DEV Community: Falade Timilehin

CompTIA Network+: Solving Networking Issues

Falade Timilehin — Wed, 21 Oct 2026 09:21:48 +0000

Study Notes for the N10-009 Certification Exam

1. Introduction to Network Troubleshooting

Network troubleshooting involves identifying, diagnosing and resolving problems affecting network connectivity, configuration, security and performance.

Network administrators use software tools, command-line utilities, hardware testing equipment and commands built into routers and switches to investigate faults.

This course covers:

Protocol analyser tools
Windows command-line utilities
Common Linux commands
Physical network testing tools
MAC address tables
Routing tables
Interface information
Startup and running configurations
Address Resolution Protocol (ARP)
Virtual LANs (VLANs)
Power over Ethernet (PoE)

The key skill is knowing which tool or command to use, what information it provides and how that information helps isolate a problem.

2. Using Protocol Analyser Tools

What is a protocol analyser?

A protocol analyser captures and examines network packets or frames travelling over wired or wireless connections.

It helps administrators understand how devices communicate and identify problems such as failed requests, unexpected traffic and communication errors.

Common protocol analyser tools

Wireshark

Wireshark is a widely used network protocol analyser. It captures and displays network packets, allowing administrators to inspect communication between devices.

Microsoft Network Monitor

Microsoft Network Monitor is another packet-capture and analysis tool referenced in the course.

Packet capture

A packet capture records network traffic for examination. Captured information may include:

Source and destination addresses
Protocol information
Packet and frame details
Communication requests and responses
Payload data, depending on the protocol and encryption

Encrypted protocols protect their payloads, so captured traffic does not necessarily reveal the underlying application data in readable form. Some metadata may still be visible.

Port mirroring

A switch normally forwards traffic according to its switching rules. A monitoring computer connected to an ordinary switch port may not see traffic between other devices.

Port mirroring configures a switch to copy selected traffic to a monitoring port, allowing a protocol analyser to inspect it.

Using filters

Packet captures can contain large amounts of information. Filters help isolate the traffic relevant to the investigation.

For example, a DNS filter can help an administrator examine DNS queries and responses when investigating name-resolution problems.

When should you use a protocol analyser?

Use a protocol analyser when you need to:

Investigate unexpected network communication.
Examine DNS requests and responses.
Inspect retransmissions or communication failures.
Determine whether packets reach the expected destination.
Analyse protocol behaviour in greater detail than basic connectivity tools allow.

Exam tip: Wireshark is appropriate when you need detailed packet-level evidence rather than just a basic connectivity result.

3. Using the Windows Command Line

Windows includes several commands that help diagnose IP addressing, connectivity, routing, name resolution and active network connections.

3.1 `ipconfig`

The ipconfig command displays network adapter configuration information.

Typical information includes:

IP address
Subnet mask
Default gateway

Example:

ipconfig

For more detailed configuration information, use:

ipconfig /all

This is useful when checking whether a computer has received the expected network configuration.

3.2 `ipconfig /release` and `ipconfig /renew`

These commands help refresh a DHCP-assigned IPv4 address.

Release the current DHCP lease:

ipconfig /release

Request a new DHCP configuration:

ipconfig /renew

Use these commands when investigating a suspected DHCP addressing problem. Releasing an address temporarily removes the relevant IPv4 configuration, so do this with care on a computer that depends on its current connection.

3.3 `ipconfig /flushdns`

This command clears the local Windows DNS resolver cache.

ipconfig /flushdns

It can help when a computer appears to be using outdated cached DNS information.

It does not repair an unavailable DNS server or incorrect DNS records at their source.

3.4 `ping`

Ping tests whether a destination responds to ICMP Echo Requests and reports round-trip timing when replies are received.

Example:

ping 192.168.1.1

A useful troubleshooting sequence is to test:

The local TCP/IP stack, such as the loopback address 127.0.0.1.
The computer's own configured IP address.
The default gateway.
A remote IP address.
A hostname, to include name resolution in the test.

The results help narrow down where a connectivity problem may exist. However, some devices block ICMP, so a failed ping does not always prove that a device or service is unavailable.

3.5 `tracert`

The Windows tracert command traces the route towards a destination.

tracert example.com

It displays the network hops encountered along the route and can help investigate routing problems or delays.

A hop that does not respond may be filtering or deprioritising traceroute probes rather than failing to forward normal traffic.

3.6 `arp -a`

This command displays the local ARP cache, which contains learned mappings between IPv4 addresses and MAC addresses.

arp -a

It is useful when investigating local-network address resolution.

3.7 `netstat -ano`

This command displays network connections and listening endpoints, together with numeric addresses and process identifiers.

netstat -ano

The options mean:

-a: Displays active connections and listening ports.
-n: Displays addresses and port numbers numerically.
-o: Includes the owning process ID (PID).

The PID can help you identify which process is associated with a connection by checking it against Windows process information.

Windows command revision table

Command	Main purpose
`ipconfig`	Display IP configuration
`ipconfig /all`	Display detailed adapter configuration
`ipconfig /release`	Release a DHCP-assigned IPv4 address
`ipconfig /renew`	Request DHCP configuration again
`ipconfig /flushdns`	Clear the local DNS resolver cache
`ping`	Test IP reachability and round-trip timing
`tracert`	Examine the route towards a destination
`arp -a`	Display cached IP-to-MAC mappings
`netstat -ano`	Display connections, listening endpoints and PIDs

Exam tip: Be prepared to match each command to the problem it investigates.

4. Common Linux Commands

Linux systems provide similar troubleshooting capabilities, although the commands and their options may differ from Windows.

4.1 `ifconfig`

The course identifies ifconfig as a Linux command used to display and configure network adapter settings.

ifconfig

It can show information such as interface addresses and status.

Unlike Windows ipconfig, which is primarily used to display IP configuration, Linux ifconfig has historically supported both display and configuration operations.

Note that modern Linux distributions commonly use the ip command, and ifconfig may not be installed by default.

4.2 `tcpdump`

tcpdump captures network packets for analysis.

Example:

sudo tcpdump -i eth0

The -i option specifies the network interface to capture on. The interface name will vary by system.

To save captured traffic in a PCAP file:

sudo tcpdump -i eth0 -w capture.pcap

PCAP files can be opened in Wireshark for more detailed analysis.

Use packet captures responsibly because they may contain sensitive information.

4.3 `iptables`

iptables manages firewall rules on Linux systems using the relevant packet-filtering framework.

It can be used to allow or block traffic according to configured rules.

Example:

sudo iptables -L

This lists firewall rules.

Important: Rule order and the chain in which a rule appears can affect how traffic is handled. Incorrect firewall changes can disrupt legitimate network communication.

4.4 `nmap`

nmap is a network discovery and port-scanning tool.

Example:

nmap 192.168.1.10

It can help identify reachable hosts and exposed ports and services, depending on the scan and target configuration.

Administrators may use it to investigate unexpected services or monitor authorised network assets.

Only scan systems and networks you are authorised to assess.

4.5 `dig`

dig queries DNS servers and displays DNS responses.

Example:

dig example.com

It can help investigate hostname resolution and inspect DNS record information.

The course compares dig with Windows nslookup, as both can be used to query DNS.

Linux command revision table

Command	Main purpose
`ifconfig`	Display or configure network interfaces on supported systems
`tcpdump`	Capture network packets
`iptables`	Inspect or manage Linux firewall rules
`nmap`	Discover hosts and examine ports and services
`dig`	Query DNS and inspect responses

5. Common Network Hardware Tools

Software commands cannot diagnose every network fault. Physical testing tools help investigate cables, wiring, electrical continuity and signal quality.

5.1 Cable tester

A cable tester checks the wiring and continuity of network cables.

It can identify problems such as:

Open connections
Incorrect pin wiring
Reversed or miswired pairs
Continuity failures

Use a cable tester when a suspected Ethernet cable fault causes an unreliable or failed connection.

5.2 Multimeter

A multimeter measures electrical values such as voltage and resistance.

It can help check power supplies and electrical continuity, depending on the measurement being performed.

Examples include:

Measuring AC or DC voltage.
Checking resistance.
Testing continuity on suitable circuits.

Use the correct measurement mode and follow electrical safety procedures.

5.3 Toner and probe

A toner and probe kit helps identify and trace cables.

The toner sends a signal through a cable, and the probe detects that signal so the cable can be located among other cables.

This is especially useful when tracing cables through racks, patch panels or cable bundles.

5.4 Reflectometer

A reflectometer examines cable characteristics by analysing signals travelling through the medium and their reflections.

Depending on the type of reflectometer, it can help locate cable faults or assess signal behaviour.

Examples include:

Time-domain reflectometer (TDR): Helps locate faults and discontinuities in metallic cables.
Optical time-domain reflectometer (OTDR): Used with fibre-optic links to investigate signal loss and locate events along the fibre.

Hardware tool comparison

Tool	Main use
Cable tester	Check cable wiring and continuity
Multimeter	Measure voltage, resistance and suitable continuity
Toner and probe	Trace and identify cables
TDR	Locate faults in metallic cables
OTDR	Investigate fibre-optic links and signal loss

Exam tip: If the problem is physical rather than logical, choose a tool designed to test the physical medium.

6. Using the MAC Address Table

What is a MAC address table?

A switch maintains a MAC address table, sometimes called a forwarding database, to record learned MAC addresses and the ports associated with them.

When a device sends a frame, the switch can learn the source MAC address and associate it with the incoming port and VLAN.

The table helps the switch forward Ethernet frames towards the correct destination port.

The `show mac-address-table` command

On supported Cisco-style network devices, the command is used to display learned MAC address entries.

show mac address-table

The precise syntax varies by platform and software version; the course refers to show mac-address-table.

The table can help you investigate:

Which switch port has learned a device's MAC address.
Whether a device is appearing on an expected port.
Whether MAC entries have been learned in the relevant VLAN.
Whether entries are disappearing or moving unexpectedly.

MAC address ageing

Learned dynamic MAC entries can age out when the switch has not received frames from the relevant source for the configured ageing period.

An entry disappearing does not necessarily mean the device has failed; it may simply have been inactive.

MAC addresses and routers

MAC addresses are used for communication on a local Layer 2 network segment.

When a router forwards an IP packet to another network, it removes the incoming Layer 2 framing and creates new Layer 2 framing for the outgoing link.

Therefore, the destination MAC address on the next link is normally the next-hop device's MAC address, not the original remote host's MAC address.

Key distinction: IP addresses identify endpoints at the network layer; MAC addresses are used for local-link delivery.

7. Displaying the Routing Table

What is a routing table?

A routing table contains information that a router uses to decide where to forward IP packets.

Routes may be learned from:

Directly connected networks
Static route configuration
Dynamic routing protocols

The `show ip route` command

On Cisco-style routers, use:

show ip route

This displays the IPv4 routing table.

Directly connected networks normally appear when the relevant interfaces are configured and operational.

For a destination network that is not directly connected, the router needs a suitable route, such as a static route or one learned through a routing protocol.

Static routing

A static route is manually configured by an administrator.

It can be suitable for simple or predictable network paths, but the administrator must maintain the routes when the topology changes.

Dynamic routing and RIP

The course demonstrates the Routing Information Protocol (RIP) as an example of a dynamic routing protocol.

Routers running a compatible and correctly configured routing protocol can exchange routing information and learn networks beyond their directly connected interfaces.

For RIP to work, the participating routers need suitable interface addressing, protocol configuration and network statements. Merely enabling RIP without correct configuration does not guarantee connectivity.

Troubleshooting routing problems

Display the routing table.
Confirm that the destination network has a suitable route.
Check the relevant interfaces and their status.
Verify static route or dynamic routing configuration.
Test connectivity to the next hop and destination.

Exam tip: If two devices on different IP networks cannot communicate, check routing information as well as interface status and addressing.

8. Displaying Interface Information

The `show interfaces` command

The command displays information about router or switch interfaces.

show interfaces

It helps administrators inspect interface status, traffic levels and errors.

Important interface information

Physical status: Whether the interface's physical connection is operational.
Line protocol status: Whether the interface's data-link protocol is operational.
Input and output packet counts: Show traffic handled by the interface.
Errors: May indicate physical faults, transmission problems or other interface issues.
Collisions: Can provide evidence of problems on relevant Ethernet links, especially legacy or incorrectly configured shared/half-duplex environments.
Interface resets: May indicate instability or repeated resets.
MTU: The maximum transmission unit used by the interface.
Bandwidth: A configured or reported interface bandwidth value, depending on platform; it is not necessarily a live measurement of available throughput.
Load and reliability: Platform-reported indicators that help assess interface conditions.

Physical and protocol status

Interface status often reports two conditions: the physical interface state and the line protocol state.

A physical connection may be present while the line protocol is down. This suggests that the administrator should investigate the data-link layer, configuration or the condition of the link beyond basic physical connectivity.

Using traffic to test an interface

Generating test traffic, such as ping, can help determine whether input and output packet counters change.

Compare counters before and after testing, and examine whether errors increase.

Exam tip: show interfaces is valuable for checking link status, errors, traffic counters and other interface health indicators.

9. Displaying Startup Configuration Information

Routers and switches commonly maintain an active configuration and a saved configuration.

Running configuration

The running configuration represents the configuration currently active on the device. On Cisco-style devices, it is held in RAM.

Display it with:

show running-config

A shorter form is:

show run

Startup configuration

The startup configuration is the saved configuration used when the device boots.

Display it with:

show startup-config

A shorter form is:

show start

Saving configuration changes

Changes made to the running configuration may be lost after a reboot if they have not been saved.

On Cisco-style devices, save the running configuration to the startup configuration using:

copy running-config startup-config

The abbreviated form is:

copy run start

Why this matters

Imagine an administrator fixes a VLAN configuration and confirms that devices can communicate. If the change is not saved, the device may return to its previous configuration after a reboot.

Configuration comparison

Configuration	Purpose	Stored in
Running configuration	Configuration currently active	RAM
Startup configuration	Saved configuration loaded at startup	Non-volatile memory

Exam tip: If a configuration change works but disappears after a reboot, check whether it was saved to the startup configuration.

10. Using Common ARP Commands

What is ARP?

The Address Resolution Protocol (ARP) maps an IPv4 address to a MAC address on a local network.

When a host needs to send an IPv4 packet to another device on its local subnet, it may need to discover the destination device's MAC address.

If the destination is on another network, the host generally resolves the MAC address of its default gateway instead.

ARP tables

An ARP table stores learned IP-to-MAC address mappings.

These entries are populated as devices communicate and can expire according to the system's cache rules.

Windows command

arp -a

This displays the local computer's ARP cache.

Cisco-style router command

show arp

This displays ARP entries on supported router platforms.

Troubleshooting ARP

ARP information can help when investigating:

Local IPv4 communication problems.
Unexpected IP-to-MAC mappings.
Whether an entry has been learned.
Possible address-resolution problems.

An absent entry may simply mean that the device has not communicated recently or that the entry has expired.

ARP versus MAC address tables

ARP table	MAC address table
Maps IPv4 addresses to MAC addresses	Maps learned MAC addresses to switch ports and VLANs
Used for IPv4 address resolution	Used for Ethernet frame forwarding
Commonly inspected with `arp -a` or `show arp`	Commonly inspected with a MAC address-table command

Exam tip: ARP answers “Which MAC address corresponds to this local IPv4 address?” A switch MAC address table answers “On which port and VLAN was this MAC address learned?”

11. Displaying VLAN Configurations

What is a VLAN?

A Virtual LAN (VLAN) logically separates devices into different Layer 2 broadcast domains, even when they use the same physical switch infrastructure.

VLANs are commonly used to separate departments, voice traffic, guest access or other groups of devices.

Devices in different VLANs generally need Layer 3 routing to communicate with one another.

The `show vlan` command

On supported Cisco-style switches:

show vlan brief

This displays VLAN information, often including VLAN IDs, names, status and associated access ports.

The course refers to the show vlan command; the exact command and output depend on the device.

Default VLAN configuration

In the course's example, a default switch has its ports assigned to VLAN 1. This means that, unless configuration changes have been made, those ports may share the same VLAN.

VLANs and IP subnets

VLANs and IP subnets are different concepts, but networks commonly assign a distinct IP subnet to each VLAN.

Correct VLAN assignment and IP addressing are important for local communication and routing.

Trunk links

A trunk link carries traffic for multiple VLANs over a single physical connection, using VLAN tagging where supported.

This allows a switch to connect to another switch or a router while transporting traffic for multiple VLANs.

Router subinterfaces

In a router-on-a-stick configuration, a router uses logical subinterfaces on a physical interface to handle traffic for different VLANs.

Each subinterface is configured for the relevant VLAN and IP network. The router can then route traffic between VLANs, subject to routing and access-control configuration.

VLAN troubleshooting checklist

Check which VLAN the relevant switch port belongs to.
Verify that the expected VLAN exists and is active.
Check whether the connected device has suitable IP addressing.
Inspect trunk configuration when multiple VLANs must cross a link.
Verify router subinterfaces or other Layer 3 routing configuration.
Review access control lists if routing exists but traffic is blocked.

Exam tip: If devices in different VLANs cannot communicate, verify both VLAN configuration and inter-VLAN routing.

12. Displaying Power Information for Interfaces

What is Power over Ethernet?

Power over Ethernet (PoE) allows supported network equipment to provide electrical power to compatible devices over Ethernet cabling.

Common PoE-powered devices include:

IP phones
Wireless access points
Some security cameras

PoE can reduce the need for separate power supplies at the connected device.

The `show power inline` command

On supported Cisco-style switches, use:

show power inline

This displays information about PoE capability and consumption.

Depending on the platform, the output may include:

Total available PoE power
Power allocated to connected devices
Per-port power usage
Remaining power budget
Port-level power limits or status

Why PoE information matters

A switch may have working data connectivity but fail to power a connected device if its PoE capability, port settings or available power budget is insufficient.

For example, if an IP phone does not power on, the administrator can inspect the port's PoE status and available power before replacing the device.

Troubleshooting PoE issues

Confirm that the switch and port support PoE.
Check the connected device's power requirements.
Inspect the port's power status.
Review the switch's total PoE budget and remaining capacity.
Check cabling and port condition.
Confirm whether the device receives power after any corrective action.

Exam tip: Use show power inline to investigate power delivery from a compatible switch to PoE-powered devices.

13. Practical Troubleshooting Scenarios

Scenario 1: A computer cannot connect to the network

Symptoms: A user reports that their computer has no network connectivity.

Suggested approach:

Run ipconfig to inspect the IP address, subnet mask and default gateway.
If DHCP addressing appears incorrect, investigate DHCP and consider renewing the lease.
Ping the loopback address and then the computer's own address.
Ping the default gateway.
Use tracert to investigate the route towards a remote destination if appropriate.
Review ARP information if local address resolution is suspected.

The results help narrow down whether the problem involves local configuration, the gateway, address resolution or the route beyond the local network.

Scenario 2: A hostname does not resolve

Symptoms: A user can reach some destinations by IP address but cannot access a service using its hostname.

Suggested approach:

Test IP connectivity with ping, where ICMP is permitted.
Use dig or nslookup to query DNS.
Inspect the response and determine whether the expected record is returned.
On Windows, consider ipconfig /flushdns if stale local cache data is suspected.
If necessary, use Wireshark to inspect DNS requests and responses.

Flushing the local cache will not fix an incorrect DNS record or an unavailable DNS server.

Scenario 3: A device cannot communicate with devices in another VLAN

Symptoms: Devices communicate within their own VLAN but cannot reach a different VLAN.

Suggested approach:

Use show vlan to inspect port assignments.
Confirm the relevant VLANs exist and are active.
Check the trunk link if traffic must cross between switches or reach a router.
Verify router subinterfaces or other Layer 3 interfaces.
Inspect the routing configuration and any applicable access control lists.

The problem may be caused by VLAN membership, trunk configuration, missing routing or traffic filtering.

Scenario 4: An IP phone does not power on

Symptoms: An IP phone connected to a switch does not start.

Suggested approach:

Check the Ethernet cable and switch port.
Confirm that the port and switch support PoE.
Run show power inline.
Inspect the available power budget and per-port power information.
Verify that the phone is compatible and that its power requirements can be met.

This avoids assuming that a failed phone is necessarily faulty when the problem may be power delivery.

Scenario 5: A router loses configuration after restarting

Symptoms: A network change works initially but disappears after a reboot.

Suggested approach:

Run show running-config to inspect the active configuration.
Run show startup-config to inspect the saved configuration.
Compare the relevant settings.
If the intended configuration is active and validated, save it using copy running-config startup-config.

This ensures the intended configuration is saved for the next startup.

14. Essential Command Revision Sheet

Command	Platform or context	Purpose
`ipconfig /all`	Windows	Detailed IP configuration
`ipconfig /release`	Windows	Release a DHCP-assigned IPv4 address
`ipconfig /renew`	Windows	Renew DHCP configuration
`ipconfig /flushdns`	Windows	Clear the local DNS cache
`ping`	Windows/Linux	Test reachability and round-trip timing
`tracert`	Windows	Trace the route towards a destination
`arp -a`	Windows	Display ARP cache entries
`netstat -ano`	Windows	Display connections, listening endpoints and PIDs
`ifconfig`	Linux, where available	Display or configure interface settings
`tcpdump`	Linux/Unix-like systems	Capture packets
`iptables -L`	Linux, where applicable	List firewall rules
`nmap`	Linux/other supported platforms	Discover hosts and examine ports
`dig`	Linux/Unix-like systems	Query DNS
`show mac-address-table`	Supported switches	Inspect learned MAC addresses and ports
`show ip route`	Cisco-style routers	Display the IPv4 routing table
`show interfaces`	Cisco-style routers/switches	Inspect interface state and counters
`show running-config`	Cisco-style devices	Display the active configuration
`show startup-config`	Cisco-style devices	Display the saved startup configuration
`show arp`	Supported routers	Display ARP entries
`show vlan brief`	Supported switches	Inspect VLANs and access-port membership
`show power inline`	Supported PoE switches	Inspect PoE power information

Note: Commands and syntax can vary by operating system, device vendor and software version. Use the syntax supported by the equipment being examined.

15. Final Exam Revision Checklist

Before taking the CompTIA Network+ N10-009 exam, ensure you can:

[ ] Explain why and when to use Wireshark and packet capture.
[ ] Explain port mirroring and the role of packet filters.
[ ] Match Windows commands to IP, DNS, connectivity and connection problems.
[ ] Explain the purposes of tcpdump, iptables, nmap and dig.
[ ] Distinguish cable testers, multimeters, toner probes and reflectometers.
[ ] Explain what a switch MAC address table records.
[ ] Interpret the purpose of a routing table.
[ ] Identify useful interface counters and status information.
[ ] Distinguish running configuration from startup configuration.
[ ] Explain how ARP maps IPv4 addresses to MAC addresses.
[ ] Explain VLANs, trunk links and inter-VLAN routing.
[ ] Explain how to investigate PoE power problems.
[ ] Select suitable commands for realistic troubleshooting scenarios.

Conclusion

Effective network troubleshooting requires more than memorising commands. It requires selecting the right tool, understanding the information returned and using the evidence to narrow down the fault.

