Ruankao Network Administrator (Junior) common mistakes
Ruankao Network Administrator (Junior) · Understand the traps and how to avoid them.
Converting between binary, decimal, and hexadecimal by treating the digits as ordinary base-10 place values, for example writing 0.1 decimal as 0.0001 binary or translating 2 KB as 2000 bytes without noticing the prefix convention the question uses.
Candidates memorize '1 KB = 1024 bytes' from consumer packaging and never build a positional-value model, so digit-by-digit conversion feels like a copying exercise rather than a weighted sum.
What to do instead
Convert by explicit place-value expansion: write each bit's weight (128, 64, 32, 16, 8, 4, 2, 1) above the digit, circle the powers that sum to the target, and group bits in fours for hex. State whether the stem uses SI or binary prefixes before computing.
Ordering the memory hierarchy by capacity instead of by proximity to the CPU, or explaining cache as 'extra RAM' that stores whole programs, so questions about locality, hit rate, or why a loop over a large array runs slowly get answered with speed-of-RAM claims.
The slogan 'cache is fast memory' is recalled in isolation, without a mental picture linking registers, L1, L2, L3, RAM, and disk along shared axes of latency, size, cost, and volatility.
What to do instead
Draw the hierarchy once as a ladder from registers to disk and label each rung with typical latency and typical size. Then rehearse locality: explain why the same loop is faster after a warm-up pass and why row-major traversal of a 2-D array beats column-major.
The candidate confuses the roles of devices and at which layer each operates: hub versus switch versus router versus Layer 3 switch versus firewall versus wireless controller and AP, and which device terminates a broadcast domain or a collision domain.
Device names are learned from product categories, not from the OSI layer and forwarding behaviour. Broadcast and collision domain counting questions then become guesswork, and design questions produce topologies with a hub where a switch belongs.
What to do instead
For each device write three facts: OSI layer, unit of forwarding (bit, frame, packet), and effect on collision and broadcast domains. Then redo domain-counting exercises by marking every port and every link on a diagram before counting. Tie each device to one design rule you would defend.
The candidate treats VLANs as pure isolation and forgets the Layer 2 and Layer 3 consequences: that inter-VLAN traffic needs a router or Layer 3 switch, that a trunk carries tagged frames, that the native VLAN is untagged, and that STP still runs per VLAN in PVST.
VLANs are learned as a configuration command sequence rather than a forwarding model. The candidate can type switchport access vlan 10 but cannot trace a frame from host A in VLAN 10 to host B in VLAN 20 and say exactly where the tag is added, removed, and routed.
What to do instead
Draw the frame path for three scenarios: same VLAN same switch, same VLAN across a trunk, different VLANs. Label each interface as access or trunk and mark where 802.1Q tags are inserted and stripped. Then answer configuration questions from the diagram rather than from memory of commands.
When a subnetting question gives a host address and prefix (e.g., 192.168.10.130/26), the candidate computes the network address by copying the first three octets and zeroing the last, ignoring that the /26 boundary falls inside the last octet.
Most practice happens on /24 boundaries, so the habit of 'first three octets = network' becomes automatic. Under exam time pressure the candidate does not convert the prefix to a mask or find the block size, and never verifies the result by checking that the network address is a multiple of the block size.
What to do instead
For a stated ordinary /25 through /30 subnet within one last octet, calculate block size as2^(32−prefix), find the containing boundary and derive network, host range and broadcast. For other prefixes operate on the full32-bit address; do not reuse an octet shortcut outside its assumptions.
The candidate answers routing questions by naming a protocol (RIP, OSPF, BGP) without stating whether it is distance-vector or link-state, what metric it uses, whether it is interior or exterior, and which transport/port it runs over, so answers are too vague to earn marks.
Study is done by memorizing protocol names and default administrative distances rather than building a comparison table. The candidate recognizes the term in the stem and stops reading, missing the qualifier such as 'converges fastest' or 'used between autonomous systems'.
