Network and Security Architecture

Calculate the STP root bridge, root ports, designated ports, and blocked ports from bridge and path costs.

Trace RSTP port roles and state transitions during a link or bridge failure.

Map VLANs to MST instances and predict the resulting forwarding topology.

Select BPDU Guard, Root Guard, Loop Guard, or storm control for a given Layer 2 threat or failure.

Diagnose an LACP bundle-formation failure from system IDs, port keys, timers, and state flags.

Trace HSRP and VRRP election, advertisement, preemption, and failover behavior.

Trace LLDP and CDP neighbor-discovery exchanges and decode standard and extended TLVs in a packet capture.

Analyze MACsec Key Agreement messaging, key-server selection, and secure-association establishment.

Calculate IPv4 subnets, usable-host ranges, and VLSM allocations for a stated addressing requirement.

Decode an IPv4 header and determine the forwarding decision using longest-prefix match, administrative preference, and recursive next-hop resolution.

Trace ICMP echo, unreachable, time-exceeded, and redirect messages in a packet capture.

Predict IPv4 fragmentation and IPv4 or IPv6 Path MTU Discovery behavior for a specified path MTU.

Decode IPv6 base and extension headers and classify global, link-local, unique-local, multicast, and solicited-node addresses.

Trace ICMPv6 Neighbor Discovery messages used for address resolution, duplicate-address detection, reachability, and router discovery.

Compare SLAAC with stateful and stateless DHCPv6 using Router Advertisement flags and address-assignment exchanges.

Evaluate dual-stack, tunneling, and NAT64/DNS64 strategies for an enterprise IPv6 transition.

Decode UDP ports, length, and checksum behavior in an IPv4 or IPv6 packet capture.

Trace TCP connection establishment, state transitions, and orderly or reset-based termination.

Calculate TCP sequence and acknowledgment numbers for a captured byte stream.

Diagnose TCP flow-control, loss, reordering, and congestion behavior using window scaling, SACK, retransmission, RTT, and acknowledgment evidence.

Trace a flow through static NAT, dynamic NAT, PAT, and twice-NAT translations.

Trace DHCP discovery, offer, request, acknowledgment, relay, and option processing.

Reconstruct a DNS lookup across caching and delegation, identifying EDNS(0), TCP fallback, DNSSEC validation, or encrypted DNS transport when present.

Predict packet treatment from DSCP or 802.1p markings and configured classification, policing, shaping, and queuing behavior.

Determine a packet’s RIB and FIB path across connected, static, floating-static, recursive, ECMP, and policy-based routing choices.

Trace the OSPF neighbor state machine and diagnose a failed adjacency from hello parameters.

Interpret OSPF router, network, summary, and external LSAs in a link-state database.

Calculate the OSPF shortest-path result for a small multi-area topology.

Design OSPF area boundaries, summarization, and stub-area behavior for a stated requirement.

Construct controlled route-redistribution logic that prevents feedback loops and unintended transit paths.

Trace IS-IS Level 1 and Level 2 adjacency formation, LSP flooding, and TLV-based route advertisement.

Trace EIGRP neighbor formation, feasible-successor selection, and DUAL convergence for a small topology.

Trace the BGP finite-state machine and diagnose an eBGP or iBGP session failure.

Interpret BGP UPDATE messages containing withdrawn routes, path attributes, and NLRI.

Calculate the best path for a set of routes using the BGP decision process.

Construct an inbound or outbound BGP policy using prefix filters, AS-path filters, local preference, MED, and AS-path prepending.

Use standard, extended, and large communities to implement a stated routing policy.

Explain route-reflector behavior and prevent common reflection, cluster-loop, or next-hop reachability failures.

Interpret MP-BGP address-family exchanges used by MPLS VPN and EVPN control planes.

Validate a dual-ISP edge design using BFD, graceful restart, maximum-prefix controls, and RPKI origin validation.

Distinguish the roles of symmetric encryption, asymmetric encryption, hashing, message authentication, and digital signatures.

Validate a certificate chain using subject alternative names, validity, key usage, trust anchors, CRLs, and OCSP.

Trace TLS 1.2 and TLS 1.3 handshakes and identify where authentication, cipher negotiation, and key establishment occur.

Trace SSH negotiation from version exchange through algorithm selection, key establishment, host validation, and user authentication.

Trace IKEv2 negotiation through IKE SA and Child SA creation.