For the Network+ N10-009 exam, focus on three things: the purpose of each command, the information it reveals and the networking problem it helps investigate. Practise applying these tools to real scenarios so that you can choose the appropriate troubleshooting method confidently.

CompTIA Network+: Troubleshooting Network Performance Issues

Falade Timilehin — Tue, 20 Oct 2026 15:48:40 +0000

Study Notes — N10-009 Certification

1. Introduction

Network performance troubleshooting is the process of identifying, diagnosing and resolving problems that affect the speed, reliability and responsiveness of a network.

The main issues covered in this course are:

Network congestion
Network bottlenecks
Bandwidth capacity limitations
Network latency
Packet loss
Network jitter
Wireless performance issues

A systematic troubleshooting approach helps identify the cause of poor performance rather than treating symptoms alone.

2. Network Congestion Issues

What is network congestion?

Network congestion occurs when the amount of traffic travelling through a network exceeds the capacity of its infrastructure to handle it efficiently.

When too much traffic competes for limited resources, network performance deteriorates.

Common causes

Insufficient bandwidth: The available network capacity cannot support the volume of traffic.
Legacy equipment: Older switches, routers or other devices may struggle to process modern traffic volumes.
High traffic volume: Too many users, applications or devices are transmitting data simultaneously.

Symptoms of congestion

Increased latency
Packet loss
Network jitter
Reduced throughput
Slow application response times

How to troubleshoot congestion

Monitor network traffic to identify periods of high utilisation.
Examine routers, switches and other network devices.
Identify which links or devices are approaching their capacity.
Review traffic requirements and network infrastructure.
Consider upgrading capacity or equipment where necessary.
Apply Quality of Service (QoS) to prioritise important traffic.

What is Quality of Service (QoS)?

QoS is a set of mechanisms used to manage network traffic and prioritise selected applications or traffic types.

For example, a network administrator may prioritise voice and video conferencing traffic over less time-sensitive file downloads.

Exam tip: If a network becomes slow when many users are active, investigate congestion and available capacity.

3. Network Bottlenecking Issues

What is a network bottleneck?

A bottleneck occurs when one particular component cannot handle the amount of traffic or processing required, limiting the performance of the wider network.

Congestion describes excessive traffic competing for network resources, while a bottleneck focuses on a specific limiting resource.

Common sources of bottlenecks

Overloaded switches
Underperforming servers
Storage networks with limited capacity
Aging hardware
Poor network design
Incorrect configurations
Hardware failures

Example

A company has a high-speed network connection, but its server can process requests only slowly. Users experience delays even though the network connection itself has sufficient capacity.

The server may be the bottleneck.

How to identify bottlenecks

Measure performance at different points in the network.
Check utilisation on switches, servers and network links.
Compare expected performance with actual performance.
Investigate components that consistently operate near their limits.
Check for misconfigurations or failing hardware.
Perform regular testing and maintenance to prevent recurring issues.

Key distinction: A bottleneck is often a specific limiting component; congestion is a broader condition in which traffic exceeds available capacity.

4. Bandwidth Capacity Issues

Bandwidth versus throughput

These terms are related but do not mean the same thing.

Term	Meaning
Bandwidth	The maximum data-carrying capacity of a network connection.
Throughput	The amount of data actually transmitted over a period.

Throughput cannot exceed the available bandwidth under the same measurement conditions and is commonly lower because of protocol overhead, congestion and other limitations.

Factors affecting throughput

Device processing limitations
Wireless signal range and quality
Hardware or software problems
Network outages
Congestion
Capacity limitations elsewhere along the network path

The lowest-capacity component

The overall capacity of a network path is constrained by its limiting component.

For example, if a path includes a 1 Gbps connection and a 100 Mbps connection, the 100 Mbps segment can restrict the end-to-end data rate to around 100 Mbps under suitable conditions.

How to troubleshoot bandwidth issues

Determine the bandwidth required by users and applications.
Measure actual throughput.
Check whether network equipment supports the required speeds.
Identify the lowest-capacity component in the path.
Investigate signal quality, outages and device limitations.
Upgrade equipment or connections where justified.

Exam tip: Bandwidth is the capacity available; throughput is the data rate actually achieved.

5. Network Latency Issues

What is latency?

Latency is the time taken for data to travel between endpoints or for a request to receive a response.

High latency makes a network feel slow, even when the connection has sufficient bandwidth.

Common symptoms

Websites take a long time to load.
Applications respond slowly.
Server requests take longer than expected.
Voice and video conversations experience noticeable delays.

Important latency measurements

Round Trip Time (RTT): The time taken for a packet to travel to a destination and for a response to return.

Time to First Byte (TTFB): The time between a client initiating a request and receiving the first byte of the response. It can include network delays and server processing time.

Troubleshooting tools

Ping: Tests reachability and reports round-trip response times.
Traceroute: Helps identify the route taken towards a destination and where delays may occur.
Wireshark: Analyses captured network packets to investigate communication delays and other network behaviour.

How to troubleshoot latency

Use ping to establish basic reachability and round-trip timing.
Use traceroute to examine the network path.
Compare results from different destinations or network locations.
Investigate unstable connections and overloaded components.
Review network configurations.
Consider suitable application-level improvements, such as HTTP/2 or load balancing, where they address the identified cause.

Exam tip: Ping and traceroute are useful initial diagnostic tools. Wireshark provides more detailed packet-level analysis.

6. Network Packet Loss

What is packet loss?

Packet loss occurs when packets transmitted across a network fail to reach their intended destination.

Some applications can recover by retransmitting lost data, but retransmissions can increase traffic and delay communication.

Common causes

Excessive distance or poor signal conditions
Outdated network hardware or software
Network congestion
Incorrect network configurations
Security attacks
Wireless interference

Effects of packet loss

Slow data transfers
Increased retransmissions
Reduced throughput
Interrupted voice or video calls
Unreliable application connections

Wireless networks may experience more packet loss when signals are weak or interference is significant.

How to reduce packet loss

Check the stability of the network connection.
Use ping and network monitoring tools to identify loss.
Inspect cables, interfaces and network equipment where relevant.
Investigate wireless signal quality and interference.
Update outdated software and maintain hardware.
Apply QoS where traffic prioritisation is appropriate.
Monitor network health to identify recurring patterns.

Exam tip: Packet loss means packets are not successfully reaching their destination. Do not confuse it with latency, which concerns delay.

7. Common Causes of Network Jitter

What is jitter?

Jitter is the variation in packet delay over time.

Latency measures delay; jitter measures how much that delay varies between packets.

Example

Suppose voice packets arrive with delays of 20 ms, 25 ms, 22 ms and 60 ms. The variation in their arrival times can disrupt the smooth playback of a conversation.

Common causes

Network congestion
Poor-quality or underperforming hardware
Insufficient bandwidth
Packet loss
Lack of suitable QoS configuration

Applications affected by jitter

Jitter is particularly noticeable in real-time applications, including:

Voice over IP (VoIP)
Video conferencing
Live audio and video streaming

It can cause choppy audio, distorted conversations and inconsistent video playback.

File transfers are generally more tolerant of jitter than real-time communication, although other performance problems may still affect them.

How to reduce jitter

Monitor delay variation during periods of high traffic.
Identify congestion and capacity limitations.
Check the condition and performance of network equipment.
Apply QoS to prioritise time-sensitive traffic where appropriate.
Reduce packet loss and address unstable links.
Review performance regularly.

The course notes identify jitter below 30 milliseconds as a target for real-time applications. Treat this as a useful course revision guideline rather than a universal threshold for every application.

Exam tip: If a VoIP call sounds choppy despite the connection remaining active, investigate jitter, packet loss and congestion.

8. Common Wireless Performance Issues

Wireless networks have additional performance challenges because devices communicate over radio frequencies rather than dedicated physical links.

8.1 Signal interference

Interference occurs when other wireless networks or electronic devices disrupt the radio signal.

Overlapping Wi-Fi channels can contribute to interference and reduce performance.

Possible symptoms: Slow Wi-Fi, unstable connections and inconsistent signal quality.

Troubleshooting: Examine channel usage, reduce avoidable interference and select suitable channels.

8.2 Wi-Fi half-duplex operation

Wi-Fi operates in half-duplex mode: a device transmits or receives over a shared radio channel rather than transmitting and receiving simultaneously on that channel.

Traditional full-duplex wired Ethernet can transmit and receive simultaneously.

Because wireless devices share the medium, they must coordinate access to it. This can reduce effective performance when many devices compete for airtime.

8.3 The 2.4 GHz and 5 GHz bands

Feature	2.4 GHz	5 GHz
Range	Generally longer	Generally shorter
Interference	Often more crowded	Often less crowded
Performance	Can be affected by congestion and interference	Can offer better performance where signal quality is adequate
Best consideration	Coverage and reach	Higher performance over suitable distances

Actual performance depends on factors such as distance, walls, interference, channel selection and equipment capabilities.

8.4 Access point configuration and roaming

Multiple access points should be configured consistently where they form the same wireless network.

Inconsistent settings can contribute to roaming problems, authentication difficulties or unreliable connections as users move between coverage areas.

Check relevant settings across access points, including network identifiers and security configuration.

8.5 Client disassociation

Disassociation occurs when a wireless client disconnects from an access point.

Frequent disassociations can indicate:

Weak signal strength
Radio interference
Access point or client configuration problems
Wireless infrastructure faults

Review access point and client logs to identify repeated disconnections and investigate the associated conditions.

Wireless troubleshooting checklist

Check signal strength and coverage.
Investigate interference and channel overlap.
Compare performance on 2.4 GHz and 5 GHz.
Check access point configuration consistency.
Review logs for repeated disassociations.
Test from different locations.
Determine whether the problem affects one client or multiple clients.

9. Comparison of Common Performance Problems

Problem	What it means	Typical symptoms	Initial investigation
Congestion	Traffic exceeds available network capacity	Slow network, packet loss and delays during busy periods	Monitor traffic and utilisation
Bottleneck	One component limits overall performance	Persistent slow performance around a particular resource	Check switches, servers, storage and links
Bandwidth limitation	Available capacity is insufficient for requirements	Low transfer rates or reduced throughput	Measure throughput and inspect link capacities
Latency	Communication experiences excessive delay	Slow responses and delayed interactions	Ping, traceroute and packet analysis
Packet loss	Some transmitted packets fail to arrive	Retransmissions, interrupted calls and poor transfers	Check connection stability and loss measurements
Jitter	Packet delay varies over time	Choppy voice and inconsistent real-time media	Monitor delay variation and congestion
Wireless interference	Radio signals are disrupted or compete for airtime	Unstable Wi-Fi and inconsistent speeds	Check channels, signal strength and access point logs

10. Practical Troubleshooting Scenario

Scenario

Employees report that video meetings are choppy, file downloads are slow and Wi-Fi disconnects frequently in one area of the office.

Step 1: Identify the symptoms

There are several possible problems: congestion, packet loss, jitter, wireless interference or a faulty access point.

Do not assume that every symptom has the same cause.

Step 2: Establish a probable cause

Check whether the problem occurs only during busy periods, only on Wi-Fi or across both wired and wireless connections.

Busy periods may suggest congestion.
Choppy calls may indicate jitter or packet loss.
Problems restricted to one wireless area may indicate interference, poor coverage or an access point fault.

Step 3: Test the theory

Use ping to check reachability and round-trip timing. Use traceroute to examine the path to a destination. Review network utilisation and wireless logs, and use Wireshark if detailed packet analysis is required.

Step 4: Plan and resolve

Depending on the evidence, possible actions include adjusting wireless channels, correcting access point configuration, improving coverage, applying QoS or upgrading an overloaded network component.

Step 5: Verify and document

Retest the affected applications, compare performance before and after the change, and record the cause, actions taken and results.

Lesson: Good troubleshooting relies on evidence. Multiple symptoms can have different causes, so isolate the problem before making changes.

11. Exam Revision: Key Facts to Remember

Congestion: Traffic exceeds the capacity available to handle it.
Bottleneck: A particular component limits overall performance.
Bandwidth: Maximum data-carrying capacity.
Throughput: Actual data transmitted over time.
Latency: Communication delay.
RTT: Time for a packet to travel to a destination and for a response to return.
TTFB: Time until the first response byte is received.
Packet loss: Packets fail to reach their destination.
Jitter: Variation in packet delay.
QoS: Helps manage and prioritise network traffic.
Ping: Tests reachability and measures round-trip timing.
Traceroute: Helps examine the route towards a destination.
Wireshark: Provides detailed packet analysis.
Wi-Fi: Operates in half-duplex mode.
2.4 GHz: Generally offers longer range but may experience more interference.
5 GHz: Can provide better performance over suitable distances but generally has shorter range.
Frequent disassociation: Investigate wireless signal quality, interference, configuration and logs.

12. Final Revision Checklist

Before taking the Network+ test, make sure you can:

[ ] Explain the difference between congestion and a bottleneck.
[ ] Distinguish bandwidth from throughput.
[ ] Explain latency, RTT and TTFB.
[ ] Describe packet loss and its effects.
[ ] Explain jitter and why it affects VoIP and video conferencing.
[ ] Match ping, traceroute and Wireshark to their purposes.
[ ] Explain how QoS can help manage traffic.
[ ] Compare the 2.4 GHz and 5 GHz wireless bands.
[ ] Identify possible causes of wireless disconnections.
[ ] Describe a systematic process for investigating and verifying a performance fix.

Final takeaway

When troubleshooting network performance, identify the symptom, establish a probable cause, test it with suitable tools, make a targeted change and verify the outcome. Understanding the difference between congestion, bottlenecks, bandwidth limitations, latency, packet loss and jitter is essential for both practical networking and CompTIA Network+ exam preparation.

CompTIA Network+: Troubleshooting Cabling, Interfaces, & Network Services

Falade Timilehin — Tue, 20 Oct 2026 15:29:59 +0000

Introduction

Network troubleshooting involves identifying and resolving problems that affect connectivity, performance and availability. Network issues can originate from physical cabling, network interfaces, hardware, switches, routing configurations or incorrect IP settings.

A structured troubleshooting approach helps administrators identify the root cause without making unnecessary changes.

This article covers the main topics from the course:

Common cabling issues
Interface issues
Hardware and Power over Ethernet (PoE)
Common switching issues
Route selection problems
DHCP address pool considerations
Default gateway issues
IP addressing conflicts
Incorrect subnet masks

1. Common Cabling Issues

Cabling provides the physical connection between network devices. Incorrect cable selection, poor termination or physical damage can cause slow connections, intermittent connectivity and complete network failure.

Cable selection

Choosing the correct cable type is important for maintaining network speed, reliability and signal quality.

When selecting a cable, consider:

Required transmission speed.
Supported distance.
The environment in which the cable will operate.
The potential for electromagnetic interference (EMI).
Compatibility with connected network devices.

Shielded cables may be appropriate in environments with significant electromagnetic interference. Shielding helps protect signals from external electrical noise when the cable and installation are suitable.

Common cabling faults

Incorrect cable type: A cable may not support the required speed or operating conditions, creating a bottleneck.

Damaged cable: Physical damage can interrupt connectivity or cause intermittent faults.

Poor termination: Incorrectly terminated connectors or inconsistent wiring can prevent reliable communication.

Incorrect transmitter and receiver wiring: The transmitting and receiving conductors must be connected appropriately for the equipment and cable type.

Electromagnetic interference: Electrical equipment or other sources of interference can affect signal integrity, especially when the cabling installation is unsuitable for the environment.

Troubleshooting approach

Inspect the cable for damage.
Check that both ends are connected securely.
Confirm that the cable type is suitable.
Inspect connector termination and wiring.
Test the cable using an appropriate cable tester.
Replace a suspected faulty cable and retest the connection.
Document the results.

Example: A workstation repeatedly loses its network connection. Inspection reveals a damaged Ethernet cable. Replacing it restores a stable connection.

Exam tip: When a problem affects one device and the physical connection is suspect, check the cable and connector before assuming the switch or router has failed.

2. Interface Issues

A network interface connects a device to the network. Interfaces can be physical, such as Ethernet ports, or logical, such as virtual interfaces.

Problems with an interface can affect connectivity, performance and the ability to communicate with other devices.

Important interface statistics

Network operating systems and monitoring tools provide interface counters that help identify faults.

Metric	Meaning	Possible indication
Dropped packets	Packets discarded before successful delivery	Congestion, insufficient resources or configuration issues
CRC errors	Frames that fail a cyclic redundancy check	Possible cabling, interference or physical-layer problems
Runts	Frames smaller than the permitted minimum Ethernet frame size	Possible collisions or physical-layer issues, depending on the environment
Giants	Frames larger than the permitted maximum frame size	Oversized frames, configuration problems or equipment issues
Overruns	Data that cannot be processed quickly enough by the receiving interface or system	Resource or processing limitations

These counters provide clues rather than automatic proof of a particular fault. Compare counter values over time and correlate them with other evidence.

Interface status

An interface may be unavailable because it is:

Administratively down: Disabled through configuration.
Suspended or blocked: Prevented from forwarding traffic by a device state or network policy.
Physically down: Unable to establish a physical link.
Operational but experiencing errors: The link is active, but communication is unreliable.

Troubleshooting steps

Check the interface's administrative and operational status.
Review interface counters and error logs.
Inspect the cable and connected port.
Confirm interface speed and duplex settings where applicable.
Check drivers and configuration.
Use operating-system tools or network-management software to gather further evidence.

Hardware failure is possible, but configuration errors, cabling problems and driver issues should also be investigated.

Exam tip: CRC errors, dropped packets, runts and giants are useful clues. Learn what each counter measures and avoid treating any one counter as conclusive evidence of a specific fault.

3. Hardware Issues and Power over Ethernet

Hardware problems can affect connectivity, network performance and device availability.

One important technology is Power over Ethernet (PoE), which allows compatible Ethernet equipment to receive electrical power and data over the same cable.

Devices that use PoE

Examples include:

Voice over IP (VoIP) phones.
Wireless access points.
IP security cameras.
Compatible Internet of Things (IoT) devices.

PoE can simplify installation because a separate power connection may not be necessary at the device location.

Troubleshooting PoE

If a device does not power on, check:

Whether the switch port supports PoE.
Whether PoE is enabled and the port is operating correctly.
Whether the switch has sufficient available power.
Whether the device's power requirements are compatible with the switch.
Whether the cable is suitable and correctly terminated.
Whether the cable length is within the supported limits.
Whether device or switch configuration, firmware or logs indicate a problem.

The course notes identify Category 5e or better cabling and a maximum Ethernet cabling distance of 100 metres as relevant considerations. Actual PoE compatibility and power delivery depend on the equipment, standard, cable and installation.

Total power budget

A PoE switch has a finite power budget. Even if individual ports support PoE, the switch may be unable to supply power to every connected device simultaneously if the total demand exceeds its available capacity.

For example, if several new wireless access points are installed and some fail to power on, check the switch's overall PoE power budget as well as the individual port settings.

Transceivers

Transceivers enable network devices to transmit and receive signals over a particular medium, such as fibre-optic cable.

When troubleshooting a suspected transceiver problem:

Check compatibility with the switch and cable type.
Inspect the transceiver and connectors for damage or contamination.
Confirm that the device is seated correctly.
Check relevant power, configuration and firmware settings.
Review interface status and logs.

Exam tip: A PoE problem is not always a faulty cable. Check port capability, power settings, the total switch power budget and device requirements.

4. Common Switching Issues

Switches connect devices within a local area network (LAN). Incorrect switch configurations can prevent communication, create loops or reduce network performance.

Bad switch ports

A faulty or misconfigured port can prevent a device from connecting correctly.

Check:

Port status.
Cable condition.
Interface counters.
Port configuration.
Whether the problem follows the device, cable or port when a controlled substitution test is performed.

Bottlenecks

A bottleneck occurs when a component or link limits overall network performance.

Possible causes include insufficient link capacity, congestion or a heavily utilised interface.

Review utilisation statistics and determine where traffic is being delayed or constrained.

VLAN mismatches

A virtual LAN (VLAN) logically separates devices into different broadcast domains.

A VLAN mismatch can occur when a switch port is assigned to the wrong VLAN or when connected switches have inconsistent trunk settings.

Symptoms may include devices being unable to reach resources that should be accessible within the intended network.

Check:

VLAN assignments.
Access-port configuration.
Trunk configuration and allowed VLANs.
VLAN consistency between connected switches.
The relevant routing configuration if communication between VLANs is required.

Spanning Tree Protocol loops

Spanning Tree Protocol (STP) helps prevent Layer 2 switching loops in networks with redundant links.

A switching loop can cause broadcast storms, excessive traffic and unstable network operation.

When investigating a suspected loop, review STP status, topology changes, switch logs and port states. Do not randomly disconnect links without understanding the network's redundancy and impact.

Access control list misconfiguration

An access control list (ACL) permits or denies traffic according to configured rules.

An incorrect ACL can block legitimate communication even when physical connectivity and IP addressing are correct.

Check the rules against the intended source, destination, protocol and traffic direction. Review logs and counters where available.

Exam tip: If devices are physically connected but cannot communicate as expected, investigate VLAN configuration, STP, ACLs and port status before concluding that hardware has failed.

5. Route Selection Problems

Routing determines how packets travel between different IP networks. Incorrect or outdated routes can cause traffic to take an inefficient path or fail to reach its destination.

Static routes

A static route is configured manually by an administrator.

Static routes should be reviewed regularly to confirm that their destinations, next hops and interfaces remain valid.

A route may become ineffective if the network changes or the next-hop device is no longer reachable.

Default route

The IPv4 default route is written as:

0.0.0.0/0

It matches destinations when no more specific route is selected. In an IPv6 network, the corresponding default route is:

::/0

A default route commonly directs traffic towards an upstream router or internet gateway.

An incorrect default route can prevent access to external networks or send traffic along an unintended path.

How routers select routes

Three important concepts are:

Longest prefix match: The router generally selects the route with the most specific matching destination prefix.

Administrative distance: Where a routing device has competing routes to the same destination from different sources, administrative distance helps it assess which source is preferred. The precise rules depend on the routing platform.

Metric: A routing protocol or routing process may use a metric to compare paths. The meaning and calculation of the metric depend on the protocol.

These concepts serve different purposes. Administrative distance helps compare route sources, metrics compare routes according to the relevant routing protocol or process, and longest prefix match selects the most specific matching destination prefix.

Troubleshooting tools

ping tests basic IP reachability.
traceroute or tracert helps identify the path packets take towards a destination.
Platform-specific show commands display routing tables, interfaces and routing information.

Example: A server can reach devices on its local subnet but cannot reach an external network. Checking the routing table reveals an incorrect default route. Correcting the route restores the expected path.

Exam tip: Understand the difference between a default route, administrative distance, route metrics and longest prefix match.

6. Address Pool Considerations

Dynamic Host Configuration Protocol (DHCP) automatically assigns IP configuration to client devices.

A DHCP scope or address pool defines the addresses available for assignment within a particular network.

Address pool exhaustion

Address pool exhaustion occurs when the DHCP server has no available addresses left to lease to additional clients.

