Foundational Concepts and Terminology
Build the vocabulary before the scenarios
Most missed questions in this domain are not about hard technology - they are about two adjacent terms being swapped. Own the following clusters cold.
Layering. Know the OSI seven layers and how they map to the four-layer TCP/IP model. Be able to place a device or protocol on a layer: hub/repeater (L1), switch and MAC address (L2), router, IP address, and ICMP (L3), TCP/UDP ports (L4), and application protocols such as DNS, DHCP, and HTTP (L7). Encapsulation runs top-down on send and is unwrapped bottom-up on receive.
Addressing. Separate MAC (flat, burned-in, local link) from IP (logical, routable, hierarchical). Know CIDR notation, network and broadcast addresses, private ranges, and the role of the default gateway. A switch segments collision domains; a router separates broadcast domains - a classic trap.
Transport and traffic types. TCP is connection-oriented with a three-way handshake; UDP is connectionless and best-effort. Know unicast, broadcast, multicast, and anycast. Know the well-known ports (DNS 53, SSH 22, HTTPS 443, SMTP 25, SNMP 161, DHCP 67/68).
Performance terms. Bandwidth is capacity, throughput is achieved rate, latency is delay. More bandwidth does not fix a latency problem - expect a question that baits this.
Worked example
Subnet 192.168.10.0/26. The mask is 255.255.255.192; block size is 64. Subnets are .0, .64, .128, .192, each with 62 usable hosts. A host at 192.168.10.200 therefore sits in the .192 subnet, with a usable range of .193–.254. Count hosts before you answer the question that follows; most options differ only by off-by-two errors.