Ruankao Network Engineer (Intermediate) common mistakes
Ruankao Network Engineer (Intermediate) · Understand the traps and how to avoid them.
When a subnetting question gives a host address and prefix (e.g., 192.168.10.130/26), the candidate computes the network address by copying the first three octets and zeroing the last, ignoring that the /26 boundary falls inside the last octet.
Most practice happens on /24 boundaries, so the habit of 'first three octets = network' becomes automatic. Under exam time pressure the candidate does not convert the prefix to a mask or find the block size, and never verifies the result by checking that the network address is a multiple of the block size.
What to do instead
Always do the four-step drill on paper: mask = 256 - block size; block size = 2^(32-prefix); find the largest multiple of the block size not exceeding the host octet; write network, first host, last host, broadcast. Verify by confirming the host address lies between first and last host. Practice /25 through /30 inside a single octet until it takes under 30 seconds.
The candidate answers routing questions by naming a protocol (RIP, OSPF, BGP) without stating whether it is distance-vector or link-state, what metric it uses, whether it is interior or exterior, and which transport/port it runs over, so answers are too vague to earn marks.
Study is done by memorizing protocol names and default administrative distances rather than building a comparison table. The candidate recognizes the term in the stem and stops reading, missing the qualifier such as 'converges fastest' or 'used between autonomous systems'.
What to do instead
Build a one-page comparison table with columns: type, metric, algorithm, transport/port, multicast address, convergence, scope, max hop count. Fill it from first principles (RIP = hop count, 15 max, UDP 520; OSPF = cost, IP protocol 89, 224.0.0.5/6; BGP = path attributes, TCP 179). Rehearse explaining each row aloud in one sentence.
On TCP versus UDP and application-protocol questions, the candidate picks the transport protocol by feel and cannot say which port and which transport each service uses, or confuses control and data connections (FTP 20/21, DNS 53 over both, DHCP 67/68, SNMP 161/162, SMTP 25, POP3 110, IMAP 143).
Ports are memorized as a flat list without the reasoning (why DNS uses UDP for queries and TCP for zone transfers, why TFTP uses UDP). Without the reasoning, similar numbers blur together under exam pressure.
What to do instead
Group services by transport and by function rather than memorizing a list: name resolution, mail, file transfer, management, remote access. For each, write one line on why that transport was chosen. Then do reverse drills: given port 162, name the service and the direction of the message.
The candidate treats VLANs as pure isolation and forgets the Layer 2 and Layer 3 consequences: that inter-VLAN traffic needs a router or Layer 3 switch, that a trunk carries tagged frames, that the native VLAN is untagged, and that STP still runs per VLAN in PVST.
VLANs are learned as a configuration command sequence rather than a forwarding model. The candidate can type switchport access vlan 10 but cannot trace a frame from host A in VLAN 10 to host B in VLAN 20 and say exactly where the tag is added, removed, and routed.
What to do instead
Draw the frame path for three scenarios: same VLAN same switch, same VLAN across a trunk, different VLANs. Label each interface as access or trunk and mark where 802.1Q tags are inserted and stripped. Then answer configuration questions from the diagram rather than from memory of commands.
When asked to troubleshoot a connectivity failure, the candidate jumps to a conclusion (firewall, DNS) without ordering the checks, and cannot state what each tool proves: ping tests ICMP reachability, traceroute locates the break, arp -a shows Layer 2 resolution, nslookup tests name resolution, telnet to a port tests transport reachability.
Real-world habits are built by trial and error on familiar systems, so the candidate never internalizes a layered method. Exam scenarios are written so that the symptom is consistent with several causes, and guessing fails.
What to do instead
Adopt a fixed bottom-up script: link status, IP configuration, gateway reachability, remote IP reachability, name resolution, application port. For each step write the command and the exact conclusion a success or failure allows. Practice on scenarios where the symptom is 'can ping IP but not hostname' and 'can ping gateway but not internet'.
The candidate confuses the roles of devices and at which layer each operates: hub versus switch versus router versus Layer 3 switch versus firewall versus wireless controller and AP, and which device terminates a broadcast domain or a collision domain.
Device names are learned from product categories, not from the OSI layer and forwarding behaviour. Broadcast and collision domain counting questions then become guesswork, and design questions produce topologies with a hub where a switch belongs.
What to do instead
For each device write three facts: OSI layer, unit of forwarding (bit, frame, packet), and effect on collision and broadcast domains. Then redo domain-counting exercises by marking every port and every link on a diagram before counting. Tie each device to one design rule you would defend.
In network security questions the candidate answers with a product category ('use a firewall', 'use a VPN') instead of specifying the mechanism, the placement, and the threat it addresses, and mixes up symmetric and asymmetric encryption use cases and what a digital signature actually guarantees.
Security is studied as vocabulary lists. The candidate knows the words but not the properties: symmetric is fast and needs key distribution, asymmetric solves distribution but is slow, a signature gives integrity and authentication but not confidentiality.
What to do instead
For every control write a sentence of the form: mechanism, placed here, stops this threat, at this cost. Build a table of encryption use cases (bulk data, key exchange, signatures, certificates) and state what each does and does not provide. Answer security questions by naming the threat first, then the control.
The candidate misreads standardization and professional-English items: skips the English passage and guesses from a keyword, or confuses standards bodies and what each publishes (IEEE 802.x for LAN, IETF RFCs for Internet protocols, ITU-T for telecommunications, ISO for the OSI reference model).
English reading is slow under time pressure, so the candidate hunts for a familiar word in the passage. Standards knowledge is picked up incidentally and never organized by scope.
What to do instead
Practice timed reading of short technical passages with the question read first, then scan for the sentence that answers it. Keep a standards map: body, scope, two example documents. Never answer an English item without locating the supporting sentence.
The candidate answers structured-cabling and network-design items with generic good practice ('use quality cable', 'design for growth') rather than the specific rules: the 100 m horizontal channel limit, 90 m permanent link plus patch cords, the 1-10 numbering and 568A/568B pinouts, and the sequence of requirements analysis, logical design, physical design, and documentation.
Cabling is treated as low-status material and studied last, and design questions look like essay prompts, so the candidate writes what sounds sensible instead of the standard figures and the design phases the question is testing.
What to do instead
Memorize the small set of hard numbers and the phase order, then practice writing design answers as a numbered list mapped to phases: requirement, logical topology, addressing, device selection, physical cabling, documentation. Include at least one concrete figure in every design answer.
The candidate spends too long on calculation-heavy items (subnetting, throughput, error-detection or encoding arithmetic) and leaves later items unanswered, or changes correct answers during a rushed final review.
Calculation items feel productive, so the candidate keeps reworking them to be sure. There is no time budget per item and no rule for when to abandon a question and mark it for return.
What to do instead
Set a per-item budget in advance (for example, one minute average, two minutes maximum on calculations), mark and skip anything exceeding it, and reserve the last ten minutes for unanswered items only. During review, change an answer only when you can name the specific error in the original reasoning.