Possible symptoms include devices failing to obtain a usable IP address or being unable to communicate normally on the network.

Potential causes include:

Too many devices using the available pool.
Leases remaining active for longer than necessary.
A pool that is too small for the number of clients.
Unexpected devices connecting to the network.
DHCP scope or exclusion misconfiguration.

Troubleshooting steps

Check the client's IP configuration.
Inspect DHCP scope utilisation and available addresses.
Review active leases and lease durations.
Investigate unexpected clients or reservations.
Check scope size and exclusion settings.
Expand or redesign the pool where appropriate.
Consider additional subnets or scopes if the network design supports them.

The course notes also mention reducing the number of connected devices when appropriate.

Private IPv4 addresses can be reused across separate private networks, but a single subnet still has a finite number of usable addresses. IPv6 provides a much larger address space, although correct addressing and DHCP or other address-configuration mechanisms remain important.

Exam tip: If multiple new devices cannot obtain valid network configuration, investigate DHCP availability and scope exhaustion before assuming that all the devices have failed.

7. Default Gateway Issues

A default gateway is the device or routing interface that forwards traffic from a local network towards destinations outside that network when no more specific route applies.

It is usually a router or Layer 3 device.

Common symptoms

Local devices can communicate, but external networks are unreachable.
Internet access fails even though the device has a valid local IP address.
Traffic cannot reach a different subnet.
Several devices in the same network experience similar external-connectivity problems.

Common causes

Incorrect or missing default gateway configuration.
Gateway device failure.
Incorrect client IP settings.
Physical connectivity problems.
Router or interface configuration errors.
Driver or operating-system networking problems.

Troubleshooting process

Check the client's IP address, subnet mask and default gateway.
Verify that the gateway address belongs to the expected local subnet.
Check the device's physical or wireless connection.
Test connectivity to the gateway.
Inspect the router's interface and routing status.
Compare the configuration with a working device.
Apply an authorised corrective action and test again.

If a client can communicate with local devices but cannot reach other networks, the gateway is an important point to investigate.

The course also mentions resetting TCP/IP, updating drivers or firmware, disabling interfering software and using a safe-boot approach to isolate software-related problems. These should be considered when the evidence points towards a client configuration or software issue, rather than applied indiscriminately.

Exam tip: A default gateway is needed to reach destinations outside the local IP subnet. It is not normally required for communication between devices in the same subnet.

8. IP Addressing Conflicts

An IP addressing conflict occurs when two devices are assigned the same IP address within the same network where that address must be unique.

Duplicate assignments can result in intermittent connectivity, failed communication or operating-system warnings.

Common causes

Two devices manually configured with the same static IP address.
DHCP scope misconfiguration.
A static address falling inside the DHCP allocation range without a suitable reservation or exclusion.
Incorrect documentation or coordination between administrators.

Troubleshooting steps

Check the affected device's IP configuration.
Review DHCP leases and reservations.
Compare the configuration with the IP address management records.
Identify whether a static assignment overlaps with the DHCP pool.
Use appropriate network tools to gather evidence about the conflicting address.
Correct the conflicting assignment.
Renew the DHCP lease where appropriate.
Verify that connectivity has returned.

Pinging an address may provide useful evidence, but it does not conclusively identify a duplicate IP address in every situation. Check DHCP records, device configurations and relevant network logs as well.

Prevention

Maintain accurate IP address documentation.
Exclude static addresses from dynamic DHCP allocation where appropriate.
Use DHCP reservations when suitable for the network design.
Coordinate manual IP assignments between administrators.
Review scopes and configuration changes regularly.

Exam tip: A duplicate IP address is different from an incorrect subnet mask. A duplicate means the same address has been assigned to multiple devices; a mask error means a device may interpret network boundaries incorrectly.

9. Incorrect Subnet Mask

A subnet mask identifies which bits of an IPv4 address represent the network portion and which represent the host portion.

For example:

IP address: 192.168.1.25
Subnet mask: 255.255.255.0
CIDR notation: /24
Network address: 192.168.1.0

With a /24 mask, the first 24 bits identify the network and the remaining 8 bits identify the host portion.

How an incorrect mask causes problems

Devices use their IP address and subnet mask to determine whether a destination is local or must be reached through a router.

If a device has the wrong mask, it may make an incorrect decision about where a destination resides.

This can prevent communication even when devices are connected to the same switch. Physical connection alone does not guarantee that their IP configurations are compatible.

Troubleshooting steps

Inspect the device's IP address and subnet mask.
Compare them with network documentation.
Check the settings on a correctly configured device in the same subnet.
Confirm the intended subnet and network boundary.
Correct the mask through the appropriate configuration mechanism.
Retest local and remote connectivity.

DHCP can reduce client-side configuration errors by supplying the correct IP address, mask, gateway and other settings. However, incorrect DHCP scope configuration can distribute incorrect settings to many devices.

Exam tip: If two devices share the same physical switch but cannot communicate, check their IP addresses and subnet masks as well as VLAN membership.

10. Troubleshooting Tools and Their Uses

Tool or method	Main purpose
Cable tester	Checks cable wiring and physical continuity, depending on the tester
Interface counters	Identifies errors, drops and other interface statistics
Device logs	Reveals interface, switching, power or configuration events
`ping`	Tests IP reachability and response time
`traceroute` / `tracert`	Helps identify the route towards a destination
Routing table commands	Displays routes and next-hop information
DHCP lease inspection	Helps identify scope exhaustion and assignment problems
IP configuration tools	Shows the device's address, subnet mask and gateway

No single tool proves every cause. Combine test results with user reports, configuration records and the observed symptoms.

11. Integrated Troubleshooting Scenario

Scenario: Several employees can access local shared resources but cannot reach external websites. One employee also reports intermittent connectivity.

Step 1: Identify the scope

Determine whether the external-connectivity problem affects one user, several users or the entire subnet. Check whether internal resources remain accessible.

Step 2: Check physical connectivity

Inspect relevant cables, switch ports and interface status. Review interface counters for errors or dropped packets.

Step 3: Validate IP configuration

Check IP addresses, subnet masks and default gateways. Review DHCP leases if devices appear to have incorrect or missing configuration.

Step 4: Investigate routing

If local connectivity works, inspect the default gateway and routing table. Use ping and traceroute to gather further evidence.

Step 5: Check switching configuration

If only a subset of devices is affected, review VLAN assignments, port configuration and applicable ACLs.

Step 6: Apply the appropriate fix

Use the evidence to identify the cause. Assess the impact before changing shared infrastructure, and escalate if the required action is outside your authority.

Step 7: Verify and document

Test local and external connectivity, confirm that the intermittent problem has stopped, check that other services still work and document the resolution.

This scenario illustrates why effective troubleshooting considers physical connections, interfaces, switching, addressing and routing rather than assuming every connectivity problem has the same cause.

12. Final Exam Revision Checklist

Before taking the CompTIA Network+ N10-009 test on this topic, ensure that you can explain:

Common cable faults, cable selection and electromagnetic interference.
Interface counters, including CRC errors, runts, giants and overruns.
Administrative interface states and physical link problems.
PoE requirements, port settings and switch power budgets.
Switch faults, bottlenecks, VLAN mismatches, STP loops and ACL errors.
The purpose of a default route and how routers select paths.
Administrative distance, metrics and longest prefix match.
DHCP address pool exhaustion and possible remedies.
The purpose of a default gateway and how to troubleshoot it.
The causes and resolution of duplicate IP addresses.
How an incorrect subnet mask affects local and remote communication.
How to use ping, traceroute, interface statistics, logs and configuration tools.

Quick memory guide

Physical layer: Cable, connector, interference and link status.

Interface and hardware: Counters, port configuration, drivers, transceivers and PoE.

Switching: VLANs, STP, ACLs, ports and bottlenecks.

Routing: Route tables, default routes, metrics and administrative distance.

IP services: DHCP pools, default gateways, IP conflicts and subnet masks.

Final principle: Follow a logical troubleshooting process, test your theories, assess the impact of changes, verify the result and document what you learned.

These notes are based on the course material provided, with practical examples added to support revision.

CompTIA Network+: Troubleshooting Methodologies & Approaches

Falade Timilehin — Tue, 20 Oct 2026 15:19:28 +0000

1. Course Overview

Network troubleshooting is the systematic process of identifying, investigating and resolving network problems. Network administrators must respond quickly to incidents and outages because unresolved issues can disrupt business operations, cause downtime and lead to costly repairs.

A consistent troubleshooting methodology helps technicians identify the underlying cause instead of simply treating the symptoms.

The main stages are:

Identify the problem.
Establish a theory of probable cause.
Test the theory to determine the cause.
Establish a plan of action and consider potential effects.
Implement the solution or escalate the issue.
Verify system functionality.
Document the findings, actions and results.

Key principle: Troubleshooting should be logical, evidence-based and documented. Avoid making changes before understanding the problem and its possible consequences.

2. Identify the Problem

The first step is to understand what is happening before attempting a solution.

Information to gather

Problem description: What exactly is not working?
Symptoms: What does the user experience?
History: When did the problem begin? Has it happened before?
Scope: Does it affect one user, one device, a department or the entire network?
Recent changes: Have configurations, cables, software or network equipment recently changed?
Reproduction: Can you repeat the problem under the same conditions?

User reports and technical tools both help establish the facts.

Recommended approach

Ask the user clear questions about the issue.
Gather relevant information and check the problem history.
Use suitable tools to investigate symptoms.
Attempt to reproduce the problem.
Record the evidence and actions taken.
Isolate the issue and investigate one problem at a time.

Example

A user reports that they cannot access the internet.

Instead of immediately restarting the router, establish whether:

The device is connected to Wi-Fi or Ethernet.
Other users can access the internet.
The user can access internal resources.
The problem affects one website or all websites.
The problem began after a recent configuration change.

These details help narrow down the possible cause.

Exam reminder: Start by gathering information. Do not assume that the first symptom identifies the root cause.

3. Establish a Theory of Probable Cause

Once the problem is understood, develop possible explanations for why it is happening.

A theory of probable cause is a reasoned explanation that can be investigated and tested.

Prioritise likely causes

Begin with straightforward possibilities before investigating more complicated ones.

For example, if a workstation has no network connectivity, check:

Whether the device has power.
Whether its network cable is connected.
Whether Wi-Fi is enabled.
Whether a recent change affected connectivity.
Whether a reboot is appropriate.

These checks can identify simple causes before you spend time investigating complex network configurations.

Troubleshooting approaches

Two useful approaches are top-down and bottom-up troubleshooting.

Approach	Starting point	Example
Top-down	Higher OSI layers, such as the application layer	Investigate an application or service before moving towards lower layers
Bottom-up	Lower OSI layers, such as the physical layer	Check cables and link status before investigating higher-level services

Choose the approach based on the symptoms and available evidence.

You can also collaborate with colleagues or other technical teams, dividing the investigation into manageable tasks to isolate the root cause more quickly.

Exam reminder: Know the difference between top-down and bottom-up troubleshooting. Both are systematic approaches; the starting point differs.

4. Test the Theory

After establishing a probable cause, test it to determine whether it explains the problem.

Do not assume that a plausible explanation is correct simply because it fits the symptoms.

Testing process

Select the most likely cause.
Decide how to test it.
Carry out the test.
Review the results.
Confirm or reject the theory.
If necessary, move to the next probable cause.

For example, if a loose Ethernet cable is suspected, inspect the cable and connection. If correcting the connection restores connectivity, the evidence supports the theory.

If the test does not confirm the cause, continue investigating instead of repeatedly applying the same unsuccessful fix.

Why systematic testing matters

Reduces wasted time.
Helps identify the root cause.
Avoids unnecessary configuration changes.
Reduces the likelihood of recurring problems.
Helps minimise network downtime.

Escalation

Escalate the problem when it exceeds your technical knowledge, access permissions or assigned responsibilities. Provide the evidence gathered so far so the next technician can continue the investigation efficiently.

Exam reminder: Test one theory at a time and use the results to guide the next step.

5. Identify Potential Effects and Plan the Solution

Before implementing a solution, establish a plan of action.

A fix may resolve one problem but create another. For example, changing a network configuration could restore connectivity for one user while disrupting other users.

What to consider

Which systems and users could be affected?
Could the change interrupt business operations?
Is the solution within your authority?
Is a maintenance window required?
Is there a risk of data loss or service disruption?
What will you do if the solution fails?
Can the change be reversed?

Build a step-by-step plan

A good plan should describe:

The proposed corrective action.
The order in which actions will be performed.
The expected result.
The potential side effects.
A contingency or rollback plan.
The verification checks required afterwards.

If the solution does not work or introduces new issues, reassess the situation and adjust the plan.

Exam reminder: Assess the impact and plan the solution before making changes.

6. Resolve the Problem

Once the likely cause has been established and the effects assessed, implement the solution if you have the necessary authority.

Good practice

Follow the agreed troubleshooting plan.
Confirm that you have permission to make the change.
Follow organisational procedures.
Record the investigation and actions taken.
Escalate problems outside your responsibility or skill level.
Provide useful notes when handing the issue to another team.

Escalation process

Follow the appropriate escalation chain, starting with the relevant colleague, team or supervisor according to organisational procedures. Do not bypass the established process by immediately contacting senior management.

When escalating, include:

The original problem description.
The scope and impact.
Tests already performed.
Results of successful and unsuccessful attempts.
Any changes made.
Remaining questions or suspected causes.

This prevents the next technician from repeating work unnecessarily.

Exam reminder: Stay within your authorisation. Escalation is a responsible troubleshooting action, not a failure.

7. Verify System Functionality

Implementing a fix does not automatically mean the problem is resolved.

Verification confirms that the original issue has been corrected and that the solution has not introduced additional problems.

Verification checklist

Can the affected user perform the original task?
Does the relevant service work as expected?
Can affected devices communicate?
Are other users or services still functioning?
Have any new errors appeared?
Does the system remain stable after the change?

For example, if a user could not access a network resource, ask them to test that resource after the fix. Check related connectivity and confirm that other services remain operational.

Preventative measures

The course also highlights ways to reduce future incidents:

Redundancy: Use suitable fault-tolerance measures, such as RAID where appropriate, to reduce certain forms of downtime or data loss.
Restrictions and policies: Limit unauthorised changes and reduce user errors.
Preventative controls: Apply measures appropriate to the type of problem encountered.

These measures can reduce the frequency or impact of some issues, but they cannot eliminate all network problems.

Important distinction: RAID provides storage redundancy or fault tolerance; it is not a universal solution for network outages.

8. Documentation Processes

Documentation should be updated after the solution has been tested and confirmed to work. Record the investigation throughout the process where appropriate, rather than relying on memory at the end.

What to document

Information	What to record
Problem description	What was reported and what was observed
Date and time	When the issue was reported and investigated
Reporter	The person or team reporting the problem
Scope	The affected devices, users, services or locations
Technician	Who investigated or resolved the issue
Symptoms	Errors, failures and other observed behaviour
Investigation	Tests performed and evidence gathered
Actions taken	Changes, repairs or corrective steps
Outcomes	Whether each action succeeded or failed
Escalation status	Whether the issue was escalated and to whom
Final verification	How normal functionality was confirmed

Why documentation matters

Helps future technicians resolve similar issues.
Prevents repeated, unsuccessful troubleshooting.
Supports handovers and escalations.
Creates a record of configuration changes and corrective actions.
Improves consistency and accountability.

Document unsuccessful attempts as well as successful ones. A failed test is useful evidence because it helps narrow down the possible causes.

9. The Complete Troubleshooting Methodology

Remember the sequence below when answering scenario-based exam questions.

Stage	Key question
1. Identify the problem	What is happening, and who or what is affected?
2. Establish a probable cause	What is the most likely explanation?
3. Test the theory	What evidence will confirm or reject the explanation?
4. Plan and assess effects	What could the solution affect, and what is the backup plan?
5. Implement or escalate	Can I safely and legitimately carry out the solution?
6. Verify functionality	Has the original problem been resolved without new issues?
7. Document	What happened, what was done and what were the results?

10. Practical Troubleshooting Scenario

Scenario: Several employees cannot access an internal application, but other network services appear to work.

Step 1 — Identify the problem: Ask affected users when the issue began. Determine whether the failure affects a particular department, device type or location. Check whether the application worked previously.

Step 2 — Establish a probable cause: Consider possible causes such as an application service failure, a recent configuration change or a connectivity issue affecting the application.

Step 3 — Test the theory: Carry out appropriate checks and review the results. Avoid changing multiple settings simultaneously, because that can make it harder to identify the cause.

Step 4 — Assess the effects: Before restarting a shared service or changing configuration, consider the impact on other users and establish a contingency plan.

Step 5 — Resolve or escalate: Apply the authorised fix if the cause is established and the change is within your responsibilities. Otherwise, escalate with the evidence collected.

Step 6 — Verify functionality: Ask affected users to test the application. Confirm that other network services still work and that no new problems have appeared.

Step 7 — Document: Record the symptoms, scope, investigation, tests, changes, outcomes and final verification.

The central lesson is to work methodically rather than jumping straight to a fix.

11. Final Exam Revision Points

Before retaking the course test, make sure you can explain the following:

Why troubleshooting should follow a consistent methodology.
What information to gather when identifying a problem.
How to establish and prioritise a theory of probable cause.
The difference between top-down and bottom-up troubleshooting.
Why each theory must be tested before moving to another.
Why potential side effects and contingency plans matter.
When and how to escalate an issue.
Why verification is necessary after implementing a solution.
How preventative measures can reduce future problems.
What details should be included in troubleshooting documentation.

Easy memory aid

Identify → Establish → Test → Plan → Resolve → Verify → Document

Use this sequence to structure your answers to troubleshooting scenarios. If a question asks what to do next, identify the stage you are currently at and select the action that logically follows it.

These notes are based on the course material you provided. They organise the completed lessons into a revision guide; the practical examples are illustrative applications of those concepts.

CompTIA Network+: Common Network Attack Types

Falade Timilehin — Tue, 20 Oct 2026 12:45:41 +0000

1. Introduction

Network attacks are attempts to gain unauthorised access to network resources, steal information, disrupt services, or compromise the confidentiality, integrity, and availability of systems.

Network security involves using appropriate controls to monitor, detect, prevent, and respond to attacks. Understanding common attack types helps network professionals recognise vulnerabilities and select effective countermeasures.

This article covers the key attack types in the CompTIA Network+ N10-009 course:

Denial-of-Service (DoS) and Distributed Denial-of-Service (DDoS)
VLAN hopping
Media Access Control (MAC) flooding
Address Resolution Protocol (ARP) spoofing and poisoning
DNS poisoning and spoofing
Rogue devices and services
Evil twin attacks
On-path attacks
Social engineering
Malware attacks

2. Denial-of-Service (DoS) Attacks

A Denial-of-Service attack attempts to make a server, network, or service unavailable by overwhelming it with excessive traffic or requests, or by exhausting its resources.

For example, an attacker may send so many requests to a company website that legitimate customers can no longer access it.

DoS vs DDoS

A DoS attack typically originates from one system or a limited source. A Distributed Denial-of-Service attack uses multiple systems to attack the same target, making the attack more difficult to block.

Attack type	Description
DoS	Attempts to disrupt a service using excessive traffic or resource consumption.
DDoS	Uses multiple systems to overwhelm a target.

Four common DoS attack categories

1. Volumetric attacks

These attacks consume network bandwidth by sending large amounts of traffic. The objective is to prevent legitimate traffic from reaching the target.

2. Fragmentation attacks

These attacks exploit how systems handle fragmented IP packets. Malformed or overlapping fragments may consume resources or trigger weaknesses in packet reassembly.

3. TCP state exhaustion

These attacks consume resources associated with maintaining TCP connections or connection states. A system may become unable to handle legitimate connection requests.

4. Application-layer attacks

These attacks target applications or services, such as web servers. They may use a large number of requests that appear legitimate but consume excessive processing power or memory.

Why do attackers launch DoS attacks?

Common motivations include:

Revenge or personal disputes.
Competition between organisations.
Hacktivism.
Extortion or ransom demands.
Disruption for entertainment or mischief.

Prevention and mitigation

Organisations can reduce the impact of DoS and DDoS attacks through:

Network traffic monitoring.
Establishing normal traffic baselines.
Rate limiting and filtering where appropriate.
Using suitable DDoS protection services.
Testing resilience through authorised simulations.
Reviewing incidents and improving defences afterwards.

The key exam point is that DoS attacks target availability.

3. VLAN Hopping Attacks

A Virtual Local Area Network (VLAN) separates devices into logical network segments. VLAN hopping is an attack that attempts to access traffic or resources belonging to a VLAN that the attacker should not be able to access.

The attack may exploit weaknesses in VLAN tagging or switch configuration.

Understanding VLAN tagging

IEEE 802.1Q is a standard used to identify VLAN membership in Ethernet frames. Trunk links can carry traffic for multiple VLANs between network devices.

Incorrect switch configuration can create opportunities for VLAN hopping.

Two common VLAN hopping techniques

Double tagging

In a double-tagging attack, an attacker crafts a frame with two VLAN tags. Under certain switch configurations, the first switch may remove the outer tag, leaving the second tag to influence how the frame is handled by another switch.

This technique depends on the network topology and configuration. It is commonly associated with weaknesses involving native VLAN handling.

Switch spoofing

Switch spoofing attempts to trick a switch into treating an attacker's device as another switch. If trunk negotiation is improperly enabled, the attacker may establish a trunk link and gain access to traffic from multiple VLANs.

Prevention

Administrators can reduce VLAN hopping risks by:

Avoiding use of the default VLAN for ordinary user traffic.
Disabling dynamic trunk negotiation on ports that do not require it.
Configuring unused ports as access ports and disabling them where practical.
Explicitly configuring trunk ports.
Using a dedicated, unused native VLAN where appropriate.
Restricting which VLANs are permitted on trunk links.
Reviewing switch configurations regularly.

The key exam point is that VLAN hopping exploits VLAN and switch configuration weaknesses to cross intended network boundaries.

4. Media Access Control (MAC) Flooding Attacks

Switches maintain a MAC address table that associates device MAC addresses with switch ports. This allows the switch to forward Ethernet frames to the correct destination port.

A MAC flooding attack attempts to fill the switch's MAC address table with large numbers of fabricated MAC addresses.

How MAC flooding works

The attacker sends many Ethernet frames containing fake source MAC addresses.
The switch's MAC address table becomes full or reaches its operating limit.
Depending on the switch and its configuration, traffic for unknown destinations may be flooded out multiple ports within the relevant VLAN.
This may expose traffic that would otherwise have been forwarded only to a particular destination.

The result can be increased traffic, reduced performance, and potential information exposure.

Not every switch behaves identically when its table is full. The impact depends on the device's implementation and security controls.

Prevention

Organisations can reduce the risk by using:

Port security: Limits the number of MAC addresses learned on a switch port.
Network monitoring: Identifies unusual increases in MAC addresses or abnormal traffic.
VLAN segmentation: Helps limit the area affected by an incident.
MAC address controls: Can provide an additional restriction where appropriate.

MAC flooding does not have one universal software patch. Prevention relies on secure switch configuration, monitoring, and limiting the impact of the attack.

