetB. Only browser historyC. Whether the router LEDs are the same colorD. Nothing; subnet changes never affect applications
Read a DHCP pool before calling the symptom an Internet outage
The pool contains ten addresses and all ten are already leased. That precisely matches the observed split: existing clients may keep communicating, while a new client cannot obtain configuration. The immediate evidence supports scope exhaustion, not a universal WAN failure.
A stronger remediation sequence is to inspect stale leases, reservations, exclusions, lease duration, client turnover, and whether the intended address plan should be expanded. The smallest change should preserve the existing LAN design rather than randomly changing the subnet.
Separate WAN service speed from the slowest local component
The result is exactly what the 100 Mbps WAN interface predicts after protocol overhead. Buying a faster ISP tier cannot overcome a physical interface limit in the path. Upgrade analysis should inspect modem/ONT, router ports and processing, switching, cabling, Wi-Fi capabilities, and the client.
One multifunction router can contain several independent failures at once
Observation A points toward the shared WAN/upstream path. Observation B is a segmentation or firewall-policy weakness. Observation C is a capacity warning that may soon affect new clients. Replacing an access point would not directly solve any of those three evidence branches.
A useful small-network record describes dependencies, not just device names
| Record | Why it matters |
|---|---|
| ISP handoff + WAN mode | Recreates upstream connectivity |
| LAN subnet + DHCP range | Preserves client addressing plan |
| Reservations/static devices | Protects printers, cameras, servers |
| SSID/security + guest mapping | Preserves wireless and trust boundaries |
| Port forwards/VPN | Preserves intentional inbound/remote services |
| Switch/uplink map | Reduces physical tracing during replacement |
| Last verified backup date | Supports rollback/recovery |
Swipe horizontally to see the documentation table.
Do not store secrets casually in ordinary documentation. Record dependencies while protecting credentials and sensitive configuration appropriately.
Replace a router without silently breaking hidden dependencies
A migration is not complete because one laptop opens one website. That single test says very little about reservations, cameras, printers, inbound services, or guest isolation.
Coverage, interference, and capacity produce different symptoms
| Symptom pattern | Stronger branch | Next evidence |
|---|---|---|
| Weak signal at far edge | Coverage | Signal/placement test |
| Strong signal, crowded channel, poor speed | Interference/contention | Channel/RF comparison |
| Strong signal, clean channel, many active clients | Capacity | AP load/client counts |
| Wired good, wireless bad | Local wireless path | SSID/AP/channel/VLAN |
Swipe horizontally to see the wireless differential table.
Port forwarding, remote administration, NAT, and firewalling are related but not interchangeable
A port forward creates an inbound path to an internal service. NAT translates addressing and ports. Firewall policy decides whether traffic is permitted. Remote administration exposes the management plane. These functions may all live on one router but solve different requirements.
Buy capacity only after identifying the demonstrated bottleneck
A faster ISP plan does not fix an exhausted DHCP pool, a 100 Mbps router port, poor AP placement, a crowded 2.4 GHz channel, or an overloaded client. A good upgrade recommendation names the constrained component and the measurement that revealed it.
Reject answers that operate outside the demonstrated failure boundary
If all clients can reach the router but none can reach an external IP, printer drivers and one laptop's DNS cache do not match the scope. If only new clients fail, a universal WAN outage does not match the working existing clients. If Ethernet is normal and only Wi-Fi is slow, buying more WAN bandwidth is weak without evidence of upstream saturation.
Unit 2 questions often become easier when you ask one question: Does this answer explain both the working devices and the failing devices at the same time?
Know exactly what a successful SOHO test proves
| Observation | Supports | Does not prove |
|---|---|---|
| Router local page opens | Client reaches router management locally | WAN works |
| Existing client has Internet | Its current path works | DHCP can lease a new client |
| Wi-Fi association succeeds | Layer 2 association/authentication succeeded | DHCP/VLAN/Internet works |
| Port forward exists | Mapping is configured | Service is secure or reachable |
| Firmware update completed | New version installed | Every service remained functional |
Swipe horizontally to see the evidence-boundary table.
Rework every missed question using function plus affected scope
Classify each miss as WAN, LAN addressing/DHCP, wireless, documentation, advanced feature, capacity/upgrade, or security. Then classify the affected population: one client, new clients, wireless clients, guests, or everyone.
This two-axis method is powerful because one physical SOHO router can host several logically independent services. A DHCP failure can coexist with healthy WAN routing. A guest-policy failure can coexist with healthy wireless association. A firmware issue can coexist with correct DHCP.
Choose three different next steps for three different symptoms
Symptom 1: inspect WAN/upstream routing state. Symptom 2: inspect guest segmentation and firewall policy. Symptom 3: inspect DHCP scope/service and network mapping. The same physical router may be involved in all three, but the evidence points to three different logical functions.
Build the answer from scope, shared function, evidence, and verification
Affected scope: who fails and who still works?
Shared function: WAN, DHCP, wireless, NAT/firewall, documentation, capacity, or management security?
Known-good evidence: preserve what still works.
Next test: choose the smallest test that separates the leading causes.
Boundary: state what the current evidence does not prove.
Verification: retest the original requirement after the change.
24 AP Networking Unit 2 digital flashcards
Practice SOHO troubleshooting scope, DHCP, wireless evidence, documentation, upgrades, bottlenecks, NAT/firewall distinctions, guest security, port forwarding, firmware, migration, and verification.