Find the last proven checkpoint before choosing the next action
Unit 4 combines network failures, protocol models, command-line evidence, routing, monitoring, defense, reliability, redundancy, and growth. The strongest answers do not restart from the beginning after evidence has already proven part of the path. They identify the last successful checkpoint, locate the first unresolved dependency, and select the artifact or corrective action that sits closest to that boundary.
Global connection questions need both local and remote evidence. Use the routing and service-protocol tests in AP Networking Practice Tests by Topic to examine return paths, resolver views, and transport-specific outcomes, then apply the bounded conclusions to this unit.
Unit 4 tests whether you can connect troubleshooting, path selection, visibility, and resilience
4.1 Failures
Failure domains, selective vs. shared outages, and end-to-end troubleshooting.
4.2 Models
Protocol-layer reasoning and why one successful layer does not prove the next.
4.3 CLI Tools
Use command output as evidence rather than as a memorization list.
4.4 Routing
Longest-prefix match, route preference, path changes, and return routes.
4.5 Monitoring & Defense
Baselines, logs, correlated artifacts, alerts, and security controls.
4.6 Reliability & Growth
Redundancy, failover, common failure domains, tested resilience, and capacity planning.
Route selection is mechanical before it becomes diagnostic
Find all matching prefixes and choose the longest match. Only after the prefix decision is known should you compare route preference or metrics among competing candidates for the same relevant prefix.
Do not restart at Layer 1 after later checkpoints succeed
The first three observations establish useful local and routed IP behavior. The failed DNS query identifies name resolution as the next dependency. Strong follow-up checks include configured resolver accuracy, resolver reachability on DNS transport, resolver service state, and filtering.
Correlated measurements are stronger than one isolated number
The evidence localizes degradation toward the wireless path rather than raw WAN bandwidth. The wired endpoints act as a control that helps eliminate a shared upstream explanation.
A backup link is not validated until the application works through it
A failover test may show the backup interface up and the route installed while applications still fail because NAT, firewall, DNS, or other service dependencies exist only for the primary path.
Redundant devices can still share one hidden single point of failure
Two firewalls connected to one power source, two WAN routers connected to one provider handoff, or two core switches in one unprotected physical location are not fully independent. Reliability analysis should identify shared power, carrier, cabling, cooling, physical-location, and policy dependencies.
| Redundant component | Shared dependency | Residual risk |
|---|---|---|
| Two firewalls | One UPS | Power failure affects both |
| Two WAN links | One carrier conduit | Single cut affects both |
| Two routers | One NAT/firewall policy object | Config error affects both paths |
Swipe horizontally to see the failure-domain table.
Growth problems often degrade service before anything goes down
A WAN that climbs from 45% to 58% to 72% to 88% peak utilization across quarters is not experiencing a link-down event. If latency and output drops begin appearing at the newest peak, the evidence supports growing capacity pressure.
That calls for traffic-source analysis, scheduling, QoS where appropriate, or capacity changes—not the same response as an interface that suddenly goes down at 20% utilization.
Applied Unit 4 questions with full reasoning
Answer each question before reading the explanation. For each miss, identify which checkpoint you ignored or which artifact you over-interpreted.
Remote IP works; hostname fails
A client reaches its gateway and 203.0.113.20 by IP. Its query to the configured DNS resolver times out. What is the strongest next focus?
A. DNS resolver/pathB. Replace the access cable immediatelyC. Remove the default routeD. Reconfigure every switch VLANLongest-prefix match
A router has 0.0.0.0/0 via A, 10.0.0.0/8 via B, and 10.40.0.0/16 via C. Which next hop is selected for 10.40.5.9?
A. AB. BC. CD. All are ignoredBroken specific route
General Internet access works, but 172.20.40.0/24 fails. A specific /24 route points to an unreachable next hop while the default is healthy. Why does the destination still fail?
A. The specific /24 wins over the defaultB. Default always overrides specificsC. DNS controls route choiceD. Switches select Internet routesTraceroute interpretation
A traceroute shows no response at hop 5, but hops 6–10 and the destination respond. What is the best conclusion?
A. Hop 5 dropped all transit trafficB. Hop 5 may ignore probes while still forwardingC. Destination is unreachableD. DNS is brokenMonitoring baseline
An uplink normally peaks near 25%. For five days it reaches 95% while latency and output drops also rise. What does this support?
A. Recurring capacity/congestion conditionB. Cable certainly unpluggedC. Utilization cannot affect latencyD. Ignore because it is not 100%ICMP success vs TCP failure
A server answers ping but TCP/443 fails. What does ping prove?
A. The tested ICMP/IP path workedB. HTTPS must be healthyC. Certificate is validD. Firewall allows every protocolReturn path
A server log proves requests from 10.60.0.25 arrive, but the client receives no response. Which area becomes especially important?
A. Server-side return routing/filteringB. Client cable necessarily disconnectedC. DNS must have failedD. Request never reached serverSecurity correlation
A firewall records repeated denied management attempts from one client, and auth logs show failed admin logins from the same source at matching times. Why is this stronger than one isolated event?