5. ARP Spoofing and ARP Cache Poisoning

The Address Resolution Protocol (ARP) helps devices on an IPv4 local network discover the MAC address associated with an IPv4 address.

ARP does not provide built-in authentication. This creates an opportunity for an attacker to send false ARP information.

How ARP spoofing works

Suppose a computer needs to communicate with its default gateway. It uses ARP to discover the gateway's MAC address.

An attacker on the same local network may send forged ARP messages claiming that the attacker's MAC address belongs to the gateway's IP address.

If the victim accepts the false information, its ARP cache may store an incorrect mapping. This is known as ARP cache poisoning.

Traffic intended for the gateway may then be sent to the attacker's device.

Possible consequences

ARP spoofing and poisoning can lead to:

Denial-of-Service.
Session hijacking.
On-path or man-in-the-middle attacks.
Unauthorised observation or modification of traffic.

Prevention

Useful protective measures include:

Dynamic ARP Inspection on supported switches.
DHCP snooping as a supporting control where appropriate.
Network monitoring and ARP anomaly detection.
Static ARP entries for carefully selected systems where practical.
Network segmentation and controlled access.
Encrypted protocols such as TLS and SSH.
VPNs where appropriate for protecting traffic over untrusted networks.
Regular authorised security testing.

Encryption is particularly important because it can help protect the contents of communications even if traffic is intercepted.

The key exam point is that ARP spoofing targets the relationship between IPv4 addresses and MAC addresses on a local network.

6. DNS Poisoning and DNS Spoofing

The Domain Name System (DNS) translates domain names into information used to locate network services, including IP addresses.

For example, a user enters a website name into a browser. DNS helps the device find the address associated with that name.

DNS poisoning and spoofing attacks attempt to provide false DNS information, potentially redirecting users to malicious systems.

How DNS attacks work

An attacker may manipulate DNS records, responses, or caches so that a legitimate domain name resolves to an incorrect IP address.

A victim may believe they are visiting a trusted website while actually connecting to a malicious server.

Attacks may target DNS servers, client-side caches, or local HOSTS files. In some scenarios, ARP spoofing may also be used to redirect traffic towards an unauthorised DNS server.

DNS poisoning vs DNS spoofing

The terms are sometimes used interchangeably, but they can describe different aspects of an attack.

DNS spoofing: Forging or manipulating DNS responses or information.
DNS cache poisoning: Causing false DNS information to be stored in a resolver's cache so that subsequent requests may receive an incorrect answer.

Prevention

Organisations can reduce DNS attack risks through:

DNS Security Extensions (DNSSEC), where properly deployed and validated.
Secure configuration and patching of DNS servers.
Network monitoring and firewall controls.
Protecting administrative access to DNS infrastructure.
Using HTTPS and checking website certificate warnings.
User awareness training.

DNSSEC helps validate the authenticity and integrity of signed DNS data. It does not encrypt DNS queries or replace HTTPS.

HTTPS helps protect the connection to a website, but users should still pay attention to certificate warnings and unexpected domain names.

The key exam point is that DNS attacks can redirect users by supplying false name-resolution information.

7. Rogue Devices and Services

A rogue device or service is hardware or software operating on a network without appropriate authorisation.

Rogue devices may be introduced accidentally by employees or deliberately by attackers. They can create security weaknesses because they may bypass the organisation's approved controls.

Common examples

Unauthorised wireless access points

An employee may connect a personal wireless router to a corporate network. If poorly secured, it may provide an alternative path into the network.

Rogue DHCP servers

A DHCP server automatically provides network configuration, such as IP addresses and gateway details. An unauthorised DHCP server may supply incorrect settings and redirect traffic.

Rogue DNS servers

An unauthorised DNS server may provide false name-resolution information or direct users towards malicious destinations.

Unmanaged mobile and IoT devices

Personal phones, cameras, smart devices, and other equipment may contain outdated software or weak security settings.

Bring Your Own Device (BYOD) policies can increase these risks if personal devices are allowed to connect without appropriate security checks.

Possible consequences

Rogue devices and services may lead to:

Malware infections.
Data theft.
Unauthorised access.
Traffic interception.
Network disruption.
Insider threats or accidental policy violations.

Prevention and detection

Organisations can use:

Network access control.
Intrusion detection and monitoring tools.
Network discovery and authorised port scanning.
Device authentication.
Regular asset inventories and security audits.
Penetration testing.
Staff awareness and clear BYOD policies.

The key exam point is that rogue devices and services are unauthorised components that may bypass approved network controls.

8. Evil Twin Attacks

An evil twin attack uses a fake wireless access point that imitates a legitimate Wi-Fi network.

Attackers may set up a network with the same or a similar name to a trusted network in a café, hotel, airport, or other public location.

A user may connect to the fake network believing it is genuine.

How an evil twin attack works

An attacker creates a fake Wi-Fi network.
The network uses a name that resembles a legitimate one.
A victim connects to it, potentially because their device automatically joins a familiar network.
The attacker may attempt to intercept traffic, collect credentials, or redirect the user to malicious content.

The extent of access depends on the network setup and the victim's behaviour. Connecting to an evil twin does not automatically mean that all encrypted traffic can be read.

Prevention

Users should:

Verify the correct Wi-Fi network name with the provider.
Avoid entering sensitive information on untrusted networks.
Disable automatic connection to unfamiliar or unnecessary Wi-Fi networks.
Use a personal hotspot for sensitive activity when appropriate.
Use a reputable VPN when protection against local network interception is needed.
Enable multi-factor authentication.
Keep operating systems and security software updated.
Pay attention to browser and certificate warnings.

A VPN can protect traffic between a device and the VPN endpoint, but it does not guarantee safety from phishing, malware, or every form of attack.

The key exam point is that an evil twin is a fraudulent Wi-Fi access point designed to imitate a legitimate network.

9. On-Path Attacks

An on-path attack occurs when an attacker gains a position on the communication path between two parties and can observe or potentially modify their traffic.

It is commonly associated with the broader category of man-in-the-middle attacks.

For example, an attacker may position themselves between a user and a service, allowing them to attempt to intercept communication without the user necessarily realising that the connection has been compromised.

Possible consequences

An on-path attacker may attempt to:

Capture sensitive information.
Observe unprotected communications.
Modify data in transit.
Steal session information.
Redirect users or interfere with transactions.

The attacker's capabilities depend on the protocols, encryption, authentication, and network conditions involved.

Prevention

Organisations and users can reduce risk through:

TLS-protected communications.
Verifying website certificates and investigating certificate warnings.
Secure email protection, such as S/MIME where appropriate.
VPNs for protecting traffic over untrusted networks.
Strong authentication and multi-factor authentication.
Secure Wi-Fi configuration.
Monitoring for unusual network behaviour.

TLS can protect the confidentiality and integrity of data in transit when correctly configured and when authentication is properly validated.

The key exam point is that an on-path attack places the attacker between communicating parties to observe or interfere with their communications.

10. Social Engineering Attacks

Social engineering attacks exploit human behaviour rather than relying solely on technical weaknesses.

An attacker may impersonate a trusted organisation, colleague, manager, bank, or technical support worker to persuade a victim to reveal information or perform an unsafe action.

Common social engineering techniques

Phishing

Fraudulent messages attempt to trick users into clicking malicious links, opening harmful attachments, or revealing sensitive information.

Vishing

Voice phishing uses phone calls or voice messages to deceive victims.

Fake websites

Attackers create websites that resemble legitimate services to steal passwords, payment details, or personal information.

Cloned social media accounts

An attacker may copy another person's profile to impersonate them and request money, sensitive information, or assistance.

Helpdesk fraud

An attacker pretends to be an employee or authorised user and tries to persuade IT support to reset a password, disclose information, or grant access.

How to recognise social engineering

Warning signs include:

Unexpected requests for passwords or verification codes.
Urgent demands to transfer money or change payment details.
Unusual links or attachments.
Requests to bypass normal procedures.
Messages that create fear, pressure, or excitement.
Unexpected requests from familiar contacts using unusual communication channels.

Prevention

The best defence combines user awareness with technical and organisational controls.

Users should verify unusual requests through a trusted channel, avoid sharing passwords or one-time authentication codes, and report suspicious messages.

Organisations should provide regular training, enforce approval procedures for sensitive actions, and use email security controls and multi-factor authentication.

Financial institutions and legitimate service providers may send verification messages through approved channels, so the important lesson is to verify the request using the organisation's official contact details rather than trusting an unsolicited message.

The key exam point is that social engineering manipulates people into compromising security.

11. Common Malware Attacks

Malware is malicious software designed to damage systems, disrupt operations, steal information, spy on users, or provide unauthorised access.

Attackers may use malware for financial gain, espionage, disruption, or extortion.

Common malware types

Virus

A virus attaches itself to a file or program and spreads when the infected content is executed. It commonly requires some form of user or system action to spread.

Worm

A worm can replicate and spread across systems or networks without needing to attach itself to another file in the same way as a traditional virus.

Trojan horse

A Trojan disguises itself as legitimate or useful software. Once installed or executed, it may perform malicious actions.

Ransomware

Ransomware encrypts files or otherwise prevents access to systems and demands payment. Some attackers also steal information and threaten to publish it.

Spyware

Spyware secretly monitors user activity or collects information.

Adware

Adware displays unwanted advertisements. Some forms also track user behaviour or introduce additional security risks.

Bot malware

Bot malware allows an infected device to be controlled remotely. Multiple infected devices may form a botnet, which can be used for activities such as DDoS attacks.

Rootkit

A rootkit is designed to conceal malicious activity or maintain privileged access to a system. Some rootkits are particularly difficult to detect because they attempt to hide their presence.

Common malware delivery methods

Malware may be delivered through:

Malicious email attachments.
Phishing links.
Compromised websites.
Trojan applications.
Exploitation of unpatched vulnerabilities.
Infected removable media.
Compromised devices or network services.

Malware prevention and recovery

Organisations can reduce the risk through:

Updated antimalware and endpoint protection.
Timely security patches.
User education.
Strong access controls.
Network segmentation.
Secure email and web filtering.
Regular security audits.
Tested backups stored with appropriate protection.

Backups are particularly important for recovery from ransomware and other destructive attacks. They should be protected from unauthorised modification and periodically tested to confirm that restoration works.

The key exam point is to recognise malware by its behaviour and understand that different malware types have different purposes.

12. Quick Comparison Table

Attack	What it targets	Typical impact	Main defensive approach
DoS	Service or device availability	Service becomes unavailable	Traffic monitoring, filtering, and resilience measures
DDoS	Availability using multiple systems	Large-scale service disruption	DDoS protection, traffic analysis, and filtering
VLAN hopping	VLAN separation and switch configuration	Unauthorised access across VLANs	Secure trunk configuration and VLAN controls
MAC flooding	Switch MAC address table	Traffic flooding and possible exposure	Port security and monitoring
ARP spoofing	IPv4-to-MAC address mappings	Traffic interception or redirection	Dynamic ARP Inspection and encrypted protocols
DNS poisoning	DNS records or caches	Users redirected to incorrect destinations	DNSSEC validation and secure DNS administration
Rogue devices	Unauthorised hardware or services	Uncontrolled network access	NAC, asset inventories, and monitoring
Evil twin	Wireless network trust	Fake Wi-Fi connection and potential interception	Verify networks, disable auto-connect, and use appropriate encryption
On-path	Communication between two parties	Interception or modification of traffic	TLS, certificate validation, and secure connections
Social engineering	Human behaviour and trust	Credential theft or unauthorised actions	Awareness training and independent verification
Malware	Devices, files, and systems	Data theft, disruption, spying, or extortion	Patching, endpoint protection, access control, and backups

13. Practical Scenario

Imagine a company experiences several security incidents.

An employee reports that the company website is unavailable because of an overwhelming volume of traffic. This may indicate a DoS or DDoS attack.

Another employee discovers that a device connected to the wrong VLAN can access resources it should not reach. The security team should investigate possible VLAN hopping and switch misconfiguration.

Network monitoring then detects many unfamiliar MAC addresses on a switch port. This may indicate MAC flooding.

Separately, staff report that a familiar website is directing them to an unexpected address. The team should investigate DNS resolution, DNS cache poisoning, and other possible redirection methods.

Finally, an employee receives a message from someone claiming to be IT support and asking for their password. This is a potential social engineering attempt.

Each incident requires the organisation to identify the attack, investigate the cause, contain the risk, and apply suitable corrective controls.

The important skill is matching the observed symptoms to the likely attack type without assuming that one symptom always proves a particular attack.

14. Exam Revision: Key Points to Remember

Before taking the CompTIA Network+ N10-009 course test, review these points:

DoS: Attempts to make a service unavailable.
DDoS: Uses multiple systems to attack a target.
Volumetric attack: Consumes bandwidth.
TCP state exhaustion: Consumes resources associated with connection states.
VLAN hopping: Attempts to cross VLAN boundaries through techniques such as double tagging or switch spoofing.
MAC flooding: Fills a switch's MAC address table with fabricated addresses.
ARP spoofing: Sends false IP-to-MAC mappings on a local IPv4 network.
DNS poisoning: Causes false DNS information to be used or cached.
Rogue device: Unauthorised hardware or service on a network.
Evil twin: A fake Wi-Fi network imitating a legitimate one.
On-path attack: An attacker positions themselves in the communication path.
Social engineering: Manipulates people into revealing information or taking unsafe actions.
Virus: Typically attaches to a file or program.
Worm: Can replicate and spread independently.
Trojan: Disguises itself as legitimate software.
Ransomware: Denies access to data or systems, commonly through encryption or other forms of extortion.
Spyware: Secretly collects information or monitors activity.
Bot malware: Enables remote control of an infected device.
Rootkit: Helps conceal malicious activity or maintain privileged access.

15. Conclusion

Common network attacks exploit weaknesses in availability, network configuration, address resolution, wireless trust, communication protocols, devices, software, and human behaviour.

Network professionals need to recognise the signs of these attacks and understand which controls are appropriate. Secure configurations, network segmentation, access control, encryption, patching, monitoring, staff awareness, and reliable backups all help reduce risk.

For the CompTIA Network+ exam, focus on identifying each attack from a scenario, understanding its target and likely impact, and selecting the most suitable mitigation. This will help you apply the concepts in practical network security situations.

CompTIA Network+: Network Security Concepts & Solutions

Falade Timilehin — Tue, 20 Oct 2026 10:21:38 +0000

1. Introduction

Network security protects an organisation's data, devices, applications, and network infrastructure from unauthorised access, misuse, and cyberattacks.

The main goals of network security are confidentiality, integrity, and availability. These are known as the CIA triad and form the foundation of information security.

Network security combines logical controls, physical protection, monitoring, access management, encryption, and compliance. Organisations must protect both their digital systems and the physical environments in which those systems operate.

This article covers the key concepts from the CompTIA Network+ course, including logical security, physical security controls, deception technologies, compliance, network segmentation, device hardening, network access control, key management, filtering rules, and security zones.

2. Logical Security Concepts

Logical security uses software, configurations, policies, and technical controls to protect network resources and information.

Encryption

Encryption converts readable information, known as plaintext, into unreadable information called ciphertext. A cipher and cryptographic key are used to perform the process.

Encryption helps protect sensitive information from people who are not authorised to access it.

There are two main types of encryption.

Symmetric encryption

Symmetric encryption uses the same key to encrypt and decrypt information. It is generally efficient for protecting large amounts of data. However, the key must be shared securely between the parties that need to communicate.

Asymmetric encryption

Asymmetric encryption uses a pair of related keys: a public key and a private key. The public key can be shared, while the private key must remain secret.

Asymmetric cryptography can support secure key exchange and identity verification. It is generally more computationally expensive than symmetric encryption.

How HTTPS uses encryption

HTTPS protects communication between a browser and a website using TLS.

During the TLS handshake, the parties establish the parameters needed for a secure connection and authenticate the server using its certificate. Modern TLS commonly uses asymmetric cryptography for authentication and key establishment, then symmetric encryption to protect the session data.

This combination provides security while maintaining good performance.

Identity and Access Management (IAM)

Identity and Access Management controls who can access systems and what they are permitted to do.

IAM commonly involves:

Authentication: Verifying a user's identity.
Authorisation: Determining what an authenticated user can access.
Access permissions: Defining which resources and actions are allowed.
Access management: Controlling and reviewing access to systems and information.

For example, an employee may be permitted to view customer records but not change payment details. IAM helps enforce these permissions.

3. Physical Security Controls

Physical security protects buildings, equipment, network devices, servers, and other assets against unauthorised physical access.

Logical security protects digital resources, while physical security helps prevent people from reaching or damaging those resources directly.

Common physical security controls

Fences and gates

Fences define boundaries around a site. Gates control entry and exit. Their effectiveness depends on their design, construction, placement, and access procedures.

Bollards

Bollards restrict vehicle access to protected areas. They may be fixed or retractable. Some retractable systems use sensors or other mechanisms to control movement.

Access control vestibules and mantraps

These systems use controlled doors to manage entry. A mantrap typically requires one door to close before another opens, helping prevent unauthorised people from following an authorised person into a secure area.

Access badges and cards

Badges and cards identify authorised personnel and allow access to approved areas. Organisations should monitor their use and prevent tailgating, which occurs when an unauthorised person follows someone through a controlled entrance.

Security guards

Security guards can deter unauthorised access, monitor activity, check credentials, and respond to incidents. Their effectiveness depends on suitable recruitment, training, supervision, and procedures.

Physical security is strongest when multiple controls work together rather than relying on a single measure.

4. Security Deception Technologies

Security deception technologies create decoys that attract potential attackers away from genuine systems or help security teams observe malicious activity.

Honeypots

A honeypot is a deliberately exposed or simulated system designed to attract attackers. It can help an organisation observe attack methods, identify suspicious behaviour, and improve its security controls.

Honeypots should be isolated and carefully monitored so that an attacker cannot use them to reach production systems.

There are several types.

Low-interaction honeypot: Simulates limited services or behaviours. It is often easier to deploy and maintain, but provides less information about complex attacks.
High-interaction honeypot: Provides a more realistic environment in which attackers can interact with systems. It can reveal more detailed behaviour but requires stronger isolation and monitoring.
Specialised honeypots: Target particular threats or services, such as email systems, malware activity, or databases.

Honeynets

A honeynet is a collection of honeypots arranged to resemble a network or broader computing environment.

It allows security teams to observe how attackers interact with multiple systems and services.

Honeywalls and bait data

A honeywall is a monitoring and control mechanism used in some honeynet designs. It helps observe and control traffic entering or leaving the decoy environment.

Bait data consists of decoy information designed to attract attention or reveal unauthorised access attempts.

The purpose of deception technology is to improve threat detection and gather intelligence. It should complement, not replace, normal security controls.

5. Common Security Terminology

Understanding common security terms helps network professionals identify threats and select appropriate protections.

Risk

Risk is the possibility that an event will negatively affect systems, information, or business operations.

Risk assessment considers the likelihood of an event and the consequences if it occurs. Organisations use this information to decide which security controls are necessary.

Vulnerability

A vulnerability is a weakness in software, hardware, configuration, or a process that could be exploited.

Examples include outdated software, weak passwords, unnecessary open ports, and incorrect access permissions.

Exploit

An exploit takes advantage of a vulnerability to perform an unauthorised or harmful action.

Applying security patches promptly, removing unnecessary services, and maintaining secure configurations can reduce exposure to known exploits.

Zero-day exploit

A zero-day exploit targets a vulnerability for which an effective patch or fix may not yet be available to the affected organisation. These vulnerabilities can be difficult to defend against because normal patching may not immediately resolve the issue.

Social engineering

Social engineering manipulates people into revealing information, granting access, or performing actions that compromise security.

Examples include phishing messages, impersonation, and fraudulent requests for credentials.

Organisations can reduce social engineering risks through staff awareness training, clear verification procedures, and appropriate technical controls.

The CIA triad

The CIA triad describes three essential security objectives.

Principle	Meaning	Example
Confidentiality	Information is accessible only to authorised people or systems.	Encrypting sensitive customer records.
Integrity	Information remains accurate and is not changed without authorisation.	Using permissions and integrity checks to protect records.
Availability	Systems and information remain accessible when needed.	Using backups and resilient infrastructure.

A strong security strategy balances all three principles.

6. Compliance and Auditing

Organisations often have legal, regulatory, contractual, and industry obligations to protect information and demonstrate that appropriate security controls are in place.

Compliance involves following applicable requirements and maintaining evidence that the organisation is meeting them.

Important compliance activities

Documented policies: Written security policies explain expected behaviour, responsibilities, and required controls.

Defined roles: Employees and teams should understand who is responsible for security decisions, system administration, incident response, and data protection.

Security protocols: Procedures define how systems are protected, how access is managed, and how incidents are handled.

Employee training: Staff need to understand common threats, secure working practices, and their responsibilities.

Continuous monitoring: Monitoring helps identify suspicious activity, weaknesses, and potential policy violations.

Regular audits: Audits examine whether controls are designed appropriately and operating as intended.

Internal and external audits

Internal audits help an organisation review its own security arrangements and identify areas for improvement.

External audits provide an independent assessment and may identify issues that internal teams have overlooked. They can also provide evidence for customers, regulators, or other interested parties.

Examples of security standards and regulations

PCI DSS: A security standard for organisations that store, process, or transmit payment card data.
GDPR: A legal framework governing the processing and protection of personal data within its scope, including individuals' rights and organisational responsibilities.

Compliance requirements vary by organisation, sector, jurisdiction, and the type of data involved. Organisations should identify which requirements apply to their activities.

7. Network Segmentation and Enforcement

Network segmentation divides a network into smaller sections to control communication and limit unnecessary access.

Without effective segmentation, a compromised device may provide an attacker with a path to other systems on the same network.

Physical segmentation

Physical segmentation separates networks using distinct physical infrastructure or network devices.

It can provide strong separation, but may require additional equipment, cabling, and administration.

Logical segmentation

Logical segmentation separates networks using configurations on shared infrastructure. Virtual Local Area Networks (VLANs) are a common example.

VLANs allow devices to be grouped logically, even when they connect through the same physical switches. Traffic between VLANs can be controlled using routing rules, access control lists, and firewalls.

Microsegmentation

Microsegmentation applies more granular controls to communication between workloads, applications, or individual systems.

It can limit which services are allowed to communicate with one another, reducing the potential spread of an attack.

Benefits of segmentation

Segmentation can:

Limit unauthorised access between network areas.
Reduce the spread of malware and other attacks.
Separate sensitive systems from general user devices.
Improve traffic management.
Help protect Internet of Things (IoT) devices.
Isolate Bring Your Own Device (BYOD) connections.
Separate industrial control systems from corporate networks.
Reduce the scope of systems that must meet particular compliance requirements.

Segmentation is effective only when the organisation also controls the traffic that crosses segment boundaries.

8. Device Hardening Techniques

Device hardening reduces the number of weaknesses that attackers could exploit on network equipment, servers, computers, and other devices.

The goal is to configure each device securely and remove unnecessary features that increase risk.

