Junior Network Administrator common mistakes
Junior Network Administrator · Understand the traps and how to avoid them.
When asked which layer of the OSI model a device or protocol operates at, the candidate answers from memorized device lists (e.g., 'switches are Layer 2') without checking the specific function described in the question, such as a multilayer switch routing between VLANs or a firewall inspecting at Layer 7.
Study guides often present simplified one-device-one-layer mappings, and candidates rehearse those pairings instead of applying the encapsulation and PDU logic that the exam tests.
What to do instead
For every practice item, restate the function in the stem (e.g., 'forwards frames by MAC address' vs. 'chooses a path by IP address') and map that function to the layer before looking at the answer choices; build a table of PDU names, addressing, and example protocols per layer and drill it until the mapping is automatic.
The candidate computes subnet ranges by memorizing a few common masks (e.g., /24, /25) and then guesses on unfamiliar prefixes, producing off-by-one errors in network and broadcast addresses or placing the broadcast address inside the usable host range.
Many candidates learn subnetting through worked examples rather than the underlying block-size and power-of-two arithmetic, so a prefix such as /27 or /29 exposes gaps in understanding.
What to do instead
Practice the block-size method daily: block size = 256 minus the interesting octet value; list network, first host, last host, and broadcast for every prefix from /24 to /30 until each is produced in under 30 seconds; then verify with binary conversion for one random prefix per study session.
When a scenario describes connectivity between two hosts on different subnets, the candidate checks only the IP addresses and mask and concludes the hosts can communicate, ignoring that the default gateway must be on the same subnet and that the router needs a route back.
Candidates treat IP addressing and routing as separate topics and do not habitually trace the full path: source host, gateway, destination network, return path.
What to do instead
For every connectivity question, write out the source subnet, the gateway address, whether the gateway is in that subnet, and the destination route; practice with two-host scenarios where the mask is wrong on one side, where the gateway is missing, and where the return route is absent, so each failure mode is recognized quickly.
The candidate selects a crossover cable for a PC-to-switch link or a straight-through cable for a switch-to-switch link because the rule was memorized as 'same devices use crossover' without checking the actual pinout and MDI/MDI-X behavior.
Older study material emphasizes device-category rules, while modern exams test whether the candidate knows which pairs transmit and receive and that Auto-MDI/MDIX changes the answer on current hardware.
What to do instead
Learn the pin functions for T568A and T568B (pins 1,2 and 3,6), then classify each link by whether the transmit pair on one end meets the receive pair on the other; practice ten link scenarios including PC-to-PC, PC-to-switch, switch-to-switch, and router-to-switch, and note when Auto-MDI/MDIX makes the cable choice irrelevant.
The candidate treats a VLAN as a security boundary by itself and assumes hosts in different VLANs cannot communicate, forgetting that inter-VLAN traffic is routed by a Layer 3 device unless an ACL or firewall policy blocks it.
VLANs are taught as broadcast-domain separators, and candidates conflate broadcast separation with traffic isolation, missing the routing step that connects them.
What to do instead
For each VLAN scenario, identify the broadcast domain, the Layer 3 gateway (SVI or router subinterface), and the filtering policy; practice questions that ask whether a given host pair can reach each other and require the candidate to state the path through the router and any ACL before answering.
When a wireless client cannot associate, the candidate immediately blames interference or signal strength and skips checking the SSID, security mode, and authentication settings, or picks the strongest signal without considering channel overlap.
Wireless troubleshooting is often studied as a list of physical-layer causes, so configuration mismatches and co-channel interference are underweighted in the candidate's mental model.
What to do instead
Use a layered checklist for every wireless item: (1) is the SSID correct and broadcasting, (2) do security and authentication match (WPA2/WPA3, PSK vs. 802.1X), (3) is the client on a non-overlapping channel (1, 6, 11 in 2.4 GHz), (4) signal and interference. Apply the checklist in order and eliminate options that address a later layer before an earlier one.
The candidate confuses DHCP and DNS roles in a scenario, for example blaming DNS for a client that cannot obtain an address, or blaming DHCP for a name-resolution failure, and misidentifies which server or relay handles which request.
Both services are commonly deployed together and share the 'network services' study block, so candidates memorize port numbers without mapping each service to the symptom it produces.
What to do instead
Build a symptom-to-service table: no address or APIPA means DHCP (ports 67/68, relay agent); name resolves nowhere means DNS (port 53, forward/reverse zones); one-way connections or private-to-public issues mean NAT; time drift means NTP (port 123). For each practice question, name the failing service and the exact query or message that would fail before reviewing the options.
The candidate answers security questions by choosing the 'most secure-sounding' option, such as recommending WEP because it is encryption or opening all ports because a service might be needed, instead of applying least privilege and the specific threat described.
Security items often present several plausible controls, and without a habit of matching control to threat, candidates default to buzzwords rather than reasoning about the attack path.
What to do instead
For each security scenario, state the asset, the threat, and the control category (preventive, detective, corrective) before reading the choices; memorize the deprecated/insecure technologies (WEP, Telnet, FTP, SSL, WPA/TKIP) and the port-level defaults for common services, then eliminate any option that weakens least privilege.
When given monitoring output such as interface counters or syslog lines, the candidate reads only the first line or the highest number and ignores context such as interface speed, duplex, error type, and time correlation across devices.
Candidates practice interpreting single metrics in isolation and are not used to correlating multiple counters or logs, which is what the exam scenarios require.
What to do instead
Practice reading a small table of interface statistics and classifying each anomaly: CRC and late collisions suggest duplex mismatch or cabling; runts suggest collisions; discards suggest congestion or QoS. Then practice ordering syslog messages by timestamp across two devices to find the first cause rather than the loudest symptom.
The candidate jumps to a conclusion from a single symptom (e.g., 'no link light means the cable is bad') without following a structured troubleshooting sequence or checking the OSI layer where the failure actually occurs, and skips verifying that the fix restored service.
Exam questions reward the first plausible cause, and candidates who have not internalized a repeatable method (identify, hypothesize, test, verify, document) substitute pattern matching for diagnosis.
What to do instead
For every troubleshooting item, write the layer at which the symptom appears and the next test that would confirm or eliminate the top hypothesis; practice bottom-up and top-down approaches on the same scenario, and always include a verification step and a documentation step in the answer, since exams often test whether the fix was confirmed and recorded.