Network Operations and Troubleshooting
Core concepts
Candidates must reason systematically through the layers: physical, data link, network, transport, application. Know the diagnostic value of interface counters, syslog severity levels, SNMP polling versus traps, NetFlow and sFlow records, and packet capture placement. Understand convergence behavior, control-plane policing, and how to distinguish a control-plane problem (adjacency down) from a forwarding problem (traffic dropped despite adjacencies up). Familiarity with change management, rollback plans, and baseline documentation is expected.
Traps in questions
A common trap is a symptom that points to the wrong layer: an interface shows up/up but errors climb, indicating a physical or duplex issue rather than a routing one. Another is assuming a syslog message means the event just occurred; timestamps and clock synchronization matter. Questions may also describe a fix that resolves the symptom while leaving the root cause, which is usually the wrong answer when the prompt asks for root cause.
Worked rule of thumb
Use the divide-and-conquer method: establish what works, then test the nearest boundary. Example: users cannot reach an application server. Ping the default gateway (works), ping the server from the same subnet (fails), check the server NIC (up, no errors), check the local firewall (blocking). The fault is host-local, not the network, and the answer should reflect that evidence chain rather than a routing change.
Practical guidance
Record a baseline before changes, define a rollback trigger, and prefer reversible steps. When a question supplies multiple observations, the answer must be consistent with all of them, not just the most dramatic.