What to do instead
Build a one-page comparison table with columns: type, metric, algorithm, transport/port, multicast address, convergence, scope, max hop count. Fill it from first principles (RIP = hop count, 15 max, UDP 520; OSPF = cost, IP protocol 89, 224.0.0.5/6; BGP = path attributes, TCP 179). Rehearse explaining each row aloud in one sentence.
The candidate spends too long on calculation-heavy items (subnetting, throughput, error-detection or encoding arithmetic) and leaves later items unanswered, or changes correct answers during a rushed final review.
Calculation items feel productive, so the candidate keeps reworking them to be sure. There is no time budget per item and no rule for when to abandon a question and mark it for return.
What to do instead
Set a per-item budget in advance (for example, one minute average, two minutes maximum on calculations), mark and skip anything exceeding it, and reserve the last ten minutes for unanswered items only. During review, change an answer only when you can name the specific error in the original reasoning.
On TCP versus UDP and application-protocol questions, the candidate picks the transport protocol by feel and cannot say which port and which transport each service uses, or confuses control and data connections (FTP 20/21, DNS 53 over both, DHCP 67/68, SNMP 161/162, SMTP 25, POP3 110, IMAP 143).
Ports are memorized as a flat list without the reasoning (why DNS uses UDP for queries and TCP for zone transfers, why TFTP uses UDP). Without the reasoning, similar numbers blur together under exam pressure.
What to do instead
Group services by transport and by function rather than memorizing a list: name resolution, mail, file transfer, management, remote access. For each, write one line on why that transport was chosen. Then do reverse drills: given port 162, name the service and the direction of the message.
When asked to troubleshoot a connectivity failure, the candidate jumps to a conclusion (firewall, DNS) without ordering the checks, and cannot state what each tool proves: ping tests ICMP reachability, traceroute locates the break, arp -a shows Layer 2 resolution, nslookup tests name resolution, telnet to a port tests transport reachability.
Real-world habits are built by trial and error on familiar systems, so the candidate never internalizes a layered method. Exam scenarios are written so that the symptom is consistent with several causes, and guessing fails.
What to do instead
Use an ordered hypothesis-driven check of link, address, route, name resolution, transport and application evidence. A failed ping or traceroute is not proof of one particular broken hop because filtering and asymmetric paths can affect replies. Respect production authority and tool limits.
Answering structured-cabling questions with generic quality claims while ignoring the supplied channel, permanent-link, route and acceptance requirements.
Cabling is treated as low-status material and studied last, and design questions look like essay prompts, so the candidate writes what sounds sensible instead of the standard figures and the design phases the question is testing.
What to do instead
Map requirements to logical design, addressing, device and media choice, test evidence and handover. Use actual supplied specifications and applicable standards; do not invent a figure simply to make an answer sound precise.
In network security questions the candidate answers with a product category ('use a firewall', 'use a VPN') instead of specifying the mechanism, the placement, and the threat it addresses, and mixes up symmetric and asymmetric encryption use cases and what a digital signature actually guarantees.
Security is studied as vocabulary lists. The candidate knows the words but not the properties: symmetric is fast and needs key distribution, asymmetric solves distribution but is slow, a signature gives integrity and authentication but not confidentiality.
What to do instead
For every control write a sentence of the form: mechanism, placed here, stops this threat, at this cost. Build a table of encryption use cases (bulk data, key exchange, signatures, certificates) and state what each does and does not provide. Answer security questions by naming the threat first, then the control.
The candidate misreads standardization and professional-English items: skips the English passage and guesses from a keyword, or confuses standards bodies and what each publishes (IEEE 802.x for LAN, IETF RFCs for Internet protocols, ITU-T for telecommunications, ISO for the OSI reference model).
English reading is slow under time pressure, so the candidate hunts for a familiar word in the passage. Standards knowledge is picked up incidentally and never organized by scope.
What to do instead
Practice timed reading of short technical passages with the question read first, then scan for the sentence that answers it. Keep a standards map: body, scope, two example documents. Never answer an English item without locating the supporting sentence.