The 60-Machine Campus Network Plan
Sunrise Public School has 60 computers: a 24-machine senior lab in the main block, a 12-machine junior lab, 10 office machines (accounts, admissions and the principal), 8 library terminals and 6 teacher laptops. The senior lab still runs on a coaxial bus segment; the rest of the main block hangs off two 8-port hubs. The science block is 80 m from the main block and the primary block is 140 m away. In one week the school reports: transfers inside the senior lab crawl whenever more than six machines are active; the science block loses the network whenever the lab hub is powered off; the staff-room Wi-Fi router has no password and a visible SSID; the office shares a folder of fee-defaulter data with the whole 192.168.1.0/24 network; a teacher's infected pen drive encrypted files on two office PCs; and students' peer-to-peer downloads saturate the 100 Mbps ISP link during project week. The principal wants a written plan she can defend to the trust, not a shopping list.
1. Recommend a topology and the devices for each block, justifying the choices against the symptoms reported.
Read the worked answer
Use a star topology inside each block, with a star-of-stars backbone: one switch per lab and one per office area, all uplinked to a central switch in the main block. Each device then has its own cable to a switch port, and a single failed cable or machine takes down only that one connection.
The coaxial bus in the senior lab is the cause of the crawl. A bus is one shared collision domain: every station contends for the same medium, so throughput collapses as more machines become active - exactly the 'more than six machines' symptom. A hub would not fix it, because a hub repeats every frame out of all ports, so all its ports still share one collision domain. A switch learns MAC addresses and forwards a frame only to the destination port, giving each port its own collision domain and full-duplex operation; that removes the contention bottleneck.
The science block losing connectivity when the lab hub is powered off is a cascading-dependency problem, solved by giving each block its own switch on its own uplink rather than daisy-chaining through a device in another room. For cabling, UTP Cat6 reaches 100 m, so the 80 m science block is fine on copper with a switch at each end, but the 140 m primary block exceeds the limit and needs fibre (or an intermediate switch/repeater). A central router connects the switched network to the ISP, and a firewall sits at that boundary.
2. The office holds fee-defaulter data on the same flat network as the student labs. What change addresses this, and what wireless and endpoint measures does the plan need?
Read the worked answer
Segment the network instead of relying on a shared folder's permissions. Put the 10 office machines on their own VLAN and subnet (for example 192.168.20.0/24) with the student labs and library on a separate VLAN (192.168.10.0/24). Inter-VLAN traffic then passes through the router or a Layer-3 switch, where an ACL or firewall rule blocks student-to-office traffic while allowing office-to-server and office-to-internet. Remove the open share; file-level permissions alone are too weak when any infected student machine can reach the share's SMB ports.
Wireless: the staff router needs WPA2 or WPA3 with a strong passphrase, changed default admin credentials and firmware updates. Hiding the SSID or filtering MAC addresses is not security - both are trivially bypassed - so do not count them. Put staff Wi-Fi on the office VLAN and a separate student SSID on the student VLAN, rate-limited.
The pen-drive ransomware shows why endpoint and recovery measures belong in the plan: disable or restrict removable-media autorun, keep antivirus current, patch the office PCs, apply least-privilege accounts so a teacher cannot encrypt the accounts machine's data, and keep offline or off-site backups with a tested restore. Backups are the only control that survives a successful infection. Finally, the firewall should block or throttle peer-to-peer traffic, or apply QoS so project-week downloads cannot saturate the 100 Mbps link.
3. The principal wants to host a fee-payment page on the office server. Explain what TCP/IP and HTTP do here and why HTTPS is non-negotiable.
Read the worked answer
TCP/IP is the layered suite that moves the data: IP addresses and routes packets between networks, and TCP runs on top, opening a connection, numbering segments, acknowledging them and retransmitting losses so the browser sees a complete, ordered stream. HTTP is the application-layer protocol that rides on that connection; it is a stateless request-response protocol, where the browser sends a method such as GET or POST and the server replies with a status code and content.
Plain HTTP sends that request in clear text. A parent typing a card number or password on the fee page is broadcasting it across the school's shared network and every hop to the server; anyone with a packet sniffer on the student VLAN could read it. HTTPS is HTTP carried inside TLS, which encrypts the content, authenticates the server with a certificate so a fake fee page cannot impersonate the school, and detects tampering. For a page handling money it is a requirement, not an upgrade.
Two further points belong in the plan: do not expose the office server directly to the internet - place it behind the firewall and publish only the single HTTPS port; and keep the server patched, because encryption protects data in transit, not a server with an unpatched flaw or a weak admin password.