Change default credentials

Default usernames and passwords are often publicly known. Administrators should replace default credentials with strong, unique passwords and apply appropriate controls to privileged accounts.

Multi-factor authentication should be used where supported and appropriate.

Use secure management protocols

Administrators should use secure protocols to manage network devices.

For example, Secure Shell (SSH) encrypts remote command-line sessions. Telnet does not encrypt its session traffic, so credentials and commands can be exposed to anyone able to intercept the connection.

Disable unnecessary ports and services

Open ports and running services can create additional attack opportunities. Administrators should identify which services are required and disable those that are unnecessary.

This reduces the device's attack surface.

Update or disable outdated protocols

Outdated protocols may contain known security weaknesses. Administrators should assess their use and replace or disable insecure options where possible.

Standardise configurations

Organisations can create secure baseline configurations for devices of the same type or role. These standard builds help maintain consistency across the network.

Document and centrally manage configurations

Configuration records help administrators understand how devices should operate and support troubleshooting, auditing, and recovery.

Centralised management tools can help apply updates and security settings consistently across multiple devices.

Device hardening should be an ongoing process. New vulnerabilities, software updates, and changing business requirements may require further adjustments.

9. Network Access Control (NAC) Solutions

Network Access Control helps determine which devices can connect to a network and under what conditions.

NAC can use device identity, authentication, security policies, and other information to control access.

Port security

Switch port security restricts which devices can connect through a switch port. One common method is to limit the MAC addresses permitted on a port.

This can help prevent unauthorised devices from connecting through an unused or restricted port.

However, MAC addresses can be spoofed, so port security should not be treated as a complete security solution.

IEEE 802.1X

802.1X provides port-based network access control. A device must complete an authentication process before receiving normal network access.

A typical arrangement involves:

Supplicant: The client or device requesting access.
Authenticator: The network device, such as a switch or wireless access point, that controls access.
Authentication server: Commonly a RADIUS server, which validates credentials or authentication information.

This approach is widely used in enterprise wired and wireless networks.

MAC filtering

MAC filtering allows or denies network access based on a device's MAC address.

It can provide a basic access restriction, but it is not strong authentication on its own because MAC addresses can be copied or spoofed.

Wireless security

WPA3 provides modern wireless security capabilities and should be used where supported and appropriate.

MAC filtering should not replace strong wireless encryption and authentication. Organisations should combine suitable wireless security with firewalls, endpoint protection, VPNs where required, and other access controls.

10. Key Management Concepts

Cryptographic keys are essential to encryption, decryption, and some authentication processes. If keys are exposed, lost, or poorly managed, the security of the systems that rely on them may be compromised.

Key management covers the secure handling of keys throughout their life cycle.

Symmetric and asymmetric keys

Feature	Symmetric cryptography	Asymmetric cryptography
Keys used	One shared secret key.	A public and private key pair.
Main strength	Efficient for encrypting large amounts of data.	Supports public-key-based authentication and key establishment.
Main challenge	The secret key must be shared and protected securely.	Private keys must be protected, and the operations are generally more computationally expensive.
Typical use	Protecting data and secure communication sessions.	Certificates, digital signatures, authentication, and key establishment.

Modern secure communication often combines both approaches. Asymmetric cryptography helps establish trust or session keys, while symmetric cryptography efficiently protects the session data.

Key management life cycle

Good key management includes:

Secure generation: Keys must be created using appropriate cryptographic methods.

Secure storage: Keys should be protected against unauthorised access and theft.

Access control: Only authorised users, services, or systems should be able to use particular keys.

Key rotation: Keys may need to be replaced periodically or when compromise is suspected, according to the applicable policy.

Revocation and retirement: Keys that are compromised, expired, or no longer needed should be handled appropriately.

Backup and recovery: Where required, keys must be recoverable through secure procedures without exposing them unnecessarily.

Hardware Security Modules (HSMs)

A Hardware Security Module is a specialised device used to protect and manage cryptographic keys and perform certain cryptographic operations.

HSMs can help prevent sensitive keys from being exposed to ordinary applications or users.

Key management should be treated as a critical part of security, not simply as a one-time encryption setup.

11. Network Security Rules

Network security rules determine which users, devices, applications, and types of traffic are permitted or blocked.

These controls help organisations enforce security policies and reduce exposure to malicious or inappropriate content.

Access Control Lists (ACLs)

An Access Control List is a set of rules that allows or denies access to resources or traffic based on defined criteria.

Network ACLs can filter traffic using information such as source and destination addresses, protocols, and ports. Other ACLs can control access to files or other resources.

ACLs should be designed carefully. Rules that are too broad may permit unwanted access, while incorrect rules may block legitimate services.

URL filtering

URL filtering controls access to websites and web addresses.

Depending on the implementation, an organisation may block known malicious sites, restrict categories of websites, or permit only approved destinations.

Content filtering

Content filtering examines information or traffic to identify and block material that violates security policies.

Examples include blocking malicious downloads, harmful email attachments, or prohibited content.

Other filtering approaches

DNS filtering: Blocks or redirects requests for specified domain names, including domains associated with known threats.
Email filtering: Detects or blocks spam, phishing messages, malicious links, and harmful attachments.
Search engine filtering: Restricts certain search results or content categories.
Proxy filtering: Uses a proxy service to apply web access policies and inspect or control requests, depending on its configuration.

Centralised filtering tools can help organisations apply consistent policies across devices and servers.

Filtering is most effective when combined with endpoint protection, user awareness, access control, and monitoring.

12. Network Security Zones

Network security zones group systems and interfaces according to their trust level and security requirements. Firewalls and other controls regulate communication between the zones.

A common design uses three zones: the trusted internal network, the demilitarised zone (DMZ), and the untrusted external network.

Trusted internal network

This zone contains internal systems and services that require protection from external threats. Examples include employee workstations, internal applications, and business databases.

Being inside the trusted network does not mean that every device should automatically be trusted. Internal access should still follow security policies and least-privilege principles.

Demilitarised zone (DMZ)

A DMZ contains public-facing systems that must communicate with external users while remaining separated from the internal network.

Examples include public web servers, reverse proxies, and certain externally accessible services.

The DMZ acts as a controlled buffer between the Internet and the internal network. Firewall rules should restrict which connections are allowed into and out of the zone.

For example, a public web server may accept approved web traffic from the Internet but should not have unrestricted access to internal databases.

Untrusted external network

The external zone typically represents the Internet or other networks that the organisation does not control.

Traffic from this zone must be treated according to the organisation's security policies rather than being trusted by default.

Firewalls and three-zone designs

A firewall controls traffic according to configured rules. In a three-zone design, a firewall may have separate interfaces for the internal network, DMZ, and external network. A firewall with three network interfaces is sometimes described as a three-legged or triple-homed firewall.

Its rules determine which traffic can pass between zones.

A secure design should apply only the access required for legitimate business purposes. A DMZ should not be treated as a reason to allow unrestricted communication with internal systems.

13. Quick Comparison Table

Technology or control	Main purpose	Key point to remember
Symmetric encryption	Protects data using one shared secret key.	Same key encrypts and decrypts.
Asymmetric encryption	Supports public-key cryptography.	Uses a public and private key pair.
IAM	Controls identity, authentication, and permissions.	Determines who can access what.
Mantrap	Controls physical entry through secured doors.	Helps prevent unauthorised following.
Honeypot	Attracts and observes potential attackers.	A decoy system.
Honeynet	Provides multiple connected decoy systems.	A decoy network.
CIA triad	Defines core security objectives.	Confidentiality, integrity, availability.
PCI DSS	Protects payment card data.	Payment card security standard.
GDPR	Regulates personal data processing within its scope.	Personal data protection and rights.
VLAN	Logically separates network traffic.	Network segmentation.
Microsegmentation	Applies fine-grained controls between workloads or services.	Limits lateral movement.
SSH	Provides secure remote command-line management.	Prefer it over Telnet.
Port security	Restricts devices on switch ports.	May limit allowed MAC addresses.
802.1X	Provides port-based network access authentication.	Commonly works with RADIUS.
MAC filtering	Allows or denies devices by MAC address.	MAC addresses can be spoofed.
HSM	Protects cryptographic keys and performs cryptographic operations.	Specialised hardware for key security.
ACL	Allows or denies access or traffic according to rules.	Rule-based access control.
DNS filtering	Controls access using domain-name requests.	Can block known malicious domains.
DMZ	Separates public-facing services from internal systems.	A controlled buffer zone.
Firewall	Controls traffic between networks or zones.	Enforces traffic rules.

14. Practical Scenario

A company hosts a public website, stores customer records internally, and allows employees to connect remotely.

A business-minded network administrator could apply the course concepts as follows:

Protect communication: Use HTTPS with modern TLS to secure connections to the website.
Control access: Use IAM to ensure employees have only the permissions required for their roles.
Protect the building: Use badges, controlled entrances, and other physical security measures to restrict access to server equipment.
Separate systems: Place the public website in a DMZ and restrict its connections to the internal network.
Harden devices: Change default passwords, disable unnecessary services, apply patches, and use SSH for secure administration.
Control network access: Use appropriate NAC measures, such as 802.1X, where supported.
Protect cryptographic keys: Store and manage keys securely, applying access controls and rotation policies.
Filter threats: Apply suitable DNS, email, URL, and network traffic filtering.
Monitor threats: Use monitoring and, where appropriate, carefully isolated deception technologies to identify suspicious activity.
Maintain compliance: Document policies, train staff, monitor controls, and conduct appropriate audits.

These controls work together. No single technology provides complete protection.

15. Exam Revision: Key Points to Remember

Before taking the CompTIA Network+ N10-009 course test, review the following:

Encryption converts plaintext into ciphertext using a cipher and key.
Symmetric encryption uses one shared key. Asymmetric cryptography uses a public and private key pair.
HTTPS uses TLS to protect communication. Modern TLS combines asymmetric cryptography with symmetric session encryption.
IAM manages identities, authentication, and permissions.
Physical security includes fences, gates, bollards, mantraps, access badges, and security guards.
A honeypot is a decoy system. A honeynet is a network of decoy systems.
Risk concerns potential adverse outcomes. A vulnerability is a weakness, and an exploit takes advantage of a weakness.
Zero-day exploits target vulnerabilities for which an effective fix may not yet be available.
The CIA triad means confidentiality, integrity, and availability.
PCI DSS relates to payment card data security. GDPR governs personal data processing within its scope.
Segmentation separates networks or workloads to limit access and contain attacks.
Device hardening includes changing default passwords, disabling unnecessary services, patching systems, and using secure management protocols.
Port security may limit MAC addresses on switch ports. MAC filtering alone is not strong authentication.
802.1X provides port-based network access control and commonly uses RADIUS for authentication.
Key management includes secure generation, storage, access control, rotation, and retirement.
ACLs regulate access or traffic. URL, DNS, email, and content filters apply different types of restrictions.
A DMZ hosts public-facing services while helping protect the internal network.
Firewalls enforce rules that control traffic between security zones.

16. Conclusion

Network Security Concepts and Solutions brings together the technologies, policies, and physical controls that organisations use to protect their networks.

The most important lesson is that security requires several layers of protection. Encryption protects information, IAM and NAC control access, segmentation limits communication, device hardening reduces weaknesses, and firewalls enforce rules between network zones. Physical security, monitoring, key management, staff training, and compliance support these technical controls.

For the Network+ exam, focus on understanding what each control does, where it is used, and how it differs from similar technologies. Being able to recognise the right control for a practical scenario is just as important as memorising definitions.

BABOK® Guide v3: Strategy Analysis

Falade Timilehin — Thu, 15 Oct 2026 15:16:32 +0000

1. Introduction

Strategy Analysis is a key knowledge area in the Business Analysis Body of Knowledge (BABOK®) Guide version 3, published by the International Institute of Business Analysis (IIBA). It focuses on understanding business needs, examining the current state of an organisation, defining a desired future state, assessing risks and recommending an appropriate change strategy.

The main purpose of Strategy Analysis is to help an organisation understand why change is necessary, what the change should achieve and how the organisation should move from its current position to its desired future state.

Business analysts use strategic thinking, critical analysis and stakeholder collaboration to ensure proposed changes align with business objectives. They also assess whether an organisation has the capabilities, resources and readiness required to achieve its goals.

Strategy Analysis applies to strategic and tactical initiatives. These include digital transformation, process improvement, software implementation, regulatory compliance, cost reduction and improvements to customer experience.

2. The Strategy Analysis Knowledge Area

Strategy Analysis helps business analysts understand the context behind a business need and identify suitable approaches to addressing it.

An organisation might experience declining revenue, inefficient processes, outdated technology, customer dissatisfaction or new regulatory requirements. Before recommending a solution, the business analyst must understand the underlying problem and the results the organisation wants to achieve.

The Strategy Analysis Knowledge Area consists of four main tasks:

Analyse Current State.
Define Future State.
Assess Risks.
Define Change Strategy.

These tasks are connected. Understanding the current state provides the foundation for defining the future state. Comparing both states reveals gaps and potential changes. Risk assessment identifies factors that might prevent success. The change strategy then outlines how the organisation should achieve the desired outcomes.

The business analyst works with stakeholders throughout this process to validate assumptions, evaluate options and maintain alignment with business objectives.

3. Strategy Analysis Core Concepts

Several core concepts support Strategy Analysis.

Business Need

A business need is a problem or opportunity requiring attention. It explains why an organisation needs to make a change.

Examples include:

Reducing operational costs.
Improving customer satisfaction.
Increasing revenue.
Meeting new legal or regulatory requirements.
Replacing outdated systems.
Improving the accuracy of business information.

The business analyst investigates the underlying need rather than immediately assuming a particular solution is required.

For example, a company might request a new customer relationship management system because staff struggle to access customer information. Investigation might reveal that the main issue is poor data quality and inconsistent processes. The organisation might therefore need process improvements and better data management rather than a complete system replacement.

Current State

The current state describes how an organisation operates today. It includes people, processes, technology, information, resources, policies, organisational culture and external influences.

Understanding the current state helps identify existing capabilities, limitations, problems and opportunities.

Future State

The future state describes the desired conditions after a change. It explains what the organisation wants to achieve and how success will be measured.

A future state should reflect business objectives, stakeholder needs, available resources and relevant constraints.

Change

A change is the transformation required to move from the current state towards the future state.

Changes might affect organisational structures, employee responsibilities, business processes, technology, policies or customer interactions.

Solution Scope

Solution scope describes the capabilities and boundaries of a proposed solution. It identifies what the solution is intended to address and helps distinguish included work from activities outside the agreed scope.

Value

Value refers to the worth, importance or usefulness of something to a stakeholder within a particular context. Value might include financial returns, improved efficiency, reduced risk, better customer experience or stronger regulatory compliance.

Context

Context includes the circumstances and external factors influencing a change. Examples include market conditions, legislation, competition, technology trends and organisational culture.

4. Analysing the Current State

Analysing the Current State is the process of examining an organisation's existing environment to understand its capabilities and determine why change is needed.

The business analyst investigates the organisation's internal operations and external environment. This helps establish a reliable baseline for future decisions.

Key areas of analysis

Organisational structure: Understand reporting relationships, responsibilities, decision-making authority and communication channels.

Business processes: Examine how work is completed, where delays occur and whether unnecessary steps or duplicated activities exist.

People and capabilities: Assess employee skills, knowledge, experience and readiness to adopt new ways of working.

Technology and infrastructure: Review existing systems, applications, integrations, data quality and technical limitations.

Policies and regulations: Identify internal policies, contractual obligations, legal requirements and compliance constraints.

Organisational culture: Consider attitudes towards change, leadership support, collaboration and established working practices.

External environment: Examine competition, economic conditions, customer expectations, technological developments and industry regulations.

Why current state analysis matters

Without a clear understanding of the current state, an organisation risks investing in a solution that fails to address the real problem.

For example, if a company experiences delays in supplier payments, the business analyst should examine the invoice submission process, approval responsibilities, finance systems and payment controls. This investigation might reveal that delays result from unclear approval limits rather than insufficient software.

Outputs of current state analysis

The analysis provides a documented understanding of the current environment, existing capabilities, identified problems, business needs, constraints and opportunities for improvement.

These findings inform the definition of the future state.

5. Tools and Techniques for Analysing the Current State

Business analysts select techniques according to the problem, available information, stakeholders and delivery approach.

Interviews

Interviews allow the analyst to gather detailed information from stakeholders about their experiences, concerns and expectations.

Workshops

Workshops bring stakeholders together to discuss processes, identify problems and agree on priorities. They are particularly useful when several departments have different perspectives.

Document analysis

The analyst reviews existing policies, process documents, reports, system specifications and performance records to understand how the organisation operates.

Process modelling

Process modelling represents the steps, decisions and interactions involved in a business process. It helps identify bottlenecks, duplicated work and unnecessary hand-offs.

SWOT analysis

SWOT examines strengths, weaknesses, opportunities and threats. It supports an understanding of internal capabilities and external influences.

Root-cause analysis

Root-cause analysis investigates why a problem occurs rather than focusing only on its visible symptoms. Techniques include the Five Whys and fishbone diagrams.

Data analysis

Data analysis helps establish baselines, identify patterns and quantify the impact of existing problems.

Stakeholder analysis

Stakeholder analysis identifies people and groups affected by a change, their interests, their influence and their information needs.

The analyst combines these techniques where appropriate and validates findings with subject matter experts, end users, managers and other relevant stakeholders.

6. Defining the Future State

Defining the Future State involves describing the desired outcomes of a change and establishing what the organisation needs to achieve.

The business analyst considers business objectives, stakeholder needs, available capabilities, constraints, assumptions, dependencies and the value expected from the proposed change.

The future state must be sufficiently clear to guide decisions about solution scope, requirements and implementation.

Setting SMART objectives

SMART objectives are:

Specific: Clearly describe the intended outcome.
Measurable: Identify how progress or success will be measured.
Achievable: Reflect available capabilities and resources.
Relevant: Support the organisation's business objectives.
Time-bound: Include a defined timeframe.

For example, instead of stating, "Improve invoice processing", an organisation might set the objective, "Reduce average invoice approval time from five working days to two working days within six months."

The second objective provides a measurable target and a deadline.

Defining future capabilities

The analyst identifies the capabilities required to achieve the future state. These might include automated workflows, improved reporting, revised policies, staff training, new technology or changes to organisational responsibilities.

Considering constraints

Constraints limit the available options. They might include budgets, deadlines, regulatory requirements, technical limitations, staff capacity or contractual commitments.

Evaluating potential value

The analyst considers expected benefits against implementation costs, ongoing operational costs, risks and opportunity costs.

Opportunity cost refers to the value of the best alternative forgone when an organisation chooses one option over another.

Outputs of future state definition

The outputs include future-state objectives, desired outcomes, relevant measures, required capabilities, assumptions, constraints, dependencies, potential value and an understanding of the solution scope.

7. Tools and Techniques for Defining the Future State

Several techniques help business analysts describe and evaluate the desired future state.

Benchmarking

Benchmarking compares performance, processes or capabilities against relevant industry standards, competitors or recognised best practices.

Business process modelling

The analyst models the proposed future process to show how activities, decisions and responsibilities should work after the change.

SWOT analysis

SWOT can also support future-state definition by identifying opportunities to build on strengths, address weaknesses and respond to threats.

Balanced measures and KPIs

Key performance indicators (KPIs) help the organisation monitor whether the change produces the intended results.

Examples include:

Average processing time.
Cost per transaction.
Customer satisfaction scores.
Error rates.
Percentage of requests completed within service targets.

Stakeholder collaboration

Stakeholders validate whether the proposed future state is realistic, useful and consistent with business objectives.

Gap analysis

Gap analysis compares the current state with the desired future state. It identifies the differences the organisation must address.

For example, if the future state requires automated approval notifications but the current system relies on manual emails, the gap might involve workflow automation, system integration, revised responsibilities and staff training.

8. Assessing Risks

Assessing Risks involves identifying and evaluating uncertainties that might affect the organisation's ability to achieve its objectives.

A risk represents the possibility of an event or condition affecting an outcome. Risks might arise from assumptions, constraints, dependencies, technology, people, external factors or the proposed change itself.

Types of business risks

Operational risks: Disruption to daily activities, staff shortages or process failures.

Financial risks: Unexpected costs, reduced returns or budget overruns.

Technology risks: System failures, integration difficulties, cybersecurity incidents or data migration problems.

Regulatory risks: Failure to comply with relevant legislation, standards or contractual requirements.

People and adoption risks: Employee resistance, insufficient training or limited stakeholder engagement.

Delivery risks: Delays, resource constraints, dependencies and changing requirements.

Reputational risks: Loss of customer confidence or damage to the organisation's reputation.

Risk assessment process

The analyst identifies risks, evaluates their likelihood and impact, prioritises them and works with stakeholders to determine suitable responses.

A risk register helps record each risk, its cause, potential consequences, owner, assessment and planned response.

A simple risk matrix classifies risks according to likelihood and impact. High-likelihood, high-impact risks generally require greater attention than low-priority risks.

Risk attitudes

Organisations differ in their attitudes towards risk.

Risk-seeking organisations are willing to accept greater uncertainty in pursuit of potential benefits.

Risk-neutral organisations evaluate risks and benefits without a strong preference for either higher or lower risk.

Risk-averse organisations prefer to minimise uncertainty and avoid exposures they consider unacceptable.

These attitudes influence decisions about investment, technology, implementation and change.

Risk response strategies

Possible responses include:

Avoiding a risk by changing the proposed approach.
Mitigating a risk by reducing its likelihood or impact.
Accepting a risk where the organisation considers the exposure tolerable.
Transferring or sharing aspects of a risk through suitable contractual or other arrangements.
Pursuing an opportunity where the potential benefits justify the associated uncertainty.

The appropriate response depends on the risk, the organisation's risk tolerance and the expected value of the change.

9. Defining the Change Strategy

Defining the Change Strategy involves determining the most appropriate approach for moving from the current state to the desired future state.

The business analyst uses the findings from current state analysis, future state definition and risk assessment to evaluate available options.

The strategy should explain what needs to change, why the change is required and how the organisation intends to achieve the desired outcomes.

Factors influencing the change strategy

Business objectives: The proposed strategy must support the organisation's priorities.

Organisational readiness: The analyst considers whether people, processes and technology are ready for the change.

Costs and benefits: Options are evaluated against implementation costs, operational expenses and expected value.

Risk: The analyst considers potential negative consequences and how the organisation will manage them.

Stakeholder impact: The strategy accounts for changes to responsibilities, working practices and customer interactions.

Dependencies: The analyst identifies activities, systems, decisions or resources that must be available before implementation.

Transition requirements: The organisation might need training, data migration, parallel operations, phased deployment or temporary workarounds.

Choosing an implementation approach

A business analyst might recommend a phased implementation when a large change creates substantial operational risk. A pilot might be appropriate when assumptions need testing before wider deployment. A direct transition might suit a smaller change with limited disruption and well-understood requirements.

The analyst presents options and supporting evidence to the appropriate decision-makers. The business analyst supports the decision but does not automatically own every strategic or investment decision.

Change strategy and solution scope

The change strategy explains the proposed route towards the future state. Solution scope describes the capabilities and boundaries of the solution intended to address the business need.