Distinguish IPsec AH from ESP and interpret ESP transport-mode and tunnel-mode packet structures.

Predict the effects of NAT Traversal, rekeying, Dead Peer Detection, and anti-replay processing on an IPsec tunnel.

Diagnose an IPsec VPN failure by locating the failed peer-reachability, IKE, Child SA, routing, or encrypted data-plane stage.

Compare HTTP/1.1 connection reuse and pipelining with HTTP/2 framing, stream multiplexing, and header compression.

Trace QUIC connection establishment and HTTP/3 stream delivery over UDP.

Reconstruct a client egress flow through explicit and transparent forward proxies, including HTTP CONNECT tunneling.

Reconstruct an ingress flow through a reverse proxy or load balancer, including VIP translation, TLS termination, health checks, persistence, and client-address forwarding.

Trace LDAP simple and SASL bind exchanges and directory-query flows in a packet capture.

Trace Kerberos AS, TGS, and application exchanges during service authentication.

Compare RADIUS and TACACS+ packet flows, transport protection, authorization models, and accounting behavior.

Distinguish SAML, OAuth 2.0, and OpenID Connect exchanges by participants, redirects, tokens, trust boundaries, and intended purpose.

Trace LDP label distribution and MPLS label imposition, swapping, stacking, and disposition across a label-switched path.

Trace MP-BGP route and VPN-label distribution for an MPLS Layer 3 VPN.

Decode a GRE-encapsulated packet and calculate its MTU overhead.

Trace VXLAN encapsulation and endpoint learning between virtual tunnel endpoints.

Interpret EVPN route types used for endpoint learning, inclusive multicast, multihoming, and inter-subnet forwarding.

Diagnose an EVPN multihoming or BUM-traffic failure from control-plane and forwarding evidence.

Compare GRE, VXLAN, Geneve, and IPsec encapsulation overhead, security, and service characteristics.

Map SD-WAN underlay, overlay, controller, policy, tunnel-establishment, and path-selection functions in a vendor-neutral design.

Select 2.4 GHz, 5 GHz, or 6 GHz channel plans from channel width, interference, capacity, and coverage requirements.

Trace 802.11 scanning, authentication, association, and data-frame delivery.

Compare WPA2 four-way key establishment with WPA3-SAE authentication and protected management-frame behavior.

Trace wired or wireless 802.1X authentication from EAPOL and EAP exchanges through a RADIUS backend.

Explain Layer 2 and Layer 3 wireless roaming, including the roles of 802.11k, 802.11v, and 802.11r.

Trace CAPWAP control and data paths between an access point and wireless controller.

Interpret IPv4 IGMP and IPv6 MLD host-membership exchanges and the resulting Layer 2 snooping state.

Use RPF checks, PIM-SM neighbor state, rendezvous-point behavior, and source-tree transitions to diagnose a missing multicast flow.

Analyze route propagation and route-precedence logic in AWS VPCs and Transit Gateways.

Analyze route propagation, priority rules, and global-versus-regional routing in Google Cloud VPCs.

Compare security-filter attachment points, statefulness, and rule-evaluation order across AWS, Azure, and Google Cloud.

Trace BGP route exchange across an ExpressRoute, Direct Connect, or Cloud Interconnect attachment.

Predict traffic paths through cloud transit hubs, virtual WANs, peering, and VPN gateways.

Trace private-service access from DNS resolution through a private endpoint and return-path routing.

Trace remote-user traffic through authentication, posture evaluation, TLS or IPsec tunnel establishment, policy lookup, and security enforcement.

Trace branch or service-connection traffic through IPsec or GRE transport, BGP route exchange, and a Prisma Access or equivalent SASE enforcement path.

Diagnose time-synchronization faults from NTP stratum, offset, delay, reachability, association, and authentication data.

Interpret SNMP polling, traps, informs, MIB objects, and SNMPv3 authentication and privacy parameters.

Correlate severity, facility, timestamp, source, and transport fields across centralized syslog events.

Use NetFlow, IPFIX, or sFlow records to identify a specified traffic path or anomaly.

Select streaming telemetry, NETCONF/YANG, RESTCONF, or gNMI for a stated operational requirement.

Localize a multi-layer incident by correlating packet captures, routing state, session state, logs, counters, and flow records.

Produce a protocol-dependency and failure-domain diagram for a hybrid enterprise service.

Justify protocol, convergence, security, scalability, and observability choices in a concise network-security architecture review.