A Slow Lab, a Vanishing Printer and a Suspicious Email
A government higher secondary school in Berhampur has one 100 Mbps fibre broadband line. A single-band Wi-Fi router, still using its default admin password, broadcasts an SSID protected by WPA2-PSK with the password 'school1234'. The router serves the staff room, the principal's office and the corridor outside the IT lab, which has 20 wired PCs. Those PCs are connected through two unmanaged 8-port switches daisy-chained together, with one Cat5e uplink from the second switch to the router. PC-1 in the lab shares an HP LaserJet printer with the whole lab. Teachers report that between 11 am and 12 noon, when the practical class runs, internet access becomes very slow, online videos buffer, and the shared printer sometimes vanishes from the network for a few minutes before reappearing. In the same week the office clerk received an email signed with the principal's name, sent from a Gmail address, asking him to 'verify the school account by clicking the link and entering the OTP received on the phone'.
1. Analyse the causes of the slow internet and the disappearing printer. Point out anything in the described wiring that does not add up, and separate causes you can prove from causes you would have to test.
Read the worked answer
The port count does not add up. Two 8-port switches give 16 ports in total. One port is consumed by the inter-switch link and one by the uplink to the router, leaving 14 usable ports for 20 PCs. Either some PCs are actually on Wi-Fi, or a hub or an extra switch has been spliced in and not mentioned. This must be checked physically before anything else, because it changes the whole diagnosis.
Contention. A 100 Mbps line shared by 20 lab PCs plus staff laptops and phones will saturate during a practical class where students open videos or download files. Windows updates running at 11 am would produce exactly this pattern.
One uplink for everything. Because the printer is shared from PC-1, print jobs from PCs on the other switch also cross the single daisy-chain link, competing with internet traffic. Switching is full duplex, so this is bandwidth and queueing delay, not collisions.
Printer vanishing. Most likely a DHCP address change or an IP conflict on PC-1 after a reboot, or PC-1 entering sleep and withdrawing the share. A duplicate IP would also explain the random, self-correcting disappearance.
To test, not assume: cable quality and length on the Cat5e run, Wi-Fi channel interference, router CPU load, and the actual line speed at the router with a single laptop.
2. Assess the email the clerk received. List the indicators that identify it, then give the response procedure in the order it should be carried out.
Read the worked answer
Indicators. The display name says 'principal' but the actual sending address is a free Gmail account - a display name proves nothing. There is urgency and a threat of account loss, a request to click a link, and, decisively, a request for an OTP: no bank, board or school will ever ask for a one-time password, because possession of the OTP is the second factor and giving it away defeats it. Generic wording and an unverifiable sign-off complete the pattern. This is phishing with a credential- and OTP-harvesting page behind the link.
Procedure, in order.
- Do not click the link and do not enter anything; do not reply.
- Do not delete it - keep the full headers as evidence.
- Report it to the principal and the person responsible for IT, and warn the office staff, since the same message may have gone to several people.
- Verify by a separate channel: call the bank or the school's known number, never the number or link in the mail.
- If anyone already entered credentials or an OTP, treat it as a compromise: call the bank's fraud line at once, change the password, and check for unauthorised transactions.
- Report the incident to CERT-In through its official incident-reporting channel, and block the sender.
3. Given a modest budget, propose a network and wireless improvement plan. Rank the changes by benefit per rupee and explain what each one fixes.
Read the worked answer
Rank 1 - replace the two 8-port switches with one 24-port unmanaged or smart switch (₹4,000–7,000). This fixes the port shortfall, removes the daisy-chain hop, and gives every PC its own full-duplex 100 Mbps/1 Gbps port. Without this, no other change can be trusted.
Rank 2 - secure the router (₹0). Change the default admin password, replace 'school1234' with a long passphrase, disable WPS and remote management, and update the firmware. The current settings mean anyone in the corridor can join the network or take over the router. This is the highest-value change because it is free.
Rank 3 - separate the staff Wi-Fi from the lab traffic (₹0–3,000). Create a second SSID for staff and students' phones and put the lab PCs on the wired LAN. If the router supports it, enable QoS or bandwidth limits so the practical class is not starved by video streaming.
Rank 4 - fix the printer share (₹0). Give PC-1 a static IP or a DHCP reservation, disable sleep on its network adapter, and document the share path. Better still, buy a network-ready printer or a small print server when the budget allows.
Rank 5 - a dual-band router or an access point in the corridor (₹2,500+). Moves users to 5 GHz where there is less interference.
Ongoing: label every cable and port, keep a simple network diagram, and schedule Windows updates outside class hours.