Both must be communicated clearly to stakeholders to maintain a shared understanding of the intended change.

10. Practical Business Case Study

Consider a company experiencing long delays in approving employee expenses.

Current state

Employees submit expenses through email. Managers approve requests manually, and finance staff enter details into a separate spreadsheet. Receipts are sometimes missing, approval responsibilities are unclear and employees frequently ask finance for updates.

The business analyst gathers information from employees, managers and finance staff. The analyst reviews processing times, maps the current workflow and identifies duplicated data entry and unclear approval rules.

Future state

The company wants a controlled expense management process with digital submissions, receipt uploads, defined approval limits and clear status tracking.

The business objective is to reduce average approval time from five working days to two working days within six months.

Risk assessment

The analyst identifies potential risks, including staff resistance, inaccurate migrated data, system integration problems and unauthorised approvals.

The team proposes staff training, data validation, access controls, testing and a pilot implementation.

Change strategy

The analyst compares the available options, including improving the existing process, configuring an existing platform or implementing a new system.

The preferred approach is selected based on cost, feasibility, risk, expected benefits and alignment with business objectives.

The implementation begins with a pilot involving one department. The team gathers feedback, resolves problems and measures results before expanding the solution.

Measuring success

The company compares post-implementation performance against its baseline. Measures include average approval time, missing receipts, processing errors, overdue requests and user satisfaction.

This case study demonstrates how current state analysis, future state definition, risk assessment and change strategy work together.

11. The Role of the Business Analyst in Strategy Analysis

The business analyst helps an organisation make informed decisions by connecting business needs with practical change options.

Key responsibilities include:

Identifying and clarifying business needs.
Analysing the current operating environment.
Engaging stakeholders and validating findings.
Defining measurable future-state objectives.
Identifying gaps between current and desired capabilities.
Assessing risks, assumptions, constraints and dependencies.
Evaluating alternative change approaches.
Communicating recommendations and their implications.
Supporting alignment between business objectives, requirements and solution scope.
Helping define measures for evaluating the value of change.

The analyst also needs strong communication, critical thinking, problem-solving, facilitation and analytical skills.

12. Strategy Analysis in Predictive and Adaptive Approaches

Strategy Analysis takes place within different delivery approaches.

In a predictive approach, the organisation often defines more of the expected scope, requirements and implementation plan before delivery begins. This approach is useful when the business need, solution and constraints are sufficiently understood.

In an adaptive approach, the organisation works iteratively and uses feedback to refine its understanding of the problem and the solution. This approach is useful when uncertainty is high or stakeholder needs are likely to evolve.

Both approaches require analysis of the current state, definition of intended outcomes, consideration of risks and decisions about how change should proceed.

The level of detail and timing of analysis differ according to the circumstances.

13. Common Challenges in Strategy Analysis

Business analysts should recognise several common challenges.

Unclear business needs: Stakeholders request solutions before defining the underlying problem. The analyst should investigate causes and desired outcomes.

Conflicting priorities: Departments have different objectives. The analyst should clarify trade-offs and support evidence-based decisions.

Unrealistic future-state objectives: Targets exceed available resources or organisational capabilities. The analyst should assess feasibility and revise assumptions.

Incomplete risk analysis: Teams overlook dependencies, adoption challenges or external influences. The analyst should engage relevant stakeholders and review risks throughout the change.

Resistance to change: Employees fear disruption or lack confidence in new processes. The organisation should communicate the reasons for change and provide appropriate support.

Poor measures of success: The team implements a solution without a clear way to assess value. The analyst should define baselines, targets and measurement responsibilities before implementation.

Addressing these challenges early improves decision-making and reduces the likelihood of pursuing a change that fails to meet business needs.

14. Conclusion

BABOK® v3 Strategy Analysis provides a structured approach to understanding business needs and planning organisational change.

The four main tasks are Analyse Current State, Define Future State, Assess Risks and Define Change Strategy.

Together, these tasks help business analysts understand the existing environment, establish measurable objectives, identify risks and recommend a suitable route towards the desired outcomes.

Effective Strategy Analysis depends on stakeholder collaboration, critical thinking, evidence-based decisions and clear communication. It also requires an understanding of organisational capabilities, constraints, external influences and the value expected from change.

For aspiring business analysts, mastering this knowledge area supports practical work in process improvement, digital transformation, software delivery, business planning and organisational change. It also provides a strong foundation for further study of requirements analysis, requirements life cycle management, solution evaluation and other BABOK® knowledge areas.

BABOK® v3: Requirements and Designs Life Cycle Management

Falade Timilehin — Thu, 15 Oct 2026 14:48:11 +0000

1. Introduction

Requirements and Designs Life Cycle Management is an important knowledge area in business analysis. It focuses on managing requirements and designs from the beginning of an initiative through implementation and beyond.

Business needs can change as a project develops. Stakeholders may identify new expectations, business priorities may shift, and technical or regulatory constraints may emerge. Business analysts must ensure that requirements and designs remain accurate, relevant, traceable, and aligned with business objectives.

The main activities covered in this topic are:

Tracing requirements and designs.
Maintaining requirements and designs.
Prioritising requirements and designs.
Assessing changes to requirements and designs.
Approving requirements and designs.

The overall goal is to help the organisation deliver solutions that provide business value while keeping stakeholders informed and involved.

2. Understanding the Requirements and Designs Life Cycle

Requirements and designs do not remain fixed throughout a project. They evolve as the business analyst learns more about the business problem, gathers feedback, and works with stakeholders and the implementation team.

Life cycle management helps ensure that requirements and designs continue to reflect stakeholder needs and business objectives.

For example, a company may begin a project to introduce an online booking system. During development, customers may request appointment reminders. The business analyst must assess the request, determine its value, understand its impact on the existing design, and agree on whether it should be included.

This process is iterative. Requirements and designs may be reviewed and updated several times as more information becomes available.

Effective life cycle management helps business analysts:

Keep requirements aligned with business goals.
Understand relationships between requirements and designs.
Manage changes in a controlled way.
Prioritise work according to value and constraints.
Obtain stakeholder agreement.
Retire requirements that no longer provide sufficient value.

3. Tracing Requirements and Designs

What is traceability?

Traceability is the ability to follow the relationships between requirements, designs, business objectives, stakeholder needs, and solution components.

It helps a business analyst understand where a requirement came from, what it supports, and what may be affected if it changes.

Consider a requirement for an online payment system. It may be linked to a business goal of reducing manual payment processing. It may also be linked to a payment interface, security controls, testing activities, and training for staff.

If the payment requirement changes, traceability helps the team identify which other parts of the solution may need to change.

Key relationships in traceability

Relationship	Meaning
Derive	Shows that one requirement or design is derived from another requirement, need, or objective.
Depends	Shows that one requirement or design depends on another.
Satisfy	Shows how a solution component meets or fulfils a requirement.
Validate	Shows the relationship between a requirement and the business need or objective it is intended to support.

These relationships help business analysts understand how different parts of an initiative connect.

Why is traceability important?

Traceability supports change assessment, impact analysis, validation, and communication. It also helps prevent requirements from being overlooked during implementation.

The level of traceability required depends on factors such as:

The number and complexity of requirements.
The formality of the project.
The need for audit evidence.
The expected value of maintaining trace links.
The organisation's governance requirements.

A small internal project may use a simple spreadsheet. A large or regulated project may require a dedicated requirements management application.

Tools for tracing requirements and designs

Common approaches include:

Requirements traceability matrices.
Spreadsheets.
Requirements management software.
Project management tools.
Requirements repositories.

The tool should make it possible to identify relationships, track changes, and keep information accessible to the people who need it.

4. Maintaining Requirements and Designs

Maintaining requirements and designs means keeping them accurate, understandable, organised, and useful throughout their life cycle.

A requirement that was valid at the start of a project may become outdated when business processes, legislation, technology, or stakeholder expectations change.

Business analysts must therefore review and update requirements and designs when necessary.

Good practices for maintaining requirements

Use clear names and descriptions. Each requirement should be easy to identify and understand.

Keep relationships updated. If a requirement changes, its links to business objectives, other requirements, designs, and solution components may also need updating.

Use a consistent classification system. A requirements management taxonomy helps organise requirements into categories so that they can be found and managed more easily.

Store information appropriately. The information management approach should explain where requirements and designs are stored, who can access them, and how they are maintained.

Check whether information can be reused. Some requirements and designs may be useful in future projects. Before reusing them, the business analyst should confirm that they remain relevant to the new business context.

Reusing requirements and designs

Reusability depends partly on how a requirement is expressed and how closely it relates to a specific situation.

A general requirement, such as ensuring that users can securely access an application, may be reusable across several projects. A requirement tied to a particular department's workflow may need substantial modification before it can be reused elsewhere.

The business analyst should check whether the requirement still reflects the current business state and the needs of the new initiative.

The main output of maintenance is a set of requirements and designs that remain useful for the current initiative or potential future implementation.

5. Prioritising Requirements and Designs

Prioritisation determines which requirements and designs are most important and when they should be implemented.

Not every requirement can be delivered at the same time. Projects have limits on budget, time, people, technology, and other resources. Business analysts therefore work with stakeholders to establish priorities and negotiate trade-offs.

Factors to consider when prioritising

Factor	Question to ask
Business benefit	How much value will this requirement deliver?
Cost	How much will it cost to implement and maintain?
Risk	What risks arise if it is implemented or delayed?
Dependencies	Does another requirement need to be completed first?
Urgency	How quickly is the requirement needed?
Regulatory compliance	Is the requirement necessary to meet legal or regulatory obligations?
Stakeholder importance	How important is it to the people affected by the solution?
Implementation constraints	Are the required people, skills, technology, and resources available?

Example of prioritisation

Imagine a company developing an online shopping platform. The proposed requirements include:

Secure customer payments.
A customer order history.
A personalised colour theme.
Promotional product recommendations.

Secure payments would normally receive a high priority because they are essential to safe transactions and the operation of the platform. The other requirements may be valuable, but their priority depends on business objectives, customer needs, cost, dependencies, and available resources.

The business analyst should not make prioritisation decisions in isolation. Stakeholders must understand the trade-offs and agree on what matters most.

Tools and techniques for prioritisation

Business analysts can use:

Guidelines and agreed prioritisation criteria.
Analysis of benefits, costs, risks, and dependencies.
Group discussions and collaborative workshops.
Stakeholder reviews.
Business constraints, including regulatory requirements.
Project and requirements management tools.

Relevant stakeholders may include subject matter experts, project managers, sponsors, customers, end users, and regulators.

Priorities can change as the initiative develops. A new risk, business need, or regulatory requirement may mean that an existing priority must be reconsidered.

The output is a prioritised set of requirements and designs that supports business goals and helps guide implementation.

6. Assessing Changes to Requirements and Designs

Changes are a normal part of business analysis. However, a proposed change should be assessed before the organisation commits to implementing it.

Change assessment helps determine whether a proposed change is worthwhile, feasible, urgent, and consistent with business objectives.

Inputs and outputs

Typical inputs include:

The proposed change.
Existing requirements.
Existing designs.
Relevant business information.
The organisation's governance and information management approaches.

The assessment produces information about the likely impact of the change, helping decision-makers decide whether it should be accepted, rejected, deferred, or investigated further.

What should be assessed?

A business analyst should consider:

Expected business benefits.
Implementation and ongoing costs.
Risks and potential consequences.
Urgency and business priority.
Project schedules and delivery commitments.
Dependencies between requirements.
Impacts on related designs and solution components.
Legal and regulatory implications.
Effects on stakeholders and operational processes.

Traceability is particularly useful because it helps identify related requirements and designs that may be affected.

Predictive and adaptive approaches

The way changes are assessed depends partly on the delivery approach.

Predictive approach	Adaptive approach
Changes are commonly assessed through a more formal process.	Changes are considered through ongoing collaboration and feedback.
Formal change requests and approvals may be required.	The team may regularly review and reprioritise requirements.
Schedule, scope, cost, and delivery baselines may need to be assessed.	Priorities may be updated as the team learns more about the solution.
Decisions are documented according to the governance process.	Decisions are communicated and recorded using the team's agreed approach.

Neither approach removes the need to understand the impact of a change. The difference is mainly in how the assessment and decision-making process is organised.

Tools and techniques for assessing changes

Business analysts may use:

Impact analysis: Identifies requirements, designs, processes, systems, and stakeholders that could be affected.

Business rules analysis: Checks whether the proposed change follows business rules and policies.

Financial analysis: Examines the costs, benefits, and financial consequences of the change.

Risk analysis: Identifies potential threats and uncertainties associated with the change.

Interface analysis: Examines how the change may affect connections and interactions between systems or components.

Governance processes: Define how changes are submitted, reviewed, authorised, and communicated.

The business analyst may also consult subject matter experts, project managers, sponsors, testers, customers, legal specialists, compliance teams, and regulators.

Example of change assessment

A retailer asks for an additional payment method to be added to its online store.

The business analyst should assess the expected customer benefit, implementation cost, security implications, integration requirements, regulatory obligations, testing effort, and effect on the delivery schedule.

The request should then be considered through the organisation's agreed decision-making process. If authorised, the relevant requirements and designs should be updated, and the decision communicated to affected stakeholders.

The important principle is that a change should be assessed in context, rather than accepted simply because someone has requested it.

7. Approving Requirements and Designs

Approval is the process of obtaining the appropriate agreement that requirements and designs are acceptable and can move forward.

Business analysts help facilitate this process by identifying decision-makers, supporting stakeholder consensus, coordinating reviews, and recording approval decisions.

Approval is important because implementation teams need a clear understanding of what has been agreed.

Verification and approval

Verification and approval are related, but they serve different purposes.

Verification checks whether requirements and designs meet the expected quality standards and are sufficiently clear, complete, and consistent.
Approval confirms that the appropriate stakeholders or authorised decision-makers agree to proceed with the requirements and designs.

Requirements and designs should be reviewed for quality and readiness before they are approved for further development.

Steps involved in approval

Identify the stakeholders and decision-makers who have authority to approve.
Confirm the applicable governance rules and approval criteria.
Arrange reviews, workshops, or other suitable approval activities.
Resolve questions, disagreements, and outstanding issues.
Record the decision and approval status.
Communicate the outcome to relevant stakeholders.
Store the approved information and supporting records in the appropriate repository.
Maintain an audit history of decisions and subsequent changes.

The exact process depends on the organisation, the delivery approach, and any legal or regulatory requirements.

Tools and techniques for approval

Technique	Purpose
Decision analysis	Supports structured evaluation of options and decisions.
Acceptance criteria	Defines the conditions that must be met for a requirement or solution to be accepted.
Item tracking	Records the status of requirements, issues, decisions, and approval actions.
Reviews	Allows stakeholders and implementation team members to examine requirements and designs.
Workshops	Bring stakeholders together to discuss requirements, resolve disagreements, and reach agreement.

Stakeholders involved may include subject matter experts, operational support teams, project managers, sponsors, testers, customers, end users, and regulators.

Why approval records matter

Recording approval decisions creates clarity and accountability. It helps the team understand which version of a requirement was approved, who authorised it, and what changes occurred afterwards.

These records can also support later activities, including user acceptance testing. If a requirement changes after approval, the organisation can review the change history and understand why the decision was made.

The expected output is a set of agreed and approved requirements and designs that are ready to support solution development.

8. How the Activities Work Together

The activities in Requirements and Designs Life Cycle Management are connected. They should not be treated as isolated tasks.

Consider a project to introduce a new customer service system.

First, the business analyst identifies the requirements and links them to business objectives through traceability. The requirements are then maintained so that they remain accurate and accessible.

The analyst works with stakeholders to prioritise the requirements according to value, risk, dependencies, and constraints. If a new request appears, the analyst assesses its impact on the existing requirements, designs, costs, schedule, and delivery commitments.

If the change is considered worthwhile, the appropriate decision-makers authorise it according to the governance process. The requirements and designs are updated, relevant stakeholders are informed, and the decision is recorded.

This creates a continuous cycle of tracking, maintenance, prioritisation, change assessment, and approval.

9. Quick Comparison Table

Activity	Main purpose	Key question
Trace requirements and designs	Understand relationships and dependencies.	What does this requirement support, and what will it affect?
Maintain requirements and designs	Keep information accurate, relevant, organised, and reusable.	Is this information still correct and useful?
Prioritise requirements and designs	Decide importance and implementation order.	What should be delivered first, and why?
Assess changes	Understand the impact and value of a proposed change.	What are the benefits, costs, risks, and consequences?
Approve requirements and designs	Obtain authorised agreement to proceed.	Who needs to agree, and has approval been recorded?

10. Practical Business Analyst Scenario

A hospital plans to introduce an appointment management system. During the project, staff request text message reminders for patients.

A business analyst could manage this request as follows:

Trace: Link the request to the business objective of improving appointment attendance. Identify related patient contact details, communication interfaces, privacy requirements, and testing needs.

Maintain: Record the requirement clearly and update related information where necessary.

Prioritise: Compare the expected benefit with the cost, urgency, risks, dependencies, and other requirements competing for resources.

Assess the change: Examine the technical impact, delivery schedule, financial implications, privacy considerations, and effect on existing designs.

Approve: Obtain agreement from the appropriate decision-makers, record the outcome, update the requirements repository, and communicate the decision to the team.

This example shows how a business analyst manages a requirement throughout its life cycle rather than simply documenting it and moving on.

11. Key Points to Remember for the Course Test

Requirements and designs evolve as business needs and stakeholder expectations change.
Life cycle management keeps requirements and designs aligned with business objectives.
Traceability helps identify relationships, dependencies, and the impact of changes.
The key traceability relationships covered in the course are derive, depends, satisfy, and validate.
Maintenance keeps requirements accurate, relevant, organised, and potentially reusable.
Prioritisation considers business value, cost, risk, dependencies, urgency, compliance, and implementation constraints.
Change assessment considers benefits, costs, risks, schedules, delivery commitments, and affected requirements.
Predictive approaches commonly use more formal change assessment and approval processes.
Adaptive approaches commonly use ongoing collaboration and reprioritisation.
Approval requires agreement from the appropriate decision-makers.
Verification checks the quality and readiness of requirements and designs. Approval confirms authorised agreement to proceed.
Approval decisions, change history, and supporting documents should be recorded and communicated.
Stakeholder communication and governance are important throughout the life cycle.

12. Conclusion

Requirements and Designs Life Cycle Management helps business analysts keep requirements and designs useful throughout an initiative. The work involves tracing relationships, maintaining information, prioritising according to business value, assessing proposed changes, and securing approval.

The key lesson is that requirements management does not end when requirements are first documented. Requirements and designs must continue to evolve in a controlled way as the business learns more and its needs change. By managing this process effectively, business analysts help teams make informed decisions and deliver solutions that remain aligned with business objectives.

CompTIA Network+: Network Management and IP Services

Falade Timilehin — Wed, 14 Oct 2026 11:56:58 +0000

Introduction

Network management and IP services form an important part of modern IT infrastructure. They help devices communicate, obtain network configurations, locate services, synchronise time and maintain secure connections across different locations.

The CompTIA Network+ N10-009 course, Network Management and IP Services, covers dynamic IP addressing, DNS, network time protocols, virtual private networks, network device management methods, in-band and out-of-band management, and jump servers.

Understanding these technologies helps network administrators maintain reliable connections, troubleshoot problems and control access to network resources.

1. Dynamic IP Addressing

Dynamic IP addressing allows devices to receive their network configurations automatically rather than requiring an administrator to configure every device manually.

Two important technologies in this area are DHCP and SLAAC.

Dynamic Host Configuration Protocol (DHCP)

DHCP automatically provides network configuration details to client devices. These details include:

IP address.
Subnet mask.
Default gateway.
DNS server address.

For example, when a laptop connects to an office network, a DHCP server assigns the laptop an available IP address and the other required network settings.

DHCP supports IPv4 and IPv6. It also includes features such as scopes, reservations, lease times and relay agents.

A scope defines a range of IP addresses available for assignment. A reservation assigns a particular address to a specific device based on its identifier. A lease determines how long a client holds an assigned address before renewal is required.

A DHCP relay agent forwards DHCP messages between clients and a server located on another network.

These features simplify network administration and reduce manual configuration errors.

Stateless Address Autoconfiguration (SLAAC)

SLAAC is an IPv6 mechanism which allows devices to configure their own IPv6 addresses using information advertised by routers.

Unlike DHCP, SLAAC does not depend on a DHCP server to assign the address.

The course notes highlight a limitation of SLAAC: it does not itself provide DNS server information. Additional mechanisms, such as Router Advertisement options or DHCPv6, are required when DNS configuration is needed.

For exam preparation, remember:

DHCP provides automatic network configuration. SLAAC allows IPv6 devices to configure addresses using router advertisements.

2. Network Name Resolution

Computers communicate using IP addresses, but people find names easier to remember. The Domain Name System (DNS) translates domain names into IP addresses and supports other types of DNS lookups.

For example, a user enters a website name into a browser. DNS helps the device find the IP address associated with the name.

Common DNS Records

DNS uses different record types to store information about domains.

A record: Maps a hostname to an IPv4 address.

AAAA record: Maps a hostname to an IPv6 address.

CNAME record: Creates an alias for another hostname.

NS record: Identifies the authoritative name servers for a domain or zone.

MX record: Identifies mail servers responsible for receiving email for a domain.

SOA record: Contains administrative information about a DNS zone, including details about the primary name server and zone serial number.

PTR record: Supports reverse DNS lookups by mapping an IP address to a hostname.

DNS Zones

A DNS zone is an administratively managed portion of the DNS namespace. It contains DNS records for the names managed within that zone.

Dividing DNS into zones helps administrators manage records and delegate responsibility.

A forward lookup resolves a name to an IP address. A reverse lookup uses a PTR record to identify a hostname associated with an IP address.

Hosts Files

A hosts file provides local name-to-address mappings on an individual computer.

Administrators sometimes use hosts files for testing or specific local configurations. Entries require manual maintenance and do not automatically update across all devices.

For the Network+ exam, understand the difference between DNS, DNS zones, DNS records and local hosts files.

3. Common Network Time Protocols

Accurate time is important for network security, troubleshooting, system updates and applications running across multiple devices.

Network Time Protocol (NTP) synchronises device clocks with a reliable time source. Devices use NTP to adjust their clocks and keep timestamps consistent across a network.

Accurate timestamps help administrators investigate security incidents, compare log entries and identify the order in which events occurred.

Precision Time Protocol (PTP)

PTP provides more precise clock synchronisation than traditional NTP in suitable environments.

It is useful for specialised systems which require highly accurate timing.

Network Time Security (NTS)

NTS adds security to NTP through cryptographic mechanisms. This helps protect time synchronisation against certain forms of interference or manipulation.

The main differences are:

NTP provides network time synchronisation.
PTP provides higher-precision synchronisation for specialised applications.
NTS adds security to NTP.

When managing network time, administrators should also check whether applications already include their own synchronisation mechanisms.

4. Site-to-Site Virtual Private Networks

A Virtual Private Network (VPN) establishes a protected connection across an existing network, often the public Internet.