A. Multiple artifacts correlate source, action, and timeB. Any deny proves compromiseC. Logs are unrelated to defenseD. Management cannot be filteredShared power
Two core switches and two firewalls all depend on one UPS. What reliability issue remains?
A. The UPS is a common single point of failureB. Two switches guarantee power redundancyC. DNS removes the dependencyD. VLANs generate electricityGrowth constraint
A guest WLAN has good RF and ample WAN bandwidth, but the DHCP pool has zero free leases at peak. New clients fail while existing clients work. Which upgrade targets the observed constraint?
A. Review/expand address and DHCP designB. Buy faster ISP onlyC. Add random APs onlyD. Remove all routingBackup link incomplete
A backup interface comes up and routes appear during testing, but external applications fail because NAT/firewall policy exists only on the primary interface. What is the best conclusion?
A. The alternate service path is incompleteB. The backup is fully validatedC. DNS always causes failover issuesD. The cable is necessarily badDNS resolves correctly and the server responds to ping. TCP/443 returns an immediate refusal. What should you inspect next?
A. Service listener and host/application configurationB. Replace DNS serverC. Delete default routeD. Rebuild VLANsWireless jitter
At 13:00 voice quality degrades. WAN utilization is normal, loss is low, but wireless jitter and channel utilization spike. Wired voice endpoints remain stable. What is strongest?
A. Wireless contention/interferenceB. ISP capacityC. DNS exhaustionD. Broken default routeApplication monitoring
A primary WAN fails, routing moves to backup, and users lose a critical app for 18 seconds before recovery. What should the monitoring system measure?
A. Application availability through failoverB. Only physical link LEDsC. Only DNS TTLD. Only switch temperatureSelective prefix failure
Internet and several partner networks work, but one partner prefix fails. A stale more-specific route points to an obsolete next hop. What is the best action?
A. Correct/remove the stale route and verify the winning pathB. Replace every switchC. Change DNS firstD. Disable monitoringCapacity trend
WAN peaks rise each quarter from 45% to 58% to 72% to 88%, and latency/drop symptoms appear only in the newest peak. What does this represent?
A. Gradual capacity pressureB. Hard link-down eventC. DNS poisoningD. DHCP failureServer request arrives, no listener
DNS, routing, and firewall all check out. Packet capture shows SYN reaches the server, but no TCP/443 listener exists. What is the first demonstrated failure?
A. Application listenerB. Default gatewayC. DNSD. Access VLANMonitoring artifact choice
A single utilization spike appears once with no user complaints, no drops, and no latency increase. What is the best conclusion?
A. One sample alone is insufficient for a congestion diagnosisB. Link must be upgraded immediatelyC. Firewall is brokenD. ISP failedMetric preference
Two equal-prefix routes exist. One has a lower administrative/metric preference according to the platform. Which should be chosen?
A. The more preferred route according to the platform's route-selection rulesB. Both simultaneously regardless of platformC. The default routeD. The route with the longest hostnameUnit 4 capstone
A client resolves service.example, the edge selects the expected route, firewall logs allow TCP/443, the server sees the SYN, and `ss` shows no listener on 443. Which answer best follows the evidence?
A. Repair the service listener and retest HTTPSB. Change the client's gatewayC. Replace DNSD. Remove the WAN routeThe weakest answers usually contradict evidence already established
If a remote IP responds, a completely dead local Ethernet link is inconsistent with the evidence. If DNS returns the expected address, blaming DNS for a later TCP refusal needs additional support. If a server log proves request arrival, the forward path worked far enough to reach the server.
Routing distractors often misuse the default route. Monitoring distractors treat one isolated metric as a diagnosis without baseline or correlation. Reliability distractors mistake “configured redundancy” for “tested end-to-end resilience.”
Follow one failure through DNS, routing, firewall, and server
The evidence progressively proves DNS, route selection, firewall passage, and request arrival. The missing listener is the first demonstrated application-side dependency. Changing the client's gateway would move backward in the evidence chain.
After restoring the listener, repeat the original HTTPS workflow and confirm service monitoring detects the corrected state.
Use monitoring history to measure real service impact
The important user-facing fact is not “the backup route appeared.” It is that the application was unavailable for 18 seconds. Compare that interruption with the reliability requirement. If it is acceptable, failover may be operating as designed; if not, convergence or alternate-path dependencies need improvement.
A strong Unit 4 explanation should name the checkpoint, artifact, boundary, and verification
Checkpoint: last thing proven to work.
Dependency: first unresolved mechanism.
Artifact: command, log, route, counter, or service test that best isolates it.
Boundary: what the artifact does not prove.
Verification: repeat the original workflow and a known-good control.
24 AP Networking Unit 4 digital flashcards
Practice global failures, protocol-layer reasoning, CLI evidence, longest-prefix routing, monitoring, defense, failover, redundancy, growth, and service-level verification.