A site-to-site VPN connects separate networks at different physical locations. For example, a business might have an office in London and another in Birmingham.

A site-to-site VPN allows devices in both offices to access authorised resources across the connection without requiring each employee to configure an individual VPN client.

VPN gateways or concentrators at the two sites establish and maintain the connection. Authentication and encryption help protect traffic travelling across the public Internet.

Types of Site-to-Site VPNs

Internet-based VPNs use the public Internet as the underlying connection. They are often less expensive than dedicated connectivity.

MPLS-based VPN services use a provider's managed network to connect sites. They often provide predictable performance and service-level options at a higher cost.

The appropriate option depends on the organisation's budget, security requirements, performance needs and network design.

For exam preparation, remember that a site-to-site VPN connects networks rather than individual remote users.

5. Client-to-Site Virtual Private Networks

A client-to-site VPN, also called a remote-access VPN, connects an individual user's device to a remote network.

For example, an employee working from home might use a VPN client to access internal company applications securely.

The connection uses authentication and encryption to protect data travelling across the Internet.

VPN Tunnelling

VPN tunnelling protects traffic as it travels between endpoints.

In IPsec, transport mode protects the packet's payload while retaining the original IP header. Tunnel mode protects the original IP packet by encapsulating it within a new IP packet.

The choice depends on the VPN design and security requirements.

Client-Based and Clientless VPNs

A client-based VPN uses software installed on the user's device.

A clientless VPN provides access through a web browser for supported services, reducing the need to install and maintain dedicated client software.

Full and Split Tunnelling

Full tunnelling routes all relevant client traffic through the VPN.

Split tunnelling routes selected traffic through the VPN while other traffic uses the user's normal Internet connection.

Full tunnelling provides centralised traffic inspection and policy enforcement. Split tunnelling reduces the amount of traffic sent through the organisation's network but requires careful security planning.

Client-to-site VPNs are designed for individual users. Site-to-site VPNs connect entire networks. Both approaches can operate within the same organisation.

6. Common Network Device Connection Methods

Network administrators need ways to configure, monitor and troubleshoot routers, switches, firewalls and other network devices.

The course covers four main connection methods: console, graphical user interface, Secure Shell and application programming interface.

Console

A console connection provides direct local access to a network device, commonly through a serial connection or USB console interface.

It is particularly useful during initial setup, recovery and troubleshooting when normal network connectivity is unavailable.

Graphical User Interface (GUI)

A GUI provides a visual interface for configuring and managing a device. Administrators often access it through a web browser or management application.

GUIs are user-friendly, although some advanced functions require command-line access.

Secure Shell (SSH)

SSH provides encrypted remote command-line access to network devices.

Administrators use SSH to configure equipment and execute commands without needing physical access to the device.

SSH is preferable to unencrypted remote management methods because it protects the management session.

Application Programming Interface (API)

An API allows software to communicate with a network device or management platform.

APIs support automation, repeatable configuration changes, monitoring and integration with other systems.

For example, a script might use an API to retrieve device status across many switches rather than requiring an administrator to inspect each device manually.

Remember these distinctions:

Console means direct local access. GUI means visual management. SSH means secure remote command-line access. API means software-driven management and automation.

7. In-Band and Out-of-Band Management

Network administrators need reliable access to devices for configuration and troubleshooting. In-band and out-of-band management provide two different approaches.

In-Band Management

In-band management uses the same network infrastructure as ordinary data traffic.

For example, an administrator might connect to a switch using SSH through the organisation's production network.

This approach is straightforward and inexpensive. However, if the production network fails, management access might also become unavailable.

Out-of-Band Management

Out-of-band management uses a separate management path or network.

This provides an alternative route for administrators to reach equipment when the primary network experiences a problem.

Out-of-band management often requires additional interfaces, network infrastructure and security controls. Despite the added cost, it provides greater management resilience and separation from ordinary data traffic.

The choice depends on network size, budget, operational requirements and available technical expertise.

For a small network, in-band management might be sufficient. A large or business-critical environment might benefit from a dedicated out-of-band management network.

8. Jump Hosts and Jump Servers

A jump server acts as an intermediary between an administrator and systems in another network or security zone.

Instead of connecting directly to a sensitive server, an administrator first connects to the approved jump server. From there, the administrator accesses the authorised target system.

For example:

Administrator → Jump server → Internal server

Jump servers are often used to manage systems in a demilitarised zone (DMZ) or other restricted network areas without exposing internal systems directly.

Security Benefits

A properly configured jump server helps organisations:

Restrict administrative access.
Separate security zones.
Record and audit administrator activity.
Apply stronger authentication.
Reduce direct connections to sensitive systems.

Jump servers should be hardened, patched and monitored. Administrators should also use strong credential management and restrict access to authorised users.

A jump server is one security control within a broader security strategy. It does not replace firewalls, access controls, monitoring or other protective measures.

9. How These Network Services Work Together

Consider a company with offices in two cities and employees working remotely.

DHCP assigns IP addresses and network settings to devices. DNS resolves internal hostnames and public domain names. NTP synchronises system clocks so logs use consistent timestamps.

A site-to-site VPN connects the offices, while a client-to-site VPN provides remote employees with authorised access to internal resources.

Administrators use SSH, GUIs, console connections or APIs to manage the network. A separate out-of-band network provides management access during certain production network failures.

Jump servers control access to sensitive systems and provide a central point for monitoring administrative sessions.

Together, these technologies help maintain connectivity, operational consistency, security and manageable network infrastructure.

10. CompTIA Network+ Exam Revision

Review the following concepts before taking the course assessment.

Dynamic addressing:
DHCP automatically assigns network configuration. SLAAC supports IPv6 address autoconfiguration.

DNS:
A records identify IPv4 addresses. AAAA records identify IPv6 addresses. CNAME records provide aliases. MX records identify mail servers. NS records identify name servers. SOA records hold zone information. PTR records support reverse lookups.

Time synchronisation:
NTP synchronises clocks. PTP provides higher precision in suitable environments. NTS adds security to NTP.

VPNs:
Site-to-site VPNs connect networks. Client-to-site VPNs connect individual users or devices to a remote network.

VPN tunnelling:
IPsec transport mode protects the payload. Tunnel mode encapsulates and protects the original IP packet.

VPN routing:
Full tunnelling routes all relevant client traffic through the VPN. Split tunnelling routes selected traffic through the VPN.

Device management:
Console provides direct local access. GUI provides visual management. SSH provides encrypted remote command-line access. APIs support software integration and automation.

Management networks:
In-band management uses the production network. Out-of-band management uses a separate management path.

Jump servers:
Jump servers provide controlled intermediary access to systems in restricted network zones.

Conclusion

Network management and IP services provide the foundation for reliable communication and secure administration.

DHCP and SLAAC handle address configuration. DNS makes network resources easier to locate. NTP, PTP and NTS address time synchronisation and security. VPNs connect remote users and separate sites. Device management methods provide administrative access, while in-band and out-of-band designs determine how administrators reach network equipment.

Jump servers add another layer of controlled access to sensitive systems.

Key Technology Comparison Tables

1. IP Addressing and Name Resolution

Technology	Main purpose	Key feature	Example use
DHCP	Automatic IP configuration	Assigns IP addresses and network settings	Connecting a laptop to office Wi-Fi
SLAAC	IPv6 address configuration	Uses router advertisements	Configuring an IPv6 device
DNS	Name resolution	Resolves domain names to IP addresses	Finding a website's IP address
Hosts file	Local name resolution	Stores manually configured mappings	Testing a local website

2. DNS Record Types

Record	Purpose	Example
A	Maps a hostname to IPv4	`server.example.com → IPv4`
AAAA	Maps a hostname to IPv6	`server.example.com → IPv6`
CNAME	Creates a hostname alias	`www → web server hostname`
MX	Identifies mail servers	Email delivery
NS	Identifies authoritative name servers	Domain DNS delegation
SOA	Stores DNS zone administration details	Zone serial number
PTR	Supports reverse DNS lookup	IP address to hostname

3. Network Time Protocols

Technology	Main purpose	Key difference
NTP	Synchronises device clocks	Standard network time synchronisation
PTP	Synchronises clocks with high precision	Designed for environments needing more precise timing
NTS	Secures NTP communication	Adds cryptographic security to NTP

4. VPN Technologies

Feature	Site-to-site VPN	Client-to-site VPN
Connects	Two or more separate networks	An individual device to a remote network
Typical users	Entire office networks	Remote employees
Endpoint	VPN gateways	User device and VPN server or gateway
Client software	Usually unnecessary on each user device	Often required, depending on the VPN design
Example	Connecting London and Birmingham offices	An employee accessing company systems from home

5. VPN Tunnelling and Routing

Technology	How it works	Main consideration
IPsec transport mode	Protects the packet payload while retaining the original IP header	Often used for host-to-host protection
IPsec tunnel mode	Encapsulates the original IP packet inside a new IP packet	Common in gateway-based VPNs
Full tunnelling	Routes all relevant client traffic through the VPN	Centralised traffic inspection
Split tunnelling	Routes selected traffic through the VPN	Less traffic passes through the organisation's network

6. Network Device Management Methods

Method	Access type	Main advantage	Common use
Console	Direct local connection	Access during initial setup or network failure	Device recovery
GUI	Visual interface	User-friendly configuration	Routine administration
SSH	Encrypted remote command line	Secure remote access	Configuring routers and switches
API	Software-based access	Automation and integration	Managing many devices through scripts

7. Network Management Approaches

Feature	In-band management	Out-of-band management
Network path	Uses the production network	Uses a separate management path
Cost	Usually lower	Usually higher
Resilience	Management access might fail with the production network	Provides an alternative management route
Complexity	Simpler to deploy	Requires additional infrastructure
Best suited for	Smaller or less complex networks	Critical or distributed environments

8. Network Access and Security Technologies

Technology	Main purpose	Key security benefit
RADIUS	Centralised authentication	Individual user authentication and access control
PSK	Shared wireless authentication	Password-protected wireless access
Guest network	Separates visitor connectivity	Limits access to internal resources
VLAN	Separates network traffic logically	Helps isolate users and systems
Jump server	Provides intermediary administrative access	Restricts and supports auditing of access to sensitive systems

9. Quick Exam Memory Guide

Exam scenario	Technology to consider
A device needs automatic network settings	DHCP
An IPv6 device configures its address using router advertisements	SLAAC
A hostname needs to be resolved to an IP address	DNS
Multiple offices need secure connectivity	Site-to-site VPN
A remote employee needs access to company resources	Client-to-site VPN
Administrators need encrypted remote command-line access	SSH
Network management must continue when the production network fails	Out-of-band management
Administrators need controlled access to servers in a restricted zone	Jump server
Devices need consistent timestamps	NTP
A system needs highly precise clock synchronisation	PTP
A business needs secure NTP communication	NTS
A network needs backup electrical power	UPS
Multiple network devices need a centralised power supply point	PDU

Exam tip: Focus on the purpose of each technology, the problem it solves, and how it differs from similar technologies. CompTIA Network+ scenario questions often test your ability to select the most suitable solution for a particular network requirement.

For the CompTIA Network+ N10-009 exam, focus on understanding what each technology does, when an administrator would choose it, and how it differs from similar technologies. These distinctions are essential for answering scenario-based questions and applying network management concepts in practical IT environments.

Master CompTIA Network+: Network Monitoring & Disaster Recovery

Falade Timilehin — Tue, 29 Sep 2026 08:51:12 +0000

Master CompTIA Network+: Network Monitoring & Disaster Recovery

Maintaining network uptime, performance, and operational resilience is a core domain of the CompTIA Network+ (N10-009) certification. Network administrators must monitor traffic continuously to catch bottlenecks before they cause outages and design robust Disaster Recovery (DR) strategies to ensure business continuity during catastrophic failures.

This comprehensive guide breaks down the essential concepts of network monitoring methods, critical DR metrics, recovery site options, high-availability architecture, and DR testing methodologies.

1. Network Monitoring Methods & Solutions

Continuous network monitoring provides visibility into device health, performance baselines, traffic flows, and operational errors. Catching anomalies early prevents unscheduled downtime and security breaches.

Simple Network Management Protocol (SNMP)

SNMP is an application-layer protocol used to collect hardware metrics, monitor status, and configure network devices like routers, switches, servers, and firewalls.

SNMP Manager: Central station running monitoring software.
SNMP Agent: Software module running on managed devices.
Management Information Base (MIB): A hierarchical database defining the properties and metrics of managed devices.
Protocol Versions:
SNMPv1 & SNMPv2c: Send community strings (passwords) in cleartext; vulnerable to packet sniffing.
SNMPv3: The current security standard. Provides user authentication, data integrity checks, and payload encryption.

Flow Data & Packet Capture

Flow Analysis (NetFlow, sFlow, IPFIX): Collects IP traffic statistics (source/destination IP, ports, protocol, packet count) without recording payload contents. Ideal for bandwidth monitoring, capacity planning, and identifying traffic spikes.
Packet Capture (PCAP): Deep packet inspection using tools like Wireshark or tcpdump. Analyzes full frame headers and payloads to debug complex network behavior or investigate security incidents.

Event Logs & Centralized Syslog

Network components generate operational logs (interface errors, login attempts, link state changes).
Syslog: Transports log messages across IP networks to a centralized Syslog server or Security Information and Event Management (SIEM) system for automated analysis and correlation.

Baselines & Alerts

A baseline defines normal performance parameters (CPU utilization, interface bandwidth, latency) over a representative time period (e.g., 30 days). Once established, monitoring tools use baselines to set threshold-based automated alerts when metrics deviate from standard behavior.

2. Key Reliability & Recovery Metrics

When disaster strikes or equipment fails, organizations rely on quantified Service Level Agreements (SLAs) and key performance indicators to measure resiliency and acceptable data loss.

Metric	Full Name	Definition	Key Characteristics
RPO	Recovery Point Objective	Maximum tolerable amount of data loss measured in time.	Dictates backup frequency and backup media types (e.g., synchronous replication vs. nightly tape backups).
RTO	Recovery Time Objective	Maximum tolerable duration of service downtime following an outage.	Guides resource allocation, failover speed requirements, and infrastructure redundancy.
MTTR	Mean Time to Repair	Average time required to troubleshoot, fix, and restore a failed component.	Reflects operational responsiveness, spare-parts availability, and effective monitoring tools.
MTBF	Mean Time Between Failures	Expected average operating time between hardware or system failures.	Measures hardware reliability; calculated as $\text{Total Operational Time} / \text{Number of Failures}$.

                       [ System Outage Occurs ]
                                |
 <----- RPO Timeframe ----->    |    <----- RTO Timeframe ----->
(Data loss tolerance window)    |   (Downtime / Recovery window)
                                |
[ Last Valid Data Backup ] ---->|<------------------------------->[ System Restored ]
                                               |
                                     <-- MTTR Window -->

3. Disaster Recovery Sites & High Availability

To achieve low RTOs and minimal service disruption, organizations deploy redundant site models and high-availability topologies.

Disaster Recovery Site Types

Hot Site: A fully operational backup facility equipped with duplicate hardware, real-time mirrored data, and near-instantaneous failover capabilities. Highest cost, lowest RTO.
Warm Site: Equipped with necessary hardware and network connections, but requires recent data backups to be restored before becoming operational. Moderate cost, intermediate RTO.
Cold Site: An empty shell space providing power, HVAC, and basic physical infrastructure, but zero pre-installed IT equipment or data. Lowest cost, longest RTO.

High Availability (HA) Strategies

Load Balancing: Distributes incoming traffic across multiple redundant servers to prevent overload and eliminate single points of failure.
Clustering & Active-Passive / Active-Active:
Active-Active: All nodes actively process traffic simultaneously; provides load sharing and transparent failover.
Active-Passive: Secondary node remains on standby, taking over traffic routing only if the primary node fails.
Redundant Power & Uplinks: Dual Power Supply Units (PSUs), Uninterruptible Power Supplies (UPS), backup generators, and dual ISP connections running First Hop Redundancy Protocols (FHRP) like HSRP or VRRP.

4. Disaster Recovery Testing Methodologies

A Disaster Recovery plan is unverified until it is rigorously tested. Testing identifies procedural gaps, updates outdated contact rosters, and ensures technical staff can execute recovery tasks under pressure.

Tabletop Exercise / Walkthrough: Key stakeholders discuss scenarios around a conference table to review roles, workflows, and response strategies without altering live environments.
Structured Walkthrough / Simulation: Staff execute procedures step-by-step in a simulated or isolated lab environment to test specific technical recovery operations.
Parallel Testing: Secondary disaster recovery systems are booted and tested with restored data in parallel with production environments to verify system integrity without interrupting daily business operations.
Full Interruption Test: Primary production systems are intentionally shut down or cut off to trigger an actual failover to the DR site. Highest validity, but carries operational risk if failover mechanisms fail.

Key Takeaways for CompTIA Network+

Always prefer SNMPv3 on production networks for user authentication and payload encryption.
RPO = Data Loss (Time); RTO = Downtime Duration.
MTBF measures hardware reliability over time, whereas MTTR measures how fast your team responds to and fixes an outage.
Choosing between Hot, Warm, and Cold sites comes down to balancing financial budget against tolerable RTO.

CompTIA Network+: Wireless Configurations and Physical Installations

Falade Timilehin — Wed, 23 Sep 2026 14:32:40 +0000

CompTIA Network+: Wireless Configurations and Physical Installations

Wireless networking is a major part of modern network infrastructure. Network administrators need to understand how wireless devices communicate, how to select suitable frequencies and channels, how to secure wireless networks, and how to install network equipment correctly.

The CompTIA Network+ course on Wireless Configurations and Physical Installations covers these areas, including Wi-Fi channels, wireless frequencies, SSIDs, wireless network types, security protocols, authentication, antennas, access points, physical installation, power, and environmental considerations.

1. Wi-Fi Channels

Wi-Fi uses radio frequencies to transmit data between wireless devices. These frequencies are divided into channels.

Channels help wireless devices communicate while reducing interference from other wireless signals. The choice of channel matters because nearby networks using overlapping channels can interfere with each other.

The main Wi-Fi frequency bands covered in the course are:

• 2.4 GHz
• 5 GHz
• 6 GHz

The 2.4 GHz band has fewer practical non-overlapping channels. Channels 1, 6, and 11 are commonly used because they do not overlap with each other.

The 5 GHz and 6 GHz bands provide more available channels. Some channels require additional mechanisms to avoid interference with radar and other systems.

Two important technologies are DFS and AFC.

DFS stands for Dynamic Frequency Selection. It helps wireless devices avoid frequencies used by radar systems.

AFC stands for Automated Frequency Coordination. It helps coordinate access to certain frequencies and reduce interference.

For Network+ exams, remember the relationship between frequency, channels, range, and interference.

2. Wireless Frequencies

Wireless communication uses radio waves. Frequency affects how wireless signals behave.

Lower frequencies generally travel further and penetrate walls more effectively. The 2.4 GHz band therefore provides better coverage through obstacles compared with higher-frequency bands.

Higher frequencies such as 5 GHz and 6 GHz support higher data throughput but generally have shorter effective ranges.

This creates a basic trade-off:

2.4 GHz:
• Better range
• Better wall penetration
• More interference
• Fewer practical non-overlapping channels

5 GHz:
• Higher throughput
• More channels
• Shorter range than 2.4 GHz
• Less congestion in many environments

6 GHz:
• Higher-frequency Wi-Fi operation
• More available spectrum
• Higher throughput potential
• Requires compatible devices

The course also highlights device compatibility and interference when selecting a wireless frequency.

A useful way to remember this is:

Lower frequency = better coverage.

Higher frequency = higher throughput but shorter range.

3. SSID and ESSID

SSID stands for Service Set Identifier.

An SSID is the name used to identify a wireless network.

For example, a company might have:

Company-WiFi

Staff-WiFi

Guest-WiFi

Each SSID can have different security policies, authentication requirements, and access permissions.

SSIDs can also help separate groups of users through VLANs. For example, staff devices might connect to one SSID while visitors connect to another.

ESSID stands for Extended Service Set Identifier.

An ESSID allows multiple access points to provide wireless coverage under the same network name. Users can move between access points while maintaining connectivity.

For example, a large office might have several access points:

AP1 → Company-WiFi

AP2 → Company-WiFi

AP3 → Company-WiFi

The access points use different channels while providing the same wireless network name.

The course notes highlight SSIDs for user separation, security policies, authentication, bandwidth allocation, and larger wireless coverage areas.

4. Wireless Network Types

Wireless networks come in different forms depending on their purpose and physical layout.

The course covers several network types:

• WLAN
• PAN
• MAN
• WAN

WLAN stands for Wireless Local Area Network. It provides wireless connectivity within an area such as a home, office, or building.

PAN stands for Personal Area Network. Bluetooth is a common example.

MAN stands for Metropolitan Area Network. It covers a larger geographical area than a LAN.

WAN stands for Wide Area Network. It connects networks across large geographical areas.

Wireless networks also operate in different modes.

Ad Hoc

An ad hoc network allows devices to communicate directly with one another without relying on a traditional access point.

It is essentially a peer-to-peer wireless network.

Point-to-Point

Point-to-point wireless connections link two locations.

For example:

Building A → Wireless link → Building B

Directional antennas are often used for these connections.

Infrastructure

Infrastructure mode uses wireless access points.

A typical connection looks like:

Client → Access Point → Network

This is the common model used in homes, offices, schools, and businesses.

The course also covers Wi-Fi Direct, which allows compatible devices to communicate directly, and hotspots, which provide wireless Internet access through devices such as phones or vehicles.

5. Wireless Security: WPA2 and WPA3

Wireless security protects data and prevents unauthorised users from accessing a network.

Two important security protocols are WPA2 and WPA3.

WPA stands for Wi-Fi Protected Access.

WPA2 has been widely deployed across wireless networks.

WPA3 introduces stronger security mechanisms and uses 256-bit encryption in the configurations discussed in the course.

The course also notes that WPA3 provides protection against attacks associated with weaknesses addressed by the newer protocol and supports secure provisioning for IoT devices through Wi-Fi Certified Easy Connect.

For Network+, remember:

WPA2 = widely deployed wireless security.

WPA3 = newer wireless security with stronger protection.

6. Guest Networks

Guest networks provide visitors with wireless Internet access while separating them from the main network.

A guest network normally uses a separate SSID.

For example:

Company-WiFi → Employees

Company-Guest → Visitors

The guest network can be associated with a separate VLAN. Access restrictions then prevent guests from reaching internal resources.

The main goal is network isolation.

A guest should be able to access the Internet without gaining access to internal servers, printers, employee devices, or other private resources.

Guest networks often use captive portals.

A captive portal is a web page users see before receiving network access.

A business might use the portal to:

• Display terms and conditions
• Collect information
• Provide authentication
• Provide payment options
• Display branding or advertising

The course specifically highlights VLAN separation and Internet-only access as important guest-network controls.

7. Wireless Network Authentication

Authentication determines whether a user or device is allowed to connect to a wireless network.

One common approach is a Pre-Shared Key, or PSK.

A PSK is a shared password used by users to connect to the wireless network.

For example:

Wi-Fi password → Network access

The problem is that everyone shares the same credential. If the password is shared with an unauthorised person, controlling individual access becomes difficult.

WPA-Enterprise uses a different approach.

It uses a RADIUS server to authenticate individual users.

For example:

User → Access Point → RADIUS Server → Authentication

Each user can have individual credentials rather than one shared wireless password.

The course identifies WPA-Enterprise as suitable for larger organisations because it provides individual authentication and stronger access control, although deployment requires additional infrastructure and configuration.

For the exam:

PSK = shared credential.

Enterprise = individual authentication through infrastructure such as RADIUS.

8. Wireless Antennas

Antennas affect how wireless signals are transmitted and received.

Two important antenna types are omnidirectional and directional.

Omnidirectional Antennas

Omnidirectional antennas provide broad horizontal coverage, generally around 360 degrees.

They are useful when users are located in different directions around an access point.

Common examples include wireless routers and some cellular infrastructure.

Directional Antennas

Directional antennas focus wireless signals in a particular direction.

They are useful when connecting two specific locations.

For example:

Building A → Directional antenna → Building B

Because the signal is focused in a particular direction, directional antennas are useful for longer-range point-to-point connections.

Parabolic dishes are an example of highly directional antennas.

The course highlights omnidirectional antennas for broad coverage and directional antennas for longer-range and point-to-point links.

A simple exam rule is:

Omnidirectional = broad coverage.

Directional = focused coverage.

9. Wireless Access Points

A wireless access point, or AP, provides wireless connectivity between client devices and the network.

There are two important access point types covered in the course:

• Autonomous access points
• Lightweight access points

Autonomous Access Points

An autonomous AP operates independently.

Configuration and management happen directly on the access point.

They are suitable for smaller networks where only a limited number of access points need to be managed.

Lightweight Access Points

Lightweight APs rely on a central Wireless LAN Controller, or WLC.

Instead of configuring every access point individually, administrators manage the wireless infrastructure centrally.

This approach provides:

• Centralised configuration
• Easier management
• Improved scalability
• Advanced management features

Lightweight APs are therefore useful in larger environments.

The course also notes that autonomous and lightweight APs use different protocols and are not designed to operate together as the same management model.

For the exam:

Small network → Autonomous AP.

Large or expandable network → Lightweight AP + WLC.

10. Physical Installation Considerations

Wireless networking still requires physical infrastructure.

Before installing network equipment, you need to assess the physical environment.

Important considerations include:

• Area
• Distance
• Obstacles
• Cable length
• Equipment location
• Equipment security
• Cable labelling
• Testing

The course specifies a maximum standard Ethernet cable run of 90 metres.

Network equipment should be installed in suitable equipment rooms or racks where possible.

Equipment rooms should provide:

• Secure racks
• Patch panels
• Controlled environmental conditions
• Appropriate power
• Proper cable management

A basic installation process involves:

Plan the installation.
Pull the required cables.
Connect the equipment.
Label the connections.
Test every connection.

Good labelling makes troubleshooting easier later.

If a network problem develops, a clearly labelled patch panel helps the technician identify the correct cable and port quickly.

The course emphasises planning the installation around distances, obstacles, cable limits, equipment security, and testing.

11. Power Considerations

Network equipment requires reliable power.

Routers, switches, access points, servers, and other network devices depend on stable electrical power.

A power interruption can cause:

• Network downtime
• Data loss
• Equipment shutdown
• Service interruption

A UPS, or Uninterruptible Power Supply, provides backup power during an interruption.

A UPS uses stored energy to keep equipment operating for a period after the main power supply fails.

Different UPS types provide different levels of backup and voltage protection.

A PDU, or Power Distribution Unit, distributes electrical power to multiple devices.

The key difference is:

UPS = backup power.

PDU = distributes power.

A PDU does not provide backup power by itself.

Some PDUs provide monitoring and remote power-control features.

The choice between UPS and PDU depends on equipment requirements, criticality, power needs, and cost.

12. Environmental Factors

Network equipment generates heat.

Too much heat can affect hardware performance and reliability.

Data centres therefore require suitable environmental controls.

HVAC systems help maintain appropriate temperature and remove heat from equipment rooms.

Humidity also matters.

Poor humidity control can contribute to:

• Static discharge
• Corrosion
• Hardware problems

The course notes that data centres require specialised HVAC systems and controlled humidity. It gives around 80°F as an operating temperature reference for computer equipment.

Environmental planning should therefore form part of network installation rather than being treated as an afterthought.

13. Putting Everything Together

Wireless network design involves more than choosing a wireless router.

A network administrator needs to consider the entire environment.

For example, imagine a business with three floors.

You might need:

• Multiple access points
• The same SSID across access points
• Different channels
• Separate staff and guest networks
• VLANs for traffic separation
• WPA2 or WPA3 security
• Enterprise authentication
• Suitable antennas
• Centralised AP management
• Structured Ethernet cabling
• Reliable power
• UPS protection
• Suitable equipment-room conditions

Each decision affects the reliability, security, performance, and manageability of the network.

A poorly positioned access point might create weak coverage.

A badly selected channel might create interference.

A shared wireless password might make user management difficult.

A guest network without proper isolation might expose internal resources.

Poor cable installation might create physical network failures.

This is why wireless configuration and physical installation need to be considered together.

14. Key CompTIA Network+ Exam Points

The following points are worth remembering when preparing for the Network+ exam.

Wi-Fi frequencies:

2.4 GHz → Longer range and better wall penetration.

5 GHz → Higher throughput and more channels, with shorter range.

6 GHz → Newer higher-frequency Wi-Fi band with additional spectrum.

Wi-Fi channels:

2.4 GHz → Channels 1, 6 and 11 are the practical non-overlapping choices highlighted in the course.

SSID:

Identifies a wireless network.

ESSID:

Supports wireless coverage across multiple access points using the same network identity.

Network modes:

Ad hoc → Peer-to-peer.

Point-to-point → Direct connection between two locations.

Infrastructure → Clients connect through access points.

Security:

WPA2 → Widely deployed wireless security.

WPA3 → Newer wireless security.

Authentication:

PSK → Shared password.

Enterprise → Individual authentication using infrastructure such as RADIUS.

Antennas:

Omnidirectional → Broad coverage.

Directional → Focused coverage.

Access points:

Autonomous → Independent management.

Lightweight → Centralised management through a WLC.

Guest network:

Separate SSID and VLAN used to isolate visitors from internal resources.

Power:

UPS → Backup power.

PDU → Power distribution.

Physical installation:

Plan → Pull cables → Connect → Label → Test.

15. Final Takeaway

Wireless networking requires decisions about frequency, channels, security, authentication, coverage, equipment, installation, power, and environmental conditions.

The most important exam skill is understanding why each technology is used.

When you see a question about long-range coverage, think about frequency and antenna choice.

When you see a question about focused wireless communication between two buildings, think about directional antennas and point-to-point connectivity.

When you see a question about visitors accessing the Internet without accessing internal systems, think about guest networks, VLAN isolation, and captive portals.

When you see a question about centrally managing many access points, think about lightweight APs and a Wireless LAN Controller.

When you see a question about backup power, think about a UPS.

When you see a question about distributing power to multiple devices, think about a PDU.

These distinctions form the foundation of wireless configuration and physical network installation knowledge for CompTIA Network+ N10-009. The course concludes by bringing together wireless technologies, security, authentication, antennas, access points, physical installation, power, and environmental factors.

Elicitation and Collaboration in Business Analysis

Falade Timilehin — Tue, 22 Sep 2026 16:52:36 +0000

Elicitation and Collaboration in Business Analysis

Elicitation and Collaboration is an important area of Business Analysis. It focuses on how Business Analysts obtain information from stakeholders, confirm their understanding, communicate Business Analysis information, and work with stakeholders throughout an initiative.

A Business Analyst does not simply ask stakeholders what they want and write down their answers. Elicitation involves exploring needs, understanding problems, investigating the current state, identifying the desired future state, and developing a shared understanding of what needs to change.

Collaboration is equally important because Business Analysis involves people with different responsibilities, knowledge, interests and expectations. The Business Analyst brings these perspectives together and helps stakeholders reach a common understanding.

The BABOK® v3 Knowledge Area, Elicitation and Collaboration, contains five tasks:

Prepare for Elicitation
Conduct Elicitation
Confirm Elicitation Results
Communicate Business Analysis Information
Manage Stakeholder Collaboration

The process is iterative. A BA might gather information during an interview, identify unanswered questions, discuss those questions in a workshop, review existing documents, and then return to stakeholders to confirm the findings.

1. Prepare for Elicitation

Good elicitation starts before the BA meets the stakeholders.

The BA needs to understand what the elicitation activity is intended to achieve. This includes understanding the scope, identifying relevant stakeholders, selecting suitable elicitation techniques, preparing supporting information and considering practical issues such as time, location and resources.

Stakeholder identification is particularly important. The BA needs to determine who has useful knowledge about the business problem and who will be affected by the proposed change.

For example, suppose an organisation wants to replace its customer relationship management system. The BA might need to involve sales staff, customer service teams, managers, IT specialists and other users of the existing system.

Each stakeholder provides a different perspective.

The BA also needs to select an appropriate elicitation technique. Interviews might work well when detailed information is required from an individual stakeholder. Workshops might be more appropriate when several stakeholders need to discuss a process together. Observation might be useful when the BA needs to understand how work is performed in practice.

BABOK® Task: Prepare for Elicitation

The purpose of this task is to determine the appropriate approach for obtaining information from stakeholders and other sources.

The BA considers:

• Scope of the elicitation activity
• Stakeholders who need to participate
• Elicitation techniques
• Available resources
• Timing
• Location
• Supporting materials
• Potential risks

The BA should also consider the Business Analysis approach and the characteristics of the stakeholders.

Key Output

The main output is an Elicitation Activity Plan.

This plan describes how the elicitation activity will take place.

A simple example:

Elicitation objective:

Understand problems with the current customer onboarding process.

Stakeholders:

Customer service, compliance, sales and IT.

Technique:

Workshop followed by interviews.

Duration:

Two hours.

Location:

Online.

Expected result:

Identify current process problems and stakeholder needs.

2. Conduct Elicitation

Once the BA has prepared, the elicitation activity takes place.

The BA engages with stakeholders and gathers information relevant to the business need.

The information might relate to:

• Business problems
• Current processes
• Existing systems
• Stakeholder needs
• Business rules
• Constraints
• Opportunities
• Future-state expectations
• Potential requirements

The BA should listen carefully and ask appropriate questions.

Suppose a stakeholder says:

"Our current process takes too long."

This statement does not provide enough information to define a requirement.

The BA needs to investigate further.

Questions might include:

• Which part of the process takes too long?
• How long does the process currently take?
• Who performs the activity?
• Which systems are involved?
• Where do delays occur?
• What causes the delays?
• What would an acceptable process look like?

The BA moves from a general statement towards a clearer understanding of the problem.

This is one of the reasons elicitation requires analysis and collaboration rather than simple note-taking.

BABOK® Task: Conduct Elicitation

During this task, the BA performs the planned elicitation activity.

The BA:

• Engages stakeholders
• Asks questions
• Listens to stakeholder responses
• Observes processes where appropriate
• Records information
• Identifies additional questions
• Investigates areas requiring clarification
• Identifies new information and potential requirements

The BA should remain open to information that was not expected during preparation.

Key Outputs

The main outputs are:

• Elicitation results
• Unconfirmed information
• Additional questions
• New information requiring further investigation

An important point is that elicitation results are not automatically final requirements.

The BA needs to confirm the information before treating it as reliable.

3. Elicitation Is Iterative

Elicitation rarely happens once.

A single interview might reveal new questions. A workshop might identify conflicting information. Document analysis might reveal information that stakeholders did not mention during an interview.

The BA therefore repeats elicitation activities as the understanding of the problem develops.

A typical cycle might look like:

Interview → Review information → Identify gaps → Workshop → Confirm findings → Follow-up interview

This iterative approach helps the BA develop a more complete understanding of the business need.

It also helps stakeholders refine their own understanding.

4. Elicitation Techniques

Business Analysts use different techniques depending on the situation.

Common techniques include:

• Interviews
• Workshops
• Observation
• Surveys
• Document analysis
• Interface analysis
• Data mining
• Market analysis
• Benchmarking

The choice of technique depends on the objective, stakeholders, available resources and project context.

For example, observation might help when stakeholders struggle to explain a process because they perform the work automatically as part of their daily routine.

An interview might be more appropriate when the BA needs detailed information from a subject matter expert.

A workshop might be useful when several stakeholders need to discuss a process and reach agreement.

The BA therefore needs to choose the technique rather than applying the same approach to every situation.

5. Confirming Elicitation Results

Information gathered during elicitation should not automatically be treated as final.

The BA needs to review and confirm the information.

This helps identify:

• Missing information
• Errors
• Contradictions
• Assumptions
• Misunderstandings
• Information requiring further investigation

For example, suppose Finance says that every refund requires manager approval.

Customer Service says refunds below £50 do not require manager approval.

The BA should investigate the difference rather than simply choosing one statement.

The BA might review existing business rules and speak with the appropriate stakeholders to determine the correct process.

Confirmation therefore helps establish a reliable understanding of the information gathered.

BABOK® Task: Confirm Elicitation Results

The purpose of this task is to check whether the information obtained during elicitation is accurate and useful.

The BA reviews the information with stakeholders and checks for:

• Accuracy
• Consistency
• Completeness
• Understanding
• Relevance

The BA also compares new information with existing information.

If differences appear, the BA investigates them.

Key Outputs

The outputs include:

• Confirmed elicitation results
• Updated information
• Identified issues
• Additional elicitation requirements

The key idea is:

Elicitation produces information.

Confirmation establishes shared understanding of that information.

6. Communicating Business Analysis Information

A Business Analyst also needs to communicate information effectively.

Different stakeholders need different levels of information.

A senior manager might need a high-level summary of the business problem, expected benefits, costs and risks.

A developer might need detailed functional and non-functional requirements.

An end user might need information about how a new process will affect their daily work.

The BA therefore needs to consider the audience when communicating Business Analysis information.

Possible communication formats include:

• Requirements documentation
• User stories
• Use cases
• Presentations
• Workshops
• Reviews
• Dashboards
• Models

The purpose is to make sure stakeholders understand the information relevant to their role.

BABOK® Task: Communicate Business Analysis Information

The BA selects an appropriate communication method and format.

The BA considers:

• Who needs the information?
• What information do they need?
• How much detail do they need?
• When do they need it?
• What communication method is appropriate?

For example:

Senior management:

Business objectives, costs, risks and expected value.

Developer:

Detailed requirements and business rules.

End user:

Process changes and expected system behaviour.

Key Outputs

Communication produces:

• Shared understanding
• Stakeholder feedback
• Decisions
• Agreed information
• Updated Business Analysis information

Communication is therefore more than distributing documents. The BA needs to determine whether stakeholders understand the information.

7. Managing Stakeholder Collaboration

Business Analysis depends heavily on stakeholder collaboration.

Stakeholders might have different priorities, levels of influence and views of the problem.

Some stakeholders might be highly engaged. Others might have limited availability or little interest in the initiative.

The BA needs to manage this collaboration throughout the initiative.

This involves encouraging participation, addressing concerns, clarifying responsibilities and helping stakeholders reach agreement.

For example, a new system might benefit the organisation but change how employees perform their daily work. Some employees might therefore have concerns about the change.

The BA needs to understand those concerns and ensure relevant information reaches the appropriate stakeholders.

Collaboration does not end after requirements have been documented. Stakeholders continue to provide information and feedback as the initiative develops.

BABOK® Task: Manage Stakeholder Collaboration

The BA works with stakeholders throughout the initiative to maintain effective engagement.

The BA:

• Encourages stakeholder participation
• Builds relationships
• Manages communication
• Clarifies roles and responsibilities
• Addresses stakeholder concerns
• Resolves conflicts
• Encourages agreement
• Monitors stakeholder engagement
• Maintains ongoing collaboration

The BA also needs to identify situations where stakeholders are not sufficiently engaged.

For example, a critical SME who repeatedly misses requirements workshops creates a risk because important business knowledge might be missing.

The BA needs to address the issue and find an appropriate way to obtain the required information.

Key Outputs

The results of stakeholder collaboration include:

• Stakeholder engagement
• Stakeholder agreement
• Decisions
• Issues requiring resolution
• Feedback
• Improved communication
• Ongoing stakeholder participation

8. Understanding Current and Future States

Elicitation helps the BA understand both the current state and the desired future state.

Consider a manual customer onboarding process.

The current state might involve:

• Customers completing paper forms
• Staff manually entering information
• Multiple approval steps
• Processing taking several days
• Errors caused by manual data entry

The future state might involve:

• Digital forms
• Automated data capture
• Automated validation
• Faster approvals
• Reduced manual entry

The BA uses elicitation to understand the gap between these two states.

Understanding this gap helps establish what needs to change and what the proposed solution needs to achieve.

9. The Role of Stakeholders

Different stakeholders contribute different types of information.

A Domain Subject Matter Expert provides knowledge about the business area.

For example, a finance specialist might explain how invoice approvals currently work.

An Implementation Subject Matter Expert provides knowledge about implementing the solution.

A Project Manager provides information about delivery considerations such as scope, schedule, resources and risks.

Customers provide information about their needs and expectations.

End users provide information about how processes and systems work in practice.

The BA needs to bring these perspectives together.

No single stakeholder is likely to have the complete picture.

10. Elicitation and Requirements

Elicitation and requirements are closely connected, but they are not the same thing.

Elicitation is the process of obtaining information.

Requirements represent what the organisation, stakeholders or solution need.

For example, during an interview a stakeholder might say:

"Customers keep calling us because they don't know whether their refund has been processed."

The BA investigates the problem.

The underlying need might be:

"Customers need visibility of their refund status."

This could then lead to a solution requirement such as:

"The system shall allow customers to view the status of their refund."

The BA has therefore moved from stakeholder information to an understood need and then towards a defined requirement.

11. The Importance of Shared Understanding

One of the central purposes of elicitation and collaboration is shared understanding.

A project becomes difficult when different stakeholders have different interpretations of the same requirement.

For example:

The business believes a report should show monthly sales.

The developer believes the report should show calendar-month sales.

Finance expects financial accounting periods.

These differences need to be identified and resolved.

The BA helps stakeholders clarify terminology, expectations, assumptions and requirements.

The objective is to create a common understanding before the solution is implemented.

12. BABOK® Tasks and Outputs at a Glance

The five tasks provide a useful structure for revision.

BABOK® Task	Main Purpose	Key Outputs
Prepare for Elicitation	Plan how information will be obtained	Elicitation Activity Plan
Conduct Elicitation	Obtain information from stakeholders and other sources	Elicitation results, unconfirmed information
Confirm Elicitation Results	Check and validate information	Confirmed elicitation results, updated information
Communicate Business Analysis Information	Present information in an appropriate format	Shared understanding, feedback, decisions
Manage Stakeholder Collaboration	Maintain stakeholder engagement and agreement	Stakeholder engagement, decisions, feedback, issues

A useful memory sequence is:

Prepare → Conduct → Confirm → Communicate → Collaborate

13. The Complete Elicitation and Collaboration Cycle

The overall process can be remembered as:

Prepare → Conduct → Confirm → Communicate → Collaborate

First, the BA prepares by understanding the objective, stakeholders, techniques and resources.

Second, the BA conducts elicitation and gathers information.

Third, the BA confirms the information with stakeholders.

Fourth, the BA communicates the information using an appropriate format.

Finally, the BA continues collaboration with stakeholders throughout the initiative.

The process repeats as new information emerges.

14. Key Points to Remember

Elicitation is more than collecting requirements. It involves investigating needs, problems, opportunities, current states and future states.

Preparation is important because the BA needs to understand the purpose of the activity, identify stakeholders and select suitable techniques.

Elicitation is iterative. New information often creates new questions.

Elicitation results need to be reviewed and confirmed.

Different stakeholders require different communication approaches.

Stakeholder collaboration continues throughout the initiative.

Conflicting information needs to be investigated and resolved.

The BA's role is to help stakeholders develop a shared understanding of the business need and the change required.

The five BABOK® tasks are:

Prepare for Elicitation
Conduct Elicitation
Confirm Elicitation Results
Communicate Business Analysis Information
Manage Stakeholder Collaboration

A useful way to remember the topic is:

Prepare the conversation.

Elicit the information.

Confirm what you learned.

Communicate the results.

Collaborate with stakeholders.

Repeat the process as the understanding develops.

DEV Community: Falade Timilehin

CompTIA Network+: Solving Networking Issues

Study Notes for the N10-009 Certification Exam

1. Introduction to Network Troubleshooting

2. Using Protocol Analyser Tools

What is a protocol analyser?

Common protocol analyser tools

Packet capture

Port mirroring

Using filters

When should you use a protocol analyser?

3. Using the Windows Command Line

3.1 ipconfig

3.2 ipconfig /release and ipconfig /renew

3.3 ipconfig /flushdns

3.4 ping

3.5 tracert

3.6 arp -a

3.7 netstat -ano

Windows command revision table

4. Common Linux Commands

4.1 ifconfig

4.2 tcpdump

4.3 iptables

4.4 nmap

4.5 dig

Linux command revision table

5. Common Network Hardware Tools

5.1 Cable tester

5.2 Multimeter

5.3 Toner and probe

5.4 Reflectometer

Hardware tool comparison

6. Using the MAC Address Table

What is a MAC address table?

The show mac-address-table command

MAC address ageing

MAC addresses and routers

7. Displaying the Routing Table

What is a routing table?

The show ip route command

Static routing

Dynamic routing and RIP

Troubleshooting routing problems

8. Displaying Interface Information

The show interfaces command

Important interface information

Physical and protocol status

Using traffic to test an interface

9. Displaying Startup Configuration Information

Running configuration

Startup configuration

Saving configuration changes

Why this matters

Configuration comparison

10. Using Common ARP Commands

What is ARP?

ARP tables

Windows command

Cisco-style router command

Troubleshooting ARP

ARP versus MAC address tables

11. Displaying VLAN Configurations

What is a VLAN?

The show vlan command

Default VLAN configuration

VLANs and IP subnets

Trunk links

Router subinterfaces

VLAN troubleshooting checklist

12. Displaying Power Information for Interfaces

What is Power over Ethernet?

The show power inline command

Why PoE information matters

Troubleshooting PoE issues

13. Practical Troubleshooting Scenarios

Scenario 1: A computer cannot connect to the network

Scenario 2: A hostname does not resolve

Scenario 3: A device cannot communicate with devices in another VLAN

Scenario 4: An IP phone does not power on

3.1 `ipconfig`

3.2 `ipconfig /release` and `ipconfig /renew`

3.3 `ipconfig /flushdns`

3.4 `ping`

3.5 `tracert`

3.6 `arp -a`

3.7 `netstat -ano`

4.1 `ifconfig`

4.2 `tcpdump`

4.3 `iptables`

4.4 `nmap`

4.5 `dig`

The `show mac-address-table` command

The `show ip route` command

The `show interfaces` command

The `show vlan` command

The `show power inline` command